pi-code 1.0.47 → 1.0.49

package/extensions/hooks/index.ts

@@ -97,6 +97,7 @@ import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-a
 import { INSTRUCTIONS_CHANNEL, isInstructionLoadEvent } from '../internal/instruction-events.js'
 import { readManagedSettings } from '../internal/managed-settings.js'
 import { isMcpToolAliases, MCP_TOOLS_CHANNEL } from '../internal/mcp-alias.js'
+import { resolveModelOverride } from '../internal/model-lookup.js'
 import { isPlanModeState, PLAN_MODE_CHANNEL } from '../internal/plan-mode-state.js'
 import { installedPlugins } from '../internal/plugins.js'
 import { isProjectApproved } from '../internal/project-approval.js'
@@ -230,13 +231,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   }
   /** Claude's prompt-hook `model` override, resolved against the models this user
    * can run (exact id first, then a substring match); the session model otherwise. */
-  const resolveHookModel = (ctx: ExtensionContext, override: string | undefined): ExtensionContext['model'] => {
-    if (!override) return ctx.model
-    const available = (ctx as { modelRegistry?: { getAvailable?: () => ReadonlyArray<{ id: string; name?: string }> } }).modelRegistry?.getAvailable?.() ?? []
-    const needle = override.toLowerCase()
-    const match = available.find((model) => model.id.toLowerCase() === needle) ?? available.find((model) => model.id.toLowerCase().includes(needle) || model.name?.toLowerCase().includes(needle))
-    return (match as ExtensionContext['model']) ?? ctx.model
-  }
+  const resolveHookModel = (ctx: ExtensionContext, override: string | undefined): ExtensionContext['model'] => resolveModelOverride(ctx, override)
 
   /** Kills for background hooks still running; Claude kills async hooks at teardown,
    * so session_shutdown reaps anything left rather than let a hung hook pin the

package/extensions/internal/command-file.ts

@@ -13,8 +13,8 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 
 import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
-
 import { splitSegments } from './shell-split.js'
+import { type Fence, fenceMarker, stepFence } from './strip-comments.js'
 
 /** The pi file tools a Claude path rule can govern. */
 export type PathRuleTool = 'read' | 'edit' | 'write'
@@ -421,7 +421,7 @@ export function discoverCommandFiles(root: string): DiscoveredCommand[] {
   return found
 }
 
-export type CommandExec = (command: string) => Promise<{ stdout: string; stderr: string; code: number }>
+export type CommandExec = (command: string) => Promise<{ stdout: string; stderr: string; code: number; killed?: boolean }>
 
 /** PowerShell single-quote escaping: inside a '...' literal the only special
  * characters are the quote delimiters themselves, written doubled. PowerShell's
@@ -511,20 +511,27 @@ interface FenceBlock {
 }
 
