one-code-extension 0.4.1 → 0.5.0

package/extensions/footer/pr.ts

@@ -8,7 +8,9 @@
  * a PR whose head lives in the base repo, so it misses the common case of a PR
  * opened from a fork (`isCrossRepository`), even though `list` on the base repo
  * knows about it. `--state open` keeps a merged/closed PR for the same branch
- * name from showing.
+ * name from showing. The footer repeats the lookup once a minute while the
+ * session is in use (`nextPrPollDelay`), so a PR merged, closed or opened
+ * mid-session shows within a minute.
  *
  * The exec lives here but the parse is split out so it unit-tests without a
  * subprocess.
@@ -35,19 +37,46 @@ export function parsePrNumber(stdout: string): number | undefined {
 
 const LOOKUP_TIMEOUT_MS = 4000;
 
+/** A lookup's outcome: the open PR, if any, and whether `gh` is not installed at all. */
+export interface PrLookup {
+	pr: number | undefined;
+	ghMissing: boolean;
+}
+
 /**
- * Resolve the open PR number for `branch` in `cwd`, or `undefined`. Never
- * rejects: any failure (no gh, no PR, detached HEAD, timeout) is `undefined`.
+ * Resolve the open PR number for `branch` in `cwd`. Never rejects: any failure
+ * (no gh, no PR, detached HEAD, timeout) has `pr` undefined, and a `gh` that
+ * is not on PATH says so, so the footer stops polling for it.
  */
-export function fetchPrNumber(cwd: string, branch: string): Promise<number | undefined> {
+export function fetchPrNumber(cwd: string, branch: string): Promise<PrLookup> {
 	return new Promise((resolve) => {
 		execFile(
 			"gh",
 			["pr", "list", "--head", branch, "--state", "open", "--json", "number"],
 			{ cwd, timeout: LOOKUP_TIMEOUT_MS, encoding: "utf8" },
 			(error, stdout) => {
-				resolve(error ? undefined : parsePrNumber(stdout));
+				const ghMissing = (error as NodeJS.ErrnoException | null)?.code === "ENOENT";
+				resolve({ pr: error ? undefined : parsePrNumber(stdout), ghMissing });
 			},
 		);
 	});
 }
+
+/** Claude Code's PR status cadence (its `usePrStatus`): one lookup a minute while the session is in use. */
+export const PR_POLL_INTERVAL_MS = 60_000;
+/** Polling stops after this long without user input, and resumes on the next input. */
+export const PR_IDLE_STOP_MS = 60 * 60_000;
+/** A lookup slower than this turns polling off for the session (branch changes still look up). */
+export const PR_SLOW_LOOKUP_MS = 4_000;
+
+/**
+ * When the next PR lookup is due, relative to the last one: never sooner than
+ * PR_POLL_INTERVAL_MS after it, so a turn boundary asking for a refresh does
+ * not spawn `gh` more than once a minute. Undefined when polling should stop:
+ * turned off by a slow lookup, or no input for PR_IDLE_STOP_MS.
+ */
+export function nextPrPollDelay(state: { lastLookupAt: number; lastInputAt: number; disabled: boolean }, now: number): number | undefined {
+	if (state.disabled) return undefined;
+	if (now - state.lastInputAt >= PR_IDLE_STOP_MS) return undefined;
+	return Math.max(0, state.lastLookupAt + PR_POLL_INTERVAL_MS - now);
+}

package/extensions/hooks/compaction.ts

@@ -0,0 +1,7 @@
+/** Successful PreCompact hook output, scoped to the compaction that requested it. */
+export const PRECOMPACT_INSTRUCTIONS_CHANNEL = "one-code:precompact-instructions";
+
+export interface PreCompactInstructions {
+	signal: AbortSignal;
+	instructions: string;
+}

