pi-code 0.8.0 → 1.0.0

package/README.md

@@ -36,20 +36,20 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Feature | Reads / provides | Extension |
 |---|---|---|
 | Global + project rules | `~/.claude/rules`, `.claude/rules` (+ `paths:` frontmatter scoping) | `claude-rules.ts` |
-| Custom slash commands | `.claude/commands/*.md` → pi prompt templates | `commands.ts` |
-| Skills | `.claude/skills` → pi skill discovery (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
+| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`), `$ARGUMENTS`/`$1`, `` !`cmd` `` bash output, `@file` inlining, `allowed-tools`/`model`/`argument-hint` frontmatter; project commands gated on approval | `commands.ts` |
+| Skills | `.claude/skills` → pi skill discovery, project skills gated on approval (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
 | Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd; Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`; Claude replace semantics with `keep-coding-instructions`; bundled Explanatory/Learning/Proactive; `/output-style [name]` | `output-styles.ts` |
 | CLAUDE.md `@imports` | resolves `@path` imports pi's native loader skips; loads `CLAUDE.local.md` (approval-gated) | `context-imports.ts` |
-| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE by `type`; `${VAR:-default}` expansion; `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT` | `mcp.ts` |
+| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE by `type`; `${VAR:-default}` expansion; `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`; tools refresh on `list_changed` | `mcp.ts` |
 | Project trust | prompts before loading project config (MCP servers, hooks, agents, rules, output styles) that pi would otherwise trust silently | `internal/project-approval.ts` |
-| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; agent roster with descriptions in the system prompt; background runs | `subagent/` |
+| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; agent roster with descriptions in the system prompt; `skills` preload; background runs with cancel and resume | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
 | Checkpoints / rewind | shadow-repo snapshots; restore overwrites checkpointed files, keeps files created later | `git-checkpoint.ts` |
 | Persistent memory | per-project memories, index injected each session | `memory.ts` |
 | WebSearch / WebFetch | key-free DuckDuckGo search, SSRF-guarded fetch | `web.ts` |
-| AskUserQuestion | one question with `header`, single- or `multiSelect` options, plus free-text; no multi-question batching | `question.ts` |
+| AskUserQuestion | 1-4 questions per call (asked in sequence), each with `header`, single- or `multiSelect` options, plus free-text | `question.ts` |
 | Statusline | Claude `statusLine` command contract (stdin JSON, `padding`, `refreshInterval`); built-in turn state + session cost fallback | `status-line.ts` |
 | Notifications | vendored example | `notify.ts` |
 

package/extensions/commands.ts

@@ -1,15 +1,18 @@
 /**
  * Claude Commands Extension
  *
- * Bridges Claude Code's custom slash commands into pi. On resources_discover
- * it hands pi the existing `.claude/commands` directories (user then project)
- * as prompt-template paths, so `/name` invokes `.claude/commands/name.md` the
- * same way pi loads its own `.pi/prompts`. pi's `$ARGUMENTS` / `$1` / `${1:-x}`
- * substitution overlaps Claude Code's, so most command files work unchanged.
+ * Registers Claude Code's custom slash commands with pi directly, rather than
+ * handing `.claude/commands` to pi's prompt-template loader. Owning registration
+ * is what makes the rest of Claude's command contract reachable: namespaced
+ * subdirectories (`frontend/build.md` is `/frontend:build`), `$ARGUMENTS` and
+ * positional substitution, `` !`cmd` `` bash output, `@file` inlining, and the
+ * `allowed-tools` / `model` / `argument-hint` / `disable-model-invocation`
+ * frontmatter.
  *
- * Not bridged (pi's prompt engine ignores them): `!` bash execution, `@` file
- * refs, `allowed-tools`/`model` frontmatter, and namespaced subdirectories
- * (discovery is non-recursive).
+ * A project command body is repository-controlled text that can now run shell
+ * commands and read files, so project commands load only once the project is
+ * approved. That closes the "skills / commands are not trust-gated" limitation
+ * for commands; skills remain pi-loader territory.
  *
  * Docs: https://code.claude.com/docs/en/slash-commands.md
  */
@@ -17,7 +20,13 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, ExtensionCommandContext } from '@earendil-works/pi-coding-agent'
+
+import { type DiscoveredCommand, discoverCommandFiles, expandDynamicContent, type ParsedCommand, parseCommandFile, substituteArgs } from './internal/command-file.js'
+import { isProjectApproved } from './internal/project-approval.js'
+
+/** Wall-clock budget for one `` !`cmd` `` span; a hung command must not wedge a turn. */
+const BASH_TIMEOUT_MS = 30_000
 
