pi-code 0.3.1 → 0.4.0

package/README.md

@@ -38,10 +38,10 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Global + project rules | `~/.claude/rules`, `.claude/rules` (+ `paths:` frontmatter scoping) | `claude-rules.ts` |
 | Custom slash commands | `.claude/commands/*.md` → pi prompt templates | `commands.ts` |
 | Skills | `.claude/skills` → pi skill discovery (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
-| Hooks | `.claude/settings.json` hooks on pi lifecycle events | `hooks.ts` |
+| Hooks | `.claude/settings.json` hooks: PreToolUse, PostToolUse, SessionStart, UserPromptSubmit (blocks and injects context), Stop, PreCompact, SessionEnd | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`, `/output-style` switcher | `output-styles.ts` |
 | CLAUDE.md `@imports` | resolves `@path` imports pi's native loader skips; loads `CLAUDE.local.md` (approval-gated) | `context-imports.ts` |
-| MCP servers | user `~/.claude.json`, `~/.pi/agent/mcp.json` (loaded on session start); project `.mcp.json`, `.pi/mcp.json` (only once the project is approved); stdio, HTTP, SSE | `mcp.ts` |
+| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved); stdio/HTTP/SSE by `type`; `${VAR:-default}` expansion; `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT` | `mcp.ts` |
 | Project trust | prompts before loading project config (MCP servers, hooks, agents, rules, output styles) that pi would otherwise trust silently | `internal/project-approval.ts` |
 | Subagents / Task | `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; background runs | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
@@ -49,7 +49,7 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Checkpoints / rewind | shadow-repo snapshots; restore overwrites checkpointed files, keeps files created later | `git-checkpoint.ts` |
 | Persistent memory | per-project memories, index injected each session | `memory.ts` |
 | WebSearch / WebFetch | key-free DuckDuckGo search, SSRF-guarded fetch | `web.ts` |
-| AskUserQuestion | vendored example | `question.ts` |
+| AskUserQuestion | one question with `header`, single- or `multiSelect` options, plus free-text; no multi-question batching | `question.ts` |
 | Statusline | turn state + session cost | `status-line.ts` |
 | Notifications | vendored example | `notify.ts` |
 

package/extensions/git-checkpoint.ts

@@ -106,18 +106,29 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     const createdAt = new Date().toISOString()
     const add = await gitShadow(['add', '-A'])
     if (add.code !== 0) return undefined
-    const commit = await gitShadow(['commit', '-m', 'checkpoint'])
-    if (commit.code !== 0) {
-      // nothing changed since the last snapshot: reuse HEAD, or create the first empty commit
+    // Decide "nothing changed" from the index, not from the commit exit code: a commit can
+    // also fail on the user's global signing or hooks config, and reusing HEAD then would
+    // record a ref that predates the current tree, so /rewind restores the wrong state.
+    const status = await gitShadow(['status', '--porcelain'])
+    const nothingChanged = status.code === 0 && status.stdout.trim() === ''
+    if (nothingChanged) {
       const head = await gitShadow(['rev-parse', 'HEAD'])
       if (head.code === 0) return { ref: head.stdout.trim(), createdAt }
-      const empty = await gitShadow(['commit', '--allow-empty', '-m', 'checkpoint'])
+      const empty = await commitShadow(['--allow-empty'])
       if (empty.code !== 0) return undefined
+    } else {
+      const commit = await commitShadow([])
+      if (commit.code !== 0) return undefined // real failure: do not record a stale ref
     }
     const sha = await gitShadow(['rev-parse', 'HEAD'])
     return sha.code === 0 ? { ref: sha.stdout.trim(), createdAt } : undefined
   }
 
+  /** Commit in the shadow repo, isolated from the user's global signing and hook config. */
+  function commitShadow(extra: string[]): ReturnType<ExtensionAPI['exec']> {
+    return gitShadow(['-c', 'commit.gpgsign=false', '-c', 'core.hooksPath=/dev/null', 'commit', ...extra, '-m', 'checkpoint'])
+  }
+
   async function restoreCode(ctx: ExtensionCommandContext, checkpoint: Checkpoint): Promise<boolean> {
     if (!checkpoint.ref) {
       ctx.ui.notify('Checkpoint has no code snapshot; code left untouched', 'warning')