 /** Fenced blocks of a body: Claude's dynamic syntax is literal text inside a plain
- * fence, while a ```! fence is itself a placeholder that executes. */
+ * fence, while a ```! fence is itself a placeholder that executes. Fences follow
+ * CommonMark: any indentation, closed only by the opener's character in a run at
+ * least as long, so a tilde line or a shorter fence inside stays content. */
 function fenceBlocks(body: string): FenceBlock[] {
   const blocks: FenceBlock[] = []
-  const fence = /^(```|~~~)([^\n]*)$/gm
+  let fence: Fence | null = null
   let open: { index: number; exec: boolean; contentStart: number } | undefined
-  let match = fence.exec(body)
-  while (match !== null) {
-    if (open === undefined) {
-      open = { index: match.index, exec: match[1] === '```' && match[2].trim() === '!', contentStart: match.index + match[0].length + 1 }
-    } else {
-      blocks.push({ start: open.index, end: match.index + match[0].length, exec: open.exec, content: body.slice(Math.min(open.contentStart, match.index), match.index).replace(/\n$/, '') })
+  let offset = 0
+  for (const line of body.split('\n')) {
+    const trimmed = line.trimStart()
+    const step = stepFence(fence, trimmed, fenceMarker(trimmed))
+    const lineEnd = offset + line.length
+    if (fence === null && step.fence !== null) {
+      // Only the exact, unindented ```! opener executes, as Claude documents it.
+      open = { index: offset, exec: line.startsWith('```') && step.fence.length === 3 && trimmed.slice(3).trim() === '!', contentStart: lineEnd + 1 }
+    } else if (fence !== null && step.fence === null && open !== undefined) {
+      blocks.push({ start: open.index, end: lineEnd, exec: open.exec, content: body.slice(Math.min(open.contentStart, offset), offset).replace(/\n$/, '') })
       open = undefined
     }
-    match = fence.exec(body)
+    fence = step.fence
+    offset = lineEnd + 1
   }
   // An unterminated fence protects to the end of the body rather than executing.
   if (open !== undefined) blocks.push({ start: open.index, end: body.length, exec: false, content: '' })
@@ -563,6 +570,10 @@ export function benignExitOne(command: string, shell: SpanShell = 'bash'): boole
  * documents: the model never sees a half-expanded body. */
 async function runSpan(exec: CommandExec, command: string, pattern: string, shell: SpanShell): Promise<string> {
   const result = await exec(command)
+  // A timeout kill arrives as killed:true with code 0 (a signal death has no exit code),
+  // so the code alone would paste the partial output as a success. Claude kills a span
+  // at the Bash timeout and that failure aborts the invocation.
+  if (result.killed) throw new Error(`Shell command timed out for pattern "${pattern}"`)
   if (result.code !== 0 && !(result.code === 1 && benignExitOne(command, shell))) {
     throw new Error(`Shell command failed for pattern "${pattern}"\n[stderr]\n${(result.stderr || result.stdout).trim()}`)
   }

