killeros 2.1.28 → 2.1.30

package/CHANGELOG.md

@@ -4,6 +4,35 @@ All notable changes to KillerOS are documented here.
 
 ## [Unreleased]
 
+## [2.1.30] - 2026-09-21
+
+### Added
+
+- Added measured assistant output-token throughput to settled worked-for receipts, excluding first-token latency, tool execution, and gaps between model calls.
+
+### Fixed
+
+- Prevented competing stale-settings-lock recovery attempts from removing a new writer's lock and losing settings updates.
+- Recorded change receipts in repositories using Git's reftable reference backend while still rejecting receipts when `HEAD` moves during a response.
+- Serialized global `killeros.json` updates across Pi processes so concurrent automatic-compaction and notification changes no longer discard successful writes or fail during Windows file replacement.
+- Accepted `/handoff` summaries with `## ` lines inside fenced code blocks instead of rejecting the complete summary for an extra section.
+- Changed the footer's `ctx` percentage to show context remaining, matching `/auto-compact` threshold direction while preserving urgency colors and the `/compact` hint.
+- Reported `/goal` objectives with unsupported terminal content separately from the 4,000-character limit.
+
+## [2.1.29] - 2026-09-19
+
+### Added
+
+- Added `/auto-compact [status|on|off|<percent>]` to inspect and update the global automatic compaction preference without restarting Pi.
+
+### Fixed
+
+- Kept normalized CRLF checkouts clean in passive Git scans while respecting text attributes and binary files without running filters.
+- Detected same-size tracked-file rewrites even when tools restore the indexed modification time.
+- Resolved change-receipt repository ownership at the start of every response so nested or replaced repositories cannot reuse a stale monitor.
+- Kept the 100% automatic-compaction threshold active for later user requests and goal turns without compacting the generated ordinary continuation.
+- Prevented automatic footer and change-receipt scans from starting clean or process filters, including filters added and removed while a scan is running.
+
 ## [2.1.28] - 2026-09-15
 
 ### Changed

package/README.md

@@ -8,7 +8,7 @@ A TypeScript extension for the [Pi coding agent](https://github.com/earendil-wor
 - `/goal`: set an objective and Pi keeps working toward it across turns, compaction, reloads, and branch navigation. Each turn must record `continue` with evidence and one next action, `complete`, or the existing blocker decision; otherwise the goal pauses. New goals pause after 20 turns; `/goal resume` grants another 20.
 - `/codex-fast`: toggles the `priority` service tier on Codex requests or reports its status.
 - `/handoff`: starts a fresh linked session carrying visible continuation context.
-- Automatic context compaction when remaining tokens drop below 15% of the window (configurable).
+- `/auto-compact`: reports, enables, disables, or tunes automatic context compaction.
 - A `question` tool with single-select and multi-select modes.
 - Lifecycle hooks (`tool_call`, `tool_result`, `agent_settled`) from `.pi/killeros-hooks.json`, plus `AGENTS.local.md` loading for trusted projects.
 - Optional completion sounds for settled requests.
@@ -32,7 +32,7 @@ Or from GitHub:
 pi install git:github.com/KyrosHendrix/pi-KillerOS
 ```
 
-Pin a release by appending its tag, for example `@v2.1.28`. Add `-l` to install only for the current project. Restart Pi after installing.
+Pin a release by appending its tag, for example `@v2.1.30`. Add `-l` to install only for the current project. Restart Pi after installing.
 
 ## Commands
 
@@ -43,6 +43,8 @@ Pin a release by appending its tag, for example `@v2.1.28`. Add `-l` to install
 /goal resume              Resume automatic continuation
 /goal clear               Remove the current goal
 /codex-fast [status]      Toggle or report Codex fast mode
+/auto-compact [status|on|off|<percent>]
+                          Inspect or change automatic compaction
 /notification             Configure the completion sound
 /handoff [focus]          Fresh session with continuation context
 /clear                    New session after confirmation
@@ -71,6 +73,8 @@ The packaged `killeros` theme activates on TUI start. Compaction triggers by def
 }
 ```
 
+Use `/auto-compact status` to inspect the effective KillerOS preference, `/auto-compact on` or `/auto-compact off` to toggle it, and `/auto-compact <percent>` to set an integer threshold from 0 through 100. A threshold of 0 does not disable Pi's own token reserve.
+
 `handoffMaxTokens` caps the `/handoff` summary output at 8192 tokens by default; raise it when long sessions truncate the summary.
 
 State proof in the objective so the agent can verify it with its normal tools:

package/killeros/auto-compaction.ts

@@ -7,7 +7,8 @@ import {
   type ExtensionContext,
 } from "@earendil-works/pi-coding-agent";
 import { errorMessage } from "./errors.ts";
-import { createKillerosSettingsStore } from "./settings.ts";
+import { GOAL_CONTINUATION_TYPE } from "./goal-runtime.ts";
+import { createKillerosSettingsStore, type KillerosSettingsStore } from "./settings.ts";
 
 export const DEFAULT_AUTO_COMPACTION_PERCENT_REMAINING = 15;
 export const AUTO_COMPACTION_MESSAGE_TYPE = "killeros-auto-compaction";
@@ -32,6 +33,7 @@ export interface AutoCompactionGoalHandlers {
 export interface AutoCompactionDependencies {
   loadPreference?: (ctx: ExtensionContext) => AutoCompactionPreference;
   getCompactionSettings?: (ctx: ExtensionContext) => CompactionSettings;
+  settingsStore?: KillerosSettingsStore;
   goal?: AutoCompactionGoalHandlers;
 }
 
@@ -66,8 +68,8 @@ export function readAutoCompactionPreference(
   };
 }
 
-function defaultPreference(): AutoCompactionPreference {
-  return readAutoCompactionPreference(createKillerosSettingsStore().load());
+function defaultPreference(store: KillerosSettingsStore): AutoCompactionPreference {
+  return readAutoCompactionPreference(store.load());
 }
 
 function defaultCompactionSettings(ctx: ExtensionContext): CompactionSettings {
@@ -115,18 +117,60 @@ export function registerAutoCompaction(
   pi: ExtensionAPI,
   dependencies: AutoCompactionDependencies = {},
 ): void {
-  const loadPreference = dependencies.loadPreference ?? (() => defaultPreference());
+  const settingsStore = dependencies.settingsStore ?? createKillerosSettingsStore();
+  const loadPreference = dependencies.loadPreference ?? (() => defaultPreference(settingsStore));
   const getCompactionSettings = dependencies.getCompactionSettings ?? defaultCompactionSettings;
   let request: AutoCompactionRequest | undefined;
   let armed = true;
+  let rearmOnNextLogicalRequest = false;
   let settingsErrorReported = false;
 
   const resetForLifecycle = (): void => {
     request = undefined;
     armed = true;
+    rearmOnNextLogicalRequest = false;
     settingsErrorReported = false;
   };
 
