pi-code 1.0.3 → 1.0.4

package/extensions/commands.ts

@@ -86,12 +86,12 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // fire-and-forget, so the restore would land before the agent ever read the tool
     // list, leaving the command running with everything enabled.
     if (parsed.allowedTools) {
-      const saved = pi.getActiveTools()
-      const granted = parsed.allowedTools.filter((tool) => saved.includes(tool))
-      // Only the first restriction in a turn knows the unrestricted set; a second
-      // command would otherwise record the first one's narrowed set as the thing to
-      // restore, and the tools the first command dropped would never come back.
-      pendingRestore ??= saved
+      // Only the first restriction in a turn sees the unrestricted set; a second
+      // command must grant and restore against that original set, or its own tools
+      // are intersected away by the first command's narrowing.
+      const original = pendingRestore ?? pi.getActiveTools()
+      pendingRestore = original
+      const granted = parsed.allowedTools.filter((tool) => original.includes(tool))
       // `allowed-tools: []` says no tools, and is honored. A non-empty list that
       // intersects to nothing named only tools pi has none of: that restriction cannot
       // be expressed, and applying it as "no tools" is not what the command asked for.

package/extensions/context-imports.ts

@@ -110,11 +110,14 @@ function readImport(target: string, fromDir: string, home: string, allowedRoots:
     return null
   }
   if (seen.has(real)) return null
-  seen.add(real)
   if (!isUnder(real, allowedRoots)) return null
   try {
     // real may be a directory (EISDIR) or vanish after the realpath (ENOENT/EACCES).
-    return { real, body: fs.readFileSync(real, 'utf-8') }
+    const body = fs.readFileSync(real, 'utf-8')
+    // Only a consumed file dedupes: marking a blocked or unreadable target seen
+    // would let one reader's failure suppress the import for a later, allowed one.
+    seen.add(real)
+    return { real, body }
   } catch {
     return null
   }

package/extensions/git-checkpoint.ts

@@ -137,12 +137,25 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     pruneCheckpointRepos(checkpointsRoot, CHECKPOINT_RETENTION_DAYS, shadowDir)
     const check = await pi.exec('git', ['--git-dir', shadowDir, 'rev-parse', '--git-dir'], { cwd: ctx.cwd })
     if (check.code !== 0) {
-      await pi.exec('git', ['init', '--bare', '-b', 'main', shadowDir], { cwd: ctx.cwd })
+      const init = await pi.exec('git', ['init', '--bare', '-b', 'main', shadowDir], { cwd: ctx.cwd })
+      if (init.code !== 0) {
+        // Every later snapshot fails against the missing repo, so without this the
+        // user first learns /rewind is dead at the moment they need it.
+        ctx.ui.notify(`Checkpoints disabled: ${init.stderr.trim() || 'git init failed'}`, 'warning')
+        return
+      }
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.email', 'checkpoint@pi-code'], { cwd: ctx.cwd })
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.name', 'pi-code-checkpoint'], { cwd: ctx.cwd })
     }
   }
 
+  /** `checkout -f <ref> -- .` errors when the ref's tree holds no files, so an empty
+   * snapshot restores as a no-op rather than vetoing the whole rewind. */
+  async function snapshotIsEmpty(ref: string): Promise<boolean> {
+    const files = await gitShadow(['ls-tree', '-r', '--name-only', ref])
+    return files.code === 0 && files.stdout.trim() === ''
+  }
+
   async function snapshot(): Promise<{ ref: string; createdAt: string } | undefined> {
     const createdAt = new Date().toISOString()
     const add = await gitShadow(['add', '-A'])
@@ -175,6 +188,10 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
       ctx.ui.notify('Checkpoint has no code snapshot; code left untouched', 'warning')
       return true
     }
+    if (await snapshotIsEmpty(checkpoint.ref)) {
+      ctx.ui.notify('Checkpoint has no files; code left untouched', 'warning')
+      return true
+    }
     const result = await gitShadow(['checkout', '-f', checkpoint.ref, '--', '.'])
     if (result.code !== 0) {
       ctx.ui.notify(`Code restore failed: ${result.stderr.trim()}`, 'warning')
@@ -248,6 +265,10 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
 
     const choice = await ctx.ui.select('Restore code state?', ['Yes, restore code to that point', 'No, keep current code'])
     if (choice?.startsWith('Yes')) {
+      if (await snapshotIsEmpty(checkpoint.ref)) {
+        ctx.ui.notify('Checkpoint has no files; code left untouched', 'warning')
+        return
+      }
       const result = await gitShadow(['checkout', '-f', checkpoint.ref, '--', '.'])
       ctx.ui.notify(result.code === 0 ? 'Code restored to checkpoint' : `Restore failed: ${result.stderr.trim()}`, result.code === 0 ? 'info' : 'warning')
     }

package/extensions/hooks.ts

@@ -78,6 +78,8 @@ export interface HookRunResult {
   stderr: string
   /** The hook was killed at its timeout, so its exit code carries no verdict. */
   timedOut: boolean
+  /** The process errored before delivering a verdict (spawn failure, EIO). */
+  spawnFailed?: boolean
 }
 export type HookRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string) => Promise<HookRunResult>
 
