killeros 2.1.32 → 3.0.0

package/CHANGELOG.md

@@ -4,6 +4,37 @@ All notable changes to KillerOS are documented here. Releases use New Features f
 
 ## [Unreleased]
 
+## [3.0.0] - 2026-10-01
+
+### Changed
+
+- Raised the minimum supported Pi version and locked Pi development packages to 0.99.2, with matching CI and lockfile contracts. Users on older Pi versions must upgrade.
+
+### Added
+
+- Added a Windows CI job on Node.js 22.19.0 that runs the full quality suite, with a repository contract protecting the job's required checks.
+
+### Fixed
+
+- Canonicalized Windows short-path aliases in passive Git executable checks, preventing repository-local shims from being selected through paths such as `RUNNER~1` and fixing the Node.js 22.19.0 Windows CI failure. Removed temporary receipt debug logging.
+- Applied `/codex-fast` priority requests and the footer's `fast` label to eligible native OpenAI Responses models at the official endpoint, for both API-key and ChatGPT subscription authentication. Legacy Codex behavior, command strings, and the process-local opt-in preference are unchanged; priority acceptance and billing remain OpenAI-controlled.
+- Kept `question` and active `killeros_goal_update` directly declared in codemode-only sessions using Pi's native `model-only` exposure, which also prevents scripts and other tools from executing them. Goal activation and TUI-only question behavior are unchanged.
+- Discarded pending change receipts after session replacement or reload and kept late activity and completion-sound handlers from using the old context, preventing stale-context extension errors during receipt finalization.
+- Updated the `brace-expansion` override to patched 5.0.12, fixing recursion and quadratic-time denial of service in development and CI installs.
+- Removed the stale `undici` override so development and CI installs use Pi's patched 8.10.2 dependency, resolving GHSA-3wwx-pv8p-q78v.
+- Refreshed cached change-receipt baselines when `HEAD`, `core.filemode`, or `core.symlinks` changes between responses, while still rejecting `HEAD` changes made during a response.
+- Made passive footer scans and change receipts honor `core.symlinks=false` placeholders and `core.filemode=false` without masking file-type changes.
+- Preserved parent traversal in relative goal paths so directory links cannot redirect file proof to a lexically normalized target or collapse distinct targets.
+- Made the Windows hook cleanup test wait for its child to start and verify that both processes terminate, avoiding false failures when `taskkill` cannot confirm an already-finished cleanup.
+- Showed stable provider-reported model IDs on settled receipts when they differ from the selected alias, including GitHub Copilot Claude models.
+- Reported CRLF worktree content as modified when indexed attributes require `eol=lf`, matching Git in footer counts and change receipts.
+- Kept quoted prose goal destinations on model-reported completion; inferred file proof now requires a path-shaped destination.
+- Isolated passive footer, change-receipt, and startup branch Git scans from inherited repository-selection environment variables.
+- Rejected passive Git executables reached through repository-owned directory links while continuing to safe later `PATH` entries.
+- Prevented single-file goal proof from masking unquoted `Makefile`, `Dockerfile`, or `.gitignore` list items.
+- Prevented single-file goal proof from overlooking additional extensionless targets extracted by goal action and destination clauses. Equivalent path spellings still share one exact-path verification contract.
+- Prevented single-file goal proof from masking additional filenames that extend version or Node.js prose. Goal parsing now keeps spaces and trailing punctuation in quoted paths and matches exact Node.js prose case-insensitively.
+
 ## [2.1.32] - 2026-09-24
 
 ### Fixed

package/README.md

@@ -2,11 +2,13 @@
 
 A TypeScript extension for the [Pi coding agent](https://github.com/earendil-works/pi) that replaces the stock TUI and adds long-running goals, reasoning controls, and workflow commands.
 
+![KillerOS TUI showing the startup masthead, an active goal, a settled task receipt, and the goal footer](.github/assets/killeros-preview.png)
+
 ## What you get
 
 - A custom TUI: startup masthead with versions, model, working directory, and Git branch; a dark theme with coral accents; a multiline editor with slash-command completion; a footer that tracks model, context, and goal state; settled task receipts with duration and token usage.
 - `/goal`: set an objective and Pi keeps working toward it across turns, compaction, reloads, and branch navigation. Each turn must record `continue` with evidence and one next action, `complete`, or the existing blocker decision; otherwise the goal pauses. New goals pause after 20 turns; `/goal resume` grants another 20.
-- `/codex-fast`: toggles the `priority` service tier on Codex requests or reports its status.
+- `/codex-fast`: toggles the `priority` service tier on legacy Codex and eligible native OpenAI Responses requests or reports its status.
 - `/handoff`: starts a fresh linked session carrying visible continuation context.
 - `/auto-compact`: reports, enables, disables, or tunes automatic context compaction.
 - A `question` tool with single-select and multi-select modes.
@@ -17,7 +19,7 @@ A TypeScript extension for the [Pi coding agent](https://github.com/earendil-wor
 ## Requirements
 
