pi-code 1.0.49 → 1.0.50

package/extensions/hooks/config.ts

@@ -16,6 +16,10 @@ export interface HookCommand {
   /** exec-form: spawn `command` directly with these args and no shell (shell-form when
    * absent). $ARGUMENTS in each arg is replaced with the event JSON. */
   args?: string[]
+  /** Claude's `shell`: "bash" (the default) or "powershell". The default is /bin/sh off
+   * Windows; on Windows Git Bash, then PowerShell when Git Bash is absent. Ignored when
+   * `args` is set. */
+  shell?: string
   timeout?: number
   /** Claude's background contract, honored on `type: "command"` hooks only: `async` runs
    * without blocking its event and with no timeout enforced; `asyncRewake` also runs in

package/extensions/hooks/index.ts

@@ -72,7 +72,9 @@
  * agent-frontmatter hooks arrive via PI_CODE_AGENT_HOOKS (Stop pre-converted to
  * SubagentStop, fired at the child's own agent end) and die with the process.
  *
- * Hook commands run via `sh -c` with the event JSON on stdin. A PreToolUse
+ * Hook commands run through the platform shell (`sh -c`; on Windows Git Bash, or
+ * PowerShell when Git Bash is absent, see internal/shell-resolve) with the event JSON
+ * on stdin. A PreToolUse
  * hook blocks the tool by exiting 2 (stderr becomes the reason) or by printing
  * `{"hookSpecificOutput": {"permissionDecision": "deny", ...}}` (or the older
  * `{"decision": "block"}`).
@@ -271,7 +273,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
         if (hook.type === 'prompt') return runPromptHook(hook, merged, resolveHookModel(ctx, hook.model), ms)
         if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
         if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
-        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild)
+        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild, hook.shell)
       }
       // Claude's `once` (skill-frontmatter hooks only): removed after the first
       // successful run; a failure, block, or timeout leaves it in place.

package/extensions/hooks/runners.ts

@@ -5,10 +5,12 @@
  */
 
 import { type ChildProcess, spawn } from 'node:child_process'
+import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
 import { runAgent } from '../internal/agent-run.js'
 import { callMcpTool } from '../internal/mcp-call.js'
 import { completeText } from '../internal/model-complete.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
 
 // Claude's defaults vary by type and event (600s for command/http/mcp_tool, 30s
@@ -41,7 +43,7 @@ export type HookRunner = (hook: HookCommand, payload: unknown, timeoutMs: number
  * `args` array it becomes the exec path: `command` is spawned directly with those args.
  * `onChild` hands the caller a kill for the spawned tree, so a background hook that is
  * still running at session end can be reaped (Claude kills async hooks at teardown). */
-export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void) => Promise<HookRunResult>
+export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void, shell?: string) => Promise<HookRunResult>
 
 /** Above 2^31-1 ms Node clamps a timer to 1ms, which would kill the hook instantly. */
 const MAX_TIMEOUT_S = 2_147_483
@@ -80,6 +82,15 @@ const TIMEOUT_EXIT_CODE = 124
  * direct child alone leaves a grandchild alive holding stdout/stderr.
  */
 function killTree(child: ChildProcess): void {
+  if (process.platform === 'win32') {
+    // Windows has no process groups: taskkill /T ends the shell's whole tree. By
+    // absolute path, so a writable PATH entry cannot stand in for it. If taskkill itself
+    // cannot start, the direct kill is all that is left.
+    const taskkill = path.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe')
+    if (child.pid) spawn(taskkill, ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => child.kill('SIGKILL'))
+    else child.kill('SIGKILL')
+    return
+  }
   try {
     // Negative pid targets the whole process group, which `detached` gave the shell.
     if (child.pid) {
@@ -92,11 +103,19 @@ function killTree(child: ChildProcess): void {
   child.kill('SIGKILL')
 }
 
