pi-code 1.0.6 → 1.0.8

package/extensions/commands.ts

@@ -46,6 +46,7 @@ import { Type } from 'typebox'
 import { matchesBashRules } from './internal/bash-rules.js'
 import { type CommandExec, type DiscoveredCommand, discoverCommandFiles, expandDynamicContent, type ParsedCommand, parseCommandFile, resolvePowershellBinary, spanExec, substituteArgsDetailed, substituteVars } from './internal/command-file.js'
 import { readManagedSettings } from './internal/managed-settings.js'
+import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
 import { type InstalledPlugin, installedPlugins } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
@@ -315,12 +316,17 @@ export default function commandsExtension(pi: ExtensionAPI) {
     pendingBashRules = undefined
     pendingPathRules = undefined
     if (pendingModelRestore) {
-      void pi.setModel(pendingModelRestore as Parameters<typeof pi.setModel>[0])
+      const restore = pendingModelRestore as Parameters<typeof pi.setModel>[0]
       pendingModelRestore = undefined
+      // setModel can reject (e.g. auth resolution fails), and a floated rejection would
+      // escape as unhandled; surface it instead of leaving the session silently on the
+      // command's override model.
+      void pi.setModel(restore).catch(() => {})
+    }
+    if (pendingRestore) {
+      pi.setActiveTools(pendingRestore)
+      pendingRestore = undefined
     }
-    if (!pendingRestore) return
-    pi.setActiveTools(pendingRestore)
-    pendingRestore = undefined
   })
 
   // The active-tool set has no argument dimension, so a scoped grant hands the turn
@@ -416,6 +422,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // restored when that run ends. Restoring inline does not work: sendUserMessage is
     // fire-and-forget, so the restore would land before the agent ever read the tool
     // list, leaving the command running with everything enabled.
+    // A command invoked while the agent is streaming must not narrow the in-flight run's
+    // tools or switch its model (that would corrupt a run it does not own), and a bare
+    // sendUserMessage throws mid-stream and would be silently dropped. Queue it as a
+    // follow-up through pi's own queue, which is abort-aware and shown to the user; its
+    // frontmatter scoping is not applied in that case, since it cannot land on a run that
+    // has not started yet.
+    if (!ctx.isIdle()) {
+      pi.sendUserMessage(expanded, { deliverAs: 'followUp' })
+      return
+    }
     applyAllowedTools(parsed, vars)
     applyDisallowedTools(parsed)
     await applyModelOverride(parsed, varCtx)
@@ -500,7 +516,10 @@ export default function commandsExtension(pi: ExtensionAPI) {
         // the tool result is the channel, and frontmatter scoping stays user-path
         // territory (see the header).
         const expanded = await expandCommand(pi, current, args, execCtx, command.filePath, command.plugin, { allowShell: false })
-        return { content: [{ type: 'text' as const, text: `Contents of /${name} (expanded):\n\n${expanded}` }], details: {} }
+        // Cap the tool result: a command body can inline an arbitrarily large @file, and
+        // an uncapped tool result overflows the model's context (every other pi-code tool
+        // routes its output through capForContext). The user-invoked path stays uncapped.
+        return { content: [{ type: 'text' as const, text: capForContext(`Contents of /${name} (expanded):\n\n${expanded}`) }], details: {} }
       },
     })
   })

package/extensions/git-checkpoint.ts

@@ -13,12 +13,15 @@
  * the checkpoint (files created after the checkpoint are left in place).
  */
 
+import { createHash } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionCommandContext, ExtensionContext } from '@earendil-works/pi-coding-agent'
 
 const CUSTOM_TYPE = 'git-checkpoint'
+/** Sidecar inside the bare shadow repo recording the work tree it snapshots. */
+const WORK_TREE_FILE = 'pi-work-tree'
 const PROMPT_SNIPPET_LENGTH = 60
 const RESTORE_MODES = ['Code and conversation', 'Conversation only', 'Code only']
 
@@ -72,6 +75,31 @@ export function sessionSlug(sessionFile: string | undefined): string {
   return path.basename(sessionFile).replace(/[^\w.-]+/g, '_')
 }
 
+/** A stable per-directory key, so a session resumed elsewhere gets its own shadow. */
+function cwdSlug(cwd: string): string {
+  const resolved = path.resolve(cwd)
+  const hash = createHash('sha256').update(resolved).digest('hex').slice(0, 8)
+  return `${path.basename(resolved).replace(/[^\w.-]+/g, '_')}-${hash}`
+}
+
+/** The work tree a shadow repo was created against, or undefined for a repo that
+ * predates the sidecar or does not exist yet. */
+function recordedWorkTree(shadowDir: string): string | undefined {
+  try {
+    return fs.readFileSync(path.join(shadowDir, WORK_TREE_FILE), 'utf8').trim() || undefined
+  } catch {
+    return undefined
+  }
+}
+
+function rememberWorkTree(shadowDir: string, cwd: string): void {
+  try {
+    fs.writeFileSync(path.join(shadowDir, WORK_TREE_FILE), `${cwd}\n`)
+  } catch {
+    // best effort: without the marker the next resume simply cannot detect a move
+  }
+}
+
 function extractText(content: unknown): string {
   if (typeof content === 'string') return content
   if (!Array.isArray(content)) return ''
@@ -134,6 +162,16 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     const sessionFile = (ctx.sessionManager as { getSessionFile?: () => string | undefined }).getSessionFile?.()
     const checkpointsRoot = path.join(os.homedir(), '.pi', 'agent', 'checkpoints')
     shadowDir = path.join(checkpointsRoot, sessionSlug(sessionFile))
+    // A resumed session can arrive from a different directory than the one the shadow
+    // snapshotted; restoring those commits here would silently overwrite unrelated
+    // same-named files. Key a fresh shadow to this directory instead of ever checking
+    // one tree out into another. Resuming back in the recorded directory takes the
+    // original shadow again, so its checkpoints stay restorable there.
+    const recorded = recordedWorkTree(shadowDir)
+    if (recorded && path.resolve(recorded) !== path.resolve(ctx.cwd)) {
+      shadowDir = path.join(checkpointsRoot, `${sessionSlug(sessionFile)}-${cwdSlug(ctx.cwd)}`)
+      ctx.ui.notify(`Checkpoints for this session were recorded in ${recorded}; starting fresh checkpoints for ${ctx.cwd} (earlier ones are not restorable here)`, 'warning')
+    }
     pruneCheckpointRepos(checkpointsRoot, CHECKPOINT_RETENTION_DAYS, shadowDir)
     const check = await pi.exec('git', ['--git-dir', shadowDir, 'rev-parse', '--git-dir'], { cwd: ctx.cwd })
     if (check.code !== 0) {
@@ -147,6 +185,8 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.email', 'checkpoint@pi-code'], { cwd: ctx.cwd })
       await pi.exec('git', ['--git-dir', shadowDir, 'config', 'user.name', 'pi-code-checkpoint'], { cwd: ctx.cwd })
     }
+    // Written on every start, so repos that predate the sidecar pick it up too.
+    rememberWorkTree(shadowDir, ctx.cwd)
   }
 
   /** `checkout -f <ref> -- .` errors when the ref's tree holds no files, so an empty

package/extensions/hooks.ts

@@ -156,6 +156,42 @@ export function readDisableAllHooks(files: string[], managed: Record<string, unk
   return false
 }
 