 - Node.js 22.19.0+
-- Pi 0.85.0 or later within the 0.x release line
+- Pi 0.99.2 or later within the 0.x release line
 - An interactive TUI session for the custom header, editor, footer, and `question`
 
 ## Install
@@ -32,7 +34,7 @@ Or from GitHub:
 pi install git:github.com/KyrosHendrix/pi-KillerOS
 ```
 
-Pin a release by appending its tag, for example `@v2.1.32`. Add `-l` to install only for the current project. Restart Pi after installing.
+Pin a release by appending its tag, for example `@v3.0.0`. Add `-l` to install only for the current project. Restart Pi after installing.
 
 ## Commands
 
@@ -51,6 +53,12 @@ Pin a release by appending its tag, for example `@v2.1.32`. Add `-l` to install
 /exit                     Quit Pi gracefully
 ```
 
+Fast mode is off by default. `/codex-fast` toggles it, and `/codex-fast status` reports the preference without changing it. The preference stays in the current Pi process across model switches and extension reloads, but is not saved between processes. The command name and notification strings retain their legacy Codex wording.
+
+Fast mode applies to legacy `openai-codex` requests and selected native models with provider `openai`, API `openai-responses`, and base URL `https://api.openai.com/v1`, with an optional trailing slash. Native request payloads must also name the selected model's exact ID. Both API-key and ChatGPT subscription authentication use this rule. Custom endpoints, Azure, other APIs, and ambiguous native requests pass through unchanged. When enabled, fast mode overrides an eligible request's existing service tier with `priority`; when disabled, it leaves the request unchanged.
+
+The TUI footer's `fast` label means the enabled preference applies to the selected model, not that OpenAI accepted priority service. OpenAI controls account and model eligibility, the actual service tier, and charges. Priority can affect billing; subscription login does not guarantee accepted or free priority service. KillerOS leaves provider errors to Pi and does not silently retry with a different tier.
+
 ## Behavior by mode
 
 | Mode | What works |
@@ -59,6 +67,8 @@ Pin a release by appending its tag, for example `@v2.1.32`. Add `-l` to install
 | RPC | Goals, proactive compaction; no TUI components, sounds, title indicator |
 | Print/JSON | No interactive questions, `/goal`, or proactive compaction |
 
+`question` and the active `killeros_goal_update` tool use Pi's `model-only` exposure. They stay directly declared to the model when codemode is disabled or enabled in `on` or `only` mode, but scripts and other tools cannot call them through `ctx.executeTool()`. The goal tool remains inactive without an active goal. Questions still require TUI mode; a direct RPC call fails with `The question tool requires interactive TUI mode`. KillerOS does not enable or configure codemode.
+
 ## Configuration
 
 The packaged `killeros` theme activates on TUI start. Compaction triggers by default at 15% tokens remaining, stored in global `killeros.json`:
@@ -83,13 +93,15 @@ State proof in the objective so the agent can verify it with its normal tools:
 /goal Reduce p95 checkout latency below 120 ms, verified by the checkout benchmark, while keeping the correctness suite green
 ```
 
-A direct quoted file target binds silent file proof:
+A direct quoted path-shaped file target binds silent file proof. For an extensionless relative file, use an explicit path such as `./summary` or `.\summary`:
 