@@ -265,7 +267,9 @@ export const runHookCommand: HookRunner = (command, payload, timeoutMs, projectD
       if (stderr.length < MAX_HOOK_OUTPUT) stderr += chunk
     })
     child.on('close', (code) => finish({ code: code ?? 0, stdout, stderr, timedOut: false }))
-    child.on('error', () => finish({ code: 0, stdout, stderr, timedOut: false }))
+    // Marked rather than silently read as a clean run: under fd exhaustion a
+    // deny-list guard that never spawned would otherwise pass as an allow.
+    child.on('error', (error) => finish({ code: 0, stdout, stderr: stderr || error.message, timedOut: false, spawnFailed: true }))
     // A hook that exits without reading stdin (e.g. `exit 2`) closes the pipe first,
     // so ignore EPIPE on this write rather than crashing the host process.
     child.stdin?.on('error', () => {})
@@ -294,21 +298,42 @@ function replaceRecord(target: Record<string, unknown>, next: Record<string, unk
   Object.assign(target, next)
 }
 
-/** Run PreToolUse hooks for a tool; the first blocking verdict wins. For MCP tools the
- * matcher sees both the pi name and the Claude alias, and the payload reports the alias,
- * which is the name a Claude-written hook script expects in tool_name. A hook's
- * hookSpecificOutput.updatedInput replaces the tool input in place before the permission
- * decision applies, and later hooks see the rewritten input in their payload. */
+/** Claude surfaces a hook error notice and the action proceeds; silence would read a
+ * guard that never ran as a clean allow. */
+function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[], notify?: SystemMessageSink): void {
+  if (!notify) return
+  for (const [i, result] of results.entries()) {
+    if (result.spawnFailed) notify(`Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}`)
+  }
+}
+
+/** Run PreToolUse hooks for a tool, in parallel as Claude does; the first blocking
+ * verdict in config order wins. For MCP tools the matcher sees both the pi name and
+ * the Claude alias, and the payload reports the alias, which is the name a
+ * Claude-written hook script expects in tool_name. Every hook sees the original
+ * tool input; hookSpecificOutput.updatedInput replaces the input in place as each
+ * hook completes, so with several rewrites the last to finish takes effect, which
+ * is Claude's documented (non-deterministic) behavior. */
 export async function runPreToolUse(config: HooksConfig, toolName: string, toolInput: unknown, runner: HookRunner, claudeName?: string, onSystemMessage?: SystemMessageSink): Promise<HookDecision> {
   const names = claudeName ? [toolName, claudeName] : [toolName]
-  for (const command of matchingCommands(config.PreToolUse, names)) {
-    const result = await runner(command.command, { hook_event_name: 'PreToolUse', tool_name: claudeName ?? toolName, tool_input: toolInput }, timeoutMs(command))
+  const commands = matchingCommands(config.PreToolUse, names)
+  const results = await Promise.all(
+    commands.map((command) =>
+      runner(command.command, { hook_event_name: 'PreToolUse', tool_name: claudeName ?? toolName, tool_input: toolInput }, timeoutMs(command)).then((result) => {
+        const updated = tryParseJson(result.stdout)?.hookSpecificOutput?.updatedInput
+        if (isRecord(updated) && isRecord(toolInput)) replaceRecord(toolInput, updated)
+        return result
+      }),
+    ),
+  )
+  surfaceHookFailures(commands, results, onSystemMessage)
+  for (const [i, result] of results.entries()) {
     // A killed hook never reached its verdict, and SIGKILL leaves a null exit code that
     // would otherwise read as a clean allow. Fail closed instead.
-    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}` }
-    if (onSystemMessage) surfaceSystemMessages([result], onSystemMessage)
-    const updated = tryParseJson(result.stdout)?.hookSpecificOutput?.updatedInput
-    if (isRecord(updated) && isRecord(toolInput)) replaceRecord(toolInput, updated)
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}` }
+  }
+  if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
+  for (const result of results) {
     const decision = interpretHookResult(result.code, result.stdout, result.stderr)
     if (decision.block) return decision
   }
@@ -343,14 +368,19 @@ function promptContext(stdout: string): string {
   return stdout.trim()
 }
 
-/** Run UserPromptSubmit hooks: the first blocking verdict wins; otherwise their
- * additional context is concatenated for injection ahead of the prompt. */
+/** Run UserPromptSubmit hooks, in parallel as Claude does: the first blocking
+ * verdict in config order wins; otherwise their additional context is concatenated
+ * in config order for injection ahead of the prompt. */
 export async function runUserPromptSubmit(config: HooksConfig, prompt: string, runner: HookRunner, onSystemMessage?: SystemMessageSink): Promise<PromptDecision> {
+  const commands = matchingCommands(config.UserPromptSubmit, 'UserPromptSubmit')
+  const results = await Promise.all(commands.map((command) => runner(command.command, { hook_event_name: 'UserPromptSubmit', prompt }, timeoutMs(command))))
+  surfaceHookFailures(commands, results, onSystemMessage)
+  for (const [i, result] of results.entries()) {
+    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}`, context: '' }
+  }
+  if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   const contexts: string[] = []
-  for (const command of matchingCommands(config.UserPromptSubmit, 'UserPromptSubmit')) {
-    const result = await runner(command.command, { hook_event_name: 'UserPromptSubmit', prompt }, timeoutMs(command))
-    if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(command)}ms: ${command.command}`, context: '' }
-    if (onSystemMessage) surfaceSystemMessages([result], onSystemMessage)
+  for (const result of results) {
     const decision = interpretHookResult(result.code, result.stdout, result.stderr)
     if (decision.block) return { block: true, reason: decision.reason, context: '' }
     const context = promptContext(result.stdout)

package/extensions/internal/command-file.ts

@@ -148,16 +148,21 @@ export function splitArgs(args: string): string[] {
   return out
 }
 
