pi-code 1.0.48 → 1.0.50

package/extensions/claude-rules.ts

@@ -68,7 +68,8 @@ function parsePaths(frontmatter: string): string[] {
 
 /** Split YAML-ish frontmatter off the front of a rule file, extracting `paths`. */
 export function parseFrontmatter(content: string): Frontmatter {
-  const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(content)
+  // A leading byte order mark (Windows editors add one) is part of the header, not the body.
+  const match = /^\uFEFF?---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(content)
   if (!match) return { paths: [], body: content }
   return { paths: parsePaths(match[1]), body: content.slice(match[0].length) }
 }

package/extensions/commands.ts

@@ -197,7 +197,7 @@ function commandVars(ctx: { cwd: string }, filePath: string, plugin?: CommandPlu
 
 /** The exec seam expandCommand runs spans through; pi itself satisfies it. */
 interface SpanRunner {
-  exec(command: string, args: string[], options?: { cwd?: string; timeout?: number }): Promise<{ stdout: string; stderr: string; code: number }>
+  exec(command: string, args: string[], options?: { cwd?: string; timeout?: number }): Promise<{ stdout: string; stderr: string; code: number; killed?: boolean }>
 }
 
 /**
@@ -231,7 +231,7 @@ export async function expandCommand(runner: SpanRunner, parsed: ParsedCommand, a
           // pwsh cannot merge a native command's stderr in-script (spanExec sets
           // mergeStreams), so it is appended here; the sh script merges via 2>&1.
           const stdout = run.mergeStreams ? result.stdout + result.stderr : result.stdout
-          return { stdout, stderr: result.stderr, code: result.code }
+          return { stdout, stderr: result.stderr, code: result.code, killed: result.killed }
         }
       : async () => ({ stdout: SHELL_DISABLED_PLACEHOLDER, stderr: '', code: 0 })
   let expanded = await expandDynamicContent(withVars, ctx.cwd, exec, parsed.shell === 'powershell' ? 'powershell' : 'bash')

package/extensions/context-imports.ts

@@ -72,12 +72,13 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { type InstructionLoadEvent, memoryTypeForPath, publishInstructionLoad } from './internal/instruction-events.js'
 import { managedSettingsPath, readManagedSettings } from './internal/managed-settings.js'
+import { sliceBytes } from './internal/output-guard.js'
 import { globToRegExpSource } from './internal/path-rules.js'
 import { isProjectApproved, isProjectApprovedSilently } from './internal/project-approval.js'
 import { ancestorFiles, findNearestFile, repoRoot } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
 import { statToken } from './internal/stat-token.js'
-import { fenceMarker, stripBlockComments } from './internal/strip-comments.js'
+import { type Fence, fenceMarker, stepFence, stripBlockComments } from './internal/strip-comments.js'
 
 /** Claude documents "a maximum depth of four hops" for recursive imports. */
 const MAX_IMPORT_DEPTH = 4
@@ -145,16 +146,14 @@ export const createImportBudget = (): ImportBudget => ({ files: MAX_IMPORT_FILES
  * imports neither in fenced code blocks (backtick or tilde) nor in inline spans. */
 function importTargets(content: string): string[] {
   const targets: string[] = []
-  // A fence only closes with the character that opened it: a backtick-fenced
-  // example may legitimately contain tilde-fence lines, and vice versa.
-  let fence: string | null = null
+  // CommonMark fences: closed only by the same character in a run at least as long
+  // as the opener, so a backtick example may hold tilde lines or shorter fences.
+  let fence: Fence | null = null
   for (const line of content.split('\n')) {
-    const marker = fenceMarker(line.trimStart())
-    if (marker !== null && (fence === null || fence === marker)) {
-      fence = fence === null ? marker : null
-      continue
-    }
-    if (fence !== null) continue
+    const trimmed = line.trimStart()
+    const step = stepFence(fence, trimmed, fenceMarker(trimmed))
+    fence = step.fence
+    if (step.fenced) continue
     // Backreference so a multi-backtick span (``literal `@x` backticks``) strips whole.
     const withoutSpans = line.replace(/(`+)[^`]*?\1/g, '')
     for (const match of withoutSpans.matchAll(/(^|\s)@(\S+)/g)) targets.push(match[2])
@@ -222,8 +221,10 @@ function collectFrom(scan: ImportScan, content: string, fromDir: string, depth:
     const file = readImport(target, fromDir, scan.home, scan.allowedRoots, scan.seen, scan.isExcluded)
     if (!file) continue
     scan.budget.files -= 1
-    const kept = file.body.slice(0, scan.budget.bytes)
-    scan.budget.bytes -= kept.length
+    // The budget is bytes: a string slice counts UTF-16 units and lets CJK text through
+    // at three times the budget without ever reaching the truncation marker.
+    const kept = sliceBytes(file.body, scan.budget.bytes)
+    scan.budget.bytes -= Buffer.byteLength(kept)
     const body = kept.length < file.body.length ? `${kept.trim()}\n${IMPORT_TRUNCATED_MARKER}` : kept.trim()
     // Comments are stripped before the scan for further imports, so a
     // commented-out @import stays dead at every depth, matching the top level

