killeros 2.0.17 → 2.0.18

package/CHANGELOG.md

@@ -4,6 +4,44 @@ All notable changes to KillerOS are documented here.
 
 ## [Unreleased]
 
+## [2.0.18] - 2026-08-24
+
+### Added
+
+- Added a real Pi SDK lifecycle test for package activation, shutdown-before-reload, fresh registration, and stale-context rejection.
+
+### Changed
+
+- Raised the locked Pi development packages and minimum supported Pi peer version to 0.84.3.
+- Made Pi lifecycle compatibility coverage install the generated npm tarball offline before activation and reload.
+
+### Fixed
+
+- Preserved provider-managed OAuth routing during `/handoff`, fixing GitHub Copilot `421 Misdirected Request` failures.
+- Repaired incompatible process-global `/codex-fast` state during extension updates while preserving a valid saved enabled flag.
+- Stopped lifecycle-hook failures from echoing configured shell commands, which could expose inline credentials in Pi diagnostics.
+- Kept lifecycle-hook configuration paths terminal-safe and single-line in warnings.
+- Limited trusted lifecycle-hook configuration to a 64 KiB regular, non-linked file in the project's real `.pi` directory and verified the opened file identity before parsing it.
+- Sanitized dynamic slash-command descriptions and omitted unsafe command names from KillerOS autocomplete.
+- Rejected explicit file goals when their starting filesystem baseline cannot be inspected instead of treating every error as a missing file.
+- Kept custom model and provider labels single-line and terminal-safe in the shell header and footer.
+- Sanitized model-reported `/init` policy conflicts before returning, storing, or notifying with them.
+- Kept session-storage failure details terminal-safe when an explicit goal pause falls back to in-memory state.
+- Stripped terminal commands and unsafe controls from saved goal objectives before clear confirmations.
+- Kept rejected `/variants` arguments terminal-safe and single-line in error notifications.
+- Kept provider and model identifiers terminal-safe and single-line throughout `/variants`.
+- Flushed partial UTF-8 lifecycle-hook output on process close instead of silently dropping final diagnostic bytes.
+- Contained synchronous lifecycle-hook process-start failures inside normal hook failure handling.
+- Kept header and footer paths single-line and terminal-safe for unusual cwd or home-directory names.
+- Sanitized manual-compaction abort diagnostics before saving recovery-eligible goal state.
+- Stripped terminal commands and unsafe controls from saved goal text before showing status panels or notifications.
+- Sanitized provider and storage diagnostics before persisting or announcing an automatically paused goal.
+- Routed handoff generation and session-replacement failures through the shared terminal-safe error reporter.
+- Stripped terminal commands and unsafe control bytes from caught errors before showing KillerOS failure notifications.
+- Stripped terminal commands and control bytes from cwd and session names before emitting the KillerOS terminal title.
+- Removed filesystem source paths from personal-instruction prompt wrappers so unusual project paths cannot alter prompt structure.
+- Stripped terminal commands and unsafe control bytes from lifecycle hook failure notifications and tool block reasons.
+
 ## [2.0.17] - 2026-08-23
 
 ### Added

package/README.md

@@ -19,7 +19,7 @@ A TypeScript extension for the [Pi coding agent](https://github.com/earendil-wor
 ## Requirements
 
 - Node.js 22.19.0+
-- Pi 0.84.2+
+- Pi 0.84.3+
 - An interactive TUI session for the custom header, editor, footer, `question`, and `/init`
 
 ## Install
@@ -34,7 +34,7 @@ Or from GitHub:
 pi install git:github.com/KyrosHendrix/pi-KillerOS
 ```
 
-Pin a release by appending its tag, for example `@v2.0.17`. Add `-l` to install only for the current project. Restart Pi after installing.
+Pin a release by appending its tag, for example `@v2.0.18`. Add `-l` to install only for the current project. Restart Pi after installing.
 
 ## Commands
 
@@ -85,7 +85,7 @@ Releases go through CI on `main`; do not push version tags manually.
 
 ## Security
 
-Pi extensions run with your user permissions. Review the source before installing globally. Hook commands run only for projects Pi marks as trusted; check `.pi/killeros-hooks.json` before enabling project trust.
