killeros 2.1.32 → 3.0.1

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to KillerOS are documented here. Releases use New Features f
 
 ## [Unreleased]
 
+## [3.0.1] - 2026-10-02
+
+### Changed
+
+- Expanded Pi peer ranges to `>=0.99.2 <2` and pinned development packages to 1.0.0. Compatibility CI now runs the full quality suite against the exact 0.99.2 minimum and latest stable 1.x with matched host packages, without changing the tracked manifest or lockfile.
+- Documented Pi 1.0's fullscreen default and the regular-mode override for terminal-owned scrollback.
+- Documented the protected PR-based release process and merge-commit requirement for automatic `main`-to-`dev` synchronization. CI now validates release metadata before package smoke testing, so mismatched versions, missing release notes, and stale README tags fail before merge.
+
+### Fixed
+
+- Reused bounded cleanup retries in passive Git footer tests so transient Windows directory locks do not fail CI after the security assertions pass.
+- Preserved an authorized goal continuation when a replacement becomes stale during its idle wait, instead of leaving the surviving goal active but idle. Navigation, clear, turn limits, and competing continuation holds remain respected.
+- Rejected recognized credential assignments in Markdown handoffs, including list items, bold labels, and inline-code labels, before creating a destination session.
+- Discarded pending goal mutations after committed navigation or a competing goal mutation during confirmation, idle waiting, or file-baseline inference, including goals set and then cleared. Overlapping commands retain their own continuation holds. Cancelled navigation preserves valid pending commands.
+- Preserved concurrent changes to independent `/auto-compact` fields by merging the effective preference under the settings lock.
+- Removed C1 terminal controls from custom activity tool names.
+- Clipped collapsed and expanded transcript lines to the terminal width, including wide Unicode characters at one column.
+- Treated failed Git HEAD lookups as unavailable instead of inventing added files, while retaining support for repositories without commits. Footer scans and task receipts share the same HEAD resolution.
+- Paused normally stopped goals without an accepted decision even when automatic compaction succeeds or skips a session-too-small request, preventing repeated same-turn requests from bypassing the turn limit. Interrupted-turn recovery and accepted next-turn decisions remain supported.
+- Saved `/handoff` context before reporting success so the linked session survives immediate exit and resume without another prompt or an automatic agent turn.
+- Discarded pending task receipts after committed tree navigation, preventing late scans from attaching the abandoned branch's receipt to the selected branch. Cancelled navigation still preserves receipts.
+
+## [3.0.0] - 2026-10-01
+
+### Changed
+
+- Raised the minimum supported Pi version and locked Pi development packages to 0.99.2, with matching CI and lockfile contracts. Users on older Pi versions must upgrade.
+
+### Added
+
+- Added a Windows CI job on Node.js 22.19.0 that runs the full quality suite, with a repository contract protecting the job's required checks.
+
+### Fixed
+
+- Canonicalized Windows short-path aliases in passive Git executable checks, preventing repository-local shims from being selected through paths such as `RUNNER~1` and fixing the Node.js 22.19.0 Windows CI failure. Removed temporary receipt debug logging.
+- Applied `/codex-fast` priority requests and the footer's `fast` label to eligible native OpenAI Responses models at the official endpoint, for both API-key and ChatGPT subscription authentication. Legacy Codex behavior, command strings, and the process-local opt-in preference are unchanged; priority acceptance and billing remain OpenAI-controlled.
+- Kept `question` and active `killeros_goal_update` directly declared in codemode-only sessions using Pi's native `model-only` exposure, which also prevents scripts and other tools from executing them. Goal activation and TUI-only question behavior are unchanged.
+- Discarded pending change receipts after session replacement or reload and kept late activity and completion-sound handlers from using the old context, preventing stale-context extension errors during receipt finalization.
+- Updated the `brace-expansion` override to patched 5.0.12, fixing recursion and quadratic-time denial of service in development and CI installs.
+- Removed the stale `undici` override so development and CI installs use Pi's patched 8.10.2 dependency, resolving GHSA-3wwx-pv8p-q78v.
+- Refreshed cached change-receipt baselines when `HEAD`, `core.filemode`, or `core.symlinks` changes between responses, while still rejecting `HEAD` changes made during a response.
+- Made passive footer scans and change receipts honor `core.symlinks=false` placeholders and `core.filemode=false` without masking file-type changes.
+- Preserved parent traversal in relative goal paths so directory links cannot redirect file proof to a lexically normalized target or collapse distinct targets.
+- Made the Windows hook cleanup test wait for its child to start and verify that both processes terminate, avoiding false failures when `taskkill` cannot confirm an already-finished cleanup.
+- Showed stable provider-reported model IDs on settled receipts when they differ from the selected alias, including GitHub Copilot Claude models.
+- Reported CRLF worktree content as modified when indexed attributes require `eol=lf`, matching Git in footer counts and change receipts.
+- Kept quoted prose goal destinations on model-reported completion; inferred file proof now requires a path-shaped destination.
+- Isolated passive footer, change-receipt, and startup branch Git scans from inherited repository-selection environment variables.
+- Rejected passive Git executables reached through repository-owned directory links while continuing to safe later `PATH` entries.
+- Prevented single-file goal proof from masking unquoted `Makefile`, `Dockerfile`, or `.gitignore` list items.
+- Prevented single-file goal proof from overlooking additional extensionless targets extracted by goal action and destination clauses. Equivalent path spellings still share one exact-path verification contract.
+- Prevented single-file goal proof from masking additional filenames that extend version or Node.js prose. Goal parsing now keeps spaces and trailing punctuation in quoted paths and matches exact Node.js prose case-insensitively.
+
 ## [2.1.32] - 2026-09-24
 
 ### Fixed

package/README.md

@@ -2,11 +2,13 @@
 
 A TypeScript extension for the [Pi coding agent](https://github.com/earendil-works/pi) that replaces the stock TUI and adds long-running goals, reasoning controls, and workflow commands.
 
+![KillerOS TUI showing the startup masthead, an active goal, a settled task receipt, and the goal footer](.github/assets/killeros-preview.png)
+
 ## What you get
 
 - A custom TUI: startup masthead with versions, model, working directory, and Git branch; a dark theme with coral accents; a multiline editor with slash-command completion; a footer that tracks model, context, and goal state; settled task receipts with duration and token usage.
 - `/goal`: set an objective and Pi keeps working toward it across turns, compaction, reloads, and branch navigation. Each turn must record `continue` with evidence and one next action, `complete`, or the existing blocker decision; otherwise the goal pauses. New goals pause after 20 turns; `/goal resume` grants another 20.
-- `/codex-fast`: toggles the `priority` service tier on Codex requests or reports its status.
+- `/codex-fast`: toggles the `priority` service tier on legacy Codex and eligible native OpenAI Responses requests or reports its status.
 - `/handoff`: starts a fresh linked session carrying visible continuation context.
 - `/auto-compact`: reports, enables, disables, or tunes automatic context compaction.
 - A `question` tool with single-select and multi-select modes.
@@ -17,7 +19,7 @@ A TypeScript extension for the [Pi coding agent](https://github.com/earendil-wor
 ## Requirements
 
 - Node.js 22.19.0+
-- Pi 0.85.0 or later within the 0.x release line
+- Pi 0.99.2 or later below 2.0.0
 - An interactive TUI session for the custom header, editor, footer, and `question`
 
 ## Install
@@ -32,7 +34,7 @@ Or from GitHub:
 pi install git:github.com/KyrosHendrix/pi-KillerOS
 ```
 
-Pin a release by appending its tag, for example `@v2.1.32`. Add `-l` to install only for the current project. Restart Pi after installing.
+Pin a release by appending its tag, for example `@v3.0.1`. Add `-l` to install only for the current project. Restart Pi after installing.
 
 ## Commands
 
@@ -51,14 +53,24 @@ Pin a release by appending its tag, for example `@v2.1.32`. Add `-l` to install
 /exit                     Quit Pi gracefully
 ```
 