package/extensions/git-checkpoint.ts

@@ -194,6 +194,32 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     }
     // Written on every start, so repos that predate the sidecar pick it up too.
     rememberWorkTree(shadowDir, ctx.cwd)
+    await mirrorLocalExcludes(ctx.cwd)
+  }
+
+  /** git reads ignore rules from the tree's .gitignore files, the user's global excludes,
+   * and $GIT_DIR/info/exclude. The shadow is the GIT_DIR here, so the repo's own
+   * .git/info/exclude (where secrets and scratch that must never be committed live)
+   * would be snapshotted and restored. Mirror it into the shadow on every start; the
+   * global excludes stay untouched (core.excludesFile is single-valued, so pointing it
+   * at the repo file would replace them). */
+  async function mirrorLocalExcludes(cwd: string): Promise<void> {
+    if (!shadowDir) return
+    // Resolved through git so a linked worktree maps to its common dir; outside a repo
+    // git exits 128 and there is nothing to mirror.
+    const located = await pi.exec('git', ['rev-parse', '--git-path', 'info/exclude'], { cwd })
+    const target = path.join(shadowDir, 'info', 'exclude')
+    try {
+      const source = located.code === 0 ? path.resolve(cwd, located.stdout.trim()) : undefined
+      if (source && fs.existsSync(source)) {
+        fs.mkdirSync(path.dirname(target), { recursive: true })
+        fs.copyFileSync(source, target)
+      } else {
+        fs.rmSync(target, { force: true })
+      }
+    } catch {
+      // A failed mirror only means local excludes are not honored this session.
+    }
   }
 
   /** `checkout -f <ref> -- .` errors when the ref's tree holds no files, so an empty

package/extensions/hooks/config.ts

@@ -16,6 +16,10 @@ export interface HookCommand {
   /** exec-form: spawn `command` directly with these args and no shell (shell-form when
    * absent). $ARGUMENTS in each arg is replaced with the event JSON. */
   args?: string[]
+  /** Claude's `shell`: "bash" (the default) or "powershell". The default is /bin/sh off
+   * Windows; on Windows Git Bash, then PowerShell when Git Bash is absent. Ignored when
+   * `args` is set. */
+  shell?: string
   timeout?: number
   /** Claude's background contract, honored on `type: "command"` hooks only: `async` runs
    * without blocking its event and with no timeout enforced; `asyncRewake` also runs in

package/extensions/hooks/index.ts

@@ -72,7 +72,9 @@
  * agent-frontmatter hooks arrive via PI_CODE_AGENT_HOOKS (Stop pre-converted to
  * SubagentStop, fired at the child's own agent end) and die with the process.
  *
- * Hook commands run via `sh -c` with the event JSON on stdin. A PreToolUse
+ * Hook commands run through the platform shell (`sh -c`; on Windows Git Bash, or
+ * PowerShell when Git Bash is absent, see internal/shell-resolve) with the event JSON
+ * on stdin. A PreToolUse
  * hook blocks the tool by exiting 2 (stderr becomes the reason) or by printing
  * `{"hookSpecificOutput": {"permissionDecision": "deny", ...}}` (or the older
  * `{"decision": "block"}`).
@@ -271,7 +273,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
         if (hook.type === 'prompt') return runPromptHook(hook, merged, resolveHookModel(ctx, hook.model), ms)
         if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
         if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
-        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild)
+        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild, hook.shell)
       }
       // Claude's `once` (skill-frontmatter hooks only): removed after the first
       // successful run; a failure, block, or timeout leaves it in place.

package/extensions/hooks/runners.ts

@@ -5,10 +5,12 @@
  */
 
 import { type ChildProcess, spawn } from 'node:child_process'
+import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
 import { runAgent } from '../internal/agent-run.js'
 import { callMcpTool } from '../internal/mcp-call.js'
 import { completeText } from '../internal/model-complete.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
 
 // Claude's defaults vary by type and event (600s for command/http/mcp_tool, 30s
@@ -41,7 +43,7 @@ export type HookRunner = (hook: HookCommand, payload: unknown, timeoutMs: number
  * `args` array it becomes the exec path: `command` is spawned directly with those args.
  * `onChild` hands the caller a kill for the spawned tree, so a background hook that is
  * still running at session end can be reaped (Claude kills async hooks at teardown). */
-export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void) => Promise<HookRunResult>
+export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void, shell?: string) => Promise<HookRunResult>
 
 /** Above 2^31-1 ms Node clamps a timer to 1ms, which would kill the hook instantly. */
 const MAX_TIMEOUT_S = 2_147_483
@@ -80,6 +82,15 @@ const TIMEOUT_EXIT_CODE = 124
  * direct child alone leaves a grandchild alive holding stdout/stderr.
  */
 function killTree(child: ChildProcess): void {
+  if (process.platform === 'win32') {
+    // Windows has no process groups: taskkill /T ends the shell's whole tree. By
+    // absolute path, so a writable PATH entry cannot stand in for it. If taskkill itself
+    // cannot start, the direct kill is all that is left.
+    const taskkill = path.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe')
+    if (child.pid) spawn(taskkill, ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => child.kill('SIGKILL'))
+    else child.kill('SIGKILL')
+    return
+  }
   try {
     // Negative pid targets the whole process group, which `detached` gave the shell.
     if (child.pid) {
@@ -92,11 +103,19 @@ function killTree(child: ChildProcess): void {
   child.kill('SIGKILL')
 }
 