+Pi extensions run with your user permissions. Review the source before installing globally. Hook commands run only for projects Pi marks as trusted; check `.pi/killeros-hooks.json` before enabling project trust. KillerOS accepts that configuration only as a regular, non-linked file no larger than 64 KiB in the project's real `.pi` directory.
 
 ## License
 

package/killeros/codex-fast-state.ts

@@ -7,14 +7,25 @@ interface CodexFastState {
 
 const GLOBAL_STATE_KEY = "__killerosCodexFastState";
 type GlobalWithCodexFastState = typeof globalThis & {
-  [GLOBAL_STATE_KEY]?: CodexFastState;
+  [GLOBAL_STATE_KEY]?: unknown;
 };
 
+// Accepts process-global state only when it is safe to reuse across extension versions.
+function isCodexFastState(value: unknown): value is CodexFastState {
+  return typeof value === "object" && value !== null
+    && "enabled" in value && typeof value.enabled === "boolean"
+    && "listeners" in value && value.listeners instanceof Set
+    && [...value.listeners].every((listener) => typeof listener === "function");
+}
+
 const globalState = globalThis as GlobalWithCodexFastState;
-const state = globalState[GLOBAL_STATE_KEY] ??= {
-  enabled: false,
+const savedState = globalState[GLOBAL_STATE_KEY];
+const state: CodexFastState = isCodexFastState(savedState) ? savedState : {
+  enabled: typeof savedState === "object" && savedState !== null
+    && "enabled" in savedState && savedState.enabled === true,
   listeners: new Set<CodexFastStateListener>(),
 };
+globalState[GLOBAL_STATE_KEY] = state;
 
 export function isCodexFastEnabled(): boolean {
   return state.enabled;

package/killeros/commands.ts

@@ -1,5 +1,6 @@
 import { type ExtensionAPI, type ExtensionCommandContext } from "@earendil-works/pi-coding-agent";
 import type { AutocompleteItem } from "@earendil-works/pi-tui";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 async function confirmNewSession(ctx: ExtensionCommandContext): Promise<boolean> {
   if (!ctx.hasUI) return true;
@@ -87,6 +88,11 @@ interface TaggedAutocompleteItem extends AutocompleteItem {
 const SLASH_COMMAND_PREFIX_PATTERN = /(?:^|[ \t])\/([^\s/]*)$/u;
 const SLASH_COMMAND_TOKEN_PATTERN = /(?:^|[ \t])\/([^\s/]+)(?=$|[ \t])/gu;
 
+function safeCommandName(name: string): string | undefined {
+  const safe = safeTerminalText(name).replaceAll("\n", "").trim();
+  return safe === name && safe && !/[\s/]/u.test(safe) ? safe : undefined;
+}
+
 export function getSlashCommandPrefix(line: string): { prefix: string; slashIndex: number } | undefined {
   const match = SLASH_COMMAND_PREFIX_PATTERN.exec(line);
   if (!match || match.index === undefined) return undefined;
@@ -107,7 +113,8 @@ export function findSlashCommandTokens(line: string): SlashCommandToken[] {
 }
 
 function commandNameFromAutocompleteItem(item: AutocompleteItem): string {
-  return (item.value || item.label).replace(/^\//u, "").trim().split(/\s+/u)[0] ?? "";
+  const name = (item.value || item.label).replace(/^\//u, "").trim().split(/\s+/u)[0] ?? "";
+  return safeCommandName(name) ?? "";
 }
 
 export function createSlashCommandResolver(
@@ -124,16 +131,20 @@ export function createSlashCommandResolver(
     }));
 
     for (const command of pi.getCommands()) {
+      const name = safeCommandName(command.name);
+      if (!name) continue;
       const category: CommandInfo["category"] = command.source === "skill"
         ? "Skill"
         : command.source === "prompt"
           ? "Prompt"
           : "Extension";
-      commands.set(command.name, {
-        name: command.name,
-        description: command.description,
+      commands.set(name, {
+        name,
+        description: command.description === undefined
+          ? undefined
+          : safeTerminalText(command.description).replaceAll("\n", " "),
         category,
-        syntaxHint: COMMAND_SYNTAX_HINTS[command.name],
+        syntaxHint: COMMAND_SYNTAX_HINTS[name],
       });
     }
 
@@ -142,7 +153,11 @@ export function createSlashCommandResolver(
       : fallbackCommands;
     for (const [name, description] of baseCommands) {
