pi-code 1.0.49 → 1.0.51

package/extensions/commands.ts

@@ -50,7 +50,7 @@ import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile, readManagedSettings } from './internal/managed-settings.js'
 import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
-import { type InstalledPlugin, installedPlugins } from './internal/plugins.js'
+import { type InstalledPlugin, installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, repoRoot } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -146,7 +146,7 @@ function pluginCommands(plugins: InstalledPlugin[]): DiscoveredCommand[] {
   const found: DiscoveredCommand[] = []
   for (const plugin of plugins) {
     const declared = plugin.manifest.commands
-    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => path.resolve(plugin.root, String(entry)))
+    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => pluginComponentPath(plugin, String(entry))).filter((dir): dir is string => dir !== undefined)
     for (const dir of dirs) {
       for (const command of discoverCommandFiles(dir)) {
         found.push({ name: `${plugin.name}:${command.name}`, filePath: command.filePath, plugin: { root: plugin.root, dataDir: plugin.dataDir, ...(plugin.userConfig ? { userConfig: plugin.userConfig } : {}) } })

package/extensions/hooks/config.ts

@@ -7,7 +7,7 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { readManagedSettings } from '../internal/managed-settings.js'
-import { type InstalledPlugin, substitutePluginVars } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath, substitutePluginVars } from '../internal/plugins.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
 
 export interface HookCommand {
@@ -16,6 +16,10 @@ export interface HookCommand {
   /** exec-form: spawn `command` directly with these args and no shell (shell-form when
    * absent). $ARGUMENTS in each arg is replaced with the event JSON. */
   args?: string[]
+  /** Claude's `shell`: "bash" (the default) or "powershell". The default is /bin/sh off
+   * Windows; on Windows Git Bash, then PowerShell when Git Bash is absent. Ignored when
+   * `args` is set. */
+  shell?: string
   timeout?: number
   /** Claude's background contract, honored on `type: "command"` hooks only: `async` runs
    * without blocking its event and with no timeout enforced; `asyncRewake` also runs in
@@ -223,6 +227,44 @@ function mergeHooksJson(config: HooksConfig, raw: string, source: string, source
  * every hook the plugin declared silently vanished. */
 const jsonEscape = (value: string): string => JSON.stringify(value).slice(1, -1)
 
+/** A reference Claude refuses to substitute into anything that reaches a shell. */
+const USER_CONFIG_REF = /\$\{user_config\./
+
+/**
+ * Drop shell-form hook commands that reference `${user_config.*}`. Claude: "Fields that
+ * run in a shell reject `${user_config.*}`: substituting a configured value into a shell
+ * command would let the shell run whatever that value contains, so the component fails
+ * with an error instead." Exec form (`args`) and every other field still substitute, and
+ * the documented alternative is reading CLAUDE_PLUGIN_OPTION_<KEY> from the hook's
+ * environment. Sibling hooks in the same file are unaffected: one rejected component
+ * costs itself, not the plugin's other hooks.
+ */
+function withoutUserConfigShellCommands(raw: string, source: string): string {
+  let parsed: { hooks?: Record<string, unknown> }
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return raw // mergeHooksJson reports the parse failure
+  }
+  let dropped = false
+  for (const matchers of Object.values(parsed?.hooks ?? {})) {
+    if (!Array.isArray(matchers)) continue
+    for (const entry of matchers) {
+      const record = entry as { hooks?: unknown }
+      if (!Array.isArray(record.hooks)) continue
+      const kept = record.hooks.filter((hook) => {
+        const candidate = hook as { command?: unknown; args?: unknown }
+        if (Array.isArray(candidate.args) || typeof candidate.command !== 'string' || !USER_CONFIG_REF.test(candidate.command)) return true
+        console.warn(`pi-code-hooks: ignoring a hook in ${source}: a shell-form command cannot reference \${user_config.*}; use exec form with "args", or read CLAUDE_PLUGIN_OPTION_<KEY> from the environment`)
+        dropped = true
+        return false
+      })
+      record.hooks = kept
+    }
+  }
+  return dropped ? JSON.stringify(parsed) : raw
+}
+
 export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[], sources?: Map<HookMatcher, string>): void {
   for (const plugin of plugins) {
     const declared = plugin.manifest.hooks
@@ -230,12 +272,14 @@ export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[],
     // numeric event keys), so it falls through to the default path rather than
     // silently registering nothing.
     if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
-      mergeHooksJson(config, substitutePluginVars(JSON.stringify({ hooks: declared }), plugin, jsonEscape), `${plugin.name} (plugin.json)`, sources, `plugin:${plugin.name}`)
+      const inlineSource = `${plugin.name} (plugin.json)`
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(JSON.stringify({ hooks: declared }), inlineSource), plugin, jsonEscape), inlineSource, sources, `plugin:${plugin.name}`)
       continue
     }
-    const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    const file = pluginComponentPath(plugin, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    if (file === undefined) continue
     try {
-      mergeHooksJson(config, substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(fs.readFileSync(file, 'utf-8'), file), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
     } catch {
       // a plugin without hooks contributes nothing
     }