-export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild) =>
+/** The shell invocation for a shell-form command, or undefined when this machine has no
+ * shell for it (Windows with neither Git Bash nor PowerShell). */
+function shellInvocation(command: string, shell: string | undefined): { file: string; spawnArgs: string[] } | undefined {
+  const resolved = resolveShell(shell)
+  return resolved ? { file: resolved.file, spawnArgs: resolved.argsFor(command) } : undefined
+}
+
+export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild, shell) =>
   new Promise((resolve) => {
-    // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
-    // `detached` makes the shell its own process group leader so the timeout can kill
-    // the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
+    // /bin/sh by absolute path off Windows, so the shell can't be resolved through an
+    // attacker-controlled PATH; on Windows the resolver follows Claude's documented Git
+    // Bash lookup. `detached` makes the shell its own process group leader so the
+    // timeout can kill the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
     // reference project files regardless of the shell's cwd. CLAUDECODE=1 marks every
     // subprocess Claude spawns, so it is set on the child unconditionally.
     // CLAUDE_CODE_CHILD_SESSION marks per-call children (hook and status line
@@ -110,11 +129,18 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, p
     // An exec-form hook (an `args` array) spawns the executable directly with those args
     // and no shell, so shell metacharacters in the args arrive literally; $ARGUMENTS in
     // each arg is replaced with the event JSON by a replacer function (so $$/$& in the
-    // payload survive verbatim). Without args it stays the shell path. Both share the
+    // payload survive verbatim). Without args the command string goes to the platform's
+    // shell, or to PowerShell when the hook says `shell: "powershell"`. Both share the
     // same detached process group, so killTree reaches the descendants either way.
-    const file = Array.isArray(args) ? command : '/bin/sh'
-    const spawnArgs = Array.isArray(args) ? args.map((arg) => substituteArguments(arg, payload)) : ['-c', command]
-    const child = spawn(file, spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env })
+    const target = Array.isArray(args) ? { file: command, spawnArgs: args.map((arg) => substituteArguments(arg, payload)) } : shellInvocation(command, shell)
+    if (!target) {
+      // Marked like a spawn failure so a gated event fails closed rather than reading as an allow.
+      resolve({ code: 0, stdout: '', stderr: 'no shell found: install Git for Windows or PowerShell', timedOut: false, spawnFailed: true })
+      return
+    }
+    // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
+    // window; windowsHide keeps every hook invisible (a no-op elsewhere).
+    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/command-file.ts

@@ -13,8 +13,8 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 
 import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
-
 import { splitSegments } from './shell-split.js'
+import { type Fence, fenceMarker, stepFence } from './strip-comments.js'
 
 /** The pi file tools a Claude path rule can govern. */
 export type PathRuleTool = 'read' | 'edit' | 'write'
@@ -421,7 +421,7 @@ export function discoverCommandFiles(root: string): DiscoveredCommand[] {
   return found
 }
 
-export type CommandExec = (command: string) => Promise<{ stdout: string; stderr: string; code: number }>
+export type CommandExec = (command: string) => Promise<{ stdout: string; stderr: string; code: number; killed?: boolean }>
 
 /** PowerShell single-quote escaping: inside a '...' literal the only special
  * characters are the quote delimiters themselves, written doubled. PowerShell's
@@ -433,26 +433,9 @@ export function powershellQuote(value: string): string {
   return value.replaceAll(/['‘’‚‛]/g, '$&$&')
 }
 
-/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
- * Windows spellings on win32, where powershell.exe ships with the OS. */
-const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
-
-/** First PowerShell binary found on PATH, or undefined when none is installed. */
-export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
-  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
-  for (const candidate of powershellCandidates(platform)) {
-    for (const dir of dirs) {
-      const full = path.join(dir, candidate)
-      try {
-        fs.accessSync(full, fs.constants.X_OK)
-        if (fs.statSync(full).isFile()) return full
-      } catch {
-        // not here; keep looking
-      }
-    }
-  }
-  return undefined
-}
+import { bashBinary } from './shell-resolve.js'
+
+export { resolvePowershellBinary } from './shell-resolve.js'
 
 export interface SpanExec {
   command: string
@@ -464,42 +447,55 @@ export interface SpanExec {
   mergeStreams?: boolean
 }
 