+/** Claude's `allowedHttpHookUrls` setting: URL patterns http hooks may target, with
+ * `*` as a wildcard. Per Claude's documentation: undefined (no source sets the key)
+ * means no restrictions, an empty array blocks every http hook, and arrays merge
+ * across settings sources. Merging is a union of managed settings plus every file in
+ * the chain; the chain already gates project files on trust (see hookFiles), and a
+ * trusted project can run arbitrary shell hooks anyway, so letting it extend the
+ * allowlist is no escalation. */
+export function readAllowedHttpHookUrls(files: string[], managed: Record<string, unknown> = readManagedSettings()): string[] | undefined {
+  let found: string[] | undefined
+  const collect = (value: unknown): void => {
+    if (!Array.isArray(value)) return
+    found = [...(found ?? []), ...value.filter((entry): entry is string => typeof entry === 'string')]
+  }
+  collect(managed.allowedHttpHookUrls)
+  for (const file of files) {
+    try {
+      const parsed: unknown = JSON.parse(fs.readFileSync(file, 'utf-8'))
+      if (isRecord(parsed)) collect(parsed.allowedHttpHookUrls)
+    } catch {
+      // missing or invalid file: skip
+    }
+  }
+  return found
+}
+
+/** Whether an http hook may target `url`. `*` in an allowlist entry matches any run
+ * of characters; everything else is literal and the whole URL must match. An
+ * undefined allowlist means the setting is absent, so there are no restrictions. */
+export function httpUrlAllowed(url: string, allowlist: string[] | undefined): boolean {
+  if (allowlist === undefined) return true
+  return allowlist.some((pattern) => {
+    const literal = pattern.split('*').map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`))
+    return new RegExp(`^${literal.join('.*')}$`).test(url)
+  })
+}
+
 export function loadHooks(files: string[], sources?: Map<HookMatcher, string>): HooksConfig {
   const config: HooksConfig = {}
   for (const file of files) {
@@ -459,12 +495,15 @@ function interpolateHeaders(headers: Record<string, string> | undefined, allowed
  * with a valid JSON body renders a decision, read exactly like command stdout.
  * Everything else, including non-2xx statuses, connection failures and timeouts,
  * is a non-blocking error by contract, so none of these outcomes ever reports
- * `timedOut`, which PreToolUse fails closed on. The user wrote the URL into their
- * own settings, so it carries the same trust as a command hook's shell string and
- * gets no SSRF screening.
+ * `timedOut`, which PreToolUse fails closed on. Claude's `allowedHttpHookUrls`
+ * allowlist gates the fetch itself: a URL matching no entry is never contacted,
+ * so a settings file cannot point a hook at an arbitrary endpoint and exfiltrate
+ * the payload; when the setting is absent there are no restrictions, as Claude
+ * documents. A blocked hook renders no decision, like every other http failure.
  */
-export async function runHttpHook(hook: { type?: string; command: string; url?: string; headers?: Record<string, string>; allowedEnvVars?: string[] }, payload: unknown, timeoutMs: number): Promise<HookRunResult> {
+export async function runHttpHook(hook: { type?: string; command: string; url?: string; headers?: Record<string, string>; allowedEnvVars?: string[] }, payload: unknown, timeoutMs: number, allowedUrls?: string[]): Promise<HookRunResult> {
   const url = hook.url ?? hook.command
+  if (!httpUrlAllowed(url, allowedUrls)) return { code: 1, stdout: '', stderr: `${url} does not match allowedHttpHookUrls; the hook was not called`, timedOut: false }
   try {
     const response = await fetch(url, {
       method: 'POST',
@@ -526,7 +565,7 @@ export async function runPromptHook(hook: HookCommand, payload: unknown, model:
   const prompt = substituteArguments(hook.prompt, payload)
   const signal = AbortSignal.timeout(timeoutMs)
   try {
-    const answer = await completeText(model, prompt, { system: PROMPT_HOOK_SYSTEM, maxTokens: 512, signal })
+    const { text: answer } = await completeText(model, prompt, { system: PROMPT_HOOK_SYSTEM, maxTokens: 512, signal })
     return { code: 0, stdout: answer, stderr: '', timedOut: false }
   } catch (error) {
     return abortAwareFailure(signal, error)
@@ -615,8 +654,9 @@ function replaceRecord(target: Record<string, unknown>, next: Record<string, unk
   Object.assign(target, next)
 }
 
-/** Claude surfaces a hook error notice and the action proceeds; silence would read a
- * guard that never ran as a clean allow. */
+/** Claude surfaces a hook error notice; on ungated events the action proceeds, while
+ * PreToolUse and UserPromptSubmit additionally fail closed on the same results (see
+ * their spawnFailed checks). Silence would hide that a guard never ran. */
 function surfaceHookFailures(commands: HookCommand[], results: HookRunResult[], notify?: SystemMessageSink): void {
   if (!notify) return
   for (const [i, result] of results.entries()) {
@@ -648,6 +688,10 @@ export async function runPreToolUse(config: HooksConfig, toolName: string, toolI
     // A killed hook never reached its verdict, and SIGKILL leaves a null exit code that
     // would otherwise read as a clean allow. Fail closed instead.
     if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}` }
+    // A hook that never spawned (EMFILE, missing /bin/sh) reached no verdict either;
+    // its code 0 must fail closed like a timeout, not read as an allow exactly when
+    // the machine is degraded.
+    if (result.spawnFailed) return { block: true, reason: `Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}` }
   }
   if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   // A hard deny wins over an ask, matching Claude's deny > ask > allow precedence:
@@ -698,6 +742,8 @@ export async function runUserPromptSubmit(config: HooksConfig, prompt: string, r
   surfaceHookFailures(commands, results, onSystemMessage)
   for (const [i, result] of results.entries()) {
     if (result.timedOut) return { block: true, reason: `Hook timed out after ${timeoutMs(commands[i])}ms: ${commands[i].command}`, context: '' }
+    // No verdict was delivered, so fail closed like a timeout (see runPreToolUse).
+    if (result.spawnFailed) return { block: true, reason: `Hook failed to run: ${commands[i].command}: ${result.stderr.trim() || 'unknown error'}`, context: '' }
   }
   if (onSystemMessage) surfaceSystemMessages(results, onSystemMessage)
   const contexts: string[] = []
@@ -742,6 +788,8 @@ function postToolFeedback(result: HookRunResult, eventName: string, isError: boo
 export default function hooksExtension(pi: ExtensionAPI) {
   let config: HooksConfig = {}
   let projectDir = ''
+  /** Claude's allowedHttpHookUrls allowlist, resolved from the settings chain. */
+  let allowedHttpHookUrls: string[] | undefined
   let pendingSessionContext: string[] = []
   let stopHookActive = false
   let sessionCtx: ExtensionContext | undefined
@@ -763,7 +811,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     (ctx: ExtensionContext, extra?: Record<string, unknown>): HookRunner =>
     (hook, payload, ms) => {
       const merged = { ...commonPayload(ctx), ...extra, ...(payload as Record<string, unknown>) }
-      if (hook.type === 'http') return runHttpHook(hook, merged, ms)
+      if (hook.type === 'http') return runHttpHook(hook, merged, ms, allowedHttpHookUrls)
       if (hook.type === 'prompt') return runPromptHook(hook, merged, ctx.model, ms)
       if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
       if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
@@ -814,8 +862,14 @@ export default function hooksExtension(pi: ExtensionAPI) {
     const ctx = sessionCtx
     const eventName = data.phase === 'start' ? 'SubagentStart' : 'SubagentStop'
     const payload = { hook_event_name: eventName, agent_type: data.agentType, agent_id: data.agentId }
-    const results = await runNotifyHooks(matchingCommands(config[eventName], data.agentType), payload, boundRunner(ctx))
-    surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
+    try {
+      const results = await runNotifyHooks(matchingCommands(config[eventName], data.agentType), payload, boundRunner(ctx))
+      surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
+    } catch {
+      // The bus outlives the session: an event landing between /new disposing this
+      // ctx and the next session_start hits disposed getters, and nothing awaits a
+      // bus listener, so a throw here would escape as an unhandled rejection.
+    }
   })
 
