pi-code 1.0.15 → 1.0.16

package/README.md

@@ -45,7 +45,7 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | Custom slash commands | `.claude/commands/**/*.md` (namespaced `/dir:name`); `$ARGUMENTS` (with the `ARGUMENTS:` append when unused), 0-based `$ARGUMENTS[N]`/`$N`, named `arguments:` frontmatter, `${CLAUDE_SESSION_ID}`/`${CLAUDE_EFFORT}`/`${CLAUDE_SKILL_DIR}`/`${CLAUDE_PROJECT_DIR}` (in bodies and `allowed-tools` rules); `` !`cmd` `` and multi-line ```` ```! ```` bash (whitespace-bounded, merged stderr, 2-minute budget, a failure aborts the invocation with the documented exit-1 carveout), `@file` inlining; `allowed-tools` with `Bash(...)` and `Read`/`Edit`/`Write` path scopes enforced at call time (gitignore anchors, Edit governs writes), `disallowed-tools`, `argument-hint`, `model` (switches the session model for the command's turn, restored after), `effort` (raises reasoning for the turn, restored after), `shell: powershell` (injected spans run through PowerShell when a `pwsh` binary is present, else `/bin/sh`); the model can also run a command itself through the `SlashCommand` tool (Claude's `SlashCommand` in `allowed-tools`), steered by `when_to_use` and opted out per file with `disable-model-invocation` (`user-invocable: false` hides a command from the menu while still exposing it to the model); `disableSkillShellExecution` (managed and user always, project when trusted) replaces every `!` span with a policy-disabled placeholder; project commands gated on approval | `commands.ts` |
 | `/init` | generates a project context file: detects an existing `AGENTS.md`/`CLAUDE.md` (proposes improvements) or none (creates `AGENTS.md`, pi's preferred name), ingesting `.cursor/rules`, `.cursorrules`, and `.github/copilot-instructions.md` when present; drives the main agent with full tools via a prompt (not a tool-less completion) so it analyzes the codebase and writes the file itself | `init.ts` |
 | Skills | `.claude/skills` → pi skill discovery, project skills gated on approval (pi reads `name`, `description`, `disable-model-invocation`; `allowed-tools` is inert in pi's loader) | `skills.ts` |
-| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s, non-blocking) since pi has no permission backstop; `async`/`asyncRewake` command hooks run in the background on every event (never blocking, no decision, no timeout enforced on `async` while asyncRewake keeps its own; an asyncRewake exit 2 wakes the model with the hook's stderr as a new turn, other completions deliver `systemMessage`/`additionalContext` to the model on the next turn, and hooks still running at session end are killed); a `command` hook may use exec form (`command` as an argv array, run with no shell) and executes with `CLAUDECODE=1` and `CLAUDE_PROJECT_DIR` set; a user-typed `!`/`!!` bash line runs PreToolUse (there is no PostToolUse for it); `type: http` targets are gated by `allowedHttpHookUrls` (union of managed and settings scopes; unset allows all, `[]` blocks every http hook); a Stop hook may block at most 8 times before the turn ends (`CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`); `disableAllHooks` in any scope turns the system off; `/hooks` prints the resolved configuration | `hooks.ts` |
+| Hooks | `.claude/settings.json` hooks: PreToolUse (blocks, rewrites input via `updatedInput`), PostToolUse (feedback and `additionalContext` land next to the tool result), PostToolUseFailure, SessionStart (context injection), UserPromptSubmit (blocks and injects context), Stop (a block continues the conversation), SubagentStart/SubagentStop, PreCompact, PostCompact, SessionEnd, Notification (idle_prompt, the type pi can source), InstructionsLoaded (observational: fires per loaded context file at session start, plus `path_glob_match` on a scoped-rule attach and `include` per resolved `@import`; deduped per session; `nested_traversal`/`compact` reasons never fire since pi