+Fast mode is off by default. `/codex-fast` toggles it, and `/codex-fast status` reports the preference without changing it. The preference stays in the current Pi process across model switches and extension reloads, but is not saved between processes. The command name and notification strings retain their legacy Codex wording.
+
+Fast mode applies to legacy `openai-codex` requests and selected native models with provider `openai`, API `openai-responses`, and base URL `https://api.openai.com/v1`, with an optional trailing slash. Native request payloads must also name the selected model's exact ID. Both API-key and ChatGPT subscription authentication use this rule. Custom endpoints, Azure, other APIs, and ambiguous native requests pass through unchanged. When enabled, fast mode overrides an eligible request's existing service tier with `priority`; when disabled, it leaves the request unchanged.
+
+The TUI footer's `fast` label means the enabled preference applies to the selected model, not that OpenAI accepted priority service. OpenAI controls account and model eligibility, the actual service tier, and charges. Priority can affect billing; subscription login does not guarantee accepted or free priority service. KillerOS leaves provider errors to Pi and does not silently retry with a different tier.
+
 ## Behavior by mode
 
+Pi 1.0 defaults to fullscreen. Use `--tui-mode regular` for one invocation or set `"tuiMode": "regular"` in Pi's [settings](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#terminal-and-display) to restore terminal-owned scrollback. KillerOS leaves Pi's `tuiMode` and `quietStartup` preferences unchanged.
+
 | Mode | What works |
 | --- | --- |
 | TUI | Everything |
 | RPC | Goals, proactive compaction; no TUI components, sounds, title indicator |
 | Print/JSON | No interactive questions, `/goal`, or proactive compaction |
 
+`question` and the active `killeros_goal_update` tool use Pi's `model-only` exposure. They stay directly declared to the model when codemode is disabled or enabled in `on` or `only` mode, but scripts and other tools cannot call them through `ctx.executeTool()`. The goal tool remains inactive without an active goal. Questions still require TUI mode; a direct RPC call fails with `The question tool requires interactive TUI mode`. KillerOS does not enable or configure codemode.
+
 ## Configuration
 
 The packaged `killeros` theme activates on TUI start. Compaction triggers by default at 15% tokens remaining, stored in global `killeros.json`:
@@ -75,7 +87,9 @@ The packaged `killeros` theme activates on TUI start. Compaction triggers by def
 
 Use `/auto-compact status` to inspect the effective KillerOS preference, `/auto-compact on` or `/auto-compact off` to toggle it, and `/auto-compact <percent>` to set an integer threshold from 0 through 100. A threshold of 0 does not disable Pi's own token reserve.
 
-`handoffMaxTokens` caps the `/handoff` summary output at 8192 tokens by default; raise it when long sessions truncate the summary.
+Concurrent `/auto-compact` commands preserve independent changes to the enabled flag and threshold, along with unrelated settings. Malformed settings and failed writes report an error without claiming success or replacing the original file.
+
+`handoffMaxTokens` caps the `/handoff` summary output at 8192 tokens by default; raise it when long sessions truncate the summary. The handoff is saved as a visible user-context message before success is reported, so the linked session survives immediate exit and resume without sending another prompt. Creating the handoff does not start an agent turn.
 
 State proof in the objective so the agent can verify it with its normal tools:
 
@@ -83,13 +97,19 @@ State proof in the objective so the agent can verify it with its normal tools:
 /goal Reduce p95 checkout latency below 120 ms, verified by the checkout benchmark, while keeping the correctness suite green
 ```
 
-A direct quoted file target binds silent file proof:
+A direct quoted path-shaped file target binds silent file proof. For an extensionless relative file, use an explicit path such as `./summary` or `.\summary`:
 
 ```text
 /goal Fix `killeros/footer.ts`, verified by npm test
 ```
 
-KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Restored goals keep their persisted limit.
+Bare quoted prose remains model-reported. KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Same-turn recovery requires an actual interruption; successful or skipped compaction cannot restart a normally stopped goal without a decision. Restored goals keep their persisted limit.
+
+Session replacement, reload, and committed tree navigation discard unfinished task receipts. Late receipt results do not write or notify through the old session context or attach to a different branch. Cancelled navigation preserves the pending receipt.
+
+Pending `/goal` commands discard their mutation if committed navigation changes the branch or another mutation changes the goal while confirmation, idle waiting, or file-baseline reading is in progress. Cancelled navigation preserves valid pending commands. Discarding a stale replacement after its idle wait preserves the surviving goal's authorized continuation.
+
+Failed Git metadata reads keep the footer's last successful file counts and mark task changes unavailable. They are not treated as an empty repository.
 
 Completion sounds are off by default; change with `/notification` in TUI mode. The tab-title indicator requires a Nerd Font.
 
@@ -101,12 +121,24 @@ Strict TypeScript throughout. Tests run on Node's built-in test runner:
 npm ci && npm run check && npm test
 ```
 
-Releases go through CI on `main`; do not push version tags manually. The prepublish check rejects ordinary direct `npm publish`, but `--ignore-scripts` can bypass it. Configure npm's trusted publisher for `release.yml`, set package publishing access to "Require two-factor authentication and disallow tokens", and revoke unused publish tokens. npm maintainers can still publish interactively with 2FA, so workflow-only publishing also depends on maintainer policy.
+### Release process
+
+1. Prepare the release on `dev`: update `package.json` and both root versions in `package-lock.json`, update the README's pinned tag, and move completed changelog entries into a dated version section under `[Unreleased]`.
+2. Run `npm run check` and `npm test`, commit and push to `dev`, then open a pull request into `main`. Push later fixes to the same PR so CI reruns.
+3. Wait for every required check to pass, including CodeQL and dependency review, and resolve review conversations. The PR must be up to date with `main`.
+4. Merge using **Create a merge commit**. Squash and rebase merging are disabled because the automated `main`-to-`dev` sync requires shared ancestry. Avoid advancing `dev` until that sync finishes.
+5. Check the `main` CI run and the following Release run. Successful CI on the current `main` commit triggers npm publication with provenance, creates the GitHub release, and fast-forwards `dev` to the released commit. A green PR alone never publishes.
+
+`main` requires pull requests and the CI workflow's required checks, including for administrators. Force pushes and branch deletion are blocked. If CI job names change, update GitHub's required status checks to match.
+
+Releases go through CI on `main`; do not push version tags manually. The package smoke job validates release metadata before packing, and the release workflow checks it again before publication. The prepublish check rejects ordinary direct `npm publish`, but `--ignore-scripts` can bypass it. Configure npm's trusted publisher for `release.yml`, set package publishing access to "Require two-factor authentication and disallow tokens", and revoke unused publish tokens. npm maintainers can still publish interactively with 2FA, so workflow-only publishing also depends on maintainer policy.
 
 ## Security
 
 Pi extensions run with your user permissions. Review the source before installing globally. Hook commands run only for projects Pi marks as trusted; check `.pi/killeros-hooks.json` before enabling project trust. KillerOS accepts that configuration only as a regular, non-linked file no larger than 64 KiB in the project's real `.pi` directory.
 
