pi-code 1.0.50 → 1.0.51

package/extensions/commands.ts

@@ -50,7 +50,7 @@ import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile, readManagedSettings } from './internal/managed-settings.js'
 import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
-import { type InstalledPlugin, installedPlugins } from './internal/plugins.js'
+import { type InstalledPlugin, installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, repoRoot } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -146,7 +146,7 @@ function pluginCommands(plugins: InstalledPlugin[]): DiscoveredCommand[] {
   const found: DiscoveredCommand[] = []
   for (const plugin of plugins) {
     const declared = plugin.manifest.commands
-    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => path.resolve(plugin.root, String(entry)))
+    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => pluginComponentPath(plugin, String(entry))).filter((dir): dir is string => dir !== undefined)
     for (const dir of dirs) {
       for (const command of discoverCommandFiles(dir)) {
         found.push({ name: `${plugin.name}:${command.name}`, filePath: command.filePath, plugin: { root: plugin.root, dataDir: plugin.dataDir, ...(plugin.userConfig ? { userConfig: plugin.userConfig } : {}) } })

package/extensions/hooks/config.ts

@@ -7,7 +7,7 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { readManagedSettings } from '../internal/managed-settings.js'
-import { type InstalledPlugin, substitutePluginVars } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath, substitutePluginVars } from '../internal/plugins.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
 
 export interface HookCommand {
@@ -227,6 +227,44 @@ function mergeHooksJson(config: HooksConfig, raw: string, source: string, source
  * every hook the plugin declared silently vanished. */
 const jsonEscape = (value: string): string => JSON.stringify(value).slice(1, -1)
 
+/** A reference Claude refuses to substitute into anything that reaches a shell. */
+const USER_CONFIG_REF = /\$\{user_config\./
+
+/**
+ * Drop shell-form hook commands that reference `${user_config.*}`. Claude: "Fields that
+ * run in a shell reject `${user_config.*}`: substituting a configured value into a shell
+ * command would let the shell run whatever that value contains, so the component fails
+ * with an error instead." Exec form (`args`) and every other field still substitute, and
+ * the documented alternative is reading CLAUDE_PLUGIN_OPTION_<KEY> from the hook's
+ * environment. Sibling hooks in the same file are unaffected: one rejected component
+ * costs itself, not the plugin's other hooks.
+ */
+function withoutUserConfigShellCommands(raw: string, source: string): string {
+  let parsed: { hooks?: Record<string, unknown> }
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return raw // mergeHooksJson reports the parse failure
+  }
+  let dropped = false
+  for (const matchers of Object.values(parsed?.hooks ?? {})) {
+    if (!Array.isArray(matchers)) continue
+    for (const entry of matchers) {
+      const record = entry as { hooks?: unknown }
+      if (!Array.isArray(record.hooks)) continue
+      const kept = record.hooks.filter((hook) => {
+        const candidate = hook as { command?: unknown; args?: unknown }
+        if (Array.isArray(candidate.args) || typeof candidate.command !== 'string' || !USER_CONFIG_REF.test(candidate.command)) return true
+        console.warn(`pi-code-hooks: ignoring a hook in ${source}: a shell-form command cannot reference \${user_config.*}; use exec form with "args", or read CLAUDE_PLUGIN_OPTION_<KEY> from the environment`)
+        dropped = true
+        return false
+      })
+      record.hooks = kept
+    }
+  }
+  return dropped ? JSON.stringify(parsed) : raw
+}
+
 export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[], sources?: Map<HookMatcher, string>): void {
   for (const plugin of plugins) {
     const declared = plugin.manifest.hooks
@@ -234,12 +272,14 @@ export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[],
     // numeric event keys), so it falls through to the default path rather than
     // silently registering nothing.
     if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
-      mergeHooksJson(config, substitutePluginVars(JSON.stringify({ hooks: declared }), plugin, jsonEscape), `${plugin.name} (plugin.json)`, sources, `plugin:${plugin.name}`)
+      const inlineSource = `${plugin.name} (plugin.json)`
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(JSON.stringify({ hooks: declared }), inlineSource), plugin, jsonEscape), inlineSource, sources, `plugin:${plugin.name}`)
       continue
     }
-    const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    const file = pluginComponentPath(plugin, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    if (file === undefined) continue
     try {
-      mergeHooksJson(config, substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(fs.readFileSync(file, 'utf-8'), file), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
     } catch {
       // a plugin without hooks contributes nothing
     }

