pi-code 1.0.6 → 1.0.7

package/extensions/git-checkpoint.ts

@@ -13,12 +13,15 @@
  * the checkpoint (files created after the checkpoint are left in place).
  */
 
+import { createHash } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from '@earendil-works/pi-coding-agent'
 
 const CUSTOM_TYPE = 'git-checkpoint'
+/** Sidecar inside the bare shadow repo recording the work tree it snapshots. */
+const WORK_TREE_FILE = 'pi-work-tree'
 const PROMPT_SNIPPET_LENGTH = 60
 const RESTORE_MODES = ['Code and conversation', 'Conversation only', 'Code only']
 
@@ -72,6 +75,31 @@ export function sessionSlug(sessionFile: string | undefined): string {
   return path.basename(sessionFile).replace(/[^\w.-]+/g, '_')
 }
 
+/** A stable per-directory key, so a session resumed elsewhere gets its own shadow. */
+function cwdSlug(cwd: string): string {
+  const resolved = path.resolve(cwd)
+  const hash = createHash('sha256').update(resolved).digest('hex').slice(0, 8)
+  return `${path.basename(resolved).replace(/[^\w.-]+/g, '_')}-${hash}`
+}
+
+/** The work tree a shadow repo was created against, or undefined for a repo that
+ * predates the sidecar or does not exist yet. */
+function recordedWorkTree(shadowDir: string): string | undefined {
+  try {
+    return fs.readFileSync(path.join(shadowDir, WORK_TREE_FILE), 'utf8').trim() || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function rememberWorkTree(shadowDir: string, cwd: string): void {
+  try {
+    fs.writeFileSync(path.join(shadowDir, WORK_TREE_FILE), `${cwd}\n`)
+  } catch {
+    // best effort: without the marker the next resume simply cannot detect a move
+  }
+}
+
 function extractText(content: unknown): string {
   if (typeof content === 'string') return content
   if (!Array.isArray(content)) return ''
@@ -134,6 +162,16 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     const sessionFile = (ctx.sessionManager as { getSessionFile?: () => string | undefined }).getSessionFile?.()
     const checkpointsRoot = path.join(os.homedir(), '.pi', 'agent', 'checkpoints')
     shadowDir = path.join(checkpointsRoot, sessionSlug(sessionFile))
+    // A resumed session can arrive from a different directory than the one the shadow
+    // snapshotted; restoring those commits here would silently overwrite unrelated
+    // same-named files. Key a fresh shadow to this directory instead of ever checking
+    // one tree out into another. Resuming back in the recorded directory takes the
+    // original shadow again, so its checkpoints stay restorable there.
+    const recorded = recordedWorkTree(shadowDir)
+    if (recorded && path.resolve(recorded) !== path.resolve(ctx.cwd)) {
+      shadowDir = path.join(checkpointsRoot, `${sessionSlug(sessionFile)}-${cwdSlug(ctx.cwd)}`)
+      ctx.ui.notify(`Checkpoints for this session were recorded in ${recorded}; starting fresh checkpoints for ${ctx.cwd} (earlier ones are not restorable here)`, 'warning')
+    }
     pruneCheckpointRepos(checkpointsRoot, CHECKPOINT_RETENTION_DAYS, shadowDir)
     const check = await pi.exec('git', ['--git-dir', shadowDir, 'rev-parse', '--git-dir'], { cwd: ctx.cwd })
     if (check.code !== 0) {
@@ -147,6 +185,8 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.email', 'checkpoint@pi-code'], { cwd: ctx.cwd })
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.name', 'pi-code-checkpoint'], { cwd: ctx.cwd })
     }
+    // Written on every start, so repos that predate the sidecar pick it up too.
+    rememberWorkTree(shadowDir, ctx.cwd)
   }
 
   /** `checkout -f <ref> -- .` errors when the ref's tree holds no files, so an empty

package/extensions/hooks.ts

@@ -156,6 +156,42 @@ export function readDisableAllHooks(files: string[], managed: Record<string, unk
   return false
 }
 
