pi-code 1.0.50 → 1.0.52

package/extensions/claude-rules.ts

@@ -39,12 +39,47 @@ function unquote(value: string): string {
   return value.replace(/^["']|["']$/g, '')
 }
 
+/** Split a YAML flow sequence on its top-level commas. A comma inside a brace group
+ * (`*.{ts,tsx}`, which Claude expands) or inside quotes belongs to its entry, so
+ * splitting on every comma produced patterns that match nothing. */
 function splitInline(value: string): string[] {
-  return value
-    .replace(/^\[|\]$/g, '')
-    .split(',')
-    .map((entry) => unquote(entry.trim()))
-    .filter(Boolean)
+  const entries: string[] = []
+  let current = ''
+  let depth = 0
+  let quote: string | undefined
+  for (const char of value.replace(/^\[/, '').replace(/\]$/, '')) {
+    if (quote !== undefined) {
+      if (char === quote) quote = undefined
+      current += char
+      continue
+    }
+    if (char === '"' || char === "'") {
+      quote = char
+      current += char
+      continue
+    }
+    if (char === '{') depth++
+    else if (char === '}') depth = Math.max(0, depth - 1)
+    else if (char === ',' && depth === 0) {
+      entries.push(current)
+      current = ''
+      continue
+    }
+    current += char
+  }
+  entries.push(current)
+  return entries.map((entry) => unquote(entry.trim())).filter(Boolean)
+}
+
+/** A flow sequence that opens on the `paths:` line and closes on a later one, joined
+ * back into a single value. An unterminated list runs to the end of the frontmatter. */
+function joinFlowSequence(lines: string[], index: number, opening: string): string {
+  let joined = opening
+  for (let i = index + 1; i < lines.length; i++) {
+    joined += ` ${lines[i].trim()}`
+    if (lines[i].includes(']')) break
+  }
+  return joined
 }
 
 function parsePaths(frontmatter: string): string[] {
@@ -52,7 +87,7 @@ function parsePaths(frontmatter: string): string[] {
   const index = lines.findIndex((line) => /^\s*paths\s*:/.test(line))
   if (index === -1) return []
   const inline = lines[index].replace(/^\s*paths\s*:/, '').trim()
-  if (inline) return splitInline(inline)
+  if (inline) return splitInline(inline.startsWith('[') && !inline.includes(']') ? joinFlowSequence(lines, index, inline) : inline)
   const items: string[] = []
   // Matched with string ops rather than a regex: the equivalent pattern needs two
   // adjacent whitespace quantifiers, which backtracks super-linearly on long lines.

package/extensions/commands.ts

@@ -50,7 +50,7 @@ import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile, readManagedSettings } from './internal/managed-settings.js'
 import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
-import { type InstalledPlugin, installedPlugins } from './internal/plugins.js'
+import { type InstalledPlugin, installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, repoRoot } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -146,7 +146,7 @@ function pluginCommands(plugins: InstalledPlugin[]): DiscoveredCommand[] {
   const found: DiscoveredCommand[] = []
   for (const plugin of plugins) {
     const declared = plugin.manifest.commands
-    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => path.resolve(plugin.root, String(entry)))
+    const dirs = (Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'commands']).map((entry) => pluginComponentPath(plugin, String(entry))).filter((dir): dir is string => dir !== undefined)
     for (const dir of dirs) {
       for (const command of discoverCommandFiles(dir)) {
         found.push({ name: `${plugin.name}:${command.name}`, filePath: command.filePath, plugin: { root: plugin.root, dataDir: plugin.dataDir, ...(plugin.userConfig ? { userConfig: plugin.userConfig } : {}) } })

package/extensions/env-settings.ts

@@ -40,7 +40,7 @@ import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-a
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
-import { findNearestFile } from './internal/project-root.js'
+import { claudeSettingsChain } from './internal/settings-chain.js'
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value)
@@ -137,12 +137,14 @@ export function sanitizeProjectEnv(env: Record<string, string>, warn: (key: stri
   return kept
 }
 
-/** The project scope's env: .claude/settings.json with settings.local.json overlaid,
- * each the nearest of its name at or above cwd (matching the hooks settings chain). */
-function projectEnv(cwd: string): Record<string, string> {
-  const base = envFromSettings(readSettingsFile(findNearestFile(cwd, path.join('.claude', 'settings.json')) ?? path.join(cwd, '.claude', 'settings.json')))
-  const local = envFromSettings(readSettingsFile(findNearestFile(cwd, path.join('.claude', 'settings.local.json')) ?? path.join(cwd, '.claude', 'settings.local.json')))
-  return sanitizeProjectEnv({ ...base, ...local })
+/** The project scope's env, resolved through the shared settings chain so placement
+ * matches every other consumer: the shared settings.json comes from the session's own
+ * directory and never an ancestor, settings.local.json from the repository root. Later
+ * files win. */
+function projectEnv(cwd: string, home: string): Record<string, string> {
+  const merged: Record<string, string> = {}
+  for (const file of claudeSettingsChain(cwd, home, true).slice(1)) Object.assign(merged, envFromSettings(readSettingsFile(file)))
+  return sanitizeProjectEnv(merged)
 }
 
