pi-code 1.0.4 → 1.0.6

package/extensions/memory.ts

@@ -15,6 +15,8 @@ import { StringEnum } from '@earendil-works/pi-ai'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
 import { capForContext } from './internal/output-guard.js'
+import { isProjectApprovedSilently } from './internal/project-approval.js'
+import { findNearestFile, repoRoot } from './internal/project-root.js'
 
 const INDEX_FILE = 'MEMORY.md'
 
@@ -45,21 +47,79 @@ function legacySlug(cwd: string): string {
     .replace(/^-+/, '-')
 }
 
+/** The project a memory store belongs to: the repository root, so subdirectory
+ * sessions share one store, matching Claude ("derived from the git repository, so
+ * all worktrees and subdirectories within the same repo share one auto memory
+ * directory. Outside a git repo, the project root is used instead."). Falls back
+ * to cwd when there is no project marker. */
+function memoryProject(cwd: string): string {
+  return repoRoot(cwd) ?? cwd
+}
+
 export function memoryDir(cwd: string): string {
-  return path.join(os.homedir(), '.pi', 'agent', 'memory', projectSlug(cwd))
+  return path.join(os.homedir(), '.pi', 'agent', 'memory', projectSlug(memoryProject(cwd)))
+}
+
+/** The store location, honoring an `autoMemoryDirectory` override. Claude requires
+ * it to be absolute or start with `~/`; a relative value is ignored, falling back
+ * to the default per-project directory. */
+export function resolveMemoryDir(cwd: string, override?: string): string {
+  const trimmed = override?.trim()
+  if (trimmed?.startsWith('~/')) return path.join(os.homedir(), trimmed.slice(2))
+  if (trimmed && path.isAbsolute(trimmed)) return trimmed
+  return memoryDir(cwd)
+}
+
+/** Whether auto memory runs: on by default, off when `CLAUDE_CODE_DISABLE_AUTO_MEMORY`
+ * is `1`/`true` or a settings scope sets `autoMemoryEnabled: false`. */
+export function autoMemoryEnabled(setting: unknown, env: NodeJS.ProcessEnv): boolean {
+  const disable = (env.CLAUDE_CODE_DISABLE_AUTO_MEMORY ?? '').trim().toLowerCase()
+  if (disable === '1' || disable === 'true') return false
+  return setting !== false
+}
+
+/** Set or replace the ISO 8601 `modified:` field inside a memory's YAML frontmatter.
+ * Files without frontmatter are returned untouched: Claude never adds frontmatter to
+ * a file that has none. */
+export function stampModified(content: string, iso: string): string {
+  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content)
+  if (!match) return content
+  const inner = match[1]
+  const rest = content.slice(match[0].length)
+  const withoutModified = inner
+    .split('\n')
+    .filter((line) => !/^\s*modified\s*:/.test(line))
+    .join('\n')
+  const body = withoutModified.length > 0 ? `${withoutModified}\n` : ''
+  return `---\n${body}modified: ${iso}\n---${rest}`
+}
+
+/** The index content that actually loads: YAML frontmatter and block-level HTML
+ * comments are stripped, so they neither show in the prompt nor count toward the
+ * 200-line / 25KB read limits, matching Claude Code. */
+export function stripNonLoaded(text: string): string {
+  return text.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').replace(/<!--[\s\S]*?-->\r?\n?/g, '')
 }
 
-/** Move a store written under the pre-digest slug to the current one, once. Without
- * this the slug change would silently orphan every memory a user already has. */
+/** Move a store written under an older slug to the current one, once. Two earlier
+ * formats can orphan a user's memories on upgrade: the released digest-of-cwd slug
+ * (before the store was anchored on the repository root, so a subdirectory session
+ * resolved to a different dir), and the pre-digest slug. Newest format first. */
 export function migrateLegacyStore(cwd: string): void {
   const current = memoryDir(cwd)
   if (fs.existsSync(current)) return
-  const legacy = path.join(os.homedir(), '.pi', 'agent', 'memory', legacySlug(cwd))
-  if (!fs.existsSync(legacy)) return
-  try {
-    fs.renameSync(legacy, current)
-  } catch {
-    // A failed migration must not take down session start; the store stays legacy.
+  const base = path.join(os.homedir(), '.pi', 'agent', 'memory')
+  // projectSlug(cwd) differs from current only for a subdirectory session (current is
+  // keyed on the repo root); for a repo-root session it equals current and is skipped.
+  const candidates = [path.join(base, projectSlug(cwd)), path.join(base, legacySlug(cwd))]
+  for (const legacy of candidates) {
+    if (legacy === current || !fs.existsSync(legacy)) continue
+    try {
+      fs.renameSync(legacy, current)
+    } catch {
+      // A failed migration must not take down session start; the store stays put.
+    }
+    return
   }
 }
 