 ```text
 /goal Fix `killeros/footer.ts`, verified by npm test
 ```
 
-KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Restored goals keep their persisted limit.
+Bare quoted prose remains model-reported. KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Restored goals keep their persisted limit.
+
+Session replacement and reload discard unfinished task receipts. Late receipt results do not write or notify through the old session context.
 
 Completion sounds are off by default; change with `/notification` in TUI mode. The tab-title indicator requires a Nerd Font.
 

package/killeros/activity.ts

@@ -102,7 +102,7 @@ export function registerRequestActivity(pi: ExtensionAPI): void {
   });
 
   pi.on("agent_settled", (_event, ctx) => {
-    if (ctx.mode !== "tui" || !active || !ctx.isIdle?.() || ctx.hasPendingMessages?.()) return;
+    if (!active || ctx.mode !== "tui" || !ctx.isIdle?.() || ctx.hasPendingMessages?.()) return;
     clear(ctx);
   });
 

package/killeros/change-receipt.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createReadStream, watch } from "node:fs";
-import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveWorktreeFile as DirtyFile } from "./passive-git-status.ts";
+import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, passiveWorktreeMode, passiveWorktreeSettings, type PassiveWorktreeFile as DirtyFile, type PassiveWorktreeSnapshot } from "./passive-git-status.ts";
 import { lstat, open, readlink } from "node:fs/promises";
 import path from "node:path";
 import { createInflate } from "node:zlib";
@@ -176,7 +176,7 @@ async function readBoundedFile(filePath: string, limit: number): Promise<Buffer>
   }
 }
 
-type Snapshot = { head: string; files: Map<string, DirtyFile> };
+type Snapshot = PassiveWorktreeSnapshot;
 type RepositoryMonitor = {
   changedPaths: Set<string>;
   inUse: boolean;
@@ -218,7 +218,11 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
     try {
       const absolutePath = path.join(repo.root, ...filePath.split("/"));
       const stats = await lstat(absolutePath);
-      const mode = stats.isSymbolicLink() ? "120000" : stats.mode & 0o111 ? "100755" : "100644";
+      const mode = passiveWorktreeMode(
+        stats.isSymbolicLink() ? "120000" : stats.mode & 0o111 ? "100755" : "100644",
+        previous.indexMode,
+        baseline,
+      );
       const content = stats.isSymbolicLink()
         ? Buffer.from(await readlink(absolutePath))
         : await readBoundedFile(absolutePath, SNAPSHOT_CONTENT_LIMIT - totalBytes);
@@ -230,7 +234,7 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
       files.set(filePath, { ...previous, mode: undefined, content: undefined });
     }
   }
-  return { head: baseline.head, files };
+  return { ...baseline, files };
 }
 
 async function currentHead(repo: Repository): Promise<string> {
@@ -262,7 +266,7 @@ async function refreshSnapshot(monitor: RepositoryMonitor, observedPaths: readon
     if (observes(filePath, observedPaths)) files.delete(filePath);
   }
   for (const [filePath, file] of scoped.files) files.set(filePath, file);
-  return { head: scoped.head, files };
+  return { ...scoped, files };
 }
 
 function createMonitor(repo: Repository, initialSnapshot: Snapshot): RepositoryMonitor {
@@ -626,7 +630,14 @@ export async function beginChangeReceipt(cwd: string, trusted = true): Promise<C
     const idleChanges = [...monitor.changedPaths];
     monitor.changedPaths.clear();
     try {
-      monitor.snapshot = await refreshSnapshot(monitor, idleChanges);
+      const [head, settings] = await Promise.all([
+        currentHead(repo),
+        passiveWorktreeSettings((args) => runGit(repo.root, args)),
+      ]);
+      monitor.snapshot = head !== monitor.snapshot.head
+        || settings.fileMode !== monitor.snapshot.fileMode || settings.symlinks !== monitor.snapshot.symlinks
+        ? await snapshot(repo)
+        : await refreshSnapshot(monitor, idleChanges);
     } catch (error) {
       discardMonitor(monitor);
       throw error;

package/killeros/codex-fast-state.ts

@@ -1,3 +1,5 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
 type CodexFastStateListener = () => void;
 
 interface CodexFastState {
@@ -25,6 +27,12 @@ const state: CodexFastState = isCodexFastState(savedState) ? savedState : {
 };
 globalThis.__killerosCodexFastState = state;
 
+export function isCodexFastModel(model: ExtensionContext["model"]): boolean {
+  return model?.provider === "openai-codex"
+    || (model?.provider === "openai" && model.api === "openai-responses"
+      && (model.baseUrl === "https://api.openai.com/v1" || model.baseUrl === "https://api.openai.com/v1/"));
+}
+
 export function isCodexFastEnabled(): boolean {
   return state.enabled;
 }

package/killeros/codex-fast.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { isCodexFastEnabled, toggleCodexFast } from "./codex-fast-state.ts";
+import { isCodexFastEnabled, isCodexFastModel, toggleCodexFast } from "./codex-fast-state.ts";
 
-const CODEX_PROVIDER = "openai-codex";
 type RequestPayload = Record<string, unknown>;
 
 function isRequestPayload(value: unknown): value is RequestPayload {