+/** Claude's `allowedHttpHookUrls` setting: URL patterns http hooks may target, with
+ * `*` as a wildcard. Per Claude's documentation: undefined (no source sets the key)
+ * means no restrictions, an empty array blocks every http hook, and arrays merge
+ * across settings sources. Merging is a union of managed settings plus every file in
+ * the chain; the chain already gates project files on trust (see hookFiles), and a
+ * trusted project can run arbitrary shell hooks anyway, so letting it extend the
+ * allowlist is no escalation. */
+export function readAllowedHttpHookUrls(files: string[], managed: Record<string, unknown> = readManagedSettings()): string[] | undefined {
+  let found: string[] | undefined
+  const collect = (value: unknown): void => {
+    if (!Array.isArray(value)) return
+    found = [...(found ?? []), ...value.filter((entry): entry is string => typeof entry === 'string')]
+  }
+  collect(managed.allowedHttpHookUrls)
+  for (const file of files) {
+    try {
+      const parsed: unknown = JSON.parse(fs.readFileSync(file, 'utf-8'))
+      if (isRecord(parsed)) collect(parsed.allowedHttpHookUrls)
+    } catch {
+      // missing or invalid file: skip
+    }
+  }
+  return found
+}
+
+/** Whether an http hook may target `url`. `*` in an allowlist entry matches any run
+ * of characters; everything else is literal and the whole URL must match. An
+ * undefined allowlist means the setting is absent, so there are no restrictions. */
+export function httpUrlAllowed(url: string, allowlist: string[] | undefined): boolean {
+  if (allowlist === undefined) return true
+  return allowlist.some((pattern) => {
+    const literal = pattern.split('*').map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`))
+    return new RegExp(`^${literal.join('.*')}$`).test(url)
+  })
+}
+
 export function loadHooks(files: string[], sources?: Map<HookMatcher, string>): HooksConfig {
   const config: HooksConfig = {}
   for (const file of files) {
@@ -459,12 +495,15 @@ function interpolateHeaders(headers: Record<string, string> | undefined, allowed
  * with a valid JSON body renders a decision, read exactly like command stdout.
  * Everything else, including non-2xx statuses, connection failures and timeouts,
  * is a non-blocking error by contract, so none of these outcomes ever reports
- * `timedOut`, which PreToolUse fails closed on. The user wrote the URL into their
- * own settings, so it carries the same trust as a command hook's shell string and
- * gets no SSRF screening.
+ * `timedOut`, which PreToolUse fails closed on. Claude's `allowedHttpHookUrls`
+ * allowlist gates the fetch itself: a URL matching no entry is never contacted,
+ * so a settings file cannot point a hook at an arbitrary endpoint and exfiltrate
+ * the payload; when the setting is absent there are no restrictions, as Claude
+ * documents. A blocked hook renders no decision, like every other http failure.
  */
-export async function runHttpHook(hook: { type?: string; command: string; url?: string; headers?: Record<string, string>; allowedEnvVars?: string[] }, payload: unknown, timeoutMs: number): Promise<HookRunResult> {
+export async function runHttpHook(hook: { type?: string; command: string; url?: string; headers?: Record<string, string>; allowedEnvVars?: string[] }, payload: unknown, timeoutMs: number, allowedUrls?: string[]): Promise<HookRunResult> {
   const url = hook.url ?? hook.command
+  if (!httpUrlAllowed(url, allowedUrls)) return { code: 1, stdout: '', stderr: `${url} does not match allowedHttpHookUrls; the hook was not called`, timedOut: false }
   try {
     const response = await fetch(url, {
       method: 'POST',
@@ -615,8 +654,9 @@ function replaceRecord(target: Record<string, unknown>, next: Record<string, unk
   Object.assign(target, next)
 }
 