package/extensions/internal/goal-evaluator.ts

@@ -0,0 +1,262 @@
+/**
+ * The pure half of /goal: the directive Claude Code sends when a goal is set, the
+ * evaluator prompt its small fast model judges the condition with, the transcript
+ * rendering that prompt sees, verdict parsing, the classifier for the errors that
+ * clear a goal, the check-in schedule, and the status text. No pi state lives here,
+ * so goal.ts stays the lifecycle wiring and each contract is pinned on its own.
+ */
+
+/** Claude caps a goal condition at 4,000 characters. */
+export const GOAL_CONDITION_MAX_CHARS = 4000
+
+/** `/goal clear` and its documented aliases, matched case-insensitively. */
+const CLEAR_ALIASES = new Set(['clear', 'stop', 'off', 'reset', 'none', 'cancel'])
+
+export function isClearAlias(text: string): boolean {
+  return CLEAR_ALIASES.has(text.toLowerCase())
+}
+
+/** The directive a set goal starts its first turn with: the condition itself is the task. */
+export function kickoffPrompt(condition: string): string {
+  return `A session-scoped Stop hook is now active with condition: "${condition}". Briefly acknowledge the goal, then immediately start (or continue) working toward it: treat the condition itself as your directive and do not pause to ask the user what to do. The hook will block stopping until the condition holds. It auto-clears once the condition is met, so do not tell the user to run \`/goal clear\` after success; that is only for clearing a goal early.`
+}
+
+/** Claude's stop-condition evaluator instructions: transcript evidence only, three
+ * verdict shapes, and impossible reserved for a condition that can never hold. */
+export const EVALUATOR_SYSTEM = [
+  'You are evaluating a stop-condition hook for a coding agent session. Read the conversation transcript carefully, then judge whether the user-provided condition is satisfied.',
+  'Your response must be a JSON object with one of these shapes:',
+  '- {"ok": true, "reason": "<quote evidence from the transcript that satisfies the condition>"}',
+  '- {"ok": false, "reason": "<quote what is missing or what blocks the condition>"}',
+  '- {"ok": false, "impossible": true, "reason": "<explain why the condition can never be satisfied>"}',
+  'Always include a "reason" field, quoting specific text from the transcript whenever possible. If the transcript does not contain clear evidence that the condition is satisfied, return {"ok": false, "reason": "insufficient evidence in transcript"}.',
+  'Only use {"ok": false, "impossible": true} when the condition is genuinely unachievable in this session, for example: the condition is self-contradictory, it depends on a resource or capability that is unavailable, or the assistant has explicitly tried, exhausted reasonable approaches, and stated it cannot be done. Apply your own judgment when deciding this: the assistant claiming the goal is impossible is evidence, not proof; independently confirm the condition is genuinely unachievable rather than deferring to the assistant\'s self-assessment. Do not use it just because the goal has not been reached yet or because progress is slow. When in doubt, return {"ok": false} without "impossible".',
+  // Claude pins the reply with a JSON schema; pi's one-off completion cannot, so the
+  // instruction has to carry that weight.
+  'Output the JSON object only, with no text before or after it and no code fence.',
+].join('\n')
+
+/** The user turn of the evaluation: the rendered transcript, then Claude's question. */
+export function evaluatorPrompt(transcript: string, condition: string): string {
+  return `<transcript>\n${transcript}\n</transcript>\n\nBased on the conversation transcript above, has the following stopping condition been satisfied? Answer based on transcript evidence only.\nCondition: ${condition}`
+}
+
+export interface GoalVerdict {
+  ok: boolean
+  reason: string
+  /** Only meaningful when ok is false: the condition can never be satisfied. */
+  impossible: boolean
+}
+
+/** A reply with no JSON at all but an opening yes/no: a small model answering the
+ * question in prose. The whole reply becomes the reason. Anything less clear-cut is
+ * not a verdict. */
+function proseVerdict(text: string): GoalVerdict | undefined {
+  const lead = /^\s*(yes|no)\b/i.exec(text)?.[1]?.toLowerCase()
+  if (lead === undefined) return undefined
+  return { ok: lead === 'yes', reason: text.trim(), impossible: false }
+}
+
+/** The evaluator's JSON verdict, tolerating prose or a code fence around the object; a
+ * reply with no object at all falls back to its yes/no lead. Undefined when the object
