pi-code 1.0.23 → 1.0.25

package/extensions/claude-rules.ts

@@ -21,8 +21,10 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { claudeMdExcludeFiles, isExcludedPath, readClaudeMdExcludes } from './context-imports.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { publishInstructionLoad } from './internal/instruction-events.js'
+import { readManagedSettings } from './internal/managed-settings.js'
 import { type CompiledGlob, compileGlobs, matchesCompiledGlobs } from './internal/path-rules.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { findNearestDir } from './internal/project-root.js'
@@ -147,12 +149,36 @@ interface RuleSet {
 
 const EMPTY_RULES: RuleSet = { inline: [], scoped: [] }
 
+/** The canonical form of a path. A target that does not exist yet (a write
+ * creating a new file) canonicalises its nearest existing ancestor and keeps the
+ * remaining segments, so both sides of the attach match compare realpaths even
+ * for brand-new files in a symlinked checkout. */
+function realpathOr(target: string): string {
+  try {
+    return fs.realpathSync(target)
+  } catch {
+    const dir = path.dirname(target)
+    if (dir === target) return target
+    return path.join(realpathOr(dir), path.basename(target))
+  }
+}
+
 /** Unscoped rules are inlined; path-scoped ones keep their scope as pointers,
- * mirroring Claude Code, where scoped rules attach only to matching files. */
-function readRules(rulesDir: string): RuleSet {
+ * mirroring Claude Code, where scoped rules attach only to matching files. Files
+ * matching `claudeMdExcludes` are skipped entirely, as the docs' monorepo recipe
+ * (excluding another team's `.claude/rules/**`) relies on; the check runs on the
+ * realpath so a symlink cannot dodge an exclusion. */
+function readRules(rulesDir: string, isExcluded?: (realPath: string) => boolean): RuleSet {
   const inline: string[] = []
   const scoped: ScopedRule[] = []
   for (const file of findMarkdownFiles(rulesDir)) {
+    if (isExcluded) {
+      // Both spellings count: a glob written against the lexical path and one
+      // written against the resolved real path each exclude, which can only
+      // widen an exclusion, never dodge one.
+      const lexical = path.join(rulesDir, file)
+      if (isExcluded(lexical) || isExcluded(realpathOr(lexical))) continue
+    }
     let parsed: Frontmatter
     try {
       parsed = parseFrontmatter(fs.readFileSync(path.join(rulesDir, file), 'utf-8'))
@@ -223,15 +249,20 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
   let attachTargets: AttachTarget[] = []
 
   pi.on('session_start', async (_event, ctx) => {
-    globalRules = readRules(globalRulesDir)
     // Project rules are repository text landing in the system prompt, so they load
     // only once the project is approved. isProjectTrusted alone is true for a repo
     // pi never asked about; see project-approval.
     const approved = await isProjectApproved(ctx)
+    // Claude's claudeMdExcludes covers rules files too (the docs' monorepo recipe
+    // excludes another team's .claude/rules/**), so the same merged glob list the
+    // context loader honors gates rule files here.
+    const excludeGlobs = readClaudeMdExcludes(claudeMdExcludeFiles(ctx.cwd, os.homedir(), approved), readManagedSettings())
+    const isExcluded = (realPath: string): boolean => isExcludedPath(realPath, excludeGlobs, os.homedir())
+    globalRules = readRules(globalRulesDir, isExcluded)
     // Nearest at-or-above cwd, so a subdirectory session still reads the rules the
     // approval walk gated on.
     const projectRulesDir = approved ? findNearestDir(ctx.cwd, path.join('.claude', 'rules')) : null
-    projectRules = projectRulesDir ? readRules(projectRulesDir) : EMPTY_RULES
+    projectRules = projectRulesDir ? readRules(projectRulesDir, isExcluded) : EMPTY_RULES
 
     // Global globs are relative to cwd; project globs to the project root (the dir
     // holding .claude), so `db/**` in a repo rule matches repo-relative paths even
@@ -239,8 +270,8 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     // than on every tool result; rebuilt per session so a re-run re-attaches.
     const projectRoot = projectRulesDir ? path.dirname(path.dirname(projectRulesDir)) : ctx.cwd
     attachTargets = [
-      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
-      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
+      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(ctx.cwd), file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
+      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(projectRoot), file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
     ]
     pendingScopedRules = attachTargets.length
     // Relative to cwd, which the read tool resolves: an ancestor dir yields a
@@ -274,7 +305,9 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     if (event.toolName !== 'read' && event.toolName !== 'edit' && event.toolName !== 'write') return
     const rel = (event.input as { path?: unknown } | undefined)?.path
     if (typeof rel !== 'string' || rel.length === 0) return
-    const abs = path.resolve(ctx.cwd, rel)
+    // Realpath both sides (roots canonicalise at session_start): a tool reporting
+    // the resolved real path in a symlinked checkout must still match.
+    const abs = realpathOr(path.resolve(ctx.cwd, rel))
 