package/extensions/hooks.ts

@@ -3,9 +3,17 @@
  *
  * Runs Claude Code's `.claude/settings.json` hooks on pi's lifecycle events, so
  * a project's existing hooks work under pi:
- * - PreToolUse  -> pi `tool_call` (can block the tool)
- * - PostToolUse -> pi `tool_execution_end` (fire-and-forget)
- * - SessionStart-> pi `session_start` (fire-and-forget)
+ * - PreToolUse      -> pi `tool_call` (can block the tool)
+ * - PostToolUse     -> pi `tool_execution_end` (fire-and-forget)
+ * - SessionStart    -> pi `session_start` (fire-and-forget)
+ * - UserPromptSubmit-> pi `input` (can block the prompt via `handled`, or inject
+ *                      additional context by transforming the submitted text)
+ * - Stop            -> pi `agent_end` (fire-and-forget; cannot prevent stopping)
+ * - PreCompact      -> pi `session_before_compact` (fire-and-forget)
+ * - SessionEnd      -> pi `session_shutdown` (fire-and-forget)
+ *
+ * Claude's SubagentStop has no pi lifecycle seam (the subagent tool spawns child pi
+ * processes, and pi emits no subagent-completion event), so it is not bridged.
  *
  * Hook commands run via `sh -c` with the event JSON on stdin. A PreToolUse
  * hook blocks the tool by exiting 2 (stderr becomes the reason) or by printing
@@ -102,7 +110,7 @@ export function matchingCommands(matchers: HookMatcher[] | undefined, name: stri
   return result
 }
 
-function tryParseJson(text: string): { hookSpecificOutput?: { permissionDecision?: string; permissionDecisionReason?: string }; decision?: string; reason?: string } | undefined {
+function tryParseJson(text: string): { hookSpecificOutput?: { permissionDecision?: string; permissionDecisionReason?: string; additionalContext?: string }; decision?: string; reason?: string; continue?: boolean; stopReason?: string } | undefined {
   try {
     return JSON.parse(text)
   } catch {
@@ -115,8 +123,11 @@ export function interpretHookResult(code: number, stdout: string, stderr: string
   if (code === 2) return { block: true, reason: stderr.trim() || 'Blocked by hook' }
   const parsed = tryParseJson(stdout)
   const specific = parsed?.hookSpecificOutput
-  if (specific?.permissionDecision === 'deny') return { block: true, reason: specific.permissionDecisionReason ?? 'Blocked by hook' }
+  // pi's tool_call return is allow-or-block, so "ask" (confirm) maps to block-with-reason
+  // rather than a silent allow, which is the least-safe reading on a trust-gated path.
+  if (specific?.permissionDecision === 'deny' || specific?.permissionDecision === 'ask') return { block: true, reason: specific.permissionDecisionReason ?? 'Blocked by hook' }
   if (parsed?.decision === 'block') return { block: true, reason: parsed.reason ?? 'Blocked by hook' }
+  if (parsed?.continue === false) return { block: true, reason: parsed.stopReason ?? 'Blocked by hook' }
   return { block: false }
 }
 
@@ -214,6 +225,35 @@ async function runNotifyHooks(commands: HookCommand[], payload: unknown, runner:
   await Promise.all(commands.map((command) => runner(command.command, payload, timeoutMs(command))))
 }
 
+export interface PromptDecision {
+  block: boolean
+  reason?: string
+  context: string
+}
+
+/** Additional context a UserPromptSubmit hook contributes: an explicit
+ * hookSpecificOutput.additionalContext, or the raw stdout of a plain exit-0 hook. */
+function promptContext(stdout: string): string {
+  const parsed = tryParseJson(stdout)
+  if (parsed) return parsed.hookSpecificOutput?.additionalContext ?? ''
+  return stdout.trim()
+}
+
+/** Run UserPromptSubmit hooks: the first blocking verdict wins; otherwise their
+ * additional context is concatenated for injection ahead of the prompt. */
+export async function runUserPromptSubmit(config: HooksConfig, prompt: string, runner: HookRunner): Promise<PromptDecision> {
+  const contexts: string[] = []
+  for (const command of matchingCommands(config.UserPromptSubmit, 'UserPromptSubmit')) {
+    const result = await runner(command.command, { hook_event_name: 'UserPromptSubmit', prompt }, timeoutMs(command))
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}`, context: '' }
+    const decision = interpretHookResult(result.code, result.stdout, result.stderr)
+    if (decision.block) return { block: true, reason: decision.reason, context: '' }
+    const context = promptContext(result.stdout)
+    if (context) contexts.push(context)
+  }
+  return { block: false, context: contexts.join('\n') }
+}
+
 /** Bound on remembered tool inputs, in case a blocked or aborted call never ends. */
 const MAX_PENDING_INPUTS = 100
 