+ * does not parse, `ok` is not a boolean, or no lead is there, which the caller treats
+ * as an evaluator error rather than a verdict. */
+export function parseVerdict(text: string): GoalVerdict | undefined {
+  const start = text.indexOf('{')
+  const end = text.lastIndexOf('}')
+  if (start === -1) return proseVerdict(text)
+  if (end <= start) return undefined
+  let parsed: unknown
+  try {
+    parsed = JSON.parse(text.slice(start, end + 1))
+  } catch {
+    return undefined
+  }
+  if (typeof parsed !== 'object' || parsed === null) return undefined
+  const { ok, reason, impossible } = parsed as Record<string, unknown>
+  if (typeof ok !== 'boolean') return undefined
+  return { ok, reason: typeof reason === 'string' ? reason.trim() : '', impossible: !ok && impossible === true }
+}
+
+/** One message's rendering is capped so a single tool dump cannot consume the budget. */
+const BLOCK_MAX_CHARS = 6000
+/** Tool arguments are context, not evidence; a short prefix identifies the call. */
+const TOOL_ARGS_MAX_CHARS = 400
+const OMITTED_MARKER = '[earlier transcript omitted]'
+
+interface ContentPart {
+  type?: string
+  text?: string
+  name?: string
+  arguments?: unknown
+}
+
+interface TranscriptMessage {
+  role?: string
+  content?: unknown
+  toolName?: string
+  customType?: string
+  stopReason?: string
+  errorMessage?: string
+}
+
+function truncate(text: string, max: number): string {
+  if (text.length <= max) return text
+  return `${text.slice(0, max)}... [truncated ${text.length - max} chars]`
+}
+
+/** Text and tool-call parts of a content value; thinking is dropped, images noted. */
+function partsText(content: unknown): string {
+  if (typeof content === 'string') return content
+  if (!Array.isArray(content)) return ''
+  const rendered: string[] = []
+  for (const part of content as ContentPart[]) {
+    if (part?.type === 'text' && typeof part.text === 'string') rendered.push(part.text)
+    else if (part?.type === 'image') rendered.push('[image]')
+    else if (part?.type === 'toolCall') rendered.push(`[tool call ${part.name}(${truncate(JSON.stringify(part.arguments ?? {}), TOOL_ARGS_MAX_CHARS)})]`)
+  }
+  return rendered.join('\n')
+}
+
+function renderMessage(message: TranscriptMessage): string | undefined {
+  switch (message.role) {
+    case 'user':
+      return `User: ${partsText(message.content)}`
+    case 'assistant': {
+      const body = message.stopReason === 'error' ? `[error: ${message.errorMessage ?? 'unknown error'}]` : partsText(message.content)
+      return `Assistant: ${body}`
+    }
+    case 'toolResult':
+      return `Tool result (${message.toolName ?? 'tool'}): ${partsText(message.content)}`
+    case 'custom':
+      return `Note (${message.customType ?? 'note'}): ${partsText(message.content)}`
+    default:
+      return undefined
+  }
+}
+
+/**
+ * The conversation as the evaluator reads it: one block per message, newest last,
+ * trimmed from the head to `budgetChars` (Claude trims to half the evaluator's
+ * context window). A cut is marked so the model knows evidence may predate it; the
+ * newest message always survives, cut to the budget when it alone exceeds it.
+ */
+export function renderTranscript(messages: readonly unknown[], budgetChars: number): string {
+  const blocks: string[] = []
+  for (const message of messages as TranscriptMessage[]) {
+    const rendered = renderMessage(message)
+    if (rendered !== undefined) blocks.push(truncate(rendered, BLOCK_MAX_CHARS))
+  }
+  const newest = blocks.at(-1)
+  if (newest === undefined) return ''
+  const separator = '\n\n'
+  const kept: string[] = []
+  let used = 0
+  for (let i = blocks.length - 1; i >= 0; i--) {
+    const cost = blocks[i].length + (kept.length > 0 ? separator.length : 0)
+    if (used + cost > budgetChars) {
+      if (kept.length > 0) kept.unshift(OMITTED_MARKER)
+      break
+    }
+    kept.unshift(blocks[i])
+    used += cost
+  }
+  if (kept.length === 0) return newest.slice(0, budgetChars)
+  return kept.join(separator)
+}
+
+export type UnrecoverableKind = 'authentication' | 'credits' | 'context overflow' | 'model unavailable'
+
+/** Claude clears a goal after an error the user has to fix. Transient failures (rate
+ * limits, overloads, network) deliberately match nothing so the goal stays set. */
+const UNRECOVERABLE: ReadonlyArray<[UnrecoverableKind, RegExp]> = [
+  ['authentication', /\b40[13]\b|unauthori[sz]ed|authentication|invalid (?:api[ -])?key|x-api-key/i],
+  ['credits', /\bcredit|billing|insufficient[ _](?:funds|balance|quota)|payment required|\b402\b/i],