package/extensions/hooks/executor.ts

@@ -7,7 +7,7 @@
  * pi.exec is deliberately not used: it hardcodes shell:false and gives the
  * child no stdin, while Claude Code hooks are shell command strings that read
  * a JSON payload from stdin. (Ported from pi-code's runHookCommand, MIT — see
- * docs/decisions.md.)
+ * working-docs/decisions.md.)
  *
  * The interpreter is Claude Code's: bash (Git Bash on Windows, honouring
  * `CLAUDE_CODE_GIT_BASH_PATH`) unless the hook says `shell: "powershell"`, or
@@ -22,7 +22,8 @@
  *   otherwise `close` never fires and the promise hangs past the timeout
  *   (Windows: `taskkill /T /F` on the leader's pid does the same)
  * - setEncoding("utf8") so multi-byte characters can't be split across chunks
- * - output capped at 1MB per stream
+ * - a hook exceeding 1MB per stream is killed and reported as an output-limit
+ *   failure, never parsed as a silently truncated JSON verdict
  * - stdin errors ignored (a hook that exits without reading stdin — `exit 2`
  *   — would otherwise EPIPE-crash the write)
  * - stdin JSON is newline-terminated: without a trailing "\n" a hook doing
@@ -41,13 +42,14 @@
  *   SIGCHLD-driven exit callback; with the process handle unref'd the loop
  *   counted itself empty and node exited 0 mid-tool, silently, before the
  *   hook's `close` ever fired — measured at ~55% of runs with a trivial
- *   `exit 0` hook (docs/one-shot-lsp-event-loop-drain.md has the same
+ *   `exit 0` hook (working-docs/one-shot-lsp-event-loop-drain.md has the same
  *   mechanism for the LSP client). A ref'd child holds the loop until `close`.
  */
 
 import type { ChildProcess } from "node:child_process";
 import { detachedSpawnOptions, killProcessTree, waitForChildExit } from "../lib/process-tree.ts";
 import { bashSpawn, POWERSHELL_UTF8_PREFIX, powerShellSpawn, type ShellSpawn, spawnShellCommand } from "../lib/shell-spawn.ts";
+import type { FinishedRun } from "./protocol.ts";
 import type { HookShell } from "./settings.ts";
 
 /**
@@ -76,29 +78,12 @@ export function hookShellSpawn(shell: HookShell | undefined): { spec?: ShellSpaw
 	return { spec: resolved.spawn, shell: want };
 }
 
-export interface HookRunResult {
-	/**
-	 * null when the process was killed (timeout) or never spawned. Normalized on
-	 * the timeout path rather than taken from `waitpid`: a group SIGKILL is not
-	 * atomic, so the shell can be scheduled after its foreground child is killed
-	 * and before its own signal lands, reap the child and exit(128+9) itself —
-	 * `close` then reports a normal exit of 137 instead of death by signal
-	 * (roughly 1% of timeouts under load, and never when the shell had exec'd
-	 * away, leaving no shell to reap; findings §10.20). Callers should still
-	 * prefer `timedOut`, which says what happened rather than what it looked
-	 * like, but they no longer have to.
-	 */
-	exitCode: number | null;
-	timedOut: boolean;
-	/** Set when the child could not be spawned at all. */
-	spawnError?: string;
-	stdout: string;
-	stderr: string;
-	durationMs: number;
-}
+/** A finished run (`protocol.ts FinishedRun`, field docs there) and how long it took. */
+export type HookRunResult = FinishedRun & { durationMs: number };
 
 export interface HookRunOptions {
 	cwd: string;
+	signal?: AbortSignal;
 	/** Seconds, Claude Code convention. Clamped to [1, MAX_TIMEOUT_S]. */
 	timeoutSeconds?: number;
 	/** Exposed to the hook as CLAUDE_PROJECT_DIR; defaults to cwd. */
@@ -129,6 +114,10 @@ export function runHookCommand(command: string, stdinJson: string, opts: HookRun
 	const started = Date.now();
 
 	return new Promise((resolve) => {
+		if (opts.signal?.aborted) {
+			resolve({ exitCode: null, timedOut: false, aborted: true, stdout: "", stderr: "", durationMs: Date.now() - started });
+			return;
+		}
 		let child: ChildProcess;
 		const failed = (spawnError: string) =>
 			resolve({ exitCode: null, timedOut: false, spawnError, stdout: "", stderr: "", durationMs: Date.now() - started });
@@ -175,14 +164,26 @@ export function runHookCommand(command: string, stdinJson: string, opts: HookRun
 		let stdout = "";
 		let stderr = "";
 		let timedOut = false;
+		let aborted = false;
+		let outputLimitExceeded = false;
+		const outputBytes = { stdout: 0, stderr: 0 };
 		let settled = false;
+		const onAbort = () => {
+			aborted = true;
+			killProcessTree(child, "SIGKILL");
+		};
+		opts.signal?.addEventListener("abort", onAbort, { once: true });
 