-/** Claude surfaces a hook error notice and the action proceeds; silence would read a
- * guard that never ran as a clean allow. */
+/** Claude surfaces a hook error notice; on ungated events the action proceeds, while
+ * PreToolUse and UserPromptSubmit additionally fail closed on the same results (see
+ * their spawnFailed checks). Silence would hide that a guard never ran. */
 function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[], notify?: SystemMessageSink): void {
   if (!notify) return
   for (const [i, result] of results.entries()) {
@@ -648,6 +688,10 @@ export async function runPreToolUse(config: HooksConfig, toolName: string, toolI
     // A killed hook never reached its verdict, and SIGKILL leaves a null exit code that
     // would otherwise read as a clean allow. Fail closed instead.
     if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}` }
+    // A hook that never spawned (EMFILE, missing /bin/sh) reached no verdict either;
+    // its code 0 must fail closed like a timeout, not read as an allow exactly when
+    // the machine is degraded.
+    if (result.spawnFailed) return { block: true, reason: `Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}` }
   }
   if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   // A hard deny wins over an ask, matching Claude's deny > ask > allow precedence:
@@ -698,6 +742,8 @@ export async function runUserPromptSubmit(config: HooksConfig, prompt: string, r
   surfaceHookFailures(commands, results, onSystemMessage)
   for (const [i, result] of results.entries()) {
     if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}`, context: '' }
+    // No verdict was delivered, so fail closed like a timeout (see runPreToolUse).
+    if (result.spawnFailed) return { block: true, reason: `Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}`, context: '' }
   }
   if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   const contexts: string[] = []
@@ -742,6 +788,8 @@ function postToolFeedback(result: HookRunResult, eventName: string, isError: boo
 export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
   let projectDir = ''
+  /** Claude's allowedHttpHookUrls allowlist, resolved from the settings chain. */
+  let allowedHttpHookUrls: string[] | undefined
   let pendingSessionContext: string[] = []
   let stopHookActive = false
   let sessionCtx: ExtensionContext | undefined
@@ -763,7 +811,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     (ctx: ExtensionContext, extra?: Record<string, unknown>): HookRunner =>
     (hook, payload, ms) => {
       const merged = { ...commonPayload(ctx), ...extra, ...(payload as Record<string, unknown>) }
-      if (hook.type === 'http') return runHttpHook(hook, merged, ms)
+      if (hook.type === 'http') return runHttpHook(hook, merged, ms, allowedHttpHookUrls)
       if (hook.type === 'prompt') return runPromptHook(hook, merged, ctx.model, ms)
       if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
       if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
@@ -814,8 +862,14 @@ export default function hooksExtension(pi: ExtensionAPI) {
     const ctx = sessionCtx
     const eventName = data.phase === 'start' ? 'SubagentStart' : 'SubagentStop'
     const payload = { hook_event_name: eventName, agent_type: data.agentType, agent_id: data.agentId }
-    const results = await runNotifyHooks(matchingCommands(config[eventName], data.agentType), payload, boundRunner(ctx))
-    surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
+    try {
+      const results = await runNotifyHooks(matchingCommands(config[eventName], data.agentType), payload, boundRunner(ctx))
+      surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
+    } catch {
+      // The bus outlives the session: an event landing between /new disposing this
+      // ctx and the next session_start hits disposed getters, and nothing awaits a
+      // bus listener, so a throw here would escape as an unhandled rejection.
+    }
   })
 
   pi.on('session_start', async (event, ctx) => {
@@ -827,6 +881,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     projectDir = repoRoot(ctx.cwd) ?? ctx.cwd
     const files = hookFiles(ctx.cwd, os.homedir(), trusted)
     hookSources.clear()
+    allowedHttpHookUrls = readAllowedHttpHookUrls(files)
     // The disableAllHooks escape hatch, checked before any config loads: with no
     // config resolved, no event, plugin hooks included, can fire a hook.
     hooksDisabled = readDisableAllHooks(files)

package/extensions/internal/mcp-oauth.ts

@@ -49,6 +49,11 @@ export class FileOAuthProvider implements OAuthClientProvider {
   private readonly data: StoredAuth
   private port = 0
   private readonly onRedirect: (authorizationUrl: URL) => void
+  // A fresh random CSRF token per login attempt. The SDK puts it in the authorization
+  // URL's `state` param, the server echoes it back on the redirect, and waitForAuthCode
+  // rejects any callback that does not carry it, so another local process or an open web
+  // page cannot inject an authorization code into this login (RFC 8252 8.9).
+  private readonly loginState = crypto.randomBytes(16).toString('hex')
 
   constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void) {
     this.storePath = storeFileFor(serverName)
@@ -117,6 +122,12 @@ export class FileOAuthProvider implements OAuthClientProvider {
     return this.data.tokens !== undefined
   }
 
