pi-code 1.0.10 → 1.0.12

package/README.md

@@ -38,30 +38,36 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Feature | Reads / provides | Extension |
 |---|---|---|
 | Global + project rules | `~/.claude/rules`, `.claude/rules` (nearest at or above cwd); unscoped rules inlined in full, `paths:`-scoped rules surfaced as pointers and auto-attached (the rule body is appended to a read/edit/write result when a matching file is touched, once per rule per session) | `claude-rules.ts` |
-| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`); `$ARGUMENTS` (with the `ARGUMENTS:` append when unused), 0-based `$ARGUMENTS[N]`/`$N`, named `arguments:` frontmatter, `${CLAUDE_SESSION_ID}`/`${CLAUDE_EFFORT}`/`${CLAUDE_SKILL_DIR}`/`${CLAUDE_PROJECT_DIR}` (in bodies and `allowed-tools` rules); `` !`cmd` `` and multi-line ```` ```! ```` bash (whitespace-bounded, merged stderr, 2-minute budget, a failure aborts the invocation with the documented exit-1 carveout), `@file` inlining; `allowed-tools` with `Bash(...)` and `Read`/`Edit`/`Write` path scopes enforced at call time (gitignore anchors, Edit governs writes), `disallowed-tools`, `argument-hint`, `model` (switches the session model for the command's turn, restored after), `shell: powershell` (runs the command's injected spans through PowerShell when a pwsh binary is present, else falls back to /bin/sh); `disable-model-invocation` is parsed but not applied; project commands gated on approval | `commands.ts` |
+| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`); `$ARGUMENTS` (with the `ARGUMENTS:` append when unused), 0-based `$ARGUMENTS[N]`/`$N`, named `arguments:` frontmatter, `${CLAUDE_SESSION_ID}`/`${CLAUDE_EFFORT}`/`${CLAUDE_SKILL_DIR}`/`${CLAUDE_PROJECT_DIR}` (in bodies and `allowed-tools` rules); `` !`cmd` `` and multi-line ```` ```! ```` bash (whitespace-bounded, merged stderr, 2-minute budget, a failure aborts the invocation with the documented exit-1 carveout), `@file` inlining; `allowed-tools` with `Bash(...)` and `Read`/`Edit`/`Write` path scopes enforced at call time (gitignore anchors, Edit governs writes), `disallowed-tools`, `argument-hint`, `model` (switches the session model for the command's turn, restored after), `effort` (raises reasoning for the turn, restored after), `shell: powershell` (injected spans run through PowerShell when a `pwsh` binary is present, else `/bin/sh`); the model can also run a command itself through the `SlashCommand` tool (Claude's `SlashCommand` in `allowed-tools`), steered by `when_to_use` and opted out per file with `disable-model-invocation` (`user-invocable: false` hides a command from the menu while still exposing it to the model); `disableSkillShellExecution` (managed and user always, project when trusted) replaces every `!` span with a policy-disabled placeholder; project commands gated on approval | `commands.ts` |
 | `/init` | generates a project context file: detects an existing `AGENTS.md`/`CLAUDE.md` (proposes improvements) or none (creates `AGENTS.md`, pi's preferred name), ingesting `.cursor/rules`, `.cursorrules`, and `.github/copilot-instructions.md` when present; drives the main agent with full tools via a prompt (not a tool-less completion) so it analyzes the codebase and writes the file itself | `init.ts` |
 | Skills | `.claude/skills` → pi skill discovery, project skills gated on approval (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
-| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s, non-blocking) since pi has no permission backstop | `hooks.ts` |
+| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s, non-blocking) since pi has no permission backstop; a `command` hook may use exec form (`command` as an argv array, run with no shell) and executes with `CLAUDECODE=1` and `CLAUDE_PROJECT_DIR` set; a user-typed `!`/`!!` bash line runs PreToolUse (there is no PostToolUse for it); `type: http` targets are gated by `allowedHttpHookUrls` (union of managed and settings scopes; unset allows all, `[]` blocks every http hook); a Stop hook may block at most 8 times before the turn ends (`CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`); `disableAllHooks` in any scope turns the system off; `/hooks` prints the resolved configuration | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`; plus styles shipped by enabled plugins (manifest `outputStyles`, default `output-styles/`, ranked below the user's and project's own); Claude replace semantics with `keep-coding-instructions`; bundled Explanatory/Learning/Proactive; `/output-style [name]` | `output-styles.ts` |