+  ['context overflow', /context (?:window|length)|too (?:long|many tokens)|maximum (?:context|input) (?:length|tokens)/i],
+  ['model unavailable', /model.*(?:not found|unavailable|does not exist|not available|unsupported)|no such model|not_found_error|\b404\b/i],
+]
+
+export function classifyUnrecoverable(errorMessage: string): UnrecoverableKind | undefined {
+  return UNRECOVERABLE.find(([, pattern]) => pattern.test(errorMessage))?.[0]
+}
+
+export function formatDuration(ms: number): string {
+  const seconds = Math.max(0, Math.round(ms / 1000))
+  if (seconds < 60) return `${seconds}s`
+  const minutes = Math.floor(seconds / 60)
+  if (minutes < 60) return `${minutes}m ${seconds % 60}s`
+  return `${Math.floor(minutes / 60)}h ${minutes % 60}m`
+}
+
+export function formatTokens(tokens: number): string {
+  if (tokens >= 1_000_000) return `${(tokens / 1_000_000).toFixed(1)}M`
+  if (tokens >= 1000) return `${(tokens / 1000).toFixed(1)}k`
+  return String(tokens)
+}
+
+function plural(count: number, noun: string): string {
+  return `${count} ${noun}${count === 1 ? '' : 's'}`
+}
+
+export interface GoalSummary {
+  condition: string
+  durationMs: number
+  /** Turns the evaluator has judged. */
+  iterations: number
+  /** Tokens spent since the goal was set, evaluator calls included. */
+  tokens: number
+  lastReason?: string
+}
+
+/** Claude's status view fields: duration, turn count, and token spend. */
+export function summaryText(summary: GoalSummary): string {
+  return `${formatDuration(summary.durationMs)} · ${plural(summary.iterations, 'turn')} · ${formatTokens(summary.tokens)} tokens`
+}
+
+export const NO_GOAL_TEXT = 'No goal set. Usage: /goal <condition>'
+
+export function formatActiveGoal(summary: GoalSummary): string {
+  const turns = summary.iterations === 0 ? 'not yet evaluated' : plural(summary.iterations, 'turn')
+  const lines = [`Goal active: ${summary.condition} (${turns})`, `Running for ${formatDuration(summary.durationMs)} · ${formatTokens(summary.tokens)} tokens`]
+  if (summary.lastReason) lines.push(`Last check: ${summary.lastReason}`)
+  lines.push('/goal clear to stop early')
+  return lines.join('\n')
+}
+
+export function formatAchievedGoal(summary: GoalSummary): string {
+  return `Goal achieved: ${summary.condition} (${summaryText(summary)})\n/goal <condition> to set another`
+}
+
+/** Claude's first check-in interval while background work keeps a goal waiting. */
+export const DEFAULT_CHECKIN_MINUTES = 30
+/** Later check-ins wait twice as long each, up to four times the first interval. */
+const MAX_CHECKIN_DOUBLINGS = 2
+/** Idle check-ins per goal between user prompts; the third says they are paused. */
+export const MAX_IDLE_CHECKINS = 3
+
+/** Milliseconds until the next check-in given how many have been delivered for this
+ * goal: CLAUDE_CODE_GOAL_CHECKIN_MINUTES (0 turns check-ins off, junk falls back to
+ * the default) scaled by Claude's doubling. */
+export function checkinIntervalMs(env: Record<string, string | undefined>, delivered: number): number {
+  const raw = env.CLAUDE_CODE_GOAL_CHECKIN_MINUTES
+  const parsed = raw === undefined || raw.trim() === '' ? Number.NaN : Number(raw)
+  const minutes = Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_CHECKIN_MINUTES
+  return minutes * 60_000 * 2 ** Math.min(delivered, MAX_CHECKIN_DOUBLINGS)
+}
+
+export interface RunningWork {
+  id: string
+  agentType: string
+}
+
+/** Claude's check-in turn: the running work to look at, or a nudge to continue when
+ * the work stopped without reporting. `paused` marks the capped idle check-in. */
+export function checkinText(condition: string, deferredMs: number, running: readonly RunningWork[], paused: boolean): string {
+  const minutes = Math.max(1, Math.round(deferredMs / 60_000))
+  const pausedNote = paused ? ' Idle check-ins are paused until your next message, so say clearly where things stand.' : ''
+  if (running.length === 0) {
+    return `Goal check-in: «${condition}» is still active. Its evaluation was deferred for ${minutes} min while background work ran, and that work is no longer running (it finished or was stopped without reporting back). Continue toward the goal.${pausedNote}`
+  }
+  const list = running.map((work) => `- ${work.id} · subagent ${work.agentType}`).join('\n')
+  return `Goal check-in: «${condition}» is still active, and evaluation has been deferred for ${minutes} min because background work is still running:\n${list}\nCheck on their progress (e.g. read their output). If they are progressing, say so briefly and keep waiting; if they are stuck or no longer needed, fix or stop them and continue toward the goal.${pausedNote}`
+}