@@ -73,12 +133,13 @@ export function indexWouldOverflow(index: string, name: string, description: str
   // since the injected index is capped at read time.
   const isUpdate = index.split('\n').some((entry) => entry.startsWith(entryPrefix(name)))
   if (isUpdate) return false
-  const next = upsertIndexLine(index, name, description)
+  // Only the loaded content counts: frontmatter and comments are stripped first.
+  const next = stripNonLoaded(upsertIndexLine(index, name, description))
   return next.split('\n').length > INDEX_MAX_LINES || Buffer.byteLength(next, 'utf-8') > INDEX_MAX_BYTES
 }
 
 /** Write a memory and its index line, or say why it cannot be written. */
-export function saveMemory(dir: string, indexPath: string, name: string | undefined, description: string | undefined, content: string | undefined): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+export function saveMemory(dir: string, indexPath: string, name: string | undefined, description: string | undefined, content: string | undefined, now: string = new Date().toISOString()): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
   if (!name || !description || !content) {
     return { content: [{ type: 'text', text: 'save requires name, description, and content.' }], details: {} }
   }
@@ -92,22 +153,51 @@ export function saveMemory(dir: string, indexPath: string, name: string | undefi
     }
   }
   fs.mkdirSync(dir, { recursive: true })
-  fs.writeFileSync(path.join(dir, `${name}.md`), content)
+  // A memory with frontmatter records its write time; one without is left as-is.
+  fs.writeFileSync(path.join(dir, `${name}.md`), stampModified(content, now))
   writeIndex(indexPath, upsertIndexLine(index, name, description))
   return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
 }
 
+/** The read action: a memory's body, capped for context, or a not-found message. */
+function readMemory(dir: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+  try {
+    const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
+    return { content: [{ type: 'text', text: capForContext(body) }], details: {} }
+  } catch {
+    return { content: [{ type: 'text', text: `No memory named ${name}.` }], details: {} }
+  }
+}
+
+/** The delete action: remove a memory file and its index line. The index is read
+ * before anything is removed: refusing on a failed read must leave both the memory
+ * file and the index as they were. */
+function deleteMemory(dir: string, indexPath: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+  let index: string
+  try {
+    index = readIndex(dir)
+  } catch (error) {
+    return { content: [{ type: 'text', text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
+  }
+  fs.rmSync(path.join(dir, `${name}.md`), { force: true })
+  const remaining = removeIndexLine(index, name)
+  if (remaining) writeIndex(indexPath, remaining)
+  else fs.rmSync(indexPath, { force: true })
+  return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
+}
+
 /** The index as injected into the prompt, bounded like Claude's startup load. */
 export function capIndexForPrompt(index: string): string {
-  const withinLines = index.split('\n').slice(0, INDEX_MAX_LINES)
-  let dropped = index.split('\n').length - withinLines.length
+  const loaded = stripNonLoaded(index)
+  const withinLines = loaded.split('\n').slice(0, INDEX_MAX_LINES)
+  let dropped = loaded.split('\n').length - withinLines.length
   let text = withinLines.join('\n')
   while (Buffer.byteLength(text, 'utf-8') > INDEX_MAX_BYTES && withinLines.length > 1) {
     withinLines.pop()
     dropped++
     text = withinLines.join('\n')
   }
-  if (dropped <= 0) return index
+  if (dropped <= 0) return loaded
   return `${text}\n(${dropped} more memories not shown; use the memory tool with action "list")`
 }
 