     const bodies: string[] = []
     const remaining: AttachTarget[] = []

package/extensions/hooks/index.ts

@@ -95,7 +95,7 @@ import { claudeToolInput, claudeToolName, claudeToolResponse, piToolOutput } fro
 import { formatHooksSummary, type HookCommand, type HookMatcher, type HooksConfig, hookFiles, isBackgroundHook, loadHooks, loadPluginHooks, readAllowedHttpHookUrls, readDisableAllHooks } from './config.js'
 import { blockedToolCall, jsonBlockVerdict, postToolFeedback, promptContext, runPreToolUse, runUserPromptSubmit, surfaceSystemMessages, tryParseJson } from './decisions.js'
 import { allCommands, matchingCommands, passesIfFilter } from './matcher.js'
-import { type HookRunner, type HookRunResult, runAgentHook, runHookCommand, runHttpHook, runMcpToolHook, runPromptHook, timeoutMs } from './runners.js'
+import { type HookRunner, type HookRunResult, runAgentHook, runHookCommand, runHttpHook, runMcpToolHook, runPromptHook, sessionEndTimeoutMs, timeoutMs } from './runners.js'
 
 export * from './config.js'
 export * from './decisions.js'
@@ -185,6 +185,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
     if (ctx.thinkingLevel) common.effort = { level: ctx.thinkingLevel }
     return common
   }
+  /** Claude's prompt-hook `model` override, resolved against the models this user
+   * can run (exact id first, then a substring match); the session model otherwise. */
+  const resolveHookModel = (ctx: ExtensionContext, override: string | undefined): ExtensionContext['model'] => {
+    if (!override) return ctx.model
+    const available = (ctx as { modelRegistry?: { getAvailable?: () => ReadonlyArray<{ id: string; name?: string }> } }).modelRegistry?.getAvailable?.() ?? []
+    const needle = override.toLowerCase()
+    const match = available.find((model) => model.id.toLowerCase() === needle) ?? available.find((model) => model.id.toLowerCase().includes(needle) || model.name?.toLowerCase().includes(needle))
+    return (match as ExtensionContext['model']) ?? ctx.model
+  }
+
   /** Kills for background hooks still running; Claude kills async hooks at teardown,
    * so session_shutdown reaps anything left rather than let a hung hook pin the
    * event loop past a one-shot run's end. */
@@ -220,7 +230,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
       const merged = { ...commonPayload(ctx), ...extra, ...(payload as Record<string, unknown>) }
       const dispatch = (onChild?: (kill: () => void) => void): Promise<HookRunResult> => {
         if (hook.type === 'http') return runHttpHook(hook, merged, ms, allowedHttpHookUrls)
-        if (hook.type === 'prompt') return runPromptHook(hook, merged, ctx.model, ms)
+        if (hook.type === 'prompt') return runPromptHook(hook, merged, resolveHookModel(ctx, hook.model), ms)
         if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
         if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
         return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild)
@@ -483,6 +493,14 @@ export default function hooksExtension(pi: ExtensionAPI) {
       stopHookActive = false
       return
     }
+    // Claude: Stop does not run when the stoppage was a user interrupt; pi marks
+    // the aborted turn's final assistant message stopReason "aborted".
+    const turnMessages = (event as { messages?: Array<{ role: string; stopReason?: string }> }).messages ?? []
+    const lastAssistant = [...turnMessages].reverse().find((message) => message.role === 'assistant')
+    if (lastAssistant?.stopReason === 'aborted') {
+      stopHookActive = false
+      return
+    }
     // Claude's Stop payload carries the turn's final assistant text so a hook need
     // not re-read the transcript; included only when there is one.
     const lastText = lastAssistantText((event as { messages?: Array<{ role: string; content: unknown }> }).messages ?? [])
@@ -543,7 +561,11 @@ export default function hooksExtension(pi: ExtensionAPI) {
 