 function isDirectory(target: string): boolean {
   try {
@@ -27,9 +36,11 @@ function isDirectory(target: string): boolean {
   }
 }
 
-/** Existing `.claude/commands` directories, user first then project. */
-export function commandDirs(cwd: string, home: string): string[] {
-  const candidates = [path.join(home, '.claude', 'commands'), path.join(cwd, '.claude', 'commands')]
+/** Existing `.claude/commands` directories, user first then project. The project
+ * directory is included only for approved projects. */
+export function commandDirs(cwd: string, home: string, trusted: boolean): string[] {
+  const candidates = [path.join(home, '.claude', 'commands')]
+  if (trusted) candidates.push(path.join(cwd, '.claude', 'commands'))
   const dirs: string[] = []
   for (const dir of candidates) {
     if (!dirs.includes(dir) && isDirectory(dir)) dirs.push(dir)
@@ -37,9 +48,68 @@ export function commandDirs(cwd: string, home: string): string[] {
   return dirs
 }
 
+/** All commands across the given directories, later directories winning by name. */
+export function collectCommands(dirs: string[]): DiscoveredCommand[] {
+  const byName = new Map<string, DiscoveredCommand>()
+  for (const dir of dirs) {
+    for (const found of discoverCommandFiles(dir)) byName.set(found.name, found)
+  }
+  return [...byName.values()]
+}
+
 export default function commandsExtension(pi: ExtensionAPI) {
-  pi.on('resources_discover', async (_event, ctx) => {
-    const promptPaths = commandDirs(ctx.cwd, os.homedir())
-    return promptPaths.length > 0 ? { promptPaths } : undefined
+  const registered = new Set<string>()
+
+  async function runCommand(parsed: ParsedCommand, args: string, ctx: ExtensionCommandContext): Promise<void> {
+    const withArgs = substituteArgs(parsed.body, args)
+    const expanded = await expandDynamicContent(withArgs, ctx.cwd, async (shell) => {
+      // Hooks get CLAUDE_PROJECT_DIR, and a command's bash span is the same kind of
+      // project-scoped script. pi.exec takes no env, so it is exported in the script.
+      const projectDir = ctx.cwd.replaceAll("'", String.raw`'\''`)
+      const script = `export CLAUDE_PROJECT_DIR='${projectDir}'; ${shell}`
+      const result = await pi.exec('/bin/sh', ['-c', script], { cwd: ctx.cwd, timeout: BASH_TIMEOUT_MS })
+      return { stdout: result.stdout, stderr: result.stderr, code: result.code }
+    })
+
+    // allowed-tools restricts the turn the command drives, then the previous set is
+    // restored: the restriction belongs to the command, not to the rest of the session.
+    const saved = parsed.allowedTools ? pi.getActiveTools() : undefined
+    if (parsed.allowedTools && saved) {
+      pi.setActiveTools(parsed.allowedTools.filter((tool) => saved.includes(tool)))
+    }
+    try {
+      pi.sendUserMessage(expanded)
+    } finally {
+      if (saved) pi.setActiveTools(saved)
+    }
+  }
+
+  pi.on('session_start', async (_event, ctx) => {
+    const trusted = await isProjectApproved(ctx)
+    for (const command of collectCommands(commandDirs(ctx.cwd, os.homedir(), trusted))) {
+      // pi has no unregister, so a command already registered this process keeps its
+      // original file binding; re-registering would only add a numbered duplicate.
+      if (registered.has(command.name)) continue
+      let parsed: ParsedCommand
+      try {
+        parsed = parseCommandFile(fs.readFileSync(command.filePath, 'utf-8'))
+      } catch {
+        continue // an unreadable command file must not take down session start
+      }
+      registered.add(command.name)
+      pi.registerCommand(command.name, {
+        description: parsed.argumentHint ? `${parsed.description} ${parsed.argumentHint}` : parsed.description,
+        handler: async (args, commandCtx) => {
+          // Re-read on invocation so an edited command file takes effect without a reload.
+          let current = parsed
+          try {
+            current = parseCommandFile(fs.readFileSync(command.filePath, 'utf-8'))
+          } catch {
+            // fall back to what was parsed at registration
+          }
+          await runCommand(current, args, commandCtx)
+        },
+      })
+    }
   })
 }

