pi-code 1.0.61 → 1.0.63

package/extensions/mcp/index.ts

@@ -49,7 +49,7 @@ import { disabledServerNames, loadConfigFrom, loadPluginServers, loadUserScope,
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
 import { formatPromptCommandName, formatToolName, type McpContentBlock, type McpPromptInfo, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
 import { applyServerPolicy, loadManagedMcpServers, type McpPolicy, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
-import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isUnauthorized, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
+import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isUnauthorized, mcpConnectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
 // Re-exports for consumers: the module split keeps the extension's public surface
@@ -85,6 +85,10 @@ function authUiFor(ctx: ExtensionContext): AuthUi | undefined {
 
 export default async function mcpExtension(pi: ExtensionAPI) {
   const clients = new Map<string, Client>()
+  // The session's OAuth UI seams, captured at session_start. The reconnect paths below
+  // run outside that handler, and passing undefined there made an INTERACTIVE session
+  // report the headless "cannot log in" advice on a re-auth it could actually perform.
+  let sessionAuthUi: AuthUi | undefined
   const status = new Map<string, { state: string; tools: number }>()
   // Config per server name, kept for call-time timeout tuning: the idle tier follows
   // the transport kind, and a declared per-server timeout governs the wall budget.
@@ -178,14 +182,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   /** Claude's mid-session reconnect for a dropped remote server: five attempts with
    * a delay doubling from one second. connectServers redoes the full bring-up
    * (tools, prompts, subscriptions, a fresh onclose) and its duplicate guard skips
-   * out if another path already reconnected the name. Runs without authUi: a server
-   * that now needs a login ends failed, and after the fifth failure the last
-   * attempt's failed status stands, with a session restart as the manual retry. */
+   * out if another path already reconnected the name. Uses the session's authUi, so a
+   * server that now needs a login can prompt for it in an interactive session; headless
+   * still ends failed, and after the fifth failure the last attempt's failed status
+   * stands, with a session restart as the manual retry. */
   async function reconnectWithBackoff(name: string, config: ServerConfig): Promise<void> {
     for (let attempt = 0; attempt < 5; attempt++) {
       await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** attempt))
       if (shuttingDown || clients.has(name)) return
-      await connectServers({ [name]: config }, undefined, true)
+      await connectServers({ [name]: config }, sessionAuthUi, true)
       if (clients.has(name)) return
     }
   }
@@ -200,7 +205,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
       clients.delete(name)
       await withTimeout(old.close(), 3000, 'close').catch(() => {})
     }
-    await connectServers({ [name]: config }, undefined, true)
+    await connectServers({ [name]: config }, sessionAuthUi, true)
   }
 
   /** A tool call with the auth retry: on a 401/403 rejection, reconnect once and
@@ -558,6 +563,23 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     if (!projectConnected) projectConnected = await connectGatedProjectServers(ctx, gated, authUi)
   }
 
+  /** Publishes the current alias set and the connection banner. `'connecting'`
+   * servers are excluded from both connected and failed counts: they are neither,
+   * and while the non-blocking startup race below is still in flight some legitimately
+   * are. Called once right after startup (whether or not every server settled by
+   * then) and again when a still-connecting tail finishes, so a server that connects
+   * late still gets its aliases published and counted. */
+  function publishConnectionSummary(ctx: ExtensionContext): void {
+    pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])
+    const connected = [...status.values()].filter((s) => s.state === 'connected')
+    const failed = [...status.entries()].filter(([, s]) => s.state !== 'connected' && s.state !== 'connecting')
+    if (connected.length > 0 || failed.length > 0) {
+      const total = connected.reduce((sum, s) => sum + s.tools, 0)
+      const failNote = failed.length > 0 ? `, ${failed.length} failed` : ''
+      ctx.ui.notify(`MCP: ${total} tools from ${connected.length} servers${failNote}`, failed.length > 0 ? 'warning' : 'info')
+    }
+  }
+
   pi.on('session_start', async (_event, ctx) => {
     // Reset the status map so /mcp and the banner reflect only this session's config: a
     // server present last session but not this one must not linger as "connected". The
@@ -574,8 +596,9 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     projectConnected = false
     // Claude answers roots/list with the session's launch directory and exports the
     // project root as CLAUDE_PROJECT_DIR to stdio servers; both derive from ctx.cwd.
-    sessionDirs = { projectDir: repoRoot(ctx.cwd) ?? ctx.cwd, launchDir: ctx.cwd }
+    sessionDirs = { projectDir: repoRoot(ctx.cwd) ?? ctx.cwd, launchDir: ctx.cwd, sessionId: ctx.sessionManager?.getSessionId?.() }
     const authUi = authUiFor(ctx)
+    sessionAuthUi = authUi
     // The allow/deny lists filter every scope, including a managed-mcp.json set. They
     // merge from managed settings plus the trust-gated settings chain, as Claude
     // documents (a repo's file counts only once the project is approved).
@@ -586,21 +609,27 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // file leaves the normal scopes untouched; a present but corrupt file fails closed to an
     // empty set (see loadManagedMcpServers).
     const managed = loadManagedMcpServers()
-    if (managed !== null) {
-      await connectManagedExclusive(managed, policy, authUi)
-    } else {
-      await connectNormalScopes(ctx, policy, authUi)
-    }
-
-    pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])
-
-    const connected = [...status.values()].filter((s) => s.state === 'connected')
-    const failed = [...status.entries()].filter(([, s]) => s.state !== 'connected')
-    if (connected.length > 0 || failed.length > 0) {
-      const total = connected.reduce((sum, s) => sum + s.tools, 0)
-      const failNote = failed.length > 0 ? `, ${failed.length} failed` : ''
-      ctx.ui.notify(`MCP: ${total} tools from ${connected.length} servers${failNote}`, failed.length > 0 ? 'warning' : 'info')
-    }
+    const connecting = managed !== null ? connectManagedExclusive(managed, policy, authUi) : connectNormalScopes(ctx, policy, authUi)
+    // Claude: "MCP startup is non-blocking by default: servers connect in the
+    // background and their tools become available as they finish." A slow or
+    // unreachable server no longer costs the whole session's startup its own
+    // MCP_TIMEOUT x retries; alwaysLoad-style forced waiting and the ToolSearch/
+    // WaitForMcpServers mechanism that lets the model itself wait on a pending
+    // server's tools are not implemented, so a call to a tool that has not
+    // registered yet still just finds no such tool, same as before it connected.
+    //
+    // Claude also states non-interactive mode "waits for still-pending servers
+    // before the first turn regardless of this variable", because a -p run has no
+    // later turn to react to late-arriving tools; a headless ctx (no UI) keeps the
+    // prior fully-blocking wait for the same reason.
+    const settled = !ctx.hasUI
+      ? await connecting.then(() => true)
+      : await withTimeout(connecting, mcpConnectTimeoutMs(), 'mcp startup').then(
+          () => true,
+          () => false,
+        )
+    publishConnectionSummary(ctx)
+    if (!settled) void connecting.then(() => publishConnectionSummary(ctx))
   })
 