-| CLAUDE.md `@imports` and rewriting | resolves `@path` imports pi's native loader skips (4-hop depth, budget-capped); loads every `CLAUDE.local.md` from the repo root down to cwd (approval-gated, root first); injects managed `claudeMd` from `managed-settings.json` at the top of context; honors `claudeMdExcludes` (glob/absolute-path skip list from user, approved-project, and managed settings, merged; managed content never excluded); strips block-level HTML comments from CLAUDE.md, rule, and imported bodies (fenced-code comments preserved), so a commented-out `@import` does not expand; with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` set, loads `CLAUDE.md`/`.claude/CLAUDE.md`/`.claude/rules/*.md`/`CLAUDE.local.md` from each `--add-dir` directory (comma-separated for several, since pi's flag is single-value) | `context-imports.ts` |
-| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE/WebSocket by `type` (WebSocket is url-only: any `headers`/`bearerToken`/`headersHelper` on a ws server is ignored with a warning); `${VAR:-default}` expansion; a `headersHelper` command whose stdout JSON merges into the transport headers (http/sse); managed `allowedMcpServers`/`deniedMcpServers` read from `managed-settings.json` only (`{serverName}` entries, applied globally across scopes, allow list exclusive with an empty array = lockdown, deny wins); `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`; tools refresh on `list_changed`; bearer tokens, or OAuth for remote servers (browser login on 401 after a confirm, tokens under `~/.pi/agent/mcp-oauth`, silent refresh later) | `mcp.ts` |
+| CLAUDE.md `@imports` and rewriting | resolves `@path` imports pi's native loader skips (4-hop depth, budget-capped); loads the user `~/.claude/CLAUDE.md` and the project `.claude/CLAUDE.md` (approval-gated, deduped against the repo-root `CLAUDE.md`/`AGENTS.md` pi loads natively) that pi's own loader does not; loads every `CLAUDE.local.md` from the repo root down to cwd (approval-gated, root first); injects the managed `CLAUDE.md` (a per-OS file beside `managed-settings.json`) and the `claudeMd` string from `managed-settings.json` at the top of context (managed content is never excludable); honors `claudeMdExcludes` (glob/absolute-path skip list from user, approved-project, and managed settings, merged; managed content never excluded); strips block-level HTML comments from CLAUDE.md, rule, and imported bodies (fenced-code comments preserved), so a commented-out `@import` does not expand; with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` set, loads `CLAUDE.md`/`.claude/CLAUDE.md`/`.claude/rules/*.md`/`CLAUDE.local.md` from each `--add-dir` directory (comma-separated for several, since pi's flag is single-value) | `context-imports.ts` |
+| Settings `env` | `env` blocks from `managed-settings.json`, `~/.claude/settings.json`, and the project `.claude/settings.json`/`settings.local.json` exported into the session (per-key `managed > user > project`); the project scope is approval-gated (a repo's env can redirect providers), a shell `export` outranks user and project but a managed key overrides even that, and a key an approved project set is unset once a later session no longer defines it | `env-settings.ts` |
+| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE/WebSocket by `type` (WebSocket is url-only: any `headers`/`bearerToken`/`headersHelper` on a ws server is ignored with a warning); `${VAR:-default}` expansion; a `headersHelper` command whose stdout JSON merges into the transport headers (http/sse); a `managed-mcp.json` beside `managed-settings.json` takes exclusive control (only its servers load, every other scope and the approval flow suppressed; an empty file disables MCP); managed `allowedMcpServers`/`deniedMcpServers` read from `managed-settings.json` only (`{serverName}` entries, applied globally across scopes, allow list exclusive with an empty array = lockdown, deny wins); connect and per-call budgets (`MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`) over a 4-hour wall default, plus a 5-minute idle timeout that a progress notification resets (`CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT`, `0` disables); a connected server's prompts register as `/mcp__server__prompt` commands and its resources are reachable through the `list_mcp_resources`/`read_mcp_resource` tools; tools refresh on `list_changed`; bearer tokens, or OAuth for remote servers (browser login on 401 after a confirm, CSRF-guarded loopback callback, tokens under `~/.pi/agent/mcp-oauth`, silent refresh later) | `mcp.ts` |
 | Project trust | prompts before loading project config (MCP servers, hooks, agents, rules, output styles, commands, skills) that pi would otherwise trust silently | `internal/project-approval.ts` |
-| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents` (scanned recursively into subfolders) merged by default once the project is trusted (project wins on a name clash); frontmatter `tools`/`disallowedTools`/`model` (sonnet/opus/haiku/fable tier aliases or a concrete id)/`effort`/`skills` preload/`permissionMode: plan`/`maxTurns`/`memory` (`user`/`project`/`local` give the child its own persistent store under `.claude/agent-memory[-local]`, injected with Read/Write/Edit enabled, gated on auto memory; the parent conversation's memory is never loaded into a subagent, matching Claude); parallel and chain modes (pi extensions), one nesting level; background runs with cancel and resume | `subagent/` |
+| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents` (scanned recursively into subfolders) merged by default once the project is trusted (project wins on a name clash); frontmatter `tools`/`disallowedTools`/`model` (sonnet/opus/haiku/fable tier aliases or a concrete id)/`effort`/`skills` preload/`permissionMode: plan`/`maxTurns`/`memory` (`user`/`project`/`local` give the child its own persistent store under `.claude/agent-memory[-local]`, injected with Read/Write/Edit enabled, gated on auto memory; the parent conversation's memory is never loaded into a subagent, matching Claude); parallel and chain modes (pi extensions), one nesting level; background runs with cancel and resume (`/tasks` lists them, `/agents` lists the discovered roster) | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, tool snapshot/restore that survives `/reload` | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
 | Checkpoints / rewind | shadow-repo snapshots; restore overwrites checkpointed files, keeps files created later; 100 per session, repos pruned after 30 days | `git-checkpoint.ts` |
 | Persistent memory | per-repo memories under `~/.pi/agent/memory` keyed on the repository root (subdirectory sessions share one store, as Claude does; pi's own store, separate from Claude's), index injected each session within Claude's 200-line/25KB bound (YAML frontmatter and block HTML comments stripped before it counts or loads); a save that would overflow it reports why; a memory written with frontmatter gets a `modified:` ISO timestamp; honors `autoMemoryEnabled` (settings) and `CLAUDE_CODE_DISABLE_AUTO_MEMORY` (env) to turn it off, and `autoMemoryDirectory` (absolute or `~/`) to relocate the store | `memory.ts` |
 | WebSearch / WebFetch | key-free DuckDuckGo search (with `allowed_domains`/`blocked_domains`); SSRF-guarded fetch that prefers markdown via `Accept` then converts HTML, with Claude's 15-minute per-URL cache and an optional `prompt` that runs the page through the model in-process and returns the answer (falls back to markdown when headless or on error) | `web.ts` |
 | AskUserQuestion | 1-4 questions per call (asked in sequence), each with `header` and 2-4 options, single- or `multiSelect`, plus free-text | `question.ts` |
-| Statusline | Claude `statusLine` command contract (stdin JSON incl. `version`, `hook_event_name`, `session_name`, cost durations and line counters, context percentages; `padding`, `refreshInterval`, 300ms debounce); built-in turn state + session cost fallback | `status-line.ts` |
+| Statusline | Claude `statusLine` command contract (stdin JSON incl. `version`, `hook_event_name`, `session_name`, a `cost` block with wall and API durations and lines added/removed, a `context_window` token breakdown, `exceeds_200k_tokens`, and `rate_limits` carrying the `five_hour`/`seven_day` utilization and reset from the provider's rate-limit headers; `padding`, `refreshInterval`, 300ms debounce); built-in turn state + session cost fallback | `status-line.ts` |
 | Notifications | terminal notification when a turn ends (OSC 777 / Kitty OSC 99 / Windows toast); honors `preferredNotifChannel` (`terminal_bell`, `notifications_disabled`, `iterm2_with_bell`, else desktop) from user settings; fires only when you "appear to be away" (approximated by turn duration, since pi exposes no terminal-focus signal) | `notify.ts` |
+| Think keywords | raises reasoning for one turn when the prompt carries a keyword: `ultrathink` to the max, `think hard`/`think harder` to high, a bare `think` to medium; only ever raises, matched on word boundaries, and the prior level is restored once the turn settles | `thinking.ts` |
+| Session title | names a new session from its first message with a single model call (shown in the session selector and the terminal title); never overwrites an existing name, best-effort, at most once per session | `session-title.ts` |
+| `/context` | reports how much of the model's context window the session occupies (used, window, free, and percent), and reads pi's live usage so it reflects a compaction | `context-usage.ts` |
 | Claude plugins | installed marketplace plugins (`~/.claude/plugins/cache`), active per `enabledPlugins` in user settings only (a checked-out repo cannot flip which code-bearing plugins run, so project settings never toggle them): commands as `/plugin:name`, agents, hooks and MCP servers (tools aliased `mcp__plugin_<plugin>_<server>__<tool>`) and output styles with `${CLAUDE_PLUGIN_ROOT}`/`${CLAUDE_PLUGIN_DATA}` and `${user_config.KEY}` (from `pluginConfigs[id].options` in user settings) substituted; skill dirs contribute too, though pi's loader names them without the plugin prefix | `internal/plugins.ts` |
 