+/** The sh invocation for a span: CLAUDE_PROJECT_DIR and CLAUDECODE=1 exported in-script
+ * (pi.exec takes no env; CLAUDECODE marks every subprocess Claude spawns), stderr merged
+ * with 2>&1. The group opens with a `:` null command: `{ }` around an empty or
+ * comment-only span is a hard sh syntax error (exit 2) that aborted the whole
+ * invocation, and `:` keeps such a span the harmless no-op it was on HEAD while the
+ * group still merges stderr for real spans. */
+function shSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
+  return { command: binary, args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+}
+
+/** The PowerShell invocation for a span. No in-script 2>&1: under pwsh 7 it does not
+ * merge a native command's stderr on a script block, so mergeStreams has the caller
+ * append it. The trailing exit forwards a failed native command's code, which pwsh
+ * -Command otherwise swallows (the process exited 0 and a failure never aborted the
+ * invocation). An empty or cmdlet-only span leaves $LASTEXITCODE unset and exits 0.
+ * Residual gap vs sh: a failing cmdlet sets no exit code, so it cannot abort; its
+ * error text still reaches the model through the merged stderr. */
+function powershellSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
+  return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
+}
+
 /**
- * The exec invocation for one injected span, honoring the `shell:` frontmatter.
- * The default (absent or `bash`) runs through /bin/sh; `powershell` resolves a
- * PowerShell binary and runs the span with -Command, falling back to /bin/sh when
- * none is installed so the command still works, per Claude's shell matrix. Both
- * paths export CLAUDE_PROJECT_DIR (each shell's own quoting) and merge stderr
- * into stdout, as the Bash tool does when it runs these for Claude: the sh script
- * in-line with 2>&1, the pwsh path via mergeStreams in the caller.
+ * The exec invocation for one injected span, honoring the `shell:` frontmatter per
+ * Claude's shell matrix (skills.md). `powershell` runs through a PowerShell binary when
+ * one resolves. Otherwise the span runs through bash: /bin/sh off Windows, Git Bash on
+ * Windows. Without Git Bash, a skill that declared `shell: bash` fails before any
+ * command runs ("requires bash"), an undeclared one falls to PowerShell, and with
+ * neither shell the invocation fails. Both paths export CLAUDE_PROJECT_DIR (each
+ * shell's own quoting) and merge stderr into stdout, as the Bash tool does when it
+ * runs these for Claude: the sh script in-line with 2>&1, the pwsh path via
+ * mergeStreams in the caller.
  *
- * The resolver is a parameter rather than a default so the caller passes its own
- * imported binding, which keeps the lookup mockable in tests.
+ * The resolvers are parameters so a caller (or test) controls the lookups: the
+ * PowerShell one is passed as an imported binding, the bash one defaults to the
+ * platform rule.
  */
-export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined): SpanExec {
+export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined, resolveBash: () => string | undefined = bashBinary): SpanExec {
   if (shell === 'powershell') {
     const binary = resolveBinary()
-    if (binary !== undefined) {
-      // CLAUDECODE=1 marks every subprocess Claude spawns; pi.exec takes no env, so
-      // it is exported in the script alongside CLAUDE_PROJECT_DIR.
-      const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
-      // No in-script 2>&1: under pwsh 7 it does not merge a native command's
-      // stderr on a script block, so mergeStreams has the caller append it. The
-      // trailing exit forwards a failed native command's code, which pwsh
-      // -Command otherwise swallows (the process exited 0 and a failure never
-      // aborted the invocation). An empty or cmdlet-only span leaves
-      // $LASTEXITCODE unset and exits 0. Residual gap vs sh: a failing cmdlet
-      // sets no exit code, so it cannot abort; its error text still reaches the
-      // model through the merged stderr.
-      return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
-    }
+    if (binary !== undefined) return powershellSpan(binary, projectDir, script)
   }
-  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
-  // The group opens with a `:` null command: `{ }` around an empty or
-  // comment-only span is a hard sh syntax error (exit 2) that aborted the whole
-  // invocation, and `:` keeps such a span the harmless no-op it was on HEAD
-  // while the group still merges stderr for real spans.
-  return { command: '/bin/sh', args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+  const bash = resolveBash()
+  if (bash !== undefined) return shSpan(bash, projectDir, script)
+  if (shell === 'bash') throw new Error('shell: bash requires Git Bash, which was not found (install Git for Windows or set CLAUDE_CODE_GIT_BASH_PATH)')
+  const binary = resolveBinary()
+  if (binary !== undefined) return powershellSpan(binary, projectDir, script)
+  throw new Error('no shell found for the injected commands: install Git for Windows or PowerShell')
 }
 
