killeros 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to KillerOS are documented here. Releases use New Features f
 
 ## [Unreleased]
 
+## [3.0.2] - 2026-10-05
+
+### Changed
+
+- Raised the minimum supported Pi version and locked Pi development packages to 1.0.2. Compatibility CI now tests the exact 1.0.2 minimum and latest stable 1.x; users on older Pi versions must upgrade.
+- Documented Pi's native thinking-level sampling configuration and trusted-project MCP overrides without adding KillerOS commands or settings.
+
+### Added
+
+- Added real Pi contract coverage for capacity-error recovery within one logical goal turn, with task receipts and completion sounds deferred until settlement.
+- Verified that native OpenAI fast mode preserves thinking-level sampling overrides across API-key and ChatGPT subscription requests, extension reloads, and provider retries.
+
+### Fixed
+
+- Kept POSIX process-group cleanup pending after a timed-out or cancelled hook's shell exits, preserving forced termination and reporting bounded uncertainty unless group exit is confirmed. Fixes #42.
+- Preserved goal-request ownership through settlement so automatic compaction cannot restart completed or blocked goals as ordinary work. Active-goal recovery, later ordinary requests, and compaction error reporting remain supported. Fixes #43.
+- Corrected the process-tree timeout fixture's marker argument and delayed descendant writes beyond cleanup. Added a real cleanup-disabled control that detects surviving descendants and checks explicit uncertainty. Fixes #44.
+
+## [3.0.1] - 2026-10-02
+
+### Changed
+
+- Expanded Pi peer ranges to `>=0.99.2 <2` and pinned development packages to 1.0.0. Compatibility CI now runs the full quality suite against the exact 0.99.2 minimum and latest stable 1.x with matched host packages, without changing the tracked manifest or lockfile.
+- Documented Pi 1.0's fullscreen default and the regular-mode override for terminal-owned scrollback.
+- Documented the protected PR-based release process and merge-commit requirement for automatic `main`-to-`dev` synchronization. CI now validates release metadata before package smoke testing, so mismatched versions, missing release notes, and stale README tags fail before merge.
+
+### Fixed
+
+- Reused bounded cleanup retries in passive Git footer tests so transient Windows directory locks do not fail CI after the security assertions pass.
+- Preserved an authorized goal continuation when a replacement becomes stale during its idle wait, instead of leaving the surviving goal active but idle. Navigation, clear, turn limits, and competing continuation holds remain respected.
+- Rejected recognized credential assignments in Markdown handoffs, including list items, bold labels, and inline-code labels, before creating a destination session.
+- Discarded pending goal mutations after committed navigation or a competing goal mutation during confirmation, idle waiting, or file-baseline inference, including goals set and then cleared. Overlapping commands retain their own continuation holds. Cancelled navigation preserves valid pending commands.
+- Preserved concurrent changes to independent `/auto-compact` fields by merging the effective preference under the settings lock.
+- Removed C1 terminal controls from custom activity tool names.
+- Clipped collapsed and expanded transcript lines to the terminal width, including wide Unicode characters at one column.
+- Treated failed Git HEAD lookups as unavailable instead of inventing added files, while retaining support for repositories without commits. Footer scans and task receipts share the same HEAD resolution.
+- Paused normally stopped goals without an accepted decision even when automatic compaction succeeds or skips a session-too-small request, preventing repeated same-turn requests from bypassing the turn limit. Interrupted-turn recovery and accepted next-turn decisions remain supported.
+- Saved `/handoff` context before reporting success so the linked session survives immediate exit and resume without another prompt or an automatic agent turn.
+- Discarded pending task receipts after committed tree navigation, preventing late scans from attaching the abandoned branch's receipt to the selected branch. Cancelled navigation still preserves receipts.
+
 ## [3.0.0] - 2026-10-01
 
 ### Changed

package/README.md

@@ -19,7 +19,7 @@ A TypeScript extension for the [Pi coding agent](https://github.com/earendil-wor
 ## Requirements
 
 - Node.js 22.19.0+
-- Pi 0.99.2 or later within the 0.x release line
+- Pi 1.0.2 or later below 2.0.0
 - An interactive TUI session for the custom header, editor, footer, and `question`
 
 ## Install
@@ -34,7 +34,7 @@ Or from GitHub:
 pi install git:github.com/KyrosHendrix/pi-KillerOS
 ```
 
-Pin a release by appending its tag, for example `@v3.0.0`. Add `-l` to install only for the current project. Restart Pi after installing.
+Pin a release by appending its tag, for example `@v3.0.2`. Add `-l` to install only for the current project. Restart Pi after installing.