@@ -175,12 +265,55 @@ function writeIndex(indexPath: string, content: string): void {
   fs.renameSync(tmp, indexPath)
 }
 
+/** The settings chain that decides `autoMemoryEnabled` and `autoMemoryDirectory`:
+ * user settings always, then project settings (nearest at or above cwd) only when
+ * approved, since a project's `autoMemoryDirectory` is honored under the same trust
+ * rule as hooks in settings files. Later files win. */
+export function memorySettingsFiles(cwd: string, home: string, approved: boolean): string[] {
+  const files = [path.join(home, '.claude', 'settings.json')]
+  if (!approved) return files
+  for (const name of ['settings.json', 'settings.local.json']) {
+    files.push(findNearestFile(cwd, path.join('.claude', name)) ?? path.join(cwd, '.claude', name))
+  }
+  return files
+}
+
+/** Merge the two memory settings across the chain, later files winning per key. */
+export function readMemorySettings(files: string[]): { autoMemoryEnabled?: unknown; autoMemoryDirectory?: unknown } {
+  const merged: { autoMemoryEnabled?: unknown; autoMemoryDirectory?: unknown } = {}
+  for (const file of files) {
+    try {
+      const settings = JSON.parse(fs.readFileSync(file, 'utf-8'))
+      if (settings === null || typeof settings !== 'object') continue
+      if ('autoMemoryEnabled' in settings) merged.autoMemoryEnabled = settings.autoMemoryEnabled
+      if ('autoMemoryDirectory' in settings) merged.autoMemoryDirectory = settings.autoMemoryDirectory
+    } catch {
+      // missing or invalid settings file: skip
+    }
+  }
+  return merged
+}
+
 export default function memoryExtension(pi: ExtensionAPI) {
   let dir = memoryDir(process.cwd())
+  let enabled = true
+
+  // These extensions also load inside spawned subagent processes, which carry the
+  // PI_CODE_SUBAGENT marker. Claude does not load the main conversation's auto memory
+  // into subagents (they get their own store through the agent `memory:` field), so
+  // everything here no-ops there: no index injection, no notify, and the tool never
+  // touches the parent store. Read per call so tests can flip the env var.
+  const inSubagent = (): boolean => Boolean(process.env.PI_CODE_SUBAGENT)
 
   pi.on('session_start', async (_event, ctx) => {
+    if (inSubagent()) return
     migrateLegacyStore(ctx.cwd)
-    dir = memoryDir(ctx.cwd)
+    const approved = isProjectApprovedSilently(ctx)
+    const settings = readMemorySettings(memorySettingsFiles(ctx.cwd, os.homedir(), approved))
+    enabled = autoMemoryEnabled(settings.autoMemoryEnabled, process.env)
+    const override = typeof settings.autoMemoryDirectory === 'string' ? settings.autoMemoryDirectory : undefined
+    dir = enabled ? resolveMemoryDir(ctx.cwd, override) : memoryDir(ctx.cwd)
+    if (!enabled) return
     const count = readIndexQuietly(dir)
       .split('\n')
       .filter((l) => l.startsWith('- ')).length
@@ -188,6 +321,7 @@ export default function memoryExtension(pi: ExtensionAPI) {
   })
 
   pi.on('before_agent_start', async (event) => {
+    if (inSubagent() || !enabled) return
     const index = readIndexQuietly(dir)
     if (!index.trim()) return
     return {
@@ -201,6 +335,12 @@ export default function memoryExtension(pi: ExtensionAPI) {
     description: 'Persistent memory across sessions. Save durable facts, user preferences, corrections, and project decisions that are not derivable from the code. Actions: save (name + description + content), read (name), delete (name), list.',
     parameters: MemoryParams,
     async execute(_id, params) {
+      if (inSubagent()) {
+        return { content: [{ type: 'text' as const, text: 'The memory tool is unavailable in a subagent; auto memory belongs to the main conversation. Use your agent memory directory instead if one was provided.' }], details: {} }
+      }
+      if (!enabled) {
+        return { content: [{ type: 'text' as const, text: 'Auto memory is disabled (autoMemoryEnabled is false or CLAUDE_CODE_DISABLE_AUTO_MEMORY is set). No memory was read or written.' }], details: {} }
+      }
       const name = params.name ? slugifyName(params.name) : undefined
       const indexPath = path.join(dir, INDEX_FILE)
 