-/** Claude's substitutions: `$ARGUMENTS`, `$@`, `$1`..`$n`, `${n:-default}`. An
- * unfilled positional becomes empty rather than leaking its literal token. */
+/** Claude's substitutions: `$ARGUMENTS`, `$@`, `$1`..`$n`, `${n:-default}`, and `\$`
+ * for a literal dollar. An unfilled positional becomes empty rather than leaking its
+ * literal token. One pass with a replacer function: sequential string passes both
+ * interpreted `$&`-style metacharacters in the arguments and re-scanned substituted
+ * text, so `$` sequences the user typed were consumed as tokens. */
 export function substituteArgs(body: string, args: string): string {
   const parts = splitArgs(args)
-  return body
-    .replaceAll(/\$\{(\d+):-([^}]*)\}/g, (_m, index: string, fallback: string) => parts[Number(index) - 1] ?? fallback)
-    .replaceAll(/\$\{ARGUMENTS:-([^}]*)\}/g, (_m, fallback: string) => (args.trim() ? args.trim() : fallback))
-    .replaceAll(/\$ARGUMENTS\b/g, args.trim())
-    .replaceAll('$@', args.trim())
-    .replaceAll(/\$(\d+)/g, (_m, index: string) => parts[Number(index) - 1] ?? '')
+  const all = args.trim()
+  return body.replaceAll(/\\\$|\$\{(\d+):-([^}]*)\}|\$\{ARGUMENTS:-([^}]*)\}|\$ARGUMENTS\b|\$@|\$(\d+)/g, (token, index?: string, fallback?: string, argsFallback?: string, position?: string) => {
+    if (token === '\\$') return '$'
+    if (index !== undefined) return parts[Number(index) - 1] ?? fallback ?? ''
+    if (argsFallback !== undefined) return all || argsFallback
+    if (position !== undefined) return parts[Number(position) - 1] ?? ''
+    return all
+  })
 }
 
 /** `a/b/c.md` becomes Claude's `a:b:c`. */
@@ -239,12 +244,17 @@ export async function expandDynamicContent(body: string, cwd: string, exec: Comm
     bashMatch = bashPattern.exec(body)
   }
 
-  let expanded = body
+  // Splice by recorded position: a textual replace would interpret `$` sequences in
+  // the command's output and could hit an identical fenced copy of the span instead.
+  let expanded = ''
+  let cursor = 0
   for (const entry of commands) {
     const result = await exec(entry.command)
     const output = result.code === 0 ? result.stdout.trimEnd() : `(command failed: ${entry.command})\n${result.stderr.trim() || result.stdout.trim()}`
-    expanded = expanded.replace(entry.span, output)
+    expanded += body.slice(cursor, entry.index) + output
+    cursor = entry.index + entry.span.length
   }
+  expanded += body.slice(cursor)
 
   // Ranges are recomputed: command output can change offsets.
   const fencedAfter = fencedRanges(expanded)

package/extensions/mcp.ts

@@ -482,8 +482,24 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const count = registerTools(name, config, client, tools)
           subscribeToToolChanges(name, config, client)
           status.set(name, { state: 'connected', tools: count })
+          // A server that dies mid-session would otherwise stay "connected" in /mcp
+          // while every call fails with the SDK's bare "Not connected"; flip the
+          // status and free the name so a later session start can reconnect it.
+          client.onclose = () => {
+            if (clients.get(name) !== client) return
+            clients.delete(name)
+            status.set(name, { state: 'disconnected', tools: 0 })
+          }
         } catch (error) {
           status.set(name, { state: `failed: ${error instanceof Error ? error.message : String(error)}`, tools: 0 })
+          // Connected but failed after (tool listing hung or errored): left in the
+          // map, the client idles its process for the whole session and the
+          // duplicate-name guard blocks the name for every later attempt.
+          const leaked = clients.get(name)
+          if (leaked) {
+            clients.delete(name)
+            void leaked.close().catch(() => {})
+          }
         }
       }),
     )
@@ -503,16 +519,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return true
   }
 
-  let userConnected = false
   let projectConnected = false
 
   pi.on('session_start', async (_event, ctx) => {
     // Connecting spawns processes and opens sockets, so it belongs here rather than in
     // the factory: pi runs the factory for invocations that never start a session.
-    if (!userConnected) {
-      userConnected = true
-      await connectServers(loadUserScope(os.homedir(), ctx.cwd))
-    }
+    // Names still connected are filtered out, so a later session start only retries
+    // servers that failed or whose transport dropped, without duplicate-name warnings.
+    const userServers = Object.fromEntries(Object.entries(loadUserScope(os.homedir(), ctx.cwd)).filter(([name]) => !clients.has(name)))
+    if (Object.keys(userServers).length > 0) await connectServers(userServers)
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once
     // the project is trusted. Per-server settings refine that: disabled servers never
     // connect, servers the user consented to individually connect without the

package/extensions/memory.ts

@@ -93,7 +93,7 @@ export function saveMemory(dir: string, indexPath: string, name: string | undefi
   }
   fs.mkdirSync(dir, { recursive: true })
   fs.writeFileSync(path.join(dir, `${name}.md`), content)
-  fs.writeFileSync(indexPath, upsertIndexLine(index, name, description))
+  writeIndex(indexPath, upsertIndexLine(index, name, description))
   return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
 }
 
