pi-code 0.2.0 → 0.2.2

package/extensions/context-imports.ts

@@ -5,16 +5,18 @@
  * Claude Code's `@path` imports inside them. This fills that one gap: on
  * before_agent_start it reads the already-loaded context files from
  * systemPromptOptions, resolves any `@path` imports (recursive, depth-capped,
- * cycle-safe; ~ expands to home, relative paths resolve against the importing
- * file), and appends ONLY the imported content. pi already injected the base
- * files, so nothing is duplicated.
+ * cycle-safe, budget-capped; ~ expands to home, relative paths resolve against
+ * the importing file), and appends ONLY the imported content. pi already
+ * injected the base files, so nothing is duplicated.
  *
  * Security: context files can come from an untrusted project, so imports are
  * confined (after resolving symlinks) to the working directory and the user's
  * own ~/.claude and ~/.pi config roots. An import that escapes those roots
  * (absolute paths, ~/.ssh, ../.. traversal, symlinks) is ignored, so a hostile
  * CLAUDE.md cannot read arbitrary files into the prompt. Imports inside fenced
- * code blocks are also skipped.
+ * code blocks are also skipped. One byte-and-file budget is shared by the whole
+ * run, so a context file cannot flood the prompt by importing breadth-first;
+ * what the budget refused is stated in the prompt rather than dropped silently.
  *
  * Docs: https://code.claude.com/docs/en/memory.md (imports)
  */
@@ -25,6 +27,8 @@ import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 const MAX_IMPORT_DEPTH = 5
+export const MAX_IMPORT_FILES = 50
+export const MAX_IMPORT_BYTES = 256 * 1024
 
 export function expandHome(target: string, home: string): string {
   if (target === '~') return home
@@ -54,6 +58,18 @@ export interface ImportedFile {
   body: string
 }
 
+/** Appended to the last body the byte budget could only partly pay for. */
+export const IMPORT_TRUNCATED_MARKER = '[truncated: import byte budget exhausted]'
+
+/** Remaining import allowance, shared across every context file of one run. */
+export interface ImportBudget {
+  files: number
+  bytes: number
+  dropped: number
+}
+
+export const createImportBudget = (): ImportBudget => ({ files: MAX_IMPORT_FILES, bytes: MAX_IMPORT_BYTES, dropped: 0 })
+
 /** The `@path` targets of a context file, in document order, skipping fenced code blocks. */
 function importTargets(content: string): string[] {
   const targets: string[] = []
@@ -94,13 +110,22 @@ function readImport(target: string, fromDir: string, home: string, allowedRoots:
  * discovery order. Imports are resolved through symlinks and kept within
  * `allowedRoots` (which must already be realpath'd).
  */
-export function collectImports(content: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>, depth = 0): ImportedFile[] {
+export function collectImports(content: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>, budget: ImportBudget = createImportBudget(), depth = 0): ImportedFile[] {
   if (depth >= MAX_IMPORT_DEPTH) return []
   const out: ImportedFile[] = []
   for (const target of importTargets(content)) {
+    // Checked before the read so an exhausted budget costs no I/O.
+    if (budget.files === 0 || budget.bytes === 0) {
+      budget.dropped += 1
+      continue
+    }
     const file = readImport(target, fromDir, home, allowedRoots, seen)
     if (!file) continue
-    out.push({ path: file.real, body: file.body.trim() }, ...collectImports(file.body, path.dirname(file.real), home, allowedRoots, seen, depth + 1))
+    budget.files -= 1
+    const kept = file.body.slice(0, budget.bytes)
+    budget.bytes -= kept.length
+    const body = kept.length < file.body.length ? `${kept.trim()}\n${IMPORT_TRUNCATED_MARKER}` : kept.trim()
+    out.push({ path: file.real, body }, ...collectImports(kept, path.dirname(file.real), home, allowedRoots, seen, budget, depth + 1))
   }
   return out
 }
@@ -132,14 +157,17 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const seenSet = new Set(seen)
 