 interface FenceBlock {
@@ -511,20 +507,27 @@ interface FenceBlock {
 }
 
 /** Fenced blocks of a body: Claude's dynamic syntax is literal text inside a plain
- * fence, while a ```! fence is itself a placeholder that executes. */
+ * fence, while a ```! fence is itself a placeholder that executes. Fences follow
+ * CommonMark: any indentation, closed only by the opener's character in a run at
+ * least as long, so a tilde line or a shorter fence inside stays content. */
 function fenceBlocks(body: string): FenceBlock[] {
   const blocks: FenceBlock[] = []
-  const fence = /^(```|~~~)([^\n]*)$/gm
+  let fence: Fence | null = null
   let open: { index: number; exec: boolean; contentStart: number } | undefined
-  let match = fence.exec(body)
-  while (match !== null) {
-    if (open === undefined) {
-      open = { index: match.index, exec: match[1] === '```' && match[2].trim() === '!', contentStart: match.index + match[0].length + 1 }
-    } else {
-      blocks.push({ start: open.index, end: match.index + match[0].length, exec: open.exec, content: body.slice(Math.min(open.contentStart, match.index), match.index).replace(/\n$/, '') })
+  let offset = 0
+  for (const line of body.split('\n')) {
+    const trimmed = line.trimStart()
+    const step = stepFence(fence, trimmed, fenceMarker(trimmed))
+    const lineEnd = offset + line.length
+    if (fence === null && step.fence !== null) {
+      // Only the exact, unindented ```! opener executes, as Claude documents it.
+      open = { index: offset, exec: line.startsWith('```') && step.fence.length === 3 && trimmed.slice(3).trim() === '!', contentStart: lineEnd + 1 }
+    } else if (fence !== null && step.fence === null && open !== undefined) {
+      blocks.push({ start: open.index, end: lineEnd, exec: open.exec, content: body.slice(Math.min(open.contentStart, offset), offset).replace(/\n$/, '') })
       open = undefined
     }
-    match = fence.exec(body)
+    fence = step.fence
+    offset = lineEnd + 1
   }
   // An unterminated fence protects to the end of the body rather than executing.
   if (open !== undefined) blocks.push({ start: open.index, end: body.length, exec: false, content: '' })
@@ -563,6 +566,10 @@ export function benignExitOne(command: string, shell: SpanShell = 'bash'): boole
  * documents: the model never sees a half-expanded body. */
 async function runSpan(exec: CommandExec, command: string, pattern: string, shell: SpanShell): Promise<string> {
   const result = await exec(command)
+  // A timeout kill arrives as killed:true with code 0 (a signal death has no exit code),
+  // so the code alone would paste the partial output as a success. Claude kills a span
+  // at the Bash timeout and that failure aborts the invocation.
+  if (result.killed) throw new Error(`Shell command timed out for pattern "${pattern}"`)
   if (result.code !== 0 && !(result.code === 1 && benignExitOne(command, shell))) {
     throw new Error(`Shell command failed for pattern "${pattern}"\n[stderr]\n${(result.stderr || result.stdout).trim()}`)
   }

package/extensions/internal/output-guard.ts

@@ -15,12 +15,13 @@ import { DEFAULT_MAX_BYTES, DEFAULT_MAX_LINES, formatSize, truncateHead } from '
 /**
  * Trim `text` to a byte budget. `String.slice` counts UTF-16 units, so slicing a CJK
  * string by a byte budget keeps up to three times the bytes asked for; cutting the
- * encoded buffer is exact. A character straddling the cut decodes to U+FFFD.
- * Shorter input comes back whole and a negative budget yields nothing, so callers
- * need no length check of their own.
+ * encoded buffer is exact. A character straddling the cut is dropped (the streaming
+ * decoder holds back an incomplete sequence instead of emitting U+FFFD), so the
+ * result is whole characters within the budget. Shorter input comes back whole and a
+ * negative budget yields nothing, so callers need no length check of their own.
  */
-function sliceBytes(text: string, maxBytes: number): string {
-  return Buffer.from(text, 'utf-8').subarray(0, Math.max(0, maxBytes)).toString('utf-8')
+export function sliceBytes(text: string, maxBytes: number): string {
+  return new TextDecoder().decode(Buffer.from(text, 'utf-8').subarray(0, Math.max(0, maxBytes)), { stream: true })
 }
 
 /** Trim `text` to pi's documented tool-output budget, noting what was dropped. */