package/extensions/hooks/index.ts

@@ -72,7 +72,9 @@
  * agent-frontmatter hooks arrive via PI_CODE_AGENT_HOOKS (Stop pre-converted to
  * SubagentStop, fired at the child's own agent end) and die with the process.
  *
- * Hook commands run via `sh -c` with the event JSON on stdin. A PreToolUse
+ * Hook commands run through the platform shell (`sh -c`; on Windows Git Bash, or
+ * PowerShell when Git Bash is absent, see internal/shell-resolve) with the event JSON
+ * on stdin. A PreToolUse
  * hook blocks the tool by exiting 2 (stderr becomes the reason) or by printing
  * `{"hookSpecificOutput": {"permissionDecision": "deny", ...}}` (or the older
  * `{"decision": "block"}`).
@@ -271,7 +273,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
         if (hook.type === 'prompt') return runPromptHook(hook, merged, resolveHookModel(ctx, hook.model), ms)
         if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
         if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
-        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild)
+        return runHookCommand(hook.command, merged, ms, projectDir, hook.args, onChild, hook.shell)
       }
       // Claude's `once` (skill-frontmatter hooks only): removed after the first
       // successful run; a failure, block, or timeout leaves it in place.

package/extensions/hooks/runners.ts

@@ -5,10 +5,12 @@
  */
 
 import { type ChildProcess, spawn } from 'node:child_process'
+import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
 import { runAgent } from '../internal/agent-run.js'
 import { callMcpTool } from '../internal/mcp-call.js'
 import { completeText } from '../internal/model-complete.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
 
 // Claude's defaults vary by type and event (600s for command/http/mcp_tool, 30s
@@ -41,7 +43,7 @@ export type HookRunner = (hook: HookCommand, payload: unknown, timeoutMs: number
  * `args` array it becomes the exec path: `command` is spawned directly with those args.
  * `onChild` hands the caller a kill for the spawned tree, so a background hook that is
  * still running at session end can be reaped (Claude kills async hooks at teardown). */
-export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void) => Promise<HookRunResult>
+export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[], onChild?: (kill: () => void) => void, shell?: string) => Promise<HookRunResult>
 
 /** Above 2^31-1 ms Node clamps a timer to 1ms, which would kill the hook instantly. */
 const MAX_TIMEOUT_S = 2_147_483
@@ -80,6 +82,15 @@ const TIMEOUT_EXIT_CODE = 124
  * direct child alone leaves a grandchild alive holding stdout/stderr.
  */
 function killTree(child: ChildProcess): void {
+  if (process.platform === 'win32') {
+    // Windows has no process groups: taskkill /T ends the shell's whole tree. By
+    // absolute path, so a writable PATH entry cannot stand in for it. If taskkill itself
+    // cannot start, the direct kill is all that is left.
+    const taskkill = path.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe')
+    if (child.pid) spawn(taskkill, ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => child.kill('SIGKILL'))
+    else child.kill('SIGKILL')
+    return
+  }
   try {
     // Negative pid targets the whole process group, which `detached` gave the shell.
     if (child.pid) {
@@ -92,11 +103,19 @@ function killTree(child: ChildProcess): void {
   child.kill('SIGKILL')
 }
 
-export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild) =>
+/** The shell invocation for a shell-form command, or undefined when this machine has no
+ * shell for it (Windows with neither Git Bash nor PowerShell). */
+function shellInvocation(command: string, shell: string | undefined): { file: string; spawnArgs: string[] } | undefined {
+  const resolved = resolveShell(shell)
+  return resolved ? { file: resolved.file, spawnArgs: resolved.argsFor(command) } : undefined
+}
+
+export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args, onChild, shell) =>
   new Promise((resolve) => {
-    // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
-    // `detached` makes the shell its own process group leader so the timeout can kill
-    // the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
+    // /bin/sh by absolute path off Windows, so the shell can't be resolved through an
+    // attacker-controlled PATH; on Windows the resolver follows Claude's documented Git
+    // Bash lookup. `detached` makes the shell its own process group leader so the
+    // timeout can kill the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
     // reference project files regardless of the shell's cwd. CLAUDECODE=1 marks every
     // subprocess Claude spawns, so it is set on the child unconditionally.
     // CLAUDE_CODE_CHILD_SESSION marks per-call children (hook and status line
@@ -110,11 +129,18 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, p
     // An exec-form hook (an `args` array) spawns the executable directly with those args
     // and no shell, so shell metacharacters in the args arrive literally; $ARGUMENTS in
     // each arg is replaced with the event JSON by a replacer function (so $$/$& in the
-    // payload survive verbatim). Without args it stays the shell path. Both share the
+    // payload survive verbatim). Without args the command string goes to the platform's
+    // shell, or to PowerShell when the hook says `shell: "powershell"`. Both share the
     // same detached process group, so killTree reaches the descendants either way.
-    const file = Array.isArray(args) ? command : '/bin/sh'
-    const spawnArgs = Array.isArray(args) ? args.map((arg) => substituteArguments(arg, payload)) : ['-c', command]
-    const child = spawn(file, spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env })
+    const target = Array.isArray(args) ? { file: command, spawnArgs: args.map((arg) => substituteArguments(arg, payload)) } : shellInvocation(command, shell)
+    if (!target) {
+      // Marked like a spawn failure so a gated event fails closed rather than reading as an allow.
+      resolve({ code: 0, stdout: '', stderr: 'no shell found: install Git for Windows or PowerShell', timedOut: false, spawnFailed: true })
+      return
+    }
+    // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
+    // window; windowsHide keeps every hook invisible (a no-op elsewhere).
+    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/bash-rules.ts