+Slash commands: `/init`, `/context`, `/memory`, `/todos`, `/rewind`, `/tasks`, `/agents`, `/plan`, `/mcp`, `/hooks`, and `/output-style`, alongside your own `/dir:name` commands, `/skill:name` skills, `/plugin:name` plugin commands, and each connected server's `/mcp__server__prompt` prompts.
+
 pi has no general permission system, so most of what Claude routes through a permission prompt maps to hard behavior here: `allowed-tools` restricts the turn's tool set instead of pre-approving calls, and a hook that times out on PreToolUse or UserPromptSubmit fails closed. A hook's `permissionDecision: "ask"` is the exception: it shows a confirm dialog and lets the call through when you approve (a headless run has no dialog, so it blocks). Where a Claude restriction cannot be expressed at all (an argument-scoped grant in an agent's `tools:`), the definition is rejected rather than widened.
 
-`CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
+`CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base. Setting `CLAUDE_CONFIG_DIR` relocates the entire home config scope (settings, commands, agents, skills, plugins, output styles, memory, and the user `CLAUDE.md`); a project's own `.claude/` is a separate scope and is unaffected.
 
-`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), `project-approval.ts` (the trust decision above), `command-file.ts` (slash-command parsing and dynamic content), and the shared-bus contracts `mcp-alias.ts`, `plan-mode-state.ts` and `subagent-events.ts`. The extensions use them; only `internal/` keeps them out of pi's extension scan.
+`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), `project-approval.ts` (the trust decision above), `command-file.ts` (slash-command parsing and dynamic content), `config-dir.ts` (the `CLAUDE_CONFIG_DIR` home-scope resolver), `managed-settings.ts` (the enterprise policy file), `model-complete.ts` (the in-process model calls behind session titling and prompt hooks), `mcp-oauth.ts` (the OAuth loopback), and the shared-bus contracts `mcp-alias.ts`, `plan-mode-state.ts` and `subagent-events.ts`. The extensions use them; only `internal/` keeps them out of pi's extension scan.
 
 Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 

package/extensions/hooks.ts

@@ -3,7 +3,14 @@
  *
  * Runs Claude Code's `.claude/settings.json` hooks on pi's lifecycle events, so
  * a project's existing hooks work under pi:
- * - PreToolUse      -> pi `tool_call` (can block the tool or rewrite its input)
+ * - PreToolUse      -> pi `tool_call` (can block the tool or rewrite its input), plus
+ *                      pi `user_bash` for a `!`/`!!` command the user runs directly (the
+ *                      model never issues these, so a deny-list guard would otherwise miss
+ *                      them). No pi tool call exists there, so the payload reports the
+ *                      Claude name "Bash"; a deny hands pi a synthetic failed result so
+ *                      the command never runs. UserBashEvent carries no execution result
+ *                      and fires only before the command runs, so it has no PostToolUse
+ *                      counterpart (pi never delivers the output to observe).
  * - PostToolUse     -> pi `tool_result` (block reasons and additionalContext are
  *                      appended next to the tool result, as Claude documents)
  * - SessionStart    -> pi `session_start` (stdout/additionalContext is injected as
@@ -1021,6 +1028,31 @@ export default function hooksExtension(pi: ExtensionAPI) {
     return { content: [...event.content, ...feedback.map((text) => ({ type: 'text' as const, text }))] }
   })
 
+  // Claude's PreToolUse for Bash, extended to a command the user runs directly with the
+  // `!`/`!!` prefix. pi fires user_bash before executing it, and the model never sees it,
+  // so without this a guard that blocks `git push -f` from the model would not stop the
+  // same command typed by hand. There is no pi tool call, so the matcher sees both pi's
+  // "bash" and the Claude name "Bash" (exactly as an MCP alias is bridged) and the payload
+  // reports "Bash", the tool_name a Claude-written PreToolUse Bash hook expects. The
+  // payload carries no tool_use_id (no model tool call produced it). UserBashEventResult
+  // exposes no block flag: a deny is enforced through `result` ("extension handled
+  // execution, use this result"), a synthetic failed BashResult that stands in for the
+  // command so it never runs and its deny reason shows as the output. The event delivers
+  // no execution result and fires only before the command runs, so there is deliberately
+  // no PostToolUse for it.
+  pi.on('user_bash', async (event, ctx) => {
+    const decision = await runPreToolUse(config, 'bash', { command: event.command }, boundRunner(ctx), 'Bash', (message) => ctx.ui.notify(message, 'warning'))
+    if (!decision.block) return undefined
+    // Claude's "ask": prompt before running and let the command through on approval; with
+    // no UI (headless) the block stands, the same safe default as the tool_call path.
+    if (decision.ask && ctx.hasUI) {
+      const approved = await ctx.ui.confirm('Allow this command?', decision.reason ?? 'A hook asks you to confirm this command.')
+      if (approved) return undefined
+    }
+    const reason = decision.reason ?? 'Command blocked by hook'
+    return { result: { output: `Blocked by hook: ${reason}`, exitCode: 1, cancelled: false, truncated: false } }
+  })
+
   pi.on('input', async (event, ctx) => {
     // Only genuine user input; extension-injected messages (plan-mode, subagent) are not
     // prompts the user submitted.

package/extensions/internal/project-approval.ts

@@ -61,7 +61,7 @@ export interface ApprovalContext {
   cwd: string
   hasUI: boolean
   isProjectTrusted?: () => boolean
-  ui: { confirm: (title: string, body: string) => Promise<boolean> }
+  ui: { confirm: (title: string, body: string) => Promise<boolean>; notify?: (message: string, type?: 'info' | 'warning' | 'error') => void }
 }
 
 export interface ApprovalDeps {
@@ -80,6 +80,37 @@ const defaultDeps: ApprovalDeps = {
 
 const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MCP servers, hooks and agents can run commands from this repository.'
 