package/extensions/internal/bash-rules.ts

@@ -14,10 +14,20 @@ import { hasSubstitution, splitSegments } from './shell-split.js'
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
+/**
+ * One rule against one command segment, per Claude's permission table:
+ * - `*` stands in for whatever text is in its place.
+ * - a trailing `*` with a space before it also matches the bare command, but only when
+ *   it is the rule's only wildcard (`* --help *` does not match `npm --help`).
+ * - that space is part of the rule, so `ls *` does not match `lsof` while `ls*` does.
+ * - `:*` is an equivalent spelling of a trailing ` *`, recognized only at the end; a
+ *   colon anywhere else is a literal character.
+ */
 function matchesRule(segment: string, rule: string): boolean {
-  if (rule.endsWith(':*')) return segment.startsWith(rule.slice(0, -2))
-  if (rule.includes('*')) return new RegExp(`^${rule.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
-  return segment === rule
+  const normalized = rule.endsWith(':*') ? `${rule.slice(0, -2)} *` : rule
+  if (normalized.endsWith(' *') && normalized.indexOf('*') === normalized.length - 1 && segment === normalized.slice(0, -2)) return true
+  if (normalized.includes('*')) return new RegExp(`^${normalized.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
+  return segment === normalized
 }
 
 export function matchesBashRules(command: string, rules: string[]): boolean {

package/extensions/internal/mcp-oauth.ts

@@ -39,10 +39,26 @@ export interface OAuthServerConfig {
   authServerMetadataUrl?: string
 }
 
+/** The origin a sign-in belongs to, so the same server name at a different endpoint gets
+ * its own store. An unparseable url falls back to its raw text rather than to nothing. */
+function endpointKey(endpoint: string | undefined): string {
+  if (!endpoint) return ''
+  try {
+    return new URL(endpoint).origin
+  } catch {
+    return endpoint
+  }
+}
+
 /** A server name is config-controlled text; the digest keeps hostile names inside
- * the store directory and distinct names from colliding after sanitization. */
-function storeFileFor(serverName: string): string {
-  const digest = crypto.createHash('sha256').update(serverName).digest('hex').slice(0, 8)
+ * the store directory and distinct names from colliding after sanitization. The endpoint
+ * rides the digest so a second project reusing a name cannot read the first one's tokens. */
+function storeFileFor(serverName: string, endpoint?: string): string {
+  const digest = crypto
+    .createHash('sha256')
+    .update(`${serverName}\n${endpointKey(endpoint)}`)
+    .digest('hex')
+    .slice(0, 8)
   // Collapse disallowed runs to a single hyphen, then strip leading and trailing
   // hyphens by index. The old /^-+|-+$/g trim rescanned on every hyphen of a long run
   // (its trailing-anchored branch backtracks per start position), which is quadratic.
@@ -66,8 +82,8 @@ export class FileOAuthProvider implements OAuthClientProvider {
   // page cannot inject an authorization code into this login (RFC 8252 8.9).
   private readonly loginState = crypto.randomBytes(16).toString('hex')
 
-  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig) {
-    this.storePath = storeFileFor(serverName)
+  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig, endpoint?: string) {
+    this.storePath = storeFileFor(serverName, endpoint)
     this.onRedirect = onRedirect
     this.oauth = oauth
     try {

package/extensions/internal/plugins.ts

@@ -243,6 +243,20 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
  * substituting into text that is still raw JSON must pass an escapeValue that
  * JSON-escapes: a Windows root (C:\Users\...) inserted verbatim injects invalid
  * escape sequences and the subsequent parse throws. */
+/** A plugin component path, resolved inside the plugin root. Claude "rejects a component
+ * path that resolves outside the plugin root, such as `../shared-utils`", so an escaping
+ * entry yields undefined and its caller skips that component. The check is lexical, which
+ * is the rule as documented: a plugin's own root may itself be a symlink (link mode). */
+export function pluginComponentPath(plugin: Pick<InstalledPlugin, 'name' | 'root'>, declared: string): string | undefined {
+  const resolved = path.resolve(plugin.root, declared)
+  const inside = path.relative(plugin.root, resolved)
+  if (inside !== '' && (inside.startsWith(`..${path.sep}`) || inside === '..' || path.isAbsolute(inside))) {
+    console.warn(`pi-code-plugins: plugin ${plugin.name} declares the component path "${declared}", which resolves outside its root; ignoring it`)
+    return undefined
+  }
+  return resolved
+}
+
 export function substitutePluginVars(value: string, plugin: InstalledPlugin, escapeValue: (substituted: string) => string = (substituted) => substituted): string {
   return value
     .replaceAll('${CLAUDE_PLUGIN_ROOT}', escapeValue(plugin.root))