     const imported: ImportedFile[] = []
+    // One budget for the whole run, so N context files cannot each spend a full one.
+    const budget = createImportBudget()
     for (const file of contextFiles) {
       // Roots are scoped per importing file: a project file never reaches user config.
       const allowedRoots = rootsForImporter(file.path, home, cwd)
-      imported.push(...collectImports(file.content, path.dirname(file.path), home, allowedRoots, seenSet))
+      imported.push(...collectImports(file.content, path.dirname(file.path), home, allowedRoots, seenSet, budget))
     }
     if (imported.length === 0) return
 
     const section = imported.map((entry) => `### ${entry.path}\n\n${entry.body}`).join('\n\n')
-    return { systemPrompt: `${event.systemPrompt}\n\n## Imported context (@)\n\n${section}` }
+    const notice = budget.dropped === 0 ? '' : `\n\n${budget.dropped} further @imports were skipped: the import budget (${MAX_IMPORT_FILES} files, ${MAX_IMPORT_BYTES} bytes) is spent.`
+    return { systemPrompt: `${event.systemPrompt}\n\n## Imported context (@)\n\n${section}${notice}` }
   })
 }

package/extensions/hooks.ts

@@ -21,12 +21,14 @@
  * Docs: https://code.claude.com/docs/en/hooks.md
  */
 
-import { spawn } from 'node:child_process'
+import { type ChildProcess, spawn } from 'node:child_process'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { isProjectApproved } from './project-approval.js'
+
 const DEFAULT_TIMEOUT_S = 60
 
 interface HookCommand {
@@ -48,6 +50,8 @@ export interface HookRunResult {
   code: number
   stdout: string
   stderr: string
+  /** The hook was killed at its timeout, so its exit code carries no verdict. */
+  timedOut: boolean
 }
 export type HookRunner = (command: string, payload: unknown, timeoutMs: number) => Promise<HookRunResult>
 
@@ -110,27 +114,64 @@ export function interpretHookResult(code: number, stdout: string, stderr: string
   return { block: false }
 }
 