 export default function envSettingsExtension(pi: ExtensionAPI) {
@@ -157,6 +159,6 @@ export default function envSettingsExtension(pi: ExtensionAPI) {
   apply(os.homedir(), {})
 
   pi.on('session_start', async (_event, ctx: ExtensionContext) => {
-    apply(os.homedir(), isProjectApprovedSilently(ctx) ? projectEnv(ctx.cwd) : {})
+    apply(os.homedir(), isProjectApprovedSilently(ctx) ? projectEnv(ctx.cwd, os.homedir()) : {})
   })
 }

package/extensions/hooks/config.ts

@@ -7,7 +7,7 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { readManagedSettings } from '../internal/managed-settings.js'
-import { type InstalledPlugin, substitutePluginVars } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath, substitutePluginVars } from '../internal/plugins.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
 
 export interface HookCommand {
@@ -227,6 +227,44 @@ function mergeHooksJson(config: HooksConfig, raw: string, source: string, source
  * every hook the plugin declared silently vanished. */
 const jsonEscape = (value: string): string => JSON.stringify(value).slice(1, -1)
 
+/** A reference Claude refuses to substitute into anything that reaches a shell. */
+const USER_CONFIG_REF = /\$\{user_config\./
+
+/**
+ * Drop shell-form hook commands that reference `${user_config.*}`. Claude: "Fields that
+ * run in a shell reject `${user_config.*}`: substituting a configured value into a shell
+ * command would let the shell run whatever that value contains, so the component fails
+ * with an error instead." Exec form (`args`) and every other field still substitute, and
+ * the documented alternative is reading CLAUDE_PLUGIN_OPTION_<KEY> from the hook's
+ * environment. Sibling hooks in the same file are unaffected: one rejected component
+ * costs itself, not the plugin's other hooks.
+ */
+function withoutUserConfigShellCommands(raw: string, source: string): string {
+  let parsed: { hooks?: Record<string, unknown> }
+  try {
+    parsed = JSON.parse(raw)
+  } catch {
+    return raw // mergeHooksJson reports the parse failure
+  }
+  let dropped = false
+  for (const matchers of Object.values(parsed?.hooks ?? {})) {
+    if (!Array.isArray(matchers)) continue
+    for (const entry of matchers) {
+      const record = entry as { hooks?: unknown }
+      if (!Array.isArray(record.hooks)) continue
+      const kept = record.hooks.filter((hook) => {
+        const candidate = hook as { command?: unknown; args?: unknown }
+        if (Array.isArray(candidate.args) || typeof candidate.command !== 'string' || !USER_CONFIG_REF.test(candidate.command)) return true
+        console.warn(`pi-code-hooks: ignoring a hook in ${source}: a shell-form command cannot reference \${user_config.*}; use exec form with "args", or read CLAUDE_PLUGIN_OPTION_<KEY> from the environment`)
+        dropped = true
+        return false
+      })
+      record.hooks = kept
+    }
+  }
+  return dropped ? JSON.stringify(parsed) : raw
+}
+
 export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[], sources?: Map<HookMatcher, string>): void {
   for (const plugin of plugins) {
     const declared = plugin.manifest.hooks
@@ -234,12 +272,14 @@ export function loadPluginHooks(config: HooksConfig, plugins: InstalledPlugin[],
     // numeric event keys), so it falls through to the default path rather than
     // silently registering nothing.
     if (declared !== null && typeof declared === 'object' && !Array.isArray(declared)) {
-      mergeHooksJson(config, substitutePluginVars(JSON.stringify({ hooks: declared }), plugin, jsonEscape), `${plugin.name} (plugin.json)`, sources, `plugin:${plugin.name}`)
+      const inlineSource = `${plugin.name} (plugin.json)`
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(JSON.stringify({ hooks: declared }), inlineSource), plugin, jsonEscape), inlineSource, sources, `plugin:${plugin.name}`)
       continue
     }
-    const file = path.resolve(plugin.root, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    const file = pluginComponentPath(plugin, typeof declared === 'string' ? declared : path.join('hooks', 'hooks.json'))
+    if (file === undefined) continue
     try {
-      mergeHooksJson(config, substitutePluginVars(fs.readFileSync(file, 'utf-8'), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
+      mergeHooksJson(config, substitutePluginVars(withoutUserConfigShellCommands(fs.readFileSync(file, 'utf-8'), file), plugin, jsonEscape), file, sources, `plugin:${plugin.name}`)
     } catch {
       // a plugin without hooks contributes nothing
     }