+  pi.registerCommand("auto-compact", {
+    description: "Inspect or change automatic compaction",
+    handler: async (args, ctx) => {
+      const argument = args.trim();
+      if (!argument || argument === "status") {
+        try {
+          const preference = readAutoCompactionPreference(settingsStore.load());
+          ctx.ui.notify(preference.enabled
+            ? `Automatic compaction: on at ${preference.percentRemaining}% remaining`
+            : `Automatic compaction: off (threshold ${preference.percentRemaining}%)`, "info");
+        } catch (error) {
+          ctx.ui.notify(`Automatic compaction setting could not be read: ${errorMessage(error)}`, "error");
+        }
+        return;
+      }
+
+      const percent = /^\d+$/u.test(argument) ? Number(argument) : undefined;
+      if (argument !== "on" && argument !== "off" && (percent === undefined || percent > 100)) {
+        ctx.ui.notify("Usage: /auto-compact [status|on|off|<percent 0-100>]", "error");
+        return;
+      }
+
+      try {
+        const preference = readAutoCompactionPreference(settingsStore.load());
+        const updated = percent === undefined
+          ? { ...preference, enabled: argument === "on" }
+          : { ...preference, percentRemaining: percent };
+        settingsStore.update({ autoCompaction: updated });
+        ctx.ui.notify(percent === undefined
+          ? updated.enabled
+            ? `Automatic compaction: on at ${updated.percentRemaining}% remaining`
+            : `Automatic compaction: off (threshold ${updated.percentRemaining}%)`
+          : `Automatic compaction threshold: ${percent}% remaining (${updated.enabled ? "on" : "off"})`, "info");
+      } catch (error) {
+        ctx.ui.notify(`Automatic compaction setting could not be saved: ${errorMessage(error)}`, "error");
+      }
+    },
+  });
+
   const notifyFailure = (ctx: ExtensionContext, error: unknown): void => {
     ctx.ui.notify(`Automatic compaction failed: ${errorMessage(error)}`, "error");
   };
@@ -250,6 +294,7 @@ export function registerAutoCompaction(
       ctx.compact({
         onComplete: () => {
           if (request?.phase !== "compacting" || request.token !== token) return;
+          rearmOnNextLogicalRequest = preference.percentRemaining === 100;
           if (goal && dependencies.goal) {
             request = undefined;
             try {
@@ -280,9 +325,15 @@ export function registerAutoCompaction(
     finalizeOrdinaryContinuation(ctx, request.token);
   });
   pi.on("message_start", (event) => {
-    if (request?.phase === "continuation-dispatched"
-      && event.message.role === "custom"
-      && event.message.customType === AUTO_COMPACTION_MESSAGE_TYPE) request = undefined;
+    const isOrdinaryContinuation = event.message.role === "custom"
+      && event.message.customType === AUTO_COMPACTION_MESSAGE_TYPE;
+    if (request?.phase === "continuation-dispatched" && isOrdinaryContinuation) request = undefined;
+    const startsNewLogicalRequest = event.message.role === "user"
+      || (event.message.role === "custom" && event.message.customType === GOAL_CONTINUATION_TYPE);
+    if (rearmOnNextLogicalRequest && startsNewLogicalRequest) {
+      armed = true;
+      rearmOnNextLogicalRequest = false;
+    }
   });
 
   pi.on("session_start", resetForLifecycle);

package/killeros/change-receipt.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createReadStream, watch } from "node:fs";
-import { PASSIVE_GIT_CONFIG_ARGS, passiveGitCommand, passiveGitEnv, passiveStatusSafetyArgs, samePassiveFilters } from "./passive-git-status.ts";
+import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveWorktreeFile as DirtyFile } from "./passive-git-status.ts";
 import { lstat, open, readlink } from "node:fs/promises";
 import path from "node:path";
 import { createInflate } from "node:zlib";
@@ -140,44 +140,22 @@ type Repository = {
   blobCache: Map<string, Buffer>;
   blobCacheBytes: number;
 };
-const repositoryCache = new Map<string, Promise<Repository>>();
-
 async function repository(cwd: string): Promise<Repository> {
-  const cached = repositoryCache.get(cwd);
-  if (cached) return cached;
-  const pending = (async () => {
-    const result = decode(await runGit(cwd, ["rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir"])).trimEnd().split(/\r?\n/u);
-    const [root, gitDirectory, commonDirectory] = result;
-    if (!root || !gitDirectory || !commonDirectory) throw new GitFailure("error");
-    return {
-      root,
-      gitDirectory,
-      commonDirectory,
-      objectDirectory: path.join(commonDirectory, "objects"),
-      blobCache: new Map(),
-      blobCacheBytes: 0,
-    };
-  })();
-  repositoryCache.set(cwd, pending);
-  try {
-    return await pending;
-  } catch (error) {
-    repositoryCache.delete(cwd);
-    throw error;
-  }
+  const result = decode(await runGit(cwd, [
+    "rev-parse", "--path-format=absolute", "--show-toplevel", "--git-dir", "--git-common-dir", "--git-path", "objects",
+  ])).trimEnd().split(/\r?\n/u);
+  const [root, gitDirectory, commonDirectory, objectDirectory] = result;
+  if (!root || !gitDirectory || !commonDirectory || !objectDirectory) throw new GitFailure("error");
+  return {
+    root,
+    gitDirectory,
+    commonDirectory,
+    objectDirectory,
+    blobCache: new Map(),
+    blobCacheBytes: 0,
+  };
 }
 
-type DirtyFile = {
-  path: string;
-  headMode?: string;
-  headObjectId?: string;
-  indexMode?: string;
-  indexObjectId?: string;
-  mode?: string;
-  content?: Buffer;
-  contentObjectId?: string;
-};
-
 async function readBoundedFile(filePath: string, limit: number): Promise<Buffer> {
   const handle = await open(filePath, "r");
   try {
@@ -198,47 +176,6 @@ async function readBoundedFile(filePath: string, limit: number): Promise<Buffer>
   }
 }
 
-async function readSnapshotFiles(repo: Repository, files: Map<string, DirtyFile>): Promise<void> {
-  const pending = [...files.values()].filter((file) => file.mode && !file.contentObjectId);
-  let totalBytes = 0;
-  let nextIndex = 0;
-  const readNext = async (): Promise<void> => {
-    while (nextIndex < pending.length) {
-      const file = pending[nextIndex];
-      nextIndex += 1;
-      if (!file?.mode) continue;
-      const absolutePath = path.join(repo.root, ...file.path.split("/"));
-      if (file.mode === "120000") {
-        const content = Buffer.from(await readlink(absolutePath));
-        totalBytes += content.length;
-        if (totalBytes > SNAPSHOT_CONTENT_LIMIT) throw new GitFailure("too-large");
-        file.content = content;
-        continue;
-      }
-      const handle = await open(absolutePath, "r");
-      try {
-        const stats = await handle.stat();
-        if (!stats.isFile()) throw new GitFailure("error");
-        totalBytes += stats.size;
-        if (totalBytes > SNAPSHOT_CONTENT_LIMIT) throw new GitFailure("too-large");
-        const content = Buffer.alloc(stats.size + 1);
-        let length = 0;
-        while (length < content.length) {
-          const { bytesRead } = await handle.read(content, length, content.length - length, length);
-          if (bytesRead === 0) break;
-          length += bytesRead;
-        }
-        if (length > stats.size) throw new GitFailure("error");
-        totalBytes -= stats.size - length;
-        file.content = content.subarray(0, length);
-      } finally {
-        await handle.close();
-      }
-    }
-  };
-  await Promise.all(Array.from({ length: Math.min(8, pending.length) }, readNext));
-}
-
 type Snapshot = { head: string; files: Map<string, DirtyFile> };
 type RepositoryMonitor = {
   changedPaths: Set<string>;
@@ -253,59 +190,23 @@ const repositoryMonitors = new Map<string, RepositoryMonitor>();
 
 function discardMonitor(monitor: RepositoryMonitor): void {
   for (const watcher of monitor.watchers) watcher.close();
-  repositoryMonitors.delete(monitor.repo.root);
+  if (repositoryMonitors.get(monitor.repo.root) === monitor) repositoryMonitors.delete(monitor.repo.root);
 }
 
