pi-code 0.1.0 → 0.2.1

package/README.md

@@ -1,5 +1,16 @@
 # pi-code
 
+[![npm](https://img.shields.io/npm/v/pi-code)](https://www.npmjs.com/package/pi-code)
+[![npm](https://img.shields.io/npm/dt/pi-code)](https://www.npmjs.com/package/pi-code)
+[![GitHub](https://img.shields.io/github/license/ilovepixelart/pi-code)](https://github.com/ilovepixelart/pi-code/blob/main/LICENSE)
+\
+[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=ilovepixelart_pi-code&metric=coverage)](https://sonarcloud.io/summary/new_code?id=ilovepixelart_pi-code)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=ilovepixelart_pi-code&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=ilovepixelart_pi-code)
+\
+[![Reliability Rating](https://sonarcloud.io/api/project_badges/measure?project=ilovepixelart_pi-code&metric=reliability_rating)](https://sonarcloud.io/summary/new_code?id=ilovepixelart_pi-code)
+[![Maintainability Rating](https://sonarcloud.io/api/project_badges/measure?project=ilovepixelart_pi-code&metric=sqale_rating)](https://sonarcloud.io/summary/new_code?id=ilovepixelart_pi-code)
+[![Security Rating](https://sonarcloud.io/api/project_badges/measure?project=ilovepixelart_pi-code&metric=security_rating)](https://sonarcloud.io/summary/new_code?id=ilovepixelart_pi-code)
+
 Claude Code experience for the [pi](https://pi.dev) coding agent, in one package. Point pi at a project that already has a `.claude/` directory and it reads your existing config: rules, commands, skills, hooks, output styles, MCP servers, and agents. It also adds the Claude Code features pi lacks: a todo overlay, checkpoints, memory, web search, and subagents.
 
 ![pi-code demo](demos/hero.gif)
@@ -7,12 +18,18 @@ Claude Code experience for the [pi](https://pi.dev) coding agent, in one package
 ## Install
 
 ```bash
-pi install pi-code                       # from npm (when published)
+pi install npm:pi-code       # from npm
+pi install -l npm:pi-code    # project-local instead, writes .pi/settings.json
+```
+
+Other sources:
+
+```bash
 pi install git:github.com/ilovepixelart/pi-code
-pi install ~/Documents/pi-code           # local path, then /reload after edits
+pi install ./pi-code         # local checkout, then /reload after edits
 ```
 
-One `pi install`, everything below loads. Each feature is an extension under [`extensions/`](extensions).
+One `pi install` and everything below loads on the next start. `pi list` shows what is installed, `pi config` toggles individual resources, and `pi update pi-code` upgrades it. Each feature is an extension under [`extensions/`](extensions).
 
 ## What it does
 
@@ -24,8 +41,8 @@ One `pi install`, everything below loads. Each feature is an extension under [`e
 | Hooks | `.claude/settings.json` hooks on pi lifecycle events | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`, `/output-style` switcher | `output-styles.ts` |
 | CLAUDE.md `@imports` | resolves `@path` imports pi's native loader skips | `context-imports.ts` |
-| MCP servers | `.mcp.json`, `~/.claude.json`, `.pi/mcp.json`; stdio + HTTP | `mcp.ts` |
-| Subagents / Task | `~/.claude/agents` + project `.claude/agents`, background runs | `subagent/` |
+| MCP servers | `~/.claude.json`, `~/.pi/agent/mcp.json`, `.mcp.json`, `.pi/mcp.json` (later wins); stdio, HTTP, SSE | `mcp.ts` |
+| Subagents / Task | `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; background runs | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
 | Checkpoints / rewind | shadow-repo snapshots, hard-reset restore | `git-checkpoint.ts` |
@@ -37,7 +54,7 @@ One `pi install`, everything below loads. Each feature is an extension under [`e
 
 `CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
 
-Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)). Personal config lives in [dot-pi](https://github.com/ilovepixelart/dot-pi) (`~/.pi/agent`).
+Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 
 ## Development
 