@@ -28,9 +27,11 @@ export function registerCodexFastMode(pi: ExtensionAPI): void {
   });
 
   pi.on("before_provider_request", (event, ctx) => {
-    if (!isCodexFastEnabled() || ctx.model?.provider !== CODEX_PROVIDER || !isRequestPayload(event.payload)) {
+    if (!isCodexFastEnabled() || !isCodexFastModel(ctx.model) || !isRequestPayload(event.payload)) {
       return event.payload;
     }
+    // The hook exposes no dispatched provider/API. Native requests must match the selected model.
+    if (ctx.model?.provider === "openai" && event.payload.model !== ctx.model.id) return event.payload;
     return { ...event.payload, service_tier: "priority" };
   });
 }

package/killeros/footer.ts

@@ -3,7 +3,7 @@ import { watch } from "node:fs";
 import path from "node:path";
 import { type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth, visibleWidth, type TUI } from "@earendil-works/pi-tui";
-import { isCodexFastEnabled, subscribeCodexFast } from "./codex-fast-state.ts";
+import { isCodexFastEnabled, isCodexFastModel, subscribeCodexFast } from "./codex-fast-state.ts";
 import { formatCwd, formatTime, modelDisplayName, padRight } from "./display.ts";
 import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveGitRunner } from "./passive-git-status.ts";
 import { goalElapsedMilliseconds } from "./goal-state.ts";
@@ -15,7 +15,6 @@ const GIT_STATUS_REFRESH_INTERVAL_MS = 30_000;
 const GIT_STATUS_TIMEOUT_MS = 5_000;
 const GIT_STATUS_WATCH_DEBOUNCE_MS = 250;
 const GIT_STATUS_WATCH_INTERVAL_MS = 5_000;
-const CODEX_PROVIDER = "openai-codex";
 export const colorDirectory = (text: string): string => `\x1B[38;2;240;248;154m${text}\x1B[39m`;
 
 export interface GitFileChanges {
@@ -309,7 +308,7 @@ export function formatModel(
   if (!model) return theme.fg("dim", "no model");
   const displayName = modelDisplayName(model) || "unknown model";
   const name = theme.fg("text", displayName);
-  const fast = showCodexFast && model.provider === CODEX_PROVIDER ? theme.fg("text", "fast") : "";
+  const fast = showCodexFast && isCodexFastModel(model) ? theme.fg("text", "fast") : "";
   const provider = includeProvider ? theme.fg("dim", formatProviderName(model.provider)) : "";
   return [name, fast, provider].filter(Boolean).join(" ");
 }

package/killeros/goal-interface.ts

@@ -150,6 +150,7 @@ export function registerGoalInterface(
     label: "Goal update",
     description: "Record exactly one active-goal decision: complete after verification, continue with evidence and one next action, or audit the same blocker before blocking it.",
     parameters: GoalUpdateParams,
+    exposure: "model-only",
     executionMode: "sequential",
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
       signal?.throwIfAborted();

package/killeros/goal-state.ts

@@ -144,11 +144,19 @@ function isAbsoluteFilePath(value: string): boolean {
 }
 
 function stripUnquotedPathPunctuation(value: string): string {
-  const pathWithoutMarks = value.replace(/[.!?]+$/u, "");
-  const trailingClosers = pathWithoutMarks.match(/\)+$/u)?.[0].length ?? 0;
-  const unmatchedClosers = Math.max(0, pathWithoutMarks.split(")").length - pathWithoutMarks.split("(").length);
-  const punctuationLength = Math.min(trailingClosers, unmatchedClosers);
-  return pathWithoutMarks.slice(0, punctuationLength ? -punctuationLength : undefined);
+  let stripped = value;
+  while (true) {
+    const withoutMarks = stripped.replace(/[.,;:!?]+$/u, "");
+    if (withoutMarks !== stripped) {
+      stripped = withoutMarks;
+      continue;
+    }
+    const closer = stripped.at(-1);
+    const opener = closer === ")" ? "(" : closer === "]" ? "[" : closer === "}" ? "{" : undefined;
+    if (closer === undefined || opener === undefined
+      || stripped.split(closer).length <= stripped.split(opener).length) return stripped;
+    stripped = stripped.slice(0, -1);
+  }
 }
 
 function isGoalFileVerification(value: unknown): value is GoalFileVerification {
@@ -348,41 +356,80 @@ export async function captureGoalFileBaseline(
 const GOAL_URL_PATTERN = /(?:https?|file):\/\/[^\s"'`]+/giu;
 const GOAL_QUOTED_PATTERN = /`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'/gu;
 const GOAL_ABSOLUTE_PATTERN = /(?:^|[\s"'`(\[{,;])([A-Za-z]:[\\/][^\s,;'"`]+|\/[^\s,;'"`]+)/gu;
-const GOAL_LIST_FILE_PATTERN = /(?:\band\b|\bor\b|[,;&+])\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|([A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b)/giu;
+const GOAL_LIST_FILE_PATTERN = /(?:\band\b|\bor\b|\bplus\b|\balong\s+with\b|[,;&+])\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|((?:\.{1,2}[\\/])*[A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b|(Makefile|Dockerfile|\.gitignore)\b)/giu;
 const GOAL_RELATIVE_FILE_PATTERN = /(?:^|[\s"'`(\[{,;])((?:\.{1,2}[\\/])*[A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b/gu;
 
 function isQuotedGoalFileMention(raw: string): boolean {
   const value = raw.trim();
-  if (!value || /[\s\p{Cc}]/u.test(value) || /^(?:https?|file):\/\//iu.test(value) || /[\\/]$/u.test(value)) return false;