package/extensions/hooks/decisions.ts

@@ -147,7 +147,19 @@ function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[],
     // Claude shows a `<hook> hook error` notice when {..}-shaped stdout cannot be
     // read as JSON output (exit 2 still blocks and reads its own channels).
     const jsonError = result.code === 2 ? undefined : hookJsonError(result.stdout)
-    if (jsonError !== undefined) notify(`${commands[i].command} hook error: ${jsonError}`)
+    if (jsonError !== undefined) {
+      notify(`${commands[i].command} hook error: ${jsonError}`)
+      continue
+    }
+    // A non-zero exit that is neither a block (2) nor a timeout, with nothing parseable
+    // on stdout, is Claude's non-blocking error: the action proceeds and the notice
+    // carries the first line of stderr. Without it a mistyped path in settings.json
+    // leaves a policy hook silently disabled, since the shell exits 127 and says so only
+    // on stderr. A spawn failure is reported above and skipped here.
+    if (!result.spawnFailed && !result.timedOut && result.code !== 0 && result.code !== 2) {
+      const firstLine = result.stderr.trim().split('\n')[0]
+      notify(`${commands[i].command} hook error: Failed with non-blocking status code: ${firstLine || result.code}`)
+    }
   }
 }
 

package/extensions/internal/atomic-write.ts

@@ -0,0 +1,14 @@
+/**
+ * Replace a file through a temp file and a rename, so a crash mid-write cannot leave the
+ * target truncated. Used wherever pi-code rewrites a file the user owns and would have to
+ * repair by hand: settings and the memory index.
+ */
+
+import * as fs from 'node:fs'
+
+/** The tmp name carries the pid so concurrent processes do not collide. */
+export function atomicWriteFile(filePath: string, content: string): void {
+  const tmp = `${filePath}.${process.pid}.tmp`
+  fs.writeFileSync(tmp, content)
+  fs.renameSync(tmp, filePath)
+}

package/extensions/internal/bash-rules.ts

@@ -14,10 +14,20 @@ import { hasSubstitution, splitSegments } from './shell-split.js'
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
+/**
+ * One rule against one command segment, per Claude's permission table:
+ * - `*` stands in for whatever text is in its place.
+ * - a trailing `*` with a space before it also matches the bare command, but only when
+ *   it is the rule's only wildcard (`* --help *` does not match `npm --help`).
+ * - that space is part of the rule, so `ls *` does not match `lsof` while `ls*` does.
+ * - `:*` is an equivalent spelling of a trailing ` *`, recognized only at the end; a
+ *   colon anywhere else is a literal character.
+ */
 function matchesRule(segment: string, rule: string): boolean {
-  if (rule.endsWith(':*')) return segment.startsWith(rule.slice(0, -2))
-  if (rule.includes('*')) return new RegExp(`^${rule.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
-  return segment === rule
+  const normalized = rule.endsWith(':*') ? `${rule.slice(0, -2)} *` : rule
+  if (normalized.endsWith(' *') && normalized.indexOf('*') === normalized.length - 1 && segment === normalized.slice(0, -2)) return true
+  if (normalized.includes('*')) return new RegExp(`^${normalized.split('*').map(escapeRegExp).join('[^]*')}$`).test(segment)
+  return segment === normalized
 }
 
 export function matchesBashRules(command: string, rules: string[]): boolean {

package/extensions/internal/mcp-oauth.ts

@@ -39,10 +39,26 @@ export interface OAuthServerConfig {
   authServerMetadataUrl?: string
 }
 
+/** The origin a sign-in belongs to, so the same server name at a different endpoint gets
+ * its own store. An unparseable url falls back to its raw text rather than to nothing. */
+function endpointKey(endpoint: string | undefined): string {
+  if (!endpoint) return ''
+  try {
+    return new URL(endpoint).origin
+  } catch {
+    return endpoint
+  }
+}
+
 /** A server name is config-controlled text; the digest keeps hostile names inside
- * the store directory and distinct names from colliding after sanitization. */
-function storeFileFor(serverName: string): string {
-  const digest = crypto.createHash('sha256').update(serverName).digest('hex').slice(0, 8)
+ * the store directory and distinct names from colliding after sanitization. The endpoint
+ * rides the digest so a second project reusing a name cannot read the first one's tokens. */
+function storeFileFor(serverName: string, endpoint?: string): string {
+  const digest = crypto
+    .createHash('sha256')
+    .update(`${serverName}\n${endpointKey(endpoint)}`)
+    .digest('hex')
+    .slice(0, 8)
   // Collapse disallowed runs to a single hyphen, then strip leading and trailing
   // hyphens by index. The old /^-+|-+$/g trim rescanned on every hyphen of a long run
   // (its trailing-anchored branch backtracks per start position), which is quadratic.
@@ -66,8 +82,8 @@ export class FileOAuthProvider implements OAuthClientProvider {
   // page cannot inject an authorization code into this login (RFC 8252 8.9).
   private readonly loginState = crypto.randomBytes(16).toString('hex')
 