package/extensions/internal/shell-resolve.ts

@@ -0,0 +1,121 @@
+/**
+ * Which shell runs a command string, per Claude's contract. hooks.md: a shell-form
+ * command is "passed to a shell: `sh -c` on macOS and Linux, Git Bash on Windows, or
+ * PowerShell when Git Bash isn't installed", and a hook's `shell: "powershell"` runs it
+ * via PowerShell (pwsh, then Windows PowerShell 5.1). statusline.md applies the same
+ * Git Bash-then-PowerShell rule to statusLine commands. troubleshoot-install.md: when
+ * CLAUDE_CODE_GIT_BASH_PATH is unset, Git Bash is looked for in `C:\Program Files\Git`
+ * and `C:\Program Files (x86)\Git`, then through the `git` on PATH (the `bin\bash.exe`
+ * of that installation), skipping a git in the launch directory or below it under
+ * node_modules or a virtual environment. env-vars.md: the override is ignored unless
+ * the file exists and is named bash.exe, sh.exe, bash, or sh.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+
+export interface ResolvedShell {
+  kind: 'bash' | 'powershell'
+  file: string
+  /** The argv that runs `command` through this shell. */
+  argsFor: (command: string) => string[]
+}
+
+const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh'])
+const DEFAULT_GIT_ROOTS = [String.raw`C:\Program Files\Git`, String.raw`C:\Program Files (x86)\Git`]
+const PROJECT_TOOLING_DIRS = new Set(['node_modules', '.venv', 'venv'])
+
+const isFile = (file: string): boolean => {
+  try {
+    return fs.statSync(file).isFile()
+  } catch {
+    return false
+  }
+}
+
+/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
+ * Windows spellings on win32, where powershell.exe ships with the OS. */
+const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
+
+/** First PowerShell binary found on PATH, or undefined when none is installed. */
+export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
+  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
+  for (const candidate of powershellCandidates(platform)) {
+    for (const dir of dirs) {
+      const full = path.join(dir, candidate)
+      try {
+        fs.accessSync(full, fs.constants.X_OK)
+        if (fs.statSync(full).isFile()) return full
+      } catch {
+        // not here; keep looking
+      }
+    }
+  }
+  return undefined
+}
+
+/** A git in the launch directory itself, or below it under node_modules or a virtual
+ * environment, is a project's own tooling rather than the user's Git installation. */
+function isProjectTooling(dir: string, cwd: string): boolean {
+  const relative = path.relative(cwd, dir)
+  if (relative === '') return true
+  if (relative.startsWith('..') || path.isAbsolute(relative)) return false
+  return relative.split(path.sep).some((segment) => PROJECT_TOOLING_DIRS.has(segment))
+}
+
+/** Git Bash in Claude's documented order, or undefined when none is installed.
+ * `installRoots` is the default install location list, a parameter so tests on a
+ * Windows host that has Git there can still exercise the later rules. */
+export function resolveGitBash(env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots: string[] = DEFAULT_GIT_ROOTS): string | undefined {
+  const override = env.CLAUDE_CODE_GIT_BASH_PATH
+  if (override && GIT_BASH_NAMES.has(path.basename(override).toLowerCase()) && isFile(override)) return override
+  for (const root of installRoots) {
+    const bash = path.join(root, 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  for (const dir of (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean)) {
+    if (!isFile(path.join(dir, 'git.exe')) || isProjectTooling(dir, cwd)) continue
+    // Git for Windows puts git.exe in cmd\ (or bin\); bash.exe lives in bin\ of the same install.
+    const bash = path.join(path.dirname(dir), 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  return undefined
+}
+
+/** Claude rewrites these three placeholders in a PowerShell shell-form command to
+ * PowerShell's `${env:NAME}` form; the bare `$NAME` spelling is left alone (PowerShell
+ * reads it as an undefined variable, which Claude only warns about). */
+export const toPowershellPlaceholders = (command: string): string => command.replace(/\$\{(CLAUDE_PROJECT_DIR|CLAUDE_PLUGIN_ROOT|CLAUDE_PLUGIN_DATA)\}/g, (_match, name: string) => `\${env:${name}}`)
+
+/** The bash for an injected command span: /bin/sh off Windows, Git Bash on Windows
+ * (undefined when it is not installed). */
+export function bashBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): string | undefined {
+  return platform === 'win32' ? resolveGitBash(env, cwd, installRoots) : '/bin/sh'
+}
+
+const bashShell = (file: string): ResolvedShell => ({ kind: 'bash', file, argsFor: (command) => ['-c', command] })
+
+const powershellShell = (file: string): ResolvedShell => ({
+  kind: 'powershell',
+  file,
+  // -Command swallows a native command's exit code unless it is forwarded; a script
+  // that calls `exit` itself never reaches the trailer, so its own code stands.
+  argsFor: (command) => ['-NoProfile', '-NonInteractive', '-Command', `${toPowershellPlaceholders(command)}\nexit $LASTEXITCODE`],
+})
+
+/**
+ * The shell for a command string. `preferred` is a hook's `shell` field: "powershell"
+ * runs through PowerShell where one is installed. Otherwise /bin/sh off Windows; on
+ * Windows Git Bash, then PowerShell. Undefined means nothing on this machine can run
+ * it (Windows with neither Git Bash nor PowerShell installed).
+ */
+export function resolveShell(preferred: string | undefined, platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): ResolvedShell | undefined {
+  if (preferred === 'powershell') {
+    const powershell = resolvePowershellBinary(platform, env)
+    if (powershell) return powershellShell(powershell)
+  }
+  const bash = bashBinary(platform, env, cwd, installRoots)
+  if (bash) return bashShell(bash)
+  const powershell = resolvePowershellBinary(platform, env)
+  return powershell ? powershellShell(powershell) : undefined
+}

package/extensions/internal/strip-comments.ts

@@ -11,7 +11,7 @@
  * fenced code block (backtick or tilde).
  */
 
-/** The fence a line opens or closes, if any; mirrors context-imports. */
+/** The fence a line opens or closes, if any. */
 export function fenceMarker(lineStart: string): string | null {
   if (lineStart.startsWith('```')) return '`'
   if (lineStart.startsWith('~~~')) return '~'
@@ -29,14 +29,14 @@ function fenceLength(lineStart: string, marker: string): number {
 // is at least as long as the opener, so both are tracked: a shorter same-char
 // fence line (the classic 3-backtick block quoted inside a 4-backtick one) is
 // content, not a closer.
-interface Fence {
+export interface Fence {
   marker: string
   length: number
 }
 