does not lazily load nested CLAUDE.md or reload after compaction); `type: http` entries POST the payload (a 2xx JSON body renders the decision, everything else is non-blocking per Claude's contract), `type: prompt` evaluates in-process against the session model, `type: mcp_tool` calls a connected server's tool, and `type: agent` (experimental) spawns a read-only Read/Grep/Glob subagent that returns the JSON decision (a missing model/server/runner is non-blocking, only a PreToolUse timeout fails closed); Claude matcher semantics incl. `mcp__server__tool` names; payloads carry session_id, transcript_path, cwd, permission_mode, effort; `permissionDecision: "ask"` prompts via a confirm dialog (blocks when headless), SubagentStop/PostToolUseFailure are notify-only, and a timed-out PreToolUse/UserPromptSubmit hook fails closed at a 60s default (Claude: 600s for PreToolUse, 30s for UserPromptSubmit, both non-blocking) since pi has no permission backstop; `async`/`asyncRewake` command hooks run in the background on every event (never blocking, no decision, no timeout enforced on `async` while asyncRewake keeps its own; an asyncRewake exit 2 wakes the model with the hook's stderr as a new turn, other completions deliver `systemMessage`/`additionalContext` to the model on the next turn, and hooks still running at session end are killed); a `command` hook may use exec form (`command` as an argv array, run with no shell) and executes with `CLAUDECODE=1` and `CLAUDE_PROJECT_DIR` set; a user-typed `!`/`!!` bash line runs PreToolUse (there is no PostToolUse for it); `type: http` targets are gated by `allowedHttpHookUrls` (union of managed and settings scopes; unset allows all, `[]` blocks every http hook); a Stop hook may block at most 8 times before the turn ends (`CLAUDE_CODE_STOP_HOOK_BLOCK_CAP`); `disableAllHooks` in any scope turns the system off; `/hooks` prints the resolved configuration | `hooks.ts` |
 | Output styles | `.claude/output-styles` + active `outputStyle`; plus styles shipped by enabled plugins (manifest `outputStyles`, default `output-styles/`, ranked below the user's and project's own); Claude replace semantics with `keep-coding-instructions`; bundled Explanatory/Learning/Proactive; `/output-style [name]` | `output-styles.ts` |
 | CLAUDE.md `@imports` and rewriting | resolves `@path` imports pi's native loader skips (4-hop depth, budget-capped); loads the user `~/.claude/CLAUDE.md` and the project `.claude/CLAUDE.md` (approval-gated, deduped against the repo-root `CLAUDE.md`/`AGENTS.md` pi loads natively) that pi's own loader does not; loads every `CLAUDE.local.md` from the repo root down to cwd (approval-gated, root first); injects the managed `CLAUDE.md` (a per-OS file beside `managed-settings.json`) and the `claudeMd` string from `managed-settings.json` at the top of context (managed content is never excludable); honors `claudeMdExcludes` (glob/absolute-path skip list from user, approved-project, and managed settings, merged; managed content never excluded); strips block-level HTML comments from CLAUDE.md, rule, and imported bodies (fenced-code comments preserved), so a commented-out `@import` does not expand; with `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD` set, loads `CLAUDE.md`/`.claude/CLAUDE.md`/`.claude/rules/*.md`/`CLAUDE.local.md` from each `--add-dir` directory (comma-separated for several, since pi's flag is single-value) | `context-imports.ts` |
 | Settings `env` | `env` blocks from `managed-settings.json`, `~/.claude/settings.json`, and the project `.claude/settings.json`/`settings.local.json` exported into the session (per-key `managed > user > project`); the project scope is approval-gated (a repo's env can redirect providers), a shell `export` outranks user and project but a managed key overrides even that, and a key an approved project set is unset once a later session no longer defines it | `env-settings.ts` |