+/**
+ * Shown once when the pi runtime predates project-trust support. pi >= 0.79.1 hands
+ * extensions a `ctx.isProjectTrusted` callback; older runtimes omit it, and the trust
+ * guard below then reads every project as untrusted, so trust prompts, project hooks, MCP,
+ * commands, skills and rules all fail closed with nothing said. A live run on such a pi
+ * produced no error anywhere; this turns that silence into one line.
+ */
+const RUNTIME_TOO_OLD = 'pi-code requires pi >= 0.79.1 for project configuration; project-scoped .claude config stays disabled on this pi version'
+
+/**
+ * Whether the runtime lacks the `isProjectTrusted` capability, warning once when it does.
+ *
+ * The notice fires at most once per process and the guard is never reset: a pi binary
+ * cannot change version mid-run, so a single notice carries all the information a session
+ * can, and repeating it on every gated surface would be noise. Both the prompting and the
+ * silent callers report it. A missing runtime capability is not an approval question, so
+ * surfacing it from the silent variant is correct rather than a stray dialog. `ctx.ui` may
+ * be absent on a headless run, so the notify is fully optional-chained. Callers still fail
+ * closed on a true return, exactly as before.
+ */
+let warnedRuntimeTooOld = false
+
+function runtimeLacksProjectTrust(ctx: { isProjectTrusted?: () => boolean; ui?: { notify?: (message: string, type?: 'info' | 'warning' | 'error') => void } }): boolean {
+  if (typeof ctx.isProjectTrusted === 'function') return false
+  if (!warnedRuntimeTooOld) {
+    warnedRuntimeTooOld = true
+    ctx.ui?.notify?.(RUNTIME_TOO_OLD, 'warning')
+  }
+  return true
+}
+
 /**
  * Whether project-controlled config may be acted on.
  *
@@ -90,7 +121,8 @@ const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MC
 /** The same decision as isProjectApproved, but never prompts: an undecided project
  * reads as unapproved. For surfaces that only display project config, like the
  * subagent roster, where a mid-turn dialog would be wrong. */
-export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'isProjectTrusted'>, deps: ApprovalDeps = defaultDeps): boolean {
+export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'isProjectTrusted'> & { ui?: ApprovalContext['ui'] }, deps: ApprovalDeps = defaultDeps): boolean {
+  if (runtimeLacksProjectTrust(ctx)) return false // pi predates project-trust support
   if (ctx.isProjectTrusted?.() !== true) return false
   if (!deps.hasClaudeShaped(ctx.cwd)) return true
   if (deps.piWouldAsk(ctx.cwd)) return true
@@ -98,7 +130,8 @@ export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'is
 }
 
 export async function isProjectApproved(ctx: ApprovalContext, deps: ApprovalDeps = defaultDeps): Promise<boolean> {
-  if (ctx.isProjectTrusted?.() !== true) return false // pi already declined, or never trusted
+  if (runtimeLacksProjectTrust(ctx)) return false // pi predates project-trust support
+  if (ctx.isProjectTrusted?.() !== true) return false // pi declined trust for this project
   if (!deps.hasClaudeShaped(ctx.cwd)) return true // nothing here pi's own check would miss
   if (deps.piWouldAsk(ctx.cwd)) return true // pi genuinely prompted for this project
 

package/extensions/mcp.ts

@@ -1243,7 +1243,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     for (const [name, client] of Array.from(clients.entries())) {
       if (managedNames.has(name)) continue
       clients.delete(name)
-      await client.close().catch(() => {})
+      // Bound the close like session_shutdown does: a hung server must not stall the new
+      // session start, which awaits this eviction before connecting the managed set.
+      await withTimeout(client.close(), 3000, 'close').catch(() => {})
       status.set(name, { state: 'disabled by managed policy', tools: 0 })
     }
     await connectServers(managedServers, authUi)

package/extensions/memory.ts

@@ -271,11 +271,17 @@ function readIndexQuietly(dir: string): string {
   }
 }
 
+/** Write through a temp file and rename onto the target, so a crash mid-write cannot
+ * truncate it. The tmp name carries the pid so concurrent processes do not collide. */
+function atomicWriteFile(filePath: string, content: string): void {
+  const tmp = `${filePath}.${process.pid}.tmp`
+  fs.writeFileSync(tmp, content)
+  fs.renameSync(tmp, filePath)
+}
+
 /** Replace the index through a rename so a crash mid-write cannot truncate it. */
 function writeIndex(indexPath: string, content: string): void {
-  const tmp = `${indexPath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, indexPath)
+  atomicWriteFile(indexPath, content)
 }
 
