pi-code 1.0.11 → 1.0.13

package/README.md

@@ -17,6 +17,10 @@ What a repository ships is treated as untrusted until you approve it: project MC
 
 ![pi-code demo](demos/hero.gif)
 
+## Requirements
+
+pi `>=0.79.1` (0.84.x recommended) and Node `>=22.19` for current pi.
+
 ## Install
 
 ```bash
@@ -38,30 +42,36 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Feature | Reads / provides | Extension |
 |---|---|---|
 | Global + project rules | `~/.claude/rules`, `.claude/rules` (nearest at or above cwd); unscoped rules inlined in full, `paths:`-scoped rules surfaced as pointers and auto-attached (the rule body is appended to a read/edit/write result when a matching file is touched, once per rule per session) | `claude-rules.ts` |
-| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`); `$ARGUMENTS` (with the `ARGUMENTS:` append when unused), 0-based `$ARGUMENTS[N]`/`$N`, named `arguments:` frontmatter, `${CLAUDE_SESSION_ID}`/`${CLAUDE_EFFORT}`/`${CLAUDE_SKILL_DIR}`/`${CLAUDE_PROJECT_DIR}` (in bodies and `allowed-tools` rules); `` !`cmd` `` and multi-line ```` ```! ```` bash (whitespace-bounded, merged stderr, 2-minute budget, a failure aborts the invocation with the documented exit-1 carveout), `@file` inlining; `allowed-tools` with `Bash(...)` and `Read`/`Edit`/`Write` path scopes enforced at call time (gitignore anchors, Edit governs writes), `disallowed-tools`, `argument-hint`, `model` (switches the session model for the command's turn, restored after), `shell: powershell` (runs the command's injected spans through PowerShell when a pwsh binary is present, else falls back to /bin/sh); `disable-model-invocation` is parsed but not applied; project commands gated on approval | `commands.ts` |
+| Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`); `$ARGUMENTS` (with the `ARGUMENTS:` append when unused), 0-based `$ARGUMENTS[N]`/`$N`, named `arguments:` frontmatter, `${CLAUDE_SESSION_ID}`/`${CLAUDE_EFFORT}`/`${CLAUDE_SKILL_DIR}`/`${CLAUDE_PROJECT_DIR}` (in bodies and `allowed-tools` rules); `` !`cmd` `` and multi-line ```` ```! ```` bash (whitespace-bounded, merged stderr, 2-minute budget, a failure aborts the invocation with the documented exit-1 carveout), `@file` inlining; `allowed-tools` with `Bash(...)` and `Read`/`Edit`/`Write` path scopes enforced at call time (gitignore anchors, Edit governs writes), `disallowed-tools`, `argument-hint`, `model` (switches the session model for the command's turn, restored after), `effort` (raises reasoning for the turn, restored after), `shell: powershell` (injected spans run through PowerShell when a `pwsh` binary is present, else `/bin/sh`); the model can also run a command itself through the `SlashCommand` tool (Claude's `SlashCommand` in `allowed-tools`), steered by `when_to_use` and opted out per file with `disable-model-invocation` (`user-invocable: false` hides a command from the menu while still exposing it to the model); `disableSkillShellExecution` (managed and user always, project when trusted) replaces every `!` span with a policy-disabled placeholder; project commands gated on approval | `commands.ts` |
 | `/init` | generates a project context file: detects an existing `AGENTS.md`/`CLAUDE.md` (proposes improvements) or none (creates `AGENTS.md`, pi's preferred name), ingesting `.cursor/rules`, `.cursorrules`, and `.github/copilot-instructions.md` when present; drives the main agent with full tools via a prompt (not a tool-less completion) so it analyzes the codebase and writes the file itself | `init.ts` |
 | Skills | `.claude/skills` → pi skill discovery, project skills gated on approval (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
-| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s, non-blocking) since pi has no permission backstop | `hooks.ts` |
+| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s, non-blocking) since pi has no permission backstop; a `command` hook may use exec form (`command` as an argv array, run with no shell) and executes with `CLAUDECODE=1` and `CLAUDE_PROJECT_DIR` set; a user-typed `!`/`!!` bash line runs PreToolUse (there is no PostToolUse for it); `type: http` targets are gated by `allowedHttpHookUrls` (union of managed and settings scopes; unset allows all, `[]` blocks every http hook); a Stop hook may block at most 8 times before the turn ends (`CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`); `disableAllHooks` in any scope turns the system off; `/hooks` prints the resolved configuration | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`; plus styles shipped by enabled plugins (manifest `outputStyles`, default `output-styles/`, ranked below the user's and project's own); Claude replace semantics with `keep-coding-instructions`; bundled Explanatory/Learning/Proactive; `/output-style [name]` | `output-styles.ts` |
-| CLAUDE.md `@imports` and rewriting | resolves `@path` imports pi's native loader skips (4-hop depth, budget-capped); loads every `CLAUDE.local.md` from the repo root down to cwd (approval-gated, root first); injects managed `claudeMd` from `managed-settings.json` at the top of context; honors `claudeMdExcludes` (glob/absolute-path skip list from user, approved-project, and managed settings, merged; managed content never excluded); strips block-level HTML comments from CLAUDE.md, rule, and imported bodies (fenced-code comments preserved), so a commented-out `@import` does not expand; with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` set, loads `CLAUDE.md`/`.claude/CLAUDE.md`/`.claude/rules/*.md`/`CLAUDE.local.md` from each `--add-dir` directory (comma-separated for several, since pi's flag is single-value) | `context-imports.ts` |
-| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE/WebSocket by `type` (WebSocket is url-only: any `headers`/`bearerToken`/`headersHelper` on a ws server is ignored with a warning); `${VAR:-default}` expansion; a `headersHelper` command whose stdout JSON merges into the transport headers (http/sse); managed `allowedMcpServers`/`deniedMcpServers` read from `managed-settings.json` only (`{serverName}` entries, applied globally across scopes, allow list exclusive with an empty array = lockdown, deny wins); `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`; tools refresh on `list_changed`; bearer tokens, or OAuth for remote servers (browser login on 401 after a confirm, tokens under `~/.pi/agent/mcp-oauth`, silent refresh later) | `mcp.ts` |
+| CLAUDE.md `@imports` and rewriting | resolves `@path` imports pi's native loader skips (4-hop depth, budget-capped); loads the user `~/.claude/CLAUDE.md` and the project `.claude/CLAUDE.md` (approval-gated, deduped against the repo-root `CLAUDE.md`/`AGENTS.md` pi loads natively) that pi's own loader does not; loads every `CLAUDE.local.md` from the repo root down to cwd (approval-gated, root first); injects the managed `CLAUDE.md` (a per-OS file beside `managed-settings.json`) and the `claudeMd` string from `managed-settings.json` at the top of context (managed content is never excludable); honors `claudeMdExcludes` (glob/absolute-path skip list from user, approved-project, and managed settings, merged; managed content never excluded); strips block-level HTML comments from CLAUDE.md, rule, and imported bodies (fenced-code comments preserved), so a commented-out `@import` does not expand; with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` set, loads `CLAUDE.md`/`.claude/CLAUDE.md`/`.claude/rules/*.md`/`CLAUDE.local.md` from each `--add-dir` directory (comma-separated for several, since pi's flag is single-value) | `context-imports.ts` |
+| Settings `env` | `env` blocks from `managed-settings.json`, `~/.claude/settings.json`, and the project `.claude/settings.json`/`settings.local.json` exported into the session (per-key `managed > user > project`); the project scope is approval-gated (a repo's env can redirect providers), a shell `export` outranks user and project but a managed key overrides even that, and a key an approved project set is unset once a later session no longer defines it | `env-settings.ts` |
+| MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE/WebSocket by `type` (WebSocket is url-only: any `headers`/`bearerToken`/`headersHelper` on a ws server is ignored with a warning); `${VAR:-default}` expansion; a `headersHelper` command whose stdout JSON merges into the transport headers (http/sse); a `managed-mcp.json` beside `managed-settings.json` takes exclusive control (only its servers load, every other scope and the approval flow suppressed; an empty file disables MCP); managed `allowedMcpServers`/`deniedMcpServers` read from `managed-settings.json` only (`{serverName}` entries, applied globally across scopes, allow list exclusive with an empty array = lockdown, deny wins); connect and per-call budgets (`MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`) over a 4-hour wall default, plus a 5-minute idle timeout that a progress notification resets (`CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT`, `0` disables); a connected server's prompts register as `/mcp__server__prompt` commands and its resources are reachable through the `list_mcp_resources`/`read_mcp_resource` tools; tools refresh on `list_changed`; bearer tokens, or OAuth for remote servers (browser login on 401 after a confirm, CSRF-guarded loopback callback, tokens under `~/.pi/agent/mcp-oauth`, silent refresh later) | `mcp.ts` |
 | Project trust | prompts before loading project config (MCP servers, hooks, agents, rules, output styles, commands, skills) that pi would otherwise trust silently | `internal/project-approval.ts` |
-| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents` (scanned recursively into subfolders) merged by default once the project is trusted (project wins on a name clash); frontmatter `tools`/`disallowedTools`/`model` (sonnet/opus/haiku/fable tier aliases or a concrete id)/`effort`/`skills` preload/`permissionMode: plan`/`maxTurns`/`memory` (`user`/`project`/`local` give the child its own persistent store under `.claude/agent-memory[-local]`, injected with Read/Write/Edit enabled, gated on auto memory; the parent conversation's memory is never loaded into a subagent, matching Claude); parallel and chain modes (pi extensions), one nesting level; background runs with cancel and resume | `subagent/` |
+| Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents` (scanned recursively into subfolders) merged by default once the project is trusted (project wins on a name clash); frontmatter `tools`/`disallowedTools`/`model` (sonnet/opus/haiku/fable tier aliases or a concrete id)/`effort`/`skills` preload/`permissionMode: plan`/`maxTurns`/`memory` (`user`/`project`/`local` give the child its own persistent store under `.claude/agent-memory[-local]`, injected with Read/Write/Edit enabled, gated on auto memory; the parent conversation's memory is never loaded into a subagent, matching Claude); parallel and chain modes (pi extensions), one nesting level; background runs with cancel and resume (`/tasks` lists them, `/agents` lists the discovered roster) | `subagent/` |
 | Plan mode | `plan_mode_complete` tool, tool snapshot/restore that survives `/reload` | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
 | Checkpoints / rewind | shadow-repo snapshots; restore overwrites checkpointed files, keeps files created later; 100 per session, repos pruned after 30 days | `git-checkpoint.ts` |
 | Persistent memory | per-repo memories under `~/.pi/agent/memory` keyed on the repository root (subdirectory sessions share one store, as Claude does; pi's own store, separate from Claude's), index injected each session within Claude's 200-line/25KB bound (YAML frontmatter and block HTML comments stripped before it counts or loads); a save that would overflow it reports why; a memory written with frontmatter gets a `modified:` ISO timestamp; honors `autoMemoryEnabled` (settings) and `CLAUDE_CODE_DISABLE_AUTO_MEMORY` (env) to turn it off, and `autoMemoryDirectory` (absolute or `~/`) to relocate the store | `memory.ts` |
 | WebSearch / WebFetch | key-free DuckDuckGo search (with `allowed_domains`/`blocked_domains`); SSRF-guarded fetch that prefers markdown via `Accept` then converts HTML, with Claude's 15-minute per-URL cache and an optional `prompt` that runs the page through the model in-process and returns the answer (falls back to markdown when headless or on error) | `web.ts` |
 | AskUserQuestion | 1-4 questions per call (asked in sequence), each with `header` and 2-4 options, single- or `multiSelect`, plus free-text | `question.ts` |
-| Statusline | Claude `statusLine` command contract (stdin JSON incl. `version`, `hook_event_name`, `session_name`, cost durations and line counters, context percentages; `padding`, `refreshInterval`, 300ms debounce); built-in turn state + session cost fallback | `status-line.ts` |
+| Statusline | Claude `statusLine` command contract (stdin JSON incl. `version`, `hook_event_name`, `session_name`, a `cost` block with wall and API durations and lines added/removed, a `context_window` token breakdown, `exceeds_200k_tokens`, and `rate_limits` carrying the `five_hour`/`seven_day` utilization and reset from the provider's rate-limit headers; `padding`, `refreshInterval`, 300ms debounce); built-in turn state + session cost fallback | `status-line.ts` |
 | Notifications | terminal notification when a turn ends (OSC 777 / Kitty OSC 99 / Windows toast); honors `preferredNotifChannel` (`terminal_bell`, `notifications_disabled`, `iterm2_with_bell`, else desktop) from user settings; fires only when you "appear to be away" (approximated by turn duration, since pi exposes no terminal-focus signal) | `notify.ts` |
+| Think keywords | raises reasoning for one turn when the prompt carries a keyword: `ultrathink` to the max, `think hard`/`think harder` to high, a bare `think` to medium; only ever raises, matched on word boundaries, and the prior level is restored once the turn settles | `thinking.ts` |
+| Session title | names a new session from its first message with a single model call (shown in the session selector and the terminal title); never overwrites an existing name, best-effort, at most once per session | `session-title.ts` |
+| `/context` | reports how much of the model's context window the session occupies (used, window, free, and percent), and reads pi's live usage so it reflects a compaction | `context-usage.ts` |
 | Claude plugins | installed marketplace plugins (`~/.claude/plugins/cache`), active per `enabledPlugins` in user settings only (a checked-out repo cannot flip which code-bearing plugins run, so project settings never toggle them): commands as `/plugin:name`, agents, hooks and MCP servers (tools aliased `mcp__plugin_<plugin>_<server>__<tool>`) and output styles with `${CLAUDE_PLUGIN_ROOT}`/`${CLAUDE_PLUGIN_DATA}` and `${user_config.KEY}` (from `pluginConfigs[id].options` in user settings) substituted; skill dirs contribute too, though pi's loader names them without the plugin prefix | `internal/plugins.ts` |
 
+Slash commands: `/init`, `/context`, `/memory`, `/todos`, `/rewind`, `/tasks`, `/agents`, `/plan`, `/mcp`, `/hooks`, and `/output-style`, alongside your own `/dir:name` commands, `/skill:name` skills, `/plugin:name` plugin commands, and each connected server's `/mcp__server__prompt` prompts.
+
 pi has no general permission system, so most of what Claude routes through a permission prompt maps to hard behavior here: `allowed-tools` restricts the turn's tool set instead of pre-approving calls, and a hook that times out on PreToolUse or UserPromptSubmit fails closed. A hook's `permissionDecision: "ask"` is the exception: it shows a confirm dialog and lets the call through when you approve (a headless run has no dialog, so it blocks). Where a Claude restriction cannot be expressed at all (an argument-scoped grant in an agent's `tools:`), the definition is rejected rather than widened.
 
-`CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base.