+Handoff validation rejects recognized credential assignments in plain text, Markdown lists, bold labels, and inline-code labels before creating a destination session. This pattern check cannot detect every secret or personally identifying value. Rejected values are not included in the error notification.
+
 ## License
 
 [MIT](LICENSE) © 2026 KyrosHendrix

package/killeros/activity.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 import { modelDisplayName } from "./display.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export type ActivityMessage =
   | { kind: "prompt" }
@@ -9,7 +10,7 @@ export type ActivityMessage =
   | { kind: "responding" };
 
 function safeToolName(toolName: string): string {
-  const normalized = toolName.replace(/[\u0000-\u001F\u007F]+/gu, " ").replace(/\s+/gu, " ").trim();
+  const normalized = safeTerminalText(toolName.replace(/[\r\n\t]+/gu, " ")).replace(/\s+/gu, " ").trim();
   return truncateToWidth(normalized || "tool", 32, "…");
 }
 
@@ -102,7 +103,7 @@ export function registerRequestActivity(pi: ExtensionAPI): void {
   });
 
   pi.on("agent_settled", (_event, ctx) => {
-    if (ctx.mode !== "tui" || !active || !ctx.isIdle?.() || ctx.hasPendingMessages?.()) return;
+    if (!active || ctx.mode !== "tui" || !ctx.isIdle?.() || ctx.hasPendingMessages?.()) return;
     clear(ctx);
   });
 

package/killeros/auto-compaction.ts

@@ -155,11 +155,15 @@ export function registerAutoCompaction(
       }
 
       try {
-        const preference = readAutoCompactionPreference(settingsStore.load());
-        const updated = percent === undefined
-          ? { ...preference, enabled: argument === "on" }
-          : { ...preference, percentRemaining: percent };
-        settingsStore.update({ autoCompaction: updated });
+        let updated: AutoCompactionPreference | undefined;
+        settingsStore.update((current) => {
+          const preference = readAutoCompactionPreference(current);
+          updated = percent === undefined
+            ? { ...preference, enabled: argument === "on" }
+            : { ...preference, percentRemaining: percent };
+          return { autoCompaction: updated };
+        });
+        if (!updated) throw new Error("Settings update did not apply the preference");
         ctx.ui.notify(percent === undefined
           ? updated.enabled
             ? `Automatic compaction: on at ${updated.percentRemaining}% remaining`

package/killeros/bounded-text.ts

@@ -11,7 +11,7 @@ export class BoundedText implements Component {
 
   render(width: number): string[] {
     if (width <= 0) return [];
-    const lines = new Text(this.text, 0, 0).render(width);
+    const lines = new Text(this.text, 0, 0).render(width).map((line) => truncateToWidth(line, width, ""));
     if (this.maxRows === undefined || lines.length <= this.maxRows) return lines;
     const rowLimit = Math.max(1, this.maxRows);
     const visible = lines.slice(0, rowLimit);

package/killeros/change-receipt.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createReadStream, watch } from "node:fs";
-import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveWorktreeFile as DirtyFile } from "./passive-git-status.ts";
+import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, passiveWorktreeMode, passiveWorktreeSettings, resolvePassiveHead, type PassiveWorktreeFile as DirtyFile, type PassiveWorktreeSnapshot } from "./passive-git-status.ts";
 import { lstat, open, readlink } from "node:fs/promises";
 import path from "node:path";
 import { createInflate } from "node:zlib";
@@ -176,7 +176,7 @@ async function readBoundedFile(filePath: string, limit: number): Promise<Buffer>
   }
 }
 
-type Snapshot = { head: string; files: Map<string, DirtyFile> };
+type Snapshot = PassiveWorktreeSnapshot;
 type RepositoryMonitor = {
   changedPaths: Set<string>;
   inUse: boolean;
@@ -218,7 +218,11 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
     try {
       const absolutePath = path.join(repo.root, ...filePath.split("/"));
       const stats = await lstat(absolutePath);
-      const mode = stats.isSymbolicLink() ? "120000" : stats.mode & 0o111 ? "100755" : "100644";
+      const mode = passiveWorktreeMode(
+        stats.isSymbolicLink() ? "120000" : stats.mode & 0o111 ? "100755" : "100644",
+        previous.indexMode,
+        baseline,
+      );
       const content = stats.isSymbolicLink()
         ? Buffer.from(await readlink(absolutePath))
         : await readBoundedFile(absolutePath, SNAPSHOT_CONTENT_LIMIT - totalBytes);
@@ -230,22 +234,11 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
       files.set(filePath, { ...previous, mode: undefined, content: undefined });
     }
   }
-  return { head: baseline.head, files };
+  return { ...baseline, files };
 }
 
-async function currentHead(repo: Repository): Promise<string> {
-  let resolved: Buffer;
-  try {
-    resolved = await runGit(repo.root, ["rev-parse", "--verify", "HEAD"], undefined, 4_096);
-  } catch (error) {
-    if (!(error instanceof GitFailure) || error.reason !== "error") throw error;
-    const reference = decode(await runGit(repo.root, ["symbolic-ref", "--quiet", "HEAD"], undefined, 4_096)).trim();
-    if (!/^refs\/[^\0\r\n]+$/u.test(reference)) throw new GitFailure("error");
-    return "(initial)";
-  }
-  const head = decode(resolved).trim();
-  if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new GitFailure("error");
-  return head;
+function currentHead(repo: Repository): Promise<string> {
+  return resolvePassiveHead((args) => runGit(repo.root, args, undefined, 4_096));
 }
 
 function observes(filePath: string, observedPaths: readonly string[]): boolean {
@@ -262,7 +255,7 @@ async function refreshSnapshot(monitor: RepositoryMonitor, observedPaths: readon
     if (observes(filePath, observedPaths)) files.delete(filePath);
   }
   for (const [filePath, file] of scoped.files) files.set(filePath, file);
-  return { head: scoped.head, files };
+  return { ...scoped, files };
 }
 
 function createMonitor(repo: Repository, initialSnapshot: Snapshot): RepositoryMonitor {
@@ -626,7 +619,14 @@ export async function beginChangeReceipt(cwd: string, trusted = true): Promise<C
     const idleChanges = [...monitor.changedPaths];
     monitor.changedPaths.clear();
     try {
-      monitor.snapshot = await refreshSnapshot(monitor, idleChanges);
+      const [head, settings] = await Promise.all([
+        currentHead(repo),
+        passiveWorktreeSettings((args) => runGit(repo.root, args)),
+      ]);
+      monitor.snapshot = head !== monitor.snapshot.head
+        || settings.fileMode !== monitor.snapshot.fileMode || settings.symlinks !== monitor.snapshot.symlinks
+        ? await snapshot(repo)
+        : await refreshSnapshot(monitor, idleChanges);
     } catch (error) {
       discardMonitor(monitor);
       throw error;

package/killeros/codex-fast-state.ts

@@ -1,3 +1,5 @@
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
 type CodexFastStateListener = () => void;
 
 interface CodexFastState {
@@ -25,6 +27,12 @@ const state: CodexFastState = isCodexFastState(savedState) ? savedState : {
 };
 globalThis.__killerosCodexFastState = state;
 
+export function isCodexFastModel(model: ExtensionContext["model"]): boolean {
+  return model?.provider === "openai-codex"
+    || (model?.provider === "openai" && model.api === "openai-responses"
+      && (model.baseUrl === "https://api.openai.com/v1" || model.baseUrl === "https://api.openai.com/v1/"));
+}
+
 export function isCodexFastEnabled(): boolean {
   return state.enabled;
 }

package/killeros/codex-fast.ts

@@ -1,7 +1,6 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { isCodexFastEnabled, toggleCodexFast } from "./codex-fast-state.ts";
+import { isCodexFastEnabled, isCodexFastModel, toggleCodexFast } from "./codex-fast-state.ts";
 