       if (name && !commands.has(name)) {
-        commands.set(name, { name, description, category: "Built-in" });
+        commands.set(name, {
+          name,
+          description: description === undefined ? undefined : safeTerminalText(description).replaceAll("\n", " "),
+          category: "Built-in",
+        });
       }
     }
     return commands;

package/killeros/display.ts

@@ -1,18 +1,21 @@
 import os from "node:os";
 import { truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
+/** Formats a terminal-safe, single-line project path with home abbreviation. */
 export function formatCwd(cwd: string): string {
-  const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
-  if (!home) return cwd;
+  const safeCwd = safeTerminalText(cwd).replaceAll("\n", "");
+  const home = safeTerminalText(process.env.HOME || process.env.USERPROFILE || os.homedir()).replaceAll("\n", "");
+  if (!home) return safeCwd;
   const normalizedHome = home.replace(/[\\/]+$/, "");
-  const normalizedCwd = cwd.replace(/[\\/]+$/, "");
+  const normalizedCwd = safeCwd.replace(/[\\/]+$/, "");
   const comparedHome = process.platform === "win32" ? normalizedHome.toLowerCase() : normalizedHome;
   const comparedCwd = process.platform === "win32" ? normalizedCwd.toLowerCase() : normalizedCwd;
   if (comparedCwd === comparedHome) return "~";
   const separator = normalizedCwd.slice(normalizedHome.length, normalizedHome.length + 1);
   return comparedCwd.startsWith(comparedHome) && (separator === "/" || separator === "\\")
     ? `~${normalizedCwd.slice(normalizedHome.length)}`
-    : cwd;
+    : safeCwd;
 }
 
 export function padRight(text: string, width: number): string {

package/killeros/errors.ts

@@ -1,8 +1,9 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 /** Converts unknown caught values into text suitable for user-facing errors. */
 export function errorMessage(error: unknown): string {
-  return error instanceof Error ? error.message : String(error);
+  return safeTerminalText(error instanceof Error ? error.message : String(error));
 }
 
 export function reportError(ctx: ExtensionContext, area: string, error: unknown): void {

package/killeros/footer.ts

@@ -4,6 +4,7 @@ import { isCodexFastEnabled, subscribeCodexFast } from "./codex-fast-state.ts";
 import { formatCwd, formatTime, formatTokens, padRight } from "./display.ts";
 import { goalElapsedMilliseconds } from "./goals.ts";
 import type { GoalRuntime, GoalState } from "./runtime.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 import { LEVEL_COLORS, type ThinkingLevel } from "./variants.ts";
 
 const FOOTER_REFRESH_INTERVAL_MS = 1_000;
@@ -76,7 +77,7 @@ const PROVIDER_WORDS: Readonly<Record<string, string>> = {
 };
 
 function formatProviderName(provider: string): string {
-  const normalized = provider.trim();
+  const normalized = safeTerminalText(provider).replaceAll("\n", "").trim();
   const known = PROVIDER_LABELS[normalized.toLowerCase()];
   if (known) return known;
   return normalized
@@ -87,7 +88,8 @@ function formatProviderName(provider: string): string {
 }
 
 function modelDisplayName(model: NonNullable<ExtensionContext["model"]>): string {
-  return model.name?.trim() || model.id;
+  const name = safeTerminalText(model.name ?? "").replaceAll("\n", "").trim();
+  return name || safeTerminalText(model.id).replaceAll("\n", "").trim() || "Unknown model";
 }
 
 export function formatModel(

package/killeros/goals.ts

@@ -118,8 +118,9 @@ function captureGoalFileBaseline(filePath: string): GoalFileBaseline {
   let artifact: ReturnType<typeof lstatSync>;
   try {
     artifact = lstatSync(filePath);
-  } catch {
-    return { exists: false };
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return { exists: false };
+    throw error;
   }
   const baseline = { exists: true as const, size: artifact.size, mtimeMs: artifact.mtimeMs };
   if (!artifact.isFile()) return baseline;
@@ -382,7 +383,7 @@ function goalStatusSummary(state: GoalState, ctx: ExtensionContext): string {
     state.objective,
   ];
   if (state.result) lines.push(state.result);
-  return lines.join("\n");