@@ -255,4 +295,34 @@ export default function hooksExtension(pi: ExtensionAPI) {
     if (event.isError) return
     await runNotifyHooks(matchingCommands(config.PostToolUse, event.toolName), { hook_event_name: 'PostToolUse', tool_name: event.toolName, tool_input: toolInput, tool_response: event.result }, runner)
   })
+
+  pi.on('input', async (event, ctx) => {
+    // Only genuine user input; extension-injected messages (plan-mode, subagent) are not
+    // prompts the user submitted.
+    if (event.source === 'extension') return { action: 'continue' }
+    const decision = await runUserPromptSubmit(config, event.text, runner)
+    if (decision.block) {
+      // pi's input result has no reason channel, so surface why before consuming it.
+      ctx.ui.notify(decision.reason ?? 'Prompt blocked by hook', 'error')
+      return { action: 'handled' }
+    }
+    // Claude injects a UserPromptSubmit hook's context ahead of the prompt; transform is
+    // pi's seam for rewriting the submitted text.
+    if (decision.context) return { action: 'transform', text: `${decision.context}\n\n${event.text}` }
+    return { action: 'continue' }
+  })
+
+  // Notify-style Claude events with a matching pi lifecycle seam. None can block: pi's
+  // agent_end, session_before_compact and session_shutdown are fire-and-forget here.
+  pi.on('agent_end', async () => {
+    await runNotifyHooks(matchingCommands(config.Stop, 'Stop'), { hook_event_name: 'Stop' }, runner)
+  })
+
+  pi.on('session_before_compact', async (event) => {
+    await runNotifyHooks(matchingCommands(config.PreCompact, event.reason), { hook_event_name: 'PreCompact', trigger: event.reason }, runner)
+  })
+
+  pi.on('session_shutdown', async (event) => {
+    await runNotifyHooks(matchingCommands(config.SessionEnd, event.reason), { hook_event_name: 'SessionEnd', reason: event.reason }, runner)
+  })
 }

package/extensions/internal/web-transport.ts

@@ -21,6 +21,9 @@ export interface TransportOptions {
   userAgent: string
 }
 
+/** Statuses the WHATWG Response constructor forbids a body on (per the fetch spec). */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304])
+
 /** One request, no redirect following (the caller re-validates and re-pins per hop). */
 export function httpFetch(url: URL, opts: TransportOptions): Promise<Response> {
   const request = url.protocol === 'https:' ? httpsRequest : httpRequest
@@ -36,13 +39,23 @@ export function httpFetch(url: URL, opts: TransportOptions): Promise<Response> {
         // validation use the real host even though the socket connects to the pinned IP.
       },
       (res) => {
-        const headers = new Headers()
-        for (const [key, value] of Object.entries(res.headers)) {
-          if (typeof value === 'string') headers.set(key, value)
-          else if (Array.isArray(value)) headers.set(key, value.join(', '))
+        try {
+          const headers = new Headers()
+          for (const [key, value] of Object.entries(res.headers)) {
+            if (typeof value === 'string') headers.set(key, value)
+            else if (Array.isArray(value)) headers.set(key, value.join(', '))
+          }
+          const status = res.statusCode ?? 0
+          // The Response constructor throws for a non-null body on a null-body status
+          // (204/205/304) and for status 0. That throw fires here, off the Promise
+          // executor, so without this guard it escapes as an uncaughtException and pi
+          // exits. Give those statuses a null body; reject anything else that throws.
+          const body = NULL_BODY_STATUSES.has(status) ? null : (Readable.toWeb(res) as ReadableStream<Uint8Array>)
+          resolve(new Response(body, { status, headers }))
+        } catch (err) {
+          res.resume() // drain so the socket can close
+          reject(err)
         }
-        const body = Readable.toWeb(res) as ReadableStream<Uint8Array>
-        resolve(new Response(body, { status: res.statusCode ?? 0, headers }))
       },
     )
     req.on('error', reject)

package/extensions/mcp.ts

@@ -7,14 +7,15 @@
  * failures skip with a notice; stdio and HTTP (streamable with SSE fallback)
  * transports; /mcp shows status.
  *
- * Reads Claude Code's MCP config too. User config (~/.claude.json,
- * ~/.pi/agent/mcp.json) is the user's own and loads on the first session. Project
- * config (.mcp.json, .pi/mcp.json) can run arbitrary commands on connect, so it
- * loads only once the project is approved (see project-approval). The two scopes
- * are loaded separately, not merged; user config connects first, so a project
- * server cannot take the name of a user server that connected.
- * Values support ${VAR} interpolation, and a stdio server receives only the SDK's
- * default environment plus its own `env` block, not the whole process environment.
+ * Reads Claude Code's MCP config too. User config (~/.claude.json top-level plus its
+ * per-project `projects[cwd].mcpServers` local scope, and ~/.pi/agent/mcp.json) is the
+ * user's own and loads on the first session. Project config (.mcp.json, .pi/mcp.json)
+ * can run arbitrary commands on connect, so it loads only once the project is approved
+ * (see project-approval). The two scopes are loaded separately, not merged; user config
+ * connects first, so a project server cannot take the name of a user server that connected.
+ * Values support ${VAR} / ${VAR:-default} interpolation, connect and per-call timeouts
+ * honor MCP_TIMEOUT / MCP_TOOL_TIMEOUT, and a stdio server receives only the SDK's default
+ * environment plus its own `env` block, not the whole process environment.
  */
 
 import * as fs from 'node:fs'
@@ -31,8 +32,20 @@ import { Type } from 'typebox'
 import { capForContext } from './internal/output-guard.js'
 import { isProjectApproved } from './internal/project-approval.js'
 
