pi-code 1.0.1 → 1.0.2

package/README.md

@@ -38,7 +38,7 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Feature | Reads / provides | Extension |
 |---|---|---|
 | Global + project rules | `~/.claude/rules`, `.claude/rules` (+ `paths:` frontmatter scoping) | `claude-rules.ts` |
-| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`), `$ARGUMENTS`/`$1`, `` !`cmd` `` bash output, `@file` inlining, `allowed-tools`/`model`/`argument-hint` frontmatter; project commands gated on approval | `commands.ts` |
+| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`), `$ARGUMENTS`/`$1`, `` !`cmd` `` bash output, `@file` inlining, `allowed-tools`/`argument-hint` frontmatter (`model` is parsed but not yet applied); project commands gated on approval | `commands.ts` |
 | Skills | `.claude/skills` → pi skill discovery, project skills gated on approval (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
 | Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd; Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`; Claude replace semantics with `keep-coding-instructions`; bundled Explanatory/Learning/Proactive; `/output-style [name]` | `output-styles.ts` |
@@ -57,7 +57,7 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 
 `CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
 
-`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), and `project-approval.ts` (the trust decision above). The extensions use them; only `internal/` keeps them out of pi's extension scan.
+`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), `project-approval.ts` (the trust decision above), `command-file.ts` (slash-command parsing and dynamic content), and the shared-bus contracts `mcp-alias.ts`, `plan-mode-state.ts` and `subagent-events.ts`. The extensions use them; only `internal/` keeps them out of pi's extension scan.
 
 Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 

package/extensions/commands.ts

@@ -6,8 +6,10 @@
  * is what makes the rest of Claude's command contract reachable: namespaced
  * subdirectories (`frontend/build.md` is `/frontend:build`), `$ARGUMENTS` and
  * positional substitution, `` !`cmd` `` bash output, `@file` inlining, and the
- * `allowed-tools` / `model` / `argument-hint` / `disable-model-invocation`
- * frontmatter.
+ * `allowed-tools` and `argument-hint` frontmatter. `model` and
+ * `disable-model-invocation` are parsed but not applied yet: pi has seams for both
+ * (`pi.setModel`, and commands are user-invoked anyway), so they are a gap rather
+ * than an impossibility.
  *
  * A project command body is repository-controlled text that can now run shell
  * commands and read files, so project commands load only once the project is
@@ -59,6 +61,14 @@ export function collectCommands(dirs: string[]): DiscoveredCommand[] {
 
 export default function commandsExtension(pi: ExtensionAPI) {
   const registered = new Set<string>()
+  /** Tool set to put back once the turn a restricted command drove has ended. */
+  let pendingRestore: string[] | undefined
+
+  pi.on('turn_end', async () => {
+    if (!pendingRestore) return
+    pi.setActiveTools(pendingRestore)
+    pendingRestore = undefined
+  })
 
   async function runCommand(parsed: ParsedCommand, args: string, ctx: ExtensionCommandContext): Promise<void> {
     const withArgs = substituteArgs(parsed.body, args)
@@ -71,17 +81,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
       return { stdout: result.stdout, stderr: result.stderr, code: result.code }
     })
 
-    // allowed-tools restricts the turn the command drives, then the previous set is
-    // restored: the restriction belongs to the command, not to the rest of the session.
-    const saved = parsed.allowedTools ? pi.getActiveTools() : undefined
-    if (parsed.allowedTools && saved) {
+    // allowed-tools restricts the turn the command drives, and the previous set is
+    // restored when that turn ends. Restoring inline does not work: sendUserMessage is
+    // fire-and-forget, so the restore would land before the agent ever read the tool
+    // list, leaving the command running with everything enabled.
+    if (parsed.allowedTools) {
+      const saved = pi.getActiveTools()
+      pendingRestore = saved
       pi.setActiveTools(parsed.allowedTools.filter((tool) => saved.includes(tool)))
     }
-    try {
-      pi.sendUserMessage(expanded)
-    } finally {
-      if (saved) pi.setActiveTools(saved)
-    }
+    pi.sendUserMessage(expanded)
   }
 