+`CLAUDE.md` itself needs no extension: pi loads `CLAUDE.md` / `AGENTS.md` context files natively (global + walking cwd to root). `context-imports.ts` only adds the `@import` resolution pi's loader lacks, appending the imported files without re-injecting the base. Setting `CLAUDE_CONFIG_DIR` relocates the entire home config scope (settings, commands, agents, skills, plugins, output styles, memory, and the user `CLAUDE.md`); a project's own `.claude/` is a separate scope and is unaffected.
 
-`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), `project-approval.ts` (the trust decision above), `command-file.ts` (slash-command parsing and dynamic content), and the shared-bus contracts `mcp-alias.ts`, `plan-mode-state.ts` and `subagent-events.ts`. The extensions use them; only `internal/` keeps them out of pi's extension scan.
+`extensions/internal/` holds shared modules pi's loader must not treat as extensions: `output-guard.ts` (context-budget truncation), `web-transport.ts` (DNS-pinned fetch), `project-approval.ts` (the trust decision above), `command-file.ts` (slash-command parsing and dynamic content), `config-dir.ts` (the `CLAUDE_CONFIG_DIR` home-scope resolver), `managed-settings.ts` (the enterprise policy file), `model-complete.ts` (the in-process model calls behind session titling and prompt hooks), `mcp-oauth.ts` (the OAuth loopback), and the shared-bus contracts `mcp-alias.ts`, `plan-mode-state.ts` and `subagent-events.ts`. The extensions use them; only `internal/` keeps them out of pi's extension scan.
 
 Vendored bases (`question`, `notify`, `status-line`) come from pi's MIT example extensions (see [LICENSE](LICENSE)).
 

package/extensions/commands.ts

@@ -466,6 +466,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (_event, ctx) => {
+    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // the same instance while a command's per-run scoping is still pending (its agent_settled
+    // never came). Carrying that into the next session would restore an unrelated tool set,
+    // bash/path scope, model, or effort onto it, so drop the pending state here. Drop only:
+    // no setActiveTools/setModel/setThinkingLevel, since the new session owns its own state.
+    pendingRestore = undefined
+    pendingBashRules = undefined
+    pendingPathRules = undefined
+    pendingModelRestore = undefined
+    pendingEffortRestore = undefined
     const trusted = await isProjectApproved(ctx)
     projectApproved = trusted
     // A resume/fork/new session can switch projects in-process. pi cannot unregister a

package/extensions/git-checkpoint.ts

@@ -253,6 +253,13 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (_event, ctx) => {
+    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // the same instance after turn_start took the pre-run snapshot but before turn_end saved
+    // it; that pending ref belongs to the previous session and must not attach to the next
+    // session's first turn_end. Re-arm runNeedsSnapshot too, so the next run snapshots its
+    // own tree even though the prior run left it false.
+    pending = undefined
+    runNeedsSnapshot = true
     await ensureShadow(ctx)
     checkpoints.clear()
     for (const entry of ctx.sessionManager.getEntries()) {

package/extensions/hooks.ts

@@ -67,7 +67,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
-import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, ExtensionContext, ToolCallEventResult } from '@earendil-works/pi-coding-agent'
 import { runAgent } from './internal/agent-run.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { INSTRUCTIONS_CHANNEL, isInstructionLoadEvent } from './internal/instruction-events.js'
@@ -859,6 +859,13 @@ function postToolFeedback(result: HookRunResult, eventName: string, isError: boo
   return lines
 }
 
+/** A blocked tool_call verdict carrying pi's `terminate` flag (#7715): with it set on
+ * an all-terminating tool batch, pi skips the automatic follow-up model call that a plain
+ * block would otherwise pay for. */
+function blockedToolCall(reason: string | undefined): ToolCallEventResult {
+  return { block: true, reason, terminate: true }
+}
+
 export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
   let projectDir = ''
@@ -951,6 +958,11 @@ export default function hooksExtension(pi: ExtensionAPI) {
 
   pi.on('session_start', async (event, ctx) => {
     sessionCtx = ctx
+    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // the same instance while a Stop-hook continuation streak is in flight; it must not
+    // carry into the next session, so reset before any early return (disableAllHooks below).
+    stopHookActive = false
+    stopHookBlockCount = 0
     const trusted = await isProjectApproved(ctx)
     // Claude's CLAUDE_PROJECT_DIR is the project root, not the session cwd; a hook
     // referencing $CLAUDE_PROJECT_DIR/.claude/hooks/helper.sh must resolve from a
@@ -1002,9 +1014,9 @@ export default function hooksExtension(pi: ExtensionAPI) {
     // With no UI (headless) the block stands, which is the safe default.
     if (decision.ask && ctx.hasUI) {
       const approved = await ctx.ui.confirm(`Allow ${event.toolName}?`, decision.reason ?? 'A hook asks you to confirm this tool call.')