-const CONNECT_TIMEOUT_MS = 10_000
-const CALL_TIMEOUT_MS = 120_000
+const DEFAULT_CONNECT_TIMEOUT_MS = 10_000
+const DEFAULT_CALL_TIMEOUT_MS = 120_000
+
+/** A positive-integer env override, or the default when unset or unparseable. */
+function envTimeout(name: string, fallback: number): number {
+  const raw = process.env[name]
+  if (raw === undefined) return fallback
+  const value = Number.parseInt(raw, 10)
+  return Number.isInteger(value) && value > 0 ? value : fallback
+}
+
+// Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.
+const connectTimeoutMs = (): number => envTimeout('MCP_TIMEOUT', DEFAULT_CONNECT_TIMEOUT_MS)
+const callTimeoutMs = (): number => envTimeout('MCP_TOOL_TIMEOUT', DEFAULT_CALL_TIMEOUT_MS)
 // Tool names an MCP server must never take over. formatToolName always emits
 // `<server>_<tool>`, so only names containing an underscore are actually reachable:
 // pi's own built-ins (read, bash, edit, ...) cannot be produced and are not listed.
@@ -91,6 +104,23 @@ export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
   return servers
 }
 
+/**
+ * All user-owned servers for this session: the global user servers plus Claude's "local"
+ * scope, the per-project user servers under `projects[cwd].mcpServers` in ~/.claude.json.
+ * Both are the user's own config, so neither needs project trust; local wins on a name
+ * clash (Claude's precedence is local over user).
+ */
+export function loadUserScope(home: string, cwd: string): Record<string, ServerConfig> {
+  const servers = loadConfigFrom(userConfigPaths(home))
+  try {
+    const claudeJson = JSON.parse(fs.readFileSync(path.join(home, '.claude.json'), 'utf-8'))
+    Object.assign(servers, claudeJson.projects?.[cwd]?.mcpServers ?? {})
+  } catch {
+    // missing or invalid ~/.claude.json: the top-level user servers already loaded
+  }
+  return servers
+}
+
 export function formatToolName(server: string, tool: string): string {
   return `${server}_${tool}`.replaceAll('-', '_')
 }
@@ -113,20 +143,24 @@ interface McpContentBlock {
 export type ToolContent = { type: 'text'; text: string } | { type: 'image'; data: string; mimeType: string }
 
 export function mapContent(content: McpContentBlock[] | undefined, structured?: unknown): ToolContent[] {
+  // capForContext every text output, whatever its source: a server can blow the tool-output
+  // budget through a resource block, a JSON-stringified block, or the structured fallback,
+  // not only a text block.
+  const text = (value: string): ToolContent => ({ type: 'text', text: capForContext(value) })
   if (!content || content.length === 0) {
-    return [{ type: 'text', text: structured !== undefined ? JSON.stringify(structured, null, 2) : '(empty result)' }]
+    return [text(structured !== undefined ? JSON.stringify(structured, null, 2) : '(empty result)')]
   }
   return content.map((block) => {
     if (block.type === 'text') {
-      return { type: 'text', text: capForContext(block.text ?? '') }
+      return text(block.text ?? '')
     }
     if (block.type === 'image' && block.data) {
       return { type: 'image', data: block.data, mimeType: block.mimeType ?? 'image/png' }
     }
     if (block.type === 'resource' && block.resource) {
-      return { type: 'text', text: `[Resource: ${block.resource.uri ?? 'unknown'}]\n${block.resource.text ?? ''}` }
+      return text(`[Resource: ${block.resource.uri ?? 'unknown'}]\n${block.resource.text ?? ''}`)
     }
-    return { type: 'text', text: JSON.stringify(block) }
+    return text(JSON.stringify(block))
   })
 }
 
@@ -165,33 +199,53 @@ async function connect(name: string, config: ServerConfig): Promise<Client> {
       cwd: config.cwd?.replace(/^~(?=\/|$)/, os.homedir()),
       stderr: 'ignore',
     })
-    await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, `connect ${name}`)
+    await connectWithTimeout(client, transport, `connect ${name}`)
     return client
   }
   const headers: Record<string, string> = {}
   for (const [key, value] of Object.entries(config.headers ?? {})) headers[key] = interpolateEnv(value)
-  const token = config.bearerToken ?? (config.bearerTokenEnv ? process.env[config.bearerTokenEnv] : undefined)
+  const token = config.bearerToken ? interpolateEnv(config.bearerToken) : config.bearerTokenEnv ? process.env[config.bearerTokenEnv] : undefined
   if (token) headers.Authorization = `Bearer ${token}`
   const url = new URL(interpolateEnv(config.url))
   if (config.type === 'sse') {
     const transport = new SSEClientTransport(url, { requestInit: { headers } }) // NOSONAR: explicitly declared legacy transport
-    await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, `connect ${name} (sse)`)
+    await connectWithTimeout(client, transport, `connect ${name} (sse)`)
     return client
   }
   try {
     const transport = new StreamableHTTPClientTransport(url, { requestInit: { headers } })
-    await withTimeout(client.connect(transport), CONNECT_TIMEOUT_MS, `connect ${name}`)
+    await connectWithTimeout(client, transport, `connect ${name}`)
     return client
   } catch (error) {
     // An explicitly declared streamable transport must not silently degrade to SSE.
     if (config.type !== undefined || String(error).includes('Unauthorized')) throw error
     const fallback = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
     const transport = new SSEClientTransport(url, { requestInit: { headers } }) // NOSONAR: deliberate legacy fallback
-    await withTimeout(fallback.connect(transport), CONNECT_TIMEOUT_MS, `connect ${name} (sse)`)
+    await connectWithTimeout(fallback, transport, `connect ${name} (sse)`)
     return fallback
   }
 }
 