 /** The fence state after a line, plus whether the line is fenced code (opener,
  * body, or closer) and so emitted verbatim rather than scanned for comments. */
-function stepFence(fence: Fence | null, trimmed: string, marker: string | null): { fence: Fence | null; fenced: boolean } {
+export function stepFence(fence: Fence | null, trimmed: string, marker: string | null): { fence: Fence | null; fenced: boolean } {
   if (marker !== null && fence === null) {
     return { fence: { marker, length: fenceLength(trimmed, marker) }, fenced: true }
   }

package/extensions/mcp/transport.ts

@@ -16,6 +16,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js'
 import { ListRootsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
 import { FileOAuthProvider, type OAuthServerConfig } from '../internal/mcp-oauth.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { expandCwd, type HttpServerConfig, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
 import { runInteractiveOAuth, serializeInteractiveOAuth } from './oauth-flow.js'
 
@@ -306,11 +307,17 @@ export async function connectWithRetries(name: string, config: ServerConfig, aut
 }
 
 /** Run a headersHelper command and parse its JSON stdout into headers, under the
- * environment helperEnv built. A failure or a 10s timeout yields no extra headers
- * rather than blocking the connection. */
+ * environment helperEnv built. It runs through the platform shell (/bin/sh; Git Bash
+ * or PowerShell on Windows). A failure, a 10s timeout, or a machine with no shell
+ * yields no extra headers rather than blocking the connection. */
 function runHeadersHelper(command: string, env: NodeJS.ProcessEnv): Promise<Record<string, string>> {
   return new Promise((resolve) => {
-    execFile('/bin/sh', ['-c', command], { timeout: 10_000, env }, (error, stdout) => {
+    const shell = resolveShell(undefined)
+    if (!shell) {
+      resolve({})
+      return
+    }
+    execFile(shell.file, shell.argsFor(command), { timeout: 10_000, env }, (error, stdout) => {
       resolve(error ? {} : parseHelperHeaders(stdout))
     })
   })

package/extensions/plan-mode/index.ts

@@ -429,7 +429,9 @@ After completing a step, include a [DONE:n] tag in your response.`,
       planModeEnabled = true
     }
 
-    const entries = ctx.sessionManager.getEntries()
+    // The current branch only: getEntries() lists every branch in the file, so after a
+    // rewind past a plan it would resurrect the abandoned plan and its tool restriction.
+    const entries = ctx.sessionManager.getBranch()
 
     // Restore persisted state
     const planModeEntry = findLast(entries, (e: { type: string; customType?: string }) => e.type === 'custom' && e.customType === 'plan-mode') as { data?: { enabled: boolean; todos?: TodoItem[]; executing?: boolean; savedTools?: string[] } } | undefined

package/extensions/question.ts

@@ -179,7 +179,7 @@ export default function question(pi: ExtensionAPI) {
 
     renderCall(args, theme, _context) {
       const multi = args.multiSelect === true
-      const heading = args.header ? `[${args.header}] ` : ''
+      const heading = args.header ? `[${shortHeader(String(args.header))}] ` : ''
       let text = theme.fg('toolTitle', theme.bold('question ')) + theme.fg('muted', heading + String(args.question ?? ''))
       const opts = Array.isArray(args.options) ? args.options : []
       if (opts.length) {

package/extensions/subagent/background.ts

@@ -24,6 +24,8 @@ export interface BackgroundRun {
   stderr?: string
   /** Claude's partial marker: the run stopped at its maxTurns limit. */
   partial?: boolean
+  /** Temp dir holding a prompt file rebuilt for a resume; removed with the run. */
+  rebuiltPromptDir?: string
   /** Set while running so the run can be cancelled; cleared on completion. */
   kill?: () => void
   /** True until the child process actually closes: a cancelled child that ignores
@@ -65,7 +67,7 @@ export const MAX_FINISHED_RUNS = 20
 /** Grace between the cancel SIGTERM and the SIGKILL that ends a child ignoring it. */
 const CANCEL_KILL_GRACE_MS = 5000
 
-/** Bytes of stderr kept per run, enough for the boot error without buffering logs. */
+/** Characters of stderr kept per run, enough for the boot error without buffering logs. */
 const STDERR_TAIL_CHARS = 2048
 
 export function activeBackgroundRuns(): number {
@@ -79,6 +81,7 @@ let finishSequence = 0
 /** Test seam: the registry is module state, so tests reset it between cases to
  * stay order-independent. */
 export function resetBackgroundRuns(): void {
+  for (const run of runs.values()) removeRebuiltPrompt(run)
   runs.clear()
   finishSequence = 0
 }
@@ -86,7 +89,10 @@ export function resetBackgroundRuns(): void {
 function evictFinishedRuns(): void {
   const finished = [...runs.values()].filter((run) => !run.live && run.state !== 'running')
   finished.sort((a, b) => (a.finishedAt ?? 0) - (b.finishedAt ?? 0))
-  for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) runs.delete(stale.id)
+  for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) {
+    removeRebuiltPrompt(stale)
+    runs.delete(stale.id)
+  }
 }
 