+/** Memory backstop for a runaway hook. A decision payload is orders of magnitude smaller. */
+const MAX_HOOK_OUTPUT = 1_000_000
+
+/** Conventional exit code for a killed-on-timeout command, as `timeout(1)` reports it. */
+const TIMEOUT_EXIT_CODE = 124
+
+/**
+ * Kill the shell and everything it spawned. `sh -c 'a; b'` forks, so signalling the
+ * direct child alone leaves a grandchild alive holding stdout/stderr.
+ */
+function killTree(child: ChildProcess): void {
+  try {
+    // Negative pid targets the whole process group, which `detached` gave the shell.
+    if (child.pid) {
+      process.kill(-child.pid, 'SIGKILL')
+      return
+    }
+  } catch {
+    // Group already reaped, or the platform refused it; fall through to the direct kill.
+  }
+  child.kill('SIGKILL')
+}
+
 export const runHookCommand: HookRunner = (command, payload, timeoutMs) =>
   new Promise((resolve) => {
     // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
-    const child = spawn('/bin/sh', ['-c', command], { stdio: ['pipe', 'pipe', 'pipe'] })
+    // `detached` makes the shell its own process group leader so the timeout can kill
+    // the descendants too.
+    const child = spawn('/bin/sh', ['-c', command], { stdio: ['pipe', 'pipe', 'pipe'], detached: true })
     let stdout = ''
     let stderr = ''
-    const timer = setTimeout(() => child.kill('SIGKILL'), timeoutMs)
-    child.stdout?.on('data', (chunk) => {
-      stdout += chunk
-    })
-    child.stderr?.on('data', (chunk) => {
-      stderr += chunk
-    })
-    child.on('close', (code) => {
+    let settled = false
+    const finish = (result: HookRunResult): void => {
+      if (settled) return
+      settled = true
       clearTimeout(timer)
-      resolve({ code: code ?? 0, stdout, stderr })
+      resolve(result)
+    }
+    // Resolve from the timer itself rather than waiting for `close`: `close` fires only
+    // once every stdio pipe is closed, and a grandchild that inherited them can hold the
+    // promise pending long past the timeout, stalling the tool call that awaits it.
+    const timer = setTimeout(() => {
+      killTree(child)
+      finish({ code: TIMEOUT_EXIT_CODE, stdout, stderr, timedOut: true })
+    }, timeoutMs)
+    // Decode on the stream: concatenating Buffers as strings mangles a multi-byte
+    // character split across chunks, and a mangled byte in a hook's deny decision makes
+    // it unparseable, which reads as an allow.
+    child.stdout?.setEncoding('utf8')
+    child.stderr?.setEncoding('utf8')
+    child.stdout?.on('data', (chunk: string) => {
+      if (stdout.length < MAX_HOOK_OUTPUT) stdout += chunk
     })
-    child.on('error', () => {
-      clearTimeout(timer)
-      resolve({ code: 0, stdout, stderr })
+    child.stderr?.on('data', (chunk: string) => {
+      if (stderr.length < MAX_HOOK_OUTPUT) stderr += chunk
     })
+    child.on('close', (code) => finish({ code: code ?? 0, stdout, stderr, timedOut: false }))
+    child.on('error', () => finish({ code: 0, stdout, stderr, timedOut: false }))
     // A hook that exits without reading stdin (e.g. `exit 2`) closes the pipe first,
     // so ignore EPIPE on this write rather than crashing the host process.
     child.stdin?.on('error', () => {})
@@ -145,6 +186,9 @@ function timeoutMs(command: HookCommand): number {
 export async function runPreToolUse(config: HooksConfig, toolName: string, toolInput: unknown, runner: HookRunner): Promise<HookDecision> {
   for (const command of matchingCommands(config.PreToolUse, toolName)) {
     const result = await runner(command.command, { hook_event_name: 'PreToolUse', tool_name: toolName, tool_input: toolInput }, timeoutMs(command))
+    // A killed hook never reached its verdict, and SIGKILL leaves a null exit code that
+    // would otherwise read as a clean allow. Fail closed instead.
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}` }
     const decision = interpretHookResult(result.code, result.stdout, result.stderr)
     if (decision.block) return decision
   }
@@ -159,7 +203,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
 
   pi.on('session_start', async (event, ctx) => {
-    const trusted = ctx.isProjectTrusted?.() ?? false
+    const trusted = await isProjectApproved(ctx)
     config = loadHooks(hookFiles(ctx.cwd, os.homedir(), trusted))
     // Only fire SessionStart hooks on a genuine session begin, matched by source (Claude uses
     // "startup"/"resume"/...). "reload" and "fork" re-fire in-process and would double-run hooks.

package/extensions/mcp.ts

@@ -24,10 +24,11 @@ import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' //
 import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
+import { isProjectApproved } from './project-approval.js'
 
 const CONNECT_TIMEOUT_MS = 10_000
 const CALL_TIMEOUT_MS = 120_000
-const MAX_INLINE_RESULT = 50_000
 // Tool names an MCP server must never take over. formatToolName always emits
 // `<server>_<tool>`, so only names containing an underscore are actually reachable:
 // pi's own built-ins (read, bash, edit, ...) cannot be produced and are not listed.
@@ -114,8 +115,7 @@ export function mapContent(content: McpContentBlock[] | undefined, structured?:
   }
   return content.map((block) => {
     if (block.type === 'text') {
-      const text = block.text ?? ''
-      return text.length > MAX_INLINE_RESULT ? { type: 'text', text: `${text.slice(0, MAX_INLINE_RESULT)}\n[truncated ${text.length - MAX_INLINE_RESULT} chars]` } : { type: 'text', text }
+      return { type: 'text', text: capForContext(block.text ?? '') }
     }
     if (block.type === 'image' && block.data) {
       return { type: 'image', data: block.data, mimeType: block.mimeType ?? 'image/png' }
@@ -249,7 +249,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       await connectServers(loadConfigFrom(userConfigPaths(os.homedir())))
     }
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once the project is trusted.
-    if (!projectConnected && ctx.isProjectTrusted?.()) {
+    // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
+    if (!projectConnected && (await isProjectApproved(ctx))) {
       projectConnected = true
       await connectServers(loadConfigFrom(projectConfigPaths(ctx.cwd)))
     }

package/extensions/memory.ts

@@ -11,8 +11,9 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
-import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, type ExtensionAPI, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
+import { capForContext } from './output-guard.js'
 
 const INDEX_FILE = 'MEMORY.md'
 