   pi.on('session_start', async (_event, ctx) => {

package/extensions/internal/command-file.ts

@@ -27,9 +27,23 @@ export interface DiscoveredCommand {
   filePath: string
 }
 
-/** Claude tool names are PascalCase; pi's are lowercase. */
-function normalizeToolName(name: string): string {
-  return name.trim().toLowerCase()
+/** Claude tool names are PascalCase and do not all exist in pi: `Glob` is pi's
+ * `find`. Lowercasing alone left `glob` in the list, and since pi has no tool by
+ * that name the grant was silently dropped when the list was intersected with the
+ * active tools. Shared with the subagent's own frontmatter parsing. */
+const CLAUDE_TOOL_MAP: Record<string, string> = {
+  read: 'read',
+  write: 'write',
+  edit: 'edit',
+  bash: 'bash',
+  grep: 'grep',
+  glob: 'find',
+  ls: 'ls',
+}
+
+export function normalizeToolName(name: string): string {
+  const lower = name.trim().toLowerCase()
+  return CLAUDE_TOOL_MAP[lower] ?? lower
 }
 
 function field(frontmatter: string, key: string): string {
@@ -128,12 +142,16 @@ const inRanges = (ranges: Array<[number, number]>, index: number): boolean => ra
 /** Read a `@path` reference, confined to the working directory. Returns undefined
  * when the path escapes it or cannot be read, so the reference stays literal. */
 function readReference(cwd: string, reference: string): string | undefined {
-  const resolved = path.resolve(cwd, reference)
-  const root = path.resolve(cwd)
-  if (resolved !== root && !resolved.startsWith(root + path.sep)) return undefined
   try {
-    if (!fs.statSync(resolved).isFile()) return undefined
-    return fs.readFileSync(resolved, 'utf-8')
+    // Both sides canonicalised: on macOS /var is itself a symlink, so comparing a
+    // resolved path against an unresolved root rejects every legitimate read.
+    const root = fs.realpathSync(cwd)
+    // Confinement is checked after symlinks resolve: a lexical check passes a link
+    // that points outside the project, and the read would follow it.
+    const real = fs.realpathSync(path.resolve(cwd, reference))
+    if (real !== root && !real.startsWith(root + path.sep)) return undefined
+    if (!fs.statSync(real).isFile()) return undefined
+    return fs.readFileSync(real, 'utf-8')
   } catch {
     return undefined
   }

package/extensions/internal/project-approval.ts

@@ -29,6 +29,8 @@ const CLAUDE_SHAPED = [
   path.join('.claude', 'hooks'),
   path.join('.claude', 'output-styles'),
   path.join('.claude', 'rules'),
+  path.join('.claude', 'skills'),
+  path.join('.claude', 'commands'),
   'CLAUDE.local.md',
   '.mcp.json',
   path.join('.pi', 'mcp.json'),

package/extensions/mcp.ts

@@ -32,7 +32,7 @@ import { ToolListChangedNotificationSchema } from '@modelcontextprotocol/sdk/typ
 import { Type } from 'typebox'
 import { MCP_TOOLS_CHANNEL, type McpToolAlias } from './internal/mcp-alias.js'
 import { capForContext } from './internal/output-guard.js'
-import { isProjectApproved } from './internal/project-approval.js'
+import { isProjectApproved, isProjectApprovedSilently } from './internal/project-approval.js'
 
 const DEFAULT_CONNECT_TIMEOUT_MS = 10_000
 const DEFAULT_CALL_TIMEOUT_MS = 120_000
@@ -103,13 +103,18 @@ export interface ProjectServerPolicy {
   consentAll: boolean
 }
 
