pi-code 1.0.2 → 1.0.4

package/README.md

@@ -46,7 +46,7 @@ One `pi install` and everything below loads on the next start. `pi list` shows w
 | MCP servers | user `~/.claude.json` (incl. per-project `projects[cwd]` local scope), `~/.pi/agent/mcp.json`; project `.mcp.json`, `.pi/mcp.json` (once approved; `enabledMcpjsonServers`/`disabledMcpjsonServers`/`enableAllProjectMcpServers` honored, consent keys only from non-repo settings); stdio/HTTP/SSE by `type`; `${VAR:-default}` expansion; `MCP_TIMEOUT`/`MCP_TOOL_TIMEOUT`; tools refresh on `list_changed` | `mcp.ts` |
 | Project trust | prompts before loading project config (MCP servers, hooks, agents, rules, output styles, commands, skills) that pi would otherwise trust silently | `internal/project-approval.ts` |
 | Subagents / Task | builtin Explore/Plan/general-purpose agents, `~/.claude/agents` and `~/.pi/agent/agents`, plus project `.claude/agents` and `.pi/agents`; agent roster with descriptions in the system prompt; `skills` preload; background runs with cancel and resume | `subagent/` |
-| Plan mode | `plan_mode_complete` tool, exact tool snapshot/restore | `plan-mode/` |
+| Plan mode | `plan_mode_complete` tool, tool snapshot/restore that survives `/reload` | `plan-mode/` |
 | Todo list | persistent overlay, status machine, compaction-safe | `todo.ts` |
 | Checkpoints / rewind | shadow-repo snapshots; restore overwrites checkpointed files, keeps files created later; 100 per session, repos pruned after 30 days | `git-checkpoint.ts` |
 | Persistent memory | per-project memories, index injected each session within Claude's 200-line/25KB bound; a save that would overflow it reports why | `memory.ts` |

package/extensions/commands.ts

@@ -86,9 +86,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // fire-and-forget, so the restore would land before the agent ever read the tool
     // list, leaving the command running with everything enabled.
     if (parsed.allowedTools) {
-      const saved = pi.getActiveTools()
-      pendingRestore = saved
-      pi.setActiveTools(parsed.allowedTools.filter((tool) => saved.includes(tool)))
+      // Only the first restriction in a turn sees the unrestricted set; a second
+      // command must grant and restore against that original set, or its own tools
+      // are intersected away by the first command's narrowing.
+      const original = pendingRestore ?? pi.getActiveTools()
+      pendingRestore = original
+      const granted = parsed.allowedTools.filter((tool) => original.includes(tool))
+      // `allowed-tools: []` says no tools, and is honored. A non-empty list that
+      // intersects to nothing named only tools pi has none of: that restriction cannot
+      // be expressed, and applying it as "no tools" is not what the command asked for.
+      if (granted.length > 0 || parsed.allowedTools.length === 0) pi.setActiveTools(granted)
     }
     pi.sendUserMessage(expanded)
   }

package/extensions/context-imports.ts

@@ -110,11 +110,14 @@ function readImport(target: string, fromDir: string, home: string, allowedRoots:
     return null
   }
   if (seen.has(real)) return null
-  seen.add(real)
   if (!isUnder(real, allowedRoots)) return null
   try {
     // real may be a directory (EISDIR) or vanish after the realpath (ENOENT/EACCES).
-    return { real, body: fs.readFileSync(real, 'utf-8') }
+    const body = fs.readFileSync(real, 'utf-8')
+    // Only a consumed file dedupes: marking a blocked or unreadable target seen
+    // would let one reader's failure suppress the import for a later, allowed one.
+    seen.add(real)
+    return { real, body }
   } catch {
     return null
   }