@@ -150,25 +150,45 @@ const MemoryParams = Type.Object({
 function readIndex(dir: string): string {
   try {
     return fs.readFileSync(path.join(dir, INDEX_FILE), 'utf-8')
+  } catch (error) {
+    // Only a missing file means an empty index. Treating any other failure as empty
+    // lets the next read-modify-write clobber every existing entry.
+    if ((error as NodeJS.ErrnoException).code === 'ENOENT') return ''
+    throw error
+  }
+}
+
+/** For display paths, where a transiently unreadable index should not break the
+ * session; the mutating paths go through readIndex and refuse instead. */
+function readIndexQuietly(dir: string): string {
+  try {
+    return readIndex(dir)
   } catch {
     return ''
   }
 }
 
+/** Replace the index through a rename so a crash mid-write cannot truncate it. */
+function writeIndex(indexPath: string, content: string): void {
+  const tmp = `${indexPath}.${process.pid}.tmp`
+  fs.writeFileSync(tmp, content)
+  fs.renameSync(tmp, indexPath)
+}
+
 export default function memoryExtension(pi: ExtensionAPI) {
   let dir = memoryDir(process.cwd())
 
   pi.on('session_start', async (_event, ctx) => {
     migrateLegacyStore(ctx.cwd)
     dir = memoryDir(ctx.cwd)
-    const count = readIndex(dir)
+    const count = readIndexQuietly(dir)
       .split('\n')
       .filter((l) => l.startsWith('- ')).length
     if (count > 0) ctx.ui.notify(`Memory: ${count} memories loaded`, 'info')
   })
 
   pi.on('before_agent_start', async (event) => {
-    const index = readIndex(dir)
+    const index = readIndexQuietly(dir)
     if (!index.trim()) return
     return {
       systemPrompt: `${event.systemPrompt}\n\n## Memory\n\nPersistent memories from earlier sessions (index):\n\n${capIndexForPrompt(index)}\nUse the memory tool with action "read" to load a memory's full content when relevant.`,
@@ -185,7 +205,11 @@ export default function memoryExtension(pi: ExtensionAPI) {
       const indexPath = path.join(dir, INDEX_FILE)
 
       if (params.action === 'save') {
-        return saveMemory(dir, indexPath, name, params.description, params.content)
+        try {
+          return saveMemory(dir, indexPath, name, params.description, params.content)
+        } catch (error) {
+          return { content: [{ type: 'text' as const, text: `Memory save failed: ${error instanceof Error ? error.message : String(error)}. The index was left untouched.` }], details: {} }
+        }
       }
 
       if (params.action === 'read') {
@@ -200,14 +224,22 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
       if (params.action === 'delete') {
         if (!name) return { content: [{ type: 'text' as const, text: 'delete requires name.' }], details: {} }
+        // The index is read before anything is removed: refusing on a failed read
+        // must leave both the memory file and the index as they were.
+        let index: string
+        try {
+          index = readIndex(dir)
+        } catch (error) {
+          return { content: [{ type: 'text' as const, text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
+        }
         fs.rmSync(path.join(dir, `${name}.md`), { force: true })
-        const remaining = removeIndexLine(readIndex(dir), name)
-        if (remaining) fs.writeFileSync(indexPath, remaining)
+        const remaining = removeIndexLine(index, name)
+        if (remaining) writeIndex(indexPath, remaining)
         else fs.rmSync(indexPath, { force: true })
         return { content: [{ type: 'text' as const, text: `Deleted memory ${name}.` }], details: {} }
       }
 
-      const index = readIndex(dir)
+      const index = readIndexQuietly(dir)
       return { content: [{ type: 'text' as const, text: index.trim() || 'No memories saved for this project yet.' }], details: {} }
     },
   })

package/extensions/notify.ts

@@ -8,6 +8,7 @@
  * - Windows toast: Windows Terminal (WSL)
  */
 
+import { execFile } from 'node:child_process'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 function windowsToastScript(title: string, body: string): string {
@@ -29,7 +30,6 @@ function notifyOSC99(title: string, body: string): void {
 }
 
 function notifyWindows(title: string, body: string): void {
-  const { execFile } = require('node:child_process')
   // Resolve powershell from a fixed system path rather than through PATH, and let the callback
   // capture a spawn failure instead of an unhandled 'error' event crashing the host.
   const root = process.env.SystemRoot ?? String.raw`C:\Windows`

package/extensions/plan-mode/index.ts

@@ -24,6 +24,10 @@ import { extractTodoItems, isSafeCommand, markCompletedSteps, planToTodos, type
 // Tools
 const PLAN_MODE_TOOLS = ['read', 'bash', 'grep', 'find', 'ls', 'question', 'plan_mode_complete']
 
+/** Agent runs in execution mode with no [DONE:n] progress before execution ends on
+ * its own. Kept small: each stalled run re-injects the stale plan into the turn. */
+const STALLED_RUN_LIMIT = 2
+
 // Type guard for assistant messages
 function isAssistantMessage(m: AgentMessage): m is AssistantMessage {
   return m.role === 'assistant' && Array.isArray(m.content)
@@ -60,6 +64,8 @@ export default function planModeExtension(pi: ExtensionAPI): void {
   let todoItems: TodoItem[] = []
   let planFromTool = false
   let savedTools: string[] = []
+  let stalledRuns = 0
+  let runProgress = false
 
   function enterPlanTools(): void {
     savedTools = pi.getActiveTools()
@@ -113,6 +119,8 @@ export default function planModeExtension(pi: ExtensionAPI): void {
     executionMode = false
     todoItems = []
     planFromTool = false
+    stalledRuns = 0
+    runProgress = false
 
     if (planModeEnabled) {
       enterPlanTools()
@@ -140,11 +148,8 @@ export default function planModeExtension(pi: ExtensionAPI): void {
     })
   }
 