 		const capture = (sink: "stdout" | "stderr") => (chunk: string) => {
-			const current = sink === "stdout" ? stdout : stderr;
-			if (current.length >= MAX_OUTPUT_BYTES) return;
-			const next = current + chunk.slice(0, MAX_OUTPUT_BYTES - current.length);
-			if (sink === "stdout") stdout = next;
-			else stderr = next;
+			if (outputLimitExceeded) return;
+			outputBytes[sink] += Buffer.byteLength(chunk, "utf8");
+			if (outputBytes[sink] > MAX_OUTPUT_BYTES) {
+				outputLimitExceeded = true;
+				killProcessTree(child, "SIGKILL");
+				return;
+			}
+			if (sink === "stdout") stdout += chunk;
+			else stderr += chunk;
 		};
 		child.stdout?.setEncoding("utf8");
 		child.stderr?.setEncoding("utf8");
@@ -200,7 +201,8 @@ export function runHookCommand(command: string, stdinJson: string, opts: HookRun
 			if (settled) return;
 			settled = true;
 			clearTimeout(timer);
-			resolve({ ...result, durationMs: Date.now() - started });
+			opts.signal?.removeEventListener("abort", onAbort);
+			resolve({ ...result, ...(aborted ? { aborted: true } : {}), ...(outputLimitExceeded ? { outputLimitExceeded: true } : {}), durationMs: Date.now() - started });
 		};
 
 		// Settles on exit plus a short stdio grace, not on `close`: a grandchild
@@ -211,7 +213,7 @@ export function runHookCommand(command: string, stdinJson: string, opts: HookRun
 		// keeps "we killed it" from ever looking like an ordinary non-zero exit,
 		// which fails OPEN downstream.
 		waitForChildExit(child).then(
-			({ code }) => finish({ exitCode: timedOut ? null : code, timedOut, stdout, stderr }),
+			({ code }) => finish({ exitCode: timedOut || aborted || outputLimitExceeded ? null : code, timedOut, stdout, stderr }),
 			(error: Error) => finish({ exitCode: null, timedOut, spawnError: error.message, stdout, stderr }),
 		);
 

package/extensions/hooks/index.ts

@@ -15,7 +15,7 @@
  *
  * A hook can block anything, loaders included (tool_search/skill/
  * structured_output) — full CC fidelity, the user's config is the user's
- * choice; see docs/findings.md for the foot-gun note. A hook can never
+ * choice; see working-docs/findings.md for the foot-gun note. A hook can never
  * pre-approve: "allow" is informational and the permission gate still runs.
  *
  * pi's emitToolCall has no try/catch around handlers, so every hook dispatch
@@ -38,12 +38,15 @@
  * (settings, consent, logging) and a payload naming the child.
  */
 
+import { contentText } from "@earendil-works/pi-ai";
 import { getAgentDir, type ExtensionAPI, type ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { RunOutcomeLatch } from "../lib/interrupt.ts";
+import { SESSION_WORK_CHANNEL, type SessionWorkQuery } from "../lib/session-work.ts";
 import { claudeConfigDir } from "../lib/paths.ts";
 import { defaultDiscoverRoots } from "../lib/plugins.ts";
 import { appendHookLog, formatDebugLine, hooksDebugEnabled, hooksLogPath } from "./debug.ts";
 import { runHookCommand } from "./executor.ts";
+import { PRECOMPACT_INSTRUCTIONS_CHANNEL, type PreCompactInstructions } from "./compaction.ts";
 import { changedSince, FORMATTER_NOTICE, type FileSnapshot, fileToolTarget, snapshotFile } from "./formatter-notice.ts";
 import { matcherApplies, ccToolName, toolMatchCandidates, ccToolInput, nativeToolInput } from "./matcher.ts";
 import { loadPluginHooks } from "./plugin-hooks.ts";
@@ -52,6 +55,7 @@ import {
 	type CcHookEvent,
 	type HookOutcome,
 	type HookStdinPayload,
+	cancelledOutcome,
 	interpretHookResult,
 } from "./protocol.ts";
 import { type HookCommand, type HooksSource, loadHookSettings } from "./settings.ts";
@@ -59,6 +63,12 @@ import { persistIfLarge, sessionResultsDir } from "../lib/persisted-output.ts";
 import { REMINDER_CHANNEL, wrapReminder } from "../lib/reminders.ts";
 import { type ChildHookCall, type ChildHookResult, type HookBridge, SUBAGENT_HOOK_CHANNEL, type SubagentHookPayload } from "./subagent-bridge.ts";
 import { projectHooksApproved } from "./trust.ts";
+import { QueuedDelivery } from "../lib/queued-delivery.ts";
+import { SKILL_INVOCATION_TYPE, type SkillInvocationDetails } from "../skill/invoke.ts";
+import { isNotificationDetails } from "../lib/notifications.ts";
+import { consentDialog } from "../lib/consent-dialogs.ts";
+import { isUserRun } from "../lib/prompt-options.ts";
+import { followWorkCwd } from "../lib/worktree-channel.ts";
 