package/extensions/commands.ts

@@ -3,9 +3,10 @@
  *
  * Registers Claude Code's custom slash commands with pi directly, rather than
  * handing `.claude/commands` to pi's prompt-template loader. Owning registration
- * is what makes the rest of Claude's command contract reachable: namespaced
- * subdirectories (`frontend/build.md` is `/frontend:build`), `$ARGUMENTS` and
- * positional substitution, `` !`cmd` `` bash output, `@file` inlining, and the
+ * is what makes the rest of Claude's command contract reachable: `$ARGUMENTS` and
+ * positional substitution, `` !`cmd` `` bash output, `@file` inlining, subdirectory
+ * commands (registered as `/frontend:build`; current Claude docs name a command by
+ * file name alone, so the qualified form is a pi-code divergence), and the
  * `allowed-tools`, `argument-hint` and `model` frontmatter (`model` switches the
  * session model for the command's run via `pi.setModel`, restored on agent_end).
  * `shell: powershell` runs a command's injected spans through PowerShell when a

package/extensions/hooks/decisions.ts

@@ -62,8 +62,8 @@ function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[],
  * the Claude alias, and the payload reports the alias, which is the name a
  * Claude-written hook script expects in tool_name. Every hook sees the original
  * tool input; hookSpecificOutput.updatedInput replaces the input in place as each
- * hook completes, so with several rewrites the last to finish takes effect, which
- * is Claude's documented (non-deterministic) behavior. */
+ * hook completes, so with several rewrites the last to finish takes effect (the
+ * docs leave multi-rewrite ordering unspecified). */
 export async function runPreToolUse(config: HooksConfig, toolName: string, toolInput: unknown, runner: HookRunner, claudeName?: string, onSystemMessage?: SystemMessageSink): Promise<HookDecision> {
   const names = claudeName ? [toolName, claudeName] : [toolName]
   const commands = matchingCommands(config.PreToolUse, names)

package/extensions/hooks/index.ts

@@ -34,8 +34,9 @@
  *
  * Every payload carries session_id, transcript_path (pi's session file), cwd,
  * permission_mode (plan-mode state off the shared bus) and effort; tool events add
- * tool_use_id. Every event honors the universal `systemMessage` output (a
- * user-facing warning).
+ * tool_use_id. The universal `systemMessage` output (a user-facing warning) is
+ * honored on the decision-bearing events; the observational paths (Notification,
+ * InstructionsLoaded) ignore it, as Claude documents for them.
  * `suppressOutput` is accepted and inert: pi never echoes hook stdout to the
  * transcript in the first place.
  * `async`/`asyncRewake` (command hooks only, as Claude documents) run in the
@@ -111,10 +112,12 @@ export function lastAssistantText(messages: ReadonlyArray<{ role: string; conten
 const DEFAULT_STOP_HOOK_BLOCK_CAP = 8
 
 /** The consecutive-block cap for the Stop hook: CLAUDE_CODE_STOP_HOOK_BLOCK_CAP when it
- * is a positive integer, else the default. A non-positive or malformed value falls back
- * to the default rather than capping at zero (which would suppress the very first block). */
+ * is a positive integer, the documented "disable the cap" for 0 (unbounded, not a
+ * zero-cap that would suppress the very first block), else the default for a negative
+ * or malformed value. */
 export function stopHookBlockCap(env: Record<string, string | undefined> = process.env): number {
   const override = Number.parseInt(env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP ?? '', 10)
+  if (override === 0) return Number.POSITIVE_INFINITY
   return Number.isInteger(override) && override > 0 ? override : DEFAULT_STOP_HOOK_BLOCK_CAP
 }
 

package/extensions/hooks/runners.ts

@@ -11,11 +11,13 @@ import { callMcpTool } from '../internal/mcp-call.js'
 import { completeText } from '../internal/model-complete.js'
 import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
 