+/**
+ * Connect with a deadline, closing the client if the deadline (not a connect error) wins.
+ * Without this, a slow-but-successful server finishes connecting after the race is lost and
+ * lingers unreferenced: process/socket alive, never in `clients`, invisible to shutdown.
+ */
+async function connectWithTimeout(client: Client, transport: Parameters<Client['connect']>[0], label: string): Promise<void> {
+  const connecting = client.connect(transport)
+  try {
+    await withTimeout(connecting, connectTimeoutMs(), label)
+  } catch (error) {
+    // Only a timeout can orphan a still-opening transport; a connect rejection means the
+    // SDK already tore it down, so closing again would be redundant.
+    if (String(error).includes('timed out after')) {
+      connecting.catch(() => {}) // a late rejection must not surface as unhandled
+      void client.close().catch(() => {})
+    }
+    throw error
+  }
+}
+
 async function listAllTools(client: Client): Promise<Array<{ name: string; description?: string; inputSchema?: unknown }>> {
   const tools: Array<{ name: string; description?: string; inputSchema?: unknown }> = []
   let cursor: string | undefined
@@ -220,7 +274,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       try {
         const client = await connect(name, config)
         clients.set(name, client)
-        const tools = await withTimeout(listAllTools(client), CONNECT_TIMEOUT_MS, `list tools ${name}`)
+        const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
         let count = 0
         for (const tool of tools) {
           const toolName = formatToolName(name, tool.name)
@@ -236,7 +290,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
             description: tool.description ?? `MCP tool ${tool.name} from ${name}`,
             parameters: Type.Unsafe(normalizeSchema(tool.inputSchema)),
             async execute(_id, params) {
-              const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }), CALL_TIMEOUT_MS, toolName)
+              // Pass the timeout to the SDK too: its own default request timeout is 60s and
+              // would otherwise reject first, so the outer race at CALL_TIMEOUT_MS was dead.
+              const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: callTimeoutMs() }), callTimeoutMs(), toolName)
               const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
               const details: { error?: string } = {}
               if (result.isError) {
@@ -263,7 +319,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // the factory: pi runs the factory for invocations that never start a session.
     if (!userConnected) {
       userConnected = true
-      await connectServers(loadConfigFrom(userConfigPaths(os.homedir())))
+      await connectServers(loadUserScope(os.homedir(), ctx.cwd))
     }
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once the project is trusted.
     // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.

package/extensions/plan-mode/index.ts

@@ -114,6 +114,8 @@ export default function planModeExtension(pi: ExtensionAPI): void {
       restoreTools()
       ctx.ui.notify('Plan mode disabled. Full access restored.')
     }
+    // Persist the toggle so a resume does not restore a state the user left.
+    persistState()
     updateStatus(ctx)
   }
 
@@ -158,6 +160,9 @@ export default function planModeExtension(pi: ExtensionAPI): void {
       restoreTools()
       updateStatus(ctx)
 
+      // Persist before the turn: a crash before the first turn_end must resume into
+      // execution, not back into plan mode.
+      persistState()
       const execMessage = todoItems.length > 0 ? `Execute the plan. Start with: ${todoItems[0].text}` : 'Execute the plan you just created.'
       pi.sendMessage({ customType: 'plan-mode-execute', content: execMessage, display: true }, { triggerTurn: true })
     } else if (choice === 'Refine the plan') {
@@ -351,6 +356,13 @@ After completing a step, include a [DONE:n] tag in your response.`,
 
   // Restore state on session start/resume
   pi.on('session_start', async (_event, ctx) => {
+    // One extension instance serves every session, so clear prior state first: a fresh
+    // session (/new, no plan entry) must not inherit the last session's plan or execution.
+    planModeEnabled = false
+    executionMode = false
+    todoItems = []
+    planFromTool = false
+
     if (pi.getFlag('plan') === true) {
       planModeEnabled = true
     }
@@ -375,6 +387,10 @@ After completing a step, include a [DONE:n] tag in your response.`,
 
     if (planModeEnabled) {
       enterPlanTools()
+    } else {
+      // A prior session in this instance may have shrunk the tool set; undo that when
+      // the restored/fresh state is not plan mode.
+      restoreTools()
     }
     updateStatus(ctx)
   })

package/extensions/plan-mode/utils.ts

@@ -191,9 +191,11 @@ export function cleanStepText(text: string): string {
   return cleaned
 }
 