   pi.on('session_shutdown', async (event, ctx) => {
     const reason = claudeSpelling(SESSION_END_REASON, event.reason)
-    const results = await runNotifyHooks(matchingCommands(config.SessionEnd, reason.names), { hook_event_name: 'SessionEnd', reason: reason.value }, boundRunner(ctx))
+    // SessionEnd rides Claude's short shared budget (see sessionEndTimeoutMs) so a
+    // slow hook cannot stall session exit, /new or /resume.
+    const sessionEndCommands = matchingCommands(config.SessionEnd, reason.names).filter((command) => passesIfFilter(command, undefined))
+    const runner = boundRunner(ctx)
+    const results = await Promise.all(sessionEndCommands.map((command) => runner(command, { hook_event_name: 'SessionEnd', reason: reason.value }, sessionEndTimeoutMs(command))))
     surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
     // Claude kills async hooks still running at teardown; the session that spawned
     // these is over, and their delivery would target a disposed context anyway.

package/extensions/hooks/runners.ts

@@ -20,6 +20,12 @@ import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
 // raise their own per-hook `timeout`.
 const DEFAULT_TIMEOUT_S = 60
 
+/** Claude's per-type defaults where they are safe to mirror: 30s for `prompt`
+ * hooks and 60s for `agent` hooks. Command/http/mcp_tool keep the flat 60s
+ * documented divergence from Claude's 600 (a gated hook fails closed here, so ten
+ * minutes of default budget would wedge the turn). */
+const TYPE_DEFAULT_TIMEOUT_S: Record<string, number> = { prompt: 30, agent: 60 }
+
 export interface HookRunResult {
   code: number
   stdout: string
@@ -49,10 +55,20 @@ export function timeoutMs(command: HookCommand): number {
   // Non-positive values fall back to the default: a 0ms timer would fire before the
   // hook runs, and a timed-out PreToolUse hook fails closed, bricking the tool.
   const declared = command.timeout
-  const seconds = typeof declared === 'number' && declared > 0 ? Math.min(declared, MAX_TIMEOUT_S) : DEFAULT_TIMEOUT_S
+  const fallback = TYPE_DEFAULT_TIMEOUT_S[command.type ?? 'command'] ?? DEFAULT_TIMEOUT_S
+  const seconds = typeof declared === 'number' && declared > 0 ? Math.min(declared, MAX_TIMEOUT_S) : fallback
   return seconds * 1000
 }
 
+/** Claude's SessionEnd budget: hooks share 1.5 seconds so session exit (and /new,
+ * /resume) cannot stall on a slow hook; a declared per-hook `timeout` raises the
+ * budget to match, up to 60 seconds. */
+export function sessionEndTimeoutMs(command: HookCommand): number {
+  const declared = command.timeout
+  if (typeof declared === 'number' && declared > 0) return Math.min(declared, 60) * 1000
+  return 1500
+}
+
 /** Memory backstop for a runaway hook. A decision payload is orders of magnitude smaller. */
 const MAX_HOOK_OUTPUT = 1_000_000
 
@@ -217,7 +233,11 @@ export async function runPromptHook(hook: HookCommand, payload: unknown, model:
   if (!model) return { code: 1, stdout: '', stderr: 'no model available for prompt hook', timedOut: false }
   // A replacer function, so `$$`/`$&`/`` $` ``/`$'` inside the payload JSON are inserted
   // verbatim rather than read as replacement patterns (a Bash `echo $$` is a common trigger).
-  const prompt = substituteArguments(hook.prompt, payload)
+  // Claude: when $ARGUMENTS is not present, the input JSON is appended to the
+  // prompt, so the model never evaluates blind.
+  const template = hook.prompt ?? ''
+  const withInput = template.includes('$ARGUMENTS') ? template : `${template}\n\n$ARGUMENTS`
+  const prompt = substituteArguments(withInput, payload)
   const signal = AbortSignal.timeout(timeoutMs)
   try {
     const { text: answer } = await completeText(model, prompt, { system: PROMPT_HOOK_SYSTEM, maxTokens: 512, signal })

package/extensions/internal/path-rules.ts

@@ -7,8 +7,10 @@
  * root (the settings source), and bare or `./` from the current directory. As
  * allow rules, a single-segment directory pattern anchors at cwd; a bare
  * filename matches at any depth. `*` stays within one segment, `**` crosses
- * directories. Matching is lexical, on resolved paths; bracket expressions are
- * not supported and match literally, which can only over-block, never widen.
+ * directories. Matching is lexical, on resolved paths. Bracket expressions parse
+ * per Claude's documented glob contract: `[abc]` classes with ranges and `!`
+ * negation, an unreadable `[` making the pattern match nothing, and `\[` for a
+ * literal bracket.
  */
 
 import * as path from 'node:path'
@@ -79,26 +81,63 @@ function expandBraces(pattern: string): string[] | null {
   return expanded
 }
 