+  return safeTerminalText(lines.join("\n"));
 }
 
 export function pauseGoalAfterFailure(
@@ -394,13 +395,14 @@ export function pauseGoalAfterFailure(
   notify = true,
 ): void {
   if (runtime.state?.status !== "active") return;
+  const safeReason = safeTerminalText(reason);
   try {
-    transitionGoal(pi, runtime, "error", "paused", reason);
+    transitionGoal(pi, runtime, "error", "paused", safeReason);
   } catch {
     runtime.state = runtime.state ? {
       ...stopGoalClock(runtime.state, Date.now()),
       status: "paused",
-      result: reason,
+      result: safeReason,
       resumeAfterManualCompaction: undefined,
     } : undefined;
     syncGoalUpdateTool(pi, runtime);
@@ -409,7 +411,7 @@ export function pauseGoalAfterFailure(
     runtime.automaticCompaction = undefined;
     runtime.requestRender?.();
   }
-  if (notify) ctx.ui.notify(`Goal paused: ${reason}\n${recoveryInstruction}`, "error");
+  if (notify) ctx.ui.notify(`Goal paused: ${safeReason}\n${recoveryInstruction}`, "error");
 }
 
 function pauseGoalForPossibleManualCompaction(
@@ -419,15 +421,16 @@ function pauseGoalForPossibleManualCompaction(
   reason: string,
 ): void {
   if (runtime.state?.status !== "active") return;
+  const safeReason = safeTerminalText(reason);
   try {
-    transitionGoal(pi, runtime, "error", "paused", reason, {
+    transitionGoal(pi, runtime, "error", "paused", safeReason, {
       resumeAfterManualCompaction: true,
     });
   } catch {
     runtime.state = runtime.state ? {
       ...stopGoalClock(runtime.state, Date.now()),
       status: "paused",
-      result: reason,
+      result: safeReason,
       resumeAfterManualCompaction: true,
     } : undefined;
     syncGoalUpdateTool(pi, runtime);
@@ -587,7 +590,7 @@ function goalContinuationMessage(state: GoalState, ctx: ExtensionContext): strin
   if (ctx.isProjectTrusted()) {
     const personal = resolvePersonalInstructions(ctx.cwd);
     if (personal) {
-      sections.push(`<personal_instructions source=${JSON.stringify(personal.source)}>\n${personal.content}\n</personal_instructions>`);
+      sections.push(personal);
     }
   }
   return sections.join("\n\n");
@@ -793,7 +796,7 @@ export function registerGoal(
         const selected = await ctx.ui.select(goalStatusSummary(runtime.state, ctx), actions.map((action) => action.label));
         const action = actions.find((candidate) => candidate.label === selected);
         if (!action) return;
-        if (action.control === "clear" && !await ctx.ui.confirm("Clear goal?", runtime.state.objective)) return;
+        if (action.control === "clear" && !await ctx.ui.confirm("Clear goal?", safeTerminalText(runtime.state.objective))) return;
         await handleGoalCommand(action.control, ctx);
         return;
       }
@@ -878,7 +881,7 @@ export function registerGoal(
           transitionGoal(pi, runtime, "pause", "paused");
           saved = true;
         } catch (error) {
-          failureReason = `the requested pause could not be saved: ${error instanceof Error ? error.message : String(error)}`;
+          failureReason = safeTerminalText(`the requested pause could not be saved: ${error instanceof Error ? error.message : String(error)}`);
           pauseGoalAfterFailure(
             pi,
             runtime,
@@ -1038,21 +1041,21 @@ export function registerGoal(
         return;
       }
       const now = Date.now();
-      const state: GoalState = {
-        version: GOAL_VERSION,
-        revision: 1,
-        objective,
-        status: "active",
-        createdAt: now,
-        updatedAt: now,
-        activeMilliseconds: 0,
-        activeStartedAt: now,
-        turns: 0,
-        blockedAuditStartTurn: 0,
-        baselineTokens: sumGoalTokens(ctx),
-        verification: inferGoalVerification(objective),
-      };
       try {
+        const state: GoalState = {
+          version: GOAL_VERSION,
+          revision: 1,
+          objective,
+          status: "active",
+          createdAt: now,
+          updatedAt: now,
+          activeMilliseconds: 0,
+          activeStartedAt: now,