@@ -214,29 +354,12 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
       if (params.action === 'read') {
         if (!name) return { content: [{ type: 'text' as const, text: 'read requires name.' }], details: {} }
-        try {
-          const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
-          return { content: [{ type: 'text' as const, text: capForContext(body) }], details: {} }
-        } catch {
-          return { content: [{ type: 'text' as const, text: `No memory named ${name}.` }], details: {} }
-        }
+        return readMemory(dir, name)
       }
 
       if (params.action === 'delete') {
         if (!name) return { content: [{ type: 'text' as const, text: 'delete requires name.' }], details: {} }
-        // The index is read before anything is removed: refusing on a failed read
-        // must leave both the memory file and the index as they were.
-        let index: string
-        try {
-          index = readIndex(dir)
-        } catch (error) {
-          return { content: [{ type: 'text' as const, text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
-        }
-        fs.rmSync(path.join(dir, `${name}.md`), { force: true })
-        const remaining = removeIndexLine(index, name)
-        if (remaining) writeIndex(indexPath, remaining)
-        else fs.rmSync(indexPath, { force: true })
-        return { content: [{ type: 'text' as const, text: `Deleted memory ${name}.` }], details: {} }
+        return deleteMemory(dir, indexPath, name)
       }
 
       const index = readIndexQuietly(dir)

package/extensions/notify.ts

@@ -6,11 +6,62 @@
  * - OSC 777: Ghostty, iTerm2, WezTerm, rxvt-unicode
  * - OSC 99: Kitty
  * - Windows toast: Windows Terminal (WSL)
+ *
+ * Honors Claude Code's `preferredNotifChannel` (user settings): `terminal_bell`
+ * rings the bell, `notifications_disabled` stays silent, `iterm2_with_bell` does
+ * both, anything else sends the desktop notification. Like Claude, a notification
+ * fires only when you "appear to be away": pi exposes no terminal-focus signal, so
+ * a turn is treated as away when it ran at least AWAY_AFTER_MS, or when no prompt
+ * was submitted since session start.
  */
 
 import { execFile } from 'node:child_process'
+import * as fs from 'node:fs'
+import * as os from 'node:os'
+import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+/** How a finished turn is announced, from Claude's `preferredNotifChannel`. */
+export type NotifChannel = 'desktop' | 'bell' | 'both' | 'off'
+
+/** Map Claude's `preferredNotifChannel` to what we emit. Unknown or unset means the
+ * default desktop notification; `iterm2_with_bell` both notifies and rings. */
+export function resolveNotifChannel(setting: unknown): NotifChannel {
+  switch (typeof setting === 'string' ? setting : '') {
+    case 'notifications_disabled':
+      return 'off'
+    case 'terminal_bell':
+      return 'bell'
+    case 'iterm2_with_bell':
+      return 'both'
+    default:
+      return 'desktop'
+  }
+}
+
+/** How long a turn must run before its end is worth a notification. Claude only
+ * notifies when you "appear to be away"; pi exposes no terminal-focus signal, so a
+ * turn that ran at least this long is the best available proxy for having stepped
+ * away. A turn with no recorded start (none since session start) always notifies. */
+export const AWAY_AFTER_MS = 30_000
+
+export function isAway(lastInputAt: number | undefined, now: number, thresholdMs: number): boolean {
+  if (lastInputAt === undefined) return true
+  return now - lastInputAt >= thresholdMs
+}
+
+/** The `preferredNotifChannel` from the user's settings. This is a personal terminal
+ * preference, so only user scope is read; a checked-out repo does not get to silence
+ * or change your notifications. */
+function readPreferredNotifChannel(home: string): unknown {
+  try {
+    const settings = JSON.parse(fs.readFileSync(path.join(home, '.claude', 'settings.json'), 'utf-8'))
+    return settings?.preferredNotifChannel
+  } catch {
+    return undefined
+  }
+}
+
 function windowsToastScript(title: string, body: string): string {
   const type = 'Windows.UI.Notifications'
   const mgr = `[${type}.ToastNotificationManager, ${type}, ContentType = WindowsRuntime]`
@@ -37,9 +88,7 @@ function notifyWindows(title: string, body: string): void {
   execFile(powershell, ['-NoProfile', '-Command', windowsToastScript(title, body)], () => {})
 }
 