+  if (!value || /\p{Cc}/u.test(value) || /^(?:https?|file):\/\//iu.test(value) || /[\\/]$/u.test(value)) return false;
   return /[\/\\.:]/u.test(value);
 }
 
-function normalizeGoalFileMention(raw: string, cwd: string): string | undefined {
-  const value = raw.trim().replace(/[.,;:!?)\]}]+$/u, "");
-  if (!value || /[\s\p{Cc}]/u.test(value)) return undefined;
-  const absolute = path.isAbsolute(value) || path.win32.isAbsolute(value) ? value : path.resolve(cwd, value);
+function isPathShapedGoalCandidate(raw: string): boolean {
+  if (/\p{Cc}/u.test(raw)) return false;
+  const value = raw.trim();
+  if (!value || /[\\\/]$/u.test(value)) return false;
+  if (path.isAbsolute(value) || path.win32.isAbsolute(value)) return true;
+  if (URL.canParse(value)) return false;
+  return /[\\\/]/u.test(value)
+    || value.startsWith(".") && value !== "." && value !== ".."
+    || /\.[A-Za-z0-9]{1,12}$/u.test(value);
+}
+
+function goalPathIdentity(filePath: string): string {
+  const nativePath = process.platform === "win32" ? filePath.replaceAll("/", "\\") : filePath;
+  // Parent segments may traverse symlinks; keep them distinct without filesystem proof.
+  const normalized = nativePath.split(path.sep).includes("..") ? nativePath : path.normalize(nativePath);
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+
+function absoluteGoalFilePath(value: string, cwd: string): string {
+  if (path.isAbsolute(value) || path.win32.isAbsolute(value)) return value;
+  const nativePath = process.platform === "win32" ? value.replaceAll("/", "\\") : value;
+  // Resolving parent segments lexically can select a different file across a directory symlink.
+  return nativePath.split(path.sep).includes("..")
+    ? `${path.resolve(cwd)}${path.sep}${nativePath}`
+    : path.resolve(cwd, value);
+}
+
+function normalizeGoalFileMention(raw: string, cwd: string, quoted = false): string | undefined {
+  const trimmed = raw.trim();
+  const value = quoted ? trimmed : stripUnquotedPathPunctuation(trimmed);
+  if (!value || /\p{Cc}/u.test(value) || !quoted && /\s/u.test(value)) return undefined;
+  const absolute = absoluteGoalFilePath(value, cwd);
   if (!isAbsoluteFilePath(absolute)) return undefined;
-  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+  return goalPathIdentity(absolute);
 }
 
 /** Counts distinct path-shaped mentions so several files cannot bind proof to one. */
-function countGoalTargetFiles(objective: string, cwd: string, target: string): number {
-  const prose = objective.replace(GOAL_URL_PATTERN, " ");
+function countGoalTargetFiles(objective: string, cwd: string, target: string, targetQuoted: boolean): number {
+  const source = objective.replace(GOAL_URL_PATTERN, " ");
+  // ponytail: Only these exact prose forms are excluded; quote ambiguous bare filenames for exact proof.
+  const prose = source.replace(GOAL_QUOTED_PATTERN, " ")
+    .replace(/(?<![A-Za-z0-9_.\\/-])version\s+\d+(?:\.\d+)+(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))/giu, " ")
+    .replace(/(?<![A-Za-z0-9_.\\/-])for\s+Node\.js(?!\s+compatibility\.[A-Za-z0-9])(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))|(?<![A-Za-z0-9_.\\/-])Node\.js\s+compatibility(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))/giu, " ");
   const mentions = new Set<string>();
-  const add = (raw: string): void => {
-    const normalized = normalizeGoalFileMention(raw, cwd);
+  const add = (raw: string, quoted = false): void => {
+    const normalized = normalizeGoalFileMention(raw, cwd, quoted);
     if (normalized) mentions.add(normalized);
   };
-  add(target);
-  for (const match of prose.matchAll(GOAL_QUOTED_PATTERN)) {
+  add(target, targetQuoted);
+  for (const match of source.matchAll(GOAL_QUOTED_PATTERN)) {
     const raw = match[1] ?? match[2] ?? match[3] ?? "";
-    if (isQuotedGoalFileMention(raw)) add(raw);
+    if (isQuotedGoalFileMention(raw)) add(raw, true);
+  }
+  for (const match of source.matchAll(GOAL_LIST_FILE_PATTERN)) {
+    const quoted = match[1] ?? match[2] ?? match[3];
+    if (quoted !== undefined) add(quoted, true);
   }
   for (const match of prose.matchAll(GOAL_ABSOLUTE_PATTERN)) {
     if (match[1]) add(stripUnquotedPathPunctuation(match[1].trim()));
   }
-  for (const match of prose.matchAll(GOAL_LIST_FILE_PATTERN)) add(match[1] ?? match[2] ?? match[3] ?? match[4] ?? "");
-  for (const match of prose.replace(GOAL_QUOTED_PATTERN, " ").matchAll(GOAL_RELATIVE_FILE_PATTERN)) {
+  for (const match of prose.matchAll(GOAL_LIST_FILE_PATTERN)) {
+    if (match[4]) add(match[4]);
+    if (match[5]) add(match[5]);
+  }
+  for (const match of prose.matchAll(GOAL_RELATIVE_FILE_PATTERN)) {
     if (match[1]) add(match[1]);
   }
   return mentions.size;
@@ -390,30 +437,43 @@ function countGoalTargetFiles(objective: string, cwd: string, target: string): n
 
 /** Captures one explicit output path so goal completion can verify its creation or modification. */
 export async function inferGoalVerification(objective: string, cwd: string): Promise<GoalFileVerification | undefined> {
-  const candidates: string[] = [];
+  const candidates: Array<{ raw: string; quoted: boolean }> = [];