-// Claude defaults to 600s and lets a timed-out hook proceed; here a timed-out
-// PreToolUse or UserPromptSubmit hook fails closed (pi has no permission prompt
-// to fall back on), so ten minutes of default budget would wedge the turn for
-// ten minutes on a hung hook. Hooks that legitimately run long can raise their
-// own per-hook `timeout`.
+// Claude's defaults vary by type and event (600s for command/http/mcp_tool, 30s
+// for prompt, 60s for agent, lowered to 30s on UserPromptSubmit and to a shared
+// 1.5s budget on SessionEnd) and a timed-out hook proceeds; here one flat default
+// applies and a timed-out PreToolUse or UserPromptSubmit hook fails closed (pi
+// has no permission prompt to fall back on), so ten minutes of default budget
+// would wedge the turn on a hung hook. Hooks that legitimately run long can
+// raise their own per-hook `timeout`.
 const DEFAULT_TIMEOUT_S = 60
 
 export interface HookRunResult {

package/extensions/internal/command-file.ts

@@ -99,10 +99,12 @@ export function normalizeToolName(name: string): string {
 }
 
 /**
- * Entries are comma-separated, except a comma inside an argument scope belongs to the
- * scope: `Bash(cat, tail)` is one grant, not three. Splitting on every comma made the
- * fragments between them top-level entries, so a command naming only `Bash` came away
- * with pi's `edit` tool active.
+ * Entries are comma- or space-separated, as Claude documents ("a space- or
+ * comma-separated string, or a YAML list"), except a separator inside an argument
+ * scope belongs to the scope: `Bash(cat, tail)` and `Bash(git add *)` are one grant
+ * each. Splitting on every comma made the fragments between them top-level entries,
+ * so a command naming only `Bash` came away with pi's `edit` tool active; splitting
+ * on no spaces mangled the docs' own space-separated examples into one garbage rule.
  *
  * Scanned rather than matched with a regex: the pattern form is quadratic on an input
  * of unclosed parens, and a command file comes from the repository.
@@ -114,7 +116,7 @@ function toolEntries(raw: string): string[] {
   for (const ch of raw) {
     if (ch === '(') depth++
     else if (ch === ')') depth = Math.max(0, depth - 1)
-    if (ch === ',' && depth === 0) {
+    if ((ch === ',' || ch === ' ' || ch === '\t') && depth === 0) {
       entries.push(current)
       current = ''
     } else {

package/extensions/mcp/index.ts

@@ -41,10 +41,11 @@ import { setMcpToolCaller } from '../internal/mcp-call.js'
 import { capForContext } from '../internal/output-guard.js'
 import { installedPlugins } from '../internal/plugins.js'
 import { isProjectApproved, isProjectApprovedSilently } from '../internal/project-approval.js'
+import { claudeSettingsChain } from '../internal/settings-chain.js'
 import { loadConfigFrom, loadPluginServers, loadUserScope, projectConfigPaths, type ServerConfig, warnOnTypelessUrl } from './config.js'
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
 import { formatPromptCommandName, formatToolName, type McpContentBlock, type McpPromptInfo, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
-import { applyServerPolicy, loadManagedMcpServers, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
+import { applyServerPolicy, loadManagedMcpServers, type McpPolicy, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
 import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, withTimeout } from './transport.js'
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
@@ -57,7 +58,7 @@ export type { McpToolInfo } from './listing.js'
 export type { McpPromptArgumentInfo, McpPromptInfo, ToolContent } from './mapping.js'
 export { capTotal, formatPromptCommandName, formatToolName, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
 export type { ProjectServerPolicy } from './policy.js'
-export { applyServerPolicy, loadManagedMcpServers, managedMcpPath, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
+export { applyServerPolicy, loadManagedMcpServers, type McpPolicy, type McpPolicyEntry, managedMcpPath, mcpAllowDeny, projectServerPolicy, splitByPolicy, urlPatternMatches } from './policy.js'
 export type { AuthUi } from './transport.js'
 export { parseHelperHeaders, resolveBearerToken } from './transport.js'
 