@@ -14,10 +14,20 @@ import { hasSubstitution, splitSegments } from './shell-split.js'
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
+/**
+ * One rule against one command segment, per Claude's permission table:
+ * - `*` stands in for whatever text is in its place.
+ * - a trailing `*` with a space before it also matches the bare command, but only when
+ *   it is the rule's only wildcard (`* --help *` does not match `npm --help`).
+ * - that space is part of the rule, so `ls *` does not match `lsof` while `ls*` does.
+ * - `:*` is an equivalent spelling of a trailing ` *`, recognized only at the end; a
+ *   colon anywhere else is a literal character.
+ */
 function matchesRule(segment: string, rule: string): boolean {
-  if (rule.endsWith(':*')) return segment.startsWith(rule.slice(0, -2))
-  if (rule.includes('*')) return new RegExp(`^${rule.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
-  return segment === rule
+  const normalized = rule.endsWith(':*') ? `${rule.slice(0, -2)} *` : rule
+  if (normalized.endsWith(' *') && normalized.indexOf('*') === normalized.length - 1 && segment === normalized.slice(0, -2)) return true
+  if (normalized.includes('*')) return new RegExp(`^${normalized.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
+  return segment === normalized
 }
 
 export function matchesBashRules(command: string, rules: string[]): boolean {

package/extensions/internal/command-file.ts

@@ -433,26 +433,9 @@ export function powershellQuote(value: string): string {
   return value.replaceAll(/['‘’‚‛]/g, '$&$&')
 }
 
-/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
- * Windows spellings on win32, where powershell.exe ships with the OS. */
-const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
-
-/** First PowerShell binary found on PATH, or undefined when none is installed. */
-export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
-  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
-  for (const candidate of powershellCandidates(platform)) {
-    for (const dir of dirs) {
-      const full = path.join(dir, candidate)
-      try {
-        fs.accessSync(full, fs.constants.X_OK)
-        if (fs.statSync(full).isFile()) return full
-      } catch {
-        // not here; keep looking
-      }
-    }
-  }
-  return undefined
-}
+import { bashBinary } from './shell-resolve.js'
+
+export { resolvePowershellBinary } from './shell-resolve.js'
 
 export interface SpanExec {
   command: string
@@ -464,42 +447,55 @@ export interface SpanExec {
   mergeStreams?: boolean
 }
 