   const destination = /\b(?:create|write|save|generate)\b[^\r\n]{0,160}?\b(?:file|document|markdown|report|spreadsheet|presentation|image)\b\s+(?:to|at|as|destination(?:\s+is)?|output(?:\s+(?:to|at))?)\b\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|([A-Za-z]:\\[^\s,;]+|\/[^\s,;]+))/giu;
   for (const match of objective.matchAll(destination)) {
     const quoted = match[1] ?? match[2] ?? match[3];
-    candidates.push(quoted !== undefined ? quoted.trim() : stripUnquotedPathPunctuation((match[4] ?? "").trim()));
+    candidates.push({
+      raw: quoted !== undefined ? quoted : stripUnquotedPathPunctuation((match[4] ?? "").trim()),
+      quoted: quoted !== undefined,
+    });
   }
   const direct = /\b(?:update|edit|fix|refactor|migrate)\s+(`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)')/giu;
   for (const match of objective.matchAll(direct)) {
     const quoted = match[2] ?? match[3] ?? match[4];
-    if (quoted !== undefined) candidates.push(quoted.trim());
+    if (quoted !== undefined) candidates.push({ raw: quoted, quoted: true });
   }
-  const resolved: string[] = [];
-  for (const raw of candidates) {
-    if (!raw || /^(?:https?|file):\/\//iu.test(raw) || /[\\\/]$/u.test(raw)) continue;
-    const absolute = path.isAbsolute(raw) || path.win32.isAbsolute(raw) ? raw : path.resolve(cwd, raw);
-    if (isAbsoluteFilePath(absolute)) resolved.push(absolute);
+  const operands = new Set<string>();
+  const resolved = new Map<string, { filePath: string; quoted: boolean }>();
+  for (const candidate of candidates) {
+    const value = candidate.raw.trim();
+    if (!value || /\p{Cc}/u.test(value)) continue;
+    const alreadyAbsolute = path.isAbsolute(value) || path.win32.isAbsolute(value);
+    if (!alreadyAbsolute && URL.canParse(value)) continue;
+    const absolute = absoluteGoalFilePath(value, cwd);
+    const identity = goalPathIdentity(absolute);
+    operands.add(identity);
+    if (!isPathShapedGoalCandidate(candidate.raw) || !isAbsoluteFilePath(absolute)) continue;
+    const existing = resolved.get(identity);
+    resolved.set(identity, {
+      filePath: existing?.filePath ?? absolute,
+      quoted: candidate.quoted || existing?.quoted === true,
+    });
   }
-  const unique = [...new Set(resolved)];
-  if (unique.length !== 1) return undefined;
+  if (operands.size !== 1 || resolved.size !== 1) return undefined;
   // A goal that names several files must not verify from one file alone.
   // Repeated references to the same file count as one target.
-  const filePath = unique[0];
-  if (countGoalTargetFiles(objective, cwd, filePath) > 1) return undefined;
-  return { kind: "file", path: filePath, baseline: await captureGoalFileBaseline(filePath) };
+  const target = resolved.values().next().value;
+  if (target === undefined || countGoalTargetFiles(objective, cwd, target.filePath, target.quoted) > 1) return undefined;
+  return { kind: "file", path: target.filePath, baseline: await captureGoalFileBaseline(target.filePath) };
 }
 
 export async function verifyGoalDeliverable(verification: GoalFileVerification): Promise<void> {

package/killeros/notifications.ts

@@ -117,7 +117,7 @@ export function registerCompletionNotifications(
   });
 
   pi.on("agent_settled", (_event, ctx) => {
-    if (ctx.mode !== "tui" || !requestPending) return;
+    if (!requestPending || ctx.mode !== "tui") return;
     if (!ctx.isIdle() || ctx.hasPendingMessages()) return;
     requestPending = false;
     if (!enabled || lastStopReason === "aborted") return;

package/killeros/passive-git-status.ts

@@ -22,8 +22,30 @@ export type PassiveWorktreeFile = {
 export type PassiveWorktreeSnapshot = {
   head: string;
   files: Map<string, PassiveWorktreeFile>;
+  fileMode: boolean;
+  symlinks: boolean;
 };
 
+export async function passiveWorktreeSettings(runGit: PassiveGitRunner): Promise<Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">> {
+  const [fileMode, symlinks] = await Promise.all([
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.filemode"]),
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.symlinks"]),
+  ]);
+  return { fileMode: decode(fileMode).trim() === "true", symlinks: decode(symlinks).trim() === "true" };
+}
+
+export function passiveWorktreeMode(
+  actual: string,
+  indexed: string | undefined,
+  settings: Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">,
+): string {
+  if (actual === "100644" || actual === "100755") {
+    if (indexed === "120000" && !settings.symlinks) return indexed;
+    if ((indexed === "100644" || indexed === "100755") && !settings.fileMode) return indexed;
+  }
+  return actual;
+}
+
 type IndexEntry = {
   mode: string;
   objectId: string;
@@ -77,7 +99,7 @@ function inspectedRoot(cwd: string): string | undefined {
   }
   let base: string;
   try {
-    base = realpathSync(start);
+    base = realpathSync.native(start);
   } catch {
     base = start;
   }
@@ -86,7 +108,7 @@ function inspectedRoot(cwd: string): string | undefined {
     try {
       if (existsSync(path.join(current, ".git"))) {
         try {
-          return realpathSync(current);