+  /** The CSRF token the SDK adds to the authorization URL as `state`; waitForAuthCode
+   * verifies the redirect echoes exactly this value. */
+  state(): string {
+    return this.loginState
+  }
+
   redirectToAuthorization(authorizationUrl: URL): void {
     this.onRedirect(authorizationUrl)
   }
@@ -147,11 +158,30 @@ export async function startCallbackServer(preferredPort?: number): Promise<{ ser
   return { server, port: (server.address() as { port: number }).port }
 }
 
-export function waitForAuthCode(server: http.Server, timeoutMs: number): Promise<string> {
+export function waitForAuthCode(server: http.Server, timeoutMs: number, expectedState?: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(`authorization timed out after ${timeoutMs}ms`)), timeoutMs)
+    // Do not let the pending timer keep the process alive on its own: if the login is
+    // abandoned or resolved out of band, the event loop can still drain.
+    timer.unref?.()
     server.on('request', (request, response) => {
       const url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      // Only the redirect path settles the login. A stray request (a favicon fetch, a
+      // local port scan, or a forged redirect from another process or an open web page)
+      // is answered but ignored, so it can neither inject a code nor abort the login by
+      // rejecting the promise (a repeatable DoS on a stable, guessable loopback port).
+      if (url.pathname !== '/callback') {
+        response.writeHead(404, { 'content-type': 'text/plain' })
+        response.end('not found')
+        return
+      }
+      // The CSRF check: a callback that does not echo this login's state is rejected
+      // without settling, so an attacker who cannot read the state cannot complete it.
+      if (expectedState !== undefined && url.searchParams.get('state') !== expectedState) {
+        response.writeHead(400, { 'content-type': 'text/plain' })
+        response.end('state mismatch')
+        return
+      }
       const code = url.searchParams.get('code')
       const error = url.searchParams.get('error')
       response.writeHead(200, { 'content-type': 'text/html' })

package/extensions/internal/path-rules.ts

@@ -21,8 +21,66 @@ export interface PathAnchors {
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
-/** One gitignore-style pattern as an anchored regular expression source. */
-export function globToRegExpSource(pattern: string): string {
+/** Cap on brace-expanded alternatives per pattern, mirroring Claude's ~1000
+ * budget; an over-budget pattern is used unexpanded. */
+const BRACE_EXPANSION_LIMIT = 1000
+
+interface BraceGroup {
+  start: number
+  end: number
+  options: string[]
+}
+
+/** The `{...}` group opening at `open`, or null when it is unmatched or carries no
+ * top-level comma (literal braces). Options are split on commas at the group's own
+ * depth so a nested group stays inside one option. */
+function parseBraceGroup(pattern: string, open: number): BraceGroup | null {
+  let depth = 1
+  let optionStart = open + 1
+  const options: string[] = []
+  for (let i = open + 1; i < pattern.length; i += 1) {
+    const ch = pattern[i]
+    if (ch === '{') depth += 1
+    else if (ch === ',' && depth === 1) {
+      options.push(pattern.slice(optionStart, i))
+      optionStart = i + 1
+    } else if (ch === '}' && --depth === 0) {
+      if (options.length === 0) return null // no top-level comma: literal braces
+      options.push(pattern.slice(optionStart, i))
+      return { start: open, end: i, options }
+    }
+  }
+  return null
+}
+
+/** The first expandable `{...}` group. A comma-less or unmatched `{` is skipped as
+ * literal, so the scan can still find an expandable group nested inside it. */
+function findBraceGroup(pattern: string): BraceGroup | null {
+  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+    const group = parseBraceGroup(pattern, open)
+    if (group) return group
+  }
+  return null
+}
+
+/** Bash-style brace expansion of one pattern into its alternatives: each group
+ * multiplies out (Cartesian across groups, nested groups recurse). Returns null
+ * when the expansion would exceed the budget. */
+function expandBraces(pattern: string): string[] | null {
+  const group = findBraceGroup(pattern)
+  if (group === null) return [pattern]
+  const expanded: string[] = []
+  for (const option of group.options) {
+    const branch = expandBraces(pattern.slice(0, group.start) + option + pattern.slice(group.end + 1))
+    if (branch === null) return null
+    expanded.push(...branch)
+    if (expanded.length > BRACE_EXPANSION_LIMIT) return null
+  }
+  return expanded
+}
+
+/** One glob pattern, braces already expanded, as a regular expression source. */
+function translateGlob(pattern: string): string {
   let out = ''
   let i = 0
   while (i < pattern.length) {
@@ -54,6 +112,15 @@ export function globToRegExpSource(pattern: string): string {
   return out
 }
 