-      return approved ? undefined : { block: true, reason: decision.reason }
+      return approved ? undefined : blockedToolCall(decision.reason)
     }
-    return { block: true, reason: decision.reason }
+    return blockedToolCall(decision.reason)
   })
 
   // Claude's PostToolUse (success) and PostToolUseFailure (error) both feed their

package/extensions/internal/project-approval.ts

@@ -61,7 +61,7 @@ export interface ApprovalContext {
   cwd: string
   hasUI: boolean
   isProjectTrusted?: () => boolean
-  ui: { confirm: (title: string, body: string) => Promise<boolean> }
+  ui: { confirm: (title: string, body: string) => Promise<boolean>; notify?: (message: string, type?: 'info' | 'warning' | 'error') => void }
 }
 
 export interface ApprovalDeps {
@@ -80,6 +80,37 @@ const defaultDeps: ApprovalDeps = {
 
 const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MCP servers, hooks and agents can run commands from this repository.'
 
+/**
+ * Shown once when the pi runtime predates project-trust support. pi >= 0.79.1 hands
+ * extensions a `ctx.isProjectTrusted` callback; older runtimes omit it, and the trust
+ * guard below then reads every project as untrusted, so trust prompts, project hooks, MCP,
+ * commands, skills and rules all fail closed with nothing said. A live run on such a pi
+ * produced no error anywhere; this turns that silence into one line.
+ */
+const RUNTIME_TOO_OLD = 'pi-code requires pi >= 0.79.1 for project configuration; project-scoped .claude config stays disabled on this pi version'
+
+/**
+ * Whether the runtime lacks the `isProjectTrusted` capability, warning once when it does.
+ *
+ * The notice fires at most once per process and the guard is never reset: a pi binary
+ * cannot change version mid-run, so a single notice carries all the information a session
+ * can, and repeating it on every gated surface would be noise. Both the prompting and the
+ * silent callers report it. A missing runtime capability is not an approval question, so
+ * surfacing it from the silent variant is correct rather than a stray dialog. `ctx.ui` may
+ * be absent on a headless run, so the notify is fully optional-chained. Callers still fail
+ * closed on a true return, exactly as before.
+ */
+let warnedRuntimeTooOld = false
+
+function runtimeLacksProjectTrust(ctx: { isProjectTrusted?: () => boolean; ui?: { notify?: (message: string, type?: 'info' | 'warning' | 'error') => void } }): boolean {
+  if (typeof ctx.isProjectTrusted === 'function') return false
+  if (!warnedRuntimeTooOld) {
+    warnedRuntimeTooOld = true
+    ctx.ui?.notify?.(RUNTIME_TOO_OLD, 'warning')
+  }
+  return true
+}
+
 /**
  * Whether project-controlled config may be acted on.
  *
@@ -90,7 +121,8 @@ const APPROVAL_BODY = 'It ships Claude Code configuration that pi-code loads. MC
 /** The same decision as isProjectApproved, but never prompts: an undecided project
  * reads as unapproved. For surfaces that only display project config, like the
  * subagent roster, where a mid-turn dialog would be wrong. */
-export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'isProjectTrusted'>, deps: ApprovalDeps = defaultDeps): boolean {
+export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'isProjectTrusted'> & { ui?: ApprovalContext['ui'] }, deps: ApprovalDeps = defaultDeps): boolean {
+  if (runtimeLacksProjectTrust(ctx)) return false // pi predates project-trust support
   if (ctx.isProjectTrusted?.() !== true) return false
   if (!deps.hasClaudeShaped(ctx.cwd)) return true
   if (deps.piWouldAsk(ctx.cwd)) return true
@@ -98,7 +130,8 @@ export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'is
 }
 
 export async function isProjectApproved(ctx: ApprovalContext, deps: ApprovalDeps = defaultDeps): Promise<boolean> {
-  if (ctx.isProjectTrusted?.() !== true) return false // pi already declined, or never trusted
+  if (runtimeLacksProjectTrust(ctx)) return false // pi predates project-trust support
+  if (ctx.isProjectTrusted?.() !== true) return false // pi declined trust for this project
   if (!deps.hasClaudeShaped(ctx.cwd)) return true // nothing here pi's own check would miss
   if (deps.piWouldAsk(ctx.cwd)) return true // pi genuinely prompted for this project
 

package/extensions/mcp.ts

@@ -943,6 +943,12 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   // Original server/tool names per registered pi name, for Claude-style hook matchers.
   const aliases: McpToolAlias[] = []
 
+  /** How many tools a server actually has registered. Counted from `registered` (the
+   * durable owner map) rather than registerTools' return, so a reconnect on a second
+   * session, where every tool is already registered and registerTools adds 0, still
+   * reports the true count in /mcp and the startup banner instead of zero. */
+  const serverToolCount = (name: string): number => [...registered.values()].filter((owner) => owner === name).length
+
   /** Register every not-yet-registered tool of a server; returns how many were added. */
   function registerTools(name: string, config: ServerConfig, tools: McpToolInfo[]): number {
     let count = 0
@@ -1154,7 +1160,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const added = registerTools(name, config, refreshed)
           if (added === 0) return
           const current = status.get(name)
-          status.set(name, { state: current?.state ?? 'connected', tools: (current?.tools ?? 0) + added })
+          status.set(name, { state: current?.state ?? 'connected', tools: serverToolCount(name) })
           pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])
         } catch (error) {
           console.warn(`pi-code-mcp: tool refresh failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
@@ -1187,7 +1193,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const client = await connect(name, config, authUi)
           clients.set(name, client)
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-          const count = registerTools(name, config, tools)
+          registerTools(name, config, tools)
           subscribeToToolChanges(name, config, client)
           // Prompts and resources are additive surfaces: their failures warn (inside
           // connectPrompts) rather than flipping a tool-serving server to failed.