-function notify(title: string, body: string): void {
-  // Piped or headless stdout (pi -p, CI) must not receive raw escape bytes.
-  if (!process.stdout.isTTY) return
+function notifyDesktop(title: string, body: string): void {
   if (process.env.WT_SESSION) {
     notifyWindows(title, body)
   } else if (process.env.KITTY_WINDOW_ID) {
@@ -50,7 +99,30 @@ function notify(title: string, body: string): void {
 }
 
 export default function notifyExtension(pi: ExtensionAPI) {
+  let channel: NotifChannel = 'desktop'
+  // When the user last submitted a prompt, so a turn's duration can stand in for
+  // Claude's "appear to be away" check. Undefined until the first prompt this session.
+  let lastInputAt: number | undefined
+
+  pi.on('session_start', async (_event, _ctx) => {
+    channel = resolveNotifChannel(readPreferredNotifChannel(os.homedir()))
+    lastInputAt = undefined
+  })
+
+  pi.on('input', async () => {
+    lastInputAt = Date.now()
+  })
+
   pi.on('agent_end', async () => {
-    notify('Pi', 'Ready for input')
+    if (channel === 'off') return
+    // Piped or headless stdout (pi -p, CI) must not receive raw escape bytes.
+    if (!process.stdout.isTTY) return
+    if (!isAway(lastInputAt, Date.now(), AWAY_AFTER_MS)) return
+    if (channel === 'bell') {
+      process.stdout.write('\x07')
+      return
+    }
+    notifyDesktop('Pi', 'Ready for input')
+    if (channel === 'both') process.stdout.write('\x07')
   })
 }

package/extensions/output-styles.ts

@@ -2,7 +2,9 @@
  * Output Styles Extension
  *
  * Bridges Claude Code's output styles into pi. It discovers `.claude/output-styles/*.md`
- * (user then project), honors the active style recorded as `outputStyle` in
+ * (user then project) plus styles shipped by enabled plugins (manifest `outputStyles`,
+ * default `output-styles/`, ranked below the user's and project's own), honors the
+ * active style recorded as `outputStyle` in
  * `.claude/settings.json` (user, project, then settings.local.json, last wins),
  * and appends that style's body to the system prompt so the agent adopts its
  * tone and role. `/output-style` lists the styles and persists a choice to the
@@ -22,7 +24,9 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { installedPlugins } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
+import { findNearestDir, findNearestFile } from './internal/project-root.js'
 
 export interface OutputStyle {
   name: string
@@ -79,10 +83,24 @@ function isDirectory(target: string): boolean {
  */
 export function styleDirs(cwd: string, home: string, trusted: boolean): string[] {
   const dirs = [path.join(home, '.claude', 'output-styles')]
-  if (trusted) dirs.push(path.join(cwd, '.claude', 'output-styles'))
+  if (trusted) dirs.push(findNearestDir(cwd, path.join('.claude', 'output-styles')) ?? path.join(cwd, '.claude', 'output-styles'))
   return dirs.filter((dir) => isDirectory(dir))
 }
 
+/**
+ * Output-style directories of every enabled plugin: `output-styles/` unless the
+ * manifest's `outputStyles` points elsewhere, in which case it replaces the
+ * default scan (Claude Code semantics). Plugins are user-installed, so user scope
+ * alone decides; they rank below the user's and project's own styles.
+ */
+export function pluginStyleDirs(home: string): string[] {
+  return installedPlugins(home).flatMap((plugin) => {
+    const declared = plugin.manifest.outputStyles
+    const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'output-styles']
+    return dirs.map((dir) => path.resolve(plugin.root, String(dir)))
+  })
+}
+
 /** All output styles, project entries overriding user entries of the same name. */
 export function loadStyles(dirs: string[]): OutputStyle[] {
   const byName = new Map<string, OutputStyle>()
@@ -108,10 +126,14 @@ export function loadStyles(dirs: string[]): OutputStyle[] {
   return [...byName.values()]
 }
 