+/** One gitignore-style pattern as an anchored regular expression source. Brace
+ * groups (`{ts,tsx}`, nested, Cartesian across groups) expand into ORed
+ * alternatives; an over-budget expansion falls back to the literal pattern. */
+export function globToRegExpSource(pattern: string): string {
+  const alternatives = expandBraces(pattern) ?? [pattern]
+  if (alternatives.length === 1) return translateGlob(alternatives[0])
+  return `(?:${alternatives.map(translateGlob).join('|')})`
+}
+
 /** A rule resolved to an absolute glob per its anchor form. */
 function resolveRule(rule: string, anchors: PathAnchors): string {
   if (rule.startsWith('//')) return rule.slice(1)

package/extensions/mcp.ts

@@ -11,8 +11,10 @@
  * per-project `projects[cwd].mcpServers` local scope, and ~/.pi/agent/mcp.json) is the
  * user's own and loads on the first session. Project config (.mcp.json, .pi/mcp.json)
  * can run arbitrary commands on connect, so it loads only once the project is approved
- * (see project-approval). The two scopes are loaded separately, not merged; user config
- * connects first, so a project server cannot take the name of a user server that connected.
+ * (see project-approval). The two scopes are loaded separately, not merged. Claude's
+ * precedence is project over user for a duplicate name, so a project server the user has
+ * consented to (or an approved project's) wins; a merely-present untrusted project entry
+ * cannot shadow a user server, and a gated project server does not preempt it.
  * Values support ${VAR} / ${VAR:-default} interpolation, connect and per-call timeouts
  * honor MCP_TIMEOUT / MCP_TOOL_TIMEOUT, and a stdio server receives only the SDK's default
  * environment plus its own `env` block, not the whole process environment.
@@ -108,11 +110,18 @@ export type ServerConfig = StdioServerConfig | HttpServerConfig
 
 /** Claude's .mcp.json expansion: ${VAR}, and ${VAR:-default}. The syntax borrows
  * shell's `:-`, which substitutes when the variable is unset OR empty. */
-export function interpolateEnv(value: string, env: NodeJS.ProcessEnv = process.env): string {
-  return value.replace(/\$\{(\w+)(:-([^}]*))?\}/g, (_, name, hasDefault, fallback) => {
+export function interpolateEnv(value: string, env: NodeJS.ProcessEnv = process.env, onMissing?: (name: string) => void): string {
+  return value.replace(/\$\{(\w+)(:-([^}]*))?\}/g, (fullMatch, name, hasDefault, fallback) => {
     const current = env[name]
     if (hasDefault !== undefined) return current || fallback
-    return current ?? ''
+    if (current === undefined) {
+      // A referenced variable with no value and no default: keep the literal ${VAR} and
+      // report it, matching Claude, rather than silently substituting an empty string that
+      // turns `Bearer ${TOKEN}` into a confusing `Bearer ` and a mystery 401.
+      onMissing?.(name)
+      return fullMatch
+    }
+    return current
   })
 }
 
@@ -387,11 +396,40 @@ export function promptMessageContent(messages: ReadonlyArray<{ content: unknown
   return mapContent(messages.map((message) => message.content as McpContentBlock)).filter((block) => block.type !== 'text' || block.text.trim() !== '')
 }
 