-const CODEX_PROVIDER = "openai-codex";
 type RequestPayload = Record<string, unknown>;
 
 function isRequestPayload(value: unknown): value is RequestPayload {
@@ -28,9 +27,11 @@ export function registerCodexFastMode(pi: ExtensionAPI): void {
   });
 
   pi.on("before_provider_request", (event, ctx) => {
-    if (!isCodexFastEnabled() || ctx.model?.provider !== CODEX_PROVIDER || !isRequestPayload(event.payload)) {
+    if (!isCodexFastEnabled() || !isCodexFastModel(ctx.model) || !isRequestPayload(event.payload)) {
       return event.payload;
     }
+    // The hook exposes no dispatched provider/API. Native requests must match the selected model.
+    if (ctx.model?.provider === "openai" && event.payload.model !== ctx.model.id) return event.payload;
     return { ...event.payload, service_tier: "priority" };
   });
 }

package/killeros/footer.ts

@@ -3,7 +3,7 @@ import { watch } from "node:fs";
 import path from "node:path";
 import { type ExtensionAPI, type ExtensionContext, type Theme, type ThemeColor } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth, visibleWidth, type TUI } from "@earendil-works/pi-tui";
-import { isCodexFastEnabled, subscribeCodexFast } from "./codex-fast-state.ts";
+import { isCodexFastEnabled, isCodexFastModel, subscribeCodexFast } from "./codex-fast-state.ts";
 import { formatCwd, formatTime, modelDisplayName, padRight } from "./display.ts";
 import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, type PassiveGitRunner } from "./passive-git-status.ts";
 import { goalElapsedMilliseconds } from "./goal-state.ts";
@@ -15,7 +15,6 @@ const GIT_STATUS_REFRESH_INTERVAL_MS = 30_000;
 const GIT_STATUS_TIMEOUT_MS = 5_000;
 const GIT_STATUS_WATCH_DEBOUNCE_MS = 250;
 const GIT_STATUS_WATCH_INTERVAL_MS = 5_000;
-const CODEX_PROVIDER = "openai-codex";
 export const colorDirectory = (text: string): string => `\x1B[38;2;240;248;154m${text}\x1B[39m`;
 
 export interface GitFileChanges {
@@ -309,7 +308,7 @@ export function formatModel(
   if (!model) return theme.fg("dim", "no model");
   const displayName = modelDisplayName(model) || "unknown model";
   const name = theme.fg("text", displayName);
-  const fast = showCodexFast && model.provider === CODEX_PROVIDER ? theme.fg("text", "fast") : "";
+  const fast = showCodexFast && isCodexFastModel(model) ? theme.fg("text", "fast") : "";
   const provider = includeProvider ? theme.fg("dim", formatProviderName(model.provider)) : "";
   return [name, fast, provider].filter(Boolean).join(" ");
 }

package/killeros/goal-interface.ts

@@ -150,6 +150,7 @@ export function registerGoalInterface(
     label: "Goal update",
     description: "Record exactly one active-goal decision: complete after verification, continue with evidence and one next action, or audit the same blocker before blocking it.",
     parameters: GoalUpdateParams,
+    exposure: "model-only",
     executionMode: "sequential",
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
       signal?.throwIfAborted();
@@ -310,6 +311,9 @@ export function registerGoalInterface(
         ctx.ui.notify("/goal requires a saved session", "error");
         return;
       }
+      const generation = runtime.lifecycleGeneration;
+      const initiatingState = runtime.state;
+      const ownsGoal = (): boolean => runtime.lifecycleGeneration === generation && runtime.state === initiatingState;
 
       if (command.kind === "status") {
         if (!runtime.state) {
@@ -322,9 +326,11 @@ export function registerGoalInterface(
         }
         const actions = goalPanelActions(runtime.state.status);
         const selected = await ctx.ui.select(goalStatusSummary(runtime.state, ctx), actions.map((action) => action.label));
+        if (!ownsGoal()) return;
         const action = actions.find((candidate) => candidate.label === selected);
         if (!action) return;
         if (action.control === "clear" && !await ctx.ui.confirm("Clear goal?", safeTerminalText(runtime.state.objective))) return;
+        if (!ownsGoal()) return;
         await handleGoalCommand(action.control, ctx);
         return;
       }
@@ -486,17 +492,23 @@ export function registerGoalInterface(
           return;
         }
         const replace = await ctx.ui.confirm("Replace active goal", "Replace the current unfinished goal and discard its continuation state?");
-        if (!replace) return;
+        if (!replace || !ownsGoal()) return;
       }
 
-      runtime.continuationHeld = true;
+      const hold = Symbol();
+      runtime.continuationHeld = hold;
       let waitError: unknown;
       try {
         await ctx.waitForIdle();
       } catch (error) {
         waitError = error;
       } finally {
-        runtime.continuationHeld = false;
+        if (runtime.continuationHeld === hold) runtime.continuationHeld = undefined;
+      }
+      if (!ownsGoal()) {
+        // Settlement may have authorized a turn while this command held continuation.
+        if (runtime.lifecycleGeneration === generation) scheduleGoalContinuation(pi, runtime, ctx);
+        return;
       }
       if (waitError) {
         reportError(ctx, "Goal could not wait for the active turn", waitError);
@@ -507,6 +519,7 @@ export function registerGoalInterface(
       try {
         verification = await inferGoalVerification(objective, ctx.cwd);
       } catch (error) {
+        if (!ownsGoal()) return;
         if (!unfinished) {
           reportError(ctx, "Goal could not be started", error);
         } else {
@@ -515,6 +528,7 @@ export function registerGoalInterface(
         }
         return;
       }
+      if (!ownsGoal()) return;
       try {
         const state = createNewGoalState(objective, sumGoalTokens(ctx), verification, Date.now(), {
           maxTurns: DEFAULT_GOAL_MAX_TURNS,

package/killeros/goal-runtime.ts

@@ -119,6 +119,10 @@ export function persistGoalState(
   const data: GoalEntryData = { version: GOAL_VERSION, event, state: state ?? null };
   pi.appendEntry(GOAL_ENTRY_TYPE, data);
   runtime.state = state;
+  if (event === "clear") {
+    runtime.lifecycleGeneration += 1;
+    runtime.continuationHeld = undefined;
+  }
   syncGoalUpdateTool(pi, runtime);
   runtime.persistenceRetryNeeded = false;
   runtime.requestRender?.();
@@ -404,7 +408,7 @@ export function registerGoalRuntime(
     runtime.state = isGoalModeSupported(ctx) ? restored.state : undefined;
     syncGoalUpdateTool(pi, runtime);
     runtime.continuationScheduled = false;
-    runtime.continuationHeld = false;
+    runtime.continuationHeld = undefined;
     runtime.goalTurnInFlight = false;
     runtime.goalTurn = undefined;
     runtime.agentEndObserved = false;
@@ -441,7 +445,7 @@ export function registerGoalRuntime(
     runtime.state = undefined;
     syncGoalUpdateTool(pi, runtime);
     clearGoalExecutionFlags(runtime);
-    runtime.continuationHeld = false;
+    runtime.continuationHeld = undefined;
     runtime.persistenceRetryNeeded = false;
   });
 

package/killeros/goal-settlement.ts

@@ -254,6 +254,10 @@ export function registerGoalSettlement(
         );
         return;
       }
+      if (!expectedInterruption && runtime.automaticCompaction.resumeSameTurn) {
+        stopAutomaticCompactionRecovery(pi, runtime, ctx, "no turn decision");
+        return;
+      }
       if (settledTurn !== undefined && runtime.automaticCompaction.turn === settledTurn) {
         runtime.automaticCompaction.turnSettled = true;
       } else {