-async function snapshot(repo: Repository, paths?: readonly string[]): Promise<Snapshot> {
-  const config = decode(await runGit(repo.root, PASSIVE_GIT_CONFIG_ARGS));
-  const safetyArgs = passiveStatusSafetyArgs(config);
-  if (!safetyArgs) throw new GitFailure("error");
-  const output = decode(await runGit(repo.root, [
-    ...safetyArgs,
-    "status", "--porcelain=v2", "--branch", "--no-ahead-behind", "-z", "--no-renames", "--untracked-files=all", "--ignore-submodules=all",
-    ...(paths ? ["--", ...paths] : []),
-  ]));
-  if (!samePassiveFilters(config, decode(await runGit(repo.root, PASSIVE_GIT_CONFIG_ARGS)))) throw new GitFailure("error");
-  const records = output.split("\0").filter(Boolean);
-  const headRecord = records.find((record) => record.startsWith("# branch.oid "));
-  if (!headRecord) throw new Error("missing HEAD state");
-  const files = new Map<string, DirtyFile>();
-  for (const record of records) {
-    if (record.startsWith("# ")) continue;
-    if (record.startsWith("u ")) throw new Error("unmerged index");
-    if (record.startsWith("? ")) {
-      const filePath = record.slice(2);
-      if (!filePath || filePath.endsWith("/")) continue;
-      const stats = await lstat(path.join(repo.root, ...filePath.split("/")));
-      files.set(filePath, {
-        ...files.get(filePath),
-        path: filePath,
-        indexMode: undefined,
-        indexObjectId: undefined,
-        mode: stats.isSymbolicLink() ? "120000" : stats.mode & 0o111 ? "100755" : "100644",
-        contentObjectId: undefined,
-      });
-      continue;
-    }
-    const match = /^1 (\S{2}) \S+ ([0-7]{6}) ([0-7]{6}) ([0-7]{6}) ([0-9a-f]+) ([0-9a-f]+) (.*)$/su.exec(record);
-    if (!match) throw new Error("invalid status record");
-    const [, status, headMode, indexMode, worktreeMode, headObjectId, indexObjectId, filePath] = match;
-    if (!status || !headMode || !indexMode || !worktreeMode || !headObjectId || !indexObjectId || !filePath) throw new Error("incomplete status record");
-    const worktreeChanged = status[1] !== ".";
-    const selectedMode = worktreeChanged ? worktreeMode : indexMode;
-    files.set(filePath, {
-      ...files.get(filePath),
-      path: filePath,
-      headMode: headMode === "000000" ? undefined : headMode,
-      headObjectId: /^0+$/u.test(headObjectId) ? undefined : headObjectId,
-      indexMode: indexMode === "000000" ? undefined : indexMode,
-      indexObjectId: /^0+$/u.test(indexObjectId) ? undefined : indexObjectId,
-      mode: selectedMode === "000000" ? undefined : selectedMode,
-      contentObjectId: worktreeChanged || /^0+$/u.test(indexObjectId) ? undefined : indexObjectId,
-    });
+function sameRepository(left: Repository, right: Repository): boolean {
+  return left.root === right.root
+    && left.gitDirectory === right.gitDirectory
+    && left.commonDirectory === right.commonDirectory
+    && left.objectDirectory === right.objectDirectory;
+}
+
+async function snapshot(repo: Repository): Promise<Snapshot> {
+  try {
+    return await inspectWorktreeWithoutFilters(repo.root, (args) => runGit(repo.root, args));
+  } catch (error) {
+    if (error instanceof Error && error.message === "worktree content limit exceeded") throw new GitFailure("too-large");
+    throw error;
   }
-  await readSnapshotFiles(repo, files);
-  return { head: headRecord.slice("# branch.oid ".length), files };
 }
 
 async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: readonly string[]): Promise<Snapshot | undefined> {
@@ -333,24 +234,18 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
 }
 
 async function currentHead(repo: Repository): Promise<string> {
-  const head = (await readBoundedFile(path.join(repo.gitDirectory, "HEAD"), 4_096)).toString("ascii").trim();
-  if (/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) return head;
-  const match = /^ref: (refs\/[^\0\r\n]+)$/u.exec(head);
-  const reference = match?.[1];
-  if (!reference || reference.includes("\\") || reference.split("/").some((part) => part === "." || part === "..")) throw new GitFailure("error");
-  try {
-    return (await readBoundedFile(path.join(repo.commonDirectory, ...reference.split("/")), 4_096)).toString("ascii").trim();
-  } catch (error) {
-    if (!missingFile(error)) throw error;
-  }
+  let resolved: Buffer;
   try {
-    const packed = (await readBoundedFile(path.join(repo.commonDirectory, "packed-refs"), GIT_OUTPUT_LIMIT)).toString("ascii");
-    const packedMatch = new RegExp(`^([0-9a-f]{40}(?:[0-9a-f]{24})?) ${reference.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&")}$`, "mu").exec(packed);
-    return packedMatch?.[1] ?? "(initial)";
+    resolved = await runGit(repo.root, ["rev-parse", "--verify", "HEAD"], undefined, 4_096);
   } catch (error) {
-    if (missingFile(error)) return "(initial)";
-    throw error;
+    if (!(error instanceof GitFailure) || error.reason !== "error") throw error;
+    const reference = decode(await runGit(repo.root, ["symbolic-ref", "--quiet", "HEAD"], undefined, 4_096)).trim();
+    if (!/^refs\/[^\0\r\n]+$/u.test(reference)) throw new GitFailure("error");
+    return "(initial)";
   }
+  const head = decode(resolved).trim();
+  if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new GitFailure("error");
+  return head;
 }
 
 function observes(filePath: string, observedPaths: readonly string[]): boolean {
@@ -360,7 +255,8 @@ function observes(filePath: string, observedPaths: readonly string[]): boolean {
 async function refreshSnapshot(monitor: RepositoryMonitor, observedPaths: readonly string[], current = monitor.snapshot): Promise<Snapshot> {
   if (monitor.watchFailed || observedPaths.length > 200) return snapshot(monitor.repo);
   if (observedPaths.length === 0) return current;
-  const scoped = await snapshotKnownPaths(monitor.repo, current, observedPaths) ?? await snapshot(monitor.repo, observedPaths);
+  const scoped = await snapshotKnownPaths(monitor.repo, current, observedPaths);
+  if (!scoped) return snapshot(monitor.repo);
   const files = new Map(current.files);
   for (const filePath of files.keys()) {
     if (observes(filePath, observedPaths)) files.delete(filePath);
@@ -714,11 +610,17 @@ export async function beginChangeReceipt(cwd: string, trusted = true): Promise<C
     };
   }
   try {
-    const repo = await repository(cwd);
+    let repo = await repository(cwd);
     let monitor = repositoryMonitors.get(repo.root);
+    if (monitor && !sameRepository(monitor.repo, repo)) {
+      discardMonitor(monitor);
+      monitor = undefined;
+    }
     if (!monitor) {
       monitor = createMonitor(repo, await snapshot(repo));
       repositoryMonitors.set(repo.root, monitor);
+    } else {
+      repo = monitor.repo;
     }
     if (monitor.inUse) throw new Error("change collection already active");
     const idleChanges = [...monitor.changedPaths];
@@ -771,5 +673,4 @@ export async function beginChangeReceipt(cwd: string, trusted = true): Promise<C
 export function disposeChangeReceipts(): void {
   for (const monitor of repositoryMonitors.values()) discardMonitor(monitor);
   repositoryMonitors.clear();
-  repositoryCache.clear();
 }

package/killeros/commands.ts

@@ -70,6 +70,7 @@ const BUILTIN_COMMANDS: ReadonlyArray<{ name: string; description: string }> = [
 ];
 
 const COMMAND_SYNTAX_HINTS: Readonly<Record<string, string>> = {
+  "auto-compact": "/auto-compact [status|on|off|<percent>]",
   goal: "/goal [objective|pause|resume|clear]",
   handoff: "/handoff [next-session focus]",
   model: "/model [provider/model]",

package/killeros/footer.ts

@@ -1,10 +1,11 @@
 import { execFile } from "node:child_process";
 import { watch } from "node:fs";
+import path from "node:path";
 import { type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth, visibleWidth, type TUI } from "@earendil-works/pi-tui";
 import { isCodexFastEnabled, subscribeCodexFast } from "./codex-fast-state.ts";
 import { formatCwd, formatTime, modelDisplayName, padRight } from "./display.ts";
-import { PASSIVE_GIT_CONFIG_ARGS, passiveGitCommand, passiveGitEnv, passiveStatusSafetyArgs, samePassiveFilters } from "./passive-git-status.ts";
+import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveGitRunner } from "./passive-git-status.ts";
 import { goalElapsedMilliseconds } from "./goal-state.ts";
 import type { GoalRuntime, GoalState } from "./runtime.ts";
 import { safeTerminalText } from "./safe-terminal-text.ts";
@@ -36,26 +37,16 @@ type GitStatusExecutor = (
   callback: (error: Error | null, stdout: string) => void,
 ) => unknown;
 