-/** Claude's per-server approvals for project .mcp.json servers. Consent-granting keys
- * (enabledMcpjsonServers, enableAllProjectMcpServers) count only from files the repo
- * does not control (user settings and settings.local.json), so a checked-in
- * settings.json cannot approve its own servers. disabledMcpjsonServers counts from
- * every file and wins over consent. Lists union across files: for denies the union is
- * the restrictive reading, and consent is the union of the user's own two files. */
-export function projectServerPolicy(cwd: string, home: string): ProjectServerPolicy {
+/** Claude's per-server approvals for project .mcp.json servers.
+ *
+ * Consent-granting keys (enabledMcpjsonServers, enableAllProjectMcpServers) count
+ * from the user's own settings always, and from the project's settings.local.json
+ * only once the project itself is approved. That file is gitignored by convention,
+ * not by enforcement: a repository can commit one, and honoring it unconditionally
+ * let a hostile repo self-approve a server whose `command` runs on connect, even
+ * after the user declined the trust prompt.
+ *
+ * disabledMcpjsonServers counts from every file, including the repo's own, and wins
+ * over consent: a repo may always restrict itself further, never less. */
+export function projectServerPolicy(cwd: string, home: string, projectApproved: boolean): ProjectServerPolicy {
   const read = (file: string): Record<string, unknown> => {
     try {
       return JSON.parse(fs.readFileSync(file, 'utf-8'))
@@ -122,7 +127,7 @@ export function projectServerPolicy(cwd: string, home: string): ProjectServerPol
   const projectSettings = read(path.join(cwd, '.claude', 'settings.json'))
   const localSettings = read(path.join(cwd, '.claude', 'settings.local.json'))
   const disabled = new Set([...names(userSettings.disabledMcpjsonServers), ...names(projectSettings.disabledMcpjsonServers), ...names(localSettings.disabledMcpjsonServers)])
-  const consentSources = [userSettings, localSettings]
+  const consentSources = projectApproved ? [userSettings, localSettings] : [userSettings]
   const consented = new Set(consentSources.flatMap((settings) => names(settings.enabledMcpjsonServers)))
   const consentAll = consentSources.some((settings) => settings.enableAllProjectMcpServers === true)
   return { disabled, consented, consentAll }
@@ -431,7 +436,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   /** Connect the project scope under the per-server policy. Returns whether the scope
    * is settled, so a refused confirm can be retried on a later session start. */
   async function connectProjectScope(ctx: ExtensionContext): Promise<boolean> {
-    const policy = projectServerPolicy(ctx.cwd, os.homedir())
+    // The stored decision, read without prompting: consent recorded inside the
+    // project only counts once the project itself has been approved.
+    const policy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
     const { consented, gated } = splitByPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), policy)
     if (Object.keys(consented).length > 0) await connectServers(consented)
     if (Object.keys(gated).length === 0) return true

package/extensions/plan-mode/README.md

@@ -4,9 +4,9 @@ Read-only exploration mode for safe code analysis.
 
 ## Features
 
-- **Read-only tools**: Restricts available tools to read, bash, grep, find, ls, question
+- **Read-only tools**: Restricts available tools to read, bash, grep, find, ls, question, and `plan_mode_complete`
 - **Bash allowlist**: Only read-only bash commands are allowed
-- **Plan extraction**: Extracts numbered steps from `Plan:` sections
+- **Plan extraction**: Takes the plan from the `plan_mode_complete` tool call, falling back to numbered steps under a `Plan:` header when the model writes prose instead
 - **Progress tracking**: Widget shows completion status during execution
 - **[DONE:n] markers**: Explicit step completion tracking
 - **Session persistence**: State survives session resume
@@ -21,7 +21,7 @@ Read-only exploration mode for safe code analysis.
 