+          turns: 0,
+          blockedAuditStartTurn: 0,
+          baselineTokens: sumGoalTokens(ctx),
+          verification: inferGoalVerification(objective),
+        };
         persistGoalState(pi, runtime, unfinished ? "replace" : "set", state);
         if (scheduleGoalContinuation(pi, runtime, initState, ctx)) {
           ctx.ui.notify("Goal active. KillerOS will continue until completion, a repeated blocker, or pause.", "info");

package/killeros/handoff.ts

@@ -1,5 +1,6 @@
 import { contentText } from "@earendil-works/pi-ai";
 import { BorderedLoader, convertToLlm, type ExtensionAPI, type ExtensionCommandContext, serializeConversation, sessionEntryToContextMessages } from "@earendil-works/pi-coding-agent";
+import { reportError } from "./errors.ts";
 import type { GoalRuntime } from "./runtime.ts";
 import { safeTerminalText } from "./safe-terminal-text.ts";
 
@@ -81,12 +82,6 @@ function hasRequiredHandoffContent(document: string, focus: string): boolean {
   });
 }
 
-/** Reports a failed handoff through the session context that remains valid. */
-function reportHandoffError(ctx: ExtensionCommandContext, error: unknown): void {
-  const message = error instanceof Error ? error.message : String(error);
-  ctx.ui.notify(`Handoff failed: ${message}`, "error");
-}
-
 /** Generates and validates a handoff summary with optional cancellation. */
 async function generateHandoffSummary(
   ctx: ExtensionCommandContext,
@@ -96,9 +91,7 @@ async function generateHandoffSummary(
 ): Promise<string> {
   if (!ctx.model) throw new Error("No current model is available");
 
-  const auth = await ctx.modelRegistry.getApiKeyAndHeaders(ctx.model);
   signal?.throwIfAborted();
-  if (!auth.ok) throw new Error(auth.error);
 
   const response = await ctx.modelRegistry.complete(ctx.model, {
     systemPrompt: HANDOFF_SYSTEM_PROMPT,
@@ -108,9 +101,6 @@ async function generateHandoffSummary(
       timestamp: Date.now(),
     }],
   }, {
-    apiKey: auth.apiKey,
-    headers: auth.headers,
-    env: auth.env,
     maxTokens: 2_048,
     signal,
   });
@@ -173,7 +163,7 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime): voi
           throw new Error("The handoff summary did not contain every required section");
         }
       } catch (error) {
-        reportHandoffError(ctx, error);
+        reportError(ctx, "Handoff failed", error);
         return;
       }
 
@@ -191,7 +181,7 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime): voi
           },
           withSession: async (destination) => {
             if (setupFailure) {
-              reportHandoffError(destination, setupFailure.error);
+              reportError(destination, "Handoff failed", setupFailure.error);
               return;
             }
             destination.ui.notify("Handoff ready in a new session", "info");
@@ -199,7 +189,7 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime): voi
         });
       } catch (error) {
         try {
-          reportHandoffError(ctx, error);
+          reportError(ctx, "Handoff failed", error);
         } catch {
           throw error;
         }

package/killeros/hooks.ts

@@ -1,9 +1,10 @@
 import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
+import { closeSync, existsSync, fstatSync, lstatSync, openSync, readSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { StringDecoder } from "node:string_decoder";
 import { CONFIG_DIR_NAME, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { reportError } from "./errors.ts";
+import { errorMessage, reportError } from "./errors.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 type KillerosHookEvent = "tool_call" | "tool_result" | "agent_settled";
 
@@ -27,20 +28,67 @@ interface HookExecutionResult {
 }
 
 const HOOK_EVENTS: readonly KillerosHookEvent[] = ["tool_call", "tool_result", "agent_settled"];
+const HOOK_CONFIG_LIMIT = 64 * 1024;
 const HOOK_OUTPUT_LIMIT = 16 * 1024;
 const HOOK_PAYLOAD_LIMIT = 8_000;
 const HOOK_TIMEOUT_MAX_MS = 300_000;
 
+// Reads executable project configuration through a bounded, project-local file descriptor.