@@ -63,17 +64,6 @@ function readIndex(dir: string): string {
   }
 }
 
-/**
- * Keep a memory inside pi's context budget. truncateHead keeps whole lines, so a
- * single oversized line yields nothing; fall back to a hard slice in that case.
- */
-function capForContext(body: string): string {
-  const cut = truncateHead(body, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
-  if (!cut.truncated) return body
-  const kept = cut.content || body.slice(0, DEFAULT_MAX_BYTES)
-  return `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total]`
-}
-
 export default function memoryExtension(pi: ExtensionAPI) {
   let dir = memoryDir(process.cwd())
 

package/extensions/output-guard.ts

@@ -0,0 +1,23 @@
+/**
+ * Output Guard
+ *
+ * pi requires every tool to truncate its output, at 50KB or 2000 lines, whichever is hit
+ * first (docs/extensions.md, "Tool output"). Each tool used to decide that for itself, so
+ * the budgets and the truncation notices diverged and a byte-only cap let thousands of
+ * short lines through. This is the single place that decision lives.
+ *
+ * `truncateHead` keeps whole lines, which means a single line over the budget yields no
+ * content at all. That trap is handled here once rather than at each call site.
+ */
+
+import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
+
+/** Trim `text` to pi's documented tool-output budget, noting what was dropped. */
+export function capForContext(text: string): string {
+  const cut = truncateHead(text, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
+  if (!cut.truncated) return text
+  const kept = cut.content || text.slice(0, DEFAULT_MAX_BYTES)
+  const capped = `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total, ${cut.totalLines} lines]`
+  // Just over the budget, the notice can cost more than the trim saves.
+  return capped.length < text.length ? capped : text
+}

package/extensions/plan-mode/utils.ts

@@ -94,9 +94,57 @@ const SAFE_PATTERNS = [
 // outright rather than parsed.
 const SUBSTITUTION = /\$\(|`|<\(|>\(/
 
-// Claude Code's separator set (code.claude.com/docs/en/permissions): every subcommand
-// must qualify on its own, otherwise an allowlisted first token buys the rest of the line.
-const SEPARATORS = /\|\||&&|\|&|[;|&\n]/
+/**
+ * Split on the shell separators Claude Code documents (`&&`, `||`, `;`, `|`, `|&`, `&`,
+ * newline) so every subcommand is checked on its own, ignoring separators inside quotes:
+ * `grep 'a|b'` is one read, not a pipe. Returns nothing on an unbalanced quote, which
+ * fails the caller closed rather than guessing at the intended split.
+ *
+ * A shell AST would be exact; this is the honest approximation for a quoting-only concern.
+ */
+/** Length of the separator at `i`, or 0 when there is none. */
+function separatorAt(command: string, i: number): number {
+  const pair = command.slice(i, i + 2)
+  if (pair === '&&' || pair === '||' || pair === '|&') return 2
+  const ch = command[i]
+  return ch === ';' || ch === '|' || ch === '&' || ch === '\n' ? 1 : 0
+}
+
+function splitSegments(command: string): string[] {
+  const segments: string[] = []
+  let current = ''
+  let quote: "'" | '"' | undefined
+
+  for (let i = 0; i < command.length; i++) {
+    const ch = command[i]
+    if (quote !== undefined) {
+      current += ch
+      if (ch === quote) quote = undefined
+      continue
+    }
+    if (ch === "'" || ch === '"') {
+      quote = ch
+      current += ch
+      continue
+    }
+    if (ch === '\\' && i + 1 < command.length) {
+      current += ch + command[++i]
+      continue
+    }
+    const separator = separatorAt(command, i)
+    if (separator > 0) {
+      segments.push(current)
+      current = ''
+      i += separator - 1
+      continue
+    }
+    current += ch
+  }
+
+  if (quote !== undefined) return []
+  segments.push(current)
+  return segments.map((segment) => segment.trim()).filter(Boolean)
+}
 