-/** Resolves changed-file counts with a bounded asynchronous Git status process in a trusted project. */
-export function resolveGitFileChanges(
+/** Resolves changed-file counts without asking Git to inspect worktree content. */
+export async function resolveGitFileChanges(
   cwd: string,
   execute: GitStatusExecutor = execFile,
   trusted = true,
 ): Promise<GitFileChanges | undefined> {
-  if (!trusted) return Promise.resolve(undefined);
-  return new Promise((resolve) => {
-    let gitCommand: string;
-    try {
-      const found = passiveGitCommand(cwd);
-      if (!found) {
-        resolve(undefined);
-        return;
-      }
-      gitCommand = found;
-    } catch {
-      resolve(undefined);
-      return;
-    }
+  if (!trusted) return undefined;
+  try {
+    const gitCommand = passiveGitCommand(cwd);
+    if (!gitCommand) return undefined;
     const options = {
       encoding: "utf8" as const,
       env: passiveGitEnv(),
@@ -63,64 +54,42 @@ export function resolveGitFileChanges(
       timeout: GIT_STATUS_TIMEOUT_MS,
       windowsHide: true as const,
     };
-    const verifyFiltersUnchanged = (before: string, done: (unchanged: boolean) => void): void => {
-      try {
-        execute(gitCommand, ["-C", cwd, ...PASSIVE_GIT_CONFIG_ARGS], options, (error, after) => {
-          done(!error && samePassiveFilters(before, after));
-        });
-      } catch {
-        done(false);
-      }
-    };
-    const runStatus = (config: string, args: string[]): void => {
-      try {
-        execute(gitCommand, args, options, (error, stdout) => {
-          if (error) {
-            resolve(undefined);
-            return;
-          }
-          verifyFiltersUnchanged(config, (unchanged) => {
-            if (!unchanged) {
-              resolve(undefined);
-              return;
-            }
-
-          const changes: GitFileChanges = { modified: 0, added: 0, deleted: 0 };
-          const entries = stdout.split("\0");
-          for (let index = 0; index < entries.length; index += 1) {
-            const entry = entries[index];
-            if (!entry) continue;
-            const status = entry.slice(0, 2);
-            if (status.includes("D")) changes.deleted += 1;
-            else if (status === "??" || status.includes("A")) changes.added += 1;
-            else changes.modified += 1;
-            if (status.includes("R") || status.includes("C")) index += 1;
-          }
-          resolve(changes);
-          });
-        });
-      } catch {
-        resolve(undefined);
-      }
-    };
-
-    try {
-      execute(gitCommand, ["-C", cwd, ...PASSIVE_GIT_CONFIG_ARGS], options, (error, config) => {
-        if (error) {
-          resolve(undefined);
-          return;
-        }
-        const safetyArgs = passiveStatusSafetyArgs(config);
-        if (!safetyArgs) {
-          resolve(undefined);
-          return;
-        }
-        runStatus(config, ["-C", cwd, ...safetyArgs, "status", "--porcelain=v1", "-z", "--untracked-files=all"]);
+    const runAt = (directory: string): PassiveGitRunner => (args) => new Promise((resolve, reject) => {
+      execute(gitCommand, ["-C", directory, ...args], options, (error, stdout) => {
+        if (error) reject(error);
+        else resolve(Buffer.from(stdout));
       });
-    } catch {
-      resolve(undefined);
+    });
+    const initialRunner = runAt(cwd);
+    const root = new TextDecoder("utf-8", { fatal: true }).decode(
+      await initialRunner(["rev-parse", "--path-format=absolute", "--show-toplevel"]),
+    ).trim();
+    if (!path.isAbsolute(root)) return undefined;
+    const snapshot = await inspectWorktreeWithoutFilters(root, runAt(root));
+    const changes: GitFileChanges = { modified: 0, added: 0, deleted: 0 };
+    const deletedObjectIds: string[] = [];
+    const addedObjectIds: string[] = [];
+    for (const file of snapshot.files.values()) {
+      if (!file.mode) {
+        changes.deleted += 1;
+        if (!file.indexMode && file.headObjectId) deletedObjectIds.push(file.headObjectId);
+      } else if (!file.headMode) {
+        changes.added += 1;
+        if (file.indexObjectId) addedObjectIds.push(file.indexObjectId);
+      } else changes.modified += 1;
     }
-  });
+    for (const objectId of deletedObjectIds) {
+      const match = addedObjectIds.indexOf(objectId);
+      if (match < 0) continue;
+      addedObjectIds.splice(match, 1);
+      changes.deleted -= 1;
+      changes.added -= 1;
+      changes.modified += 1;
+    }
+    return changes;
+  } catch {
+    return undefined;
+  }
 }
 
 async function resolveUncommittedFileCount(cwd: string): Promise<number | undefined> {
@@ -290,11 +259,11 @@ export function contextPercentRemaining(ctx: ExtensionContext): number | null {
 export function formatContextProgress(tokensUsed: number | null, contextWindow: number, theme: Theme): string {
   if (tokensUsed === null || !Number.isFinite(tokensUsed)) return theme.fg("dim", "ctx —%");
   const windowSize = Number.isFinite(contextWindow) && contextWindow > 0 ? contextWindow : 128_000;
-  const used = Math.max(0, Math.min(windowSize, Math.max(0, tokensUsed)));
-  const percentUsed = Math.max(0, Math.min(100, Math.round((used / windowSize) * 100)));
-  const color: ThemeColor = percentUsed > 80 ? "error" : percentUsed >= 50 ? "warning" : "success";
-  const action = percentUsed >= 85 ? " · /compact" : "";
-  return theme.fg(color, `ctx ${percentUsed}%${action}`);
+  const used = Math.max(0, tokensUsed);
+  const percentRemaining = Math.max(0, Math.min(100, Math.round(((windowSize - used) / windowSize) * 100)));
+  const color: ThemeColor = percentRemaining > 50 ? "success" : percentRemaining >= 20 ? "warning" : "error";
+  const action = percentRemaining <= 15 ? " · /compact" : "";
+  return theme.fg(color, `ctx ${percentRemaining}%${action}`);
 }
 
 function sumSessionCost(ctx: ExtensionContext): number {

package/killeros/goal-command.ts

@@ -1,4 +1,5 @@
 import { validateGoalObjective } from "./goal-state.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export type GoalCommand =
   | { kind: "status" }
@@ -17,7 +18,9 @@ export function parseGoalCommand(args: string): GoalCommand {
   if (lowered === "resume") return { kind: "resume" };
   if (lowered === "clear") return { kind: "clear" };
   const objective = validateGoalObjective(input);
-  return objective
-    ? { kind: "objective", objective }
-    : { kind: "invalid", message: "A goal objective may not exceed 4,000 characters" };
+  if (objective) return { kind: "objective", objective };
+  if (safeTerminalText(input) !== input) {
+    return { kind: "invalid", message: "A goal objective contains unsupported content" };
+  }
+  return { kind: "invalid", message: "A goal objective may not exceed 4,000 characters" };
 }