+function readHookConfig(configPath: string, projectRoot: string): string {
+  const actualPath = realpathSync(configPath);
+  const expectedPath = path.join(realpathSync(projectRoot), CONFIG_DIR_NAME, "killeros-hooks.json");
+  const samePath = process.platform === "win32"
+    ? actualPath.toLowerCase() === expectedPath.toLowerCase()
+    : actualPath === expectedPath;
+  if (!samePath) {
+    throw new Error("Hook config must be stored in the real project .pi directory");
+  }
+
+  const linkedFile = lstatSync(configPath);
+  if (!linkedFile.isFile() || linkedFile.nlink !== 1) {
+    throw new Error("Hook config must be a regular, non-linked file");
+  }
+  if (linkedFile.size > HOOK_CONFIG_LIMIT) {
+    throw new Error(`Hook config exceeds ${HOOK_CONFIG_LIMIT} bytes`);
+  }
+
+  const descriptor = openSync(configPath, "r");
+  try {
+    const openedFile = fstatSync(descriptor);
+    if (!openedFile.isFile() || openedFile.nlink !== 1) {
+      throw new Error("Hook config must be a regular, non-linked file");
+    }
+    if (openedFile.dev !== linkedFile.dev || openedFile.ino !== linkedFile.ino) {
+      throw new Error("Hook config changed while being opened");
+    }
+
+    const contents = Buffer.alloc(HOOK_CONFIG_LIMIT + 1);
+    let bytesRead = 0;
+    while (bytesRead < contents.length) {
+      const count = readSync(descriptor, contents, bytesRead, contents.length - bytesRead, null);
+      if (count === 0) break;
+      bytesRead += count;
+    }
+    if (bytesRead > HOOK_CONFIG_LIMIT) {
+      throw new Error(`Hook config exceeds ${HOOK_CONFIG_LIMIT} bytes`);
+    }
+    return contents.toString("utf8", 0, bytesRead);
+  } finally {
+    closeSync(descriptor);
+  }
+}
+
 function loadKillerosHooks(ctx: ExtensionContext): KillerosHookConfig {
   const configPath = path.join(ctx.cwd, CONFIG_DIR_NAME, "killeros-hooks.json");
   if (!existsSync(configPath)) return {};
+  const displayPath = safeTerminalText(configPath).replaceAll("\n", "");
   if (!ctx.isProjectTrusted()) {
-    ctx.ui.notify(`Ignored untrusted project hooks in ${configPath}`, "warning");
+    ctx.ui.notify(`Ignored untrusted project hooks in ${displayPath}`, "warning");
     return {};
   }
 
   try {
-    const parsed = JSON.parse(readFileSync(configPath, "utf8")) as KillerosHookConfig;
+    const parsed = JSON.parse(readHookConfig(configPath, ctx.cwd)) as KillerosHookConfig;
     const hooks: KillerosHookConfig["hooks"] = {};
     for (const event of HOOK_EVENTS) {
       const candidates = parsed.hooks?.[event];
@@ -59,7 +107,7 @@ function loadKillerosHooks(ctx: ExtensionContext): KillerosHookConfig {
           && hook.command.trim().length > 0
           && (hook.matcher === undefined || typeof hook.matcher === "string");
         if (!valid) {
-          ctx.ui.notify(`Ignored invalid ${event} hook ${index + 1} in ${configPath}`, "warning");
+          ctx.ui.notify(`Ignored invalid ${event} hook ${index + 1} in ${displayPath}`, "warning");
           return false;
         }
         if (hook.matcher && hook.matcher !== "*") {
@@ -140,8 +188,9 @@ export function executeHook(
   if (signal?.aborted) {
     return Promise.resolve({ code: 130, stdout: "", stderr: "", timedOut: false, cancelled: true, exitUnconfirmed: false });
   }
-  return new Promise((resolve) => {
-    const child = spawnProcess(command, {
+  let child;
+  try {
+    child = spawnProcess(command, {
       cwd,
       env: { ...process.env, ...environment },
       detached: process.platform !== "win32",
@@ -149,6 +198,10 @@ export function executeHook(
       stdio: ["ignore", "pipe", "pipe"],
       windowsHide: true,
     });
+  } catch (error) {
+    return Promise.resolve({ code: 1, stdout: "", stderr: errorMessage(error), timedOut: false, cancelled: false, exitUnconfirmed: false });
+  }
+  return new Promise((resolve) => {
     const stdout: HookOutputBuffer = { bytes: 0, decoder: new StringDecoder("utf8"), text: "" };
     const stderr: HookOutputBuffer = { bytes: 0, decoder: new StringDecoder("utf8"), text: "" };