@@ -48,4 +65,4 @@ scripts/e2e.sh          # drives the real pi TUI via tmux (needs a working model
 scripts/record-demos.sh # re-records demos/*.tape with vhs at low thinking
 ```
 
-Extensions live in `extensions/`, tests in `tests/`. Install locally with `pi install ~/Documents/pi-code`, then `/reload` after edits.
+Extensions live in `extensions/`, tests in `tests/`. Install a local checkout with `pi install ./pi-code`, then `/reload` after edits.

package/extensions/claude-rules.ts

@@ -42,10 +42,14 @@ function parsePaths(frontmatter: string): string[] {
   const inline = lines[index].replace(/^\s*paths\s*:/, '').trim()
   if (inline) return splitInline(inline)
   const items: string[] = []
+  // Matched with string ops rather than a regex: the equivalent pattern needs two
+  // adjacent whitespace quantifiers, which backtracks super-linearly on long lines.
   for (let i = index + 1; i < lines.length; i++) {
-    const match = /^\s*-\s*(.+)$/.exec(lines[i])
-    if (!match) break
-    items.push(unquote(match[1].trim()))
+    const entry = lines[i].trimStart()
+    if (!entry.startsWith('-')) break
+    const value = entry.slice(1).trim()
+    if (!value) break
+    items.push(unquote(value))
   }
   return items
 }

package/extensions/context-imports.ts

@@ -54,6 +54,41 @@ export interface ImportedFile {
   body: string
 }
 
+/** The `@path` targets of a context file, in document order, skipping fenced code blocks. */
+function importTargets(content: string): string[] {
+  const targets: string[] = []
+  let inFence = false
+  for (const line of content.split('\n')) {
+    if (line.trimStart().startsWith('```')) {
+      inFence = !inFence
+      continue
+    }
+    if (inFence) continue
+    for (const match of line.matchAll(/(^|\s)@(\S+)/g)) targets.push(match[2])
+  }
+  return targets
+}
+
+/** Read one `@path` target, or null when it is unresolvable, already seen, outside `allowedRoots`, or unreadable. */
+function readImport(target: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>): { real: string; body: string } | null {
+  const resolved = path.resolve(fromDir, expandHome(target, home))
+  let real: string
+  try {
+    real = fs.realpathSync(resolved)
+  } catch {
+    return null
+  }
+  if (seen.has(real)) return null
+  seen.add(real)
+  if (!isUnder(real, allowedRoots)) return null
+  try {
+    // real may be a directory (EISDIR) or vanish after the realpath (ENOENT/EACCES).
+    return { real, body: fs.readFileSync(real, 'utf-8') }
+  } catch {
+    return null
+  }
+}
+
 /**
  * Collect the contents of every file transitively imported via `@path`, in
  * discovery order. Imports are resolved through symlinks and kept within
@@ -62,38 +97,29 @@ export interface ImportedFile {
 export function collectImports(content: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>, depth = 0): ImportedFile[] {
   if (depth >= MAX_IMPORT_DEPTH) return []
   const out: ImportedFile[] = []
-  let inFence = false
-  for (const line of content.split('\n')) {
-    if (line.trimStart().startsWith('```')) {
-      inFence = !inFence
-      continue
-    }
-    if (inFence) continue
-    for (const match of line.matchAll(/(^|\s)@(\S+)/g)) {
-      const resolved = path.resolve(fromDir, expandHome(match[2], home))
-      let real: string
-      try {
-        real = fs.realpathSync(resolved)
-      } catch {
-        continue
-      }
-      if (seen.has(real)) continue
-      seen.add(real)
-      if (!isUnder(real, allowedRoots)) continue
-      let body: string
-      try {
-        // real may be a directory (EISDIR) or vanish after the realpath (ENOENT/EACCES).
-        body = fs.readFileSync(real, 'utf-8')
-      } catch {
-        continue
-      }
-      out.push({ path: real, body: body.trim() })
-      out.push(...collectImports(body, path.dirname(real), home, allowedRoots, seen, depth + 1))
-    }
+  for (const target of importTargets(content)) {
+    const file = readImport(target, fromDir, home, allowedRoots, seen)
+    if (!file) continue
+    out.push({ path: file.real, body: file.body.trim() }, ...collectImports(file.body, path.dirname(file.real), home, allowedRoots, seen, depth + 1))
   }
   return out
 }
 
+/**
+ * Roots an importing file may pull from.
+ *
+ * A context file under the user's own config may reach the whole config; a project
+ * file may not. `~/.claude` holds `.credentials.json`, global settings and every
+ * project's transcripts, so granting those roots to a cloned repo's `CLAUDE.md`
+ * would let it read them into the system prompt.
+ */
+export function rootsForImporter(importer: string, home: string, cwd: string): string[] {