package/killeros/goal-state.ts

@@ -144,11 +144,19 @@ function isAbsoluteFilePath(value: string): boolean {
 }
 
 function stripUnquotedPathPunctuation(value: string): string {
-  const pathWithoutMarks = value.replace(/[.!?]+$/u, "");
-  const trailingClosers = pathWithoutMarks.match(/\)+$/u)?.[0].length ?? 0;
-  const unmatchedClosers = Math.max(0, pathWithoutMarks.split(")").length - pathWithoutMarks.split("(").length);
-  const punctuationLength = Math.min(trailingClosers, unmatchedClosers);
-  return pathWithoutMarks.slice(0, punctuationLength ? -punctuationLength : undefined);
+  let stripped = value;
+  while (true) {
+    const withoutMarks = stripped.replace(/[.,;:!?]+$/u, "");
+    if (withoutMarks !== stripped) {
+      stripped = withoutMarks;
+      continue;
+    }
+    const closer = stripped.at(-1);
+    const opener = closer === ")" ? "(" : closer === "]" ? "[" : closer === "}" ? "{" : undefined;
+    if (closer === undefined || opener === undefined
+      || stripped.split(closer).length <= stripped.split(opener).length) return stripped;
+    stripped = stripped.slice(0, -1);
+  }
 }
 
 function isGoalFileVerification(value: unknown): value is GoalFileVerification {
@@ -348,41 +356,80 @@ export async function captureGoalFileBaseline(
 const GOAL_URL_PATTERN = /(?:https?|file):\/\/[^\s"'`]+/giu;
 const GOAL_QUOTED_PATTERN = /`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'/gu;
 const GOAL_ABSOLUTE_PATTERN = /(?:^|[\s"'`(\[{,;])([A-Za-z]:[\\/][^\s,;'"`]+|\/[^\s,;'"`]+)/gu;
-const GOAL_LIST_FILE_PATTERN = /(?:\band\b|\bor\b|[,;&+])\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|([A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b)/giu;
+const GOAL_LIST_FILE_PATTERN = /(?:\band\b|\bor\b|\bplus\b|\balong\s+with\b|[,;&+])\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|((?:\.{1,2}[\\/])*[A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b|(Makefile|Dockerfile|\.gitignore)\b)/giu;
 const GOAL_RELATIVE_FILE_PATTERN = /(?:^|[\s"'`(\[{,;])((?:\.{1,2}[\\/])*[A-Za-z0-9_][A-Za-z0-9_.-]*(?:[\\/][A-Za-z0-9_.-]+)*\.[A-Za-z0-9]{1,12})\b/gu;
 
 function isQuotedGoalFileMention(raw: string): boolean {
   const value = raw.trim();
-  if (!value || /[\s\p{Cc}]/u.test(value) || /^(?:https?|file):\/\//iu.test(value) || /[\\/]$/u.test(value)) return false;
+  if (!value || /\p{Cc}/u.test(value) || /^(?:https?|file):\/\//iu.test(value) || /[\\/]$/u.test(value)) return false;
   return /[\/\\.:]/u.test(value);
 }
 
-function normalizeGoalFileMention(raw: string, cwd: string): string | undefined {
-  const value = raw.trim().replace(/[.,;:!?)\]}]+$/u, "");
-  if (!value || /[\s\p{Cc}]/u.test(value)) return undefined;
-  const absolute = path.isAbsolute(value) || path.win32.isAbsolute(value) ? value : path.resolve(cwd, value);
+function isPathShapedGoalCandidate(raw: string): boolean {
+  if (/\p{Cc}/u.test(raw)) return false;
+  const value = raw.trim();
+  if (!value || /[\\\/]$/u.test(value)) return false;
+  if (path.isAbsolute(value) || path.win32.isAbsolute(value)) return true;
+  if (URL.canParse(value)) return false;
+  return /[\\\/]/u.test(value)
+    || value.startsWith(".") && value !== "." && value !== ".."
+    || /\.[A-Za-z0-9]{1,12}$/u.test(value);
+}
+
+function goalPathIdentity(filePath: string): string {
+  const nativePath = process.platform === "win32" ? filePath.replaceAll("/", "\\") : filePath;
+  // Parent segments may traverse symlinks; keep them distinct without filesystem proof.
+  const normalized = nativePath.split(path.sep).includes("..") ? nativePath : path.normalize(nativePath);
+  return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+
+function absoluteGoalFilePath(value: string, cwd: string): string {
+  if (path.isAbsolute(value) || path.win32.isAbsolute(value)) return value;
+  const nativePath = process.platform === "win32" ? value.replaceAll("/", "\\") : value;
+  // Resolving parent segments lexically can select a different file across a directory symlink.
+  return nativePath.split(path.sep).includes("..")
+    ? `${path.resolve(cwd)}${path.sep}${nativePath}`
+    : path.resolve(cwd, value);
+}
+
+function normalizeGoalFileMention(raw: string, cwd: string, quoted = false): string | undefined {
+  const trimmed = raw.trim();
+  const value = quoted ? trimmed : stripUnquotedPathPunctuation(trimmed);
+  if (!value || /\p{Cc}/u.test(value) || !quoted && /\s/u.test(value)) return undefined;
+  const absolute = absoluteGoalFilePath(value, cwd);
   if (!isAbsoluteFilePath(absolute)) return undefined;
-  return process.platform === "win32" ? absolute.toLowerCase() : absolute;
+  return goalPathIdentity(absolute);
 }
 
 /** Counts distinct path-shaped mentions so several files cannot bind proof to one. */
-function countGoalTargetFiles(objective: string, cwd: string, target: string): number {
-  const prose = objective.replace(GOAL_URL_PATTERN, " ");
+function countGoalTargetFiles(objective: string, cwd: string, target: string, targetQuoted: boolean): number {
+  const source = objective.replace(GOAL_URL_PATTERN, " ");
+  // ponytail: Only these exact prose forms are excluded; quote ambiguous bare filenames for exact proof.
+  const prose = source.replace(GOAL_QUOTED_PATTERN, " ")
+    .replace(/(?<![A-Za-z0-9_.\\/-])version\s+\d+(?:\.\d+)+(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))/giu, " ")
+    .replace(/(?<![A-Za-z0-9_.\\/-])for\s+Node\.js(?!\s+compatibility\.[A-Za-z0-9])(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))|(?<![A-Za-z0-9_.\\/-])Node\.js\s+compatibility(?=$|[\s,;:!?)\]}]|\.(?=$|[\s,;:!?)\]}]))/giu, " ");
   const mentions = new Set<string>();
-  const add = (raw: string): void => {
-    const normalized = normalizeGoalFileMention(raw, cwd);
+  const add = (raw: string, quoted = false): void => {
+    const normalized = normalizeGoalFileMention(raw, cwd, quoted);
     if (normalized) mentions.add(normalized);
   };
-  add(target);
-  for (const match of prose.matchAll(GOAL_QUOTED_PATTERN)) {
+  add(target, targetQuoted);
+  for (const match of source.matchAll(GOAL_QUOTED_PATTERN)) {
     const raw = match[1] ?? match[2] ?? match[3] ?? "";
-    if (isQuotedGoalFileMention(raw)) add(raw);
+    if (isQuotedGoalFileMention(raw)) add(raw, true);
+  }
+  for (const match of source.matchAll(GOAL_LIST_FILE_PATTERN)) {
+    const quoted = match[1] ?? match[2] ?? match[3];
+    if (quoted !== undefined) add(quoted, true);
   }
   for (const match of prose.matchAll(GOAL_ABSOLUTE_PATTERN)) {
     if (match[1]) add(stripUnquotedPathPunctuation(match[1].trim()));
   }
-  for (const match of prose.matchAll(GOAL_LIST_FILE_PATTERN)) add(match[1] ?? match[2] ?? match[3] ?? match[4] ?? "");
-  for (const match of prose.replace(GOAL_QUOTED_PATTERN, " ").matchAll(GOAL_RELATIVE_FILE_PATTERN)) {
+  for (const match of prose.matchAll(GOAL_LIST_FILE_PATTERN)) {
+    if (match[4]) add(match[4]);
+    if (match[5]) add(match[5]);
+  }
+  for (const match of prose.matchAll(GOAL_RELATIVE_FILE_PATTERN)) {
     if (match[1]) add(match[1]);
   }
   return mentions.size;
@@ -390,30 +437,43 @@ function countGoalTargetFiles(objective: string, cwd: string, target: string): n
 