     let completed = false;
@@ -163,6 +216,8 @@ export function executeHook(
       if (forceTimer) clearTimeout(forceTimer);
       if (settleTimer) clearTimeout(settleTimer);
       signal?.removeEventListener("abort", abort);
+      stdout.text += stdout.decoder.end();
+      stderr.text += stderr.decoder.end();
       resolve({
         code,
         stdout: stdout.text,
@@ -212,9 +267,9 @@ function hookEnvironment(event: KillerosHookEvent, toolName = "", payload: unkno
   };
 }
 
-function hookFailureMessage(hook: KillerosHook, result: HookExecutionResult): string {
+function hookFailureMessage(result: HookExecutionResult): string {
   const detail = result.stderr.trim() || result.stdout.trim() || `exit code ${result.code}`;
-  return `Hook failed${result.timedOut ? " (timed out)" : ""}${result.exitUnconfirmed ? " (process exit unconfirmed)" : ""}: ${hook.command}\n${detail}`;
+  return safeTerminalText(`Hook failed${result.timedOut ? " (timed out)" : ""}${result.exitUnconfirmed ? " (process exit unconfirmed)" : ""}\n${detail}`);
 }
 
 export function registerLifecycleHooks(pi: ExtensionAPI): void {
@@ -234,7 +289,7 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
       );
       if (result.cancelled) return { block: true, reason: "Hook cancelled because the parent request was aborted" };
       if (result.code !== 0) {
-        const reason = hookFailureMessage(hook, result);
+        const reason = hookFailureMessage(result);
         ctx.ui.notify(reason, "error");
         return { block: true, reason };
       }
@@ -256,7 +311,7 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
         ctx.signal,
       );
       if (result.cancelled) break;
-      if (result.code !== 0) ctx.ui.notify(hookFailureMessage(hook, result), "error");
+      if (result.code !== 0) ctx.ui.notify(hookFailureMessage(result), "error");
     }
   });
 
@@ -271,7 +326,7 @@ export function registerLifecycleHooks(pi: ExtensionAPI): void {
         ctx.signal,
       );
       if (result.cancelled) break;
-      if (result.code !== 0) ctx.ui.notify(hookFailureMessage(hook, result), "error");
+      if (result.code !== 0) ctx.ui.notify(hookFailureMessage(result), "error");
     }
   });
 }

package/killeros/init.ts

@@ -17,6 +17,7 @@ import {
   validateGeneratedGuidance,
 } from "./init-target.ts";
 import { resetInitRuntime, type GoalRuntime, type InitOutcome, type InitRuntime } from "./runtime.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 const INIT_WRITE_TOOL = "killeros_init_write";
 const INIT_CONFLICT_TOOL = "killeros_init_conflict";
@@ -124,8 +125,9 @@ export function registerInitCommand(pi: ExtensionAPI, initState: InitRuntime, go
     executionMode: "sequential",
     async execute(_toolCallId, { reason }) {
       requirePending(initState);
-      initState.outcome = { kind: "policy-conflict", reason };
-      return { content: [{ type: "text" as const, text: `Root AGENTS.md was left unchanged: ${reason}` }], details: { reason } };
+      const safeReason = safeTerminalText(reason);
+      initState.outcome = { kind: "policy-conflict", reason: safeReason };
+      return { content: [{ type: "text" as const, text: `Root AGENTS.md was left unchanged: ${safeReason}` }], details: { reason: safeReason } };
     },
   });
 

package/killeros/notifications.ts

@@ -5,6 +5,7 @@ import {
   type ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
 import { errorMessage } from "./errors.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 import { createKillerosSettingsStore } from "./settings.ts";
 
 export interface NotificationPreferenceStore {
@@ -38,7 +39,7 @@ export function formatNotificationTitle(
 ): string {
   const directory = basename(cwd) || cwd;
   const base = sessionName ? `π - ${sessionName} - ${directory}` : `π - ${directory}`;
-  return enabled ? `${base} ${COMPLETION_BELL_GLYPH}` : base;
+  return safeTerminalText(enabled ? `${base} ${COMPLETION_BELL_GLYPH}` : base).replaceAll("\n", "");
 }
 
 export function registerCompletionNotifications(