-/** Settings files that carry `outputStyle`. Project settings apply only when trusted. */
+/** Settings files that carry `outputStyle`. Project settings apply only when trusted,
+ * each the nearest of its name at or above cwd, as the hooks settings chain reads. */
 export function settingsFiles(cwd: string, home: string, trusted: boolean): string[] {
   const files = [path.join(home, '.claude', 'settings.json')]
-  if (trusted) files.push(path.join(cwd, '.claude', 'settings.json'), path.join(cwd, '.claude', 'settings.local.json'))
+  if (!trusted) return files
+  for (const name of ['settings.json', 'settings.local.json']) {
+    files.push(findNearestFile(cwd, path.join('.claude', name)) ?? path.join(cwd, '.claude', name))
+  }
   return files
 }
 
@@ -156,8 +178,14 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
     // project styles / selection once the project is approved. isProjectTrusted alone
     // is true for a repo pi never asked about; see project-approval.
     const trusted = await isProjectApproved(ctx)
-    styles = loadStyles([BUILTIN_STYLES_DIR, ...styleDirs(ctx.cwd, home, trusted)])
-    localSettingsPath = path.join(ctx.cwd, '.claude', 'settings.local.json')
+    // Precedence low to high: builtin, plugin, then the user's and project's own
+    // dirs, so a same-named user or project style overrides a plugin's.
+    styles = loadStyles([BUILTIN_STYLES_DIR, ...pluginStyleDirs(home), ...styleDirs(ctx.cwd, home, trusted)])
+    // Persist the choice where the read chain will find it again: the nearest local
+    // settings file, else inside the nearest .claude directory, else at cwd.
+    const nearestLocal = findNearestFile(ctx.cwd, path.join('.claude', 'settings.local.json'))
+    const claudeDir = findNearestDir(ctx.cwd, '.claude') ?? path.join(ctx.cwd, '.claude')
+    localSettingsPath = nearestLocal ?? path.join(claudeDir, 'settings.local.json')
     activeName = readActiveStyleName(settingsFiles(ctx.cwd, home, trusted))
     const active = styleForName(styles, activeName)
     if (active) ctx.ui.notify(`Output style: ${active.name}`, 'info')

package/extensions/plan-mode/utils.ts

@@ -3,6 +3,8 @@
  * Extracted for testability.
  */
 
+import { hasSubstitution, splitSegments } from '../internal/shell-split.js'
+
 // Destructive commands blocked in plan mode
 const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
@@ -90,62 +92,6 @@ const SAFE_PATTERNS = [
   /^\s*eza\b/,
 ]
 
-// The shell can hide an arbitrary command inside any of these, so they are refused
-// outright rather than parsed.
-const SUBSTITUTION = /\$\(|`|<\(|>\(/
-
-/**
- * Split on the shell separators Claude Code documents (`&&`, `||`, `;`, `|`, `|&`, `&`,
- * newline) so every subcommand is checked on its own, ignoring separators inside quotes:
- * `grep 'a|b'` is one read, not a pipe. Returns nothing on an unbalanced quote, which
- * fails the caller closed rather than guessing at the intended split.
- *
- * A shell AST would be exact; this is the honest approximation for a quoting-only concern.
- */
-/** Length of the separator at `i`, or 0 when there is none. */
-function separatorAt(command: string, i: number): number {
-  const pair = command.slice(i, i + 2)
-  if (pair === '&&' || pair === '||' || pair === '|&') return 2
-  const ch = command[i]
-  return ch === ';' || ch === '|' || ch === '&' || ch === '\n' ? 1 : 0
-}
-
-function splitSegments(command: string): string[] {
-  const segments: string[] = []
-  let current = ''
-  let quote: "'" | '"' | undefined
-
-  for (let i = 0; i < command.length; i++) {
-    const ch = command[i]
-    if (quote !== undefined) {
-      current += ch
-      if (ch === quote) quote = undefined
-      continue
-    }
-    if (ch === "'" || ch === '"') {
-      quote = ch
-      current += ch
-      continue
-    }
-    if (ch === '\\' && i + 1 < command.length) {
-      current += ch + command[++i]
-      continue
-    }
-    const separator = separatorAt(command, i)
-    if (separator > 0) {
-      segments.push(current)
-      current = ''
-      i += separator - 1
-      continue
-    }
-    current += ch
-  }
-
-  if (quote !== undefined) return []
-  segments.push(current)
-  return segments.map((segment) => segment.trim()).filter(Boolean)
-}
-
 // find is allowlisted for traversal only; these actions run commands or delete.
 const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
 