 /** Captures one explicit output path so goal completion can verify its creation or modification. */
 export async function inferGoalVerification(objective: string, cwd: string): Promise<GoalFileVerification | undefined> {
-  const candidates: string[] = [];
+  const candidates: Array<{ raw: string; quoted: boolean }> = [];
   const destination = /\b(?:create|write|save|generate)\b[^\r\n]{0,160}?\b(?:file|document|markdown|report|spreadsheet|presentation|image)\b\s+(?:to|at|as|destination(?:\s+is)?|output(?:\s+(?:to|at))?)\b\s*(?:`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)'|([A-Za-z]:\\[^\s,;]+|\/[^\s,;]+))/giu;
   for (const match of objective.matchAll(destination)) {
     const quoted = match[1] ?? match[2] ?? match[3];
-    candidates.push(quoted !== undefined ? quoted.trim() : stripUnquotedPathPunctuation((match[4] ?? "").trim()));
+    candidates.push({
+      raw: quoted !== undefined ? quoted : stripUnquotedPathPunctuation((match[4] ?? "").trim()),
+      quoted: quoted !== undefined,
+    });
   }
   const direct = /\b(?:update|edit|fix|refactor|migrate)\s+(`([^`\r\n]+)`|"([^"\r\n]+)"|'([^'\r\n]+)')/giu;
   for (const match of objective.matchAll(direct)) {
     const quoted = match[2] ?? match[3] ?? match[4];
-    if (quoted !== undefined) candidates.push(quoted.trim());
+    if (quoted !== undefined) candidates.push({ raw: quoted, quoted: true });
   }
-  const resolved: string[] = [];
-  for (const raw of candidates) {
-    if (!raw || /^(?:https?|file):\/\//iu.test(raw) || /[\\\/]$/u.test(raw)) continue;
-    const absolute = path.isAbsolute(raw) || path.win32.isAbsolute(raw) ? raw : path.resolve(cwd, raw);
-    if (isAbsoluteFilePath(absolute)) resolved.push(absolute);
+  const operands = new Set<string>();
+  const resolved = new Map<string, { filePath: string; quoted: boolean }>();
+  for (const candidate of candidates) {
+    const value = candidate.raw.trim();
+    if (!value || /\p{Cc}/u.test(value)) continue;
+    const alreadyAbsolute = path.isAbsolute(value) || path.win32.isAbsolute(value);
+    if (!alreadyAbsolute && URL.canParse(value)) continue;
+    const absolute = absoluteGoalFilePath(value, cwd);
+    const identity = goalPathIdentity(absolute);
+    operands.add(identity);
+    if (!isPathShapedGoalCandidate(candidate.raw) || !isAbsoluteFilePath(absolute)) continue;
+    const existing = resolved.get(identity);
+    resolved.set(identity, {
+      filePath: existing?.filePath ?? absolute,
+      quoted: candidate.quoted || existing?.quoted === true,
+    });
   }
-  const unique = [...new Set(resolved)];
-  if (unique.length !== 1) return undefined;
+  if (operands.size !== 1 || resolved.size !== 1) return undefined;
   // A goal that names several files must not verify from one file alone.
   // Repeated references to the same file count as one target.
-  const filePath = unique[0];
-  if (countGoalTargetFiles(objective, cwd, filePath) > 1) return undefined;
-  return { kind: "file", path: filePath, baseline: await captureGoalFileBaseline(filePath) };
+  const target = resolved.values().next().value;
+  if (target === undefined || countGoalTargetFiles(objective, cwd, target.filePath, target.quoted) > 1) return undefined;
+  return { kind: "file", path: target.filePath, baseline: await captureGoalFileBaseline(target.filePath) };
 }
 
 export async function verifyGoalDeliverable(verification: GoalFileVerification): Promise<void> {

package/killeros/handoff.ts

@@ -300,7 +300,8 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime, hand
           parentSession: sourceSession,
           setup: async (sessionManager) => {
             try {
-              sessionManager.appendCustomMessageEntry("killeros-handoff", document, true);
+              // A regular user message makes Pi persist the otherwise setup-only child session.
+              sessionManager.appendMessage({ role: "user", content: document, timestamp: Date.now() });
               sessionManager.appendSessionInfo(sessionName(sourceName, focus, document));
             } catch (error) {
               setupFailure = { error };

package/killeros/notifications.ts

@@ -117,7 +117,7 @@ export function registerCompletionNotifications(
   });
 
   pi.on("agent_settled", (_event, ctx) => {
-    if (ctx.mode !== "tui" || !requestPending) return;
+    if (!requestPending || ctx.mode !== "tui") return;
     if (!ctx.isIdle() || ctx.hasPendingMessages()) return;
     requestPending = false;
     if (!enabled || lastStopReason === "aborted") return;

package/killeros/passive-git-status.ts

@@ -8,6 +8,13 @@ const PASSIVE_METADATA_ARGS = ["-c", "core.fsmonitor=false"] as const;
 
 export type PassiveGitRunner = (args: readonly string[]) => Promise<Buffer>;
 
+/** Revs-only returns empty output for an unborn HEAD; command failures still reject. */
+export async function resolvePassiveHead(runGit: PassiveGitRunner): Promise<string> {
+  const head = decode(await runGit(["rev-parse", "--revs-only", "--end-of-options", "HEAD"])).trim();
+  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
+  return head || "(initial)";
+}
+
 export type PassiveWorktreeFile = {
   path: string;
   headMode?: string;
@@ -22,8 +29,30 @@ export type PassiveWorktreeFile = {
 export type PassiveWorktreeSnapshot = {
   head: string;
   files: Map<string, PassiveWorktreeFile>;
+  fileMode: boolean;
+  symlinks: boolean;
 };
 
+export async function passiveWorktreeSettings(runGit: PassiveGitRunner): Promise<Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">> {
+  const [fileMode, symlinks] = await Promise.all([
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.filemode"]),
+    runGit(["config", "--type=bool", "--default", "true", "--get", "core.symlinks"]),
+  ]);
+  return { fileMode: decode(fileMode).trim() === "true", symlinks: decode(symlinks).trim() === "true" };
+}
+
+export function passiveWorktreeMode(
+  actual: string,
+  indexed: string | undefined,
+  settings: Pick<PassiveWorktreeSnapshot, "fileMode" | "symlinks">,
+): string {
+  if (actual === "100644" || actual === "100755") {
+    if (indexed === "120000" && !settings.symlinks) return indexed;
+    if ((indexed === "100644" || indexed === "100755") && !settings.fileMode) return indexed;
+  }
+  return actual;
+}
+
 type IndexEntry = {
   mode: string;
   objectId: string;
@@ -77,7 +106,7 @@ function inspectedRoot(cwd: string): string | undefined {
   }
   let base: string;
   try {
-    base = realpathSync(start);
+    base = realpathSync.native(start);
   } catch {
     base = start;
   }
@@ -86,7 +115,7 @@ function inspectedRoot(cwd: string): string | undefined {
     try {
       if (existsSync(path.join(current, ".git"))) {
         try {
-          return realpathSync(current);
+          return realpathSync.native(current);
         } catch {
           return current;
         }
@@ -120,6 +149,20 @@ function insideInspected(candidate: string, root: string): boolean {
   return normalizedCandidate.startsWith(`${trimmed}${path.sep}`);
 }
 