 // find is allowlisted for traversal only; these actions run commands or delete.
 const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
@@ -116,10 +164,7 @@ function isSafeSegment(segment: string): boolean {
  */
 export function isSafeCommand(command: string): boolean {
   if (SUBSTITUTION.test(command)) return false
-  const segments = command
-    .split(SEPARATORS)
-    .map((s) => s.trim())
-    .filter(Boolean)
+  const segments = splitSegments(command)
   return segments.length > 0 && segments.every(isSafeSegment)
 }
 

package/extensions/project-approval.ts

@@ -0,0 +1,73 @@
+/**
+ * Project Approval
+ *
+ * `ctx.isProjectTrusted()` is not sufficient on its own. pi decides whether to ask for
+ * trust in `hasTrustRequiringProjectResources`, which looks only under `cwd/.pi` and for
+ * `.agents/skills`. A repository shipping just `.claude/` and `.mcp.json` matches neither,
+ * so `resolveProjectTrusted` short-circuits to `true` before it ever emits `project_trust`:
+ *
+ *     if (!hasTrustRequiringProjectResources(cwd)) return true
+ *     if (extensionsResult) { ...emitProjectTrustEvent... }
+ *
+ * A `project_trust` handler therefore cannot cover this case; the event only fires for
+ * projects pi was already going to prompt about. The decision has to be made where the
+ * project config is consumed instead, which is what this module does.
+ *
+ * Answers are stored in pi's own trust store, so approving here also satisfies pi if the
+ * project later grows `.pi` resources, and a decision recorded on a parent directory applies.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
+
+/** Project files pi-code acts on that pi's own trust check does not look for. */
+const CLAUDE_SHAPED = [path.join('.claude', 'settings.json'), path.join('.claude', 'settings.local.json'), path.join('.claude', 'agents'), path.join('.claude', 'hooks'), path.join('.claude', 'output-styles'), '.mcp.json', path.join('.pi', 'mcp.json'), path.join('.pi', 'agents')]
+
+export function hasClaudeShapedConfig(cwd: string): boolean {
+  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
+}
+
+export interface ApprovalContext {
+  cwd: string
+  hasUI: boolean
+  isProjectTrusted?: () => boolean
+  ui: { confirm: (title: string, body: string) => Promise<boolean> }
+}
+
+export interface ApprovalDeps {
+  hasClaudeShaped: (cwd: string) => boolean
+  piWouldAsk: (cwd: string) => boolean
+  savedDecision: (cwd: string) => boolean | null
+  remember: (cwd: string, trusted: boolean) => void
+}
+
+const defaultDeps: ApprovalDeps = {
+  hasClaudeShaped: hasClaudeShapedConfig,
+  piWouldAsk: hasTrustRequiringProjectResources,
+  savedDecision: (cwd) => new ProjectTrustStore(getAgentDir()).get(cwd),
+  remember: (cwd, trusted) => new ProjectTrustStore(getAgentDir()).set(cwd, trusted),
+}
+
+const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MCP servers, hooks and agents can run commands from this repository.'
+
+/**
+ * Whether project-controlled config may be acted on.
+ *
+ * Refuses without a UI rather than deferring: pi reached this point without consulting
+ * `defaultProjectTrust` at all, so there is no user preference to fall back on. A run
+ * that cannot ask has not been approved.
+ */
+export async function isProjectApproved(ctx: ApprovalContext, deps: ApprovalDeps = defaultDeps): Promise<boolean> {
+  if (ctx.isProjectTrusted?.() !== true) return false // pi already declined, or never trusted
+  if (!deps.hasClaudeShaped(ctx.cwd)) return true // nothing here pi's own check would miss
+  if (deps.piWouldAsk(ctx.cwd)) return true // pi genuinely prompted for this project
+
+  const stored = deps.savedDecision(ctx.cwd)
+  if (stored !== null) return stored
+  if (!ctx.hasUI) return false
+
+  const approved = await ctx.ui.confirm('Trust this project?', `${ctx.cwd}\n\n${APPROVAL_BODY}`)
+  deps.remember(ctx.cwd, approved)
+  return approved
+}