+  const userRoots = realRoots([path.join(home, '.claude'), path.join(home, '.pi')])
+  const [real] = realRoots([importer])
+  const fromUserConfig = real !== undefined && isUnder(real, userRoots)
+  return fromUserConfig ? realRoots([cwd, ...userRoots]) : realRoots([cwd])
+}
+
 export default function contextImportsExtension(pi: ExtensionAPI) {
   pi.on('before_agent_start', async (event) => {
     const contextFiles: Array<{ path: string; content: string }> = event.systemPromptOptions?.contextFiles ?? []
@@ -101,13 +127,14 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
 
     const home = os.homedir()
     const cwd = event.systemPromptOptions?.cwd ?? process.cwd()
-    const allowedRoots = realRoots([cwd, path.join(home, '.claude'), path.join(home, '.pi')])
     // Seed with the loaded context file paths so pi's own files are never re-imported.
     const seen = realRoots(contextFiles.map((file) => file.path))
     const seenSet = new Set(seen)
 
     const imported: ImportedFile[] = []
     for (const file of contextFiles) {
+      // Roots are scoped per importing file: a project file never reaches user config.
+      const allowedRoots = rootsForImporter(file.path, home, cwd)
       imported.push(...collectImports(file.content, path.dirname(file.path), home, allowedRoots, seenSet))
     }
     if (imported.length === 0) return

package/extensions/git-checkpoint.ts

@@ -65,7 +65,21 @@ function checkpointLabel(checkpoint: Checkpoint, index: number): string {
   return `${index + 1}. ${time}  ${checkpoint.prompt || '(empty prompt)'}${marker}`
 }
 
-export default function (pi: ExtensionAPI) {
+async function restoreConversation(ctx: ExtensionCommandContext, entryId: string): Promise<boolean> {
+  try {
+    // navigateTree's published type omits editorText, but it is present at runtime (docs/extensions.md)
+    const result = (await ctx.navigateTree(entryId, { summarize: false })) as { cancelled: boolean; editorText?: string }
+    if (result.cancelled) return false
+    if (typeof result.editorText === 'string') ctx.ui.setEditorText(result.editorText)
+    return true
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error)
+    ctx.ui.notify(`Conversation restore failed: ${message}`, 'error')
+    return false
+  }
+}
+
+export default function gitCheckpointExtension(pi: ExtensionAPI) {
   const checkpoints = new Map<string, Checkpoint>()
   let pending: { ref: string; createdAt: string } | undefined
   let shadowDir: string | undefined
@@ -117,20 +131,6 @@ export default function (pi: ExtensionAPI) {
     return true
   }
 
-  async function restoreConversation(ctx: ExtensionCommandContext, entryId: string): Promise<boolean> {
-    try {
-      // navigateTree's published type omits editorText, but it is present at runtime (docs/extensions.md)
-      const result = (await ctx.navigateTree(entryId, { summarize: false })) as { cancelled: boolean; editorText?: string }
-      if (result.cancelled) return false
-      if (typeof result.editorText === 'string') ctx.ui.setEditorText(result.editorText)
-      return true
-    } catch (error) {
-      const message = error instanceof Error ? error.message : String(error)
-      ctx.ui.notify(`Conversation restore failed: ${message}`, 'error')
-      return false
-    }
-  }
-
   async function runRestoreMode(ctx: ExtensionCommandContext, checkpoint: Checkpoint): Promise<void> {
     const mode = await ctx.ui.select('Restore mode:', [...RESTORE_MODES])
     if (!mode) return
@@ -178,7 +178,7 @@ export default function (pi: ExtensionAPI) {
         ctx.ui.notify('No checkpoints recorded yet', 'info')
         return
       }
-      const labels = ordered.map(checkpointLabel)
+      const labels = ordered.map((checkpoint, index) => checkpointLabel(checkpoint, index))
       const choice = await ctx.ui.select('Rewind to checkpoint:', labels)
       if (!choice) return
       const checkpoint = ordered[labels.indexOf(choice)]

package/extensions/hooks.ts

@@ -27,6 +27,8 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { isProjectApproved } from './project-approval.js'
+
 const DEFAULT_TIMEOUT_S = 60
 
 interface HookCommand {
@@ -112,7 +114,8 @@ export function interpretHookResult(code: number, stdout: string, stderr: string
 
 export const runHookCommand: HookRunner = (command, payload, timeoutMs) =>
   new Promise((resolve) => {
-    const child = spawn('sh', ['-c', command], { stdio: ['pipe', 'pipe', 'pipe'] })
+    // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
+    const child = spawn('/bin/sh', ['-c', command], { stdio: ['pipe', 'pipe', 'pipe'] })
     let stdout = ''