package/extensions/internal/html-markdown.ts

@@ -5,7 +5,8 @@
  * A regex pipeline, not a DOM: pi ships no HTML parser and the output is prose
  * for a model, not a rendering. Every pattern bounds its tag matches with
  * [^<>]* so a failed match stops at the next tag instead of rescanning to the
- * end of input, keeping the pass linear on hostile pages.
+ * end of input, keeping the pass linear on hostile pages. Bare tag removal is a
+ * scanner rather than a regex: see removeTags.
  */
 
 const NAMED_ENTITIES: Record<string, string> = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'", nbsp: ' ' }
@@ -18,7 +19,34 @@ function decodeAllEntities(text: string): string {
   })
 }
 
-const stripInnerTags = (html: string): string => html.replace(/<[^<>]*>/g, '')
+/** The HTML tokenizer's tag-open rule: `<` starts a tag only before a letter, `/`,
+ * `!`, or `?`; any other `<` (as in `1 < 2`) is text. */
+const TAG_OPEN = /^<[A-Za-z/!?]/
+
+/**
+ * Drop every tag in one linear pass. A regex strip can rebuild a tag out of nested
+ * brackets: `<scr<b>ipt>` loses `<b>` and becomes `<script>` (CodeQL's incomplete
+ * multi-character sanitization). Skipping from a tag's `<` to the next `>` removes the
+ * whole span, so nothing removed can reassemble; a tag that never closes stays as text.
+ */
+export function removeTags(html: string): string {
+  let out = ''
+  let cursor = 0
+  while (cursor < html.length) {
+    const open = html.indexOf('<', cursor)
+    if (open === -1) return out + html.slice(cursor)
+    if (!TAG_OPEN.test(html.slice(open, open + 2))) {
+      out += html.slice(cursor, open + 1)
+      cursor = open + 1
+      continue
+    }
+    const close = html.indexOf('>', open + 1)
+    if (close === -1) return out + html.slice(cursor)
+    out += html.slice(cursor, open)
+    cursor = close + 1
+  }
+  return out
+}
 
 // Strip leading and trailing newline runs in linear time. The equivalent
 // /^\n+|\n+$/g backtracks super-linearly on a long run of newlines (S8786).
@@ -37,23 +65,23 @@ export function htmlToMarkdown(html: string): string {
     .replace(/<!--[\s\S]*?-->/g, ' ')
     .replace(/<(script|style|noscript|head|svg)\b[^<>]*>[\s\S]*?<\/\1[^<>]*>/gi, ' ')
     .replace(/<pre\b[^<>]*>([\s\S]*?)<\/pre>/gi, (_whole, inner: string) => {
-      preBodies.push(trimNewlines(decodeAllEntities(stripInnerTags(inner))))
+      preBodies.push(trimNewlines(decodeAllEntities(removeTags(inner))))
       return `\n\n\uE000PRE${preBodies.length - 1}\uE000\n\n`
     })
 
   work = work
-    .replace(/<code\b[^<>]*>([\s\S]*?)<\/code>/gi, (_whole, inner: string) => `\`${stripInnerTags(inner)}\``)
+    .replace(/<code\b[^<>]*>([\s\S]*?)<\/code>/gi, (_whole, inner: string) => `\`${removeTags(inner)}\``)
     // Only real web links become markdown links; fragment and javascript hrefs
     // keep their label and lose the target.
     .replace(/<a\b[^<>]*?href=(?:"([^"]*)"|'([^']*)')[^<>]*>([\s\S]*?)<\/a>/gi, (_whole, dq: string | undefined, sq: string | undefined, inner: string) => {
       const href = decodeAllEntities(dq ?? sq ?? '')
-      const label = stripInnerTags(inner).trim()
+      const label = removeTags(inner).trim()
       if (!label) return ' '
       return /^https?:\/\//i.test(href) ? `[${label}](${href})` : label
     })
-    .replace(/<(strong|b)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `**${stripInnerTags(inner).trim()}**`)
-    .replace(/<(em|i)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `*${stripInnerTags(inner).trim()}*`)
-    .replace(/<h([1-6])\b[^<>]*>([\s\S]*?)<\/h\1>/gi, (_whole, level: string, inner: string) => `\n\n${'#'.repeat(Number(level))} ${stripInnerTags(inner).trim()}\n\n`)
+    .replace(/<(strong|b)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `**${removeTags(inner).trim()}**`)
+    .replace(/<(em|i)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `*${removeTags(inner).trim()}*`)
+    .replace(/<h([1-6])\b[^<>]*>([\s\S]*?)<\/h\1>/gi, (_whole, level: string, inner: string) => `\n\n${'#'.repeat(Number(level))} ${removeTags(inner).trim()}\n\n`)
     .replace(/<img\b[^<>]*?alt=(?:"([^"]*)"|'([^']*)')[^<>]*>/gi, (_whole, dq?: string, sq?: string) => dq ?? sq ?? '')
     .replace(/<li\b[^<>]*>/gi, '\n- ')
     .replace(/<blockquote\b[^<>]*>/gi, '\n\n> ')
@@ -61,7 +89,7 @@ export function htmlToMarkdown(html: string): string {
     .replace(/<(?:br|hr)\b[^<>]*>/gi, '\n')
     .replace(/<\/(?:p|div|section|article|ul|ol|li|table|tr|blockquote|tbody|thead|header|footer|main|nav)[^<>]*>/gi, '\n\n')
 