package/extensions/git-checkpoint.ts

@@ -137,12 +137,25 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     pruneCheckpointRepos(checkpointsRoot, CHECKPOINT_RETENTION_DAYS, shadowDir)
     const check = await pi.exec('git', ['--git-dir', shadowDir, 'rev-parse', '--git-dir'], { cwd: ctx.cwd })
     if (check.code !== 0) {
-      await pi.exec('git', ['init', '--bare', '-b', 'main', shadowDir], { cwd: ctx.cwd })
+      const init = await pi.exec('git', ['init', '--bare', '-b', 'main', shadowDir], { cwd: ctx.cwd })
+      if (init.code !== 0) {
+        // Every later snapshot fails against the missing repo, so without this the
+        // user first learns /rewind is dead at the moment they need it.
+        ctx.ui.notify(`Checkpoints disabled: ${init.stderr.trim() || 'git init failed'}`, 'warning')
+        return
+      }
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.email', 'checkpoint@pi-code'], { cwd: ctx.cwd })
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.name', 'pi-code-checkpoint'], { cwd: ctx.cwd })
     }
   }
 
+  /** `checkout -f <ref> -- .` errors when the ref's tree holds no files, so an empty
+   * snapshot restores as a no-op rather than vetoing the whole rewind. */
+  async function snapshotIsEmpty(ref: string): Promise<boolean> {
+    const files = await gitShadow(['ls-tree', '-r', '--name-only', ref])
+    return files.code === 0 && files.stdout.trim() === ''
+  }
+
   async function snapshot(): Promise<{ ref: string; createdAt: string } | undefined> {
     const createdAt = new Date().toISOString()
     const add = await gitShadow(['add', '-A'])
@@ -175,6 +188,10 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
       ctx.ui.notify('Checkpoint has no code snapshot; code left untouched', 'warning')
       return true
     }
+    if (await snapshotIsEmpty(checkpoint.ref)) {
+      ctx.ui.notify('Checkpoint has no files; code left untouched', 'warning')
+      return true
+    }
     const result = await gitShadow(['checkout', '-f', checkpoint.ref, '--', '.'])
     if (result.code !== 0) {
       ctx.ui.notify(`Code restore failed: ${result.stderr.trim()}`, 'warning')
@@ -248,6 +265,10 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
 
     const choice = await ctx.ui.select('Restore code state?', ['Yes, restore code to that point', 'No, keep current code'])
     if (choice?.startsWith('Yes')) {
+      if (await snapshotIsEmpty(checkpoint.ref)) {
+        ctx.ui.notify('Checkpoint has no files; code left untouched', 'warning')
+        return
+      }
       const result = await gitShadow(['checkout', '-f', checkpoint.ref, '--', '.'])
       ctx.ui.notify(result.code === 0 ? 'Code restored to checkpoint' : `Restore failed: ${result.stderr.trim()}`, result.code === 0 ? 'info' : 'warning')
     }

package/extensions/hooks.ts

@@ -78,6 +78,8 @@ export interface HookRunResult {
   stderr: string
   /** The hook was killed at its timeout, so its exit code carries no verdict. */
   timedOut: boolean
+  /** The process errored before delivering a verdict (spawn failure, EIO). */
+  spawnFailed?: boolean
 }
 export type HookRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string) => Promise<HookRunResult>
 
@@ -97,8 +99,14 @@ export function loadHooks(files: string[]): HooksConfig {
     } catch {
       continue
     }
-    for (const [event, matchers] of Object.entries(parsed.hooks ?? {})) {
-      if (Array.isArray(matchers)) config[event] = [...(config[event] ?? []), ...matchers]
+    for (const [event, matchers] of Object.entries(parsed?.hooks ?? {})) {
+      if (!Array.isArray(matchers)) continue
+      // Entries are validated here rather than where they run: a hand-edited settings
+      // file that writes `hooks` as an object instead of a list used to throw out of
+      // the tool_call handler, and pi turns that into an error result, so every tool
+      // call for the rest of the session failed with an opaque type error.
+      const usable = matchers.filter((entry) => isUsableMatcher(entry, file, event))
+      if (usable.length > 0) config[event] = [...(config[event] ?? []), ...usable]
     }
   }
   return config
@@ -124,6 +132,26 @@ function exactListApplies(matcher: string, names: readonly string[]): boolean {
   return names.some((name) => tokens.has(foldName(name)))
 }
 