 
 ## Commands
 
@@ -61,6 +61,8 @@ The TUI footer's `fast` label means the enabled preference applies to the select
 
 ## Behavior by mode
 
+Pi 1.0 defaults to fullscreen. Use `--tui-mode regular` for one invocation or set `"tuiMode": "regular"` in Pi's [settings](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/settings.md#terminal-and-display) to restore terminal-owned scrollback. KillerOS leaves Pi's `tuiMode` and `quietStartup` preferences unchanged.
+
 | Mode | What works |
 | --- | --- |
 | TUI | Everything |
@@ -85,7 +87,9 @@ The packaged `killeros` theme activates on TUI start. Compaction triggers by def
 
 Use `/auto-compact status` to inspect the effective KillerOS preference, `/auto-compact on` or `/auto-compact off` to toggle it, and `/auto-compact <percent>` to set an integer threshold from 0 through 100. A threshold of 0 does not disable Pi's own token reserve.
 
-`handoffMaxTokens` caps the `/handoff` summary output at 8192 tokens by default; raise it when long sessions truncate the summary.
+Concurrent `/auto-compact` commands preserve independent changes to the enabled flag and threshold, along with unrelated settings. Malformed settings and failed writes report an error without claiming success or replacing the original file.
+
+`handoffMaxTokens` caps the `/handoff` summary output at 8192 tokens by default; raise it when long sessions truncate the summary. The handoff is saved as a visible user-context message before success is reported, so the linked session survives immediate exit and resume without sending another prompt. Creating the handoff does not start an agent turn.
 
 State proof in the objective so the agent can verify it with its normal tools:
 
@@ -99,12 +103,34 @@ A direct quoted path-shaped file target binds silent file proof. For an extensio
 /goal Fix `killeros/footer.ts`, verified by npm test
 ```
 
-Bare quoted prose remains model-reported. KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Restored goals keep their persisted limit.
+Bare quoted prose remains model-reported. KillerOS captures the file baseline at goal start and only completes when the file is created or changed. A normal response never continues a goal by itself: the agent must record `continue`, `complete`, or a blocker decision through `killeros_goal_update`. Repeated continuation reports and unavailable goal tools pause the goal. New goals pause after 20 turns without warning. An explicit `/goal resume` on an exhausted goal grants another 20 turns; compaction recovery never grants turns. Same-turn recovery requires an actual interruption; successful or skipped compaction cannot restart a normally stopped goal without a decision. A request that completes or blocks a goal remains goal-owned through settlement, so automatic compaction cannot restart it as ordinary work. Later ordinary requests still support compaction continuation. Restored goals keep their persisted limit.
+
+Session replacement, reload, and committed tree navigation discard unfinished task receipts. Late receipt results do not write or notify through the old session context or attach to a different branch. Cancelled navigation preserves the pending receipt.
 
-Session replacement and reload discard unfinished task receipts. Late receipt results do not write or notify through the old session context.
+Pending `/goal` commands discard their mutation if committed navigation changes the branch or another mutation changes the goal while confirmation, idle waiting, or file-baseline reading is in progress. Cancelled navigation preserves valid pending commands. Discarding a stale replacement after its idle wait preserves the surviving goal's authorized continuation.
+
+Failed Git metadata reads keep the footer's last successful file counts and mark task changes unavailable. They are not treated as an empty repository.
 
 Completion sounds are off by default; change with `/notification` in TUI mode. The tab-title indicator requires a Nerd Font.
 
+### Pi model and MCP settings
+
+Use Pi's native `/thinking` selector for reasoning levels. Pi 1.0.2 can also apply different sampling parameters for each level through `samplingParamsByThinkingLevel` in `models.json`. For example, a model entry can contain:
+
+```json
+{
+  "samplingParams": { "temperature": 1.0, "top_p": 0.95 },
+  "samplingParamsByThinkingLevel": {
+    "off": { "temperature": 0.7, "top_p": 0.8 },
+    "high": { "temperature": 0.6 }
+  }
+}
+```
+
+Only configure parameters the endpoint accepts. These settings apply to `openai-completions`, `openai-responses`, and `azure-openai-responses`, not legacy `openai-codex`. Missing levels inherit model defaults; request-level sampling parameters take precedence. `/codex-fast` preserves sampling parameters when it adds the priority service tier. See Pi's [sampling configuration](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/models.md#configure-sampling-by-thinking-level) for the full file format and merge rules.
+
+Use Pi's `/mcp` command and `.pi/mcp.json` to enable, disable, or change the exposure of a user-level MCP server for a trusted project without copying its credentials. See [project MCP overrides](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/mcp.md#configure-servers). KillerOS does not manage MCP configuration.