-  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig) {
-    this.storePath = storeFileFor(serverName)
+  constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void, oauth?: OAuthServerConfig, endpoint?: string) {
+    this.storePath = storeFileFor(serverName, endpoint)
     this.onRedirect = onRedirect
     this.oauth = oauth
     try {
@@ -228,7 +244,12 @@ export function openBrowser(url: string): void {
   else if (process.platform === 'win32') command = 'cmd'
   const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
   try {
-    spawn(command, args, { stdio: 'ignore', detached: true }).unref()
+    const child = spawn(command, args, { stdio: 'ignore', detached: true })
+    // A missing launcher (a container or an SSH session with no xdg-open) reports itself
+    // asynchronously through 'error'; with no listener node raises it as an
+    // uncaughtException and pi exits. The caller has already shown the URL to open by hand.
+    child.on('error', () => {})
+    child.unref()
   } catch {
     // the notified URL is the fallback
   }

package/extensions/internal/plugins.ts

@@ -243,6 +243,20 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
  * substituting into text that is still raw JSON must pass an escapeValue that
  * JSON-escapes: a Windows root (C:\Users\...) inserted verbatim injects invalid
  * escape sequences and the subsequent parse throws. */
+/** A plugin component path, resolved inside the plugin root. Claude "rejects a component
+ * path that resolves outside the plugin root, such as `../shared-utils`", so an escaping
+ * entry yields undefined and its caller skips that component. The check is lexical, which
+ * is the rule as documented: a plugin's own root may itself be a symlink (link mode). */
+export function pluginComponentPath(plugin: Pick<InstalledPlugin, 'name' | 'root'>, declared: string): string | undefined {
+  const resolved = path.resolve(plugin.root, declared)
+  const inside = path.relative(plugin.root, resolved)
+  if (inside !== '' && (inside.startsWith(`..${path.sep}`) || inside === '..' || path.isAbsolute(inside))) {
+    console.warn(`pi-code-plugins: plugin ${plugin.name} declares the component path "${declared}", which resolves outside its root; ignoring it`)
+    return undefined
+  }
+  return resolved
+}
+
 export function substitutePluginVars(value: string, plugin: InstalledPlugin, escapeValue: (substituted: string) => string = (substituted) => substituted): string {
   return value
     .replaceAll('${CLAUDE_PLUGIN_ROOT}', escapeValue(plugin.root))

package/extensions/mcp/config.ts

@@ -8,7 +8,7 @@ import * as os from 'node:os'
 import * as path from 'node:path'
 import { claudeConfigDir } from '../internal/config-dir.js'
 import type { OAuthServerConfig } from '../internal/mcp-oauth.js'
-import type { InstalledPlugin } from '../internal/plugins.js'
+import { type InstalledPlugin, pluginComponentPath } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
 
 export interface StdioServerConfig {
@@ -156,7 +156,9 @@ function rawPluginServerEntries(plugin: InstalledPlugin): Record<string, unknown
   const servers: Record<string, unknown> = {}
   for (const entry of paths) {
     try {
-      const parsed = JSON.parse(fs.readFileSync(path.resolve(plugin.root, entry), 'utf-8'))
+      const file = pluginComponentPath(plugin, entry)
+      if (file === undefined) continue
+      const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
       Object.assign(servers, parsed.mcpServers ?? {})
     } catch {
       // Malformed or missing JSON contributes no entries.

package/extensions/mcp/index.ts

@@ -494,6 +494,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * factory: pi runs the factory for invocations that never start a session. Names still
    * connected are filtered out, so a later session start only retries servers that failed
    * or whose transport dropped, without duplicate-name warnings. */
+  /** A project server's headersHelper, dropped while the project is unapproved. */
+  function withoutUntrustedHelper(name: string, config: ServerConfig): ServerConfig {
+    if (!('headersHelper' in config) || config.headersHelper === undefined) return config
+    console.warn(`pi-code-mcp: headersHelper not run for server ${name}: the project is not trusted yet; connecting with its static headers alone`)
+    const { headersHelper: _dropped, ...rest } = config
+    return rest as ServerConfig
+  }
+
   async function connectNormalScopes(ctx: ExtensionContext, policy: McpPolicy, authUi?: AuthUi): Promise<void> {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's. A server toggled off
@@ -510,7 +518,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // a deliberate narrowing of Claude's rule to keep the safe default.
     // The stored project decision, read without prompting: consent recorded inside
     // the project only counts once the project itself has been approved.
-    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
+    const projectApproved = isProjectApprovedSilently(ctx)
+    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), projectApproved)
     // Tag the scope on each project server: a repository-supplied headersHelper runs
     // with credential variables stripped, unlike a user-scope one.
     const projectServers = Object.fromEntries(Object.entries(loadConfigFrom(projectConfigPaths(ctx.cwd))).map(([name, config]) => [name, { ...config, projectScope: true }]))
@@ -519,7 +528,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // stays with the local (user-side) definition, so the project's entry is dropped
     // here rather than allowed to shadow it.
     const localNames = localScopeServerNames(os.homedir(), ctx.cwd)
-    const consented = Object.fromEntries(Object.entries(consentedRaw).filter(([name]) => !localNames.has(name)))
+    // Claude: until the folder is trusted, a project server connects with its static
+    // headers alone. Consenting to the server is not consenting to run the command it
+    // ships, so the helper is dropped (and named once) while the project is unapproved.
+    const consented = Object.fromEntries(
+      Object.entries(consentedRaw)
+        .filter(([name]) => !localNames.has(name))
+        .map(([name, config]) => [name, projectApproved ? config : withoutUntrustedHelper(name, config)]),
+    )
     const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     // The consented project servers carry no ordering dependency on the user scope:
@@ -547,8 +563,12 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // is why serverToolCount reads from `registered` to recover the true count here.
     status.clear()
     // A same-process session switch (/new, /resume) shut the last session down;
-    // this one may reconnect again.
+    // this one may reconnect again. projectConnected guards against connecting the project
+    // scope twice within one session, so it belongs to the session that set it: leaving it
+    // set here left every project server disconnected for the rest of the process, since
+    // the shutdown had already dropped their clients.
     shuttingDown = false
+    projectConnected = false
     // Claude answers roots/list with the session's launch directory and exports the
     // project root as CLAUDE_PROJECT_DIR to stdio servers; both derive from ctx.cwd.
     sessionDirs = { projectDir: repoRoot(ctx.cwd) ?? ctx.cwd, launchDir: ctx.cwd }