+/** A matcher entry pi-code can run: an object whose `hooks` is a list. Anything else
+ * is reported by name and skipped, so one bad entry costs its own hooks, not the
+ * session's tool calls. */
+function isUsableMatcher(entry: unknown, file: string, event: string): entry is HookMatcher {
+  const candidate = entry as HookMatcher | null
+  if (candidate === null || typeof candidate !== 'object') {
+    console.warn(`pi-code-hooks: ignoring a non-object ${event} entry in ${file}`)
+    return false
+  }
+  if (candidate.hooks !== undefined && !Array.isArray(candidate.hooks)) {
+    console.warn(`pi-code-hooks: ignoring ${event} entry in ${file}: "hooks" must be a list`)
+    return false
+  }
+  if (candidate.matcher !== undefined && typeof candidate.matcher !== 'string') {
+    console.warn(`pi-code-hooks: ignoring ${event} entry in ${file}: "matcher" must be a string`)
+    return false
+  }
+  return true
+}
+
 function matcherApplies(matcher: string | undefined, names: readonly string[]): boolean {
   if (!matcher || matcher === '*') return true
   if (EXACT_MATCHER.test(matcher)) return exactListApplies(matcher, names)
@@ -239,7 +267,9 @@ export const runHookCommand: HookRunner = (command, payload, timeoutMs, projectD
       if (stderr.length < MAX_HOOK_OUTPUT) stderr += chunk
     })
     child.on('close', (code) => finish({ code: code ?? 0, stdout, stderr, timedOut: false }))
-    child.on('error', () => finish({ code: 0, stdout, stderr, timedOut: false }))
+    // Marked rather than silently read as a clean run: under fd exhaustion a
+    // deny-list guard that never spawned would otherwise pass as an allow.
+    child.on('error', (error) => finish({ code: 0, stdout, stderr: stderr || error.message, timedOut: false, spawnFailed: true }))
     // A hook that exits without reading stdin (e.g. `exit 2`) closes the pipe first,
     // so ignore EPIPE on this write rather than crashing the host process.
     child.stdin?.on('error', () => {})
@@ -268,21 +298,42 @@ function replaceRecord(target: Record<string, unknown>, next: Record<string, unk
   Object.assign(target, next)
 }
 
-/** Run PreToolUse hooks for a tool; the first blocking verdict wins. For MCP tools the
- * matcher sees both the pi name and the Claude alias, and the payload reports the alias,
- * which is the name a Claude-written hook script expects in tool_name. A hook's
- * hookSpecificOutput.updatedInput replaces the tool input in place before the permission
- * decision applies, and later hooks see the rewritten input in their payload. */
+/** Claude surfaces a hook error notice and the action proceeds; silence would read a
+ * guard that never ran as a clean allow. */
+function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[], notify?: SystemMessageSink): void {
+  if (!notify) return
+  for (const [i, result] of results.entries()) {
+    if (result.spawnFailed) notify(`Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}`)
+  }
+}
+
+/** Run PreToolUse hooks for a tool, in parallel as Claude does; the first blocking
+ * verdict in config order wins. For MCP tools the matcher sees both the pi name and
+ * the Claude alias, and the payload reports the alias, which is the name a
+ * Claude-written hook script expects in tool_name. Every hook sees the original
+ * tool input; hookSpecificOutput.updatedInput replaces the input in place as each
+ * hook completes, so with several rewrites the last to finish takes effect, which
+ * is Claude's documented (non-deterministic) behavior. */
 export async function runPreToolUse(config: HooksConfig, toolName: string, toolInput: unknown, runner: HookRunner, claudeName?: string, onSystemMessage?: SystemMessageSink): Promise<HookDecision> {
   const names = claudeName ? [toolName, claudeName] : [toolName]
-  for (const command of matchingCommands(config.PreToolUse, names)) {
-    const result = await runner(command.command, { hook_event_name: 'PreToolUse', tool_name: claudeName ?? toolName, tool_input: toolInput }, timeoutMs(command))
+  const commands = matchingCommands(config.PreToolUse, names)
+  const results = await Promise.all(
+    commands.map((command) =>
+      runner(command.command, { hook_event_name: 'PreToolUse', tool_name: claudeName ?? toolName, tool_input: toolInput }, timeoutMs(command)).then((result) => {
+        const updated = tryParseJson(result.stdout)?.hookSpecificOutput?.updatedInput
+        if (isRecord(updated) && isRecord(toolInput)) replaceRecord(toolInput, updated)
+        return result
+      }),
+    ),
+  )
+  surfaceHookFailures(commands, results, onSystemMessage)
+  for (const [i, result] of results.entries()) {
     // A killed hook never reached its verdict, and SIGKILL leaves a null exit code that
     // would otherwise read as a clean allow. Fail closed instead.
-    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}` }
-    if (onSystemMessage) surfaceSystemMessages([result], onSystemMessage)
-    const updated = tryParseJson(result.stdout)?.hookSpecificOutput?.updatedInput
-    if (isRecord(updated) && isRecord(toolInput)) replaceRecord(toolInput, updated)
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}` }
+  }
+  if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
+  for (const result of results) {
     const decision = interpretHookResult(result.code, result.stdout, result.stderr)
     if (decision.block) return decision
   }
@@ -317,14 +368,19 @@ function promptContext(stdout: string): string {
   return stdout.trim()
 }
 