+
 ## Development
 
 Strict TypeScript throughout. Tests run on Node's built-in test runner:
@@ -113,12 +139,26 @@ Strict TypeScript throughout. Tests run on Node's built-in test runner:
 npm ci && npm run check && npm test
 ```
 
-Releases go through CI on `main`; do not push version tags manually. The prepublish check rejects ordinary direct `npm publish`, but `--ignore-scripts` can bypass it. Configure npm's trusted publisher for `release.yml`, set package publishing access to "Require two-factor authentication and disallow tokens", and revoke unused publish tokens. npm maintainers can still publish interactively with 2FA, so workflow-only publishing also depends on maintainer policy.
+### Release process
+
+1. Prepare the release on `dev`: update `package.json` and both root versions in `package-lock.json`, update the README's pinned tag, and move completed changelog entries into a dated version section under `[Unreleased]`.
+2. Run `npm run check` and `npm test`, commit and push to `dev`, then open a pull request into `main`. Push later fixes to the same PR so CI reruns.
+3. Wait for every required check to pass, including CodeQL and dependency review, and resolve review conversations. The PR must be up to date with `main`.
+4. Merge using **Create a merge commit**. Squash and rebase merging are disabled because the automated `main`-to-`dev` sync requires shared ancestry. Avoid advancing `dev` until that sync finishes.
+5. Check the `main` CI run and the following Release run. Successful CI on the current `main` commit triggers npm publication with provenance, creates the GitHub release, and fast-forwards `dev` to the released commit. A green PR alone never publishes.
+
+`main` requires pull requests and the CI workflow's required checks, including for administrators. Force pushes and branch deletion are blocked. If CI job names change, update GitHub's required status checks to match.
+
+Releases go through CI on `main`; do not push version tags manually. The package smoke job validates release metadata before packing, and the release workflow checks it again before publication. The prepublish check rejects ordinary direct `npm publish`, but `--ignore-scripts` can bypass it. Configure npm's trusted publisher for `release.yml`, set package publishing access to "Require two-factor authentication and disallow tokens", and revoke unused publish tokens. npm maintainers can still publish interactively with 2FA, so workflow-only publishing also depends on maintainer policy.
 
 ## Security
 
 Pi extensions run with your user permissions. Review the source before installing globally. Hook commands run only for projects Pi marks as trusted; check `.pi/killeros-hooks.json` before enabling project trust. KillerOS accepts that configuration only as a regular, non-linked file no larger than 64 KiB in the project's real `.pi` directory.
 
+On POSIX systems, timed-out or cancelled hooks receive `SIGTERM`, followed by `SIGKILL` if cleanup remains pending. Shell exit alone does not confirm that the original process group stopped. Cleanup uses a two-second window and reports uncertainty if group exit cannot be confirmed.
+
+Handoff validation rejects recognized credential assignments in plain text, Markdown lists, bold labels, and inline-code labels before creating a destination session. This pattern check cannot detect every secret or personally identifying value. Rejected values are not included in the error notification.
+
 ## License
 
 [MIT](LICENSE) © 2026 KyrosHendrix

package/killeros/activity.ts

@@ -1,6 +1,7 @@
 import type { ExtensionAPI, ExtensionContext, Theme } from "@earendil-works/pi-coding-agent";
 import { truncateToWidth } from "@earendil-works/pi-tui";
 import { modelDisplayName } from "./display.ts";
+import { safeTerminalText } from "./safe-terminal-text.ts";
 
 export type ActivityMessage =
   | { kind: "prompt" }
@@ -9,7 +10,7 @@ export type ActivityMessage =
   | { kind: "responding" };
 
 function safeToolName(toolName: string): string {
-  const normalized = toolName.replace(/[\u0000-\u001F\u007F]+/gu, " ").replace(/\s+/gu, " ").trim();
+  const normalized = safeTerminalText(toolName.replace(/[\r\n\t]+/gu, " ")).replace(/\s+/gu, " ").trim();
   return truncateToWidth(normalized || "tool", 32, "…");
 }
 

package/killeros/auto-compaction.ts

@@ -121,12 +121,14 @@ export function registerAutoCompaction(
   const loadPreference = dependencies.loadPreference ?? (() => defaultPreference(settingsStore));
   const getCompactionSettings = dependencies.getCompactionSettings ?? defaultCompactionSettings;
   let request: AutoCompactionRequest | undefined;
+  let goalRequestOwned = false;
   let armed = true;
   let rearmOnNextLogicalRequest = false;
   let settingsErrorReported = false;
 
   const resetForLifecycle = (): void => {
     request = undefined;
+    goalRequestOwned = false;
     armed = true;
     rearmOnNextLogicalRequest = false;
     settingsErrorReported = false;
@@ -155,11 +157,15 @@ export function registerAutoCompaction(
       }
 
       try {
-        const preference = readAutoCompactionPreference(settingsStore.load());
-        const updated = percent === undefined
-          ? { ...preference, enabled: argument === "on" }
-          : { ...preference, percentRemaining: percent };
-        settingsStore.update({ autoCompaction: updated });
+        let updated: AutoCompactionPreference | undefined;
+        settingsStore.update((current) => {
+          const preference = readAutoCompactionPreference(current);
+          updated = percent === undefined
+            ? { ...preference, enabled: argument === "on" }
+            : { ...preference, percentRemaining: percent };
+          return { autoCompaction: updated };
+        });
+        if (!updated) throw new Error("Settings update did not apply the preference");
         ctx.ui.notify(percent === undefined
           ? updated.enabled
             ? `Automatic compaction: on at ${updated.percentRemaining}% remaining`
@@ -235,6 +241,11 @@ export function registerAutoCompaction(
     }
   };
 
+  pi.on("agent_start", (_event, ctx) => {
+    // Terminal decisions clear active status before turn_end, but still own this run.