+/** Merge the `properties` (and, for allOf, the `required`) of a root-level combinator's
+ * branches into one flat object schema. Without this a tool whose input schema is a bare
+ * anyOf/oneOf/allOf (no top-level `type`) would present no properties at all, so the model
+ * would be forced to call it with no arguments. */
+function mergeCombinatorBranches(branches: unknown[]): { properties: Record<string, unknown>; required: string[] } {
+  const properties: Record<string, unknown> = {}
+  const required = new Set<string>()
+  for (const branch of branches) {
+    if (!branch || typeof branch !== 'object') continue
+    const b = branch as Record<string, unknown>
+    if (b.properties && typeof b.properties === 'object') Object.assign(properties, b.properties as Record<string, unknown>)
+    if (Array.isArray(b.required)) for (const name of b.required) if (typeof name === 'string') required.add(name)
+  }
+  return { properties, required: [...required] }
+}
+
 export function normalizeSchema(schema: unknown): object {
   const base = (schema as Record<string, unknown>) ?? {}
   const { $schema: _dropSchema, additionalProperties: _dropAdditional, ...rest } = base
-  if (!rest.type) return { type: 'object', properties: {} }
-  return rest
+  if (rest.type) return rest
+  // A root-level combinator carries the real parameters in its branches; flatten them
+  // into one object schema rather than emptying it. allOf means every branch applies, so
+  // its required union is kept; anyOf/oneOf branches are alternatives, so required is left
+  // open (the server still enforces its own).
+  const allOf = Array.isArray(rest.allOf) ? rest.allOf : undefined
+  let branches = allOf
+  if (!branches && Array.isArray(rest.anyOf)) branches = rest.anyOf
+  if (!branches && Array.isArray(rest.oneOf)) branches = rest.oneOf
+  if (!branches) return { type: 'object', properties: {} }
+  const { properties, required } = mergeCombinatorBranches(branches)
+  const merged: Record<string, unknown> = { type: 'object', properties }
+  if (typeof rest.description === 'string') merged.description = rest.description
+  if (allOf && required.length > 0) merged.required = required
+  return merged
 }
 
 interface McpContentBlock {
@@ -494,23 +532,32 @@ async function withTimeout<T>(promise: Promise<T>, ms: number, label: string): P
 
 async function connect(name: string, config: ServerConfig, authUi?: AuthUi): Promise<Client> {
   const client = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
+  // Names referenced by ${VAR} with no value and no default, gathered across this
+  // server's interpolated fields so the connect can warn once rather than fail with a
+  // mystery 401 or a command that lost an argument.
+  const missing = new Set<string>()
+  const fill = (value: string): string => interpolateEnv(value, process.env, (varName) => missing.add(varName))
+  const warnMissing = (): void => {
+    if (missing.size > 0) console.warn(`pi-code-mcp: server ${name} references undefined variable(s) ${[...missing].join(', ')}; leaving them unexpanded`)
+  }
   if (isStdio(config)) {
     // Start from the SDK's allowlist (PATH, HOME, SHELL, ...) rather than the whole
     // process env: a server should not receive ANTHROPIC_API_KEY or GITHUB_TOKEN just
     // for being launched. A server that needs a variable names it in its own env block.
     const env: Record<string, string> = { ...getDefaultEnvironment() }
-    for (const [key, value] of Object.entries(config.env ?? {})) env[key] = interpolateEnv(value)
+    for (const [key, value] of Object.entries(config.env ?? {})) env[key] = fill(value)
     const transport = new StdioClientTransport({
-      command: interpolateEnv(config.command),
-      args: (config.args ?? []).map((arg) => interpolateEnv(arg)),
+      command: fill(config.command),
+      args: (config.args ?? []).map((arg) => fill(arg)),
       env,
       cwd: expandCwd(config.cwd),
       stderr: 'ignore',
     })
+    warnMissing()
     await connectWithTimeout(client, transport, `connect ${name}`)
     return client
   }
-  const url = new URL(interpolateEnv(config.url))
+  const url = new URL(fill(config.url))
   if (config.type === 'ws' || config.type === 'websocket') {
     // The SDK's WebSocket transport takes only a url: it carries no headers, bearer
     // token, or headersHelper output. Warn rather than silently dropping configured
@@ -520,16 +567,18 @@ async function connect(name: string, config: ServerConfig, authUi?: AuthUi): Pro
       console.warn(`pi-code-mcp: server ${name} is a WebSocket server; the SDK ws transport is url-only, so its headers/bearerToken/headersHelper are ignored`)
     }
     const transport = new WebSocketClientTransport(url)
+    warnMissing()
     await connectWithTimeout(client, transport, `connect ${name} (ws)`)
     return client
   }
   const headers: Record<string, string> = {}
-  for (const [key, value] of Object.entries(config.headers ?? {})) headers[key] = interpolateEnv(value)
+  for (const [key, value] of Object.entries(config.headers ?? {})) headers[key] = fill(value)
   const token = resolveBearerToken(config)
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
   // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(interpolateEnv(config.headersHelper)))
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper)))
+  warnMissing()
   const sseTransport = (authProvider?: OAuthClientProvider) => new SSEClientTransport(url, { requestInit: { headers }, authProvider }) // NOSONAR: explicitly declared or deliberate legacy transport
   if (config.type === 'sse') {
     return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, token, authUi)
@@ -645,7 +694,9 @@ async function runInteractiveOAuth(name: string, config: { url: string }, makeTr
   provider.bindRedirectPort(port)
   try {
     const transport = makeTransport(provider)
-    const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS)
+    // Verify the redirect echoes this login's state, so a stray or forged callback to the
+    // loopback port cannot inject a code or abort the login (see waitForAuthCode).
+    const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS, provider.state())
     pendingCode.catch(() => {}) // consumed below; an abandoned login must not surface as unhandled
     const client = newClient()
     try {
@@ -790,7 +841,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   const aliases: McpToolAlias[] = []
 