   pi.on('session_start', async (event, ctx) => {
@@ -827,6 +881,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     projectDir = repoRoot(ctx.cwd) ?? ctx.cwd
     const files = hookFiles(ctx.cwd, os.homedir(), trusted)
     hookSources.clear()
+    allowedHttpHookUrls = readAllowedHttpHookUrls(files)
     // The disableAllHooks escape hatch, checked before any config loads: with no
     // config resolved, no event, plugin hooks included, can fire a hook.
     hooksDisabled = readDisableAllHooks(files)
@@ -916,6 +971,12 @@ export default function hooksExtension(pi: ExtensionAPI) {
   // turn, and stop_hook_active in the payload tells the next firing it is already
   // continuing from a stop hook, which is the hook script's documented loop guard.
   // Only exit 2 and decision:"block" continue; continue:false means "stay stopped".
+  //
+  // On agent_end rather than agent_settled: agent_settled is only emitted after every
+  // agent_end handler returns, and a peer extension (plan mode) blocks its agent_end
+  // handler on a UI dialog, which would starve the Stop hook and idle notification
+  // until the user answers it. agent_end can fire slightly early before a rare
+  // automatic retry or compaction; that is the better tradeoff.
   pi.on('agent_end', async (event, ctx) => {
     // Claude's Notification event, for the one type pi can honestly source: the
     // agent finished and is waiting for input (idle_prompt). Observational only;

package/extensions/init.ts

@@ -75,7 +75,9 @@ export default function initExtension(pi: ExtensionAPI) {
       const existing = findExistingContextFile(root)
       const cursorRules = statOf(path.join(root, '.cursor', 'rules'))?.isDirectory() === true || statOf(path.join(root, '.cursorrules'))?.isFile() === true
       const copilotRules = statOf(path.join(root, '.github', 'copilot-instructions.md'))?.isFile() === true
-      pi.sendUserMessage(buildInitPrompt({ ...(existing !== undefined ? { existingContextFile: existing } : {}), cursorRules, copilotRules }))
+      // A bare send throws (and is silently swallowed) while the agent is
+      // streaming, so mid-stream invocations queue as a follow-up turn.
+      pi.sendUserMessage(buildInitPrompt({ ...(existing !== undefined ? { existingContextFile: existing } : {}), cursorRules, copilotRules }), ctx.isIdle() ? {} : { deliverAs: 'followUp' })
     },
   })
 }

package/extensions/internal/mcp-oauth.ts

@@ -49,6 +49,11 @@ export class FileOAuthProvider implements OAuthClientProvider {
   private readonly data: StoredAuth
   private port = 0
   private readonly onRedirect: (authorizationUrl: URL) => void
+  // A fresh random CSRF token per login attempt. The SDK puts it in the authorization
+  // URL's `state` param, the server echoes it back on the redirect, and waitForAuthCode
+  // rejects any callback that does not carry it, so another local process or an open web
+  // page cannot inject an authorization code into this login (RFC 8252 8.9).
+  private readonly loginState = crypto.randomBytes(16).toString('hex')
 
   constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void) {
     this.storePath = storeFileFor(serverName)
@@ -117,6 +122,12 @@ export class FileOAuthProvider implements OAuthClientProvider {
     return this.data.tokens !== undefined
   }
 
+  /** The CSRF token the SDK adds to the authorization URL as `state`; waitForAuthCode
+   * verifies the redirect echoes exactly this value. */
+  state(): string {
+    return this.loginState
+  }
+
   redirectToAuthorization(authorizationUrl: URL): void {
     this.onRedirect(authorizationUrl)
   }
@@ -147,11 +158,30 @@ export async function startCallbackServer(preferredPort?: number): Promise<{ ser
   return { server, port: (server.address() as { port: number }).port }
 }
 
-export function waitForAuthCode(server: http.Server, timeoutMs: number): Promise<string> {
+export function waitForAuthCode(server: http.Server, timeoutMs: number, expectedState?: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(`authorization timed out after ${timeoutMs}ms`)), timeoutMs)
+    // Do not let the pending timer keep the process alive on its own: if the login is
+    // abandoned or resolved out of band, the event loop can still drain.
+    timer.unref?.()
     server.on('request', (request, response) => {
       const url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      // Only the redirect path settles the login. A stray request (a favicon fetch, a
+      // local port scan, or a forged redirect from another process or an open web page)
+      // is answered but ignored, so it can neither inject a code nor abort the login by
+      // rejecting the promise (a repeatable DoS on a stable, guessable loopback port).
+      if (url.pathname !== '/callback') {
+        response.writeHead(404, { 'content-type': 'text/plain' })
+        response.end('not found')
+        return
+      }
+      // The CSRF check: a callback that does not echo this login's state is rejected
+      // without settling, so an attacker who cannot read the state cannot complete it.
+      if (expectedState !== undefined && url.searchParams.get('state') !== expectedState) {
+        response.writeHead(400, { 'content-type': 'text/plain' })
+        response.end('state mismatch')
+        return
+      }
       const code = url.searchParams.get('code')
       const error = url.searchParams.get('error')
       response.writeHead(200, { 'content-type': 'text/html' })

package/extensions/internal/model-complete.ts

@@ -14,7 +14,7 @@
  * throw and the caller falls back to its non-model behavior.
  */
 
-import type { Api, AssistantMessage, Context, Model, ModelsSimpleStreamOptions } from '@earendil-works/pi-ai'
+import type { Api, AssistantMessage, Context, Model, ModelsSimpleStreamOptions, Usage } from '@earendil-works/pi-ai'
 import { ModelRuntime } from '@earendil-works/pi-coding-agent'
 
 /** The completion backend: model + context -> assistant message. Overridable for tests. */
@@ -52,11 +52,13 @@ export interface CompleteOptions {
 }
 