-/** Run UserPromptSubmit hooks: the first blocking verdict wins; otherwise their
- * additional context is concatenated for injection ahead of the prompt. */
+/** Run UserPromptSubmit hooks, in parallel as Claude does: the first blocking
+ * verdict in config order wins; otherwise their additional context is concatenated
+ * in config order for injection ahead of the prompt. */
 export async function runUserPromptSubmit(config: HooksConfig, prompt: string, runner: HookRunner, onSystemMessage?: SystemMessageSink): Promise<PromptDecision> {
+  const commands = matchingCommands(config.UserPromptSubmit, 'UserPromptSubmit')
+  const results = await Promise.all(commands.map((command) => runner(command.command, { hook_event_name: 'UserPromptSubmit', prompt }, timeoutMs(command))))
+  surfaceHookFailures(commands, results, onSystemMessage)
+  for (const [i, result] of results.entries()) {
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}`, context: '' }
+  }
+  if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   const contexts: string[] = []
-  for (const command of matchingCommands(config.UserPromptSubmit, 'UserPromptSubmit')) {
-    const result = await runner(command.command, { hook_event_name: 'UserPromptSubmit', prompt }, timeoutMs(command))
-    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}`, context: '' }
-    if (onSystemMessage) surfaceSystemMessages([result], onSystemMessage)
+  for (const result of results) {
     const decision = interpretHookResult(result.code, result.stdout, result.stderr)
     if (decision.block) return { block: true, reason: decision.reason, context: '' }
     const context = promptContext(result.stdout)

package/extensions/internal/command-file.ts

@@ -12,6 +12,8 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 
+import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
+
 export interface ParsedCommand {
   description: string
   argumentHint?: string
@@ -39,30 +41,97 @@ const CLAUDE_TOOL_MAP: Record<string, string> = {
   grep: 'grep',
   glob: 'find',
   ls: 'ls',
+  // Claude's names for the tools this package registers itself. Without these a
+  // perfectly ordinary `allowed-tools: WebFetch, WebSearch` matched no pi tool and
+  // the intersection left the turn with nothing.
+  webfetch: 'web_fetch',
+  websearch: 'web_search',
+  todowrite: 'todo',
+  todoread: 'todo',
+  task: 'subagent',
+  askuserquestion: 'question',
+  exitplanmode: 'plan_mode_complete',
 }
 