+function traversesInspected(candidate: string, root: string): boolean {
+  let current = path.dirname(candidate);
+  for (;;) {
+    try {
+      if (insideInspected(realpathSync.native(current), root)) return true;
+    } catch {
+      return true;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) return false;
+    current = parent;
+  }
+}
+
 /** Returns an absolute Git binary outside the inspected repository without starting a locator process. */
 export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.env): string | undefined {
   const root = inspectedRoot(cwd);
@@ -134,6 +177,7 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
     if (directory === "" || directory.trim() === "" || !path.isAbsolute(directory)) continue;
     for (const base of baseNames) {
       const candidate = path.join(directory, base);
+      if (insideInspected(candidate, root)) continue;
       try {
         if (!statSync(candidate).isFile()) continue;
       } catch {
@@ -148,27 +192,45 @@ export function passiveGitCommand(cwd: string, env: NodeJS.ProcessEnv = process.
       }
       let resolved: string;
       try {
-        resolved = realpathSync(candidate);
+        resolved = realpathSync.native(candidate);
       } catch {
         continue;
       }
-      if (path.isAbsolute(resolved) && !insideInspected(resolved, root)) return resolved;
+      if (path.isAbsolute(resolved) && !insideInspected(resolved, root) && !traversesInspected(candidate, root)) return resolved;
     }
   }
   return undefined;
 }
 
-/** Environment for automatic Git children, with locks, lazy fetches, and PATH command resolution disabled. */
+/** Environment for automatic Git children, without inherited repository selection or PATH command resolution. */
 export function passiveGitEnv(base: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
-  const env: NodeJS.ProcessEnv = { ...base, GIT_OPTIONAL_LOCKS: "0", GIT_NO_LAZY_FETCH: "1" };
+  const env: NodeJS.ProcessEnv = { ...base };
+  const selectors = [
+    "GIT_DIR",
+    "GIT_CEILING_DIRECTORIES",
+    "GIT_DISCOVERY_ACROSS_FILESYSTEM",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_NAMESPACE",
+  ];
   let hasPath = false;
   for (const key of Object.keys(env)) {
-    if (key.toLowerCase() === "path") {
+    const normalized = key.toUpperCase();
+    if (selectors.includes(normalized)
+      || normalized === "GIT_OPTIONAL_LOCKS"
+      || normalized === "GIT_NO_LAZY_FETCH") {
+      delete env[key];
+    } else if (normalized === "PATH") {
       env[key] = "";
       hasPath = true;
     }
   }
   if (!hasPath) env.PATH = "";
+  env.GIT_OPTIONAL_LOCKS = "0";
+  env.GIT_NO_LAZY_FETCH = "1";
   return env;
 }
 
@@ -263,7 +325,7 @@ function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boo
   if (blobObjectId(content, entry.objectId.length) === entry.objectId) return true;
   if (entry.mode === "120000" || !content.includes(Buffer.from("\r\n"))) return false;
   const attributes = entry.eolAttributes;
-  if (attributes === "-text") return false;
+  if (attributes.endsWith("eol=lf") || attributes === "-text") return false;
   const automatic = attributes.startsWith("text=auto") || !attributes;
   if (!attributes && !["true", "input"].includes(autoCrlf)) return false;
   if (automatic) {
@@ -288,18 +350,17 @@ function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boo
  * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
  */
 export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
-  const [indexOutput, untrackedOutput, resolvedHead, autoCrlfOutput] = await Promise.all([
+  const [indexOutput, untrackedOutput, head, autoCrlfOutput, settings] = await Promise.all([
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
       "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
-    runGit(["rev-parse", "--verify", "HEAD"]).then(decode, () => ""),
+    resolvePassiveHead(runGit),
     runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
+    passiveWorktreeSettings(runGit),
   ]);
   const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
-  const head = resolvedHead.trim();
-  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
   const index = parseIndex(indexOutput);
-  const tree = head ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
+  const tree = head !== "(initial)" ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
   const files = new Map<string, PassiveWorktreeFile>();
   let contentBytes = 0;
 
@@ -314,7 +375,7 @@ export async function inspectWorktreeWithoutFilters(root: string, runGit: Passiv
     if (indexEntry && !indexEntry.skipWorktree) {
       try {
         const state = await readFileState(root, indexEntry, filePath, WORKTREE_CONTENT_LIMIT - contentBytes);
-        mode = process.platform === "win32" && indexEntry.mode !== "120000" ? indexEntry.mode : state.mode;
+        mode = passiveWorktreeMode(state.mode, indexEntry.mode, settings);
         content = state.content;
         if (content) contentBytes += content.length;
         worktreeChanged = !state.statsMatch && (mode !== indexEntry.mode || !content || !matchesIndex(content, indexEntry, autoCrlf));
@@ -342,5 +403,5 @@ export async function inspectWorktreeWithoutFilters(root: string, runGit: Passiv
     const previous = files.get(filePath);
     files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
   }
-  return { head: head || "(initial)", files };
+  return { head, files, ...settings };
 }

package/killeros/question.ts

@@ -123,6 +123,7 @@ export function registerQuestionTool(pi: ExtensionAPI): void {
       "Use multiple mode only when the user may need to choose more than one answer; ordinary either/or decisions remain single-select.",
     ],
     parameters: QuestionParams,
+    exposure: "model-only",
     executionMode: "sequential",
 
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {

package/killeros/runtime.ts

@@ -124,7 +124,7 @@ export interface GoalTurnExecution {
 export interface GoalRuntime {
   state?: GoalState;
   continuationScheduled: boolean;
-  continuationHeld: boolean;
+  continuationHeld?: symbol;
   goalTurnInFlight: boolean;
   agentEndObserved: boolean;
   goalTurn?: GoalTurnExecution;
@@ -139,7 +139,7 @@ export interface GoalRuntime {
 export function createGoalRuntime(): GoalRuntime {
   return {
     continuationScheduled: false,
-    continuationHeld: false,
+    continuationHeld: undefined,
     goalTurnInFlight: false,
     agentEndObserved: false,
     goalTurn: undefined,

package/killeros/secret-detector.ts

@@ -10,7 +10,7 @@ const SECRET_PATTERNS = [
   /\bsk_live_[A-Za-z0-9]{16,255}\b/u,
   /\bxox[baprs]-[A-Za-z0-9-]{10,255}\b/u,
   /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/iu,
-  /^[\t ]*["']?[\w.-]*(?:api_key|apikey|password|passwd|secret|token)[\w.-]*["']?[\t ]*(?:=|:)[\t ]*(?:"[^"\r\n]+"|'[^'\r\n]+'|[^\s#][^\r\n]*)/imu,
+  /^[\t ]*(?:(?:[-*+]|\d+[.)])[\t ]+)?(?:\*\*|`)?["']?[\w.-]*(?:api_key|apikey|password|passwd|secret|token)[\w.-]*["']?(?:\*\*|`)?[\t ]*(?:=|:)[\t ]*(?:"[^"\r\n]+"|'[^'\r\n]+'|[^\s#][^\r\n]*)/imu,
 ] as const;
 