-// Horizontal whitespace before the newline: \s would include \n itself and overlap
-// the following \n, which is what backtracks super-linearly.
-const PLAN_HEADER = /\*{0,2}Plan:\*{0,2}[^\S\n]*\n/i
+// Anchored to line start (m flag) so a prose line merely ending in "plan:" is not taken
+// for the header, which would slice the plan section mid-list and drop earlier steps.
+// Horizontal whitespace only ([^\S\n]): \s would include \n itself and overlap the
+// following \n, which is what backtracks super-linearly.
+const PLAN_HEADER = /^[^\S\n]*\*{0,2}Plan:\*{0,2}[^\S\n]*\n/im
 
 const isBlank = (ch: string | undefined): boolean => ch !== undefined && ch !== '\n' && ch.trim() === ''
 

package/extensions/question.ts

@@ -1,7 +1,9 @@
 /**
- * Question Tool - Single question with options
- * Full custom UI: options list + inline editor for "Type something..."
- * Escape in editor returns to options, Escape in options cancels
+ * Question Tool - a question with options, single- or multi-select.
+ * Full custom UI: options list + inline editor for "Type something..." (single-select
+ * only), or space-toggled checkboxes when `multiSelect` is set. An optional `header`
+ * labels the question. Escape in the editor returns to options; Escape in options cancels.
+ * Multiple questions per call are not batched; ask sequentially.
  */
 
 import type { ExtensionAPI, Theme } from '@earendil-works/pi-coding-agent'
@@ -17,9 +19,11 @@ type DisplayOption = OptionWithDesc & { isOther?: boolean }
 
 interface QuestionDetails {
   question: string
+  header?: string
   options: string[]
   answer: string | null
   wasCustom?: boolean
+  multiSelect?: boolean
 }
 
 // Options with labels and optional descriptions
@@ -30,11 +34,18 @@ const OptionSchema = Type.Object({
 
 const QuestionParams = Type.Object({
   question: Type.String({ description: 'The question to ask the user' }),
+  header: Type.Optional(Type.String({ description: 'Short label for the question, shown above it' })),
   options: Type.Array(OptionSchema, { description: 'Options for the user to choose from' }),
+  multiSelect: Type.Optional(Type.Boolean({ description: 'Allow selecting several options (space toggles, enter confirms)' })),
 })
 
-function optionLine(opt: DisplayOption, index: number, selected: boolean, editMode: boolean, theme: Theme): string {
-  const label = `${index + 1}. ${opt.label}`
+function checkbox(checked: boolean | undefined): string {
+  if (checked === undefined) return ''
+  return checked ? '[x] ' : '[ ] '
+}
+
+function optionLine(opt: DisplayOption, index: number, selected: boolean, editMode: boolean, checked: boolean | undefined, theme: Theme): string {
+  const label = `${index + 1}. ${checkbox(checked)}${opt.label}`
   const prefix = selected ? theme.fg('accent', '> ') : '  '
   if (opt.isOther === true && editMode) {
     return prefix + theme.fg('accent', `${label} ✎`)
@@ -48,25 +59,30 @@ function optionLine(opt: DisplayOption, index: number, selected: boolean, editMo
 interface QuestionView {
   width: number
   question: string
+  header?: string
   options: DisplayOption[]
   optionIndex: number
   editMode: boolean
+  multiSelect: boolean
+  checked: boolean[]
   editor: Editor
   theme: Theme
 }
 
 function buildQuestionLines(view: QuestionView): string[] {
-  const { width, question, options, optionIndex, editMode, editor, theme } = view
+  const { width, question, header, options, optionIndex, editMode, multiSelect, checked, editor, theme } = view
   const lines: string[] = []
   const add = (s: string) => lines.push(truncateToWidth(s, width))
 
   add(theme.fg('accent', '─'.repeat(width)))
+  if (header) add(theme.fg('muted', ` [${header}]`))
   add(theme.fg('text', ` ${question}`))
   lines.push('')
 
   for (let i = 0; i < options.length; i++) {
     const opt = options[i]
-    add(optionLine(opt, i, i === optionIndex, editMode, theme))
+    const box = multiSelect && opt.isOther !== true ? checked[i] : undefined
+    add(optionLine(opt, i, i === optionIndex, editMode, box, theme))
     if (opt.description) {
       add(`     ${theme.fg('muted', opt.description)}`)
     }
@@ -81,12 +97,26 @@ function buildQuestionLines(view: QuestionView): string[] {
   }
 
   lines.push('')
-  add(theme.fg('dim', editMode ? ' Enter to submit • Esc to go back' : ' ↑↓ navigate • Enter to select • Esc to cancel'))
+  add(theme.fg('dim', navHint(editMode, multiSelect)))
   add(theme.fg('accent', '─'.repeat(width)))
 
   return lines
 }
 
+function navHint(editMode: boolean, multiSelect: boolean): string {
+  if (editMode) return ' Enter to submit • Esc to go back'
+  if (multiSelect) return ' ↑↓ navigate • Space to toggle • Enter to confirm • Esc to cancel'
+  return ' ↑↓ navigate • Enter to select • Esc to cancel'
+}
+
+/** The comma-joined labels of the checked options, in order. */
+function selectedLabels(options: DisplayOption[], checked: boolean[]): string {
+  return options
+    .filter((_, i) => checked[i])
+    .map((o) => o.label)
+    .join(', ')
+}
+
 export default function question(pi: ExtensionAPI) {
   pi.registerTool({
     name: 'question',
@@ -113,11 +143,14 @@ export default function question(pi: ExtensionAPI) {
         }
       }
 