 /** Claude Code's `hook_additional_context` attachment text (utils/messages.ts). */
 export function hookContextText(event: CcHookEvent, text: string): string {
@@ -95,17 +105,39 @@ interface HookDispatchCtx {
 	cwd: string;
 	hasUI: boolean;
 	sessionManager: { getSessionId(): string; getSessionFile(): string | undefined; getSessionDir?(): string | undefined };
-	ui: { confirm(title: string, message: string): Promise<boolean | undefined>; notify(message: string, type: "info"): void };
+	ui: { confirm(title: string, message: string, options?: { signal?: AbortSignal }): Promise<boolean | undefined>; notify(message: string, type: "info"): void };
+	signal?: AbortSignal;
 	/** Set on the shutdown snapshot: no consent prompt, no notices — the session is gone. */
 	sessionEnded?: true;
 }
 
+/** Claude Code's default cap on consecutive Stop-hook continuations in one user turn. */
+const MAX_STOP_CONTINUATIONS = 8;
+
+/** The customType of the Stop hook's continuation message. */
+const STOP_CONTINUATION_TYPE = "one-code:hook-stop";
+
+/** Whether a `before_agent_start` opens the Stop hook's own continuation run (pi 1.2.0 fires it for custom runs). */
+function isStopContinuation(event: unknown): boolean {
+	const run = event as { messageType?: string; message?: { customType?: string } };
+	return run.messageType === "custom" && run.message?.customType === STOP_CONTINUATION_TYPE;
+}
+
 export default function hooksExtension(pi: ExtensionAPI) {
-	let stopHookActive = false;
+	const workCwd = followWorkCwd(pi.events);
+	let stopHookBlocks = 0;
 	/** Context from UserPromptSubmit / SessionStart / PostCompact hooks, delivered with the next prompt. */
 	let pendingPromptContext: Array<{ event: CcHookEvent; text: string }> = [];
+	/**
+	 * UserPromptSubmit context for messages queued mid-turn, held until pi
+	 * delivers the message (lib/queued-delivery.ts): such a message never
+	 * reaches before_agent_start.
+	 */
+	const queuedPromptContext = new QueuedDelivery<string>();
 	/** The last context seen, for bridged child calls (dispatched parent-side). */
 	let lastCtx: ExtensionContext | undefined;
+	/** True once a prompt opened a turn in this session (before_agent_start). */
+	let prompted = false;
 	/**
 	 * The in-flight SessionStart hook dispatch. It runs OFF the `session_start`
 	 * path so the editor opens immediately (a slow hook used to hold the prompt
@@ -116,6 +148,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	let sessionStartPending: Promise<void> | undefined;
 	/** Bumped on every session_start; a superseded dispatch checks it before writing context. */
 	let sessionGen = 0;
+	/** Covers startup hooks and other dispatches that have no active turn signal. */
+	let sessionAbort = new AbortController();
 
 	const notify = (ctx: HookDispatchCtx, message: string) => {
 		if (ctx.sessionEnded) return; // session gone; nowhere to show it
@@ -131,7 +165,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	): Promise<MatchedHook[]> => {
 		const claudeDir = claudeConfigDir();
 		const loaded = loadHookSettings(claudeDir, ctx.cwd);
-		const pluginSources = loadPluginHooks(defaultDiscoverRoots(getAgentDir(), ctx.cwd), loaded.diagnostics);
+		const pluginSources = loaded.disabled ? [] : loadPluginHooks(defaultDiscoverRoots(getAgentDir(), ctx.cwd), loaded.diagnostics);
 		if (hooksDebugEnabled()) {
 			for (const diagnostic of loaded.diagnostics) process.stderr.write(`[hooks] ${diagnostic}\n`);
 		}
@@ -143,7 +177,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			projectAllowed = await projectHooksApproved(ctx.cwd, projectSources, {
 				hasUI: ctx.hasUI,
 				noPrompt: ctx.sessionEnded,
-				confirm: (title, message) => ctx.ui.confirm(title, message),
+				signal: ctx.signal,
+				confirm: (title, message) => consentDialog(pi.events, (signal) => ctx.ui.confirm(title, message, { signal: signal && ctx.signal ? AbortSignal.any([signal, ctx.signal]) : signal ?? ctx.signal })),
 				notify: (message) => notify(ctx, message),
 			});
 		}
@@ -168,7 +203,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	const basePayload = (ctx: HookDispatchCtx, event: CcHookEvent): HookStdinPayload => ({
 		session_id: ctx.sessionManager.getSessionId(),
 		transcript_path: ctx.sessionManager.getSessionFile() ?? "",
-		cwd: ctx.cwd,
+		cwd: workCwd(ctx.cwd),
 		hook_event_name: event,
 	});
 