 /** The settings chain that decides `autoMemoryEnabled` and `autoMemoryDirectory`:
@@ -337,7 +343,9 @@ export function setAutoMemoryEnabledSetting(home: string, value: boolean): { ok:
   }
   current.autoMemoryEnabled = value
   fs.mkdirSync(dir, { recursive: true })
-  fs.writeFileSync(file, `${JSON.stringify(current, null, 2)}\n`)
+  // Atomic like writeIndex: a crash mid-write must not truncate the user's settings, which
+  // also hold their hooks, env and permissions config.
+  atomicWriteFile(file, `${JSON.stringify(current, null, 2)}\n`)
   return { ok: true }
 }
 

package/extensions/output-styles.ts

@@ -200,6 +200,13 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
 
   pi.registerCommand('output-style', {
     description: 'Choose the active Claude output style (or /output-style <name>)',
+    // /output-style <name> takes a style name, so complete the discovered names by the
+    // typed prefix (case-insensitive, like the handler's own name lookup). An empty
+    // prefix offers every style.
+    getArgumentCompletions: (argumentPrefix) => {
+      const prefix = argumentPrefix.trim().toLowerCase()
+      return styles.filter((style) => style.name.toLowerCase().startsWith(prefix)).map((style) => ({ value: style.name, label: style.name, ...(style.description ? { description: style.description } : {}) }))
+    },
     handler: async (args, ctx) => {
       const requested = args.trim()
       if (requested) {

package/extensions/session-title.ts

@@ -0,0 +1,141 @@
+/**
+ * Session Auto-Title Extension
+ *
+ * Claude auto-names a new conversation from its first message; this does the same for
+ * pi. After the first run of an unnamed session settles, it asks the current model for
+ * a short title based on the first user message and applies it two ways: setSessionName
+ * (the name shown in the session selector) and the terminal window/tab title.
+ *
+ * It runs in every mode, not just the TUI: naming a session is cheap and harmless, and a
+ * headless run that persists its session still benefits from a readable name later. The
+ * window-title update is the only terminal-specific part, so it is optional-called rather
+ * than gated on hasUI. Titling is best-effort throughout: a session that already has a
+ * name, a run with no user text (a slash-command-only turn), a headless run with no model,
+ * or any provider error leaves the session untitled and never throws.
+ *
+ * Cost: one model call per session at most. The guard is claimed before the completion so
+ * repeated settles cannot each fire a call, and a failed attempt is not retried until a
+ * new session resets the guard.
+ */
+
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
+
+import { completeText } from './internal/model-complete.js'
+
+const TITLE_SYSTEM = 'You name a coding session from its first user message. Reply with a terse 3 to 6 word title in Title Case that captures the task. No quotes, no surrounding punctuation, no trailing period. Output the title only, nothing else.'
+/** A title is a few words; a tight cap keeps the extra call cheap and stops a runaway reply. */
+const TITLE_MAX_TOKENS = 24
+/** The first message can be huge; only its opening is needed to name the session, and a
+ * bounded prompt keeps the input cost of the extra call small. */
+const MAX_PROMPT_CHARS = 1000
+
+/** Join the text of a message's content, mirroring git-checkpoint's extraction: content is
+ * either a plain string or an array of parts, of which only text parts carry a title's worth. */
+function extractText(content: unknown): string {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return ''
+  return content
+    .filter((part) => part?.type === 'text' && typeof part.text === 'string')
+    .map((part) => part.text)
+    .join(' ')
+}
+
+/** Text of the first user message in the branch, or empty when the run carried no user text
+ * (for example a slash-command-only turn), in which case there is nothing to title from. */
+export function firstUserText(ctx: ExtensionContext): string {
+  for (const entry of ctx.sessionManager.getBranch()) {
+    if (entry?.type === 'message' && entry.message.role === 'user') {
+      return extractText(entry.message.content).trim()
+    }
+  }
+  return ''
+}
+
+/** Wrapping quotes (straight, smart, and backtick) and trailing sentence punctuation that
+ * cleanTitle peels, held as plain strings so the trims below can test membership by index
+ * rather than with an anchored regex. */
+const WRAPPING_QUOTES = '"\'`“”‘’'
+const TRAILING_PUNCTUATION = '.,;:!?'
+
+/** Strip runs of `chars` from both ends of `value` in linear time. The equivalent
+ * /^[chars]+|[chars]+$/g backtracks super-linearly on a long run (S8786). */
+function trimBothEnds(value: string, chars: string): string {
+  let start = 0
+  let end = value.length
+  while (start < end && chars.includes(value[start])) start++
+  while (end > start && chars.includes(value[end - 1])) end--
+  return value.slice(start, end)
+}
+
+/** Strip a trailing run of `chars` from `value` in linear time. The equivalent
+ * /[chars]+$/g backtracks super-linearly on a long trailing run (S8786). */
+function trimTrailing(value: string, chars: string): string {
+  let end = value.length
+  while (end > 0 && chars.includes(value[end - 1])) end--
+  return value.slice(0, end)
+}
+
+/** Trim the model's reply to a bare title: collapse whitespace, then peel wrapping quotes
+ * and trailing punctuation until stable, so `"Fix The Parser."` and `Fix The Parser.` both
+ * land on the plain phrase. */
+export function cleanTitle(raw: string): string {
+  let title = raw.trim().replace(/\s+/g, ' ')
+  let prev: string
+  do {
+    prev = title
+    title = trimTrailing(trimBothEnds(title, WRAPPING_QUOTES), TRAILING_PUNCTUATION).trim()
+  } while (title !== prev)
+  return title
+}
+
+export default function sessionTitleExtension(pi: ExtensionAPI) {
+  // One title per session, reset when a new session takes over so a resumed or forked
+  // session can still earn its own name.
+  let titled = false
+  // Bumped on every session_start. Captured before the model call so a title that resolves
+  // after a /new (which resets state to a different session) is recognized as stale and
+  // dropped, rather than renaming whoever holds the session slot now.
+  let generation = 0
+
+  pi.on('session_start', () => {
+    titled = false
+    generation++
+  })
+
+  pi.on('agent_settled', async (_event, ctx) => {
+    if (titled) return
+    // Never clobber an existing name: a user-chosen or resumed name wins.
+    if (pi.getSessionName?.()) return
+    const model = ctx.model
+    if (!model) return // headless with no model: nothing to name with, and the guard is left unspent
+    const prompt = firstUserText(ctx)
+    if (!prompt) return // no user text this run: leave the guard unspent for a later real message
+
+    // Claim the single attempt before the await, so overlapping or repeated settles cannot
+    // each fire a model call; a failed attempt below is not retried within this session.
+    titled = true
+    const startedGeneration = generation
+    let title: string
+    try {
+      const { text } = await completeText(model, `First user message of a new coding session:\n\n${prompt.slice(0, MAX_PROMPT_CHARS)}`, {
+        system: TITLE_SYSTEM,
+        maxTokens: TITLE_MAX_TOKENS,
+      })
+      title = cleanTitle(text)
+    } catch {
+      return // no model, provider error: leave the session untitled (best-effort)
+    }
+    if (!title) return
+    // A /new during the await moved us to a different session, or a name has since been set;
+    // applying this title now would rename the wrong session, so drop it.
+    if (generation !== startedGeneration || pi.getSessionName?.()) return
+    // Post-await ctx getters throw once the session is disposed, and an escaping rejection
+    // from this un-awaited settle can exit pi; apply the title best-effort.
+    try {
+      pi.setSessionName(title)
+      ctx.ui.setTitle?.(title)
+    } catch {
+      // disposed session or a setter failure: leave the session untitled.
+    }
+  })
+}