package/extensions/git-checkpoint.ts

@@ -34,6 +34,15 @@ interface Checkpoint {
  * for the life of the machine. */
 export const CHECKPOINT_RETENTION_DAYS = 30
 
+/** Claude keeps the 100 most recent checkpoints per session. Older ones drop off the
+ * rewind list; their commits stay in the shadow repo until the retention sweep. */
+export const MAX_CHECKPOINTS_PER_SESSION = 100
+
+/** The newest entries, up to the per-session cap, oldest first. */
+export function capCheckpoints<T>(all: T[]): T[] {
+  return all.length <= MAX_CHECKPOINTS_PER_SESSION ? all : all.slice(all.length - MAX_CHECKPOINTS_PER_SESSION)
+}
+
 /** Remove shadow repos untouched for longer than the retention window. The live
  * session's repo is always kept, whatever its age: a long session's directory mtime
  * can predate the window. Failures are ignored; this is housekeeping, not a gate. */
@@ -209,6 +218,10 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
 
     const checkpoint: Checkpoint = { entryId: target.entryId, ref: snap.ref, prompt: target.prompt, createdAt: snap.createdAt }
     checkpoints.set(checkpoint.entryId, checkpoint)
+    // Bound the rewind list the way Claude does, dropping the oldest first.
+    for (const stale of [...checkpoints.keys()].slice(0, Math.max(0, checkpoints.size - MAX_CHECKPOINTS_PER_SESSION))) {
+      checkpoints.delete(stale)
+    }
     pi.appendEntry(CUSTOM_TYPE, checkpoint)
   })
 