+    goalRequestOwned = dependencies.goal?.isActive(ctx) === true;
+  });
+
   pi.on("turn_end", (_event, ctx) => {
     if (!supportedMode(ctx) || request) return;
 
@@ -273,7 +284,8 @@ export function registerAutoCompaction(
 
     armed = false;
     const token = Symbol();
-    const goal = dependencies.goal?.isActive(ctx) === true;
+    const activeGoal = dependencies.goal?.isActive(ctx) === true;
+    const goal = goalRequestOwned || activeGoal;
     request = {
       phase: "compacting",
       goal,
@@ -281,7 +293,7 @@ export function registerAutoCompaction(
       turnSettled: false,
       compactionCompleted: false,
     };
-    if (goal && dependencies.goal) {
+    if (activeGoal && dependencies.goal) {
       try {
         dependencies.goal.onRequested();
       } catch (error) {
@@ -295,26 +307,29 @@ export function registerAutoCompaction(
         onComplete: () => {
           if (request?.phase !== "compacting" || request.token !== token) return;
           rearmOnNextLogicalRequest = preference.percentRemaining === 100;
-          if (goal && dependencies.goal) {
+          if (goal) {
             request = undefined;
-            try {
-              dependencies.goal.onCompleted(ctx);
-            } catch (error) {
-              notifyFailure(ctx, error);
+            if (activeGoal && dependencies.goal) {
+              try {
+                dependencies.goal.onCompleted(ctx);
+              } catch (error) {
+                notifyFailure(ctx, error);
+              }
             }
             return;
           }
           request.compactionCompleted = true;
           finalizeOrdinaryContinuation(ctx, token);
         },
-        onError: (error) => finishRequestError(ctx, token, goal, error),
+        onError: (error) => finishRequestError(ctx, token, activeGoal, error),
       });
     } catch (error) {
-      finishRequestError(ctx, token, goal, error);
+      finishRequestError(ctx, token, activeGoal, error);
     }
   });
 
   pi.on("agent_settled", (_event, ctx) => {
+    goalRequestOwned = false;
     if (request?.phase === "continuation-dispatched") {
       request = undefined;
       notifyFailure(ctx, new Error("continuation was not accepted"));

package/killeros/bounded-text.ts

@@ -11,7 +11,7 @@ export class BoundedText implements Component {
 
   render(width: number): string[] {
     if (width <= 0) return [];
-    const lines = new Text(this.text, 0, 0).render(width);
+    const lines = new Text(this.text, 0, 0).render(width).map((line) => truncateToWidth(line, width, ""));
     if (this.maxRows === undefined || lines.length <= this.maxRows) return lines;
     const rowLimit = Math.max(1, this.maxRows);
     const visible = lines.slice(0, rowLimit);

package/killeros/change-receipt.ts

@@ -1,6 +1,6 @@
 import { spawn } from "node:child_process";
 import { createReadStream, watch } from "node:fs";
-import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, passiveWorktreeMode, passiveWorktreeSettings, type PassiveWorktreeFile as DirtyFile, type PassiveWorktreeSnapshot } from "./passive-git-status.ts";
+import { inspectWorktreeWithoutFilters, passiveGitCommand, passiveGitEnv, passiveWorktreeMode, passiveWorktreeSettings, resolvePassiveHead, type PassiveWorktreeFile as DirtyFile, type PassiveWorktreeSnapshot } from "./passive-git-status.ts";
 import { lstat, open, readlink } from "node:fs/promises";
 import path from "node:path";
 import { createInflate } from "node:zlib";
@@ -237,19 +237,8 @@ async function snapshotKnownPaths(repo: Repository, baseline: Snapshot, paths: r
   return { ...baseline, files };
 }
 
-async function currentHead(repo: Repository): Promise<string> {
-  let resolved: Buffer;
-  try {
-    resolved = await runGit(repo.root, ["rev-parse", "--verify", "HEAD"], undefined, 4_096);
-  } catch (error) {
-    if (!(error instanceof GitFailure) || error.reason !== "error") throw error;
-    const reference = decode(await runGit(repo.root, ["symbolic-ref", "--quiet", "HEAD"], undefined, 4_096)).trim();
-    if (!/^refs\/[^\0\r\n]+$/u.test(reference)) throw new GitFailure("error");
-    return "(initial)";
-  }
-  const head = decode(resolved).trim();
-  if (!/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new GitFailure("error");
-  return head;
+function currentHead(repo: Repository): Promise<string> {
+  return resolvePassiveHead((args) => runGit(repo.root, args, undefined, 4_096));
 }
 
 function observes(filePath: string, observedPaths: readonly string[]): boolean {

package/killeros/goal-interface.ts

@@ -311,6 +311,9 @@ export function registerGoalInterface(
         ctx.ui.notify("/goal requires a saved session", "error");
         return;
       }