     let stderr = ''
     const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs)
@@ -158,7 +161,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
 
   pi.on('session_start', async (event, ctx) => {
-    const trusted = ctx.isProjectTrusted?.() ?? false
+    const trusted = await isProjectApproved(ctx)
     config = loadHooks(hookFiles(ctx.cwd, os.homedir(), trusted))
     // Only fire SessionStart hooks on a genuine session begin, matched by source (Claude uses
     // "startup"/"resume"/...). "reload" and "fork" re-fire in-process and would double-run hooks.

package/extensions/mcp.ts

@@ -18,16 +18,23 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
-import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js'
-import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
+// SSE is deprecated in favour of Streamable HTTP, but the SDK notes servers still on
+// the old spec exist, so this stays as a fallback for the migration period.
+import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' // NOSONAR
+import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
+import { isProjectApproved } from './project-approval.js'
 
 const CONNECT_TIMEOUT_MS = 10_000
 const CALL_TIMEOUT_MS = 120_000
-const MAX_INLINE_RESULT = 50_000
-// pi's built-in tool names must never be shadowed by an MCP tool
-const RESERVED_NAMES = new Set(['read', 'bash', 'edit', 'write', 'grep', 'find', 'ls', 'mcp'])
+// Tool names an MCP server must never take over. formatToolName always emits
+// `<server>_<tool>`, so only names containing an underscore are actually reachable:
+// pi's own built-ins (read, bash, edit, ...) cannot be produced and are not listed.
+// These are pi-code's own tools, and mcp.ts registers before the extensions owning
+// them, so without this guard a server named `web` would replace the SSRF-checked fetch.
+const RESERVED_NAMES = new Set(['web_fetch', 'web_search', 'plan_mode_complete'])
 
 export interface StdioServerConfig {
   command: string
@@ -82,7 +89,7 @@ export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
 }
 
 export function formatToolName(server: string, tool: string): string {
-  return `${server}_${tool}`.replace(/-/g, '_')
+  return `${server}_${tool}`.replaceAll('-', '_')
 }
 
 export function normalizeSchema(schema: unknown): object {
@@ -108,8 +115,7 @@ export function mapContent(content: McpContentBlock[] | undefined, structured?:
   }
   return content.map((block) => {
     if (block.type === 'text') {
-      const text = block.text ?? ''
-      return text.length > MAX_INLINE_RESULT ? { type: 'text', text: `${text.slice(0, MAX_INLINE_RESULT)}\n[truncated ${text.length - MAX_INLINE_RESULT} chars]` } : { type: 'text', text }
+      return { type: 'text', text: capForContext(block.text ?? '') }
     }
     if (block.type === 'image' && block.data) {
       return { type: 'image', data: block.data, mimeType: block.mimeType ?? 'image/png' }
@@ -143,7 +149,10 @@ async function withTimeout<T>(promise: Promise<T>, ms: number, label: string): P
 async function connect(name: string, config: ServerConfig): Promise<Client> {
   const client = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
   if (isStdio(config)) {
-    const env: Record<string, string> = { ...(process.env as Record<string, string>) }
+    // Start from the SDK's allowlist (PATH, HOME, SHELL, ...) rather than the whole
+    // process env: a server should not receive ANTHROPIC_API_KEY or GITHUB_TOKEN just
+    // for being launched. A server that needs a variable names it in its own env block.
+    const env: Record<string, string> = { ...getDefaultEnvironment() }
     for (const [key, value] of Object.entries(config.env ?? {})) env[key] = interpolateEnv(value)
     const transport = new StdioClientTransport({
       command: config.command,
@@ -167,7 +176,7 @@ async function connect(name: string, config: ServerConfig): Promise<Client> {
   } catch (error) {
     if (String(error).includes('Unauthorized')) throw error
     const fallback = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
-    const transport = new SSEClientTransport(url, { requestInit: { headers } })
+    const transport = new SSEClientTransport(url, { requestInit: { headers } }) // NOSONAR: deliberate legacy fallback
     await withTimeout(fallback.connect(transport), CONNECT_TIMEOUT_MS, `connect ${name} (sse)`)
     return fallback
   }
@@ -229,13 +238,19 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     }
   }
 
-  // User config is the user's own, so connect it eagerly.
-  await connectServers(loadConfigFrom(userConfigPaths(os.homedir())))
-
+  let userConnected = false