package/extensions/status-line.ts

@@ -64,6 +64,68 @@ function formatCost(cost: number): string {
   return cost >= 0.01 ? `$${cost.toFixed(2)}` : `$${cost.toFixed(4)}`
 }
 
+interface RateLimitWindow {
+  used_percentage: number
+  resets_at?: string
+}
+interface RateLimitSnapshot {
+  five_hour?: RateLimitWindow
+  seven_day?: RateLimitWindow
+}
+
+/** Lowercase every header name (HTTP names are case-insensitive) and drop null
+ * values, so a single lookup shape works regardless of how the provider cased
+ * them. ProviderHeaders values are string | null. */
+function normalizeHeaders(raw: Record<string, string | null> | undefined): Record<string, string> {
+  const out: Record<string, string> = {}
+  for (const [key, value] of Object.entries(raw ?? {})) {
+    if (typeof value === 'string') out[key.toLowerCase()] = value
+  }
+  return out
+}
+
+function toNumber(value: string | undefined): number | undefined {
+  if (value === undefined || value.trim() === '') return undefined
+  const parsed = Number(value)
+  return Number.isFinite(parsed) ? parsed : undefined
+}
+
+/** One rate-limit window from the `anthropic-ratelimit-<prefix>-*` header family,
+ * taking a direct `-utilization` percentage when present, else computing it from
+ * `-limit` and `-remaining`. resets_at comes from `-reset` when the header is set.
+ * Header names vary, so only what is present is read and a bare number is enough. */
+function readRateLimitWindow(headers: Record<string, string>, prefix: string): RateLimitWindow | undefined {
+  const base = `anthropic-ratelimit-${prefix}`
+  let usedPercentage = toNumber(headers[`${base}-utilization`])
+  if (usedPercentage === undefined) {
+    const limit = toNumber(headers[`${base}-limit`])
+    const remaining = toNumber(headers[`${base}-remaining`])
+    if (limit !== undefined && limit > 0 && remaining !== undefined) {
+      usedPercentage = ((limit - remaining) / limit) * 100
+    }
+  }
+  if (usedPercentage === undefined) return undefined
+  // A provider can report a utilization above 100 (or a remaining above the limit, making
+  // the computed value negative); clamp so the payload never carries a nonsense percentage.
+  const window: RateLimitWindow = { used_percentage: Math.max(0, Math.min(100, usedPercentage)) }
+  const resetsAt = headers[`${base}-reset`] ?? headers[`${base}-resets-at`]
+  if (resetsAt) window.resets_at = resetsAt
+  return window
+}
+
+/** The five-hour and seven-day utilization windows Claude's statusline reports,
+ * from the unified rate-limit response headers. Undefined when neither is present
+ * so a response without them never clobbers an earlier snapshot. */
+function parseRateLimits(headers: Record<string, string>): RateLimitSnapshot | undefined {
+  const fiveHour = readRateLimitWindow(headers, 'unified-5h')
+  const sevenDay = readRateLimitWindow(headers, 'unified-7d')
+  if (!fiveHour && !sevenDay) return undefined
+  const snapshot: RateLimitSnapshot = {}
+  if (fiveHour) snapshot.five_hour = fiveHour
+  if (sevenDay) snapshot.seven_day = sevenDay
+  return snapshot
+}
+
 export interface StatusLineConfig {
   command: string
   padding: number
@@ -120,6 +182,10 @@ export default function statusLine(pi: ExtensionAPI) {
   let apiDurationMs = 0
   let requestStartMs: number | undefined
   let lastUsage: { input: number; output: number; cacheRead: number; cacheWrite: number; totalTokens: number } | undefined
+  // The most recent rate-limit snapshot parsed from provider response headers, and
+  // a once-per-session guard so a 429 warns the user only the first time it lands.
+  let rateLimits: RateLimitSnapshot | undefined
+  let rateLimitWarned = false
   let refreshTimer: ReturnType<typeof setInterval> | undefined
   let debounceTimer: ReturnType<typeof setTimeout> | undefined
   let running = false
@@ -193,6 +259,9 @@ export default function statusLine(pi: ExtensionAPI) {
       payload.thinking = { enabled: ctx.thinkingLevel !== 'off' }
     }
     if (styleName) payload.output_style = { name: styleName }
+    // The current utilization of the account's rate-limit windows, when the
+    // provider reported them; omitted entirely until a response has carried them.
+    if (rateLimits) payload.rate_limits = rateLimits
     return payload
   }
 