+/** The sh invocation for a span: CLAUDE_PROJECT_DIR and CLAUDECODE=1 exported in-script
+ * (pi.exec takes no env; CLAUDECODE marks every subprocess Claude spawns), stderr merged
+ * with 2>&1. The group opens with a `:` null command: `{ }` around an empty or
+ * comment-only span is a hard sh syntax error (exit 2) that aborted the whole
+ * invocation, and `:` keeps such a span the harmless no-op it was on HEAD while the
+ * group still merges stderr for real spans. */
+function shSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
+  return { command: binary, args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+}
+
+/** The PowerShell invocation for a span. No in-script 2>&1: under pwsh 7 it does not
+ * merge a native command's stderr on a script block, so mergeStreams has the caller
+ * append it. The trailing exit forwards a failed native command's code, which pwsh
+ * -Command otherwise swallows (the process exited 0 and a failure never aborted the
+ * invocation). An empty or cmdlet-only span leaves $LASTEXITCODE unset and exits 0.
+ * Residual gap vs sh: a failing cmdlet sets no exit code, so it cannot abort; its
+ * error text still reaches the model through the merged stderr. */
+function powershellSpan(binary: string, projectDir: string, script: string): SpanExec {
+  const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
+  return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
+}
+
 /**
- * The exec invocation for one injected span, honoring the `shell:` frontmatter.
- * The default (absent or `bash`) runs through /bin/sh; `powershell` resolves a
- * PowerShell binary and runs the span with -Command, falling back to /bin/sh when
- * none is installed so the command still works, per Claude's shell matrix. Both
- * paths export CLAUDE_PROJECT_DIR (each shell's own quoting) and merge stderr
- * into stdout, as the Bash tool does when it runs these for Claude: the sh script
- * in-line with 2>&1, the pwsh path via mergeStreams in the caller.
+ * The exec invocation for one injected span, honoring the `shell:` frontmatter per
+ * Claude's shell matrix (skills.md). `powershell` runs through a PowerShell binary when
+ * one resolves. Otherwise the span runs through bash: /bin/sh off Windows, Git Bash on
+ * Windows. Without Git Bash, a skill that declared `shell: bash` fails before any
+ * command runs ("requires bash"), an undeclared one falls to PowerShell, and with
+ * neither shell the invocation fails. Both paths export CLAUDE_PROJECT_DIR (each
+ * shell's own quoting) and merge stderr into stdout, as the Bash tool does when it
+ * runs these for Claude: the sh script in-line with 2>&1, the pwsh path via
+ * mergeStreams in the caller.
  *
- * The resolver is a parameter rather than a default so the caller passes its own
- * imported binding, which keeps the lookup mockable in tests.
+ * The resolvers are parameters so a caller (or test) controls the lookups: the
+ * PowerShell one is passed as an imported binding, the bash one defaults to the
+ * platform rule.
  */
-export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined): SpanExec {
+export function spanExec(shell: string | undefined, projectDir: string, script: string, resolveBinary: () => string | undefined, resolveBash: () => string | undefined = bashBinary): SpanExec {
   if (shell === 'powershell') {
     const binary = resolveBinary()
-    if (binary !== undefined) {
-      // CLAUDECODE=1 marks every subprocess Claude spawns; pi.exec takes no env, so
-      // it is exported in the script alongside CLAUDE_PROJECT_DIR.
-      const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
-      // No in-script 2>&1: under pwsh 7 it does not merge a native command's
-      // stderr on a script block, so mergeStreams has the caller append it. The
-      // trailing exit forwards a failed native command's code, which pwsh
-      // -Command otherwise swallows (the process exited 0 and a failure never
-      // aborted the invocation). An empty or cmdlet-only span leaves
-      // $LASTEXITCODE unset and exits 0. Residual gap vs sh: a failing cmdlet
-      // sets no exit code, so it cannot abort; its error text still reaches the
-      // model through the merged stderr.
-      return { command: binary, args: ['-NoProfile', '-NonInteractive', '-Command', `${preamble}\n& {\n${script}\n}\nexit $LASTEXITCODE`], mergeStreams: true }
-    }
+    if (binary !== undefined) return powershellSpan(binary, projectDir, script)
   }
-  const quoted = projectDir.replaceAll("'", String.raw`'\''`)
-  // The group opens with a `:` null command: `{ }` around an empty or
-  // comment-only span is a hard sh syntax error (exit 2) that aborted the whole
-  // invocation, and `:` keeps such a span the harmless no-op it was on HEAD
-  // while the group still merges stderr for real spans.
-  return { command: '/bin/sh', args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
+  const bash = resolveBash()
+  if (bash !== undefined) return shSpan(bash, projectDir, script)
+  if (shell === 'bash') throw new Error('shell: bash requires Git Bash, which was not found (install Git for Windows or set CLAUDE_CODE_GIT_BASH_PATH)')
+  const binary = resolveBinary()
+  if (binary !== undefined) return powershellSpan(binary, projectDir, script)
+  throw new Error('no shell found for the injected commands: install Git for Windows or PowerShell')
 }
 
 interface FenceBlock {

package/extensions/internal/mcp-oauth.ts

@@ -39,10 +39,26 @@ export interface OAuthServerConfig {
   authServerMetadataUrl?: string
 }
 
+/** The origin a sign-in belongs to, so the same server name at a different endpoint gets
+ * its own store. An unparseable url falls back to its raw text rather than to nothing. */
+function endpointKey(endpoint: string | undefined): string {
+  if (!endpoint) return ''
+  try {
+    return new URL(endpoint).origin
+  } catch {
+    return endpoint
+  }
+}
+
 /** A server name is config-controlled text; the digest keeps hostile names inside
- * the store directory and distinct names from colliding after sanitization. */
-function storeFileFor(serverName: string): string {
-  const digest = crypto.createHash('sha256').update(serverName).digest('hex').slice(0, 8)
+ * the store directory and distinct names from colliding after sanitization. The endpoint
+ * rides the digest so a second project reusing a name cannot read the first one's tokens. */
+function storeFileFor(serverName: string, endpoint?: string): string {
+  const digest = crypto
+    .createHash('sha256')
+    .update(`${serverName}\n${endpointKey(endpoint)}`)
+    .digest('hex')
+    .slice(0, 8)
   // Collapse disallowed runs to a single hyphen, then strip leading and trailing
   // hyphens by index. The old /^-+|-+$/g trim rescanned on every hyphen of a long run
   // (its trailing-anchored branch backtracks per start position), which is quadratic.
@@ -66,8 +82,8 @@ export class FileOAuthProvider implements OAuthClientProvider {
   // page cannot inject an authorization code into this login (RFC 8252 8.9).
   private readonly loginState = crypto.randomBytes(16).toString('hex')
 