+          return realpathSync.native(current);
         } catch {
           return current;
         }
@@ -120,6 +142,20 @@ function insideInspected(candidate: string, root: string): boolean {
   return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
 }
 
+function traversesInspected(candidate: string, root: string): boolean {
+  let current = path.dirname(candidate);
+  for (;;) {
+    try {
+      if (insideInspected(realpathSync.native(current), root)) return true;
+    } catch {
+      return true;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+
 /** Returns an absolute Git binary outside the inspected repository without starting a locator process. */
 export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
   const root = inspectedRoot(cwd);
@@ -134,6 +170,7 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
     if (directory === "" || directory.trim() === "" || !path.isAbsolute(directory)) continue;
     for (const base of baseNames) {
       const candidate = path.join(directory, base);
+      if (insideInspected(candidate, root)) continue;
       try {
         if (!statSync(candidate).isFile()) continue;
       } catch {
@@ -148,27 +185,45 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
       }
       let resolved: string;
       try {
-        resolved = realpathSync(candidate);
+        resolved = realpathSync.native(candidate);
       } catch {
         continue;
       }
-      if (path.isAbsolute(resolved) && !insideInspected(resolved, root)) return resolved;
+      if (path.isAbsolute(resolved) && !insideInspected(resolved, root) && !traversesInspected(candidate, root)) return resolved;
     }
   }
   return undefined;
 }
 
-/** Environment for automatic Git children, with locks, lazy fetches, and PATH command resolution disabled. */
+/** Environment for automatic Git children, without inherited repository selection or PATH command resolution. */
 export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...base, GIT_OPTIONAL_LOCKS: "0", GIT_NO_LAZY_FETCH: "1" };
+  const env: NodeJS.ProcessEnv = { ...base };
+  const selectors = [
+    "GIT_DIR",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_NAMESPACE",
+  ];
   let hasPath = false;
   for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === "path") {
+    const normalized = key.toUpperCase();
+    if (selectors.includes(normalized)
+      || normalized === "GIT_OPTIONAL_LOCKS"
+      || normalized === "GIT_NO_LAZY_FETCH") {
+      delete env[key];
+    } else if (normalized === "PATH") {
       env[key] = "";
       hasPath = true;
     }
   }
   if (!hasPath) env.PATH = "";
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_NO_LAZY_FETCH = "1";
   return env;
 }
 
@@ -263,7 +318,7 @@ function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boo
   if (blobObjectId(content, entry.objectId.length) === entry.objectId) return true;
   if (entry.mode === "120000" || !content.includes(Buffer.from("\r\n"))) return false;
   const attributes = entry.eolAttributes;
-  if (attributes === "-text") return false;
+  if (attributes.endsWith("eol=lf") || attributes === "-text") return false;
   const automatic = attributes.startsWith("text=auto") || !attributes;
   if (!attributes && !["true", "input"].includes(autoCrlf)) return false;
   if (automatic) {
@@ -288,12 +343,13 @@ function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boo
  * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
  */
 export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
-  const [indexOutput, untrackedOutput, resolvedHead, autoCrlfOutput] = await Promise.all([
+  const [indexOutput, untrackedOutput, resolvedHead, autoCrlfOutput, settings] = await Promise.all([
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
       "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
     runGit(["rev-parse", "--verify", "HEAD"]).then(decode, () => ""),
     runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
+    passiveWorktreeSettings(runGit),
   ]);
   const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
   const head = resolvedHead.trim();
@@ -314,7 +370,7 @@ export async function inspectWorktreeWithoutFilters(root: string, runGit: Passiv
     if (indexEntry && !indexEntry.skipWorktree) {
       try {
         const state = await readFileState(root, indexEntry, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
-        mode = process.platform === "win32" && indexEntry.mode !== "120000" ? indexEntry.mode : state.mode;
+        mode = passiveWorktreeMode(state.mode, indexEntry.mode, settings);
         content = state.content;
         if (content) contentBytes += content.length;
         worktreeChanged = !state.statsMatch && (mode !== indexEntry.mode || !content || !matchesIndex(content, indexEntry, autoCrlf));
@@ -342,5 +398,5 @@ export async function inspectWorktreeWithoutFilters(root: string, runGit: Passiv
     const previous = files.get(filePath);
     files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
   }
-  return { head: head || "(initial)", files };
+  return { head: head || "(initial)", files, ...settings };
 }