-  // Announce completion and reset once every step is done
-  function finalizeCompletedExecution(ctx: ExtensionContext): void {
-    if (!todoItems.every((t) => t.completed)) return
-    const completedList = todoItems.map((t) => `~~${t.text}~~`).join('\n')
-    pi.sendMessage({ customType: 'plan-complete', content: `**Plan Complete!** ✓\n\n${completedList}`, display: true }, { triggerTurn: false })
+  function endExecution(ctx: ExtensionContext, content: string): void {
+    pi.sendMessage({ customType: 'plan-complete', content, display: true }, { triggerTurn: false })
     executionMode = false
     todoItems = []
     restoreTools()
@@ -152,6 +157,23 @@ export default function planModeExtension(pi: ExtensionAPI): void {
     persistState() // Save cleared state so resume doesn't restore old execution mode
   }
 
+  // Announce completion and reset once every step is done
+  function finalizeCompletedExecution(ctx: ExtensionContext): void {
+    if (!todoItems.every((t) => t.completed)) return
+    const completedList = todoItems.map((t) => `~~${t.text}~~`).join('\n')
+    endExecution(ctx, `**Plan Complete!** ✓\n\n${completedList}`)
+  }
+
+  /** Models regularly drop or renumber a [DONE:n] marker; without a bounded exit the
+   * stale plan would be injected into every later turn until the user finds /plan. */
+  function endStalledExecution(ctx: ExtensionContext): void {
+    const remaining = todoItems
+      .filter((t) => !t.completed)
+      .map((t) => `${t.step}. ${t.text}`)
+      .join('\n')
+    endExecution(ctx, `**Plan execution ended** after ${STALLED_RUN_LIMIT} turns without step progress. Unfinished steps:\n\n${remaining}`)
+  }
+
   // Fall back to extracting a plan from the last assistant message's prose
   function deriveTodosFromProse(messages: AgentMessage[]): void {
     const lastAssistant = [...messages].reverse().find(isAssistantMessage)
@@ -170,6 +192,8 @@ export default function planModeExtension(pi: ExtensionAPI): void {
       planModeEnabled = false
       executionMode = todoItems.length > 0
       planFromTool = false
+      stalledRuns = 0
+      runProgress = false
       restoreTools()
       publishPlanState()
       updateStatus(ctx)
@@ -241,9 +265,19 @@ export default function planModeExtension(pi: ExtensionAPI): void {
     handler: async (ctx) => togglePlanMode(ctx),
   })
 
-  // Block destructive bash commands in plan mode
+  // Enforce plan mode at call time, not only through the active-tool set: pi
+  // activates tools registered after the restriction was applied (an MCP server
+  // connecting during session_start, or a mid-session list_changed refresh), so the
+  // set alone leaks write-capable tools into plan mode.
   pi.on('tool_call', async (event) => {
-    if (!planModeEnabled || event.toolName !== 'bash') return
+    if (!planModeEnabled) return
+    if (!PLAN_MODE_TOOLS.includes(event.toolName)) {
+      return {
+        block: true,
+        reason: `Plan mode: tool blocked (read-only mode). Use /plan to disable plan mode first.\nTool: ${event.toolName}`,
+      }
+    }
+    if (event.toolName !== 'bash') return
 
     const command = event.input.command as string
     if (!isSafeCommand(command)) {
@@ -332,6 +366,7 @@ After completing a step, include a [DONE:n] tag in your response.`,
 
     const text = getTextContent(event.message)
     if (markCompletedSteps(text, todoItems) > 0) {
+      runProgress = true
       updateStatus(ctx)
     }
     persistState()
@@ -339,9 +374,18 @@ After completing a step, include a [DONE:n] tag in your response.`,
 
   // Handle plan completion and plan mode UI
   pi.on('agent_end', async (event, ctx) => {
-    // Check if execution is complete
+    // Check if execution is complete, or has stalled without marker progress
     if (executionMode && todoItems.length > 0) {
-      finalizeCompletedExecution(ctx)
+      if (todoItems.every((t) => t.completed)) {
+        finalizeCompletedExecution(ctx)
+        stalledRuns = 0
+      } else if (runProgress) {
+        stalledRuns = 0
+      } else {
+        stalledRuns++
+        if (stalledRuns >= STALLED_RUN_LIMIT) endStalledExecution(ctx)
+      }
+      runProgress = false
       return
     }
 
@@ -376,6 +420,8 @@ After completing a step, include a [DONE:n] tag in your response.`,
     executionMode = false
     todoItems = []
     planFromTool = false
+    stalledRuns = 0
+    runProgress = false
 