package/extensions/internal/command-file.ts

@@ -0,0 +1,170 @@
+/**
+ * Parsing and discovery for Claude Code slash-command files.
+ *
+ * pi's own prompt-template loader reads only `description` and `argument-hint`
+ * from one flat directory, so the rest of Claude's command contract (namespaced
+ * subdirectories, `allowed-tools`, `model`, `!` bash blocks, `@file` refs) lives
+ * here and is applied by commands.ts when it registers each command itself.
+ *
+ * Docs: https://code.claude.com/docs/en/slash-commands.md
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+
+export interface ParsedCommand {
+  description: string
+  argumentHint?: string
+  allowedTools?: string[]
+  model?: string
+  disableModelInvocation: boolean
+  body: string
+}
+
+export interface DiscoveredCommand {
+  /** Claude's namespaced name: a nested file is `dir:name`. */
+  name: string
+  filePath: string
+}
+
+/** Claude tool names are PascalCase; pi's are lowercase. */
+function normalizeToolName(name: string): string {
+  return name.trim().toLowerCase()
+}
+
+function field(frontmatter: string, key: string): string {
+  const match = new RegExp(String.raw`^\s*${key}\s*:\s*(.+)$`, 'm').exec(frontmatter)
+  return match ? match[1].trim().replace(/^["']|["']$/g, '') : ''
+}
+
+export function parseCommandFile(content: string): ParsedCommand {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content)
+  const frontmatter = match ? match[1] : ''
+  const body = (match ? content.slice(match[0].length) : content).trim()
+  const tools = field(frontmatter, 'allowed-tools')
+  const firstLine = body.split('\n').find((line) => line.trim().length > 0) ?? ''
+  return {
+    description: field(frontmatter, 'description') || firstLine.slice(0, 60),
+    argumentHint: field(frontmatter, 'argument-hint') || undefined,
+    allowedTools: tools ? tools.split(',').map(normalizeToolName).filter(Boolean) : undefined,
+    model: field(frontmatter, 'model') || undefined,
+    disableModelInvocation: field(frontmatter, 'disable-model-invocation') === 'true',
+    body,
+  }
+}
+
+/** Split a raw argument string, keeping quoted runs together. */
+export function splitArgs(args: string): string[] {
+  const out: string[] = []
+  const pattern = /"([^"]*)"|'([^']*)'|(\S+)/g
+  let match = pattern.exec(args)
+  while (match !== null) {
+    out.push(match[1] ?? match[2] ?? match[3])
+    match = pattern.exec(args)
+  }
+  return out
+}
+
+/** Claude's substitutions: `$ARGUMENTS`, `$@`, `$1`..`$n`, `${n:-default}`. An
+ * unfilled positional becomes empty rather than leaking its literal token. */
+export function substituteArgs(body: string, args: string): string {
+  const parts = splitArgs(args)
+  return body
+    .replaceAll(/\$\{(\d+):-([^}]*)\}/g, (_m, index: string, fallback: string) => parts[Number(index) - 1] ?? fallback)
+    .replaceAll(/\$\{ARGUMENTS:-([^}]*)\}/g, (_m, fallback: string) => (args.trim() ? args.trim() : fallback))
+    .replaceAll(/\$ARGUMENTS\b/g, args.trim())
+    .replaceAll('$@', args.trim())
+    .replaceAll(/\$(\d+)/g, (_m, index: string) => parts[Number(index) - 1] ?? '')
+}
+
+/** `a/b/c.md` becomes Claude's `a:b:c`. */
+export function commandNameFor(relativePath: string): string {
+  return relativePath.replace(/\.md$/, '').split(path.sep).join(':')
+}
+
+/** Every `*.md` under a commands directory, including nested ones. */
+export function discoverCommandFiles(root: string): DiscoveredCommand[] {
+  const found: DiscoveredCommand[] = []
+  const walk = (dir: string, prefix: string): void => {
+    let entries: fs.Dirent[]
+    try {
+      entries = fs.readdirSync(dir, { withFileTypes: true })
+    } catch {
+      return
+    }
+    for (const entry of entries) {
+      const full = path.join(dir, entry.name)
+      if (entry.isDirectory()) walk(full, path.join(prefix, entry.name))
+      else if (entry.name.endsWith('.md')) found.push({ name: commandNameFor(path.join(prefix, entry.name)), filePath: full })
+    }
+  }
+  walk(root, '')
+  return found
+}
+
+export type CommandExec = (command: string) => Promise<{ stdout: string; stderr: string; code: number }>
+
+/** Spans of a body that are inside a fenced code block, where Claude's dynamic
+ * syntax is literal text rather than an instruction. */
+function fencedRanges(body: string): Array<[number, number]> {
+  const ranges: Array<[number, number]> = []
+  const fence = /^(```|~~~)[^\n]*$/gm
+  let open: number | undefined
+  let match = fence.exec(body)
+  while (match !== null) {
+    if (open === undefined) open = match.index
+    else {
+      ranges.push([open, match.index + match[0].length])
+      open = undefined
+    }
+    match = fence.exec(body)
+  }
+  if (open !== undefined) ranges.push([open, body.length])
+  return ranges
+}
+
+const inRanges = (ranges: Array<[number, number]>, index: number): boolean => ranges.some(([start, end]) => index >= start && index < end)
+
+/** Read a `@path` reference, confined to the working directory. Returns undefined
+ * when the path escapes it or cannot be read, so the reference stays literal. */
+function readReference(cwd: string, reference: string): string | undefined {
+  const resolved = path.resolve(cwd, reference)
+  const root = path.resolve(cwd)
+  if (resolved !== root && !resolved.startsWith(root + path.sep)) return undefined
+  try {
+    if (!fs.statSync(resolved).isFile()) return undefined
+    return fs.readFileSync(resolved, 'utf-8')
+  } catch {
+    return undefined
+  }
+}
+
+/** Claude's dynamic command content: `` !`cmd` `` runs a shell command and pastes
+ * its output, `@path` inlines a file. Both are skipped inside fenced code blocks. */
+export async function expandDynamicContent(body: string, cwd: string, exec: CommandExec): Promise<string> {
+  const fenced = fencedRanges(body)
+
+  const commands: Array<{ span: string; command: string; index: number }> = []
+  const bashPattern = /!`([^`]+)`/g
+  let bashMatch = bashPattern.exec(body)
+  while (bashMatch !== null) {
+    if (!inRanges(fenced, bashMatch.index)) commands.push({ span: bashMatch[0], command: bashMatch[1], index: bashMatch.index })
+    bashMatch = bashPattern.exec(body)
+  }
+
+  let expanded = body
+  for (const entry of commands) {
+    const result = await exec(entry.command)
+    const output = result.code === 0 ? result.stdout.trimEnd() : `(command failed: ${entry.command})\n${result.stderr.trim() || result.stdout.trim()}`
+    expanded = expanded.replace(entry.span, output)
+  }
+
+  // Ranges are recomputed: command output can change offsets.
+  const fencedAfter = fencedRanges(expanded)
+  return expanded.replaceAll(/(^|\s)@(\S+)/g, (whole, lead: string, reference: string, offset: number) => {
+    if (inRanges(fencedAfter, offset)) return whole
+    const content = readReference(cwd, reference)
+    if (content === undefined) return whole
+    return `${lead}\n<file path="${reference}">\n${content.trimEnd()}\n</file>\n`
+  })
+}