   /** Register every not-yet-registered tool of a server; returns how many were added. */
-  function registerTools(name: string, config: ServerConfig, client: Client, tools: McpToolInfo[]): number {
+  function registerTools(name: string, config: ServerConfig, tools: McpToolInfo[]): number {
     let count = 0
     for (const tool of tools) {
       const toolName = formatToolName(name, tool.name)
@@ -809,12 +860,18 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         description: tool.description ?? `MCP tool ${tool.name} from ${name}`,
         parameters: Type.Unsafe(normalizeSchema(tool.inputSchema)),
         async execute(_id, params) {
+          // Resolve the live client by name at call time rather than capturing the one
+          // present at registration: pi has no tool unregister, so after a server drops
+          // and a later session_start reconnects it, registerTools skips re-registration
+          // and this closure would otherwise keep calling the old, closed client.
+          const current = clients.get(name)
+          if (!current) throw new Error(`MCP server "${name}" is not connected`)
           // Pass the timeout to the SDK too: its own default request timeout is 60s and
           // would otherwise reject first, so the outer race at CALL_TIMEOUT_MS was dead.
           // Claude's per-server timeout wins over MCP_TOOL_TIMEOUT, with a 1s floor.
           const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
           const budget = declared ?? callTimeoutMs()
-          const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
+          const result = await withTimeout(current.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
           const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
           const details: { error?: string } = {}
           if (result.isError) {
@@ -839,7 +896,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * no command unregister, so, like tools, a withdrawn prompt keeps its registration
    * and surfaces the server's own error when invoked; an edit to a prompt's declared
    * arguments only lands on new names, since an existing command keeps its binding. */
-  function registerPrompts(name: string, client: Client, prompts: McpPromptInfo[]): void {
+  function registerPrompts(name: string, prompts: McpPromptInfo[]): void {
     for (const prompt of prompts) {
       const commandName = formatPromptCommandName(name, prompt.name)
       const owner = registeredPrompts.get(commandName)
@@ -855,11 +912,19 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         description: hint ? `${base} ${hint}` : base,
         handler: async (args, ctx) => {
           try {
+            // Resolve the live client at call time, not the one captured at registration:
+            // pi has no command unregister, so after a reconnect this closure must not keep
+            // calling the old, closed client (see registerTools for the same reason).
+            const current = clients.get(name)
+            if (!current) {
+              ctx.ui.notify(`${commandName}: MCP server "${name}" is not connected`, 'error')
+              return
+            }
             const promptArgs = mapPromptArguments(prompt.arguments, args)
             const params: { name: string; arguments?: Record<string, string> } = { name: prompt.name }
             if (Object.keys(promptArgs).length > 0) params.arguments = promptArgs
             const budget = callTimeoutMs()
-            const result = await withTimeout(client.getPrompt(params, { timeout: budget }), budget, commandName)
+            const result = await withTimeout(current.getPrompt(params, { timeout: budget }), budget, commandName)
             // The prompt drives a turn exactly the way a custom slash command does
             // (see commands.ts), carrying its image blocks through. A prompt that
             // yields no content is reported rather than sent as an empty turn.
@@ -882,7 +947,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function connectPrompts(name: string, client: Client): Promise<void> {
     if (!client.getServerCapabilities()?.prompts) return
     try {
-      registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+      registerPrompts(name, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
     } catch (error) {
       console.warn(`pi-code-mcp: prompt listing failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
     }
@@ -894,7 +959,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     try {
       client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
         try {
-          registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+          registerPrompts(name, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
         } catch (error) {
           console.warn(`pi-code-mcp: prompt refresh failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
         }
@@ -978,7 +1043,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
         try {
           const refreshed = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-          const added = registerTools(name, config, client, refreshed)
+          const added = registerTools(name, config, refreshed)
           if (added === 0) return
           const current = status.get(name)
           status.set(name, { state: current?.state ?? 'connected', tools: (current?.tools ?? 0) + added })
@@ -1014,7 +1079,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const client = await connect(name, config, authUi)
           clients.set(name, client)
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-          const count = registerTools(name, config, client, tools)
+          const count = registerTools(name, config, tools)
           subscribeToToolChanges(name, config, client)
           // Prompts and resources are additive surfaces: their failures warn (inside
           // connectPrompts) rather than flipping a tool-serving server to failed.
@@ -1075,7 +1140,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     const pluginServers = loadPluginServers(installedPlugins(os.homedir()))
     const { allowed, denied } = mcpAllowDeny()
     const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, allowed, denied)
-    const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name)))
+    // Claude's precedence is project over user for a duplicate name. A project .mcp.json
+    // server only outranks the user's own when it will actually connect (the user already
+    // consented to it, or an approved project's), so a merely-present untrusted project
+    // entry cannot shadow a trusted user server by reusing its name. A gated project
+    // server still awaiting the approval prompt does not preempt the user server: that is
+    // a deliberate narrowing of Claude's rule to keep the safe default.
+    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
+    const projectWinners = new Set(Object.keys(splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), projectPolicy).consented))
+    const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     if (Object.keys(userServers).length > 0) await connectServers(userServers, authUiFor(ctx))
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once
     // the project is trusted. Per-server settings refine that: disabled servers never