+/**
+ * Claude scopes a grant to arguments: `Bash(git add:*)` allows exactly those commands.
+ * pi's active-tool list is per tool, with no argument dimension, so the scope is
+ * dropped and the base tool is granted. Keeping the scope in the name matched nothing
+ * when the list was intersected with the active tools, which left a command declaring
+ * only scoped grants running with no tools at all.
+ */
 export function normalizeToolName(name: string): string {
   const lower = name.trim().toLowerCase()
-  return CLAUDE_TOOL_MAP[lower] ?? lower
+  const scope = lower.indexOf('(')
+  const base = (scope === -1 ? lower : lower.slice(0, scope)).trim()
+  return CLAUDE_TOOL_MAP[base] ?? base
+}
+
+/**
+ * Entries are comma-separated, except a comma inside an argument scope belongs to the
+ * scope: `Bash(cat, tail)` is one grant, not three. Splitting on every comma made the
+ * fragments between them top-level entries, so a command naming only `Bash` came away
+ * with pi's `edit` tool active.
+ *
+ * Scanned rather than matched with a regex: the pattern form is quadratic on an input
+ * of unclosed parens, and a command file comes from the repository.
+ */
+export function toolEntries(raw: string): string[] {
+  const entries: string[] = []
+  let current = ''
+  let depth = 0
+  for (const ch of raw) {
+    if (ch === '(') depth++
+    else if (ch === ')') depth = Math.max(0, depth - 1)
+    if (ch === ',' && depth === 0) {
+      entries.push(current)
+      current = ''
+    } else {
+      current += ch
+    }
+  }
+  entries.push(current)
+  return entries.map((entry) => entry.trim()).filter(Boolean)
+}
+
+/**
+ * A tool grant is either a comma-separated string or a YAML list, and the two mean the
+ * same thing. An empty list is not the same as an absent one: it says no tools, so it
+ * comes back as an empty array rather than undefined.
+ */
+export function parseToolList(raw: unknown): string[] | undefined {
+  if (raw === undefined || raw === null) return undefined
+  let items: unknown[]
+  if (Array.isArray(raw)) items = raw
+  else if (typeof raw === 'string') items = toolEntries(raw)
+  else return undefined
+  if (items.some((item) => typeof item !== 'string')) return undefined
+  return [...new Set((items as string[]).map(normalizeToolName).filter(Boolean))]
 }
 
-function field(frontmatter: string, key: string): string {
-  const match = new RegExp(String.raw`^\s*${key}\s*:\s*(.+)$`, 'm').exec(frontmatter)
-  return match ? match[1].trim().replace(/^["']|["']$/g, '') : ''
+/** YAML types a bare scalar, so a model named `3.5` arrives as a number, not a string. */
+const text = (value: unknown): string => {
+  if (typeof value === 'string') return value.trim()
+  return typeof value === 'number' || typeof value === 'boolean' ? String(value) : ''
 }
 
+/** Claude writes `argument-hint: [pr]`, which YAML reads as a list; render it back. */
+const hint = (value: unknown): string => (Array.isArray(value) ? `[${value.join(', ')}]` : text(value))
+
 export function parseCommandFile(content: string): ParsedCommand {
-  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content)
-  const frontmatter = match ? match[1] : ''
-  const body = (match ? content.slice(match[0].length) : content).trim()
-  const tools = field(frontmatter, 'allowed-tools')
+  // pi's own parser, rather than a hand-rolled one: it reads the YAML shapes Claude
+  // command files actually use (flow sequences, block lists, quoted and multi-line
+  // values), and a value this misreads is a restriction silently not applied.
+  const { frontmatter, body: raw } = parseFrontmatter(content)
+  const body = raw.trim()
   const firstLine = body.split('\n').find((line) => line.trim().length > 0) ?? ''
+  const disable = frontmatter['disable-model-invocation']
   return {
-    description: field(frontmatter, 'description') || firstLine.slice(0, 60),
-    argumentHint: field(frontmatter, 'argument-hint') || undefined,
-    allowedTools: tools ? tools.split(',').map(normalizeToolName).filter(Boolean) : undefined,
-    model: field(frontmatter, 'model') || undefined,
-    disableModelInvocation: field(frontmatter, 'disable-model-invocation') === 'true',
+    description: text(frontmatter.description) || firstLine.slice(0, 60),
+    argumentHint: hint(frontmatter['argument-hint']) || undefined,
+    allowedTools: parseToolList(frontmatter['allowed-tools']),
+    model: text(frontmatter.model) || undefined,
+    disableModelInvocation: disable === true || text(disable) === 'true',
     body,
   }
 }
@@ -79,16 +148,21 @@ export function splitArgs(args: string): string[] {
   return out
 }
 