 /** Detects high-confidence credential material without returning the matched value. */

package/killeros/settings.ts

@@ -5,10 +5,13 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { hasErrorCode } from "./errors.ts";
 
 export type KillerosSettings = Record<string, unknown>;
+export type KillerosSettingsUpdate = Readonly<Record<string, unknown>>
+  | ((current: Readonly<KillerosSettings>) => Readonly<Record<string, unknown>>);
 
 export interface KillerosSettingsStore {
   load(): KillerosSettings;
-  update(patch: Readonly<Record<string, unknown>>): void;
+  /** Derive a field update from the latest settings while holding the writer lock. */
+  update(patch: KillerosSettingsUpdate): void;
 }
 
 function isSettings(value: unknown): value is KillerosSettings {
@@ -123,9 +126,10 @@ export function createKillerosSettingsStore(
       const temporaryPath = `${settingsPath}.${process.pid}.${randomUUID()}.tmp`;
       try {
         const current = readStoredSettings(settingsPath);
+        const changes = typeof patch === "function" ? patch(current) : patch;
         writeFileSync(
           temporaryPath,
-          `${JSON.stringify({ ...current, ...patch }, null, 2)}\n`,
+          `${JSON.stringify({ ...current, ...changes }, null, 2)}\n`,
           { encoding: "utf8", mode: 0o600 },
         );
         renameSync(temporaryPath, settingsPath);

package/killeros/worked-for.ts

@@ -302,6 +302,7 @@ export function workedForOutcome(stopReason: StopReason | undefined): WorkedForO
 }
 
 type ActiveReceipt = {
+  leafId: string | null;
   startedAt: number;
   startedTokens: number | undefined;
   stopReason: StopReason | undefined;
@@ -332,8 +333,8 @@ function receiptModelName(
   model: ExtensionContext["model"],
 ): string | undefined {
   if (settled.modelMismatch || settled.modelProvider === undefined || settled.modelId === undefined) return undefined;
-  if (!model || model.provider !== settled.modelProvider || model.id !== settled.modelId) return undefined;
-  const resolved = modelDisplayName(model);
+  if (!model || model.provider !== settled.modelProvider) return undefined;
+  const resolved = modelDisplayName({ id: settled.modelId });
   if (!resolved || resolved.length > 200) return undefined;
   return resolved;
 }
@@ -355,6 +356,7 @@ export function registerWorkedFor(
   collect: (cwd: string) => Promise<ChangeReceiptCollection> = beginChangeReceipt,
 ): void {
   let active: ActiveReceipt | undefined;
+  let lifecycleGeneration = 0;
   let collectionNoticeShown = false;
 
   pi.registerEntryRenderer<WorkedForEntryData>(WORKED_FOR_ENTRY_TYPE, (entry, options, theme) => {
@@ -368,16 +370,20 @@ export function registerWorkedFor(
     return new Text(`${headline}${theme.fg("dim", ` · ${formatWorkedForDuration(data.milliseconds)}${tokens}`)}`, 1, 0);
   });
 
-  pi.on("session_start", async () => {
+  const resetForBranch = async (): Promise<void> => {
+    lifecycleGeneration += 1;
     const stale = active;
     active = undefined;
     collectionNoticeShown = false;
     if (stale) await (await stale.collection).dispose();
-  });
+  };
+  pi.on("session_start", resetForBranch);
+  pi.on("session_tree", resetForBranch);
 
   pi.on("agent_start", async (_event, ctx) => {
     if (ctx.mode !== "tui" || active || !ctx.isProjectTrusted()) return;
     const state: ActiveReceipt = {
+      leafId: ctx.sessionManager.getLeafId(),
       startedAt: now(),
       startedTokens: sessionTokenTotal(ctx),
       stopReason: undefined,
@@ -407,18 +413,18 @@ export function registerWorkedFor(
     if (ctx.mode !== "tui" || !active) return;
     if (event.message.role !== "assistant") return;
     const provider: unknown = event.message.provider;
-    const modelId: unknown = event.message.model;
-    if (typeof provider !== "string" || typeof modelId !== "string") active.modelMismatch = true;
+    const requestedModelId: unknown = event.message.model;
+    const responseModelId: unknown = event.message.responseModel;
+    if (typeof provider !== "string" || typeof requestedModelId !== "string"
+      || responseModelId !== undefined && typeof responseModelId !== "string") active.modelMismatch = true;
     else {
+      const modelId = responseModelId ?? requestedModelId;
       if (active.modelProvider === undefined || active.modelId === undefined) {
         active.modelProvider = provider;
         active.modelId = modelId;
       } else if (active.modelProvider !== provider || active.modelId !== modelId) {
         active.modelMismatch = true;
       }
-      if (event.message.responseModel !== undefined && event.message.responseModel !== modelId) {
-        active.modelMismatch = true;
-      }
     }
     finishAssistantStream(
       active,
@@ -438,6 +444,8 @@ export function registerWorkedFor(
 
   pi.on("agent_end", (event, ctx) => {
     if (ctx.mode !== "tui" || !active) return;
+    // Pi is not idle yet; later settlement handlers can overlap tree navigation.
+    active.leafId = ctx.sessionManager.getLeafId();
     for (let index = event.messages.length - 1; index >= 0; index -= 1) {
       const message = event.messages[index];
       if (message?.role !== "assistant") continue;
@@ -447,11 +455,15 @@ export function registerWorkedFor(
   });
 
   pi.on("agent_settled", async (_event, ctx) => {
-    if (ctx.mode !== "tui" || !active) return;
+    if (!active || ctx.mode !== "tui") return;
     const settled = active;
+    const generation = lifecycleGeneration;
     active = undefined;
     const model = receiptModelName(settled, ctx.model);
     const changes = await (await settled.collection).finish();
+    // Earlier async session_tree handlers can delay our reset after Pi switches branches.
+    if (generation !== lifecycleGeneration
+      || !ctx.sessionManager.getBranch().some((entry) => entry.id === settled.leafId)) return;
     if (changes.state === "unavailable" && changes.reason !== "not-git" && changes.reason !== "timeout" && !collectionNoticeShown) {
       collectionNoticeShown = true;
       ctx.ui.notify(`Change receipt unavailable: ${changes.reason}`, "warning");
@@ -481,6 +493,7 @@ export function registerWorkedFor(
   });
 
   pi.on("session_shutdown", async () => {
+    lifecycleGeneration += 1;
     const stale = active;
     active = undefined;
     if (stale) await (await stale.collection).dispose();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "2.1.32",
+  "version": "3.0.1",
   "description": "TUI, goals, and workflow automation for the Pi coding agent",
   "type": "module",
   "keywords": [
@@ -45,16 +45,16 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.85.0 <1",
-    "@earendil-works/pi-coding-agent": ">=0.85.0 <1",
-    "@earendil-works/pi-tui": ">=0.85.0 <1",
+    "@earendil-works/pi-ai": ">=0.99.2 <2",
+    "@earendil-works/pi-coding-agent": ">=0.99.2 <2",
+    "@earendil-works/pi-tui": ">=0.99.2 <2",
     "typebox": ">=1.1.38 <2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.85.0",
-    "@earendil-works/pi-coding-agent": "0.85.0",
-    "@earendil-works/pi-server": "0.85.0",
-    "@earendil-works/pi-tui": "0.85.0",
+    "@earendil-works/pi-ai": "1.0.0",
+    "@earendil-works/pi-coding-agent": "1.0.0",
+    "@earendil-works/pi-server": "1.0.0",
+    "@earendil-works/pi-tui": "1.0.0",
     "@types/node": "24.12.4",
     "eslint": "^10.9.1",
     "typebox": "1.3.20",
@@ -62,7 +62,6 @@
     "typescript-eslint": "^8.68.0"
   },
   "overrides": {
-    "brace-expansion": "5.0.9",
-    "undici": "8.9.0"
+    "brace-expansion": "5.0.12"
   }
 }