package/extensions/subagent/agents.ts

@@ -99,12 +99,35 @@ function isDirectory(p: string): boolean {
   }
 }
 
+/** Project root at or above `from`. `.git` is a file in worktrees and submodules. */
+const ROOT_MARKERS = ['.git', 'package.json']
+
+function repoRoot(from: string): string | undefined {
+  let currentDir = from
+  while (true) {
+    if (ROOT_MARKERS.some((marker) => fs.existsSync(path.join(currentDir, marker)))) return currentDir
+    const parentDir = path.dirname(currentDir)
+    if (parentDir === currentDir) return undefined
+    currentDir = parentDir
+  }
+}
+
+/**
+ * Nearest `relative` directory at or above `cwd`, stopping at the repository root.
+ *
+ * Without the boundary the search runs to the filesystem root, so an agent planted in a
+ * world-writable ancestor such as /tmp is offered as a project agent for every session
+ * beneath it. With no project marker (.git, package.json) the extent is unknown, so only
+ * `cwd` is considered.
+ */
 function findNearestDir(cwd: string, relative: string): string | null {
+  const boundary = repoRoot(cwd) ?? cwd
   let currentDir = cwd
   while (true) {
     const candidate = path.join(currentDir, relative)
     if (isDirectory(candidate)) return candidate
 
+    if (currentDir === boundary) return null
     const parentDir = path.dirname(currentDir)
     if (parentDir === currentDir) return null
     currentDir = parentDir

package/extensions/subagent/index.ts

@@ -22,6 +22,7 @@ import { StringEnum } from '@earendil-works/pi-ai'
 import { type ExtensionAPI, type ExtensionContext, getMarkdownTheme, type Theme, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
 import { Container, Markdown, Spacer, Text } from '@earendil-works/pi-tui'
 import { type Static, Type } from 'typebox'
+import { isProjectApproved } from '../project-approval.js'
 import { type AgentConfig, type AgentScope, discoverAgents } from './agents.js'
 import { backgroundStatusText, startBackgroundRun } from './background.js'
 
@@ -484,13 +485,19 @@ async function checkProjectAgentGate(params: SubagentParamsStatic, agents: Agent
   for (const t of params.tasks ?? []) requestedAgentNames.add(t.agent)
   const requestedProjectAgents = [...requestedAgentNames].map((name) => agents.find((a) => a.name === name)).filter((a): a is AgentConfig => a?.source === 'project')
 
-  const gate = projectAgentGate(requestedProjectAgents.length, ctx.isProjectTrusted?.() ?? false, ctx.hasUI, params.confirmProjectAgents ?? true)
-  const names = requestedProjectAgents.map((a) => a.name).join(', ')
+  // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
+  const approved = await isProjectApproved(ctx)
+  const gate = projectAgentGate(requestedProjectAgents.length, approved, ctx.hasUI, params.confirmProjectAgents ?? true)
+  // Agent names come from repo-controlled frontmatter; a newline in one would otherwise
+  // let it write its own "Source:" line into the prompt body.
+  const names = requestedProjectAgents.map((a) => a.name.replace(/\s+/g, ' ').trim()).join(', ')
   if (gate === 'refuse') {
     return { content: [{ type: 'text', text: `Project-local agents (${names}) require a trusted project; refusing in non-interactive mode.` }], details: makeDetails(gateMode)([]) }
   }
   if (gate === 'confirm') {
-    const dir = projectAgentsDir ?? '(unknown)'
+    // Each agent knows where it was loaded from; projectAgentsDir only ever held .pi/agents.
+    const dirs = [...new Set(requestedProjectAgents.map((a) => path.dirname(a.filePath)))]
+    const dir = dirs.join(', ') || projectAgentsDir || '(unknown)'
     const ok = await ctx.ui.confirm('Run project-local agents?', `Agents: ${names}\nSource: ${dir}\n\nProject agents are repo-controlled. Only continue for trusted repositories.`)
     if (!ok) return { content: [{ type: 'text', text: 'Canceled: project-local agents not approved.' }], details: makeDetails(gateMode)([]) }
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"