@@ -401,8 +402,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * connected client not in the managed set (delete it from the map first so the onclose
    * handler's guard sees it gone and does not overwrite the status, then close it
    * best-effort and mark it disabled), then connect only the managed servers. */
-  async function connectManagedExclusive(managed: Record<string, ServerConfig>, allowed: Set<string> | null, denied: Set<string>, authUi?: AuthUi): Promise<void> {
-    const managedServers = applyServerPolicy(managed, allowed, denied)
+  async function connectManagedExclusive(managed: Record<string, ServerConfig>, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
+    const managedServers = applyServerPolicy(managed, policy)
     const managedNames = new Set(Object.keys(managedServers))
     for (const [name, client] of Array.from(clients.entries())) {
       if (managedNames.has(name)) continue
@@ -420,11 +421,11 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * factory: pi runs the factory for invocations that never start a session. Names still
    * connected are filtered out, so a later session start only retries servers that failed
    * or whose transport dropped, without duplicate-name warnings. */
-  async function connectNormalScopes(ctx: ExtensionContext, allowed: Set<string> | null, denied: Set<string>, authUi?: AuthUi): Promise<void> {
+  async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's.
     const pluginServers = loadPluginServers(installedPlugins(os.homedir()))
-    const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, allowed, denied)
+    const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, policy)
     // Claude's precedence is project over user for a duplicate name. A project .mcp.json
     // server only outranks the user's own when it will actually connect (the user already
     // consented to it, or an approved project's), so a merely-present untrusted project
@@ -434,7 +435,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // The stored project decision, read without prompting: consent recorded inside
     // the project only counts once the project itself has been approved.
     const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
-    const { consented, gated } = splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), projectPolicy)
+    const { consented, gated } = splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), policy), projectPolicy)
     const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     // The consented project servers carry no ordering dependency on the user scope:
@@ -462,8 +463,10 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // is why serverToolCount reads from `registered` to recover the true count here.
     status.clear()
     const authUi = authUiFor(ctx)
-    // The managed allow/deny lists filter every scope, including a managed-mcp.json set.
-    const { allowed, denied } = mcpAllowDeny()
+    // The allow/deny lists filter every scope, including a managed-mcp.json set. They
+    // merge from managed settings plus the trust-gated settings chain, as Claude
+    // documents (a repo's file counts only once the project is approved).
+    const policy = mcpAllowDeny(claudeSettingsChain(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx)))
     // managed-mcp.json (beside managed-settings.json) takes exclusive control when present:
     // only its servers load, and the user, project, and plugin scopes plus the whole
     // project-approval flow below are skipped. An empty map disables MCP entirely. An absent
@@ -471,9 +474,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // empty set (see loadManagedMcpServers).
     const managed = loadManagedMcpServers()
     if (managed !== null) {
-      await connectManagedExclusive(managed, allowed, denied, authUi)
+      await connectManagedExclusive(managed, policy, authUi)
     } else {
-      await connectNormalScopes(ctx, allowed, denied, authUi)
+      await connectNormalScopes(ctx, policy, authUi)
     }
 
     pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])

package/extensions/mcp/policy.ts

@@ -9,7 +9,7 @@ import * as path from 'node:path'
 import { claudeConfigDir } from '../internal/config-dir.js'
 import { managedSettingsFile } from '../internal/managed-settings.js'
 import { findNearestFile } from '../internal/project-root.js'
-import type { ServerConfig } from './config.js'
+import { interpolateEnv, type ServerConfig } from './config.js'
 
 export interface ProjectServerPolicy {
   disabled: Set<string>
@@ -60,31 +60,133 @@ export function splitByPolicy(candidates: Record<string, ServerConfig>, policy:
   return { consented, gated }
 }
 