-      const allOptions: DisplayOption[] = [...params.options, { label: 'Type something.', isOther: true }]
+      const multiSelect = params.multiSelect === true
+      // The free-text option does not compose with checkbox selection, so it is single-select only.
+      const allOptions: DisplayOption[] = multiSelect ? [...params.options] : [...params.options, { label: 'Type something.', isOther: true }]
 
       const result = await ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number } | null>((tui, theme, _kb, done) => {
         let optionIndex = 0
         let editMode = false
+        const checked: boolean[] = allOptions.map(() => false)
         let cachedLines: string[] | undefined
         let cachedWidth: number | undefined
 
@@ -173,7 +206,17 @@ export default function question(pi: ExtensionAPI) {
             return
           }
 
+          if (multiSelect && data === ' ') {
+            checked[optionIndex] = !checked[optionIndex]
+            refresh()
+            return
+          }
+
           if (matchesKey(data, Key.enter)) {
+            if (multiSelect) {
+              done({ answer: selectedLabels(allOptions, checked), wasCustom: false })
+              return
+            }
             const selected = allOptions[optionIndex]
             if (selected.isOther) {
               editMode = true
@@ -192,7 +235,7 @@ export default function question(pi: ExtensionAPI) {
         function render(width: number): string[] {
           if (cachedLines && cachedWidth === width) return cachedLines
           cachedWidth = width
-          cachedLines = buildQuestionLines({ width, question: params.question, options: allOptions, optionIndex, editMode, editor, theme })
+          cachedLines = buildQuestionLines({ width, question: params.question, header: params.header, options: allOptions, optionIndex, editMode, multiSelect, checked, editor, theme })
           return cachedLines
         }
 
@@ -206,45 +249,41 @@ export default function question(pi: ExtensionAPI) {
         }
       })
 
-      // Build simple options list for details
+      // Build simple options list for details; header/multiSelect appear only when set,
+      // so single-select details are unchanged.
       const simpleOptions = params.options.map((o) => o.label)
+      const base = { question: params.question, options: simpleOptions, ...(params.header ? { header: params.header } : {}), ...(multiSelect ? { multiSelect: true } : {}) }
 
       if (!result) {
         return {
           content: [{ type: 'text', text: 'User cancelled the selection' }],
-          details: { question: params.question, options: simpleOptions, answer: null } as QuestionDetails,
+          details: { ...base, answer: null } as QuestionDetails,
         }
       }
 
       if (result.wasCustom) {
         return {
           content: [{ type: 'text', text: `User wrote: ${result.answer}` }],
-          details: {
-            question: params.question,
-            options: simpleOptions,
-            answer: result.answer,
-            wasCustom: true,
-          } as QuestionDetails,
+          details: { ...base, answer: result.answer, wasCustom: true } as QuestionDetails,
         }
       }
+      const selectionText = multiSelect ? `User selected: ${result.answer || '(none)'}` : `User selected: ${result.index}. ${result.answer}`
       return {
-        content: [{ type: 'text', text: `User selected: ${result.index}. ${result.answer}` }],
-        details: {
-          question: params.question,
-          options: simpleOptions,
-          answer: result.answer,
-          wasCustom: false,
-        } as QuestionDetails,
+        content: [{ type: 'text', text: selectionText }],
+        details: { ...base, answer: result.answer, wasCustom: false } as QuestionDetails,
       }
     },
 
     renderCall(args, theme, _context) {
-      let text = theme.fg('toolTitle', theme.bold('question ')) + theme.fg('muted', args.question)
+      const multi = args.multiSelect === true
+      const heading = args.header ? `[${args.header}] ` : ''
+      let text = theme.fg('toolTitle', theme.bold('question ')) + theme.fg('muted', heading + String(args.question ?? ''))
       const opts = Array.isArray(args.options) ? args.options : []
       if (opts.length) {
         const labels = opts.map((o: OptionWithDesc) => o.label)
-        const numbered = [...labels, 'Type something.'].map((o, i) => `${i + 1}. ${o}`)
-        const optionsLine = `  Options: ${numbered.join(', ')}`
+        const shown = multi ? labels : [...labels, 'Type something.']
+        const numbered = shown.map((o, i) => `${i + 1}. ${o}`)
+        const optionsLine = `  Options${multi ? ' (multi)' : ''}: ${numbered.join(', ')}`
         text += `\n${theme.fg('dim', optionsLine)}`
       }
       return new Text(text, 0, 0)
@@ -264,6 +303,9 @@ export default function question(pi: ExtensionAPI) {
       if (details.wasCustom) {
         return new Text(theme.fg('success', '✓ ') + theme.fg('muted', '(wrote) ') + theme.fg('accent', details.answer), 0, 0)
       }
+      if (details.multiSelect) {
+        return new Text(theme.fg('success', '✓ ') + theme.fg('accent', details.answer || '(none)'), 0, 0)
+      }
       const idx = details.options.indexOf(details.answer) + 1
       const display = idx > 0 ? `${idx}. ${details.answer}` : details.answer
       return new Text(theme.fg('success', '✓ ') + theme.fg('accent', display), 0, 0)