package/extensions/project-trust.ts

@@ -1,65 +0,0 @@
-/**
- * Project Trust Extension
- *
- * pi decides whether to prompt for trust from `hasTrustRequiringProjectResources`,
- * which looks only at entries under `cwd/.pi` and at `.agents/skills`. A repository
- * that ships only Claude Code shaped config, `.claude/` plus `.mcp.json`, matches
- * none of them, so pi trusts it without asking.
- *
- * That is exactly the shape pi-code exists to load, and the other extensions gate
- * their project input on `ctx.isProjectTrusted()`. Without this handler that flag is
- * true for a freshly cloned repo nobody was asked about, and a project `.mcp.json`
- * server command, project hooks and project agents all run.
- *
- * Only user/global and CLI extensions receive `project_trust`, so this works when
- * pi-code is installed with `pi install npm:pi-code`. A project-local install
- * (`pi install -l`) is not loaded until trust is already resolved.
- *
- * Docs: node_modules/@earendil-works/pi-coding-agent/docs/extensions.md (project_trust)
- */
-
-import * as fs from 'node:fs'
-import * as path from 'node:path'
-import { type ExtensionAPI, getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
-
-/** Project files pi-code acts on that pi's own trust check does not look for. */
-const CLAUDE_SHAPED = [path.join('.claude', 'settings.json'), path.join('.claude', 'settings.local.json'), path.join('.claude', 'agents'), path.join('.claude', 'hooks'), path.join('.claude', 'output-styles'), '.mcp.json', path.join('.pi', 'mcp.json'), path.join('.pi', 'agents')]
-
-export function hasClaudeShapedConfig(cwd: string): boolean {
-  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
-}
-
-export type TrustDecision = { trusted: 'yes' | 'no' | 'undecided'; remember?: boolean }
-
-interface TrustDeps {
-  hasClaudeShaped: (cwd: string) => boolean
-  piWouldAsk: (cwd: string) => boolean
-  savedDecision: (cwd: string) => boolean | null
-}
-
-const defaultDeps: TrustDeps = {
-  hasClaudeShaped: hasClaudeShapedConfig,
-  piWouldAsk: hasTrustRequiringProjectResources,
-  savedDecision: (cwd) => new ProjectTrustStore(getAgentDir()).get(cwd),
-}
-
-/**
- * Whether to take over the trust decision for this project.
- *
- * Returns `undecided` wherever pi already resolves things correctly, so a remembered
- * decision is never overridden and a headless run keeps whatever `defaultProjectTrust`
- * says rather than being forced closed.
- */
-export async function decideTrust(cwd: string, hasUI: boolean, confirm: (title: string, body: string) => Promise<boolean>, deps: TrustDeps = defaultDeps): Promise<TrustDecision> {
-  if (!deps.hasClaudeShaped(cwd)) return { trusted: 'undecided' }
-  if (deps.piWouldAsk(cwd)) return { trusted: 'undecided' } // pi prompts on its own
-  if (deps.savedDecision(cwd) !== null) return { trusted: 'undecided' } // apply the stored answer
-  if (!hasUI) return { trusted: 'undecided' } // cannot ask; leave pi's default in charge
-
-  const approved = await confirm('Trust this project?', `${cwd}\n\nIt ships Claude Code configuration that pi-code loads: MCP servers, hooks and agents can run commands from this repository.`)
-  return { trusted: approved ? 'yes' : 'no', remember: true }
-}
-
-export default function projectTrustExtension(pi: ExtensionAPI) {
-  pi.on('project_trust', async (event, ctx) => decideTrust(event.cwd, ctx.hasUI, (title, body) => ctx.ui.confirm(title, body)))
-}