+      const generation = runtime.lifecycleGeneration;
+      const initiatingState = runtime.state;
+      const ownsGoal = (): boolean => runtime.lifecycleGeneration === generation && runtime.state === initiatingState;
 
       if (command.kind === "status") {
         if (!runtime.state) {
@@ -323,9 +326,11 @@ export function registerGoalInterface(
         }
         const actions = goalPanelActions(runtime.state.status);
         const selected = await ctx.ui.select(goalStatusSummary(runtime.state, ctx), actions.map((action) => action.label));
+        if (!ownsGoal()) return;
         const action = actions.find((candidate) => candidate.label === selected);
         if (!action) return;
         if (action.control === "clear" && !await ctx.ui.confirm("Clear goal?", safeTerminalText(runtime.state.objective))) return;
+        if (!ownsGoal()) return;
         await handleGoalCommand(action.control, ctx);
         return;
       }
@@ -487,17 +492,23 @@ export function registerGoalInterface(
           return;
         }
         const replace = await ctx.ui.confirm("Replace active goal", "Replace the current unfinished goal and discard its continuation state?");
-        if (!replace) return;
+        if (!replace || !ownsGoal()) return;
       }
 
-      runtime.continuationHeld = true;
+      const hold = Symbol();
+      runtime.continuationHeld = hold;
       let waitError: unknown;
       try {
         await ctx.waitForIdle();
       } catch (error) {
         waitError = error;
       } finally {
-        runtime.continuationHeld = false;
+        if (runtime.continuationHeld === hold) runtime.continuationHeld = undefined;
+      }
+      if (!ownsGoal()) {
+        // Settlement may have authorized a turn while this command held continuation.
+        if (runtime.lifecycleGeneration === generation) scheduleGoalContinuation(pi, runtime, ctx);
+        return;
       }
       if (waitError) {
         reportError(ctx, "Goal could not wait for the active turn", waitError);
@@ -508,6 +519,7 @@ export function registerGoalInterface(
       try {
         verification = await inferGoalVerification(objective, ctx.cwd);
       } catch (error) {
+        if (!ownsGoal()) return;
         if (!unfinished) {
           reportError(ctx, "Goal could not be started", error);
         } else {
@@ -516,6 +528,7 @@ export function registerGoalInterface(
         }
         return;
       }
+      if (!ownsGoal()) return;
       try {
         const state = createNewGoalState(objective, sumGoalTokens(ctx), verification, Date.now(), {
           maxTurns: DEFAULT_GOAL_MAX_TURNS,

package/killeros/goal-runtime.ts

@@ -119,6 +119,10 @@ export function persistGoalState(
   const data: GoalEntryData = { version: GOAL_VERSION, event, state: state ?? null };
   pi.appendEntry(GOAL_ENTRY_TYPE, data);
   runtime.state = state;
+  if (event === "clear") {
+    runtime.lifecycleGeneration += 1;
+    runtime.continuationHeld = undefined;
+  }
   syncGoalUpdateTool(pi, runtime);
   runtime.persistenceRetryNeeded = false;
   runtime.requestRender?.();
@@ -404,7 +408,7 @@ export function registerGoalRuntime(
     runtime.state = isGoalModeSupported(ctx) ? restored.state : undefined;
     syncGoalUpdateTool(pi, runtime);
     runtime.continuationScheduled = false;
-    runtime.continuationHeld = false;
+    runtime.continuationHeld = undefined;
     runtime.goalTurnInFlight = false;
     runtime.goalTurn = undefined;
     runtime.agentEndObserved = false;
@@ -441,7 +445,7 @@ export function registerGoalRuntime(
     runtime.state = undefined;
     syncGoalUpdateTool(pi, runtime);
     clearGoalExecutionFlags(runtime);
-    runtime.continuationHeld = false;
+    runtime.continuationHeld = undefined;
     runtime.persistenceRetryNeeded = false;
   });
 

package/killeros/goal-settlement.ts

@@ -254,6 +254,10 @@ export function registerGoalSettlement(
         );
         return;
       }
+      if (!expectedInterruption && runtime.automaticCompaction.resumeSameTurn) {
+        stopAutomaticCompactionRecovery(pi, runtime, ctx, "no turn decision");
+        return;
+      }
       if (settledTurn !== undefined && runtime.automaticCompaction.turn === settledTurn) {
         runtime.automaticCompaction.turnSettled = true;
       } else {

package/killeros/handoff.ts

@@ -300,7 +300,8 @@ export function registerHandoff(pi: ExtensionAPI, goalRuntime: GoalRuntime, hand
           parentSession: sourceSession,
           setup: async (sessionManager) => {
             try {
-              sessionManager.appendCustomMessageEntry("killeros-handoff", document, true);
+              // A regular user message makes Pi persist the otherwise setup-only child session.