     if (pi.getFlag('plan') === true) {
       planModeEnabled = true

package/extensions/status-line.ts

@@ -104,6 +104,7 @@ export default function statusLine(pi: ExtensionAPI) {
   /** The stdin payload per Claude's documented statusline contract. */
   function buildPayload(ctx: ExtensionContext): Record<string, unknown> {
     const usage = ctx.getContextUsage() ?? { tokens: null, contextWindow: 0, percent: null }
+    const model = ctx.model as { id?: string; name?: string } | undefined
     // Same gate as the config read above: an unapproved project's style is not applied,
     // so reporting it here would describe a style the session is not using.
     const styleName = readActiveStyleName(settingsFiles(ctx.cwd, os.homedir(), projectApproved))
@@ -111,7 +112,9 @@ export default function statusLine(pi: ExtensionAPI) {
       session_id: ctx.sessionManager.getSessionId(),
       cwd: ctx.cwd,
       workspace: { current_dir: ctx.cwd, project_dir: ctx.cwd },
-      model: { id: (ctx.model as { id?: string } | undefined)?.id ?? '' },
+      // Both fields, per Claude's documented contract: published statusline scripts
+      // read .model.display_name and render the literal "null" when it is missing.
+      model: { id: model?.id ?? '', display_name: model?.name ?? model?.id ?? '' },
       cost: { total_cost_usd: sessionCost(ctx) },
       context_window: { context_window_size: usage.contextWindow, used_percentage: usage.percent, total_input_tokens: usage.tokens },
       permission_mode: permissionMode,

package/extensions/subagent/background.ts

@@ -19,8 +19,13 @@ export interface BackgroundRun {
   exitCode?: number
   output?: string
   turns: number
+  /** Last stderr bytes of a failed child; the only diagnostics a boot failure leaves. */
+  stderr?: string
   /** Set while running so the run can be cancelled; cleared on completion. */
   kill?: () => void
+  /** True until the child process actually closes: a cancelled child that ignores
+   * SIGTERM is still alive and must keep holding its concurrency slot. */
+  live?: boolean
   /** pi session the child ran under, so a follow-up can continue its context. */
   sessionId: string
   /** How the child was spawned, so a follow-up can repeat it with a new task. */
@@ -42,30 +47,66 @@ const runs = new Map<string, BackgroundRun>()
 /** Cap on simultaneously running background children. */
 export const MAX_BACKGROUND_RUNS = 8
 
+/** Finished runs kept for status listings and resume; older ones are evicted so a
+ * long session's registry (each entry holds its final output) cannot grow forever. */
+export const MAX_FINISHED_RUNS = 20
+
+/** Grace between the cancel SIGTERM and the SIGKILL that ends a child ignoring it. */
+const CANCEL_KILL_GRACE_MS = 5000
+
+/** Bytes of stderr kept per run, enough for the boot error without buffering logs. */
+const STDERR_TAIL_CHARS = 2048
+
 export function activeBackgroundRuns(): number {
-  return [...runs.values()].filter((run) => run.state === 'running').length
+  return [...runs.values()].filter((run) => run.live || run.state === 'running').length
 }
 
-/** Extract the final assistant text and turn count from a pi --mode json stdout stream. */
-export function parseFinalOutputFromJsonl(jsonl: string): { text: string; turns: number } {
+function evictFinishedRuns(): void {
+  const finished = [...runs.values()].filter((run) => !run.live && run.state !== 'running')
+  for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) runs.delete(stale.id)
+}
+
+/** Line-by-line parser keeping only the last assistant text and a turn count, so a
+ * long run's JSONL stdout never accumulates whole in the parent's memory. */
+export function createJsonlOutputParser(): { push: (chunk: string) => void; flush: () => { text: string; turns: number } } {
+  let buffer = ''
   let text = ''
   let turns = 0
-  for (const line of jsonl.split('\n')) {
-    if (!line.trim()) continue
+  const takeLine = (raw: string): void => {
+    if (!raw.trim()) return
     let event: { type?: string; message?: { role?: string; content?: Array<{ type: string; text?: string }> } }
     try {
-      event = JSON.parse(line)
+      event = JSON.parse(raw)
     } catch {
-      continue
+      return
     }
-    if (event.type !== 'message_end' || event.message?.role !== 'assistant') continue
+    if (event.type !== 'message_end' || event.message?.role !== 'assistant') return
     turns++
     // The complete text of the last assistant message, matching getFinalOutput on the
     // foreground path so a multi-part message reads the same in both.
     const parts = (event.message.content ?? []).filter((p) => p.type === 'text' && p.text).map((p) => p.text as string)
     if (parts.length > 0) text = parts.join('\n')
   }
-  return { text, turns }
+  return {
+    push(chunk) {
+      buffer += chunk
+      const lines = buffer.split('\n')
+      buffer = lines.pop() ?? ''
+      for (const line of lines) takeLine(line)
+    },
+    flush() {
+      takeLine(buffer)
+      buffer = ''
+      return { text, turns }
+    },
+  }
+}
+
+/** Extract the final assistant text and turn count from a pi --mode json stdout stream. */
+export function parseFinalOutputFromJsonl(jsonl: string): { text: string; turns: number } {
+  const parser = createJsonlOutputParser()
+  parser.push(jsonl)
+  return parser.flush()
 }
 