 /**
- * Run `prompt` through `model` as a single user turn and return the reply text.
+ * Run `prompt` through `model` as a single user turn and return the reply text plus
+ * the call's usage. A tool that makes a nested LLM call must return that usage on
+ * its tool result, or the call's tokens and cost vanish from pi's session totals.
  * Throws on any failure so the caller can fall back; never returns a partial or a
  * tool call, only assistant text.
  */
-export async function completeText(model: Model<Api>, prompt: string, options: CompleteOptions = {}): Promise<string> {
+export async function completeText(model: Model<Api>, prompt: string, options: CompleteOptions = {}): Promise<{ text: string; usage: Usage }> {
   backend ??= realBackend()
   const complete = await backend
   const context: Context = {
@@ -64,5 +66,5 @@ export async function completeText(model: Model<Api>, prompt: string, options: C
     messages: [{ role: 'user', content: prompt, timestamp: Date.now() }],
   }
   const message = await complete(model, context, { maxTokens: options.maxTokens ?? 1024, signal: options.signal })
-  return assistantText(message)
+  return { text: assistantText(message), usage: message.usage }
 }

package/extensions/internal/path-rules.ts

@@ -21,8 +21,66 @@ export interface PathAnchors {
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
-/** One gitignore-style pattern as an anchored regular expression source. */
-export function globToRegExpSource(pattern: string): string {
+/** Cap on brace-expanded alternatives per pattern, mirroring Claude's ~1000
+ * budget; an over-budget pattern is used unexpanded. */
+const BRACE_EXPANSION_LIMIT = 1000
+
+interface BraceGroup {
+  start: number
+  end: number
+  options: string[]
+}
+
+/** The `{...}` group opening at `open`, or null when it is unmatched or carries no
+ * top-level comma (literal braces). Options are split on commas at the group's own
+ * depth so a nested group stays inside one option. */
+function parseBraceGroup(pattern: string, open: number): BraceGroup | null {
+  let depth = 1
+  let optionStart = open + 1
+  const options: string[] = []
+  for (let i = open + 1; i < pattern.length; i += 1) {
+    const ch = pattern[i]
+    if (ch === '{') depth += 1
+    else if (ch === ',' && depth === 1) {
+      options.push(pattern.slice(optionStart, i))
+      optionStart = i + 1
+    } else if (ch === '}' && --depth === 0) {
+      if (options.length === 0) return null // no top-level comma: literal braces
+      options.push(pattern.slice(optionStart, i))
+      return { start: open, end: i, options }
+    }
+  }
+  return null
+}
+
+/** The first expandable `{...}` group. A comma-less or unmatched `{` is skipped as
+ * literal, so the scan can still find an expandable group nested inside it. */
+function findBraceGroup(pattern: string): BraceGroup | null {
+  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+    const group = parseBraceGroup(pattern, open)
+    if (group) return group
+  }
+  return null
+}
+
+/** Bash-style brace expansion of one pattern into its alternatives: each group
+ * multiplies out (Cartesian across groups, nested groups recurse). Returns null
+ * when the expansion would exceed the budget. */
+function expandBraces(pattern: string): string[] | null {
+  const group = findBraceGroup(pattern)
+  if (group === null) return [pattern]
+  const expanded: string[] = []
+  for (const option of group.options) {
+    const branch = expandBraces(pattern.slice(0, group.start) + option + pattern.slice(group.end + 1))
+    if (branch === null) return null
+    expanded.push(...branch)
+    if (expanded.length > BRACE_EXPANSION_LIMIT) return null
+  }
+  return expanded
+}
+
+/** One glob pattern, braces already expanded, as a regular expression source. */
+function translateGlob(pattern: string): string {
   let out = ''
   let i = 0
   while (i < pattern.length) {
@@ -54,6 +112,15 @@ export function globToRegExpSource(pattern: string): string {
   return out
 }
 
+/** One gitignore-style pattern as an anchored regular expression source. Brace
+ * groups (`{ts,tsx}`, nested, Cartesian across groups) expand into ORed
+ * alternatives; an over-budget expansion falls back to the literal pattern. */
+export function globToRegExpSource(pattern: string): string {
+  const alternatives = expandBraces(pattern) ?? [pattern]
+  if (alternatives.length === 1) return translateGlob(alternatives[0])
+  return `(?:${alternatives.map(translateGlob).join('|')})`
+}
+
 /** A rule resolved to an absolute glob per its anchor form. */
 function resolveRule(rule: string, anchors: PathAnchors): string {
   if (rule.startsWith('//')) return rule.slice(1)

package/extensions/mcp.ts

@@ -11,8 +11,10 @@
  * per-project `projects[cwd].mcpServers` local scope, and ~/.pi/agent/mcp.json) is the
  * user's own and loads on the first session. Project config (.mcp.json, .pi/mcp.json)
  * can run arbitrary commands on connect, so it loads only once the project is approved
- * (see project-approval). The two scopes are loaded separately, not merged; user config
- * connects first, so a project server cannot take the name of a user server that connected.
+ * (see project-approval). The two scopes are loaded separately, not merged. Claude's
+ * precedence is project over user for a duplicate name, so a project server the user has
+ * consented to (or an approved project's) wins; a merely-present untrusted project entry
+ * cannot shadow a user server, and a gated project server does not preempt it.
  * Values support ${VAR} / ${VAR:-default} interpolation, connect and per-call timeouts
  * honor MCP_TIMEOUT / MCP_TOOL_TIMEOUT, and a stdio server receives only the SDK's default
  * environment plus its own `env` block, not the whole process environment.
@@ -108,11 +110,18 @@ export type ServerConfig = StdioServerConfig | HttpServerConfig
 
 /** Claude's .mcp.json expansion: ${VAR}, and ${VAR:-default}. The syntax borrows
  * shell's `:-`, which substitutes when the variable is unset OR empty. */
-export function interpolateEnv(value: string, env: NodeJS.ProcessEnv = process.env): string {
-  return value.replace(/\$\{(\w+)(:-([^}]*))?\}/g, (_, name, hasDefault, fallback) => {
+export function interpolateEnv(value: string, env: NodeJS.ProcessEnv = process.env, onMissing?: (name: string) => void): string {
+  return value.replace(/\$\{(\w+)(:-([^}]*))?\}/g, (fullMatch, name, hasDefault, fallback) => {
     const current = env[name]
     if (hasDefault !== undefined) return current || fallback
-    return current ?? ''
+    if (current === undefined) {
+      // A referenced variable with no value and no default: keep the literal ${VAR} and
+      // report it, matching Claude, rather than silently substituting an empty string that
+      // turns `Bearer ${TOKEN}` into a confusing `Bearer ` and a mystery 401.
+      onMissing?.(name)
+      return fullMatch
+    }
+    return current
   })
 }
 
@@ -387,11 +396,40 @@ export function promptMessageContent(messages: ReadonlyArray<{ content: unknown
   return mapContent(messages.map((message) => message.content as McpContentBlock)).filter((block) => block.type !== 'text' || block.text.trim() !== '')
 }
 