package/killeros/question.ts

@@ -123,6 +123,7 @@ export function registerQuestionTool(pi: ExtensionAPI): void {
       "Use multiple mode only when the user may need to choose more than one answer; ordinary either/or decisions remain single-select.",
     ],
     parameters: QuestionParams,
+    exposure: "model-only",
     executionMode: "sequential",
 
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {

package/killeros/worked-for.ts

@@ -332,8 +332,8 @@ function receiptModelName(
   model: ExtensionContext["model"],
 ): string | undefined {
   if (settled.modelMismatch || settled.modelProvider === undefined || settled.modelId === undefined) return undefined;
-  if (!model || model.provider !== settled.modelProvider || model.id !== settled.modelId) return undefined;
-  const resolved = modelDisplayName(model);
+  if (!model || model.provider !== settled.modelProvider) return undefined;
+  const resolved = modelDisplayName({ id: settled.modelId });
   if (!resolved || resolved.length > 200) return undefined;
   return resolved;
 }
@@ -355,6 +355,7 @@ export function registerWorkedFor(
   collect: (cwd: string) => Promise<ChangeReceiptCollection> = beginChangeReceipt,
 ): void {
   let active: ActiveReceipt | undefined;
+  let lifecycleGeneration = 0;
   let collectionNoticeShown = false;
 
   pi.registerEntryRenderer<WorkedForEntryData>(WORKED_FOR_ENTRY_TYPE, (entry, options, theme) => {
@@ -369,6 +370,7 @@ export function registerWorkedFor(
   });
 
   pi.on("session_start", async () => {
+    lifecycleGeneration += 1;
     const stale = active;
     active = undefined;
     collectionNoticeShown = false;
@@ -407,18 +409,18 @@ export function registerWorkedFor(
     if (ctx.mode !== "tui" || !active) return;
     if (event.message.role !== "assistant") return;
     const provider: unknown = event.message.provider;
-    const modelId: unknown = event.message.model;
-    if (typeof provider !== "string" || typeof modelId !== "string") active.modelMismatch = true;
+    const requestedModelId: unknown = event.message.model;
+    const responseModelId: unknown = event.message.responseModel;
+    if (typeof provider !== "string" || typeof requestedModelId !== "string"
+      || responseModelId !== undefined && typeof responseModelId !== "string") active.modelMismatch = true;
     else {
+      const modelId = responseModelId ?? requestedModelId;
       if (active.modelProvider === undefined || active.modelId === undefined) {
         active.modelProvider = provider;
         active.modelId = modelId;
       } else if (active.modelProvider !== provider || active.modelId !== modelId) {
         active.modelMismatch = true;
       }
-      if (event.message.responseModel !== undefined && event.message.responseModel !== modelId) {
-        active.modelMismatch = true;
-      }
     }
     finishAssistantStream(
       active,
@@ -447,11 +449,14 @@ export function registerWorkedFor(
   });
 
   pi.on("agent_settled", async (_event, ctx) => {
-    if (ctx.mode !== "tui" || !active) return;
+    if (!active || ctx.mode !== "tui") return;
     const settled = active;
+    const generation = lifecycleGeneration;
     active = undefined;
     const model = receiptModelName(settled, ctx.model);
     const changes = await (await settled.collection).finish();
+    // Shutdown can invalidate ctx while the final Git scan is still running.
+    if (generation !== lifecycleGeneration) return;
     if (changes.state === "unavailable" && changes.reason !== "not-git" && changes.reason !== "timeout" && !collectionNoticeShown) {
       collectionNoticeShown = true;
       ctx.ui.notify(`Change receipt unavailable: ${changes.reason}`, "warning");
@@ -481,6 +486,7 @@ export function registerWorkedFor(
   });
 
   pi.on("session_shutdown", async () => {
+    lifecycleGeneration += 1;
     const stale = active;
     active = undefined;
     if (stale) await (await stale.collection).dispose();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "2.1.32",
+  "version": "3.0.0",
   "description": "TUI, goals, and workflow automation for the Pi coding agent",
   "type": "module",
   "keywords": [
@@ -45,16 +45,16 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.85.0 <1",
-    "@earendil-works/pi-coding-agent": ">=0.85.0 <1",
-    "@earendil-works/pi-tui": ">=0.85.0 <1",
+    "@earendil-works/pi-ai": ">=0.99.2 <1",
+    "@earendil-works/pi-coding-agent": ">=0.99.2 <1",
+    "@earendil-works/pi-tui": ">=0.99.2 <1",
     "typebox": ">=1.1.38 <2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.85.0",
-    "@earendil-works/pi-coding-agent": "0.85.0",
-    "@earendil-works/pi-server": "0.85.0",
-    "@earendil-works/pi-tui": "0.85.0",
+    "@earendil-works/pi-ai": "0.99.2",
+    "@earendil-works/pi-coding-agent": "0.99.2",
+    "@earendil-works/pi-server": "0.99.2",
+    "@earendil-works/pi-tui": "0.99.2",
     "@types/node": "24.12.4",
     "eslint": "^10.9.1",
     "typebox": "1.3.20",
@@ -62,7 +62,6 @@
     "typescript-eslint": "^8.68.0"
   },
   "overrides": {
-    "brace-expansion": "5.0.9",
-    "undici": "8.9.0"
+    "brace-expansion": "5.0.12"
   }
 }