-  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig) {
-    this.storePath = storeFileFor(serverName)
+  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig, endpoint?: string) {
+    this.storePath = storeFileFor(serverName, endpoint)
     this.onRedirect = onRedirect
     this.oauth = oauth
     try {

package/extensions/internal/plugins.ts

@@ -243,6 +243,20 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
  * substituting into text that is still raw JSON must pass an escapeValue that
  * JSON-escapes: a Windows root (C:\Users\...) inserted verbatim injects invalid
  * escape sequences and the subsequent parse throws. */
+/** A plugin component path, resolved inside the plugin root. Claude "rejects a component
+ * path that resolves outside the plugin root, such as `../shared-utils`", so an escaping
+ * entry yields undefined and its caller skips that component. The check is lexical, which
+ * is the rule as documented: a plugin's own root may itself be a symlink (link mode). */
+export function pluginComponentPath(plugin: Pick<InstalledPlugin, 'name' | 'root'>, declared: string): string | undefined {
+  const resolved = path.resolve(plugin.root, declared)
+  const inside = path.relative(plugin.root, resolved)
+  if (inside !== '' && (inside.startsWith(`..${path.sep}`) || inside === '..' || path.isAbsolute(inside))) {
+    console.warn(`pi-code-plugins: plugin ${plugin.name} declares the component path "${declared}", which resolves outside its root; ignoring it`)
+    return undefined
+  }
+  return resolved
+}
+
 export function substitutePluginVars(value: string, plugin: InstalledPlugin, escapeValue: (substituted: string) => string = (substituted) => substituted): string {
   return value
     .replaceAll('${CLAUDE_PLUGIN_ROOT}', escapeValue(plugin.root))