@@ -1195,7 +1201,10 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           subscribeToPromptChanges(name, client)
           ensureResourceTools()
           subscribeToResourceChanges(client)
-          status.set(name, { state: 'connected', tools: count })
+          // Count from `registered`, not registerTools' return: a reconnect re-lists tools
+          // that are already registered (return 0) but still serves them, so the banner
+          // must reflect the true count.
+          status.set(name, { state: 'connected', tools: serverToolCount(name) })
           // A server that dies mid-session would otherwise stay "connected" in /mcp
           // while every call fails with the SDK's bare "Not connected"; flip the
           // status and free the name so a later session start can reconnect it.
@@ -1243,7 +1252,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     for (const [name, client] of Array.from(clients.entries())) {
       if (managedNames.has(name)) continue
       clients.delete(name)
-      await client.close().catch(() => {})
+      // Bound the close like session_shutdown does: a hung server must not stall the new
+      // session start, which awaits this eviction before connecting the managed set.
+      await withTimeout(client.close(), 3000, 'close').catch(() => {})
       status.set(name, { state: 'disabled by managed policy', tools: 0 })
     }
     await connectServers(managedServers, authUi)
@@ -1289,6 +1300,12 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (_event, ctx) => {
+    // Reset the status map so /mcp and the banner reflect only this session's config: a
+    // server present last session but not this one must not linger as "connected". The
+    // registered tools, aliases, and prompt commands stay: pi has no unregister (a
+    // withdrawn tool keeps its registration and surfaces the server's own error), which
+    // is why serverToolCount reads from `registered` to recover the true count here.
+    status.clear()
     const authUi = authUiFor(ctx)
     // The managed allow/deny lists filter every scope, including a managed-mcp.json set.
     const { allowed, denied } = mcpAllowDeny()
@@ -1318,6 +1335,13 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   pi.on('session_shutdown', async () => {
     // Close in parallel with a per-client timeout so one hung server can't stall pi's exit.
     await Promise.all([...clients.values()].map((client) => withTimeout(client.close(), 3000, 'close').catch(() => {})))
+    // Drop the closed clients and their status now rather than waiting on each client's
+    // onclose, which the SDK fires late: a same-process session switch (/new, /resume,
+    // /fork) runs the next session_start right after this, and a lingering dead client
+    // there would make connectServers skip reconnecting the name, stranding every tool
+    // closure on a closed client. session_start resets status too, so a switch rebuilds it.
+    clients.clear()
+    status.clear()
   })
 
   pi.registerCommand('mcp', {

package/extensions/memory.ts

@@ -271,11 +271,17 @@ function readIndexQuietly(dir: string): string {
   }
 }
 
+/** Write through a temp file and rename onto the target, so a crash mid-write cannot
+ * truncate it. The tmp name carries the pid so concurrent processes do not collide. */
+function atomicWriteFile(filePath: string, content: string): void {
+  const tmp = `${filePath}.${process.pid}.tmp`
+  fs.writeFileSync(tmp, content)
+  fs.renameSync(tmp, filePath)
+}
+
 /** Replace the index through a rename so a crash mid-write cannot truncate it. */
 function writeIndex(indexPath: string, content: string): void {
-  const tmp = `${indexPath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, indexPath)
+  atomicWriteFile(indexPath, content)
 }
 
 /** The settings chain that decides `autoMemoryEnabled` and `autoMemoryDirectory`:
@@ -337,7 +343,9 @@ export function setAutoMemoryEnabledSetting(home: string, value: boolean): { ok:
   }
   current.autoMemoryEnabled = value
   fs.mkdirSync(dir, { recursive: true })
-  fs.writeFileSync(file, `${JSON.stringify(current, null, 2)}\n`)
+  // Atomic like writeIndex: a crash mid-write must not truncate the user's settings, which
+  // also hold their hooks, env and permissions config.
+  atomicWriteFile(file, `${JSON.stringify(current, null, 2)}\n`)
   return { ok: true }
 }
 

package/extensions/session-title.ts

@@ -3,15 +3,15 @@
  *
  * Claude auto-names a new conversation from its first message; this does the same for
  * pi. After the first run of an unnamed session settles, it asks the current model for
- * a short title based on the first user message and applies it two ways: setSessionName
- * (the name shown in the session selector) and the terminal window/tab title.
+ * a short title based on the first user message and applies it with setSessionName, which
+ * names the session in the selector and refreshes the terminal window/tab title natively
+ * (pi changelog); a separate ctx.ui.setTitle call would only duplicate that, so there is none.