package/extensions/mcp.ts

@@ -28,6 +28,7 @@ import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 import { SSEClientTransport } from '@modelcontextprotocol/sdk/client/sse.js' // NOSONAR
 import { getDefaultEnvironment, StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js'
 import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/streamableHttp.js'
+import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/types.js'
 import { Type } from 'typebox'
 import { MCP_TOOLS_CHANNEL, type McpToolAlias } from './internal/mcp-alias.js'
 import { capForContext } from './internal/output-guard.js'
@@ -317,8 +318,14 @@ async function connectWithTimeout(client: Client, transport: Parameters<Client['
   }
 }
 
-async function listAllTools(client: Client): Promise<Array<{ name: string; description?: string; inputSchema?: unknown }>> {
-  const tools: Array<{ name: string; description?: string; inputSchema?: unknown }> = []
+export interface McpToolInfo {
+  name: string
+  description?: string
+  inputSchema?: unknown
+}
+
+async function listAllTools(client: Client): Promise<McpToolInfo[]> {
+  const tools: McpToolInfo[] = []
   let cursor: string | undefined
   do {
     const page = await client.listTools({ cursor })
@@ -331,10 +338,73 @@ async function listAllTools(client: Client): Promise<Array<{ name: string; descr
 export default async function mcpExtension(pi: ExtensionAPI) {
   const clients = new Map<string, Client>()
   const status = new Map<string, { state: string; tools: number }>()
-  const registered = new Set<string>()
+  // pi tool name -> owning server, so a refresh can tell its own tools from a conflict.
+  const registered = new Map<string, string>()
   // Original server/tool names per registered pi name, for Claude-style hook matchers.
   const aliases: McpToolAlias[] = []
 