package/killeros/personal-instructions.ts

@@ -34,20 +34,21 @@ function readBoundedText(filePath: string, limit = PERSONAL_INSTRUCTIONS_LIMIT):
   }
 }
 
-export function resolvePersonalInstructions(cwd: string): { content: string; source: string } | undefined {
+export function resolvePersonalInstructions(cwd: string): string | undefined {
   const localPath = path.join(cwd, PERSONAL_INSTRUCTIONS_FILE);
   const local = readBoundedText(localPath);
   if (!local) return undefined;
 
   const importMatch = local.trim().match(/^@(.+)$/u);
-  if (!importMatch) return { content: local, source: localPath };
-
-  const requestedPath = importMatch[1]!.trim();
-  const importedPath = requestedPath.startsWith("~/") || requestedPath.startsWith("~\\")
-    ? path.join(os.homedir(), requestedPath.slice(2))
-    : path.resolve(cwd, requestedPath);
-  const imported = readBoundedText(importedPath);
-  return imported ? { content: imported, source: importedPath } : { content: local, source: localPath };
+  let content = local;
+  if (importMatch) {
+    const requestedPath = importMatch[1]!.trim();
+    const importedPath = requestedPath.startsWith("~/") || requestedPath.startsWith("~\\")
+      ? path.join(os.homedir(), requestedPath.slice(2))
+      : path.resolve(cwd, requestedPath);
+    content = readBoundedText(importedPath) ?? local;
+  }
+  return `<personal_instructions>\n${content}\n</personal_instructions>`;
 }
 
 export function registerPersonalInstructions(pi: ExtensionAPI, initState: InitRuntime): void {
@@ -59,9 +60,7 @@ export function registerPersonalInstructions(pi: ExtensionAPI, initState: InitRu
       systemPrompt: [
         event.systemPrompt,
         "",
-        `<personal_instructions source="${personal.source}">`,
-        personal.content,
-        "</personal_instructions>",
+        personal,
       ].join("\n"),
     };
   });

package/killeros/variants.ts

@@ -1,5 +1,6 @@
 import { DynamicBorder, type ExtensionAPI, type ExtensionContext, type ThemeColor } from "@earendil-works/pi-coding-agent";
 import { SelectList, truncateToWidth } from "@earendil-works/pi-tui";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export type ThinkingLevel = ReturnType<ExtensionAPI["getThinkingLevel"]>;
 
@@ -60,7 +61,7 @@ function supportedLevels(model: ExtensionContext["model"]): ThinkingLevel[] {
 }
 
 function modelLabel(model: ExtensionContext["model"]): string {
-  return model ? `${model.provider}/${model.id}` : "unknown model";
+  return model ? safeTerminalText(`${model.provider}/${model.id}`).replaceAll("\n", "") : "unknown model";
 }
 
 export function registerVariants(pi: ExtensionAPI): void {
@@ -80,7 +81,7 @@ export function registerVariants(pi: ExtensionAPI): void {
       if (args.trim()) {
         const level = resolveThinkingLevel(args);
         if (!level) {
-          ctx.ui.notify(`Unknown reasoning level "${args.trim()}". Use: ${ALL_LEVELS.join(", ")}`, "error");
+          ctx.ui.notify(`Unknown reasoning level "${safeTerminalText(args.trim()).replaceAll("\n", "")}". Use: ${ALL_LEVELS.join(", ")}`, "error");
           return;
         }
         setLevel(ctx, level);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "2.0.17",
+  "version": "2.0.18",
   "description": "TUI, goals, and workflow automation for the Pi coding agent",
   "type": "module",
   "keywords": [
@@ -42,15 +42,15 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.84.2",
-    "@earendil-works/pi-coding-agent": ">=0.84.2",
-    "@earendil-works/pi-tui": ">=0.84.2",
+    "@earendil-works/pi-ai": ">=0.84.3",
+    "@earendil-works/pi-coding-agent": ">=0.84.3",
+    "@earendil-works/pi-tui": ">=0.84.3",
     "typebox": ">=1.1.38 <2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.84.2",
-    "@earendil-works/pi-coding-agent": "0.84.2",
-    "@earendil-works/pi-tui": "0.84.2",
+    "@earendil-works/pi-ai": "0.84.3",
+    "@earendil-works/pi-coding-agent": "0.84.3",
+    "@earendil-works/pi-tui": "0.84.3",
     "@types/node": "24.12.4",
     "typebox": "1.1.38",
     "typescript": "5.9.3"