package/killeros/goal-runtime.ts

@@ -15,7 +15,7 @@ import type { GoalRuntime, GoalState, GoalStatus } from "./runtime.ts";
 import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export const GOAL_ENTRY_TYPE = "killeros-goal";
-const GOAL_CONTINUATION_TYPE = "killeros-goal-continuation";
+export const GOAL_CONTINUATION_TYPE = "killeros-goal-continuation";
 export const GOAL_UPDATE_TOOL = "killeros_goal_update";
 
 export type GoalEntryEvent = "set" | "replace" | "limit" | "turn" | "continue" | "pause" | "resume" | "blocked" | "complete" | "error" | "clear" | "checkpoint" | "blocker-audit";

package/killeros/handoff.ts

@@ -91,10 +91,46 @@ export function resolveHandoffMaxTokens(settings: Readonly<KillerosSettings>, ov
   return positiveIntOr(override, positiveIntOr(settings.handoffMaxTokens, DEFAULT_HANDOFF_MAX_TOKENS));
 }
 
+/** Finds fenced code spans so `## ` lines inside them are not treated as headings. */
+function fencedCodeRanges(document: string): Array<{ start: number; end: number }> {
+  const ranges: Array<{ start: number; end: number }> = [];
+  let fenceStart: number | null = null;
+  let fenceChar = "";
+  let fenceLength = 0;
+  for (const line of document.matchAll(/[^\r\n]*(?:\r\n|\n|$)/g)) {
+    if (line[0].length === 0) break;
+    const lineStart = line.index ?? 0;
+    const lineEnd = lineStart + line[0].length;
+    const text = line[0].replace(/\r?\n$/, "");
+    const fence = /^[ \t]{0,3}(`{3,}|~{3,})/.exec(text);
+    if (!fence) continue;
+    const marker: string = fence[1];
+    const rest = text.slice(fence[0].length);
+    if (fenceStart === null) {
+      if (marker.startsWith("`") && rest.includes("`")) continue;
+      fenceStart = lineStart;
+      fenceChar = marker[0];
+      fenceLength = marker.length;
+    } else if (marker[0] === fenceChar && marker.length >= fenceLength && /^[ \t]*$/.test(rest)) {
+      ranges.push({ start: fenceStart, end: lineEnd });
+      fenceStart = null;
+      fenceChar = "";
+      fenceLength = 0;
+    }
+  }
+  if (fenceStart !== null) ranges.push({ start: fenceStart, end: document.length });
+  return ranges;
+}
+
 /** Checks that the model returned every section needed to continue safely. */
 function hasRequiredHandoffContent(document: string, focus: string): boolean {
   if (focus && !document.includes(focus)) return false;
-  const headings = [...document.matchAll(/^## ([^\r\n]+?)[ \t]*\r?$/gmu)];
+  const ranges = fencedCodeRanges(document);
+  const headings = [...document.matchAll(/^## ([^\r\n]+?)[ \t]*\r?$/gmu)]
+    .filter((heading) => {
+      const index = heading.index ?? 0;
+      return !ranges.some((range) => index >= range.start && index < range.end);
+    });
   if (headings.length !== HANDOFF_SECTIONS.length) return false;
   return headings.every((heading, index) => {
     if (heading[1] !== HANDOFF_SECTIONS[index]) return false;

package/killeros/passive-git-status.ts

@@ -1,21 +1,40 @@
+import { createHash } from "node:crypto";
 import { accessSync, constants, existsSync, realpathSync, statSync } from "node:fs";
+import { lstat, open, readlink } from "node:fs/promises";
 import path from "node:path";
 
-// Passive Git inspection disables fsmonitor, known clean/process filters,
-// promisor fetches, and repository-supplied Git executables. Config discovery
-// and status run in separate Git processes, so a filter configured between
-// them would be absent from the safety overrides. Automatic Git children run
-// without PATH resolution, and each scan rejects results when the effective
-// filter set changed. Absolute filter commands remain possible, so product
-// callers run these scans only after project trust is granted.
-//
-// Executable discovery itself is passive: it never starts a command shell,
-// locator process, or other helper executable, and never executes a bare
-// program name. It scans absolute search-path entries for an absolute Git
-// path outside the inspected repository and fails closed when none exists.
-export const PASSIVE_GIT_CONFIG_ARGS = ["config", "--includes", "--null", "--name-only", "--list"] as const;
-
-const SAFE_FILTER_NAME = /^[A-Za-z0-9][A-Za-z0-9._-]*$/u;
+const WORKTREE_CONTENT_LIMIT = 128 * 1024 * 1024;
+const PASSIVE_METADATA_ARGS = ["-c", "core.fsmonitor=false"] as const;
+
+export type PassiveGitRunner = (args: readonly string[]) => Promise<Buffer>;
+
+export type PassiveWorktreeFile = {
+  path: string;
+  headMode?: string;
+  headObjectId?: string;
+  indexMode?: string;
+  indexObjectId?: string;
+  mode?: string;
+  content?: Buffer;
+  contentObjectId?: string;
+};
+
+export type PassiveWorktreeSnapshot = {
+  head: string;
+  files: Map<string, PassiveWorktreeFile>;
+};
+
+type IndexEntry = {
+  mode: string;
+  objectId: string;
+  eolAttributes: string;
+  ctimeNanoseconds: bigint;
+  mtimeNanoseconds: bigint;
+  size: bigint;
+  skipWorktree: boolean;
+};
+
+type TreeEntry = { mode: string; objectId: string };
 
 function searchPathEntries(env: NodeJS.ProcessEnv): string[] {
   const values: string[] = [];
@@ -101,13 +120,7 @@ function insideInspected(candidate: string, root: string): boolean {
   return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
 }
 
-// Absolute Git binary outside the inspected repository, or undefined when
-// no safe candidate exists. Never starts a helper process and never
-// returns a bare command name, so opening a repository cannot execute a
-// repository-local locator or Git executable. Empty and relative
-// search-path entries are ignored because they can resolve against the
-// current directory. A candidate that resolves through a link returns its
-// final path only when that path is also outside the repository.
+/** Returns an absolute Git binary outside the inspected repository without starting a locator process. */
 export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
   const root = inspectedRoot(cwd);
   if (!root) return undefined;
@@ -118,8 +131,7 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
   for (const raw of entries) {
     if (raw === "" || raw.trim() === "") continue;
     const directory = unquoted(raw);
-    if (directory === "" || directory.trim() === "") continue;
-    if (!path.isAbsolute(directory)) continue;
+    if (directory === "" || directory.trim() === "" || !path.isAbsolute(directory)) continue;
     for (const base of baseNames) {
       const candidate = path.join(directory, base);
       try {
@@ -140,60 +152,15 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
       } catch {
         continue;
       }
-      if (!path.isAbsolute(resolved)) continue;
-      if (insideInspected(resolved, root)) continue;
-      return resolved;
+      if (path.isAbsolute(resolved) && !insideInspected(resolved, root)) return resolved;
     }
   }
   return undefined;
 }
 