-/** Claude's `allowedMcpServers`/`deniedMcpServers`, read from managed settings only
- * (not user or project settings, so a repo can neither widen nor narrow the policy),
- * applied globally to every server across scopes. Entries are `{ serverName }` objects
- * (bare strings tolerated). `allowed` is null when unset (no restriction); an empty
- * set is an explicit lockdown, as Claude documents (empty allow array = deny all). */
-export function mcpAllowDeny(managedFile: string = managedSettingsFile()): { allowed: Set<string> | null; denied: Set<string> } {
-  let settings: Record<string, unknown> = {}
-  try {
-    const parsed = JSON.parse(fs.readFileSync(managedFile, 'utf-8'))
-    if (parsed && typeof parsed === 'object') settings = parsed
-  } catch {
-    // No managed policy on this machine: no restriction.
-  }
-  const entryName = (entry: unknown): string | undefined => {
-    if (typeof entry === 'string') return entry
-    const serverName = (entry as { serverName?: unknown })?.serverName
-    return typeof serverName === 'string' ? serverName : undefined
+/** One allow/deny list entry, keyed by exactly one of Claude's three match kinds. */
+export interface McpPolicyEntry {
+  /** Exact user-assigned label; never expanded. */
+  serverName?: string
+  /** Remote server URL, exact or with `*` wildcards anywhere. */
+  serverUrl?: string
+  /** Exact command and arguments that start a stdio server. */
+  serverCommand?: string[]
+}
+
+export interface McpPolicy {
+  /** null when no honored scope sets allowedMcpServers: every server passing the denylist loads. */
+  allowed: McpPolicyEntry[] | null
+  denied: McpPolicyEntry[]
+}
+
+/** A raw list entry into its typed form. A bare string is a name (Claude tolerates it);
+ * an object is keyed serverUrl > serverCommand > serverName; anything else is dropped. */
+function parsePolicyEntry(entry: unknown): McpPolicyEntry | undefined {
+  if (typeof entry === 'string') return entry.length > 0 ? { serverName: entry } : undefined
+  if (entry === null || typeof entry !== 'object') return undefined
+  const { serverName, serverUrl, serverCommand } = entry as Record<string, unknown>
+  if (typeof serverUrl === 'string' && serverUrl.length > 0) return { serverUrl }
+  if (Array.isArray(serverCommand) && serverCommand.length > 0 && serverCommand.every((part): part is string => typeof part === 'string')) return { serverCommand: serverCommand as string[] }
+  if (typeof serverName === 'string' && serverName.length > 0) return { serverName }
+  return undefined
+}
+
+/** Claude's `allowedMcpServers`/`deniedMcpServers`. Both lists merge from every honored
+ * settings scope (the caller passes the trust-gated chain, so a repo's file counts only
+ * once the project is approved); managed `allowManagedMcpServersOnly: true` keeps only
+ * the managed allowlist, while the denylist always merges from every scope, as Claude
+ * documents. An allowlist `serverName` entry is limited to letters, numbers, hyphens and
+ * underscores (a denylist name accepts any non-empty string). `allowed` is null when no
+ * honored scope sets the key; an empty list is an explicit lockdown (deny all). */
+export function mcpAllowDeny(scopeFiles: string[] = [], managedFile: string = managedSettingsFile()): McpPolicy {
+  const read = (file: string): Record<string, unknown> => {
+    try {
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
+      return parsed && typeof parsed === 'object' ? parsed : {}
+    } catch {
+      // Missing or invalid file contributes no policy.
+      return {}
+    }
   }
-  const names = (value: unknown): string[] => (Array.isArray(value) ? value.map(entryName).filter((name): name is string => typeof name === 'string' && name.length > 0) : [])
+  const entries = (value: unknown): McpPolicyEntry[] => (Array.isArray(value) ? value.map(parsePolicyEntry).filter((entry): entry is McpPolicyEntry => entry !== undefined) : [])
+  const managed = read(managedFile)
+  const scopes = scopeFiles.map(read)
+  const allowSources = managed.allowManagedMcpServersOnly === true ? [managed] : [managed, ...scopes]
+  const allowSet = allowSources.some((settings) => Array.isArray(settings.allowedMcpServers))
   return {
-    allowed: Array.isArray(settings.allowedMcpServers) ? new Set(names(settings.allowedMcpServers)) : null,
-    denied: new Set(names(settings.deniedMcpServers)),
+    allowed: allowSet ? allowSources.flatMap((settings) => entries(settings.allowedMcpServers)).filter((entry) => entry.serverName === undefined || /^[A-Za-z0-9_-]+$/.test(entry.serverName)) : null,
+    denied: [managed, ...scopes].flatMap((settings) => entries(settings.deniedMcpServers)),
   }
 }
 