package/extensions/mcp/oauth-flow.ts

@@ -55,6 +55,7 @@ export async function runInteractiveOAuth(name: string, config: { url: string; o
       authUi.notify(`Authorize "${name}" in the browser. If it did not open: ${authorizationUrl}`, 'info')
     },
     config.oauth,
+    config.url,
   )
   const { server, port } = await startCallbackServer(provider.savedRedirectPort())
   provider.bindRedirectPort(port)

package/extensions/mcp/transport.ts

@@ -260,8 +260,13 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
   const token = resolveBearerToken(config)
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
-  // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper), helperEnv(name, config)))
+  // JSON stdout merges over the static headers. The command text is NOT interpolated:
+  // Claude expands ${VAR} in command, args, env, url and headers, and expanding it here
+  // would read the parent environment, which is the credential set a repository- or
+  // plugin-supplied helper must not see. The helper's own shell expands it against the
+  // stripped environment instead. Plugin path variables are already substituted in
+  // mcp/config.ts, which also refuses ${user_config.*} in a helper.
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(config.headersHelper, helperEnv(name, config)))
   warnMissing()
   // Claude: a configured Authorization header, whether static, a bearer token, or
   // helper output, is the server's authentication; there is no OAuth fallback for it.
@@ -367,7 +372,7 @@ async function connectHttpFamily(name: string, config: { url: string; oauth?: OA
   // dynamic registration, keeping it bound to the real callback port. A
   // pre-configured client (oauth.clientId) rides the silent provider too, so its
   // stored tokens refresh with the configured credentials.
-  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth)
+  const silent = hasConfiguredAuth ? undefined : new FileOAuthProvider(name, () => {}, config.oauth, config.url)
   try {
     const client = newClient()
     await connectWithTimeout(client, makeTransport(silent?.hasTokens() ? silent : undefined), label)

package/extensions/memory.ts

@@ -14,6 +14,7 @@ import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
 import { type ExtensionAPI, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
+import { atomicWriteFile } from './internal/atomic-write.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { capForContext } from './internal/output-guard.js'
@@ -322,14 +323,6 @@ function readIndexQuietly(dir: string): string {
   }
 }
 
-/** Write through a temp file and rename onto the target, so a crash mid-write cannot
- * truncate it. The tmp name carries the pid so concurrent processes do not collide. */
-function atomicWriteFile(filePath: string, content: string): void {
-  const tmp = `${filePath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, filePath)
-}
-
 /** Replace the index through a rename so a crash mid-write cannot truncate it. */
 function writeIndex(indexPath: string, content: string): void {
   atomicWriteFile(indexPath, content)

package/extensions/output-styles.ts

@@ -23,10 +23,11 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import { atomicWriteFile } from './internal/atomic-write.js'
 
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, findNearestDir, findNearestFile } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -101,10 +102,10 @@ function isDirectory(target: string): boolean {
  */
 export function styleDirs(cwd: string, home: string, trusted: boolean): string[] {
   const dirs = [path.join(claudeConfigDir(home), 'output-styles')]
-  // Claude loads every .claude/output-styles between cwd and the repository root,
-  // using the one closest to cwd for a name clash: styleForName is first-match,
-  // so the nearest directory goes first.
-  if (trusted) dirs.push(...ancestorDirs(cwd, path.join('.claude', 'output-styles')))
+  // Claude loads every .claude/output-styles between cwd and the repository root, using
+  // the one closest to cwd for a name clash. loadStyles keys by name and later dirs win,
+  // so the ancestors go farthest first and the nearest lands last.
+  if (trusted) dirs.push(...ancestorDirs(cwd, path.join('.claude', 'output-styles')).reverse())
   return dirs.filter((dir) => isDirectory(dir))
 }
 
@@ -118,7 +119,7 @@ export function pluginStyleDirs(home: string): string[] {
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.outputStyles
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'output-styles']
-    return dirs.map((dir) => path.resolve(plugin.root, String(dir)))
+    return dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined)
   })
 }
 
@@ -173,16 +174,31 @@ export function styleForName(styles: OutputStyle[], name: string | undefined): O
   return name ? styles.find((style) => style.name === name) : undefined
 }
 