-// Lists effective clean/process filter drivers in discovery order, or
-// undefined when discovery output is incomplete or names a driver the
-// safety overrides cannot represent.
-export function passiveFilterNames(config: string): string[] | undefined {
-  const records = config.split("\0");
-  if (records.at(-1) !== "") return undefined;
-  const names = new Set<string>();
-  for (const key of records) {
-    if (!key) continue;
-    const name = /^filter\.(.*)\.(?:clean|process)$/us.exec(key)?.[1];
-    if (name === undefined) continue;
-    if (!SAFE_FILTER_NAME.test(name)) return undefined;
-    names.add(name);
-  }
-  return [...names];
-}
-
-// Builds safe overrides from null-delimited `git config --name-only --list`
-// output. Returns undefined when output is incomplete or names an unsafe
-// filter, so the caller skips the status call.
-export function passiveStatusSafetyArgs(config: string): string[] | undefined {
-  const names = passiveFilterNames(config);
-  if (!names) return undefined;
-  return ["-c", "core.fsmonitor=false", ...names.flatMap((name) => ["-c", `filter.${name}.clean=`, "-c", `filter.${name}.process=`, "-c", `filter.${name}.required=false`])];
-}
-
-export function samePassiveFilters(before: string, after: string): boolean {
-  const earlier = passiveFilterNames(before);
-  const later = passiveFilterNames(after);
-  if (!earlier || !later) return false;
-  if (earlier.length !== later.length) return false;
-  const ordered = [...later].sort();
-  return [...earlier].sort().every((name, index) => name === ordered[index]);
-}
-
-// Environment for automatic Git children: no optional locks, no lazy fetch
-// from a promisor remote, and no PATH so a filter command that becomes
-// effective after discovery cannot resolve a bare command name. Absolute
-// filter paths are still possible; trusted-project callers detect mid-scan
-// config changes with samePassiveFilters and skip those results.
+/** Environment for automatic Git children, with locks, lazy fetches, and PATH command resolution disabled. */
 export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = {
-    ...base,
-    GIT_OPTIONAL_LOCKS: "0",
-    GIT_NO_LAZY_FETCH: "1",
-  };
+  const env: NodeJS.ProcessEnv = { ...base, GIT_OPTIONAL_LOCKS: "0", GIT_NO_LAZY_FETCH: "1" };
   let hasPath = false;
   for (const key of Object.keys(env)) {
     if (key.toLowerCase() === "path") {
@@ -204,3 +171,176 @@ export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.Pro
   if (!hasPath) env.PATH = "";
   return env;
 }
+
+function decode(buffer: Buffer): string {
+  return new TextDecoder("utf-8", { fatal: true }).decode(buffer);
+}
+
+function parseIndex(output: Buffer): Map<string, IndexEntry> {
+  const text = decode(output);
+  const pattern = /([0-7]{6}) ([0-9a-f]{40}(?:[0-9a-f]{24})?) ([0-3])\t([^\t]*)\t([^\0]*)\0  ctime: (\d+):(\d+)\n  mtime: (\d+):(\d+)\n  dev: \d+\tino: \d+\n  uid: \d+\tgid: \d+\n  size: (\d+)\tflags: ([0-9a-f]+)\n/gu;
+  const entries = new Map<string, IndexEntry>();
+  let end = 0;
+  for (const match of text.matchAll(pattern)) {
+    if (match.index !== end) throw new Error("invalid index metadata");
+    end = match.index + match[0].length;
+    const [, mode, objectId, stage, eolAttributes, filePath, ctimeSeconds, ctimeNanoseconds, mtimeSeconds, mtimeNanoseconds, size, flags] = match;
+    if (!mode || !objectId || !stage || eolAttributes === undefined || filePath === undefined || !ctimeSeconds || !ctimeNanoseconds || !mtimeSeconds || !mtimeNanoseconds || !size || !flags || stage !== "0") {
+      throw new Error("unsupported index entry");
+    }
+    entries.set(filePath, {
+      mode,
+      objectId,
+      eolAttributes: eolAttributes.trim(),
+      ctimeNanoseconds: BigInt(ctimeSeconds) * 1_000_000_000n + BigInt(ctimeNanoseconds),
+      mtimeNanoseconds: BigInt(mtimeSeconds) * 1_000_000_000n + BigInt(mtimeNanoseconds),
+      size: BigInt(size),
+      skipWorktree: (Number.parseInt(flags, 16) & 0x40000000) !== 0,
+    });
+  }
+  if (end !== text.length) throw new Error("incomplete index metadata");
+  return entries;
+}
+
+function parseTree(output: Buffer): Map<string, TreeEntry> {
+  const entries = new Map<string, TreeEntry>();
+  for (const record of decode(output).split("\0")) {
+    if (!record) continue;
+    const match = /^([0-7]{6}) (?:blob|commit) ([0-9a-f]{40}(?:[0-9a-f]{24})?)\t([^\0]+)$/u.exec(record);
+    if (!match?.[1] || !match[2] || !match[3]) throw new Error("invalid tree entry");
+    entries.set(match[3], { mode: match[1], objectId: match[2] });
+  }
+  return entries;
+}
+
+function parsePaths(output: Buffer): string[] {
+  const records = decode(output).split("\0");
+  if (records.at(-1) !== "") throw new Error("incomplete path list");
+  return records.slice(0, -1);
+}
+
+async function readFileState(root: string, entry: IndexEntry | undefined, filePath: string, remaining: number): Promise<{ mode: string; content?: Buffer; statsMatch: boolean }> {
+  const absolutePath = path.join(root, ...filePath.split("/"));
+  const stats = await lstat(absolutePath, { bigint: true });
+  const mode = stats.isSymbolicLink() ? "120000" : stats.isFile() ? stats.mode & 0o111n ? "100755" : "100644" : "";
+  if (!mode) throw new Error("unsupported worktree entry");
+  const statsMatch = entry !== undefined
+    && entry.mode === mode
+    && entry.size === stats.size
+    && entry.ctimeNanoseconds === stats.ctimeNs
+    && entry.mtimeNanoseconds === stats.mtimeNs;
+  if (statsMatch) return { mode, statsMatch };
+  if (!stats.isSymbolicLink() && stats.size > BigInt(remaining)) throw new Error("worktree content limit exceeded");
+  const content = stats.isSymbolicLink() ? Buffer.from(await readlink(absolutePath)) : await readBounded(absolutePath, remaining);
+  return { mode, content, statsMatch };
+}
+
+async function readBounded(filePath: string, limit: number): Promise<Buffer> {
+  const handle = await open(filePath, "r");
+  try {
+    const stats = await handle.stat();
+    if (!stats.isFile() || stats.size > limit) throw new Error("worktree content limit exceeded");
+    const content = Buffer.alloc(stats.size + 1);
+    let length = 0;
+    while (length < content.length) {
+      const { bytesRead } = await handle.read(content, length, content.length - length, length);
+      if (bytesRead === 0) break;
+      length += bytesRead;
+    }
+    if (length > stats.size) throw new Error("worktree changed while reading");
+    return content.subarray(0, length);
+  } finally {
+    await handle.close();
+  }
+}
+
+function blobObjectId(content: Buffer, length: number): string {
+  const algorithm = length === 64 ? "sha256" : "sha1";
+  return createHash(algorithm).update(`blob ${content.length}\0`).update(content).digest("hex");
+}
+
+function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boolean {
+  if (blobObjectId(content, entry.objectId.length) === entry.objectId) return true;
+  if (entry.mode === "120000" || !content.includes(Buffer.from("\r\n"))) return false;
+  const attributes = entry.eolAttributes;
+  if (attributes === "-text") return false;
+  const automatic = attributes.startsWith("text=auto") || !attributes;
+  if (!attributes && !["true", "input"].includes(autoCrlf)) return false;
+  if (automatic) {
+    // Match Git's convert_is_binary heuristic, including its terminal EOF exception.
+    let printable = 0;
+    let nonprintable = 0;
+    for (let index = 0; index < content.length; index += 1) {
+      const byte = content[index];
+      if (byte === 0 || byte === 13 && content[index + 1] !== 10) return false;
+      if (byte === 13 || byte === 10 || byte === 26 && index === content.length - 1) continue;
+      if (byte === 127 || byte < 32 && ![8, 9, 12, 27].includes(byte)) nonprintable += 1;
+      else printable += 1;
+    }
+    if (Math.floor(printable / 128) < nonprintable) return false;
+  }
+  const normalized = Buffer.from(content.toString("latin1").replaceAll("\r\n", "\n"), "latin1");
+  return blobObjectId(normalized, entry.objectId.length) === entry.objectId;
+}
+
+/**
+ * Reads index and tree metadata with Git, then inspects worktree files with Node.
+ * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
+ */
+export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
+  const [indexOutput, untrackedOutput, resolvedHead, autoCrlfOutput] = await Promise.all([
+    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
+      "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
+    runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
+    runGit(["rev-parse", "--verify", "HEAD"]).then(decode, () => ""),
+    runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
+  ]);
+  const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
+  const head = resolvedHead.trim();
+  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
+  const index = parseIndex(indexOutput);
+  const tree = head ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
+  const files = new Map<string, PassiveWorktreeFile>();
+  let contentBytes = 0;
+
+  for (const filePath of new Set([...tree.keys(), ...index.keys()])) {
+    const headEntry = tree.get(filePath);
+    const indexEntry = index.get(filePath);
+    if (headEntry?.mode === "160000" || indexEntry?.mode === "160000") continue;
+    const staged = headEntry?.mode !== indexEntry?.mode || headEntry?.objectId !== indexEntry?.objectId;
+    let mode: string | undefined;
+    let content: Buffer | undefined;
+    let worktreeChanged = false;
+    if (indexEntry && !indexEntry.skipWorktree) {
+      try {
+        const state = await readFileState(root, indexEntry, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
+        mode = process.platform === "win32" && indexEntry.mode !== "120000" ? indexEntry.mode : state.mode;
+        content = state.content;
+        if (content) contentBytes += content.length;
+        worktreeChanged = !state.statsMatch && (mode !== indexEntry.mode || !content || !matchesIndex(content, indexEntry, autoCrlf));
+      } catch (error) {
+        if (error !== null && typeof error === "object" && "code" in error && error.code === "ENOENT") worktreeChanged = true;
+        else throw error;
+      }
+    }
+    if (!staged && !worktreeChanged) continue;
+    files.set(filePath, {
+      path: filePath,
+      headMode: headEntry?.mode,
+      headObjectId: headEntry?.objectId,
+      indexMode: indexEntry?.mode,
+      indexObjectId: indexEntry?.objectId,
+      mode: worktreeChanged ? mode : indexEntry?.mode,
+      ...(worktreeChanged && content ? { content } : indexEntry ? { contentObjectId: indexEntry.objectId } : {}),
+    });
+  }
+
+  for (const filePath of parsePaths(untrackedOutput)) {
+    const state = await readFileState(root, undefined, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
+    if (!state.content) throw new Error("missing untracked content");
+    contentBytes += state.content.length;
+    const previous = files.get(filePath);
+    files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
+  }
+  return { head: head || "(initial)", files };
+}