-/** One glob pattern, braces already expanded, as a regular expression source. */
-function translateGlob(pattern: string): string {
+/** The end index of a bracket expression starting at `start` (`[`), or -1 when it
+ * cannot be read as one, which per Claude makes the whole pattern invalid. A `]`
+ * directly after the opening (or after a leading negation) is a literal member. */
+function bracketEnd(pattern: string, start: number): number {
+  let i = start + 1
+  if (pattern[i] === '!' || pattern[i] === '^') i += 1
+  if (pattern[i] === ']') i += 1
+  for (; i < pattern.length; i += 1) {
+    if (pattern[i] === ']') return i
+  }
+  return -1
+}
+
+/** A bracket expression body as a regex character class, escaping regex-relevant
+ * characters while keeping `-` ranges; a leading `!` (or `^`) negates. */
+function bracketClass(body: string): string {
+  const negated = body.startsWith('!') || body.startsWith('^')
+  const members = (negated ? body.slice(1) : body).replace(/[\\\]^]/g, (ch) => `\\${ch}`)
+  return `[${negated ? '^' : ''}${members}]`
+}
+
+/** A `*` run starting at `i`: a double star followed by a slash spans whole
+ * directories, a bare double star crosses segments, and a single `*` stays within
+ * one. Returns the regex source and the index after the run. */
+function translateStar(pattern: string, i: number): { source: string; next: number } {
+  if (pattern[i + 1] === '*') {
+    const prevSlash = i === 0 || pattern[i - 1] === '/'
+    if (prevSlash && pattern[i + 2] === '/') return { source: '(?:[^/]+/)*', next: i + 3 }
+    return { source: '.*', next: i + 2 }
+  }
+  return { source: '[^/]*', next: i + 1 }
+}
+
+function translateGlob(pattern: string): string | null {
   let out = ''
   let i = 0
   while (i < pattern.length) {
     const ch = pattern[i]
+    // Claude: to match a literal bracket, escape it; the escape consumes both chars.
+    if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) {
+      out += escapeRegExp(pattern[i + 1])
+      i += 2
+      continue
+    }
+    // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be
+    // read as one makes the pattern invalid, matching nothing.
+    if (ch === '[') {
+      const end = bracketEnd(pattern, i)
+      if (end === -1) return null
+      out += bracketClass(pattern.slice(i + 1, end))
+      i = end + 1
+      continue
+    }
     if (ch === '*') {
-      if (pattern[i + 1] === '*') {
-        const prevSlash = i === 0 || pattern[i - 1] === '/'
-        if (prevSlash && pattern[i + 2] === '/') {
-          out += '(?:[^/]+/)*' // `**/` spans zero or more whole directories
-          i += 3
-          continue
-        }
-        out += '.*'
-        i += 2
-        continue
-      }
-      out += '[^/]*'
-      i += 1
+      const star = translateStar(pattern, i)
+      out += star.source
+      i = star.next
       continue
     }
     if (ch === '?') {
@@ -112,13 +151,20 @@ function translateGlob(pattern: string): string {
   return out
 }
 
+/** A regex source that matches nothing: the compiled form of an invalid pattern. */
+const NEVER_MATCH = '(?!)'
+
 /** One gitignore-style pattern as an anchored regular expression source. Brace
  * groups (`{ts,tsx}`, nested, Cartesian across groups) expand into ORed
- * alternatives; an over-budget expansion falls back to the literal pattern. */
+ * alternatives; an over-budget expansion falls back to the literal pattern. An
+ * invalid pattern (an unreadable bracket expression) matches nothing, as Claude
+ * documents, rather than matching its literal spelling. */
 export function globToRegExpSource(pattern: string): string {
   const alternatives = expandBraces(pattern) ?? [pattern]
-  if (alternatives.length === 1) return translateGlob(alternatives[0])
-  return `(?:${alternatives.map(translateGlob).join('|')})`
+  const sources = alternatives.map(translateGlob)
+  if (sources.includes(null)) return NEVER_MATCH
+  if (sources.length === 1) return sources[0] as string
+  return `(?:${sources.join('|')})`
 }
 
 /** A rule resolved to an absolute glob per its anchor form. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.23",
+  "version": "1.0.25",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",