 /** Line-by-line parser keeping only the last assistant text and a turn count, so a
@@ -162,6 +168,8 @@ export function cancelAllBackgroundRuns(): number {
   for (const id of Array.from(runs.keys())) {
     if (cancelBackgroundRun(id) === 'cancelled') count++
   }
+  // Called at quit: nothing in this registry is resumable once pi exits.
+  for (const run of runs.values()) removeRebuiltPrompt(run)
   return count
 }
 
@@ -190,38 +198,53 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   // Persisted so the rebuild happens once: rebuilding per resume leaked one temp
   // prompt dir every follow-up.
   const rebuilt = withRebuiltPrompt(run.spawn)
-  run.spawn = { ...run.spawn, args: rebuilt }
-  const args = rebuilt.map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
+  run.spawn = { ...run.spawn, args: rebuilt.args }
+  if (rebuilt.dir) run.rebuiltPromptDir = rebuilt.dir
+  const args = rebuilt.args.map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
   run.output = undefined
   run.exitCode = undefined
   run.stderr = undefined
   run.finishedAt = undefined
+  // Both belong to the child that ran: a resume that dies before its first turn would
+  // otherwise report the previous count, and a clean follow-up to a maxTurns-capped run
+  // would still be offered as partial.
+  run.turns = 0
+  run.partial = undefined
   driveRun(run, { ...run.spawn, args }, onComplete)
   return 'resumed'
 }
 
-/** Re-point --system-prompt at a fresh file when the original is gone. */
-function withRebuiltPrompt(spawnSpec: BackgroundSpawn): string[] {
+/** Re-point --system-prompt at a fresh file when the original is gone; `dir` is the
+ * temp dir created for it, which the run then owns. */
+function withRebuiltPrompt(spawnSpec: BackgroundSpawn): { args: string[]; dir?: string } {
   const flag = spawnSpec.args.indexOf('--system-prompt')
-  if (flag === -1 || !spawnSpec.promptBody) return spawnSpec.args
+  if (flag === -1 || !spawnSpec.promptBody) return { args: spawnSpec.args }
   const current = spawnSpec.args[flag + 1]
-  if (current && fs.existsSync(current)) return spawnSpec.args
+  if (current && fs.existsSync(current)) return { args: spawnSpec.args }
   try {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'pi-subagent-'))
     const file = path.join(dir, 'prompt.md')
     fs.writeFileSync(file, spawnSpec.promptBody, { mode: 0o600 })
     const rebuilt = [...spawnSpec.args]
     rebuilt[flag + 1] = file
-    return rebuilt
+    return { args: rebuilt, dir }
   } catch {
     // Cannot rewrite it: drop the pair rather than hand pi a path it will treat as
     // prompt text, which would replace the agent persona with a temp path.
-    return spawnSpec.args.filter((_arg, i) => i !== flag && i !== flag + 1)
+    return { args: spawnSpec.args.filter((_arg, i) => i !== flag && i !== flag + 1) }
   }
 }
 
+/** The rebuilt prompt lives as long as its run can be resumed, so it goes when the run
+ * leaves the registry: eviction, quit, or the test reset. */
+function removeRebuiltPrompt(run: BackgroundRun): void {
+  if (!run.rebuiltPromptDir) return
+  fs.rmSync(run.rebuiltPromptDir, { recursive: true, force: true })
+  run.rebuiltPromptDir = undefined
+}
+
 export function startBackgroundRun(agent: string, task: string, invocation: BackgroundSpawn, onComplete: (run: BackgroundRun) => void, presetId?: string): string | null {
   // Checked here, synchronously with registration: callers await temp-file writes
   // between any check of their own and this call, so a parallel tool-call batch

package/extensions/todo.ts

@@ -387,8 +387,12 @@ export default function todoExtension(pi: ExtensionAPI) {
     content: [{ type: 'text' as const, text }],
     details,
   })
-  const ok = (action: TodoAction, text: string) => toolMessage(text, { action, todos: [...todos], nextId })
-  const fail = (action: TodoAction, error: string) => toolMessage(`Error: ${error}`, { action, todos: [...todos], nextId, error })
+  // pi keeps a result's details by reference in the live session, and start/complete
+  // mutate the todo objects in place, so each result carries its own copies: without
+  // them a rewind replays, and the TUI re-renders, today's statuses on earlier calls.
+  const snapshot = () => todos.map((t) => ({ ...t }))
+  const ok = (action: TodoAction, text: string) => toolMessage(text, { action, todos: snapshot(), nextId })
+  const fail = (action: TodoAction, error: string) => toolMessage(`Error: ${error}`, { action, todos: snapshot(), nextId, error })
 
   const handleAdd = (params: TodoParamsType) => {
     if (!params.text) return fail('add', 'text required for add')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.48",
+  "version": "1.0.50",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",