  *
  * It runs in every mode, not just the TUI: naming a session is cheap and harmless, and a
- * headless run that persists its session still benefits from a readable name later. The
- * window-title update is the only terminal-specific part, so it is optional-called rather
- * than gated on hasUI. Titling is best-effort throughout: a session that already has a
- * name, a run with no user text (a slash-command-only turn), a headless run with no model,
- * or any provider error leaves the session untitled and never throws.
+ * headless run that persists its session still benefits from a readable name later. Titling
+ * is best-effort throughout: a session that already has a name, a run with no user text (a
+ * slash-command-only turn), a headless run with no model, or any provider error leaves the
+ * session untitled and never throws.
  *
  * Cost: one model call per session at most. The guard is claimed before the completion so
  * repeated settles cannot each fire a call, and a failed attempt is not retried until a
@@ -92,9 +92,14 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
   // One title per session, reset when a new session takes over so a resumed or forked
   // session can still earn its own name.
   let titled = false
+  // Bumped on every session_start. Captured before the model call so a title that resolves
+  // after a /new (which resets state to a different session) is recognized as stale and
+  // dropped, rather than renaming whoever holds the session slot now.
+  let generation = 0
 
   pi.on('session_start', () => {
     titled = false
+    generation++
   })
 
   pi.on('agent_settled', async (_event, ctx) => {
@@ -109,6 +114,7 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
     // Claim the single attempt before the await, so overlapping or repeated settles cannot
     // each fire a model call; a failed attempt below is not retried within this session.
     titled = true
+    const startedGeneration = generation
     let title: string
     try {
       const { text } = await completeText(model, `First user message of a new coding session:\n\n${prompt.slice(0, MAX_PROMPT_CHARS)}`, {
@@ -120,7 +126,19 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
       return // no model, provider error: leave the session untitled (best-effort)
     }
     if (!title) return
-    pi.setSessionName(title)
-    ctx.ui.setTitle?.(title)
+    // A /new during the await moved us to a different session, or a name has since been set;
+    // applying this title now would rename the wrong session, so drop it.
+    if (generation !== startedGeneration || pi.getSessionName?.()) return
+    // Post-await ctx getters throw once the session is disposed, and an escaping rejection
+    // from this un-awaited settle can exit pi; apply the title best-effort.
+    try {
+      // pi.setSessionName refreshes the terminal/tab title natively (pi changelog), so a
+      // separate ctx.ui.setTitle call would only duplicate that. The guard stays: a
+      // disposed session throws from setSessionName post-await, and an escaping rejection
+      // from this un-awaited settle can exit pi.
+      pi.setSessionName(title)
+    } catch {
+      // disposed session or a setter failure: leave the session untitled.
+    }
   })
 }

package/extensions/status-line.ts

@@ -105,7 +105,9 @@ function readRateLimitWindow(headers: Record<string, string>, prefix: string): R
     }
   }
   if (usedPercentage === undefined) return undefined
-  const window: RateLimitWindow = { used_percentage: usedPercentage }
+  // A provider can report a utilization above 100 (or a remaining above the limit, making
+  // the computed value negative); clamp so the payload never carries a nonsense percentage.
+  const window: RateLimitWindow = { used_percentage: Math.max(0, Math.min(100, usedPercentage)) }
   const resetsAt = headers[`${base}-reset`] ?? headers[`${base}-resets-at`]
   if (resetsAt) window.resets_at = resetsAt
   return window

package/extensions/subagent/background.ts

@@ -1,8 +1,9 @@
 /**
  * Background subagent runs: fire-and-forget children whose completion wakes
  * the parent agent via a notification message. State lives in an in-memory
- * registry queried via {status: true}; it is lost on restart, and a child
- * still running when pi exits finishes on its own rather than being killed.
+ * registry queried via {status: true}; it is lost on restart. A child still
+ * running when pi quits is SIGTERMed (cancelAllBackgroundRuns); one still running
+ * across a same-process session switch keeps going under the new session.