-export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild) =>
+/** The shell invocation for a shell-form command, or undefined when this machine has no
+ * shell for it (Windows with neither Git Bash nor PowerShell). */
+function shellInvocation(command: string, shell: string | undefined): { file: string; spawnArgs: string[] } | undefined {
+  const resolved = resolveShell(shell)
+  return resolved ? { file: resolved.file, spawnArgs: resolved.argsFor(command) } : undefined
+}
+
+export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild, shell) =>
   new Promise((resolve) => {
-    // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
-    // `detached` makes the shell its own process group leader so the timeout can kill
-    // the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
+    // /bin/sh by absolute path off Windows, so the shell can't be resolved through an
+    // attacker-controlled PATH; on Windows the resolver follows Claude's documented Git
+    // Bash lookup. `detached` makes the shell its own process group leader so the
+    // timeout can kill the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
     // reference project files regardless of the shell's cwd. CLAUDECODE=1 marks every
     // subprocess Claude spawns, so it is set on the child unconditionally.
     // CLAUDE_CODE_CHILD_SESSION marks per-call children (hook and status line
@@ -110,11 +129,18 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, p
     // An exec-form hook (an `args` array) spawns the executable directly with those args
     // and no shell, so shell metacharacters in the args arrive literally; $ARGUMENTS in
     // each arg is replaced with the event JSON by a replacer function (so $$/$& in the
-    // payload survive verbatim). Without args it stays the shell path. Both share the
+    // payload survive verbatim). Without args the command string goes to the platform's
+    // shell, or to PowerShell when the hook says `shell: "powershell"`. Both share the
     // same detached process group, so killTree reaches the descendants either way.
-    const file = Array.isArray(args) ? command : '/bin/sh'
-    const spawnArgs = Array.isArray(args) ? args.map((arg) => substituteArguments(arg, payload)) : ['-c', command]
-    const child = spawn(file, spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env })
+    const target = Array.isArray(args) ? { file: command, spawnArgs: args.map((arg) => substituteArguments(arg, payload)) } : shellInvocation(command, shell)
+    if (!target) {
+      // Marked like a spawn failure so a gated event fails closed rather than reading as an allow.
+      resolve({ code: 0, stdout: '', stderr: 'no shell found: install Git for Windows or PowerShell', timedOut: false, spawnFailed: true })
+      return
+    }
+    // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
+    // window; windowsHide keeps every hook invisible (a no-op elsewhere).
+    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/command-file.ts

@@ -433,26 +433,9 @@ export function powershellQuote(value: string): string {
   return value.replaceAll(/['‘’‚‛]/g, '$&$&')
 }
 
-/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
- * Windows spellings on win32, where powershell.exe ships with the OS. */
-const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
-
-/** First PowerShell binary found on PATH, or undefined when none is installed. */
-export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
-  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
-  for (const candidate of powershellCandidates(platform)) {
-    for (const dir of dirs) {
-      const full = path.join(dir, candidate)
-      try {
-        fs.accessSync(full, fs.constants.X_OK)
-        if (fs.statSync(full).isFile()) return full
-      } catch {
-        // not here; keep looking
-      }
-    }
-  }
-  return undefined
-}
+import { bashBinary } from './shell-resolve.js'
+
+export { resolvePowershellBinary } from './shell-resolve.js'
 
 export interface SpanExec {
   command: string
@@ -464,42 +447,55 @@ export interface SpanExec {
   mergeStreams?: boolean
 }
 
+/** The sh invocation for a span: CLAUDE_PROJECT_DIR and CLAUDECODE=1 exported in-script
+ * (pi.exec takes no env; CLAUDECODE marks every subprocess Claude spawns), stderr merged
+ * with 2>&1. The group opens with a `:` null command: `{ }` around an empty or
+ * comment-only span is a hard sh syntax error (exit 2) that aborted the whole
+ * invocation, and `:` keeps such a span the harmless no-op it was on HEAD while the
+ * group still merges stderr for real spans. */
+function shSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