+/** Merge the `properties` (and, for allOf, the `required`) of a root-level combinator's
+ * branches into one flat object schema. Without this a tool whose input schema is a bare
+ * anyOf/oneOf/allOf (no top-level `type`) would present no properties at all, so the model
+ * would be forced to call it with no arguments. */
+function mergeCombinatorBranches(branches: unknown[]): { properties: Record<string, unknown>; required: string[] } {
+  const properties: Record<string, unknown> = {}
+  const required = new Set<string>()
+  for (const branch of branches) {
+    if (!branch || typeof branch !== 'object') continue
+    const b = branch as Record<string, unknown>
+    if (b.properties && typeof b.properties === 'object') Object.assign(properties, b.properties as Record<string, unknown>)
+    if (Array.isArray(b.required)) for (const name of b.required) if (typeof name === 'string') required.add(name)
+  }
+  return { properties, required: [...required] }
+}
+
 export function normalizeSchema(schema: unknown): object {
   const base = (schema as Record<string, unknown>) ?? {}
   const { $schema: _dropSchema, additionalProperties: _dropAdditional, ...rest } = base
-  if (!rest.type) return { type: 'object', properties: {} }
-  return rest
+  if (rest.type) return rest
+  // A root-level combinator carries the real parameters in its branches; flatten them
+  // into one object schema rather than emptying it. allOf means every branch applies, so
+  // its required union is kept; anyOf/oneOf branches are alternatives, so required is left
+  // open (the server still enforces its own).
+  const allOf = Array.isArray(rest.allOf) ? rest.allOf : undefined
+  let branches = allOf
+  if (!branches && Array.isArray(rest.anyOf)) branches = rest.anyOf
+  if (!branches && Array.isArray(rest.oneOf)) branches = rest.oneOf
+  if (!branches) return { type: 'object', properties: {} }
+  const { properties, required } = mergeCombinatorBranches(branches)
+  const merged: Record<string, unknown> = { type: 'object', properties }
+  if (typeof rest.description === 'string') merged.description = rest.description
+  if (allOf && required.length > 0) merged.required = required
+  return merged
 }
 
 interface McpContentBlock {
@@ -494,23 +532,32 @@ async function withTimeout<T>(promise: Promise<T>, ms: number, label: string): P
 
 async function connect(name: string, config: ServerConfig, authUi?: AuthUi): Promise<Client> {
   const client = new Client({ name: 'pi-code-mcp', version: '0.1.0' })
+  // Names referenced by ${VAR} with no value and no default, gathered across this
+  // server's interpolated fields so the connect can warn once rather than fail with a
+  // mystery 401 or a command that lost an argument.
+  const missing = new Set<string>()
+  const fill = (value: string): string => interpolateEnv(value, process.env, (varName) => missing.add(varName))
+  const warnMissing = (): void => {
+    if (missing.size > 0) console.warn(`pi-code-mcp: server ${name} references undefined variable(s) ${[...missing].join(', ')}; leaving them unexpanded`)
+  }
   if (isStdio(config)) {
     // Start from the SDK's allowlist (PATH, HOME, SHELL, ...) rather than the whole
     // process env: a server should not receive ANTHROPIC_API_KEY or GITHUB_TOKEN just
     // for being launched. A server that needs a variable names it in its own env block.
     const env: Record<string, string> = { ...getDefaultEnvironment() }
-    for (const [key, value] of Object.entries(config.env ?? {})) env[key] = interpolateEnv(value)
+    for (const [key, value] of Object.entries(config.env ?? {})) env[key] = fill(value)
     const transport = new StdioClientTransport({
-      command: interpolateEnv(config.command),
-      args: (config.args ?? []).map((arg) => interpolateEnv(arg)),
+      command: fill(config.command),
+      args: (config.args ?? []).map((arg) => fill(arg)),
       env,
       cwd: expandCwd(config.cwd),
       stderr: 'ignore',
     })
+    warnMissing()
     await connectWithTimeout(client, transport, `connect ${name}`)
     return client
   }
-  const url = new URL(interpolateEnv(config.url))
+  const url = new URL(fill(config.url))
   if (config.type === 'ws' || config.type === 'websocket') {
     // The SDK's WebSocket transport takes only a url: it carries no headers, bearer
     // token, or headersHelper output. Warn rather than silently dropping configured
@@ -520,16 +567,18 @@ async function connect(name: string, config: ServerConfig, authUi?: AuthUi): Pro
       console.warn(`pi-code-mcp: server ${name} is a WebSocket server; the SDK ws transport is url-only, so its headers/bearerToken/headersHelper are ignored`)
     }
     const transport = new WebSocketClientTransport(url)
+    warnMissing()
     await connectWithTimeout(client, transport, `connect ${name} (ws)`)
     return client
   }
   const headers: Record<string, string> = {}
-  for (const [key, value] of Object.entries(config.headers ?? {})) headers[key] = interpolateEnv(value)
+  for (const [key, value] of Object.entries(config.headers ?? {})) headers[key] = fill(value)
   const token = resolveBearerToken(config)
   if (token) headers.Authorization = `Bearer ${token}`
   // A headersHelper generates connect-time headers for non-OAuth auth schemes; its
   // JSON stdout merges over the static headers.
-  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(interpolateEnv(config.headersHelper)))
+  if (config.headersHelper) Object.assign(headers, await runHeadersHelper(fill(config.headersHelper)))
+  warnMissing()
   const sseTransport = (authProvider?: OAuthClientProvider) => new SSEClientTransport(url, { requestInit: { headers }, authProvider }) // NOSONAR: explicitly declared or deliberate legacy transport
   if (config.type === 'sse') {
     return await connectHttpFamily(name, config, sseTransport, `connect ${name} (sse)`, token, authUi)
@@ -645,7 +694,9 @@ async function runInteractiveOAuth(name: string, config: { url: string }, makeTr
   provider.bindRedirectPort(port)
   try {
     const transport = makeTransport(provider)
-    const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS)
+    // Verify the redirect echoes this login's state, so a stray or forged callback to the
+    // loopback port cannot inject a code or abort the login (see waitForAuthCode).
+    const pendingCode = waitForAuthCode(server, OAUTH_FLOW_TIMEOUT_MS, provider.state())
     pendingCode.catch(() => {}) // consumed below; an abandoned login must not surface as unhandled
     const client = newClient()
     try {
@@ -790,7 +841,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   const aliases: McpToolAlias[] = []
 