-/** Claude's substitutions: `$ARGUMENTS`, `$@`, `$1`..`$n`, `${n:-default}`. An
- * unfilled positional becomes empty rather than leaking its literal token. */
+/** Claude's substitutions: `$ARGUMENTS`, `$@`, `$1`..`$n`, `${n:-default}`, and `\$`
+ * for a literal dollar. An unfilled positional becomes empty rather than leaking its
+ * literal token. One pass with a replacer function: sequential string passes both
+ * interpreted `$&`-style metacharacters in the arguments and re-scanned substituted
+ * text, so `$` sequences the user typed were consumed as tokens. */
 export function substituteArgs(body: string, args: string): string {
   const parts = splitArgs(args)
-  return body
-    .replaceAll(/\$\{(\d+):-([^}]*)\}/g, (_m, index: string, fallback: string) => parts[Number(index) - 1] ?? fallback)
-    .replaceAll(/\$\{ARGUMENTS:-([^}]*)\}/g, (_m, fallback: string) => (args.trim() ? args.trim() : fallback))
-    .replaceAll(/\$ARGUMENTS\b/g, args.trim())
-    .replaceAll('$@', args.trim())
-    .replaceAll(/\$(\d+)/g, (_m, index: string) => parts[Number(index) - 1] ?? '')
+  const all = args.trim()
+  return body.replaceAll(/\\\$|\$\{(\d+):-([^}]*)\}|\$\{ARGUMENTS:-([^}]*)\}|\$ARGUMENTS\b|\$@|\$(\d+)/g, (token, index?: string, fallback?: string, argsFallback?: string, position?: string) => {
+    if (token === '\\$') return '$'
+    if (index !== undefined) return parts[Number(index) - 1] ?? fallback ?? ''
+    if (argsFallback !== undefined) return all || argsFallback
+    if (position !== undefined) return parts[Number(position) - 1] ?? ''
+    return all
+  })
 }
 
 /** `a/b/c.md` becomes Claude's `a:b:c`. */
@@ -170,12 +244,17 @@ export async function expandDynamicContent(body: string, cwd: string, exec: Comm
     bashMatch = bashPattern.exec(body)
   }
 
-  let expanded = body
+  // Splice by recorded position: a textual replace would interpret `$` sequences in
+  // the command's output and could hit an identical fenced copy of the span instead.
+  let expanded = ''
+  let cursor = 0
   for (const entry of commands) {
     const result = await exec(entry.command)
     const output = result.code === 0 ? result.stdout.trimEnd() : `(command failed: ${entry.command})\n${result.stderr.trim() || result.stdout.trim()}`
-    expanded = expanded.replace(entry.span, output)
+    expanded += body.slice(cursor, entry.index) + output
+    cursor = entry.index + entry.span.length
   }
+  expanded += body.slice(cursor)
 
   // Ranges are recomputed: command output can change offsets.
   const fencedAfter = fencedRanges(expanded)

package/extensions/internal/output-guard.ts

@@ -12,11 +12,22 @@
 
 import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '@earendil-works/pi-coding-agent'
 
+/**
+ * Trim `text` to a byte budget. `String.slice` counts UTF-16 units, so slicing a CJK
+ * string by a byte budget keeps up to three times the bytes asked for; cutting the
+ * encoded buffer is exact. A character straddling the cut decodes to U+FFFD.
+ * Shorter input comes back whole and a negative budget yields nothing, so callers
+ * need no length check of their own.
+ */
+export function sliceBytes(text: string, maxBytes: number): string {
+  return Buffer.from(text, 'utf-8').subarray(0, Math.max(0, maxBytes)).toString('utf-8')
+}
+
 /** Trim `text` to pi's documented tool-output budget, noting what was dropped. */
 export function capForContext(text: string): string {
   const cut = truncateHead(text, { maxLines: DEFAULT_MAX_LINES, maxBytes: DEFAULT_MAX_BYTES })
   if (!cut.truncated) return text
-  const kept = cut.content || text.slice(0, DEFAULT_MAX_BYTES)
+  const kept = cut.content || sliceBytes(text, DEFAULT_MAX_BYTES)
   const capped = `${kept}\n\n[truncated: ${formatSize(cut.totalBytes)} total, ${cut.totalLines} lines]`
   // Just over the budget, the notice can cost more than the trim saves.
   return capped.length < text.length ? capped : text

package/extensions/internal/project-approval.ts

@@ -37,8 +37,25 @@ const CLAUDE_SHAPED = [
   path.join('.pi', 'agents'),
 ]
 