+  return { command: binary, args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+}
+
+/** The PowerShell invocation for a span. No in-script 2>&1: under pwsh 7 it does not
+ * merge a native command's stderr on a script block, so mergeStreams has the caller
+ * append it. The trailing exit forwards a failed native command's code, which pwsh
+ * -Command otherwise swallows (the process exited 0 and a failure never aborted the
+ * invocation). An empty or cmdlet-only span leaves $LASTEXITCODE unset and exits 0.
+ * Residual gap vs sh: a failing cmdlet sets no exit code, so it cannot abort; its
+ * error text still reaches the model through the merged stderr. */
+function powershellSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
+  return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
+}
+
 /**
- * The exec invocation for one injected span, honoring the `shell:` frontmatter.
- * The default (absent or `bash`) runs through /bin/sh; `powershell` resolves a
- * PowerShell binary and runs the span with -Command, falling back to /bin/sh when
- * none is installed so the command still works, per Claude's shell matrix. Both
- * paths export CLAUDE_PROJECT_DIR (each shell's own quoting) and merge stderr
- * into stdout, as the Bash tool does when it runs these for Claude: the sh script
- * in-line with 2>&1, the pwsh path via mergeStreams in the caller.
+ * The exec invocation for one injected span, honoring the `shell:` frontmatter per
+ * Claude's shell matrix (skills.md). `powershell` runs through a PowerShell binary when
+ * one resolves. Otherwise the span runs through bash: /bin/sh off Windows, Git Bash on
+ * Windows. Without Git Bash, a skill that declared `shell: bash` fails before any
+ * command runs ("requires bash"), an undeclared one falls to PowerShell, and with
+ * neither shell the invocation fails. Both paths export CLAUDE_PROJECT_DIR (each
+ * shell's own quoting) and merge stderr into stdout, as the Bash tool does when it
+ * runs these for Claude: the sh script in-line with 2>&1, the pwsh path via
+ * mergeStreams in the caller.
  *
- * The resolver is a parameter rather than a default so the caller passes its own
- * imported binding, which keeps the lookup mockable in tests.
+ * The resolvers are parameters so a caller (or test) controls the lookups: the
+ * PowerShell one is passed as an imported binding, the bash one defaults to the
+ * platform rule.
  */
-export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined): SpanExec {
+export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined, resolveBash: () => string | undefined = bashBinary): SpanExec {
   if (shell === 'powershell') {
     const binary = resolveBinary()
-    if (binary !== undefined) {
-      // CLAUDECODE=1 marks every subprocess Claude spawns; pi.exec takes no env, so
-      // it is exported in the script alongside CLAUDE_PROJECT_DIR.
-      const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
-      // No in-script 2>&1: under pwsh 7 it does not merge a native command's
-      // stderr on a script block, so mergeStreams has the caller append it. The
-      // trailing exit forwards a failed native command's code, which pwsh
-      // -Command otherwise swallows (the process exited 0 and a failure never
-      // aborted the invocation). An empty or cmdlet-only span leaves
-      // $LASTEXITCODE unset and exits 0. Residual gap vs sh: a failing cmdlet
-      // sets no exit code, so it cannot abort; its error text still reaches the
-      // model through the merged stderr.
-      return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
-    }
+    if (binary !== undefined) return powershellSpan(binary, projectDir, script)
   }
-  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
-  // The group opens with a `:` null command: `{ }` around an empty or
-  // comment-only span is a hard sh syntax error (exit 2) that aborted the whole
-  // invocation, and `:` keeps such a span the harmless no-op it was on HEAD
-  // while the group still merges stderr for real spans.
-  return { command: '/bin/sh', args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+  const bash = resolveBash()
+  if (bash !== undefined) return shSpan(bash, projectDir, script)
+  if (shell === 'bash') throw new Error('shell: bash requires Git Bash, which was not found (install Git for Windows or set CLAUDE_CODE_GIT_BASH_PATH)')
+  const binary = resolveBinary()
+  if (binary !== undefined) return powershellSpan(binary, projectDir, script)
+  throw new Error('no shell found for the injected commands: install Git for Windows or PowerShell')
 }
 