+  /** Register every not-yet-registered tool of a server; returns how many were added. */
+  function registerTools(name: string, config: ServerConfig, client: Client, tools: McpToolInfo[]): number {
+    let count = 0
+    for (const tool of tools) {
+      const toolName = formatToolName(name, tool.name)
+      const owner = registered.get(toolName)
+      if (owner === name) continue // already registered for this server: a refresh re-listing it
+      if (RESERVED_NAMES.has(toolName) || owner !== undefined) {
+        console.warn(`pi-code-mcp: skipping colliding tool name ${toolName}`)
+        continue
+      }
+      registered.set(toolName, name)
+      aliases.push({ pi: toolName, claude: `mcp__${name}__${tool.name}` })
+      count++
+      pi.registerTool({
+        name: toolName,
+        label: `${name}: ${tool.name}`,
+        description: tool.description ?? `MCP tool ${tool.name} from ${name}`,
+        parameters: Type.Unsafe(normalizeSchema(tool.inputSchema)),
+        async execute(_id, params) {
+          // Pass the timeout to the SDK too: its own default request timeout is 60s and
+          // would otherwise reject first, so the outer race at CALL_TIMEOUT_MS was dead.
+          // Claude's per-server timeout wins over MCP_TOOL_TIMEOUT, with a 1s floor.
+          const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
+          const budget = declared ?? callTimeoutMs()
+          const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
+          const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
+          const details: { error?: string } = {}
+          if (result.isError) {
+            details.error = 'tool_error'
+            const hint = JSON.stringify(normalizeSchema(tool.inputSchema))
+            content.push({ type: 'text', text: `Tool reported an error. Expected input schema: ${hint}` })
+          }
+          return { content, details }
+        },
+      })
+    }
+    return count
+  }
+
+  /** Claude refreshes tools on a server's list_changed notification. pi has no
+   * unregister, so a withdrawn tool keeps its registration and surfaces the server's
+   * own error when called; a newly announced one is registered without a restart. */
+  function subscribeToToolChanges(name: string, config: ServerConfig, client: Client): void {
+    try {
+      client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
+        try {
+          const refreshed = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
+          const added = registerTools(name, config, client, refreshed)
+          if (added === 0) return
+          const current = status.get(name)
+          status.set(name, { state: current?.state ?? 'connected', tools: (current?.tools ?? 0) + added })
+          pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])
+        } catch (error) {
+          console.warn(`pi-code-mcp: tool refresh failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
+        }
+      })
+    } catch {
+      // a transport or client without notification support simply never refreshes
+    }
+  }
+
   async function connectServers(servers: Record<string, ServerConfig>): Promise<void> {
     for (const [name, config] of Object.entries(servers)) {
       // A later scope must not take the name of a server that already connected: it
@@ -349,39 +419,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         const client = await connect(name, config)
         clients.set(name, client)
         const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-        let count = 0
-        for (const tool of tools) {
-          const toolName = formatToolName(name, tool.name)
-          if (RESERVED_NAMES.has(toolName) || registered.has(toolName)) {
-            console.warn(`pi-code-mcp: skipping colliding tool name ${toolName}`)
-            continue
-          }
-          registered.add(toolName)
-          aliases.push({ pi: toolName, claude: `mcp__${name}__${tool.name}` })
-          count++
-          pi.registerTool({
-            name: toolName,
-            label: `${name}: ${tool.name}`,
-            description: tool.description ?? `MCP tool ${tool.name} from ${name}`,
-            parameters: Type.Unsafe(normalizeSchema(tool.inputSchema)),
-            async execute(_id, params) {
-              // Pass the timeout to the SDK too: its own default request timeout is 60s and
-              // would otherwise reject first, so the outer race at CALL_TIMEOUT_MS was dead.
-              // Claude's per-server timeout wins over MCP_TOOL_TIMEOUT, with a 1s floor.
-              const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
-              const budget = declared ?? callTimeoutMs()
-              const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
-              const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
-              const details: { error?: string } = {}
-              if (result.isError) {
-                details.error = 'tool_error'
-                const hint = JSON.stringify(normalizeSchema(tool.inputSchema))
-                content.push({ type: 'text', text: `Tool reported an error. Expected input schema: ${hint}` })
-              }
-              return { content, details }
-            },
-          })
-        }
+        const count = registerTools(name, config, client, tools)
+        subscribeToToolChanges(name, config, client)
         status.set(name, { state: 'connected', tools: count })
       } catch (error) {
         status.set(name, { state: `failed: ${error instanceof Error ? error.message : String(error)}`, tools: 0 })