package/extensions/mcp/config.ts

@@ -8,7 +8,7 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import { claudeConfigDir } from '../internal/config-dir.js'
 import type { OAuthServerConfig } from '../internal/mcp-oauth.js'
-import type { InstalledPlugin } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
 
 export interface StdioServerConfig {
@@ -156,7 +156,9 @@ function rawPluginServerEntries(plugin: InstalledPlugin): Record<string, unknown
   const servers: Record<string, unknown> = {}
   for (const entry of paths) {
     try {
-      const parsed = JSON.parse(fs.readFileSync(path.resolve(plugin.root, entry), 'utf-8'))
+      const file = pluginComponentPath(plugin, entry)
+      if (file === undefined) continue
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
       Object.assign(servers, parsed.mcpServers ?? {})
     } catch {
       // Malformed or missing JSON contributes no entries.

package/extensions/mcp/index.ts

@@ -494,6 +494,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * factory: pi runs the factory for invocations that never start a session. Names still
    * connected are filtered out, so a later session start only retries servers that failed
    * or whose transport dropped, without duplicate-name warnings. */
+  /** A project server's headersHelper, dropped while the project is unapproved. */
+  function withoutUntrustedHelper(name: string, config: ServerConfig): ServerConfig {
+    if (!('headersHelper' in config) || config.headersHelper === undefined) return config
+    console.warn(`pi-code-mcp: headersHelper not run for server ${name}: the project is not trusted yet; connecting with its static headers alone`)
+    const { headersHelper: _dropped, ...rest } = config
+    return rest as ServerConfig
+  }
+
   async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's. A server toggled off
@@ -510,7 +518,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // a deliberate narrowing of Claude's rule to keep the safe default.
     // The stored project decision, read without prompting: consent recorded inside
     // the project only counts once the project itself has been approved.
-    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
+    const projectApproved = isProjectApprovedSilently(ctx)
+    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), projectApproved)
     // Tag the scope on each project server: a repository-supplied headersHelper runs
     // with credential variables stripped, unlike a user-scope one.
     const projectServers = Object.fromEntries(Object.entries(loadConfigFrom(projectConfigPaths(ctx.cwd))).map(([name, config]) => [name, { ...config, projectScope: true }]))
@@ -519,7 +528,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // stays with the local (user-side) definition, so the project's entry is dropped
     // here rather than allowed to shadow it.
     const localNames = localScopeServerNames(os.homedir(), ctx.cwd)
-    const consented = Object.fromEntries(Object.entries(consentedRaw).filter(([name]) => !localNames.has(name)))
+    // Claude: until the folder is trusted, a project server connects with its static
+    // headers alone. Consenting to the server is not consenting to run the command it
+    // ships, so the helper is dropped (and named once) while the project is unapproved.
+    const consented = Object.fromEntries(
+      Object.entries(consentedRaw)
+        .filter(([name]) => !localNames.has(name))
+        .map(([name, config]) => [name, projectApproved ? config : withoutUntrustedHelper(name, config)]),
+    )
     const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     // The consented project servers carry no ordering dependency on the user scope:

package/extensions/mcp/oauth-flow.ts

@@ -55,6 +55,7 @@ export async function runInteractiveOAuth(name: string, config: { url: string; o
       authUi.notify(`Authorize "${name}" in the browser. If it did not open: ${authorizationUrl}`, 'info')
     },
     config.oauth,
+    config.url,
   )
   const { server, port } = await startCallbackServer(provider.savedRedirectPort())
   provider.bindRedirectPort(port)

package/extensions/mcp/transport.ts

@@ -260,8 +260,13 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
   const token = resolveBearerToken(config)
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
-  // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper), helperEnv(name, config)))
+  // JSON stdout merges over the static headers. The command text is NOT interpolated:
+  // Claude expands ${VAR} in command, args, env, url and headers, and expanding it here
+  // would read the parent environment, which is the credential set a repository- or
+  // plugin-supplied helper must not see. The helper's own shell expands it against the
+  // stripped environment instead. Plugin path variables are already substituted in
+  // mcp/config.ts, which also refuses ${user_config.*} in a helper.
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(config.headersHelper, helperEnv(name, config)))
   warnMissing()
   // Claude: a configured Authorization header, whether static, a bearer token, or
   // helper output, is the server's authentication; there is no OAuth fallback for it.
@@ -367,7 +372,7 @@ async function connectHttpFamily(name: string, config: { url: string; oauth?: OA
   // dynamic registration, keeping it bound to the real callback port. A
   // pre-configured client (oauth.clientId) rides the silent provider too, so its
   // stored tokens refresh with the configured credentials.
-  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth)
+  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth, config.url)
   try {
     const client = newClient()
     await connectWithTimeout(client, makeTransport(silent?.hasTokens() ? silent : undefined), label)