 interface FenceBlock {

package/extensions/internal/shell-resolve.ts

@@ -0,0 +1,121 @@
+/**
+ * Which shell runs a command string, per Claude's contract. hooks.md: a shell-form
+ * command is "passed to a shell: `sh -c` on macOS and Linux, Git Bash on Windows, or
+ * PowerShell when Git Bash isn't installed", and a hook's `shell: "powershell"` runs it
+ * via PowerShell (pwsh, then Windows PowerShell 5.1). statusline.md applies the same
+ * Git Bash-then-PowerShell rule to statusLine commands. troubleshoot-install.md: when
+ * CLAUDE_CODE_GIT_BASH_PATH is unset, Git Bash is looked for in `C:\Program Files\Git`
+ * and `C:\Program Files (x86)\Git`, then through the `git` on PATH (the `bin\bash.exe`
+ * of that installation), skipping a git in the launch directory or below it under
+ * node_modules or a virtual environment. env-vars.md: the override is ignored unless
+ * the file exists and is named bash.exe, sh.exe, bash, or sh.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+
+export interface ResolvedShell {
+  kind: 'bash' | 'powershell'
+  file: string
+  /** The argv that runs `command` through this shell. */
+  argsFor: (command: string) => string[]
+}
+
+const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh'])
+const DEFAULT_GIT_ROOTS = [String.raw`C:\Program Files\Git`, String.raw`C:\Program Files (x86)\Git`]
+const PROJECT_TOOLING_DIRS = new Set(['node_modules', '.venv', 'venv'])
+
+const isFile = (file: string): boolean => {
+  try {
+    return fs.statSync(file).isFile()
+  } catch {
+    return false
+  }
+}
+
+/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
+ * Windows spellings on win32, where powershell.exe ships with the OS. */
+const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
+
+/** First PowerShell binary found on PATH, or undefined when none is installed. */
+export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
+  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
+  for (const candidate of powershellCandidates(platform)) {
+    for (const dir of dirs) {
+      const full = path.join(dir, candidate)
+      try {
+        fs.accessSync(full, fs.constants.X_OK)
+        if (fs.statSync(full).isFile()) return full
+      } catch {
+        // not here; keep looking
+      }
+    }
+  }
+  return undefined
+}
+
+/** A git in the launch directory itself, or below it under node_modules or a virtual
+ * environment, is a project's own tooling rather than the user's Git installation. */
+function isProjectTooling(dir: string, cwd: string): boolean {
+  const relative = path.relative(cwd, dir)
+  if (relative === '') return true
+  if (relative.startsWith('..') || path.isAbsolute(relative)) return false
+  return relative.split(path.sep).some((segment) => PROJECT_TOOLING_DIRS.has(segment))
+}
+
+/** Git Bash in Claude's documented order, or undefined when none is installed.
+ * `installRoots` is the default install location list, a parameter so tests on a
+ * Windows host that has Git there can still exercise the later rules. */
+export function resolveGitBash(env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots: string[] = DEFAULT_GIT_ROOTS): string | undefined {
+  const override = env.CLAUDE_CODE_GIT_BASH_PATH
+  if (override && GIT_BASH_NAMES.has(path.basename(override).toLowerCase()) && isFile(override)) return override
+  for (const root of installRoots) {
+    const bash = path.join(root, 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  for (const dir of (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean)) {
+    if (!isFile(path.join(dir, 'git.exe')) || isProjectTooling(dir, cwd)) continue
+    // Git for Windows puts git.exe in cmd\ (or bin\); bash.exe lives in bin\ of the same install.
+    const bash = path.join(path.dirname(dir), 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  return undefined
+}
+
+/** Claude rewrites these three placeholders in a PowerShell shell-form command to
+ * PowerShell's `${env:NAME}` form; the bare `$NAME` spelling is left alone (PowerShell
+ * reads it as an undefined variable, which Claude only warns about). */
+export const toPowershellPlaceholders = (command: string): string => command.replace(/\$\{(CLAUDE_PROJECT_DIR|CLAUDE_PLUGIN_ROOT|CLAUDE_PLUGIN_DATA)\}/g, (_match, name: string) => `\${env:${name}}`)
+
+/** The bash for an injected command span: /bin/sh off Windows, Git Bash on Windows
+ * (undefined when it is not installed). */
+export function bashBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): string | undefined {
+  return platform === 'win32' ? resolveGitBash(env, cwd, installRoots) : '/bin/sh'
+}
+
+const bashShell = (file: string): ResolvedShell => ({ kind: 'bash', file, argsFor: (command) => ['-c', command] })
+
+const powershellShell = (file: string): ResolvedShell => ({
+  kind: 'powershell',
+  file,
+  // -Command swallows a native command's exit code unless it is forwarded; a script
+  // that calls `exit` itself never reaches the trailer, so its own code stands.
+  argsFor: (command) => ['-NoProfile', '-NonInteractive', '-Command', `${toPowershellPlaceholders(command)}\nexit $LASTEXITCODE`],
+})
+
+/**
+ * The shell for a command string. `preferred` is a hook's `shell` field: "powershell"
+ * runs through PowerShell where one is installed. Otherwise /bin/sh off Windows; on
+ * Windows Git Bash, then PowerShell. Undefined means nothing on this machine can run
+ * it (Windows with neither Git Bash nor PowerShell installed).
+ */
+export function resolveShell(preferred: string | undefined, platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): ResolvedShell | undefined {
+  if (preferred === 'powershell') {
+    const powershell = resolvePowershellBinary(platform, env)
+    if (powershell) return powershellShell(powershell)
+  }
+  const bash = bashBinary(platform, env, cwd, installRoots)
+  if (bash) return bashShell(bash)
+  const powershell = resolvePowershellBinary(platform, env)
+  return powershell ? powershellShell(powershell) : undefined
+}

package/extensions/mcp/transport.ts

@@ -16,6 +16,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js'
 import { ListRootsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
 import { FileOAuthProvider, type OAuthServerConfig } from '../internal/mcp-oauth.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { expandCwd, type HttpServerConfig, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
 import { runInteractiveOAuth, serializeInteractiveOAuth } from './oauth-flow.js'
 
@@ -306,11 +307,17 @@ export async function connectWithRetries(name: string, config: ServerConfig, aut
 }
 
 /** Run a headersHelper command and parse its JSON stdout into headers, under the
- * environment helperEnv built. A failure or a 10s timeout yields no extra headers
- * rather than blocking the connection. */
+ * environment helperEnv built. It runs through the platform shell (/bin/sh; Git Bash
+ * or PowerShell on Windows). A failure, a 10s timeout, or a machine with no shell
+ * yields no extra headers rather than blocking the connection. */
 function runHeadersHelper(command: string, env: NodeJS.ProcessEnv): Promise<Record<string, string>> {
   return new Promise((resolve) => {
-    execFile('/bin/sh', ['-c', command], { timeout: 10_000, env }, (error, stdout) => {
+    const shell = resolveShell(undefined)
+    if (!shell) {
+      resolve({})
+      return
+    }
+    execFile(shell.file, shell.argsFor(command), { timeout: 10_000, env }, (error, stdout) => {
       resolve(error ? {} : parseHelperHeaders(stdout))
     })
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.49",
+  "version": "1.0.50",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",