@@ -181,20 +216,27 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		ctx: HookDispatchCtx,
 		event: CcHookEvent,
 		matchValue: { candidates?: string[]; ignoreMatcher?: boolean },
-		payload: HookStdinPayload,
+		payloadOrFactory: HookStdinPayload | (() => Promise<HookStdinPayload | undefined>),
 		/** Runs once, only when hooks will actually run — the point where a caller can snapshot state the hooks may change. */
 		willRun?: () => void,
 	): Promise<HookOutcome> => {
 		const merged: HookOutcome = {};
+		const signal = ctx.sessionEnded ? ctx.signal : ctx.signal ? AbortSignal.any([ctx.signal, sessionAbort.signal]) : sessionAbort.signal;
 		try {
-			const hooks = await collectHooks(ctx, event, matchValue);
-			if (hooks.length === 0) return merged;
+			const hooks = await collectHooks({ ...ctx, signal }, event, matchValue);
+			const payload = typeof payloadOrFactory === "function" ? await payloadOrFactory() : payloadOrFactory;
+			if (!payload || hooks.length === 0) return merged;
+			// Cancelled before the hooks ran: the gating events block, as a mid-run cancel does.
+			if (signal?.aborted) return cancelledOutcome(event);
 			willRun?.();
 			const stdin = JSON.stringify(payload);
-			const outcomes = await Promise.all(
+			const outcomes = await Promise.allSettled(
 				hooks.map(async ({ source, hook }) => {
 					const run = await runHookCommand(hook.command, stdin, {
-						cwd: ctx.cwd,
+						// The calling session's worktree or child's directory; settings,
+						// consent and CLAUDE_PROJECT_DIR still belong to the parent project.
+						cwd: payload.cwd,
+						signal,
 						timeoutSeconds: hook.timeout,
 						shell: hook.shell,
 						projectDir: ctx.cwd,
@@ -221,7 +263,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
 					return outcome;
 				}),
 			);
-			for (const outcome of outcomes) {
+			if (signal?.aborted) return cancelledOutcome(event);
+			for (const result of outcomes) {
+				// One broken response must not erase another hook's deny or let the
+				// tool run while the other hooks are still deciding.
+				if (result.status === "rejected") {
+					if (hooksDebugEnabled()) process.stderr.write(`[hooks] hook error (${event}): ${String(result.reason)}\n`);
+					continue;
+				}
+				const outcome = result.value;
+				if (outcome.preventContinuation) merged.preventContinuation = true;
 				// A block reason becomes model-facing text (the tool result, or a
 				// Stop follow-up), so it is bounded like the other hook texts —
 				// stderr on an exit-2 hook is easily a full stack trace (review M2).
@@ -291,7 +342,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		// to it: this extension awaits the hook and loads before file-tracker, so
 		// the tracker records the hook's version as the model's own write
 		// (formatter-notice.ts, review M1). Snapshot only when hooks will run.
-		const target = event.isError ? undefined : fileToolTarget(event.toolName, event.input, ctx.cwd);
+		const target = event.isError ? undefined : fileToolTarget(event.toolName, event.input, payload.cwd);
 		let before: FileSnapshot | undefined;
 		const outcome = await dispatch(ctx, "PostToolUse", { candidates: toolMatchCandidates(event.toolName) }, payload, () => {
 			if (target) before = snapshotFile(target);
@@ -305,57 +356,119 @@ export default function hooksExtension(pi: ExtensionAPI) {
 				[outcome.additionalContext && wrapReminder(hookContextText("PostToolUse", outcome.additionalContext)), formatterNotice]
 					.filter(Boolean)
 					.join("\n") || undefined,
-		});
+		}, event.toolName);
 		if (!content) return undefined;
 		return { content, isError: event.isError };
 	});
 
-	/** Await the backgrounded SessionStart dispatch once, if one is pending. */
+	/**
+	 * Await the backgrounded SessionStart dispatch, if one is pending. Every
+	 * caller awaits the same dispatch, and it is forgotten only once it settles:
+	 * a notification opening the first turn and a prompt typed meanwhile both
+	 * wait for it, rather than the second returning at once.
+	 */
 	const drainSessionStart = async () => {
-		if (!sessionStartPending) return;
 		const pending = sessionStartPending;
-		sessionStartPending = undefined;
+		if (!pending) return;
 		try {
 			await pending;
 		} catch {
 			// dispatch already reports its own failures; never block the turn on one.
 		}
+		if (sessionStartPending === pending) sessionStartPending = undefined;
 	};
 