package/extensions/internal/shell-resolve.ts

@@ -0,0 +1,121 @@
+/**
+ * Which shell runs a command string, per Claude's contract. hooks.md: a shell-form
+ * command is "passed to a shell: `sh -c` on macOS and Linux, Git Bash on Windows, or
+ * PowerShell when Git Bash isn't installed", and a hook's `shell: "powershell"` runs it
+ * via PowerShell (pwsh, then Windows PowerShell 5.1). statusline.md applies the same
+ * Git Bash-then-PowerShell rule to statusLine commands. troubleshoot-install.md: when
+ * CLAUDE_CODE_GIT_BASH_PATH is unset, Git Bash is looked for in `C:\Program Files\Git`
+ * and `C:\Program Files (x86)\Git`, then through the `git` on PATH (the `bin\bash.exe`
+ * of that installation), skipping a git in the launch directory or below it under
+ * node_modules or a virtual environment. env-vars.md: the override is ignored unless
+ * the file exists and is named bash.exe, sh.exe, bash, or sh.
+ */
+
+import * as fs from 'node:fs'
+import * as path from 'node:path'
+
+export interface ResolvedShell {
+  kind: 'bash' | 'powershell'
+  file: string
+  /** The argv that runs `command` through this shell. */
+  argsFor: (command: string) => string[]
+}
+
+const GIT_BASH_NAMES = new Set(['bash.exe', 'sh.exe', 'bash', 'sh'])
+const DEFAULT_GIT_ROOTS = [String.raw`C:\Program Files\Git`, String.raw`C:\Program Files (x86)\Git`]
+const PROJECT_TOOLING_DIRS = new Set(['node_modules', '.venv', 'venv'])
+
+const isFile = (file: string): boolean => {
+  try {
+    return fs.statSync(file).isFile()
+  } catch {
+    return false
+  }
+}
+
+/** The PowerShell names worth trying: pwsh everywhere it installs, plus the
+ * Windows spellings on win32, where powershell.exe ships with the OS. */
+const powershellCandidates = (platform: string): string[] => (platform === 'win32' ? ['pwsh', 'pwsh.exe', 'powershell.exe'] : ['pwsh'])
+
+/** First PowerShell binary found on PATH, or undefined when none is installed. */
+export function resolvePowershellBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env): string | undefined {
+  const dirs = (env.PATH ?? '').split(path.delimiter).filter(Boolean)
+  for (const candidate of powershellCandidates(platform)) {
+    for (const dir of dirs) {
+      const full = path.join(dir, candidate)
+      try {
+        fs.accessSync(full, fs.constants.X_OK)
+        if (fs.statSync(full).isFile()) return full
+      } catch {
+        // not here; keep looking
+      }
+    }
+  }
+  return undefined
+}
+
+/** A git in the launch directory itself, or below it under node_modules or a virtual
+ * environment, is a project's own tooling rather than the user's Git installation. */
+function isProjectTooling(dir: string, cwd: string): boolean {
+  const relative = path.relative(cwd, dir)
+  if (relative === '') return true
+  if (relative.startsWith('..') || path.isAbsolute(relative)) return false
+  return relative.split(path.sep).some((segment) => PROJECT_TOOLING_DIRS.has(segment))
+}
+
+/** Git Bash in Claude's documented order, or undefined when none is installed.
+ * `installRoots` is the default install location list, a parameter so tests on a
+ * Windows host that has Git there can still exercise the later rules. */
+export function resolveGitBash(env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots: string[] = DEFAULT_GIT_ROOTS): string | undefined {
+  const override = env.CLAUDE_CODE_GIT_BASH_PATH
+  if (override && GIT_BASH_NAMES.has(path.basename(override).toLowerCase()) && isFile(override)) return override
+  for (const root of installRoots) {
+    const bash = path.join(root, 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  for (const dir of (env.PATH ?? env.Path ?? '').split(path.delimiter).filter(Boolean)) {
+    if (!isFile(path.join(dir, 'git.exe')) || isProjectTooling(dir, cwd)) continue
+    // Git for Windows puts git.exe in cmd\ (or bin\); bash.exe lives in bin\ of the same install.
+    const bash = path.join(path.dirname(dir), 'bin', 'bash.exe')
+    if (isFile(bash)) return bash
+  }
+  return undefined
+}
+
+/** Claude rewrites these three placeholders in a PowerShell shell-form command to
+ * PowerShell's `${env:NAME}` form; the bare `$NAME` spelling is left alone (PowerShell
+ * reads it as an undefined variable, which Claude only warns about). */
+export const toPowershellPlaceholders = (command: string): string => command.replace(/\$\{(CLAUDE_PROJECT_DIR|CLAUDE_PLUGIN_ROOT|CLAUDE_PLUGIN_DATA)\}/g, (_match, name: string) => `\${env:${name}}`)
+
+/** The bash for an injected command span: /bin/sh off Windows, Git Bash on Windows
+ * (undefined when it is not installed). */
+export function bashBinary(platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): string | undefined {
+  return platform === 'win32' ? resolveGitBash(env, cwd, installRoots) : '/bin/sh'
+}
+
+const bashShell = (file: string): ResolvedShell => ({ kind: 'bash', file, argsFor: (command) => ['-c', command] })
+
+const powershellShell = (file: string): ResolvedShell => ({
+  kind: 'powershell',
+  file,
+  // -Command swallows a native command's exit code unless it is forwarded; a script
+  // that calls `exit` itself never reaches the trailer, so its own code stands.
+  argsFor: (command) => ['-NoProfile', '-NonInteractive', '-Command', `${toPowershellPlaceholders(command)}\nexit $LASTEXITCODE`],
+})
+
+/**
+ * The shell for a command string. `preferred` is a hook's `shell` field: "powershell"
+ * runs through PowerShell where one is installed. Otherwise /bin/sh off Windows; on
+ * Windows Git Bash, then PowerShell. Undefined means nothing on this machine can run
+ * it (Windows with neither Git Bash nor PowerShell installed).
+ */
+export function resolveShell(preferred: string | undefined, platform: string = process.platform, env: Record<string, string | undefined> = process.env, cwd: string = process.cwd(), installRoots?: string[]): ResolvedShell | undefined {
+  if (preferred === 'powershell') {
+    const powershell = resolvePowershellBinary(platform, env)
+    if (powershell) return powershellShell(powershell)
+  }
+  const bash = bashBinary(platform, env, cwd, installRoots)
+  if (bash) return bashShell(bash)
+  const powershell = resolvePowershellBinary(platform, env)
+  return powershell ? powershellShell(powershell) : undefined
+}

package/extensions/mcp/config.ts

@@ -8,7 +8,7 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import { claudeConfigDir } from '../internal/config-dir.js'
 import type { OAuthServerConfig } from '../internal/mcp-oauth.js'
-import type { InstalledPlugin } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
 
 export interface StdioServerConfig {
@@ -156,7 +156,9 @@ function rawPluginServerEntries(plugin: InstalledPlugin): Record<string, unknown
   const servers: Record<string, unknown> = {}
   for (const entry of paths) {
     try {
-      const parsed = JSON.parse(fs.readFileSync(path.resolve(plugin.root, entry), 'utf-8'))
+      const file = pluginComponentPath(plugin, entry)
+      if (file === undefined) continue
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
       Object.assign(servers, parsed.mcpServers ?? {})
     } catch {
       // Malformed or missing JSON contributes no entries.