@@ -260,9 +329,24 @@ export default function statusLine(pi: ExtensionAPI) {
   pi.on('before_provider_request', async () => {
     requestStartMs = Date.now()
   })
-  pi.on('after_provider_response', async () => {
+  pi.on('after_provider_response', async (event, ctx) => {
     if (requestStartMs !== undefined) apiDurationMs += Date.now() - requestStartMs
     requestStartMs = undefined
+    // Rate-limit windows and 429 handling ride on the same response event. Header
+    // names and presence vary, so parse only what is there and never throw.
+    const headers = normalizeHeaders(event.headers)
+    const snapshot = parseRateLimits(headers)
+    if (snapshot) rateLimits = snapshot
+    if (event.status === 429 && !rateLimitWarned) {
+      rateLimitWarned = true
+      const retryAfter = headers['retry-after']
+      const detail = retryAfter ? `; retry after ${retryAfter}s` : ''
+      try {
+        ctx.ui.notify(`Provider rate limit reached (429)${detail}`, 'warning')
+      } catch {
+        // The session may be gone by the time a late response lands; nothing to warn.
+      }
+    }
   })
   // The last message's token usage, for the breakdown getContextUsage() omits,
   // and the running cost total, so renders never re-walk the branch.
@@ -284,6 +368,8 @@ export default function statusLine(pi: ExtensionAPI) {
     apiDurationMs = 0
     requestStartMs = undefined
     lastUsage = undefined
+    rateLimits = undefined
+    rateLimitWarned = false
     clearInterval(refreshTimer)
     // Seed the running cost from the branch: a resumed or forked session starts
     // with history, and message_end only accumulates from here on.
@@ -327,6 +413,15 @@ export default function statusLine(pi: ExtensionAPI) {
     scheduleRefresh()
   })
 
+  // The model and effort segments of the payload go stale between turns; a switch
+  // fires these events, so refresh at once instead of waiting for the next tick.
+  pi.on('model_select', async () => {
+    scheduleRefresh()
+  })
+  pi.on('thinking_level_select', async () => {
+    scheduleRefresh()
+  })
+
   pi.on('session_compact', async (_event, ctx) => {
     // Compaction replaces the branch entries; reseed the total from what remains.
     costTotal = sessionCost(ctx)

package/extensions/thinking.ts

@@ -51,6 +51,16 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     // source 'extension' (a subagent prompt, a command body replayed through it); a
     // think keyword the user did not type must not escalate, mirroring hooks.ts's guard.
     if (event.source === 'extension') return
+    // A prompt that escalated but was then BLOCKED by a hook runs no turn, so no
+    // agent_settled ever fires to restore the level. The arrival of a new input is the
+    // signal that the prior prompt is gone: if this extension still owns the level (it is
+    // exactly our escalation target), restore before handling this input. In the normal
+    // path a settle already cleared pending, so this fires only for the blocked case.
+    if (pendingRestore !== undefined && (pi.getThinkingLevel?.() ?? ctx.thinkingLevel) === pendingTarget) {
+      pi.setThinkingLevel?.(pendingRestore)
+      pendingRestore = undefined
+      pendingTarget = undefined
+    }
     const target = requestedThinkingLevel(event.text)
     if (!target) return
     const current = pi.getThinkingLevel?.() ?? ctx.thinkingLevel ?? 'off'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.10",
+  "version": "1.0.12",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",