package/extensions/status-line.ts

@@ -40,6 +40,8 @@ export default function statusLine(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (_event, ctx) => {
+    // One instance serves every session, so a fresh session must not inherit the count.
+    turnCount = 0
     showIdle(ctx, ctx.ui.theme.fg('dim', '○'))
   })
 

package/extensions/subagent/background.ts

@@ -47,9 +47,10 @@ export function parseFinalOutputFromJsonl(jsonl: string): { text: string; turns:
     }
     if (event.type !== 'message_end' || event.message?.role !== 'assistant') continue
     turns++
-    for (const part of event.message.content ?? []) {
-      if (part.type === 'text' && part.text) text = part.text
-    }
+    // The complete text of the last assistant message, matching getFinalOutput on the
+    // foreground path so a multi-part message reads the same in both.
+    const parts = (event.message.content ?? []).filter((p) => p.type === 'text' && p.text).map((p) => p.text as string)
+    if (parts.length > 0) text = parts.join('\n')
   }
   return { text, turns }
 }
@@ -83,6 +84,13 @@ export function startBackgroundRun(agent: string, task: string, invocation: Back
     env: { ...process.env, PI_CODE_SUBAGENT: '1' },
   })
   let stdout = ''
+  // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
+  let completed = false
+  const complete = (): void => {
+    if (completed) return
+    completed = true
+    onComplete(run)
+  }
   proc.stdout.on('data', (data) => {
     stdout += data.toString()
   })
@@ -92,12 +100,12 @@ export function startBackgroundRun(agent: string, task: string, invocation: Back
     run.exitCode = code ?? 0
     run.output = text
     run.turns = turns
-    onComplete(run)
+    complete()
   })
   proc.on('error', () => {
     run.state = 'failed'
     run.exitCode = 1
-    onComplete(run)
+    complete()
   })
   return id
 }

package/extensions/subagent/index.ts

@@ -160,9 +160,10 @@ export function getFinalOutput(messages: Message[]): string {
   for (let i = messages.length - 1; i >= 0; i--) {
     const msg = messages[i]
     if (msg.role === 'assistant') {
-      for (const part of msg.content) {
-        if (part.type === 'text') return part.text
-      }
+      // The complete text of the last assistant message: a message can carry more than one
+      // text part, and taking only the first diverged from the background parser.
+      const parts = msg.content.filter((part) => part.type === 'text').map((part) => part.text)
+      if (parts.length > 0) return parts.join('\n')
     }
   }
   return ''
@@ -486,6 +487,10 @@ async function checkProjectAgentGate(params: SubagentParamsStatic, agents: Agent
   for (const t of params.tasks ?? []) requestedAgentNames.add(t.agent)
   const requestedProjectAgents = [...requestedAgentNames].map((name) => agents.find((a) => a.name === name)).filter((a): a is AgentConfig => a?.source === 'project')
 
+  // No project agents means nothing repo-controlled to gate; skip the approval check so a
+  // user-scope run never prompts or persists a trust decision it does not need.
+  if (requestedProjectAgents.length === 0) return null
+
   // isProjectTrusted alone is true for a repo pi never asked about; see project-approval.
   const approved = await isProjectApproved(ctx)
   const gate = projectAgentGate(requestedProjectAgents.length, approved, ctx.hasUI, params.confirmProjectAgents ?? true)
@@ -634,7 +639,7 @@ async function runChainMode(chain: ChainStepParam[], mode: ModeContext): Promise
         details: makeDetails('chain')(results),
       }
     }
-    previousOutput = getFinalOutput(result.messages)
+    previousOutput = capForContext(getFinalOutput(result.messages))
   }
   return {
     content: [{ type: 'text', text: capForContext(getFinalOutput(results.at(-1)?.messages ?? [])) || '(no output)' }],
@@ -692,8 +697,11 @@ async function runParallelMode(tasks: TaskItemParam[], mode: ModeContext): Promi
       signal,
       // Per-task update callback
       onUpdate: (partial) => {
-        if (partial.details?.results[0]) {
-          allResults[index] = partial.details.results[0]
+        const live = partial.details?.results[0]
+        if (live) {
+          // Keep the running sentinel until the child closes: the streamed result carries
+          // exitCode 0 mid-run, which would otherwise count and render the task as done.
+          allResults[index] = { ...live, exitCode: -1 }
           emitParallelUpdate()
         }
       },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi-package"