package/killeros/settings.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from "node:crypto";
-import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { linkSync, mkdirSync, readFileSync, renameSync, rmdirSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { hasErrorCode } from "./errors.ts";
@@ -26,16 +26,103 @@ function readStoredSettings(settingsPath: string): KillerosSettings {
   }
 }
 
+const LOCK_RETRY_MILLISECONDS = 10;
+const LOCK_TIMEOUT_MILLISECONDS = 10_000;
+
+function readLockOwnerPid(lockPath: string): number | undefined {
+  try {
+    const value: unknown = JSON.parse(readFileSync(lockPath, "utf8"));
+    if (!isSettings(value) || typeof value.pid !== "number" || !Number.isSafeInteger(value.pid) || value.pid <= 0) return undefined;
+    return value.pid;
+  } catch {
+    return undefined;
+  }
+}
+
+function isProcessRunning(pid: number): boolean {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return !hasErrorCode(error, "ESRCH");
+  }
+}
+
+function moveLockAside(lockPath: string): boolean {
+  const stalePath = `${lockPath}.${process.pid}.${randomUUID()}.stale`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MILLISECONDS;
+  while (true) {
+    try {
+      renameSync(lockPath, stalePath);
+      break;
+    } catch (error) {
+      if (hasErrorCode(error, "ENOENT")) return false;
+      if (
+        Date.now() >= deadline
+        || !["EACCES", "EBUSY", "EPERM"].some((code) => hasErrorCode(error, code))
+      ) throw error;
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MILLISECONDS);
+    }
+  }
+  rmSync(stalePath, { force: true });
+  return true;
+}
+
+function recoverSettingsLock(lockPath: string, expectedPid: number): boolean {
+  const recoveryPath = `${lockPath}.recovery`;
+  try {
+    mkdirSync(recoveryPath);
+  } catch (error) {
+    if (hasErrorCode(error, "EEXIST")) return false;
+    throw error;
+  }
+  try {
+    // Recheck under exclusive recovery ownership; another waiter may have replaced the lock.
+    return readLockOwnerPid(lockPath) === expectedPid && !isProcessRunning(expectedPid) && moveLockAside(lockPath);
+  } finally {
+    // ponytail: a crash during recovery leaves .recovery for manual removal; never steal it and risk lost writes.
+    rmdirSync(recoveryPath);
+  }
+}
+
+function acquireSettingsLock(settingsPath: string): () => void {
+  const lockPath = `${settingsPath}.lock`;
+  const ownerPath = `${lockPath}.${process.pid}.${randomUUID()}.tmp`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MILLISECONDS;
+  writeFileSync(ownerPath, JSON.stringify({ pid: process.pid }), { encoding: "utf8", mode: 0o600, flag: "wx" });
+  try {
+    while (true) {
+      try {
+        linkSync(ownerPath, lockPath);
+        break;
+      } catch (error) {
+        if (!hasErrorCode(error, "EEXIST")) throw error;
+        const currentOwnerPid = readLockOwnerPid(lockPath);
+        if (currentOwnerPid && !isProcessRunning(currentOwnerPid) && recoverSettingsLock(lockPath, currentOwnerPid)) continue;
+        if (Date.now() >= deadline) throw new Error(`Timed out waiting for KillerOS settings lock: ${lockPath}`);
+        Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, LOCK_RETRY_MILLISECONDS);
+      }
+    }
+  } finally {
+    rmSync(ownerPath, { force: true });
+  }
+
+  return () => {
+    moveLockAside(lockPath);
+  };
+}
+
 export function createKillerosSettingsStore(
   settingsPath = join(getAgentDir(), "killeros.json"),
 ): KillerosSettingsStore {
   return {
     load: () => readStoredSettings(settingsPath),
     update: (patch) => {
-      const current = readStoredSettings(settingsPath);
       mkdirSync(dirname(settingsPath), { recursive: true });
+      const releaseLock = acquireSettingsLock(settingsPath);
       const temporaryPath = `${settingsPath}.${process.pid}.${randomUUID()}.tmp`;
       try {
+        const current = readStoredSettings(settingsPath);
         writeFileSync(
           temporaryPath,
           `${JSON.stringify({ ...current, ...patch }, null, 2)}\n`,
@@ -43,7 +130,11 @@ export function createKillerosSettingsStore(
         );
         renameSync(temporaryPath, settingsPath);
       } finally {
-        rmSync(temporaryPath, { force: true });
+        try {
+          rmSync(temporaryPath, { force: true });
+        } finally {
+          releaseLock();
+        }
       }
     },
   };

package/killeros/worked-for.ts

@@ -48,6 +48,8 @@ export interface WorkedForEntryDataV4 {
   checks: CheckAttempt[];
   omittedChecks: { passed: number; failed: number };
   model?: string;
+  outputTokens?: number;
+  decodeMilliseconds?: number;
 }
 
 type WorkedForEntryData = WorkedForEntryDataV1 | WorkedForEntryDataV2 | WorkedForEntryDataV3 | WorkedForEntryDataV4;
@@ -66,6 +68,10 @@ function integer(value: unknown): value is number {
   return typeof value === "number" && Number.isFinite(value) && Number.isInteger(value) && value >= 0;
 }
 