-  const text = decodeAllEntities(work.replace(/<[^<>]*>/g, ''))
+  const text = decodeAllEntities(removeTags(work))
     .replace(/[ \t]+/g, ' ')
     .replace(/ ?\n ?/g, '\n')
     .replace(/\n{3,}/g, '\n\n')

package/extensions/internal/model-lookup.ts

@@ -0,0 +1,20 @@
+/**
+ * A model named by an override (a prompt hook's `model`, /goal's evaluator model),
+ * resolved against the models this user can run: exact id first, then a substring
+ * of the id or display name. The session model stands in when nothing matches or no
+ * override was given, so a misspelled override degrades to the default rather than
+ * silently disabling the feature.
+ */
+
+export interface ModelLookupContext<M> {
+  model: M | undefined
+  modelRegistry?: { getAvailable?: () => ReadonlyArray<{ id: string; name?: string }> }
+}
+
+export function resolveModelOverride<M>(ctx: ModelLookupContext<M>, override: string | undefined): M | undefined {
+  if (!override) return ctx.model
+  const available = ctx.modelRegistry?.getAvailable?.() ?? []
+  const needle = override.toLowerCase()
+  const match = available.find((model) => model.id.toLowerCase() === needle) ?? available.find((model) => model.id.toLowerCase().includes(needle) || model.name?.toLowerCase().includes(needle))
+  return (match as M | undefined) ?? ctx.model
+}

package/extensions/internal/output-guard.ts

@@ -15,12 +15,13 @@ import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '
 /**
  * Trim `text` to a byte budget. `String.slice` counts UTF-16 units, so slicing a CJK
  * string by a byte budget keeps up to three times the bytes asked for; cutting the
- * encoded buffer is exact. A character straddling the cut decodes to U+FFFD.
- * Shorter input comes back whole and a negative budget yields nothing, so callers
- * need no length check of their own.
+ * encoded buffer is exact. A character straddling the cut is dropped (the streaming
+ * decoder holds back an incomplete sequence instead of emitting U+FFFD), so the
+ * result is whole characters within the budget. Shorter input comes back whole and a
+ * negative budget yields nothing, so callers need no length check of their own.
  */
-function sliceBytes(text: string, maxBytes: number): string {
-  return Buffer.from(text, 'utf-8').subarray(0, Math.max(0, maxBytes)).toString('utf-8')
+export function sliceBytes(text: string, maxBytes: number): string {
+  return new TextDecoder().decode(Buffer.from(text, 'utf-8').subarray(0, Math.max(0, maxBytes)), { stream: true })
 }
 