+              sessionManager.appendMessage({ role: "user", content: document, timestamp: Date.now() });
               sessionManager.appendSessionInfo(sessionName(sourceName, focus, document));
             } catch (error) {
               setupFailure = { error };

package/killeros/hooks.ts

@@ -236,6 +236,17 @@ function terminateHookProcess(child: HookChildProcess, force: boolean): void {
   }
 }
 
+function hookProcessGroupExited(child: HookChildProcess): boolean {
+  if (!child.pid) return false;
+  try {
+    process.kill(-child.pid, 0);
+    return false;
+  } catch (error) {
+    // Permission and other failures are uncertainty, not proof of exit.
+    return error instanceof Error && "code" in error && error.code === "ESRCH";
+  }
+}
+
 export function executeHook(options: ExecuteHookOptions): Promise<HookExecutionResult>;
 /** @deprecated Use the object-argument form. The positional adapter will be removed in the next major release. */
 export function executeHook(
@@ -297,6 +308,8 @@ export function executeHook(
     let forceTimer: NodeJS.Timeout | undefined;
     let settleTimer: NodeJS.Timeout | undefined;
     let windowsCleanupPending = false;
+    let posixCleanupPending = false;
+    let shellClosed = false;
     const finish = (code: number, exitUnconfirmed = false): void => {
       if (completed) return;
       completed = true;
@@ -334,10 +347,15 @@ export function executeHook(
         }, 2_000);
         return;
       }
+      posixCleanupPending = process.platform !== "win32" && child.pid !== undefined;
       forceTimer = setTimeout(() => {
         if (completed) return;
         terminateHookProcess(child, true);
-        settleTimer = setTimeout(() => finish(terminationCode(), true), 1_000);
+        if (completed) return;
+        settleTimer = setTimeout(() => {
+          const confirmed = posixCleanupPending && shellClosed && hookProcessGroupExited(child);
+          finish(terminationCode(), !confirmed);
+        }, 1_000);
       }, 1_000);
       terminateHookProcess(child, false);
     };
@@ -349,10 +367,13 @@ export function executeHook(
     if (child.stderr instanceof EventEmitter) child.stderr.on("error", captureStreamError);
     child.on("error", (error) => {
       appendBounded(stderr, error.message);
-      if (!windowsCleanupPending) finish(termination ? terminationCode() : 1);
+      if (!windowsCleanupPending && !posixCleanupPending) finish(termination ? terminationCode() : 1);
     });
     child.once("close", (code) => {
-      if (!windowsCleanupPending) finish(termination ? terminationCode() : code ?? 1);
+      shellClosed = true;
+      if (!windowsCleanupPending && (!posixCleanupPending || hookProcessGroupExited(child))) {
+        finish(termination ? terminationCode() : code ?? 1);
+      }
     });
     if (completed) return;
     const boundedTimeoutMs = Number.isNaN(timeoutMs)

package/killeros/passive-git-status.ts

@@ -8,6 +8,13 @@ const PASSIVE_METADATA_ARGS = ["-c", "core.fsmonitor=false"] as const;
 
 export type PassiveGitRunner = (args: readonly string[]) => Promise<Buffer>;
 
+/** Revs-only returns empty output for an unborn HEAD; command failures still reject. */
+export async function resolvePassiveHead(runGit: PassiveGitRunner): Promise<string> {
+  const head = decode(await runGit(["rev-parse", "--revs-only", "--end-of-options", "HEAD"])).trim();
+  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
+  return head || "(initial)";
+}
+
 export type PassiveWorktreeFile = {
   path: string;
   headMode?: string;
@@ -343,19 +350,17 @@ function matchesIndex(content: Buffer, entry: IndexEntry, autoCrlf: string): boo
  * No Git command in this path asks Git to convert worktree content, so clean and process filters cannot start.