   /** Register every not-yet-registered tool of a server; returns how many were added. */
-  function registerTools(name: string, config: ServerConfig, client: Client, tools: McpToolInfo[]): number {
+  function registerTools(name: string, config: ServerConfig, tools: McpToolInfo[]): number {
     let count = 0
     for (const tool of tools) {
       const toolName = formatToolName(name, tool.name)
@@ -809,12 +860,18 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         description: tool.description ?? `MCP tool ${tool.name} from ${name}`,
         parameters: Type.Unsafe(normalizeSchema(tool.inputSchema)),
         async execute(_id, params) {
+          // Resolve the live client by name at call time rather than capturing the one
+          // present at registration: pi has no tool unregister, so after a server drops
+          // and a later session_start reconnects it, registerTools skips re-registration
+          // and this closure would otherwise keep calling the old, closed client.
+          const current = clients.get(name)
+          if (!current) throw new Error(`MCP server "${name}" is not connected`)
           // Pass the timeout to the SDK too: its own default request timeout is 60s and
           // would otherwise reject first, so the outer race at CALL_TIMEOUT_MS was dead.
           // Claude's per-server timeout wins over MCP_TOOL_TIMEOUT, with a 1s floor.
           const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
           const budget = declared ?? callTimeoutMs()
-          const result = await withTimeout(client.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
+          const result = await withTimeout(current.callTool({ name: tool.name, arguments: params as Record<string, unknown> }, undefined, { timeout: budget }), budget, toolName)
           const content = mapContent(result.content as McpContentBlock[], result.structuredContent)
           const details: { error?: string } = {}
           if (result.isError) {
@@ -839,7 +896,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
    * no command unregister, so, like tools, a withdrawn prompt keeps its registration
    * and surfaces the server's own error when invoked; an edit to a prompt's declared
    * arguments only lands on new names, since an existing command keeps its binding. */
-  function registerPrompts(name: string, client: Client, prompts: McpPromptInfo[]): void {
+  function registerPrompts(name: string, prompts: McpPromptInfo[]): void {
     for (const prompt of prompts) {
       const commandName = formatPromptCommandName(name, prompt.name)
       const owner = registeredPrompts.get(commandName)
@@ -855,11 +912,19 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         description: hint ? `${base} ${hint}` : base,
         handler: async (args, ctx) => {
           try {
+            // Resolve the live client at call time, not the one captured at registration:
+            // pi has no command unregister, so after a reconnect this closure must not keep
+            // calling the old, closed client (see registerTools for the same reason).
+            const current = clients.get(name)
+            if (!current) {
+              ctx.ui.notify(`${commandName}: MCP server "${name}" is not connected`, 'error')
+              return
+            }
             const promptArgs = mapPromptArguments(prompt.arguments, args)
             const params: { name: string; arguments?: Record<string, string> } = { name: prompt.name }
             if (Object.keys(promptArgs).length > 0) params.arguments = promptArgs
             const budget = callTimeoutMs()
-            const result = await withTimeout(client.getPrompt(params, { timeout: budget }), budget, commandName)
+            const result = await withTimeout(current.getPrompt(params, { timeout: budget }), budget, commandName)
             // The prompt drives a turn exactly the way a custom slash command does
             // (see commands.ts), carrying its image blocks through. A prompt that
             // yields no content is reported rather than sent as an empty turn.
@@ -868,7 +933,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
               ctx.ui.notify(`${commandName}: prompt returned no content`, 'info')
               return
             }
-            pi.sendUserMessage(content)
+            // A bare send throws (and is silently swallowed) while the agent is
+            // streaming, so mid-stream invocations queue as a follow-up turn.
+            pi.sendUserMessage(content, ctx.isIdle() ? {} : { deliverAs: 'followUp' })
           } catch (error) {
             ctx.ui.notify(`${commandName}: ${error instanceof Error ? error.message : String(error)}`, 'error')
           }
@@ -882,7 +949,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function connectPrompts(name: string, client: Client): Promise<void> {
     if (!client.getServerCapabilities()?.prompts) return
     try {
-      registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+      registerPrompts(name, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
     } catch (error) {
       console.warn(`pi-code-mcp: prompt listing failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
     }
@@ -894,7 +961,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     try {
       client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {
         try {
-          registerPrompts(name, client, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
+          registerPrompts(name, await withTimeout(listAllPrompts(client), connectTimeoutMs(), `list prompts ${name}`))
         } catch (error) {
           console.warn(`pi-code-mcp: prompt refresh failed for ${name}: ${error instanceof Error ? error.message : String(error)}`)
         }
@@ -978,7 +1045,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {
         try {
           const refreshed = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-          const added = registerTools(name, config, client, refreshed)
+          const added = registerTools(name, config, refreshed)
           if (added === 0) return
           const current = status.get(name)
           status.set(name, { state: current?.state ?? 'connected', tools: (current?.tools ?? 0) + added })
@@ -1014,7 +1081,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           const client = await connect(name, config, authUi)
           clients.set(name, client)
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
-          const count = registerTools(name, config, client, tools)
+          const count = registerTools(name, config, tools)
           subscribeToToolChanges(name, config, client)
           // Prompts and resources are additive surfaces: their failures warn (inside
           // connectPrompts) rather than flipping a tool-serving server to failed.
@@ -1075,7 +1142,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     const pluginServers = loadPluginServers(installedPlugins(os.homedir()))
     const { allowed, denied } = mcpAllowDeny()
     const scoped = applyServerPolicy({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }, allowed, denied)
-    const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name)))
+    // Claude's precedence is project over user for a duplicate name. A project .mcp.json
+    // server only outranks the user's own when it will actually connect (the user already
+    // consented to it, or an approved project's), so a merely-present untrusted project
+    // entry cannot shadow a trusted user server by reusing its name. A gated project
+    // server still awaiting the approval prompt does not preempt the user server: that is
+    // a deliberate narrowing of Claude's rule to keep the safe default.
+    const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
+    const projectWinners = new Set(Object.keys(splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), projectPolicy).consented))
+    const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
     if (Object.keys(userServers).length > 0) await connectServers(userServers, authUiFor(ctx))
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once
     // the project is trusted. Per-server settings refine that: disabled servers never

package/extensions/memory.ts

@@ -12,7 +12,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import { type ExtensionAPI, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
 import { capForContext } from './internal/output-guard.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
@@ -138,29 +138,39 @@ export function indexWouldOverflow(index: string, name: string, description: str
   return next.split('\n').length > INDEX_MAX_LINES || Buffer.byteLength(next, 'utf-8') > INDEX_MAX_BYTES
 }
 
-/** Write a memory and its index line, or say why it cannot be written. */
-export function saveMemory(dir: string, indexPath: string, name: string | undefined, description: string | undefined, content: string | undefined, now: string = new Date().toISOString()): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+type MemoryToolResult = { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> }
+
+/** Write a memory and its index line, or say why it cannot be written. The whole
+ * read-modify-write holds the index's mutation queue: tool calls run in parallel, so
+ * two unqueued saves both read the same index and the second silently drops the first's
+ * line. The queue keys ONLY on the index, the shared file every save touches, and never
+ * also on the memory file: a second nested queue self-deadlocks when a memory name
+ * canonicalizes to the same key as the index (e.g. `memory.md` and `MEMORY.md` under a
+ * case-insensitive filesystem, since the queue keys on realpath). */
+export async function saveMemory(dir: string, indexPath: string, name: string | undefined, description: string | undefined, content: string | undefined, now: string = new Date().toISOString()): Promise<MemoryToolResult> {
   if (!name || !description || !content) {
     return { content: [{ type: 'text', text: 'save requires name, description, and content.' }], details: {} }
   }
-  const index = readIndex(dir)
-  // Claude reports an explicit error rather than writing a memory the next session
-  // would never load, and says what to do about it.
-  if (indexWouldOverflow(index, name, description)) {
-    return {
-      content: [{ type: 'text', text: `Memory index is full (${INDEX_MAX_LINES} entries or ${INDEX_MAX_BYTES} bytes). Delete or consolidate memories before saving ${name}.` }],
-      details: {},
+  return withFileMutationQueue(indexPath, async (): Promise<MemoryToolResult> => {
+    const index = readIndex(dir)
+    // Claude reports an explicit error rather than writing a memory the next session
+    // would never load, and says what to do about it.
+    if (indexWouldOverflow(index, name, description)) {
+      return {
+        content: [{ type: 'text', text: `Memory index is full (${INDEX_MAX_LINES} entries or ${INDEX_MAX_BYTES} bytes). Delete or consolidate memories before saving ${name}.` }],
+        details: {},
+      }
     }
-  }
-  fs.mkdirSync(dir, { recursive: true })
-  // A memory with frontmatter records its write time; one without is left as-is.
-  fs.writeFileSync(path.join(dir, `${name}.md`), stampModified(content, now))
-  writeIndex(indexPath, upsertIndexLine(index, name, description))
-  return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
+    fs.mkdirSync(dir, { recursive: true })
+    // A memory with frontmatter records its write time; one without is left as-is.
+    fs.writeFileSync(path.join(dir, `${name}.md`), stampModified(content, now))
+    writeIndex(indexPath, upsertIndexLine(index, name, description))
+    return { content: [{ type: 'text', text: `Saved memory ${name}.` }], details: {} }
+  })
 }
 