 	// ---- UserPromptSubmit ---------------------------------------------------
 	pi.on("input", async (event, ctx) => {
 		if (event.source === "extension") return undefined;
-		stopHookActive = false;
+		// Set for a message queued mid-turn (pi 0.86+ fires `input` for
+		// steer/followUp). The Stop latch is reset in before_agent_start, where a
+		// turn really starts: pi re-checks streaming after these handlers, so a
+		// queued message whose turn ended during the hook opens a new turn.
+		const queued = event.streamingBehavior;
+		const gen = sessionGen;
 		// Drain the backgrounded SessionStart dispatch before this prompt's own
 		// UserPromptSubmit context, so their order in the first turn is unchanged
 		// (SessionStart context precedes UserPromptSubmit). before_agent_start is
 		// the backstop for turns with no input event (one-shot, programmatic).
 		await drainSessionStart();
+		if (gen !== sessionGen) return { action: "handled" as const };
 		const payload: HookStdinPayload = { ...basePayload(ctx, "UserPromptSubmit"), prompt: event.text };
 		const outcome = await dispatch(ctx, "UserPromptSubmit", { ignoreMatcher: true }, payload);
+		if (gen !== sessionGen) return { action: "handled" as const };
 		if (outcome.block) {
 			notify(ctx, `Prompt blocked by UserPromptSubmit hook: ${outcome.block.reason}`);
 			return { action: "handled" as const };
 		}
-		if (outcome.additionalContext) pendingPromptContext.push({ event: "UserPromptSubmit", text: outcome.additionalContext });
+		if (!outcome.additionalContext) return undefined;
+		// A queued message's context waits for pi to deliver that message
+		// (message_start below), so it rides the same request.
+		if (queued) queuedPromptContext.hold(event.text, hookContextText("UserPromptSubmit", outcome.additionalContext));
+		else pendingPromptContext.push({ event: "UserPromptSubmit", text: outcome.additionalContext });
 		return undefined;
 	});
 
+	// pi awaits this before the request that carries the delivered message, so a
+	// one-shot emitted here is pinned to that message: after the prompt, as the
+	// before_agent_start message is for a prompt that opens a turn.
+	pi.on("message_start", async (event) => {
+		const gen = sessionGen;
+		const message = event.message;
+		const emit = (text: string) => pi.events.emit(REMINDER_CHANNEL, { text, placement: "last-append" });
+		if (message.role === "user") {
+			if (queuedPromptContext.isEmpty) return;
+			const text = queuedPromptContext.release(contentText(message.content, ""));
+			if (text) emit(text);
+			return;
+		}
+		// A `/skill:` command the skill extension took over arrives as its hidden
+		// message, carrying the typed text. It opens the turn when the command
+		// was idle, through a sendMessage that never reaches before_agent_start,
+		// so the prompt context waiting there rides this message too.
+		if (message.role !== "custom") return;
+		// A background completion that opens the session's first turn
+		// (lib/prompt-options.ts) skips before_agent_start as well, so the
+		// SessionStart context a typed first prompt would carry rides it.
+		const opensFirstTurn = !prompted && isNotificationDetails(message.details);
+		if (message.customType !== SKILL_INVOCATION_TYPE && !opensFirstTurn) return;
+		if (opensFirstTurn) await drainSessionStart();
+		if (gen !== sessionGen) return;
+		const input = (message.details as Partial<SkillInvocationDetails> | undefined)?.input;
+		const queued = typeof input === "string" ? queuedPromptContext.release(input) : undefined;
+		if (queued) emit(queued);
+		const waiting = pendingPromptContext;
+		pendingPromptContext = [];
+		for (const { event: hookEvent, text } of waiting) emit(hookContextText(hookEvent, text));
+	});
+
 	// Prompt/session/compaction hook context rides the turn it belongs to as a
 	// custom message pi appends right AFTER the user's prompt (the
 	// before_agent_start `message` return). An idle `sendMessage` from here
 	// landed it BEFORE the prompt (pi appends first, then adds the user message).
-	pi.on("before_agent_start", async (_event, ctx) => {
+	pi.on("before_agent_start", async (event, ctx) => {
+		const gen = sessionGen;
 		lastCtx = ctx;
+		prompted = true;
 		// The SessionStart dispatch runs in the background from session_start; the
 		// first turn must wait for it so its additionalContext is present (and, on
 		// first run, so its approval dialog gates execution before the model runs).
 		// The `input` handler usually drained it already; this is the backstop for
 		// turns with no input event.
 		await drainSessionStart();
-		if (pendingPromptContext.length === 0) return;
-		const texts = pendingPromptContext;
-		pendingPromptContext = [];
+		if (gen !== sessionGen) return;
+		// Every run that opens lands here (on pi 1.2.0 also one an extension
+		// opened; a queued delivery does not). Only the Stop hook's own
+		// continuation keeps the cap counting: a notification or scheduled run
+		// starts a fresh turn, as a prompt does.
+		if (!isStopContinuation(event)) stopHookBlocks = 0;
+		// UserPromptSubmit context belongs to the user's prompt; SessionStart and
+		// PostCompact context belong to whichever run opens next, which on pi
+		// 1.2.0 can be one a notification or scheduled fire opened. Its
+		// message_start can no longer deliver them: `prompted` is set above.
+		const userRun = isUserRun(event);
+		const texts = pendingPromptContext.filter((entry) => userRun || entry.event !== "UserPromptSubmit");
+		if (texts.length === 0) return;
+		pendingPromptContext = pendingPromptContext.filter((entry) => !texts.includes(entry));
 		return {
 			message: {
 				customType: "one-code:hook-context",
@@ -367,8 +480,13 @@ export default function hooksExtension(pi: ExtensionAPI) {
 