+function positiveInteger(value: unknown): value is number {
+  return integer(value) && value > 0;
+}
+
 function record(value: unknown): value is Record<string, unknown> {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -148,6 +154,9 @@ function parseV4(data: Record<string, unknown>): WorkedForEntryDataV4 | undefine
     checks.push({ label, outcome: check.outcome });
   }
   const model = parseModelName(data.model);
+  const throughput = positiveInteger(data.outputTokens) && positiveInteger(data.decodeMilliseconds)
+    ? { outputTokens: data.outputTokens, decodeMilliseconds: data.decodeMilliseconds }
+    : {};
   return {
     version: 4,
     milliseconds: data.milliseconds,
@@ -157,6 +166,7 @@ function parseV4(data: Record<string, unknown>): WorkedForEntryDataV4 | undefine
     checks,
     omittedChecks: { passed: data.omittedChecks.passed, failed: data.omittedChecks.failed },
     ...(model ? { model } : {}),
+    ...throughput,
   };
 }
 
@@ -221,9 +231,15 @@ class WorkedForV4Component implements Component {
     const { data, theme } = this;
     const outcome = OUTCOMES[data.outcome];
     const headline = theme.fg(outcome.color, outcome.label);
+    const tokensPerSecond = data.outputTokens !== undefined && data.decodeMilliseconds !== undefined
+      ? data.outputTokens / (data.decodeMilliseconds / 1_000)
+      : undefined;
+    const speedSuffix = tokensPerSecond !== undefined && Number.isFinite(tokensPerSecond) && tokensPerSecond > 0
+      ? ` · ${tokensPerSecond.toFixed(1)} tok/s`
+      : "";
     const modelSuffix = data.model ? ` · ${data.model}` : "";
     const lines = [
-      `${headline}${theme.fg("dim", ` · ${formatWorkedForDuration(data.milliseconds)} · ↑ ${formatTokens(data.tokens)} tokens${modelSuffix}`)}`,
+      `${headline}${theme.fg("dim", ` · ${formatWorkedForDuration(data.milliseconds)} · ↑ ${formatTokens(data.tokens)} tokens${speedSuffix}${modelSuffix}`)}`,
     ];
     if (data.changes.state === "unavailable") lines.push(theme.fg("dim", "Changes unavailable"));
     else if (data.changes.totalFiles === 0) lines.push(theme.fg("dim", "No files changed"));
@@ -287,8 +303,34 @@ type ActiveReceipt = {
   modelProvider: string | undefined;
   modelId: string | undefined;
   modelMismatch: boolean;
+  outputTokens: number;
+  decodeMilliseconds: number;
+  decodeStartedAt: number | undefined;
+  throughputInvalid: boolean;
 };
 
+function finishAssistantStream(
+  receipt: ActiveReceipt,
+  outputTokens: number,
+  endedAt: number,
+  failed: boolean,
+): void {
+  if (failed) {
+    if (receipt.decodeStartedAt !== undefined) receipt.throughputInvalid = true;
+  } else if (receipt.decodeStartedAt !== undefined) {
+    const decodeMilliseconds = endedAt - receipt.decodeStartedAt;
+    if (positiveInteger(outputTokens) && positiveInteger(decodeMilliseconds)) {
+      receipt.outputTokens += outputTokens;
+      receipt.decodeMilliseconds += decodeMilliseconds;
+    } else {
+      receipt.throughputInvalid = true;
+    }
+  } else if (outputTokens !== 0) {
+    receipt.throughputInvalid = true;
+  }
+  receipt.decodeStartedAt = undefined;
+}
+
 function receiptModelName(
   settled: ActiveReceipt,
   model: ExtensionContext["model"],
@@ -349,30 +391,46 @@ export function registerWorkedFor(
       modelProvider: undefined,
       modelId: undefined,
       modelMismatch: false,
+      outputTokens: 0,
+      decodeMilliseconds: 0,
+      decodeStartedAt: undefined,
+      throughputInvalid: false,
     };
     active = state;
     const collection = await state.collection;
     if (active !== state) await collection.dispose();
   });
 
+  pi.on("message_update", (event, ctx) => {
+    if (ctx.mode !== "tui" || !active) return;
+    const update = event.assistantMessageEvent;
+    if ((update.type === "text_delta" || update.type === "thinking_delta" || update.type === "toolcall_delta")
+      && update.delta.length > 0) active.decodeStartedAt ??= now();
+  });
+
   pi.on("message_end", (event, ctx) => {
     if (ctx.mode !== "tui" || !active) return;
     if (event.message.role !== "assistant") return;
     const provider: unknown = event.message.provider;
     const modelId: unknown = event.message.model;
-    if (typeof provider !== "string" || typeof modelId !== "string") {
-      active.modelMismatch = true;
-      return;
-    }
-    if (active.modelProvider === undefined || active.modelId === undefined) {
-      active.modelProvider = provider;
-      active.modelId = modelId;
-    } else if (active.modelProvider !== provider || active.modelId !== modelId) {
-      active.modelMismatch = true;
-    }
-    if (event.message.responseModel !== undefined && event.message.responseModel !== modelId) {
-      active.modelMismatch = true;
+    if (typeof provider !== "string" || typeof modelId !== "string") active.modelMismatch = true;
+    else {
+      if (active.modelProvider === undefined || active.modelId === undefined) {
+        active.modelProvider = provider;
+        active.modelId = modelId;
+      } else if (active.modelProvider !== provider || active.modelId !== modelId) {
+        active.modelMismatch = true;
+      }
+      if (event.message.responseModel !== undefined && event.message.responseModel !== modelId) {
+        active.modelMismatch = true;
+      }
     }
+    finishAssistantStream(
+      active,
+      event.message.usage.output,
+      now(),
+      event.message.stopReason === "error" || event.message.stopReason === "aborted",
+    );
   });
 
   pi.on("tool_result", (event: ToolResultEvent, ctx) => {
@@ -404,6 +462,10 @@ export function registerWorkedFor(
       ctx.ui.notify(`Change receipt unavailable: ${changes.reason}`, "warning");
     }
     const settledTokens = sessionTokenTotal(ctx);
+    const throughput = !settled.throughputInvalid && settled.decodeStartedAt === undefined && !settled.modelMismatch
+      && positiveInteger(settled.outputTokens) && positiveInteger(settled.decodeMilliseconds)
+      ? { outputTokens: settled.outputTokens, decodeMilliseconds: settled.decodeMilliseconds }
+      : {};
     const data = fitPayload({
       version: 4,
       milliseconds: Math.max(0, now() - settled.startedAt),
@@ -413,6 +475,7 @@ export function registerWorkedFor(
       checks: settled.checks,
       omittedChecks: settled.omittedChecks,
       ...(model ? { model } : {}),
+      ...throughput,
     });
     try {
       pi.appendEntry<WorkedForEntryDataV4>(WORKED_FOR_ENTRY_TYPE, data);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "2.1.28",
+  "version": "2.1.30",
   "description": "TUI, goals, and workflow automation for the Pi coding agent",
   "type": "module",
   "keywords": [