 /** The read action: a memory's body, capped for context, or a not-found message. */
-function readMemory(dir: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
+function readMemory(dir: string, name: string): MemoryToolResult {
   try {
     const body = fs.readFileSync(path.join(dir, `${name}.md`), 'utf-8')
     return { content: [{ type: 'text', text: capForContext(body) }], details: {} }
@@ -169,21 +179,23 @@ function readMemory(dir: string, name: string): { content: Array<{ type: 'text';
   }
 }
 
-/** The delete action: remove a memory file and its index line. The index is read
- * before anything is removed: refusing on a failed read must leave both the memory
- * file and the index as they were. */
-function deleteMemory(dir: string, indexPath: string, name: string): { content: Array<{ type: 'text'; text: string }>; details: Record<string, never> } {
-  let index: string
+/** The delete action: remove a memory file and its index line, queued on the index
+ * like save (single key, no deadlock). The index is read before anything is removed,
+ * and any failure (a bad index read, or an unreadable store the queue key cannot
+ * realpath) leaves both the memory file and the index as they were. */
+async function deleteMemory(dir: string, indexPath: string, name: string): Promise<MemoryToolResult> {
   try {
-    index = readIndex(dir)
+    return await withFileMutationQueue(indexPath, async (): Promise<MemoryToolResult> => {
+      const index = readIndex(dir)
+      fs.rmSync(path.join(dir, `${name}.md`), { force: true })
+      const remaining = removeIndexLine(index, name)
+      if (remaining) writeIndex(indexPath, remaining)
+      else fs.rmSync(indexPath, { force: true })
+      return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
+    })
   } catch (error) {
     return { content: [{ type: 'text', text: `Memory delete failed: ${error instanceof Error ? error.message : String(error)}. Nothing was deleted.` }], details: {} }
   }
-  fs.rmSync(path.join(dir, `${name}.md`), { force: true })
-  const remaining = removeIndexLine(index, name)
-  if (remaining) writeIndex(indexPath, remaining)
-  else fs.rmSync(indexPath, { force: true })
-  return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
 }
 
 /** The index as injected into the prompt, bounded like Claude's startup load. */
@@ -346,7 +358,8 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
       if (params.action === 'save') {
         try {
-          return saveMemory(dir, indexPath, name, params.description, params.content)
+          // Awaited here, not returned: the catch must see a queued write's rejection.
+          return await saveMemory(dir, indexPath, name, params.description, params.content)
         } catch (error) {
           return { content: [{ type: 'text' as const, text: `Memory save failed: ${error instanceof Error ? error.message : String(error)}. The index was left untouched.` }], details: {} }
         }

package/extensions/notify.ts

@@ -113,6 +113,11 @@ export default function notifyExtension(pi: ExtensionAPI) {
     lastInputAt = Date.now()
   })
 
+  // Fires on agent_end rather than agent_settled deliberately: agent_settled is only
+  // emitted after every agent_end handler returns, and a peer extension (plan mode)
+  // blocks its agent_end handler on a UI dialog, which would starve this notification
+  // exactly when the user has stepped away. agent_end can fire slightly early before a
+  // rare automatic retry or compaction, which is a better failure than never notifying.
   pi.on('agent_end', async () => {
     if (channel === 'off') return
     // Piped or headless stdout (pi -p, CI) must not receive raw escape bytes.

package/extensions/plan-mode/index.ts

@@ -209,7 +209,9 @@ export default function planModeExtension(pi: ExtensionAPI): void {
       planFromTool = false
       const refinement = await ctx.ui.editor('Refine the plan:', '')
       if (refinement?.trim()) {
-        pi.sendUserMessage(refinement.trim())
+        // A bare send throws (and is silently swallowed) while the agent is
+        // streaming, so mid-stream invocations queue as a follow-up turn.
+        pi.sendUserMessage(refinement.trim(), ctx.isIdle() ? {} : { deliverAs: 'followUp' })
       }
     }
   }

package/extensions/question.ts

@@ -238,7 +238,39 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
   // The free-text option does not compose with checkbox selection, so it is single-select only.
   const allOptions: DisplayOption[] = multiSelect ? [...params.options] : [...params.options, { label: 'Type something.', isOther: true }]
 
-  const result = await ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number } | null) => void) => {
+  // ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it resolves
+  // undefined immediately, which would read as a cancel without ever asking. Ask
+  // through the dialog primitives there instead.
+  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect) : await askViaDialogs(params, ctx, allOptions, multiSelect)
+
+  // Build simple options list for details; header/multiSelect appear only when set,
+  // so single-select details are unchanged.
+  const simpleOptions = params.options.map((o) => o.label)
+  const base = { question: params.question, options: simpleOptions, ...(params.header ? { header: shortHeader(params.header) } : {}), ...(multiSelect ? { multiSelect: true } : {}) }
+
+  if (!result) {
+    return {
+      content: [{ type: 'text', text: 'User cancelled the selection' }],
+      details: { ...base, answer: null } as QuestionDetails,
+    }
+  }
+
+  if (result.wasCustom) {
+    return {
+      content: [{ type: 'text', text: `User wrote: ${result.answer}` }],
+      details: { ...base, answer: result.answer, wasCustom: true } as QuestionDetails,
+    }
+  }
+  const selectionText = multiSelect ? `User selected: ${result.answer || '(none)'}` : `User selected: ${result.index}. ${result.answer}`
+  return {
+    content: [{ type: 'text', text: selectionText }],
+    details: { ...base, answer: result.answer, wasCustom: false } as QuestionDetails,
+  }
+}
+
+/** Terminal path: the full custom overlay (options list, checkboxes, inline editor). */
+function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
+  return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number } | null) => void) => {
     let optionIndex = 0
     let editMode = false
     const checked: boolean[] = allOptions.map(() => false)
@@ -339,28 +371,29 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
       handleInput,
     }
   })
+}
 
-  // Build simple options list for details; header/multiSelect appear only when set,
-  // so single-select details are unchanged.
-  const simpleOptions = params.options.map((o) => o.label)
-  const base = { question: params.question, options: simpleOptions, ...(params.header ? { header: shortHeader(params.header) } : {}), ...(multiSelect ? { multiSelect: true } : {}) }
-
-  if (!result) {
-    return {
-      content: [{ type: 'text', text: 'User cancelled the selection' }],
-      details: { ...base, answer: null } as QuestionDetails,
-    }
-  }
-
-  if (result.wasCustom) {
-    return {
-      content: [{ type: 'text', text: `User wrote: ${result.answer}` }],
-      details: { ...base, answer: result.answer, wasCustom: true } as QuestionDetails,
-    }
-  }
-  const selectionText = multiSelect ? `User selected: ${result.answer || '(none)'}` : `User selected: ${result.index}. ${result.answer}`
-  return {
-    content: [{ type: 'text', text: selectionText }],
-    details: { ...base, answer: result.answer, wasCustom: false } as QuestionDetails,
+/** Dialog-primitive fallback for UI without a terminal (RPC mode supports
+ * select/input/notify but not custom components). Mirrors the overlay's result
+ * shape; a dismissed dialog reads as a cancel, same as Escape in the overlay. */
+async function askViaDialogs(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
+  const header = shortHeader(params.header)
+  const title = header ? `[${header}] ${params.question}` : params.question
+  // Number the labels: ctx.ui.select returns the chosen label string, so duplicate
+  // labels (or a model-supplied option named like the free-text entry) would be
+  // ambiguous by text alone; the number is the unambiguous way back to the option.
+  const labels = allOptions.map((option, i) => `${i + 1}. ${option.label}`)
+  const choice = await ctx.ui.select(title, labels)
+  if (choice === undefined) return null
+  const index = labels.indexOf(choice)
+  const chosen = allOptions[index]
+  if (!multiSelect && chosen?.isOther === true) {
+    const typed = await ctx.ui.input(params.question, 'Your answer')
+    // A dismissed dialog cancels; a submitted empty answer is an (empty) answer, not a
+    // cancel, so one accidental blank Enter does not abort the rest of a question batch.
+    if (typed === undefined) return null
+    return { answer: typed.trim(), wasCustom: true }
   }
+  const answer = chosen?.label ?? choice
+  return multiSelect ? { answer, wasCustom: false } : { answer, wasCustom: false, index: index + 1 }
 }