 	// ---- SessionStart / SessionEnd -----------------------------------------
 	const dispatchSessionStart = async (ctx: ExtensionContext, source: string, gen: number) => {
-		const payload: HookStdinPayload = { ...basePayload(ctx, "SessionStart"), source };
-		const outcome = await dispatch(ctx, "SessionStart", { candidates: [source] }, payload);
+		// Reserve project-hook consent synchronously, before MCP and external
+		// imports enqueue their dialogs. Only defer the payload: worktree's later
+		// synchronous session_start handler must restore cwd before we capture it.
+		const outcome = await dispatch(ctx, "SessionStart", { candidates: [source] }, async () => {
+			await new Promise<void>((resolve) => setImmediate(resolve));
+			return gen === sessionGen ? { ...basePayload(ctx, "SessionStart"), source } : undefined;
+		});
 		// A later session_start (rapid /clear, resume) may have superseded this one
 		// while its hook ran; discard the stale result instead of pushing it into
 		// the new session's context (`pendingPromptContext` is shared and reset).
@@ -378,10 +496,15 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	};
 
 	pi.on("session_start", (event, ctx) => {
+		sessionAbort.abort();
+		sessionAbort = new AbortController();
 		lastCtx = ctx;
 		const gen = ++sessionGen;
 		pendingPromptContext = [];
+		queuedPromptContext.clear();
 		sessionStartPending = undefined;
+		prompted = false;
+		stopHookBlocks = 0;
 		// Publish the child hook bridge (subagent-bridge.ts). The closures read
 		// live parent state per call, so once per session start is enough.
 		pi.events.emit(SUBAGENT_HOOK_CHANNEL, { bridge: childHookBridge } satisfies SubagentHookPayload);
@@ -410,9 +533,21 @@ export default function hooksExtension(pi: ExtensionAPI) {
 		agent_id: call.sessionId,
 		agent_type: call.agentType,
 	});
+	/**
+	 * The parent's settings/consent context with the CHILD's run signal. A
+	 * background child outlives the parent's turn, so Esc in the parent must
+	 * not skip a child's deny hook; stopping the child must cancel its hooks.
+	 */
+	const childDispatchCtx = (ctx: ExtensionContext, call: ChildHookCall): HookDispatchCtx => ({
+		cwd: ctx.cwd,
+		hasUI: ctx.hasUI,
+		sessionManager: ctx.sessionManager,
+		ui: ctx.ui,
+		signal: call.signal,
+	});
 	const childHookBridge: HookBridge = {
 		async preToolUse(call) {
-			const ctx = lastCtx;
+			const ctx = lastCtx && childDispatchCtx(lastCtx, call);
 			if (!ctx) return {};
 			const outcome = await dispatch(ctx, "PreToolUse", { candidates: toolMatchCandidates(call.toolName) }, childPayload(call, "PreToolUse"));
 			return {
@@ -422,7 +557,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			};
 		},
 		async postToolUse(result: ChildHookResult) {
-			const ctx = lastCtx;
+			const ctx = lastCtx && childDispatchCtx(lastCtx, result);
 			if (!ctx) return {};
 			const payload: HookStdinPayload = {
 				...childPayload(result, "PostToolUse"),
@@ -449,6 +584,9 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	};
 