+/** `*` in a policy URL pattern matches any run of characters; everything else is literal. */
+function wildcardRegExp(pattern: string): RegExp {
+  const source = pattern
+    .split('*')
+    .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`))
+    .join('.*')
+  return new RegExp(`^${source}$`)
+}
+
+/** Claude's URL pattern match: `*` anywhere including the scheme; the scheme/host/port
+ * part compares case-insensitively and ignores a trailing FQDN dot, the path stays
+ * case-sensitive, and a pattern with no path matches any path. */
+export function urlPatternMatches(pattern: string, url: string): boolean {
+  const split = (value: string): { pre: string; path: string | undefined } => {
+    const schemeEnd = value.indexOf('://')
+    const slash = value.indexOf('/', schemeEnd === -1 ? 0 : schemeEnd + 3)
+    if (slash === -1) return { pre: value, path: undefined }
+    return { pre: value.slice(0, slash), path: value.slice(slash) }
+  }
+  const pre = (value: string): string => value.toLowerCase().replace(/\.(?=:\d+$|$)/, '')
+  const patternParts = split(pattern)
+  const urlParts = split(url)
+  if (!wildcardRegExp(pre(patternParts.pre)).test(pre(urlParts.pre))) return false
+  if (patternParts.path === undefined) return true
+  return wildcardRegExp(patternParts.path).test(urlParts.path ?? '/')
+}
+
+const configUrl = (config: ServerConfig): string | undefined => (config as { url?: string }).url
+const configArgv = (config: ServerConfig): string[] | undefined => {
+  const command = (config as { command?: string }).command
+  if (typeof command !== 'string') return undefined
+  const args = (config as { args?: unknown }).args
+  return [command, ...(Array.isArray(args) ? args.filter((part): part is string => typeof part === 'string') : [])]
+}
+const argvEqual = (a: string[], b: string[]): boolean => a.length === b.length && a.every((part, i) => part === b[i])
+/** Policy-side expansion. Divergence from Claude, documented: Claude expands policy
+ * entries from a pinned startup environment; pi-code expands from the live process env.
+ * The deny path compensates by also matching the unexpanded forms (see entryMatches),
+ * which can only widen a deny, never weaken it. */
+const expand = (value: string): string => interpolateEnv(value)
+
+/** Whether one policy entry matches a server. `includeRawForms` is the deny-side rule:
+ * raw and expanded forms both count, so expansion drift can only widen a deny. The
+ * allow side matches expanded forms only, mirroring Claude ignoring an allow entry
+ * whose expansion would change what it means. */
+function entryMatches(entry: McpPolicyEntry, name: string, config: ServerConfig, includeRawForms: boolean): boolean {
+  if (entry.serverUrl !== undefined) {
+    const url = configUrl(config)
+    if (url === undefined) return false
+    return urlPatternMatches(expand(entry.serverUrl), expand(url)) || (includeRawForms && urlPatternMatches(entry.serverUrl, url))
+  }
+  if (entry.serverCommand !== undefined) {
+    const argv = configArgv(config)
+    if (argv === undefined) return false
+    return argvEqual(entry.serverCommand.map(expand), argv.map(expand)) || (includeRawForms && argvEqual(entry.serverCommand, argv))
+  }
+  return entry.serverName === name
+}
+
+/** Claude's allowlist rule per server type: a remote server must match a `serverUrl`
+ * entry and a stdio server a `serverCommand` entry; a `serverName` match counts only
+ * when the allowlist contains no typed entries for that transport. */
+function serverAllowed(name: string, config: ServerConfig, allowed: McpPolicyEntry[] | null): boolean {
+  if (allowed === null) return true
+  const remote = configUrl(config) !== undefined
+  const typed = allowed.filter((entry) => (remote ? entry.serverUrl !== undefined : entry.serverCommand !== undefined))
+  if (typed.some((entry) => entryMatches(entry, name, config, false))) return true
+  if (typed.length > 0) return false
+  return allowed.some((entry) => entry.serverName === name)
+}
+
 /** The managed-mcp.json path: a sibling of managed-settings.json (same directory). Derived
  * through the same test seam so a test can write both into one temp dir. */
 export function managedMcpPath(managedFile: string = managedSettingsFile()): string {
@@ -126,14 +228,14 @@ export function loadManagedMcpServers(managedFile: string = managedSettingsFile(
   return servers as Record<string, ServerConfig>
 }
 