+/** Markers that end the upward walk, matching the subagent's own discovery bound. */
+const ROOT_MARKERS = ['.git', 'package.json']
+
+/** Claude-shaped config anywhere between `cwd` and the repository root.
+ *
+ * The walk matters: agent discovery already searches upward, so starting pi in a
+ * subdirectory of a repository whose `.claude/agents` sits at the root found those
+ * agents while a cwd-only check reported nothing to gate, and the short-circuit
+ * approved the project without ever asking. The bound is the repository root, so a
+ * directory outside any repository never inherits a parent's config. */
 export function hasClaudeShapedConfig(cwd: string): boolean {
-  return CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(cwd, entry)))
+  let currentDir = cwd
+  while (true) {
+    if (CLAUDE_SHAPED.some((entry) => fs.existsSync(path.join(currentDir, entry)))) return true
+    if (ROOT_MARKERS.some((marker) => fs.existsSync(path.join(currentDir, marker)))) return false
+    const parentDir = path.dirname(currentDir)
+    if (parentDir === currentDir) return false
+    currentDir = parentDir
+  }
 }
 
 export interface ApprovalContext {

package/extensions/mcp.ts

@@ -22,6 +22,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
+import { DEFAULT_MAX_BYTES } from '@earendil-works/pi-coding-agent'
 import { Client } from '@modelcontextprotocol/sdk/client/index.js'
 // SSE is deprecated in favour of Streamable HTTP, but the SDK notes servers still on
 // the old spec exist, so this stays as a fallback for the migration period.
@@ -222,12 +223,14 @@ export type ToolContent = { type: 'text'; text: string } | { type: 'image'; data
 export function mapContent(content: McpContentBlock[] | undefined, structured?: unknown): ToolContent[] {
   // capForContext every text output, whatever its source: a server can blow the tool-output
   // budget through a resource block, a JSON-stringified block, or the structured fallback,
-  // not only a text block.
+  // not only a text block. The per-block cap alone is not a budget, though: a server
+  // answering with one block per file multiplies it by the block count, so the blocks
+  // are capped again as a whole below.
   const text = (value: string): ToolContent => ({ type: 'text', text: capForContext(value) })
   if (!content || content.length === 0) {
     return [text(structured !== undefined ? JSON.stringify(structured, null, 2) : '(empty result)')]
   }
-  return content.map((block) => {
+  const mapped: ToolContent[] = content.map((block): ToolContent => {
     if (block.type === 'text') {
       return text(block.text ?? '')
     }
@@ -239,6 +242,50 @@ export function mapContent(content: McpContentBlock[] | undefined, structured?:
     }
     return text(JSON.stringify(block))
   })
+  return capTotal(mapped)
+}
+
+/**
+ * Bound a result's text as a whole, not each block. The per-block cap multiplies by
+ * the block count, so a server answering with one block per file still injects
+ * megabytes.
+ *
+ * Blocks are kept whole. Each has already been capped on its own, so keeping the one
+ * that crosses the budget bounds the text at roughly a single cap rather than at the
+ * block count times it, and it preserves that block's own truncation notice, which
+ * states how much of it was dropped. Blocks after it are omitted rather than skipped
+ * over, so what reaches the model is a prefix of what the server sent, and the number
+ * omitted is stated so a truncated set is distinguishable from a complete one.
+ *
+ * Images pass through uncut and do not spend the budget: base64 cut short is a broken
+ * image rather than a smaller one, so nothing here can bound them, and charging the
+ * budget for one would only delete the caption that accompanies a screenshot.
+ */
+export function capTotal(blocks: ToolContent[]): ToolContent[] {
+  const kept: ToolContent[] = []
+  let spent = 0
+  let full = false
+  let dropped = 0
+  for (const block of blocks) {
+    if (block.type !== 'text') {
+      kept.push(block)
+      continue
+    }
+    const size = Buffer.byteLength(block.text, 'utf-8')
+    // The first text block always goes through: a lone oversized one is better read
+    // truncated, with its own notice, than replaced by a marker saying it existed.
+    if (full || (spent > 0 && spent + size > DEFAULT_MAX_BYTES)) {
+      full = true
+      dropped++
+      continue
+    }
+    kept.push(block)
+    spent += size
+  }
+  if (dropped > 0) {
+    kept.push({ type: 'text', text: `[${dropped} further content block${dropped === 1 ? '' : 's'} omitted: tool output budget spent]` })
+  }
+  return kept
 }
 