-function persistActiveStyle(file: string, name: string): void {
-  let config: Record<string, unknown> = {}
+/** Record the choice in the local settings file, returning a message to show when it
+ * cannot be recorded. The file also carries permissions, hooks and env, so a present but
+ * unparseable one is left alone rather than replaced by the style choice alone. */
+function persistActiveStyle(file: string, name: string): string | undefined {
+  const label = path.basename(file)
+  let raw: string | undefined
   try {
-    config = JSON.parse(fs.readFileSync(file, 'utf-8'))
-  } catch {
-    // start from an empty config when the file is missing or invalid
+    raw = fs.readFileSync(file, 'utf-8')
+  } catch (error) {
+    // Only a missing file means start fresh; anything else is the user's file to keep.
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') return `${label} could not be read; the style applies to this session only`
+  }
+  let config: Record<string, unknown> = {}
+  if (raw !== undefined) {
+    try {
+      const parsed: unknown = JSON.parse(raw)
+      if (parsed !== null && typeof parsed === 'object') config = parsed as Record<string, unknown>
+    } catch {
+      return `${label} is not valid JSON; the style applies to this session only`
+    }
   }
   config.outputStyle = name
   fs.mkdirSync(path.dirname(file), { recursive: true })
-  fs.writeFileSync(file, `${JSON.stringify(config, null, 2)}\n`)
+  atomicWriteFile(file, `${JSON.stringify(config, null, 2)}\n`)
+  return undefined
 }
 
 export default function outputStylesExtension(pi: ExtensionAPI) {
@@ -236,8 +252,8 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
           return
         }
         activeName = picked.name
-        persistActiveStyle(localSettingsPath, picked.name)
-        ctx.ui.notify(`Output style set to ${picked.name} (applies next turn)`, 'info')
+        const failure = persistActiveStyle(localSettingsPath, picked.name)
+        ctx.ui.notify(failure ?? `Output style set to ${picked.name} (applies next turn)`, failure ? 'error' : 'info')
         return
       }
       if (!ctx.hasUI) {
@@ -253,8 +269,8 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
       if (!choice) return
       const picked = styles[labels.indexOf(choice)]
       activeName = picked.name
-      persistActiveStyle(localSettingsPath, picked.name)
-      ctx.ui.notify(`Output style set to ${picked.name} (applies next turn)`, 'info')
+      const failure = persistActiveStyle(localSettingsPath, picked.name)
+      ctx.ui.notify(failure ?? `Output style set to ${picked.name} (applies next turn)`, failure ? 'error' : 'info')
     },
   })
 }

package/extensions/skills.ts

@@ -29,7 +29,7 @@ import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
-import { installedPlugins } from './internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
 import { ancestorDirs } from './internal/project-root.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
@@ -58,7 +58,7 @@ export function skillDirs(cwd: string, home: string, trusted: boolean): string[]
   for (const plugin of installedPlugins(home)) {
     const declared = plugin.manifest.skills
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'skills']
-    candidates.push(...dirs.map((dir) => path.resolve(plugin.root, String(dir))))
+    candidates.push(...dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined))
   }
   // Claude loads skills from every .claude/skills between cwd and the repository
   // root; the list goes nearest-first so findClaudeSkill's first match is the

package/extensions/status-line.ts

@@ -457,14 +457,20 @@ export default function statusLine(pi: ExtensionAPI) {
     // Claude's disableAllHooks also turns off the custom statusLine command; the
     // built-in segment still renders as the fallback.
     config = readDisableAllHooks(files) ? undefined : readStatusLineConfig(files)
-    if (config?.refreshInterval) {
-      refreshTimer = setInterval(() => scheduleRefresh(), config.refreshInterval * 1000)
+    // Re-armed rather than armed once: a refreshInterval added or changed mid-session
+    // had no effect until the next session, though Claude applies a settings change as
+    // soon as the file is saved.
+    const armRefresh = (): void => {
+      clearInterval(refreshTimer)
+      refreshTimer = config?.refreshInterval ? setInterval(() => scheduleRefresh(), config.refreshInterval * 1000) : undefined
     }
+    armRefresh()
     // Claude re-runs the script when the statusLine settings change mid-session; a
     // command change re-resolves and re-runs.
     disposeSettingsWatch()
     disposeSettingsWatch = watchSettingsFiles(files, () => {
       config = readDisableAllHooks(files) ? undefined : readStatusLineConfig(files)
+      armRefresh()
       scheduleRefresh()
     })
     show(ctx, segmentText(ctx, ctx.ui.theme.fg('dim', '○')))

package/extensions/subagent/agents.ts

@@ -12,7 +12,7 @@ import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
-import { installedPlugins } from '../internal/plugins.js'
+import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
 
 /**
@@ -353,7 +353,10 @@ function pluginAgentDirs(home: string): Array<{ dir: string; pluginName: string
   return installedPlugins(home).flatMap((plugin) => {
     const declared = plugin.manifest.agents
     const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'agents']
-    return dirs.map((dir) => ({ dir: path.resolve(plugin.root, String(dir)), pluginName: plugin.name }))
+    return dirs
+      .map((dir) => pluginComponentPath(plugin, String(dir)))
+      .filter((dir): dir is string => dir !== undefined)
+      .map((dir) => ({ dir, pluginName: plugin.name }))
   })
 }
 

package/extensions/subagent/background.ts

@@ -177,6 +177,13 @@ export function backgroundStatusText(): string {
   return formatStatus(runs.values())
 }
 