package/extensions/mcp/index.ts

@@ -494,6 +494,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * factory: pi runs the factory for invocations that never start a session. Names still
    * connected are filtered out, so a later session start only retries servers that failed
    * or whose transport dropped, without duplicate-name warnings. */
+  /** A project server's headersHelper, dropped while the project is unapproved. */
+  function withoutUntrustedHelper(name: string, config: ServerConfig): ServerConfig {
+    if (!('headersHelper' in config) || config.headersHelper === undefined) return config
+    console.warn(`pi-code-mcp: headersHelper not run for server ${name}: the project is not trusted yet; connecting with its static headers alone`)
+    const { headersHelper: _dropped, ...rest } = config
+    return rest as ServerConfig
+  }
+
   async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's. A server toggled off
@@ -510,7 +518,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // a deliberate narrowing of Claude's rule to keep the safe default.
     // The stored project decision, read without prompting: consent recorded inside
     // the project only counts once the project itself has been approved.
-    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
+    const projectApproved = isProjectApprovedSilently(ctx)
+    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), projectApproved)
     // Tag the scope on each project server: a repository-supplied headersHelper runs
     // with credential variables stripped, unlike a user-scope one.
     const projectServers = Object.fromEntries(Object.entries(loadConfigFrom(projectConfigPaths(ctx.cwd))).map(([name, config]) => [name, { ...config, projectScope: true }]))
@@ -519,7 +528,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // stays with the local (user-side) definition, so the project's entry is dropped
     // here rather than allowed to shadow it.
     const localNames = localScopeServerNames(os.homedir(), ctx.cwd)
-    const consented = Object.fromEntries(Object.entries(consentedRaw).filter(([name]) => !localNames.has(name)))
+    // Claude: until the folder is trusted, a project server connects with its static
+    // headers alone. Consenting to the server is not consenting to run the command it
+    // ships, so the helper is dropped (and named once) while the project is unapproved.
+    const consented = Object.fromEntries(
+      Object.entries(consentedRaw)
+        .filter(([name]) => !localNames.has(name))
+        .map(([name, config]) => [name, projectApproved ? config : withoutUntrustedHelper(name, config)]),
+    )
     const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     // The consented project servers carry no ordering dependency on the user scope:

package/extensions/mcp/oauth-flow.ts

@@ -55,6 +55,7 @@ export async function runInteractiveOAuth(name: string, config: { url: string; o
       authUi.notify(`Authorize "${name}" in the browser. If it did not open: ${authorizationUrl}`, 'info')
     },
     config.oauth,
+    config.url,
   )
   const { server, port } = await startCallbackServer(provider.savedRedirectPort())
   provider.bindRedirectPort(port)

package/extensions/mcp/transport.ts

@@ -16,6 +16,7 @@ import { StreamableHTTPClientTransport } from '@modelcontextprotocol/sdk/client/
 import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/websocket.js'
 import { ListRootsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
 import { FileOAuthProvider, type OAuthServerConfig } from '../internal/mcp-oauth.js'
+import { resolveShell } from '../internal/shell-resolve.js'
 import { expandCwd, type HttpServerConfig, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
 import { runInteractiveOAuth, serializeInteractiveOAuth } from './oauth-flow.js'
 
@@ -259,8 +260,13 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
   const token = resolveBearerToken(config)
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
-  // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper), helperEnv(name, config)))
+  // JSON stdout merges over the static headers. The command text is NOT interpolated:
+  // Claude expands ${VAR} in command, args, env, url and headers, and expanding it here
+  // would read the parent environment, which is the credential set a repository- or
+  // plugin-supplied helper must not see. The helper's own shell expands it against the
+  // stripped environment instead. Plugin path variables are already substituted in
+  // mcp/config.ts, which also refuses ${user_config.*} in a helper.
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(config.headersHelper, helperEnv(name, config)))
   warnMissing()
   // Claude: a configured Authorization header, whether static, a bearer token, or
   // helper output, is the server's authentication; there is no OAuth fallback for it.
@@ -306,11 +312,17 @@ export async function connectWithRetries(name: string, config: ServerConfig, aut
 }
 
 /** Run a headersHelper command and parse its JSON stdout into headers, under the
- * environment helperEnv built. A failure or a 10s timeout yields no extra headers
- * rather than blocking the connection. */
+ * environment helperEnv built. It runs through the platform shell (/bin/sh; Git Bash
+ * or PowerShell on Windows). A failure, a 10s timeout, or a machine with no shell
+ * yields no extra headers rather than blocking the connection. */
 function runHeadersHelper(command: string, env: NodeJS.ProcessEnv): Promise<Record<string, string>> {
   return new Promise((resolve) => {
-    execFile('/bin/sh', ['-c', command], { timeout: 10_000, env }, (error, stdout) => {
+    const shell = resolveShell(undefined)
+    if (!shell) {
+      resolve({})
+      return
+    }
+    execFile(shell.file, shell.argsFor(command), { timeout: 10_000, env }, (error, stdout) => {
       resolve(error ? {} : parseHelperHeaders(stdout))
     })
   })
@@ -360,7 +372,7 @@ async function connectHttpFamily(name: string, config: { url: string; oauth?: OA
   // dynamic registration, keeping it bound to the real callback port. A
   // pre-configured client (oauth.clientId) rides the silent provider too, so its
   // stored tokens refresh with the configured credentials.
-  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth)
+  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth, config.url)
   try {
     const client = newClient()
     await connectWithTimeout(client, makeTransport(silent?.hasTokens() ? silent : undefined), label)