 function isStdio(config: ServerConfig): config is StdioServerConfig {
@@ -379,7 +426,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           if (result.isError) {
             details.error = 'tool_error'
             const hint = JSON.stringify(normalizeSchema(tool.inputSchema))
-            content.push({ type: 'text', text: `Tool reported an error. Expected input schema: ${hint}` })
+            content.push({ type: 'text', text: capForContext(`Tool reported an error. Expected input schema: ${hint}`) })
           }
           return { content, details }
         },
@@ -411,6 +458,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   }
 
   async function connectServers(servers: Record<string, ServerConfig>): Promise<void> {
+    const pending: [string, ServerConfig][] = []
     for (const [name, config] of Object.entries(servers)) {
       // A later scope must not take the name of a server that already connected: it
       // would evict that client from the map, leaking it at shutdown, and misreport
@@ -419,18 +467,42 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         console.warn(`pi-code-mcp: skipping duplicate server name ${name}`)
         continue
       }
-      warnOnTypelessUrl(name, config)
-      try {
-        const client = await connect(name, config)
-        clients.set(name, client)
-        const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-        const count = registerTools(name, config, client, tools)
-        subscribeToToolChanges(name, config, client)
-        status.set(name, { state: 'connected', tools: count })
-      } catch (error) {
-        status.set(name, { state: `failed: ${error instanceof Error ? error.message : String(error)}`, tools: 0 })
-      }
+      // Seed in config order before connecting: parallel connects settle in completion
+      // order, and /mcp plus the session summary iterate the map's insertion order.
+      status.set(name, { state: 'connecting', tools: 0 })
+      pending.push([name, config])
     }
+    await Promise.all(
+      pending.map(async ([name, config]) => {
+        warnOnTypelessUrl(name, config)
+        try {
+          const client = await connect(name, config)
+          clients.set(name, client)
+          const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
+          const count = registerTools(name, config, client, tools)
+          subscribeToToolChanges(name, config, client)
+          status.set(name, { state: 'connected', tools: count })
+          // A server that dies mid-session would otherwise stay "connected" in /mcp
+          // while every call fails with the SDK's bare "Not connected"; flip the
+          // status and free the name so a later session start can reconnect it.
+          client.onclose = () => {
+            if (clients.get(name) !== client) return
+            clients.delete(name)
+            status.set(name, { state: 'disconnected', tools: 0 })
+          }
+        } catch (error) {
+          status.set(name, { state: `failed: ${error instanceof Error ? error.message : String(error)}`, tools: 0 })
+          // Connected but failed after (tool listing hung or errored): left in the
+          // map, the client idles its process for the whole session and the
+          // duplicate-name guard blocks the name for every later attempt.
+          const leaked = clients.get(name)
+          if (leaked) {
+            clients.delete(name)
+            void leaked.close().catch(() => {})
+          }
+        }
+      }),
+    )
   }
 
   /** Connect the project scope under the per-server policy. Returns whether the scope
@@ -447,16 +519,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return true
   }
 
-  let userConnected = false
   let projectConnected = false
 
   pi.on('session_start', async (_event, ctx) => {
     // Connecting spawns processes and opens sockets, so it belongs here rather than in
     // the factory: pi runs the factory for invocations that never start a session.
-    if (!userConnected) {
-      userConnected = true
-      await connectServers(loadUserScope(os.homedir(), ctx.cwd))
-    }
+    // Names still connected are filtered out, so a later session start only retries
+    // servers that failed or whose transport dropped, without duplicate-name warnings.
+    const userServers = Object.fromEntries(Object.entries(loadUserScope(os.homedir(), ctx.cwd)).filter(([name]) => !clients.has(name)))
+    if (Object.keys(userServers).length > 0) await connectServers(userServers)
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once
     // the project is trusted. Per-server settings refine that: disabled servers never
     // connect, servers the user consented to individually connect without the