package/extensions/subagent/background.ts

@@ -26,6 +26,10 @@ export interface BackgroundRun {
   /** True until the child process actually closes: a cancelled child that ignores
    * SIGTERM is still alive and must keep holding its concurrency slot. */
   live?: boolean
+  /** Monotonic finish order, stamped when the run completes. Eviction drops the
+   * earliest-finished runs by this, not Map insertion (start) order: a long run
+   * started first but finished last must not vanish the instant it completes. */
+  finishedAt?: number
   /** pi session the child ran under, so a follow-up can continue its context. */
   sessionId: string
   /** How the child was spawned, so a follow-up can repeat it with a new task. */
@@ -63,8 +67,13 @@ export function activeBackgroundRuns(): number {
   return [...runs.values()].filter((run) => run.live || run.state === 'running').length
 }
 
+/** Stamps BackgroundRun.finishedAt; a counter rather than a clock so two runs
+ * completing in the same millisecond still evict in their true finish order. */
+let finishSequence = 0
+
 function evictFinishedRuns(): void {
   const finished = [...runs.values()].filter((run) => !run.live && run.state !== 'running')
+  finished.sort((a, b) => (a.finishedAt ?? 0) - (b.finishedAt ?? 0))
   for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) runs.delete(stale.id)
 }
 
@@ -160,6 +169,7 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   run.output = undefined
   run.exitCode = undefined
   run.stderr = undefined
+  run.finishedAt = undefined
   driveRun(run, { ...run.spawn, args }, onComplete)
   return 'resumed'
 }
@@ -256,6 +266,7 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   const complete = (): void => {
     if (completed) return
     completed = true
+    run.finishedAt = ++finishSequence
     evictFinishedRuns()
     // A run outlives the session that started it, and pi's loader wires assertActive()
     // into every runtime call, so notifying a disposed session throws. This fires from

package/extensions/todo.ts

@@ -84,6 +84,9 @@ const listMark = (status: TodoStatus): string => {
   return '[ ]'
 }
 
+/** Plain-text list, shared by the list action and the non-terminal /todos path. */
+const plainTodoList = (todos: Todo[]): string => (todos.length ? todos.map((t) => `${listMark(t.status)} #${t.id}: ${t.text}`).join('\n') : 'No todos')
+
 const overlayLabel = (todo: Todo, theme: Theme): string => {
   if (todo.status === 'completed') return theme.fg('dim', todo.text)
   if (todo.status === 'in_progress') return theme.fg('text', todo.activeForm ?? todo.text)
@@ -433,7 +436,7 @@ export default function todoExtension(pi: ExtensionAPI) {
     return ok('clear', `Cleared ${count} todos`)
   }
 
-  const handleList = () => ok('list', todos.length ? todos.map((t) => `${listMark(t.status)} #${t.id}: ${t.text}`).join('\n') : 'No todos')
+  const handleList = () => ok('list', plainTodoList(todos))
 
   // Register the todo tool for the LLM
   pi.registerTool({
@@ -516,6 +519,13 @@ export default function todoExtension(pi: ExtensionAPI) {
         return
       }
 
+      // ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it
+      // resolves undefined without showing anything, so notify the plain list.
+      if (ctx.mode !== 'tui') {
+        ctx.ui.notify(plainTodoList(todos), 'info')
+        return
+      }
+
       await ctx.ui.custom<void>((_tui, theme, _kb, done) => {
         return new TodoListComponent(todos, theme, () => done())
       })

package/extensions/web.ts

@@ -9,6 +9,7 @@
 import type { LookupAddress } from 'node:dns'
 import { lookup } from 'node:dns/promises'
 import type { LookupFunction } from 'node:net'
+import type { Usage } from '@earendil-works/pi-ai'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
 
@@ -252,16 +253,16 @@ function rememberFetch(cache: FetchCache, url: string, body: string, now: number
 }
 
 /** Claude's WebFetch runs the prompt over the page with a fast model and returns
- * that answer, not the raw page. Best-effort: any failure (no model, provider error)
+ * that answer, not the raw page, along with the nested call's usage so the tool
+ * result can account for it. Best-effort: any failure (no model, provider error)
  * yields null so the caller falls back to the markdown. */
-async function answerFromPage(model: Parameters<typeof completeText>[0], prompt: string, url: string, body: string, signal?: AbortSignal): Promise<string | null> {
+async function answerFromPage(model: Parameters<typeof completeText>[0], prompt: string, url: string, body: string, signal?: AbortSignal): Promise<{ text: string; usage: Usage } | null> {
   try {
-    const answer = await completeText(model, `${prompt}\n\nAnswer using only the page content below, fetched from ${url}:\n\n${body}`, {
+    return await completeText(model, `${prompt}\n\nAnswer using only the page content below, fetched from ${url}:\n\n${body}`, {
       system: 'You extract and answer questions from a web page. Answer only from the provided content, concisely. If the content does not contain the answer, say so.',
       maxTokens: 1024,
       signal,
     })
-    return answer || null
   } catch {
     return null
   }
@@ -318,14 +319,18 @@ export default function webExtension(pi: ExtensionAPI) {
       }
 
       // Best-effort prompt-over-page: a failure returns null, so web_fetch always
-      // falls back to the raw markdown and returns something.
+      // falls back to the raw markdown and returns something. The nested call's
+      // usage rides on the result either way, so pi counts it in session totals.
+      let usage: Usage | undefined
       if (params.prompt && ctx?.model) {
         const answer = await answerFromPage(ctx.model, params.prompt, params.url, body, signal)
-        if (answer) return { content: [{ type: 'text' as const, text: answer }], details: {} }
+        if (answer?.text) return { content: [{ type: 'text' as const, text: answer.text }], details: {}, usage: answer.usage }
+        // An empty answer still cost the completion; the fallback carries its usage.
+        usage = answer?.usage
       }
       // The char cap alone admits thousands of short lines; pi's tool-output budget
       // bounds lines too, which the shared guard enforces.
-      return { content: [{ type: 'text' as const, text: capForContext(body) || '(empty response)' }], details: {} }
+      return { content: [{ type: 'text' as const, text: capForContext(body) || '(empty response)' }], details: {}, usage }
     },
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",