 1. Enable plan mode with `/plan` or `--plan` flag
 2. Ask the agent to analyze code and create a plan
-3. The agent should output a numbered plan under a `Plan:` header:
+3. The agent calls `plan_mode_complete` with the finished plan. If it writes prose instead, a numbered plan under a `Plan:` header is still picked up:
 
 ```
 Plan:

package/extensions/status-line.ts

@@ -83,6 +83,7 @@ export default function statusLine(pi: ExtensionAPI) {
   let sessionCtx: ExtensionContext | undefined
   let commandLine: string | undefined
   let permissionMode = 'default'
+  let projectApproved = false
   let refreshTimer: ReturnType<typeof setInterval> | undefined
   let debounceTimer: ReturnType<typeof setTimeout> | undefined
   let running = false
@@ -103,7 +104,9 @@ export default function statusLine(pi: ExtensionAPI) {
   /** The stdin payload per Claude's documented statusline contract. */
   function buildPayload(ctx: ExtensionContext): Record<string, unknown> {
     const usage = ctx.getContextUsage() ?? { tokens: null, contextWindow: 0, percent: null }
-    const styleName = readActiveStyleName(settingsFiles(ctx.cwd, os.homedir(), true))
+    // Same gate as the config read above: an unapproved project's style is not applied,
+    // so reporting it here would describe a style the session is not using.
+    const styleName = readActiveStyleName(settingsFiles(ctx.cwd, os.homedir(), projectApproved))
     const payload: Record<string, unknown> = {
       session_id: ctx.sessionManager.getSessionId(),
       cwd: ctx.cwd,
@@ -128,11 +131,17 @@ export default function statusLine(pi: ExtensionAPI) {
     }
     running = true
     try {
+      // Everything below can touch ctx after an await, and every ctx getter throws
+      // once the session is disposed. This promise is started from a timer with no
+      // awaiter, so an escaping rejection becomes an uncaughtException and exits pi.
       const result = await runHookCommand(config.command, buildPayload(ctx), COMMAND_TIMEOUT_MS)
       const first = result.stdout.split('\n')[0].trimEnd()
       const pad = ' '.repeat(config.padding)
       commandLine = first ? `${pad}${first}${pad}` : undefined
       show(ctx, segmentText(ctx, ctx.ui.theme.fg('dim', '○')))
+    } catch {
+      // A replaced or reloaded session invalidates ctx while the command is in
+      // flight; there is nothing left to update, and the next session starts fresh.
     } finally {
       running = false
       if (rerunQueued) {
@@ -168,6 +177,7 @@ export default function statusLine(pi: ExtensionAPI) {
     // approval at session start, and a second prompt stacks over the first and eats
     // the keys meant for it. An undecided project simply skips project settings.
     const trusted = isProjectApprovedSilently(ctx)
+    projectApproved = trusted
     config = readStatusLineConfig(hookFiles(ctx.cwd, os.homedir(), trusted))
     if (config?.refreshInterval) {
       refreshTimer = setInterval(() => scheduleRefresh(), config.refreshInterval * 1000)

package/extensions/subagent/README.md

@@ -41,7 +41,7 @@ This tool executes a separate `pi` subprocess with a delegated system prompt and
 
 To enable project-local agents (`.claude/agents`, `.pi/agents`), pass `agentScope: "both"` (or `"project"`). Only do this for repositories you trust.
 
-When running interactively, the tool prompts for confirmation before running project-local agents. Set `confirmProjectAgents: false` to disable.
+When running interactively, the tool prompts for confirmation before running project-local agents. `confirmProjectAgents: false` skips that prompt for a project you have already approved; an unapproved project is still asked about.
 
 ## Usage
 

package/extensions/subagent/agents.ts

@@ -5,7 +5,7 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { getAgentDir, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works/pi-coding-agent'
 
 // Claude Code tool names -> pi tool names; unmapped names pass through lowercased
 const CLAUDE_TOOL_MAP: Record<string, string> = {
@@ -110,21 +110,31 @@ export function withPreloadedSkills(prompt: string, skills: string[] | undefined
  * prompt sent to the model, so a traversal would be an arbitrary-file read. */
 const SKILL_NAME = /^[A-Za-z0-9_.-]+$/
 
+/** Read one candidate file, but only if it really sits under `root` once symlinks
+ * are resolved. Both sides are canonicalised: on macOS /var is itself a symlink, so
+ * comparing a resolved path against an unresolved root rejects every valid read. */
+function readConfined(candidate: string, root: string): string | undefined {
+  try {
+    const real = fs.realpathSync(candidate)
+    if (real !== root && !real.startsWith(root + path.sep)) return undefined
+    return stripFrontmatter(fs.readFileSync(real, 'utf-8'))
+  } catch {
+    return undefined
+  }
+}
+
 function readSkillBody(name: string, skillDirs: string[]): string | undefined {
   if (!SKILL_NAME.test(name) || name === '.' || name === '..') return undefined
   for (const dir of skillDirs) {
-    const root = path.resolve(dir)
+    let root: string
+    try {
+      root = fs.realpathSync(dir)
+    } catch {
+      continue // a skills directory that does not exist simply contributes nothing
+    }
     for (const candidate of [path.join(dir, name, 'SKILL.md'), path.join(dir, `${name}.md`)]) {
-      // Belt and braces against symlinks and platform path quirks: the file actually
-      // read must still sit under the skills directory it was resolved from.
-      if (!path.resolve(candidate).startsWith(root + path.sep)) continue
-      try {
-        const content = fs.readFileSync(candidate, 'utf-8')
-        const match = /^---\r?\n[\s\S]*?\r?\n---/.exec(content)
-        return match ? content.slice(match[0].length) : content
-      } catch {
-        // try the next shape
-      }
+      const body = readConfined(candidate, root)