   let projectConnected = false
+
   pi.on('session_start', async (_event, ctx) => {
+    // Connecting spawns processes and opens sockets, so it belongs here rather than in
+    // the factory: pi runs the factory for invocations that never start a session.
+    if (!userConnected) {
+      userConnected = true
+      await connectServers(loadConfigFrom(userConfigPaths(os.homedir())))
+    }
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once the project is trusted.
-    if (!projectConnected && ctx.isProjectTrusted?.()) {
+    // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
+    if (!projectConnected && (await isProjectApproved(ctx))) {
       projectConnected = true
       await connectServers(loadConfigFrom(projectConfigPaths(ctx.cwd)))
     }

package/extensions/memory.ts

@@ -13,6 +13,7 @@ import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
 
 const INDEX_FILE = 'MEMORY.md'
 
@@ -28,8 +29,8 @@ export function slugifyName(name: string): string {
   return (
     name
       .toLowerCase()
-      .replace(/[^a-z0-9]+/g, '-')
-      .replace(/^-+|-+$/g, '')
+      .replaceAll(/[^a-z0-9]+/g, '-')
+      .replaceAll(/^-|-$/g, '')
       .slice(0, 64) || 'memory'
   )
 }
@@ -105,7 +106,7 @@ export default function memoryExtension(pi: ExtensionAPI) {
         if (!name) return { content: [{ type: 'text' as const, text: 'read requires name.' }], details: {} }
         try {
           const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
-          return { content: [{ type: 'text' as const, text: body }], details: {} }
+          return { content: [{ type: 'text' as const, text: capForContext(body) }], details: {} }
         } catch {
           return { content: [{ type: 'text' as const, text: `No memory named ${name}.` }], details: {} }
         }

package/extensions/notify.ts

@@ -30,9 +30,11 @@ function notifyOSC99(title: string, body: string): void {
 
 function notifyWindows(title: string, body: string): void {
   const { execFile } = require('node:child_process')
-  // The callback captures a spawn failure (e.g. powershell.exe missing) instead of
-  // letting an unhandled 'error' event crash the host process.
-  execFile('powershell.exe', ['-NoProfile', '-Command', windowsToastScript(title, body)], () => {})
+  // Resolve powershell from a fixed system path rather than through PATH, and let the callback
+  // capture a spawn failure instead of an unhandled 'error' event crashing the host.
+  const root = process.env.SystemRoot ?? String.raw`C:\Windows`
+  const powershell = String.raw`${root}\System32\WindowsPowerShell\v1.0\powershell.exe`
+  execFile(powershell, ['-NoProfile', '-Command', windowsToastScript(title, body)], () => {})
 }
 
 function notify(title: string, body: string): void {
@@ -45,7 +47,7 @@ function notify(title: string, body: string): void {
   }
 }
 
-export default function (pi: ExtensionAPI) {
+export default function notifyExtension(pi: ExtensionAPI) {
   pi.on('agent_end', async () => {
     notify('Pi', 'Ready for input')
   })

package/extensions/output-guard.ts

@@ -0,0 +1,23 @@
+/**
+ * Output Guard
+ *
+ * pi requires every tool to truncate its output, at 50KB or 2000 lines, whichever is hit
+ * first (docs/extensions.md, "Tool output"). Each tool used to decide that for itself, so
+ * the budgets and the truncation notices diverged and a byte-only cap let thousands of
+ * short lines through. This is the single place that decision lives.
+ *
+ * `truncateHead` keeps whole lines, which means a single line over the budget yields no
+ * content at all. That trap is handled here once rather than at each call site.
+ */
+
+import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
+
+/** Trim `text` to pi's documented tool-output budget, noting what was dropped. */
+export function capForContext(text: string): string {
+  const cut = truncateHead(text, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
+  if (!cut.truncated) return text
+  const kept = cut.content || text.slice(0, DEFAULT_MAX_BYTES)
+  const capped = `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total, ${cut.totalLines} lines]`
+  // Just over the budget, the notice can cost more than the trim saves.
+  return capped.length < text.length ? capped : text
+}

package/extensions/output-styles.ts

@@ -26,7 +26,7 @@ export interface OutputStyle {
 }
 
 function field(frontmatter: string, key: string): string {
-  const match = new RegExp(`^\\s*${key}\\s*:\\s*(.+)$`, 'm').exec(frontmatter)
+  const match = new RegExp(String.raw`^\s*${key}\s*:\s*(.+)$`, 'm').exec(frontmatter)
   return match ? match[1].trim().replace(/^["']|["']$/g, '') : ''
 }