  */
 export async function inspectWorktreeWithoutFilters(root: string, runGit: PassiveGitRunner): Promise<PassiveWorktreeSnapshot> {
-  const [indexOutput, untrackedOutput, resolvedHead, autoCrlfOutput, settings] = await Promise.all([
+  const [indexOutput, untrackedOutput, head, autoCrlfOutput, settings] = await Promise.all([
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--cached", "--debug", "-z", "--full-name",
       "--format=%(objectmode) %(objectname) %(stage)%x09%(eolattr)%x09%(path)"]),
     runGit([...PASSIVE_METADATA_ARGS, "ls-files", "--others", "--exclude-standard", "-z", "--full-name"]),
-    runGit(["rev-parse", "--verify", "HEAD"]).then(decode, () => ""),
+    resolvePassiveHead(runGit),
     runGit(["config", "--type=bool-or-str", "--default", "false", "--get", "core.autocrlf"]),
     passiveWorktreeSettings(runGit),
   ]);
   const autoCrlf = decode(autoCrlfOutput).trim().toLowerCase();
-  const head = resolvedHead.trim();
-  if (head && !/^[0-9a-f]{40}(?:[0-9a-f]{24})?$/u.test(head)) throw new Error("invalid HEAD");
   const index = parseIndex(indexOutput);
-  const tree = head ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
+  const tree = head !== "(initial)" ? parseTree(await runGit(["ls-tree", "-r", "-z", "--full-tree", head])) : new Map<string, TreeEntry>();
   const files = new Map<string, PassiveWorktreeFile>();
   let contentBytes = 0;
 
@@ -398,5 +403,5 @@ export async function inspectWorktreeWithoutFilters(root: string, runGit: Passiv
     const previous = files.get(filePath);
     files.set(filePath, { ...previous, path: filePath, mode: state.mode, content: state.content, contentObjectId: undefined });
   }
-  return { head: head || "(initial)", files, ...settings };
+  return { head, files, ...settings };
 }

package/killeros/runtime.ts

@@ -124,7 +124,7 @@ export interface GoalTurnExecution {
 export interface GoalRuntime {
   state?: GoalState;
   continuationScheduled: boolean;
-  continuationHeld: boolean;
+  continuationHeld?: symbol;
   goalTurnInFlight: boolean;
   agentEndObserved: boolean;
   goalTurn?: GoalTurnExecution;
@@ -139,7 +139,7 @@ export interface GoalRuntime {
 export function createGoalRuntime(): GoalRuntime {
   return {
     continuationScheduled: false,
-    continuationHeld: false,
+    continuationHeld: undefined,
     goalTurnInFlight: false,
     agentEndObserved: false,
     goalTurn: undefined,

package/killeros/secret-detector.ts

@@ -10,7 +10,7 @@ const SECRET_PATTERNS = [
   /\bsk_live_[A-Za-z0-9]{16,255}\b/u,
   /\bxox[baprs]-[A-Za-z0-9-]{10,255}\b/u,
   /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@]+:[^/\s@]+@/iu,
-  /^[\t ]*["']?[\w.-]*(?:api_key|apikey|password|passwd|secret|token)[\w.-]*["']?[\t ]*(?:=|:)[\t ]*(?:"[^"\r\n]+"|'[^'\r\n]+'|[^\s#][^\r\n]*)/imu,
+  /^[\t ]*(?:(?:[-*+]|\d+[.)])[\t ]+)?(?:\*\*|`)?["']?[\w.-]*(?:api_key|apikey|password|passwd|secret|token)[\w.-]*["']?(?:\*\*|`)?[\t ]*(?:=|:)[\t ]*(?:"[^"\r\n]+"|'[^'\r\n]+'|[^\s#][^\r\n]*)/imu,
 ] as const;
 
 /** Detects high-confidence credential material without returning the matched value. */

package/killeros/settings.ts

@@ -5,10 +5,13 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 import { hasErrorCode } from "./errors.ts";
 
 export type KillerosSettings = Record<string, unknown>;
+export type KillerosSettingsUpdate = Readonly<Record<string, unknown>>
+  | ((current: Readonly<KillerosSettings>) => Readonly<Record<string, unknown>>);
 
 export interface KillerosSettingsStore {
   load(): KillerosSettings;
-  update(patch: Readonly<Record<string, unknown>>): void;
+  /** Derive a field update from the latest settings while holding the writer lock. */
+  update(patch: KillerosSettingsUpdate): void;
 }
 
 function isSettings(value: unknown): value is KillerosSettings {
@@ -123,9 +126,10 @@ export function createKillerosSettingsStore(
       const temporaryPath = `${settingsPath}.${process.pid}.${randomUUID()}.tmp`;