@@ -163,7 +109,7 @@ function isSafeSegment(segment: string): boolean {
  * containing a determined one. Only OS-level isolation would be a boundary.
  */
 export function isSafeCommand(command: string): boolean {
-  if (SUBSTITUTION.test(command)) return false
+  if (hasSubstitution(command)) return false
   const segments = splitSegments(command)
   return segments.length > 0 && segments.every(isSafeSegment)
 }

package/extensions/question.ts

@@ -35,7 +35,7 @@ const OptionSchema = Type.Object({
 const SingleQuestion = Type.Object({
   question: Type.String({ description: 'The question to ask the user' }),
   header: Type.Optional(Type.String({ description: 'Short label for the question, shown above it, kept to 12 characters' })),
-  options: Type.Array(OptionSchema, { description: 'Options for the user to choose from (1-4)', minItems: 1, maxItems: 4 }),
+  options: Type.Array(OptionSchema, { description: 'Options for the user to choose from (2-4)', minItems: 2, maxItems: 4 }),
   multiSelect: Type.Optional(Type.Boolean({ description: 'Allow selecting several options (space toggles, enter confirms)' })),
 })
 
@@ -44,7 +44,7 @@ const SingleQuestion = Type.Object({
  * shapes gave smaller models nothing to follow, and they produced neither. */
 export const QuestionParams = Type.Object({
   question: Type.Optional(Type.String({ description: 'The question to ask. Required, unless asking several via questions.' })),
-  options: Type.Optional(Type.Array(OptionSchema, { description: 'The 1-4 choices for this question, each {label, description?}. Required with question.', minItems: 1, maxItems: 4 })),
+  options: Type.Optional(Type.Array(OptionSchema, { description: 'The 2-4 choices for this question, each {label, description?}. Required with question.', minItems: 2, maxItems: 4 })),
   header: Type.Optional(Type.String({ description: 'Optional short label shown above the question, kept to 12 characters' })),
   multiSelect: Type.Optional(Type.Boolean({ description: 'Optional: allow selecting several options (space toggles, enter confirms)' })),
   questions: Type.Optional(Type.Array(SingleQuestion, { description: 'Only to ask 2-4 questions in one call: each entry takes the same fields as above. Leave unset for a single question.', minItems: 1, maxItems: 4 })),

package/extensions/skills.ts

@@ -15,7 +15,9 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
+import { installedPlugins } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
+import { findNearestDir } from './internal/project-root.js'
 
 function isDirectory(target: string): boolean {
   try {
@@ -32,7 +34,15 @@ function isDirectory(target: string): boolean {
  * text into the prompt without the user ever agreeing to load its config. */
 export function skillDirs(cwd: string, home: string, trusted: boolean): string[] {
   const candidates = [path.join(home, '.claude', 'skills')]
-  if (trusted) candidates.push(path.join(cwd, '.claude', 'skills'))
+  // Enabled plugins contribute their skills directories. pi's loader names a
+  // skill by its directory, so a plugin skill registers without Claude's
+  // /plugin: prefix; a rename-free approximation, disclosed in the README.
+  for (const plugin of installedPlugins(home)) {
+    const declared = plugin.manifest.skills
+    const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'skills']
+    candidates.push(...dirs.map((dir) => path.resolve(plugin.root, String(dir))))
+  }
+  if (trusted) candidates.push(findNearestDir(cwd, path.join('.claude', 'skills')) ?? path.join(cwd, '.claude', 'skills'))
   const dirs: string[] = []
   for (const dir of candidates) {
     if (!dirs.includes(dir) && isDirectory(dir)) dirs.push(dir)