+/** Every run this process knows about, live and finished. The registry is module state
+ * that outlives a session switch; a per-session list is not, because pi re-invokes each
+ * extension factory per session. */
+export function allBackgroundRuns(): BackgroundRun[] {
+  return [...runs.values()]
+}
+
 /** A finished run, so a caller can continue its session with a follow-up task. */
 export function backgroundRun(id: string): BackgroundRun | undefined {
   return runs.get(id)
@@ -200,7 +207,10 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   const rebuilt = withRebuiltPrompt(run.spawn)
   run.spawn = { ...run.spawn, args: rebuilt.args }
   if (rebuilt.dir) run.rebuiltPromptDir = rebuilt.dir
-  const args = rebuilt.args.map((arg) => (arg.startsWith('Task: ') ? `Task: ${task}` : arg))
+  // The task prompt is always the final argument: both spawn paths push it last and the
+  // invocation helper only prepends. Matching a 'Task: ' prefix missed it whenever
+  // SubagentStart hooks placed their context ahead of it, so the resume re-ran the old task.
+  const args = rebuilt.args.map((arg, index) => (index === rebuilt.args.length - 1 ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
   run.output = undefined
@@ -279,7 +289,9 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   run.live = true
   const killGroup = (signal: NodeJS.Signals): void => {
     try {
-      process.kill(-proc.pid!, signal)
+      // A child that never spawned has no pid and no group; the direct kill is all there is.
+      if (proc.pid) process.kill(-proc.pid, signal)
+      else proc.kill(signal)
     } catch {
       try {
         proc.kill(signal)

package/extensions/subagent/index.ts

@@ -34,7 +34,7 @@ import { runSubagentStartHooks } from '../internal/subagent-hooks.js'
 import { autoMemoryEnabled, capIndexForPrompt, INDEX_MAX_BYTES, INDEX_MAX_LINES, memorySettingsFiles, readMemorySettings } from '../memory.js'
 import { skillDirs } from '../skills.js'
 import { type AgentConfig, type AgentMemoryScope, type AgentScope, type AgentSource, discoverAgents, expandMcpToolPatterns, resolveModelAlias, withPreloadedSkills } from './agents.js'
-import { activeBackgroundRuns, type BackgroundRun, backgroundRun, backgroundStatusText, cancelAllBackgroundRuns, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
+import { activeBackgroundRuns, allBackgroundRuns, type BackgroundRun, backgroundRun, backgroundStatusText, cancelAllBackgroundRuns, cancelBackgroundRun, MAX_BACKGROUND_RUNS, resumeBackgroundRun, startBackgroundRun } from './background.js'
 import { type DisplayItem, formatToolCall, formatUsageStats, getDisplayItems, getFinalOutput } from './render.js'
 import { type AgentWorktree, cleanupAgentWorktree, createAgentWorktree } from './worktree.js'
 
@@ -388,14 +388,19 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         resolve(code ?? 0)
       })
 
-      proc.on('error', () => {
+      proc.on('error', (error: Error) => {
         cleanup()
+        // A child that never started leaves no stdout and no stderr, so this message is the
+        // only diagnostic; without it the failure reads as "(no output)".
+        if (!currentResult.stderr) currentResult.stderr = error.message
         resolve(1)
       })
 
       const killGroup = (sig: NodeJS.Signals): void => {
         try {
-          process.kill(-proc.pid!, sig)
+          // A child that never spawned has no pid and no group; the direct kill is all there is.
+          if (proc.pid) process.kill(-proc.pid, sig)
+          else proc.kill(sig)
         } catch {
           try {
             proc.kill(sig)
@@ -564,7 +569,7 @@ function runOutputTail(run: BackgroundRunView): string | undefined {
 /** The /tasks listing: one line per background run, plus the short output tail the
  * registry's own status lines omit. A pure formatter so it tests against a plain list. */
 export function tasksStatusText(runs: ReadonlyArray<BackgroundRunView>): string {
-  if (runs.length === 0) return 'No background subagent runs in this session.'
+  if (runs.length === 0) return 'No background subagent runs.'
   return runs
     .map((run) => {
       const plural = run.turns === 1 ? '' : 's'
@@ -856,7 +861,7 @@ interface BackgroundContext {
   projectApproved: boolean
 }
 