package/extensions/output-styles.ts

@@ -26,7 +26,7 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, findNearestDir, findNearestFile } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -118,7 +118,7 @@ export function pluginStyleDirs(home: string): string[] {
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.outputStyles
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'output-styles']
-    return dirs.map((dir) => path.resolve(plugin.root, String(dir)))
+    return dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined)
   })
 }
 

package/extensions/skills.ts

@@ -29,7 +29,7 @@ import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
 import { ancestorDirs } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -58,7 +58,7 @@ export function skillDirs(cwd: string, home: string, trusted: boolean): string[]
   for (const plugin of installedPlugins(home)) {
     const declared = plugin.manifest.skills
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'skills']
-    candidates.push(...dirs.map((dir) => path.resolve(plugin.root, String(dir))))
+    candidates.push(...dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined))
   }
   // Claude loads skills from every .claude/skills between cwd and the repository
   // root; the list goes nearest-first so findClaudeSkill's first match is the

package/extensions/subagent/agents.ts

@@ -12,7 +12,7 @@ import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
-import { installedPlugins } from '../internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
 
 /**
@@ -353,7 +353,10 @@ function pluginAgentDirs(home: string): Array<{ dir: string; pluginName: string
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.agents
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'agents']
-    return dirs.map((dir) => ({ dir: path.resolve(plugin.root, String(dir)), pluginName: plugin.name }))
+    return dirs
+      .map((dir) => pluginComponentPath(plugin, String(dir)))
+      .filter((dir): dir is string => dir !== undefined)
+      .map((dir) => ({ dir, pluginName: plugin.name }))
   })
 }
 

package/extensions/subagent/background.ts

@@ -279,7 +279,9 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   run.live = true
   const killGroup = (signal: NodeJS.Signals): void => {
     try {
-      process.kill(-proc.pid!, signal)
+      // A child that never spawned has no pid and no group; the direct kill is all there is.
+      if (proc.pid) process.kill(-proc.pid, signal)
+      else proc.kill(signal)
     } catch {
       try {
         proc.kill(signal)

package/extensions/subagent/index.ts

@@ -395,7 +395,9 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
 
       const killGroup = (sig: NodeJS.Signals): void => {
         try {
-          process.kill(-proc.pid!, sig)
+          // A child that never spawned has no pid and no group; the direct kill is all there is.
+          if (proc.pid) process.kill(-proc.pid, sig)
+          else proc.kill(sig)
         } catch {
           try {
             proc.kill(sig)
@@ -1463,6 +1465,10 @@ export default function subagentExtension(pi: ExtensionAPI) {
   // available model list are captured per session so a hook run lands in the right repo.
   let hookCwd = process.cwd()
   let hookModels: ReadonlyArray<{ id: string }> = []
+  // Captured per session like cwd: a named agent resolved for a fork skill or an agent
+  // hook must respect project trust the way the tool path does, or an unapproved repo's
+  // .claude/agents entry (which wins a name clash) would run on its own say-so.
+  let hookAgentScope: AgentScope = 'user'
 
   // Discovery walks the plugin cache, the builtin dir, and every agent dir, parsing
   // each file: dozens of fs ops per call. The roster injection below runs every turn
@@ -1474,6 +1480,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
   pi.on('session_start', async (_event, ctx) => {
     rosterCache = null
     hookCwd = ctx.cwd
+    hookAgentScope = isProjectApprovedSilently(ctx) ? 'both' : 'user'
     try {
       hookModels = ctx.modelRegistry?.getAvailable?.() ?? []
     } catch {
@@ -1485,7 +1492,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
       if (process.env.PI_CODE_SUBAGENT) throw new Error('agent hooks do not run inside a subagent')
       // A context: fork skill names its agent, or runs with the full toolset;
       // agent hooks keep the read-only hook shape.
-      const named = request.agent ? discoverAgents(hookCwd, 'both').agents.find((a) => a.name === request.agent) : undefined
+      const named = request.agent ? discoverAgents(hookCwd, hookAgentScope).agents.find((a) => a.name === request.agent) : undefined
       const agent = named ?? (request.fullTools ? forkAgent(request) : buildHookAgent(request))
       const result = await runSingleAgent({
         defaultCwd: hookCwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.49",
+  "version": "1.0.51",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",