       try {
         const current = readStoredSettings(settingsPath);
+        const changes = typeof patch === "function" ? patch(current) : patch;
         writeFileSync(
           temporaryPath,
-          `${JSON.stringify({ ...current, ...patch }, null, 2)}\n`,
+          `${JSON.stringify({ ...current, ...changes }, null, 2)}\n`,
           { encoding: "utf8", mode: 0o600 },
         );
         renameSync(temporaryPath, settingsPath);

package/killeros/worked-for.ts

@@ -302,6 +302,7 @@ export function workedForOutcome(stopReason: StopReason | undefined): WorkedForO
 }
 
 type ActiveReceipt = {
+  leafId: string | null;
   startedAt: number;
   startedTokens: number | undefined;
   stopReason: StopReason | undefined;
@@ -369,17 +370,20 @@ export function registerWorkedFor(
     return new Text(`${headline}${theme.fg("dim", ` · ${formatWorkedForDuration(data.milliseconds)}${tokens}`)}`, 1, 0);
   });
 
-  pi.on("session_start", async () => {
+  const resetForBranch = async (): Promise<void> => {
     lifecycleGeneration += 1;
     const stale = active;
     active = undefined;
     collectionNoticeShown = false;
     if (stale) await (await stale.collection).dispose();
-  });
+  };
+  pi.on("session_start", resetForBranch);
+  pi.on("session_tree", resetForBranch);
 
   pi.on("agent_start", async (_event, ctx) => {
     if (ctx.mode !== "tui" || active || !ctx.isProjectTrusted()) return;
     const state: ActiveReceipt = {
+      leafId: ctx.sessionManager.getLeafId(),
       startedAt: now(),
       startedTokens: sessionTokenTotal(ctx),
       stopReason: undefined,
@@ -440,6 +444,8 @@ export function registerWorkedFor(
 
   pi.on("agent_end", (event, ctx) => {
     if (ctx.mode !== "tui" || !active) return;
+    // Pi is not idle yet; later settlement handlers can overlap tree navigation.
+    active.leafId = ctx.sessionManager.getLeafId();
     for (let index = event.messages.length - 1; index >= 0; index -= 1) {
       const message = event.messages[index];
       if (message?.role !== "assistant") continue;
@@ -455,8 +461,9 @@ export function registerWorkedFor(
     active = undefined;
     const model = receiptModelName(settled, ctx.model);
     const changes = await (await settled.collection).finish();
-    // Shutdown can invalidate ctx while the final Git scan is still running.
-    if (generation !== lifecycleGeneration) return;
+    // Earlier async session_tree handlers can delay our reset after Pi switches branches.
+    if (generation !== lifecycleGeneration
+      || !ctx.sessionManager.getBranch().some((entry) => entry.id === settled.leafId)) return;
     if (changes.state === "unavailable" && changes.reason !== "not-git" && changes.reason !== "timeout" && !collectionNoticeShown) {
       collectionNoticeShown = true;
       ctx.ui.notify(`Change receipt unavailable: ${changes.reason}`, "warning");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "killeros",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "TUI, goals, and workflow automation for the Pi coding agent",
   "type": "module",
   "keywords": [
@@ -45,16 +45,16 @@
     ]
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.99.2 <1",
-    "@earendil-works/pi-coding-agent": ">=0.99.2 <1",
-    "@earendil-works/pi-tui": ">=0.99.2 <1",
+    "@earendil-works/pi-ai": ">=1.0.2 <2",
+    "@earendil-works/pi-coding-agent": ">=1.0.2 <2",
+    "@earendil-works/pi-tui": ">=1.0.2 <2",
     "typebox": ">=1.1.38 <2"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "0.99.2",
-    "@earendil-works/pi-coding-agent": "0.99.2",
-    "@earendil-works/pi-server": "0.99.2",
-    "@earendil-works/pi-tui": "0.99.2",
+    "@earendil-works/pi-ai": "1.0.2",
+    "@earendil-works/pi-coding-agent": "1.0.2",
+    "@earendil-works/pi-server": "1.0.2",
+    "@earendil-works/pi-tui": "1.0.2",
     "@types/node": "24.12.4",
     "eslint": "^10.9.1",
     "typebox": "1.3.20",