+      if (body !== undefined) return body
     }
   }
   return undefined

package/extensions/subagent/background.ts

@@ -7,6 +7,9 @@
 
 import { spawn } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
+import * as fs from 'node:fs'
+import * as os from 'node:os'
+import * as path from 'node:path'
 
 export interface BackgroundRun {
   id: string
@@ -28,6 +31,10 @@ export interface BackgroundSpawn {
   command: string
   args: string[]
   cwd: string
+  /** The --append-system-prompt body, kept so a resume can rebuild the file the
+   * completing run deleted. Without it the resumed child is handed a path that no
+   * longer exists, and pi falls back to using that path as the prompt text. */
+  promptBody?: string
 }
 
 const runs = new Map<string, BackgroundRun>()
@@ -97,7 +104,7 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   const run = runs.get(id)
   if (!run) return 'unknown'
   if (run.state === 'running') return 'still-running'
-  const args = run.spawn.args.map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
+  const args = withRebuiltPrompt(run.spawn).map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
   run.output = undefined
@@ -106,6 +113,26 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   return 'resumed'
 }
 
+/** Re-point --append-system-prompt at a fresh file when the original is gone. */
+function withRebuiltPrompt(spawnSpec: BackgroundSpawn): string[] {
+  const flag = spawnSpec.args.indexOf('--append-system-prompt')
+  if (flag === -1 || !spawnSpec.promptBody) return spawnSpec.args
+  const current = spawnSpec.args[flag + 1]
+  if (current && fs.existsSync(current)) return spawnSpec.args
+  try {
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pi-subagent-'))
+    const file = path.join(dir, 'prompt.md')
+    fs.writeFileSync(file, spawnSpec.promptBody, { mode: 0o600 })
+    const rebuilt = [...spawnSpec.args]
+    rebuilt[flag + 1] = file
+    return rebuilt
+  } catch {
+    // Cannot rewrite it: drop the pair rather than hand pi a path it will treat as
+    // prompt text, which would replace the agent persona with a temp path.
+    return spawnSpec.args.filter((_arg, i) => i !== flag && i !== flag + 1)
+  }
+}
+
 export function startBackgroundRun(agent: string, task: string, invocation: BackgroundSpawn, onComplete: (run: BackgroundRun) => void): string | null {
   // Checked here, synchronously with registration: callers await temp-file writes
   // between any check of their own and this call, so a parallel tool-call batch

package/extensions/subagent/index.ts

@@ -626,10 +626,17 @@ async function runBackgroundMode(params: SubagentParamsStatic, agents: AgentConf
   }
   args.push(`Task: ${task}`)
   const invocation = getPiInvocation(args)
-  const id = startBackgroundRun(agent.name, task, { command: invocation.command, args: invocation.args, cwd: params.cwd ?? defaultCwd }, (run) => {
+  const id = startBackgroundRun(agent.name, task, { command: invocation.command, args: invocation.args, cwd: params.cwd ?? defaultCwd, promptBody: tmpPrompt ? promptWithSkills : undefined }, (run) => {
     removeTmpPrompt(tmpPrompt)
     pi.events.emit(SUBAGENT_CHANNEL, { phase: 'stop', agentType: run.agent, agentId: run.id })
-    pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
+    // The run outlives the session that started it, and every pi call throws once
+    // that session is disposed; an escaping error here would reach Node as an
+    // uncaughtException and take the process down with it.
+    try {
+      pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
+    } catch {
+      // the session that asked for this run is gone; nothing left to notify
+    }
   })
   if (id === null) {
     // Lost the cap race to a parallel batch: the atomic check inside startBackgroundRun refused.
@@ -749,6 +756,10 @@ async function runParallelMode(tasks: TaskItemParam[], mode: ModeContext): Promi
       cwd: t.cwd,
       signal,
       onPhase: mode.onPhase,
+      // Same context single and chain mode pass: without these, an agent's skills
+      // preload and its model tier alias silently do nothing in parallel mode only.
+      skillRoots: mode.skillRoots,
+      availableModels: mode.availableModels,
       // Per-task update callback
       onUpdate: (partial) => {
         const live = partial.details?.results[0]
@@ -1102,7 +1113,11 @@ function renderParallelResult(results: SingleResult[], expanded: boolean, theme:
 
 export default function subagentExtension(pi: ExtensionAPI) {
   const notifyBackgroundCompletion = (run: { id: string; agent: string; state: string; turns: number; output?: string }): void => {
-    pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
+    try {
+      pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
+    } catch {
+      // same as above: the session that started the run may already be gone
+    }
   }
 
   // Claude surfaces each agent's description so the model can pick one autonomously.

package/extensions/todo.ts

@@ -335,8 +335,11 @@ export default function todoExtension(pi: ExtensionAPI) {
       const msg = entry.message
       if (msg.role !== 'toolResult' || msg.toolName !== TOOL_NAME) continue
 
-      const details = msg.details as (Omit<TodoDetails, 'todos'> & { todos: LegacyTodo[] }) | undefined
-      if (details) {
+      const details = msg.details as (Omit<TodoDetails, 'todos'> & { todos?: LegacyTodo[] }) | undefined
+      // pi persists a failed tool call as `details: {}`, which is truthy: a rejected
+      // or blocked todo call would otherwise throw here and break replay for the rest
+      // of the session, losing the list on every resume, fork and compaction.
+      if (Array.isArray(details?.todos)) {
         replayTodos = details.todos.map(normalizeTodo)
         replayNextId = details.nextId
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",