package/extensions/output-styles.ts

@@ -26,7 +26,7 @@ import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, findNearestDir, findNearestFile } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -118,7 +118,7 @@ export function pluginStyleDirs(home: string): string[] {
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.outputStyles
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'output-styles']
-    return dirs.map((dir) => path.resolve(plugin.root, String(dir)))
+    return dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined)
   })
 }
 

package/extensions/skills.ts

@@ -29,7 +29,7 @@ import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
 import { ancestorDirs } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -58,7 +58,7 @@ export function skillDirs(cwd: string, home: string, trusted: boolean): string[]
   for (const plugin of installedPlugins(home)) {
     const declared = plugin.manifest.skills
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'skills']
-    candidates.push(...dirs.map((dir) => path.resolve(plugin.root, String(dir))))
+    candidates.push(...dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined))
   }
   // Claude loads skills from every .claude/skills between cwd and the repository
   // root; the list goes nearest-first so findClaudeSkill's first match is the

package/extensions/subagent/agents.ts

@@ -12,7 +12,7 @@ import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
-import { installedPlugins } from '../internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
 
 /**
@@ -353,7 +353,10 @@ function pluginAgentDirs(home: string): Array<{ dir: string; pluginName: string
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.agents
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'agents']
-    return dirs.map((dir) => ({ dir: path.resolve(plugin.root, String(dir)), pluginName: plugin.name }))
+    return dirs
+      .map((dir) => pluginComponentPath(plugin, String(dir)))
+      .filter((dir): dir is string => dir !== undefined)
+      .map((dir) => ({ dir, pluginName: plugin.name }))
   })
 }
 

package/extensions/subagent/background.ts

@@ -279,7 +279,9 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   run.live = true
   const killGroup = (signal: NodeJS.Signals): void => {
     try {
-      process.kill(-proc.pid!, signal)
+      // A child that never spawned has no pid and no group; the direct kill is all there is.
+      if (proc.pid) process.kill(-proc.pid, signal)
+      else proc.kill(signal)
     } catch {
       try {
         proc.kill(signal)

package/extensions/subagent/index.ts

@@ -395,7 +395,9 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
 
       const killGroup = (sig: NodeJS.Signals): void => {
         try {
-          process.kill(-proc.pid!, sig)
+          // A child that never spawned has no pid and no group; the direct kill is all there is.
+          if (proc.pid) process.kill(-proc.pid, sig)
+          else proc.kill(sig)
         } catch {
           try {
             proc.kill(sig)
@@ -1463,6 +1465,10 @@ export default function subagentExtension(pi: ExtensionAPI) {
   // available model list are captured per session so a hook run lands in the right repo.
   let hookCwd = process.cwd()
   let hookModels: ReadonlyArray<{ id: string }> = []
+  // Captured per session like cwd: a named agent resolved for a fork skill or an agent
+  // hook must respect project trust the way the tool path does, or an unapproved repo's
+  // .claude/agents entry (which wins a name clash) would run on its own say-so.
+  let hookAgentScope: AgentScope = 'user'
 
   // Discovery walks the plugin cache, the builtin dir, and every agent dir, parsing
   // each file: dozens of fs ops per call. The roster injection below runs every turn
@@ -1474,6 +1480,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
   pi.on('session_start', async (_event, ctx) => {
     rosterCache = null
     hookCwd = ctx.cwd
+    hookAgentScope = isProjectApprovedSilently(ctx) ? 'both' : 'user'
     try {
       hookModels = ctx.modelRegistry?.getAvailable?.() ?? []
     } catch {
@@ -1485,7 +1492,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
       if (process.env.PI_CODE_SUBAGENT) throw new Error('agent hooks do not run inside a subagent')
       // A context: fork skill names its agent, or runs with the full toolset;
       // agent hooks keep the read-only hook shape.
-      const named = request.agent ? discoverAgents(hookCwd, 'both').agents.find((a) => a.name === request.agent) : undefined
+      const named = request.agent ? discoverAgents(hookCwd, hookAgentScope).agents.find((a) => a.name === request.agent) : undefined
       const agent = named ?? (request.fullTools ? forkAgent(request) : buildHookAgent(request))
       const result = await runSingleAgent({
         defaultCwd: hookCwd,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.50",
+  "version": "1.0.51",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",