 export function formatStatus(all: Iterable<Pick<BackgroundRun, 'id' | 'agent' | 'task' | 'state' | 'turns' | 'exitCode'>>): string {
@@ -100,15 +141,22 @@ export function backgroundRun(id: string): BackgroundRun | undefined {
 /** Re-spawn a finished run's session with a new task. The child is started with the
  * same --session-id, so it continues with everything it already saw rather than
  * re-deriving context the parent would have to repeat. */
-export function resumeBackgroundRun(id: string, task: string, onComplete: (run: BackgroundRun) => void): 'resumed' | 'still-running' | 'unknown' {
+export function resumeBackgroundRun(id: string, task: string, onComplete: (run: BackgroundRun) => void): 'resumed' | 'still-running' | 'at-capacity' | 'unknown' {
   const run = runs.get(id)
   if (!run) return 'unknown'
-  if (run.state === 'running') return 'still-running'
-  const args = withRebuiltPrompt(run.spawn).map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
+  if (run.state === 'running' || run.live) return 'still-running'
+  // A resume spawns a child like a fresh start does, so it counts against the cap.
+  if (activeBackgroundRuns() >= MAX_BACKGROUND_RUNS) return 'at-capacity'
+  // Persisted so the rebuild happens once: rebuilding per resume leaked one temp
+  // prompt dir every follow-up.
+  const rebuilt = withRebuiltPrompt(run.spawn)
+  run.spawn = { ...run.spawn, args: rebuilt }
+  const args = rebuilt.map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
   run.output = undefined
   run.exitCode = undefined
+  run.stderr = undefined
   driveRun(run, { ...run.spawn, args }, onComplete)
   return 'resumed'
 }
@@ -156,25 +204,41 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   const proc = spawn(invocation.command, invocation.args, {
     cwd: invocation.cwd,
     shell: false,
-    stdio: ['ignore', 'pipe', 'ignore'],
+    stdio: ['ignore', 'pipe', 'pipe'],
     // Its own group, so cancelling reaches any grandchild the agent spawned.
     detached: true,
     // The marker lets the child's subagent tool refuse to nest further.
     env: { ...process.env, PI_CODE_SUBAGENT: '1' },
   })
-  run.kill = () => {
+  run.live = true
+  const killGroup = (signal: NodeJS.Signals): void => {
     try {
-      process.kill(-proc.pid!, 'SIGTERM')
+      process.kill(-proc.pid!, signal)
     } catch {
-      proc.kill('SIGTERM')
+      try {
+        proc.kill(signal)
+      } catch {
+        // already gone
+      }
     }
   }
-  let stdout = ''
+  run.kill = () => {
+    killGroup('SIGTERM')
+    // A child ignoring SIGTERM would hold its cap slot and process forever.
+    const escalate = setTimeout(() => killGroup('SIGKILL'), CANCEL_KILL_GRACE_MS)
+    escalate.unref()
+    proc.once('close', () => clearTimeout(escalate))
+  }
+  // Parsed as it streams: buffering the whole JSONL replays every tool result echoed
+  // by the child through the parent's memory for the life of the run.
+  const parser = createJsonlOutputParser()
+  let stderrTail = ''
   // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
   let completed = false
   const complete = (): void => {
     if (completed) return
     completed = true
+    evictFinishedRuns()
     // A run outlives the session that started it, and pi's loader wires assertActive()
     // into every runtime call, so notifying a disposed session throws. This fires from
     // the child's 'close'/'error' listener, where nothing upstream catches: an escaping
@@ -187,27 +251,33 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       // the session that asked for this run is gone
     }
   }
-  proc.stdout.on('data', (data) => {
-    stdout += data.toString()
-  })
+  proc.stdout.on('data', (data) => parser.push(data.toString()))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an
   // unguarded completion would. The foreground runner guards its streams the same way.
   proc.stdout.on('error', () => {})
+  proc.stderr?.on('data', (data) => {
+    stderrTail = (stderrTail + data.toString()).slice(-STDERR_TAIL_CHARS)
+  })
+  proc.stderr?.on('error', () => {})
   proc.on('close', (code) => {
-    const { text, turns } = parseFinalOutputFromJsonl(stdout)
+    const { text, turns } = parser.flush()
     run.kill = undefined
+    run.live = false
     // A cancelled run keeps that state: its non-zero exit is the cancellation.
     if (run.state !== 'cancelled') run.state = code === 0 ? 'done' : 'failed'
     run.exitCode = code ?? 0
     run.output = text
     run.turns = turns
+    run.stderr = stderrTail.trim() || undefined
     complete()
   })
-  proc.on('error', () => {
+  proc.on('error', (error) => {
     run.kill = undefined
+    run.live = false
     run.state = 'failed'
     run.exitCode = 1
+    run.stderr = stderrTail.trim() || error.message
     complete()
   })
 }

package/extensions/subagent/index.ts

@@ -28,7 +28,7 @@ import { isProjectApproved, isProjectApprovedSilently } from '../internal/projec
 import { SUBAGENT_CHANNEL } from '../internal/subagent-events.js'
 import { skillDirs } from '../skills.js'
 import { type AgentConfig, type AgentScope, discoverAgents, resolveModelAlias, withPreloadedSkills } from './agents.js'
-import { activeBackgroundRuns, backgroundStatusText, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
+import { activeBackgroundRuns, backgroundRun, backgroundStatusText, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
 
 const MAX_PARALLEL_TASKS = 8
 const MAX_CONCURRENCY = 4
@@ -343,6 +343,9 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         cwd: cwd ?? defaultCwd,
         shell: false,
         stdio: ['ignore', 'pipe', 'pipe'],
+        // Its own group, so an abort reaches grandchildren too: killing only the
+        // direct child orphans a build or dev server the agent started.
+        detached: true,
         // The marker lets the child's subagent tool refuse to nest further.
         env: { ...process.env, PI_CODE_SUBAGENT: '1' },
       })
@@ -401,19 +404,24 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         resolve(1)
       })
 