  */
 
 import { spawn } from 'node:child_process'
@@ -141,6 +142,18 @@ export function cancelBackgroundRun(id: string): 'cancelled' | 'not-running' | '
   return 'cancelled'
 }
 
+/** SIGTERM every live background child, killing each process group the way a single
+ * cancel does. Called on quit: a detached child would otherwise keep running (and
+ * spending tokens) after pi exits, its completion swallowed. Returns how many were
+ * signalled; each cancelled child still holds its slot until it actually dies. */
+export function cancelAllBackgroundRuns(): number {
+  let count = 0
+  for (const id of Array.from(runs.keys())) {
+    if (cancelBackgroundRun(id) === 'cancelled') count++
+  }
+  return count
+}
+
 export function backgroundStatusText(): string {
   return formatStatus(runs.values())
 }

package/extensions/subagent/index.ts

@@ -32,7 +32,7 @@ import { SUBAGENT_CHANNEL } from '../internal/subagent-events.js'
 import { autoMemoryEnabled, capIndexForPrompt, INDEX_MAX_BYTES, INDEX_MAX_LINES, memorySettingsFiles, readMemorySettings } from '../memory.js'
 import { skillDirs } from '../skills.js'
 import { type AgentConfig, type AgentMemoryScope, type AgentScope, type AgentSource, discoverAgents, resolveModelAlias, withPreloadedSkills } from './agents.js'
-import { activeBackgroundRuns, type BackgroundRun, backgroundRun, backgroundStatusText, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
+import { activeBackgroundRuns, type BackgroundRun, backgroundRun, backgroundStatusText, cancelAllBackgroundRuns, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
 
 const MAX_PARALLEL_TASKS = 8
 const MAX_CONCURRENCY = 4
@@ -1387,6 +1387,23 @@ export default function subagentExtension(pi: ExtensionAPI) {
     })
   })
 
+  pi.on('session_shutdown', (event, ctx) => {
+    // On quit pi is exiting, so a detached background child would keep running (and
+    // spending tokens) with its completion swallowed: SIGTERM every live run, killing the
+    // process group the way a cancel does. On a same-process session switch
+    // (new/resume/fork) the children keep running under the new session, so leave them be
+    // and warn once that they are still spending; /tasks inspects them. reload re-imports
+    // this module (losing the registry), so it neither kills nor warns.
+    if (event.reason === 'quit') {
+      cancelAllBackgroundRuns()
+      return
+    }
+    if (event.reason === 'new' || event.reason === 'resume' || event.reason === 'fork') {
+      const active = activeBackgroundRuns()
+      if (active > 0) ctx.ui?.notify(`${active} background run${active === 1 ? '' : 's'} still active; /tasks to inspect`, 'warning')
+    }
+  })
+
   // Claude surfaces each agent's description so the model can pick one autonomously.
   // Served from the session-level cache above (keyed on cwd and scope, so an approval
   // granted mid-session still widens it); project agents are included only when the

package/extensions/thinking.ts

@@ -46,11 +46,30 @@ export default function thinkingExtension(pi: ExtensionAPI) {
   // already moved the level, thinking stands down instead of clobbering it.
   let pendingTarget: ThinkingLevel | undefined
 
+  pi.on('session_start', () => {
+    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // the same instance while an escalation is still pending (its agent_settled never came),
+    // and that stale restore must be dropped rather than fired into the next session, whose
+    // level the new session owns. Drop only: do NOT setThinkingLevel here.
+    pendingRestore = undefined
+    pendingTarget = undefined
+  })
+
   pi.on('input', (event, ctx) => {
     // Only genuine user input escalates. sendUserMessage emits an input event with
     // source 'extension' (a subagent prompt, a command body replayed through it); a
     // think keyword the user did not type must not escalate, mirroring hooks.ts's guard.
     if (event.source === 'extension') return
+    // A prompt that escalated but was then BLOCKED by a hook runs no turn, so no
+    // agent_settled ever fires to restore the level. The arrival of a new input is the
+    // signal that the prior prompt is gone: if this extension still owns the level (it is
+    // exactly our escalation target), restore before handling this input. In the normal
+    // path a settle already cleared pending, so this fires only for the blocked case.
+    if (pendingRestore !== undefined && (pi.getThinkingLevel?.() ?? ctx.thinkingLevel) === pendingTarget) {
+      pi.setThinkingLevel?.(pendingRestore)
+      pendingRestore = undefined
+      pendingTarget = undefined
+    }
     const target = requestedThinkingLevel(event.text)
     if (!target) return
     const current = pi.getThinkingLevel?.() ?? ctx.thinkingLevel ?? 'off'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.11",
+  "version": "1.0.13",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",
@@ -20,6 +20,7 @@
     "todo"
   ],
   "license": "MIT",
+  "author": "ilovepixelart",
   "type": "module",
   "files": [
     "extensions"
@@ -51,20 +52,20 @@
     "provenance": true
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.0.0",
+    "@modelcontextprotocol/sdk": "^1.30.0",
     "typebox": "^1.3.6"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
-    "@earendil-works/pi-coding-agent": "*",
-    "@earendil-works/pi-tui": "*"
+    "@earendil-works/pi-ai": ">=0.79.1",
+    "@earendil-works/pi-coding-agent": ">=0.79.1",
+    "@earendil-works/pi-tui": ">=0.79.1"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.4",
-    "@earendil-works/pi-agent-core": "^0.84.0",
-    "@earendil-works/pi-ai": "^0.84.0",
-    "@earendil-works/pi-coding-agent": "^0.84.0",
-    "@earendil-works/pi-tui": "^0.84.0",
+    "@earendil-works/pi-agent-core": "^0.84.2",
+    "@earendil-works/pi-ai": "^0.84.2",
+    "@earendil-works/pi-coding-agent": "^0.84.2",
+    "@earendil-works/pi-tui": "^0.84.2",
     "@types/node": "^26.1.1",
     "@vitest/coverage-v8": "^4.1.10",
     "typescript": "^7.0.2",