 	pi.on("session_shutdown", (event, ctx) => {
+		// Also cancels a queued SessionStart before its deferred dispatch touches a disposed context.
+		sessionGen += 1;
+		sessionAbort.abort();
 		// A reload re-runs the extensions but keeps the conversation (pi's
 		// AgentSession.reload): not a session end, Claude Code has no such event.
 		if (event.reason === "reload") return;
@@ -492,19 +630,38 @@ export default function hooksExtension(pi: ExtensionAPI) {
 	});
 
 	pi.on("agent_settled", async (_event, ctx) => {
+		const gen = sessionGen;
+		// A queued message pi never delivered as typed (expanded, or taken over by
+		// an extension) keeps no context for a later, unrelated prompt.
+		queuedPromptContext.clear();
 		// CC skips Stop when the turn ended on an API error (a blocking hook would
 		// spiral: error → block → retry → error) or on a user interrupt (its query
 		// loop returns on the abort signal before the stop-hook step). An empty latch
 		// means no run ended in this turn, which is not a response to stop on either.
 		if (stopOutcome.take() !== "ok") return;
-		const payload: HookStdinPayload = { ...basePayload(ctx, "Stop"), stop_hook_active: stopHookActive };
+		// Claude Code's two lists of what will wake the session later, filled by the
+		// background extension (lib/session-work.ts); empty arrays when none.
+		const work: SessionWorkQuery = { crons: [], tasks: [] };
+		pi.events.emit(SESSION_WORK_CHANNEL, work);
+		const payload: HookStdinPayload = {
+			...basePayload(ctx, "Stop"),
+			stop_hook_active: stopHookBlocks > 0,
+			background_tasks: work.tasks,
+			session_crons: work.crons,
+		};
 		const outcome = await dispatch(ctx, "Stop", { ignoreMatcher: true }, payload);
-		if (!outcome.block) return;
-		stopHookActive = true;
+		if (gen !== sessionGen || outcome.preventContinuation || !outcome.block) return;
+		// Claude Code limits repeated Stop blocks to eight continuations. A hook
+		// that ignores stop_hook_active must not run up an unbounded model loop.
+		if (stopHookBlocks >= MAX_STOP_CONTINUATIONS) {
+			notify(ctx, `Stop hook continuation limit reached (${MAX_STOP_CONTINUATIONS}); ending the turn.`);
+			return;
+		}
+		stopHookBlocks += 1;
 		try {
 			pi.sendMessage(
 				{
-					customType: "one-code:hook-stop",
+					customType: STOP_CONTINUATION_TYPE,
 					content: `Stop hook blocked stopping: ${outcome.block.reason}`,
 					display: false,
 				},
@@ -533,10 +690,19 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			notify(ctx, `Compaction cancelled by PreCompact hook: ${outcome.block.reason}`);
 			return { cancel: true };
 		}
+		// These instructions belong to the summarizer, not the next user turn.
+		// The signal keeps them scoped to this attempt if compaction is cancelled.
+		if (outcome.additionalContext) {
+			pi.events.emit(PRECOMPACT_INSTRUCTIONS_CHANNEL, {
+				signal: event.signal,
+				instructions: outcome.additionalContext,
+			} satisfies PreCompactInstructions);
+		}
 		return undefined;
 	});
 
 	pi.on("session_compact", async (event, ctx) => {
+		const gen = sessionGen;
 		const trigger = compactTrigger(event);
 		const payload: HookStdinPayload = {
 			...basePayload(ctx, "PostCompact"),
@@ -544,6 +710,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
 			compact_summary: event.compactionEntry.summary,
 		};
 		const outcome = await dispatch(ctx, "PostCompact", { candidates: [trigger] }, payload);
+		if (gen !== sessionGen) return;
 		if (outcome.additionalContext) pendingPromptContext.push({ event: "PostCompact", text: outcome.additionalContext });
 		// CC fires SessionStart(source: "compact") after compaction. Awaited inline
 		// (not backgrounded), so the current generation is still in force.

package/extensions/hooks/matcher.ts

@@ -38,6 +38,9 @@ const CC_CANONICAL: Record<string, string> = {
 	task_stop: "TaskStop",
 	monitor: "Monitor",
 	schedule_wakeup: "ScheduleWakeup",
+	cron_create: "CronCreate",
+	cron_list: "CronList",
+	cron_delete: "CronDelete",
 	send_message: "SendMessage",
 	enter_worktree: "EnterWorktree",
 	exit_worktree: "ExitWorktree",