 /** Trim `text` to pi's documented tool-output budget, noting what was dropped. */

package/extensions/internal/strip-comments.ts

@@ -11,7 +11,7 @@
  * fenced code block (backtick or tilde).
  */
 
-/** The fence a line opens or closes, if any; mirrors context-imports. */
+/** The fence a line opens or closes, if any. */
 export function fenceMarker(lineStart: string): string | null {
   if (lineStart.startsWith('```')) return '`'
   if (lineStart.startsWith('~~~')) return '~'
@@ -29,14 +29,14 @@ function fenceLength(lineStart: string, marker: string): number {
 // is at least as long as the opener, so both are tracked: a shorter same-char
 // fence line (the classic 3-backtick block quoted inside a 4-backtick one) is
 // content, not a closer.
-interface Fence {
+export interface Fence {
   marker: string
   length: number
 }
 
 /** The fence state after a line, plus whether the line is fenced code (opener,
  * body, or closer) and so emitted verbatim rather than scanned for comments. */
-function stepFence(fence: Fence | null, trimmed: string, marker: string | null): { fence: Fence | null; fenced: boolean } {
+export function stepFence(fence: Fence | null, trimmed: string, marker: string | null): { fence: Fence | null; fenced: boolean } {
   if (marker !== null && fence === null) {
     return { fence: { marker, length: fenceLength(trimmed, marker) }, fenced: true }
   }

package/extensions/memory.ts

@@ -98,11 +98,36 @@ export function stampModified(content: string, iso: string): string {
   return `---\n${body}modified: ${iso}\n---${rest}`
 }
 
+/** Length of the line break `text` starts with: CRLF, LF, or none. */
+function leadingLineBreak(text: string): number {
+  if (text.startsWith('\r\n')) return 2
+  return text.startsWith('\n') ? 1 : 0
+}
+
+/** Drop every `<!-- ... -->` (and the line break after it) in one pass. A regex strip
+ * can rebuild a comment from one nested in another: `<!-<!-- x -->-- y -->` loses the
+ * inner comment and becomes `<!--- y -->`. After a removal the scan resumes three
+ * characters back, so a comment assembled across the cut is removed too; an opener
+ * that never closes stays as text. */
+function removeComments(text: string): string {
+  let out = text
+  let cursor = 0
+  while (cursor < out.length) {
+    const open = out.indexOf('<!--', cursor)
+    const close = open === -1 ? -1 : out.indexOf('-->', open + 4)
+    if (close === -1) return out
+    const tail = out.slice(close + 3)
+    out = out.slice(0, open) + tail.slice(leadingLineBreak(tail))
+    cursor = Math.max(0, open - 3)
+  }
+  return out
+}
+
 /** The index content that actually loads: YAML frontmatter and block-level HTML
  * comments are stripped, so they neither show in the prompt nor count toward the
  * 200-line / 25KB read limits, matching Claude Code. */
 export function stripNonLoaded(text: string): string {
-  return text.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, '').replace(/<!--[\s\S]*?-->\r?\n?/g, '')
+  return removeComments(text.replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n?/, ''))
 }
 
 /** Move a store written under an older slug to the current one, once. Two earlier

package/extensions/plan-mode/index.ts

@@ -429,7 +429,9 @@ After completing a step, include a [DONE:n] tag in your response.`,
       planModeEnabled = true
     }
 
-    const entries = ctx.sessionManager.getEntries()
+    // The current branch only: getEntries() lists every branch in the file, so after a
+    // rewind past a plan it would resurrect the abandoned plan and its tool restriction.
+    const entries = ctx.sessionManager.getBranch()
 
     // Restore persisted state
     const planModeEntry = findLast(entries, (e: { type: string; customType?: string }) => e.type === 'custom' && e.customType === 'plan-mode') as { data?: { enabled: boolean; todos?: TodoItem[]; executing?: boolean; savedTools?: string[] } } | undefined

package/extensions/question.ts

@@ -179,7 +179,7 @@ export default function question(pi: ExtensionAPI) {
 
     renderCall(args, theme, _context) {
       const multi = args.multiSelect === true
-      const heading = args.header ? `[${args.header}] ` : ''
+      const heading = args.header ? `[${shortHeader(String(args.header))}] ` : ''
       let text = theme.fg('toolTitle', theme.bold('question ')) + theme.fg('muted', heading + String(args.question ?? ''))
       const opts = Array.isArray(args.options) ? args.options : []
       if (opts.length) {