-/** Claude's managed allow/deny lists: `allowed` null means no allow list (keep all);
- * a set (even empty) is exclusive, so only its members survive; a deny list removes
- * servers on top, deny winning over allow. */
-export function applyServerPolicy(servers: Record<string, ServerConfig>, allowed: ReadonlySet<string> | null, denied: ReadonlySet<string>): Record<string, ServerConfig> {
+/** Claude's allow/deny lists: a denylist match by URL, command or name blocks, and
+ * nothing overrides it; then a null allowlist keeps all, while a present one (even
+ * empty) is exclusive per the typed rule in serverAllowed. */
+export function applyServerPolicy(servers: Record<string, ServerConfig>, policy: McpPolicy): Record<string, ServerConfig> {
   const out: Record<string, ServerConfig> = {}
   for (const [name, config] of Object.entries(servers)) {
-    if (denied.has(name)) continue
-    if (allowed !== null && !allowed.has(name)) continue
+    if (policy.denied.some((entry) => entryMatches(entry, name, config, true))) continue
+    if (!serverAllowed(name, config, policy.allowed)) continue
     out[name] = config
   }
   return out

package/extensions/mcp/transport.ts

@@ -144,7 +144,9 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
     // The SDK's WebSocket transport takes only a url: it carries no headers, bearer
     // token, or headersHelper output. Warn rather than silently dropping configured
     // auth, and skip the helper entirely (running it would block the connect for up to
-    // 10s while contributing nothing). A ws server must be reachable without auth.
+    // 10s while contributing nothing). Divergence: Claude documents header auth as the
+    // ws mechanism ("Authentication is header-only"); under pi an authenticated ws
+    // server cannot be used until the SDK transport grows header support.
     if (config.headers || config.bearerToken || config.bearerTokenEnv || config.headersHelper) {
       console.warn(`pi-code-mcp: server ${name} is a WebSocket server; the SDK ws transport is url-only, so its headers/bearerToken/headersHelper are ignored`)
     }

package/extensions/subagent/README.md

@@ -114,15 +114,16 @@ Claude Code fields map onto pi where a sensible seam exists: `tools` and
 `--exclude-tools`; `effort` becomes the `:thinking` suffix on a pinned model, or
 `--thinking` when no model is pinned;
 `permissionMode: plan` selects a read-only toolset unless `tools` is set. Model
-aliases (`sonnet`, `opus`, `haiku`) resolve against the models this machine is
-authenticated for, falling back to the session's default model when that tier is
+aliases (`sonnet`, `opus`, `haiku`, `fable`) resolve against the models this machine
+is authenticated for, falling back to the session's default model when that tier is
 unavailable; `inherit` is the session model by definition. `skills` names skills to preload: their bodies are inlined into the child's
 prompt, since a child pi process does not inherit the parent's skill discovery, and
 a name that resolves to nothing is reported in the prompt rather than dropped.
 Fields with no pi seam are ignored, each verified against pi's CLI rather than
-assumed: `maxTurns` (no turn-limit flag), `mcpServers` (a child reads MCP config
-from files, and writing config into the workspace to fake it would be worse than
-the gap), and `memory` (pi-code's memory is per project, not per agent).
+assumed: `mcpServers` (a child reads MCP config from files, and writing config
+into the workspace to fake it would be worse than the gap). `maxTurns` and
+`memory` are honored (turn cap enforced at the turn boundary; per-agent memory
+directories injected into the child's prompt).
 
 **Locations:**
 - `~/.claude/agents/*.md`, `~/.pi/agent/agents/*.md` - User-level (always loaded; `~/.pi` wins a name conflict)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.15",
+  "version": "1.0.16",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",