package/extensions/memory.ts

@@ -63,6 +63,40 @@ export function migrateLegacyStore(cwd: string): void {
   }
 }
 
+/** Whether adding this memory would push the index past what a session can load.
+ * Claude reports an explicit error instead of silently writing a memory that will
+ * never be seen; replacing an existing entry is not growth. */
+export function indexWouldOverflow(index: string, name: string, description: string): boolean {
+  // Editing an entry that already exists is always allowed: it adds no entry, and
+  // refusing it would strand a user whose index is already at the bound with no way
+  // to revise their way back under it. An over-long description is bounded anyway,
+  // since the injected index is capped at read time.
+  const isUpdate = index.split('\n').some((entry) => entry.startsWith(entryPrefix(name)))
+  if (isUpdate) return false
+  const next = upsertIndexLine(index, name, description)
+  return next.split('\n').length > INDEX_MAX_LINES || Buffer.byteLength(next, 'utf-8') > INDEX_MAX_BYTES
+}
+
+/** Write a memory and its index line, or say why it cannot be written. */
+export function saveMemory(dir: string, indexPath: string, name: string | undefined, description: string | undefined, content: string | undefined): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+  if (!name || !description || !content) {
+    return { content: [{ type: 'text', text: 'save requires name, description, and content.' }], details: {} }
+  }
+  const index = readIndex(dir)
+  // Claude reports an explicit error rather than writing a memory the next session
+  // would never load, and says what to do about it.
+  if (indexWouldOverflow(index, name, description)) {
+    return {
+      content: [{ type: 'text', text: `Memory index is full (${INDEX_MAX_LINES} entries or ${INDEX_MAX_BYTES} bytes). Delete or consolidate memories before saving ${name}.` }],
+      details: {},
+    }
+  }
+  fs.mkdirSync(dir, { recursive: true })
+  fs.writeFileSync(path.join(dir, `${name}.md`), content)
+  fs.writeFileSync(indexPath, upsertIndexLine(index, name, description))
+  return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
+}
+
 /** The index as injected into the prompt, bounded like Claude's startup load. */
 export function capIndexForPrompt(index: string): string {
   const withinLines = index.split('\n').slice(0, INDEX_MAX_LINES)
@@ -151,13 +185,7 @@ export default function memoryExtension(pi: ExtensionAPI) {
       const indexPath = path.join(dir, INDEX_FILE)
 
       if (params.action === 'save') {
-        if (!name || !params.description || !params.content) {
-          return { content: [{ type: 'text' as const, text: 'save requires name, description, and content.' }], details: {} }
-        }
-        fs.mkdirSync(dir, { recursive: true })
-        fs.writeFileSync(path.join(dir, `${name}.md`), params.content)
-        fs.writeFileSync(indexPath, upsertIndexLine(readIndex(dir), name, params.description))
-        return { content: [{ type: 'text' as const, text: `Saved memory ${name}.` }], details: {} }
+        return saveMemory(dir, indexPath, name, params.description, params.content)
       }
 
       if (params.action === 'read') {