package/extensions/subagent/background.ts

@@ -26,6 +26,10 @@ export interface BackgroundRun {
   /** True until the child process actually closes: a cancelled child that ignores
    * SIGTERM is still alive and must keep holding its concurrency slot. */
   live?: boolean
+  /** Monotonic finish order, stamped when the run completes. Eviction drops the
+   * earliest-finished runs by this, not Map insertion (start) order: a long run
+   * started first but finished last must not vanish the instant it completes. */
+  finishedAt?: number
   /** pi session the child ran under, so a follow-up can continue its context. */
   sessionId: string
   /** How the child was spawned, so a follow-up can repeat it with a new task. */
@@ -63,8 +67,13 @@ export function activeBackgroundRuns(): number {
   return [...runs.values()].filter((run) => run.live || run.state === 'running').length
 }
 
+/** Stamps BackgroundRun.finishedAt; a counter rather than a clock so two runs
+ * completing in the same millisecond still evict in their true finish order. */
+let finishSequence = 0
+
 function evictFinishedRuns(): void {
   const finished = [...runs.values()].filter((run) => !run.live && run.state !== 'running')
+  finished.sort((a, b) => (a.finishedAt ?? 0) - (b.finishedAt ?? 0))
   for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) runs.delete(stale.id)
 }
 
@@ -160,6 +169,7 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   run.output = undefined
   run.exitCode = undefined
   run.stderr = undefined
+  run.finishedAt = undefined
   driveRun(run, { ...run.spawn, args }, onComplete)
   return 'resumed'
 }
@@ -256,6 +266,7 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   const complete = (): void => {
     if (completed) return
     completed = true
+    run.finishedAt = ++finishSequence
     evictFinishedRuns()
     // A run outlives the session that started it, and pi's loader wires assertActive()
     // into every runtime call, so notifying a disposed session throws. This fires from

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.6",
+  "version": "1.0.7",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",