+      const killGroup = (sig: NodeJS.Signals): void => {
+        try {
+          process.kill(-proc.pid!, sig)
+        } catch {
+          try {
+            proc.kill(sig)
+          } catch {
+            /* already gone */
+          }
+        }
+      }
       if (signal) {
         onAbort = () => {
           wasAborted = true
-          proc.kill('SIGTERM')
+          killGroup('SIGTERM')
           // proc.killed only reports that the signal was sent, not that the child died. Escalate
           // on a timer that the 'close' handler clears once the child has actually exited.
-          killTimer = setTimeout(() => {
-            try {
-              proc.kill('SIGKILL')
-            } catch {
-              /* already gone */
-            }
-          }, 5000)
+          killTimer = setTimeout(() => killGroup('SIGKILL'), 5000)
         }
         if (signal.aborted) onAbort()
         else signal.addEventListener('abort', onAbort, { once: true })
@@ -498,17 +506,25 @@ type ChainStepParam = Static<typeof ChainItem>
 type TaskItemParam = Static<typeof TaskItem>
 
 /** The completion notice a background run sends when it finishes. */
-export function backgroundCompletionText(run: { id: string; agent: string; state: string; turns: number; output?: string }): string {
+export function backgroundCompletionText(run: { id: string; agent: string; state: string; turns: number; output?: string; stderr?: string }): string {
   const output = capForContext(run.output ?? '') || '(no output)'
-  return `Background subagent run ${run.id} (${run.agent}) ${run.state} after ${run.turns} turns.\n\n${output}`
+  // A child that dies at boot writes its reason only to stderr; without this the
+  // notice reads "failed after 0 turns ... (no output)" with nothing to act on.
+  const diagnostics = run.state === 'failed' && run.stderr ? `\n\nstderr tail:\n${capForContext(run.stderr)}` : ''
+  return `Background subagent run ${run.id} (${run.agent}) ${run.state} after ${run.turns} turns.\n\n${output}${diagnostics}`
 }
 
 /** What to tell the model about a resume request. */
-export function resumeResultText(id: string, task: string | undefined, onComplete: (run: { id: string; agent: string; state: string; turns: number; output?: string }) => void): string {
+export function resumeResultText(id: string, task: string | undefined, onComplete: (run: { id: string; agent: string; state: string; turns: number; output?: string; stderr?: string }) => void, onResumed?: (run: { id: string; agent: string }) => void): string {
   if (!task) return 'Pass task with resume: the follow-up needs an instruction.'
   const outcome = resumeBackgroundRun(id, task, onComplete)
-  if (outcome === 'resumed') return `Resumed background run ${id} with the follow-up task; a notification will arrive on completion.`
+  if (outcome === 'resumed') {
+    const run = backgroundRun(id)
+    if (run) onResumed?.({ id: run.id, agent: run.agent })
+    return `Resumed background run ${id} with the follow-up task; a notification will arrive on completion.`
+  }
   if (outcome === 'still-running') return `Background run ${id} is still running; wait for it or cancel it first.`
+  if (outcome === 'at-capacity') return `Background run cap reached (${MAX_BACKGROUND_RUNS} concurrent); wait for a run to finish before resuming ${id}.`
   return `Unknown background run: ${id}.\n\n${backgroundStatusText()}`
 }
 
@@ -1108,8 +1124,10 @@ function renderParallelResult(results: SingleResult[], expanded: boolean, theme:
 }
 
 export default function subagentExtension(pi: ExtensionAPI) {
-  const notifyBackgroundCompletion = (run: { id: string; agent: string; state: string; turns: number; output?: string }): void => {
+  const notifyBackgroundCompletion = (run: { id: string; agent: string; state: string; turns: number; output?: string; stderr?: string }): void => {
     // Runs through driveRun's guard, same as the background-mode callback above.
+    // The stop event fires here too, so SubagentStop hooks see resumed runs end.
+    pi.events.emit(SUBAGENT_CHANNEL, { phase: 'stop', agentType: run.agent, agentId: run.id })
     pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
   }
 
@@ -1166,7 +1184,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
         })
 
       if (params.resume) {
-        return { content: [{ type: 'text', text: resumeResultText(params.resume, params.task, notifyBackgroundCompletion) }], details: makeDetails('single')([]) }
+        return { content: [{ type: 'text', text: resumeResultText(params.resume, params.task, notifyBackgroundCompletion, (run) => pi.events.emit(SUBAGENT_CHANNEL, { phase: 'start', agentType: run.agent, agentId: run.id })) }], details: makeDetails('single')([]) }
       }
 
       if (params.cancel) {

package/extensions/web.ts

@@ -194,6 +194,9 @@ async function fetchText(rawUrl: string, transport = httpFetch): Promise<{ text:
       userAgent: USER_AGENT,
     })
     if (response.status >= 300 && response.status < 400) {
+      // The hop's body is never read; without the cancel its socket stays held
+      // until the 20s abort timeout, once per hop.
+      void response.body?.cancel().catch(() => {})
       const location = response.headers.get('location')
       if (!location) throw new Error(`redirect without location from ${url.hostname}`)
       url = new URL(location, url)
@@ -202,7 +205,10 @@ async function fetchText(rawUrl: string, transport = httpFetch): Promise<{ text:
       if (url.protocol !== 'http:' && url.protocol !== 'https:') throw new Error(`unsupported redirect scheme ${url.protocol} from ${rawUrl}`)
       continue
     }
-    if (!response.ok) throw new Error(`HTTP ${response.status} for ${url}`)
+    if (!response.ok) {
+      void response.body?.cancel().catch(() => {})
+      throw new Error(`HTTP ${response.status} for ${url}`)
+    }
     return { text: await readCapped(response), contentType: response.headers.get('content-type') ?? '' }
   }
   throw new Error(`too many redirects for ${rawUrl}`)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.3",
+  "version": "1.0.4",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",