-async function runBackgroundMode(params: SubagentParamsStatic, context: BackgroundContext, onStarted?: (id: string) => void): Promise<ToolResult> {
+async function runBackgroundMode(params: SubagentParamsStatic, context: BackgroundContext): Promise<ToolResult> {
   const { agents, defaultCwd, pi, makeDetails, skillRoots, availableModels, projectApproved } = context
   const task = params.task
   const agentName = params.agent
@@ -953,7 +958,6 @@ async function runBackgroundMode(params: SubagentParamsStatic, context: Backgrou
     removeTmpPrompt(tmpPrompt)
     return backgroundCapResult(makeDetails)
   }
-  onStarted?.(id)
   pi.events.emit(SUBAGENT_CHANNEL, { phase: 'start', agentType: agent.name, agentId: id })
   return {
     content: [{ type: 'text', text: `Started background run ${id} (${agent.name}). A notification will arrive on completion; check progress with {status: true}.` }],
@@ -1435,21 +1439,6 @@ export default function subagentExtension(pi: ExtensionAPI) {
     if (isMcpToolAliases(data)) setKnownMcpAliases(data)
   })
 
-  // /tasks resolves these against the registry at print time. background.ts owns the
-  // run records but does not enumerate them, so the ids started here are remembered;
-  // a run the registry has since evicted simply drops out of the listing.
-  const startedBackgroundRuns = new Set<string>()
-
-  // The registry self-caps and evicts old runs, so an id kept here after its record is
-  // gone is dead weight. Drop those on every add, bounding the set to the registry's
-  // live capacity rather than letting it grow for the whole session.
-  const rememberBackgroundRun = (id: string): void => {
-    for (const known of startedBackgroundRuns) {
-      if (!backgroundRun(known)) startedBackgroundRuns.delete(known)
-    }
-    startedBackgroundRuns.add(id)
-  }
-
   const notifyBackgroundCompletion = (run: { id: string; agent: string; state: string; turns: number; output?: string; stderr?: string }): void => {
     // Runs through driveRun's guard, same as the background-mode callback above.
     // The stop event fires here too, so SubagentStop hooks see resumed runs end.
@@ -1463,6 +1452,10 @@ export default function subagentExtension(pi: ExtensionAPI) {
   // available model list are captured per session so a hook run lands in the right repo.
   let hookCwd = process.cwd()
   let hookModels: ReadonlyArray<{ id: string }> = []
+  // Captured per session like cwd: a named agent resolved for a fork skill or an agent
+  // hook must respect project trust the way the tool path does, or an unapproved repo's
+  // .claude/agents entry (which wins a name clash) would run on its own say-so.
+  let hookAgentScope: AgentScope = 'user'
 
   // Discovery walks the plugin cache, the builtin dir, and every agent dir, parsing
   // each file: dozens of fs ops per call. The roster injection below runs every turn
@@ -1474,6 +1467,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
   pi.on('session_start', async (_event, ctx) => {
     rosterCache = null
     hookCwd = ctx.cwd
+    hookAgentScope = isProjectApprovedSilently(ctx) ? 'both' : 'user'
     try {
       hookModels = ctx.modelRegistry?.getAvailable?.() ?? []
     } catch {
@@ -1485,7 +1479,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
       if (process.env.PI_CODE_SUBAGENT) throw new Error('agent hooks do not run inside a subagent')
       // A context: fork skill names its agent, or runs with the full toolset;
       // agent hooks keep the read-only hook shape.
-      const named = request.agent ? discoverAgents(hookCwd, 'both').agents.find((a) => a.name === request.agent) : undefined
+      const named = request.agent ? discoverAgents(hookCwd, hookAgentScope).agents.find((a) => a.name === request.agent) : undefined
       const agent = named ?? (request.fullTools ? forkAgent(request) : buildHookAgent(request))
       const result = await runSingleAgent({
         defaultCwd: hookCwd,
@@ -1578,7 +1572,6 @@ export default function subagentExtension(pi: ExtensionAPI) {
 
       if (params.resume) {
         const onResumed = (run: { id: string; agent: string }): void => {
-          rememberBackgroundRun(run.id)
           pi.events.emit(SUBAGENT_CHANNEL, { phase: 'start', agentType: run.agent, agentId: run.id })
         }
         return { content: [{ type: 'text', text: resumeResultText(params.resume, params.task, notifyBackgroundCompletion, onResumed) }], details: makeDetails('single')([]) }
@@ -1622,7 +1615,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
       // unavailable tier still falls back to the session model.
       const availableModels = ctx.modelRegistry?.getAvailable?.() ?? []
 
-      if (wantsBackground(params, agents)) return runBackgroundMode(params, { agents, defaultCwd: ctx.cwd, pi, makeDetails, skillRoots, availableModels, projectApproved }, (id) => rememberBackgroundRun(id))
+      if (wantsBackground(params, agents)) return runBackgroundMode(params, { agents, defaultCwd: ctx.cwd, pi, makeDetails, skillRoots, availableModels, projectApproved })
 
       const mode: ModeContext = {
         agents,
@@ -1679,8 +1672,7 @@ export default function subagentExtension(pi: ExtensionAPI) {
   pi.registerCommand('tasks', {
     description: 'Show background subagent runs',
     handler: async (_args, ctx) => {
-      const runs = [...startedBackgroundRuns].map((id) => backgroundRun(id)).filter((run): run is BackgroundRun => run !== undefined)
-      ctx.ui.notify(tasksStatusText(runs), 'info')
+      ctx.ui.notify(tasksStatusText(allBackgroundRuns()), 'info')
     },
   })
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.50",
+  "version": "1.0.52",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",