   pi.on('session_shutdown', async () => {

package/extensions/mcp/oauth-flow.ts

@@ -64,7 +64,7 @@ export async function runInteractiveOAuth(name: string, config: { url: string; o
     config.oauth,
     config.url,
   )
-  const { server, port } = await startCallbackServer(provider.savedRedirectPort())
+  const { server, port } = await startCallbackServer(provider.savedRedirectPort(), provider.configuredRedirectPort() !== undefined)
   provider.bindRedirectPort(port)
   try {
     const transport = makeTransport(provider)

package/extensions/mcp/transport.ts

@@ -5,6 +5,7 @@
  */
 
 import { execFile } from 'node:child_process'
+import * as fs from 'node:fs'
 import { pathToFileURL } from 'node:url'
 // SSE is deprecated in favour of Streamable HTTP, but the SDK notes servers still on
 // the old spec exist, so this stays as a fallback for the migration period.
@@ -54,6 +55,12 @@ function envTimeout(name: string, fallback: number): number {
 export const connectTimeoutMs = (): number => envTimeout('MCP_TIMEOUT', DEFAULT_CONNECT_TIMEOUT_MS)
 export const callTimeoutMs = (): number => envTimeout('MCP_TOOL_TIMEOUT', DEFAULT_CALL_TIMEOUT_MS)
 
+// Claude: "How long blocking MCP startup waits, in milliseconds, for the connection
+// batch before snapshotting the tool list (default: 5000)." Distinct from MCP_TIMEOUT,
+// which bounds one server's own connect attempt, not the whole startup batch.
+const DEFAULT_MCP_CONNECT_TIMEOUT_MS = 5000
+export const mcpConnectTimeoutMs = (): number => envTimeout('MCP_CONNECT_TIMEOUT_MS', DEFAULT_MCP_CONNECT_TIMEOUT_MS)
+
 /** Per-server inputs to the idle-window choice: the transport kind picks the default
  * tier, and a per-server `timeout` of at least 1000 also floors the idle window. */
 export interface ServerCallTuning {
@@ -136,6 +143,9 @@ function isStdio(config: ServerConfig): config is StdioServerConfig {
 export interface SessionDirs {
   projectDir: string
   launchDir: string
+  /** Claude: "An MCP server subprocess retains the ID it was spawned with", so this
+   * is captured once here at connect time rather than re-read per call. */
+  sessionId?: string
 }
 
 /** A client that, like Claude, declares the roots capability and answers roots/list
@@ -182,15 +192,26 @@ function helperEnv(name: string, config: HttpServerConfig): NodeJS.ProcessEnv {
 }
 
 /** The env a stdio server process starts with: the SDK allowlist, the config's own
- * env block, and Claude's path variables (CLAUDE_PROJECT_DIR, and CLAUDE_PLUGIN_ROOT
- * for a plugin's server). */
+ * env block, and Claude's three path variables. Claude: "All three are exported as
+ * environment variables to hook processes and to MCP and LSP server subprocesses." */
 function stdioEnv(config: StdioServerConfig, fill: (value: string) => string, session?: SessionDirs): Record<string, string> {
   // CLAUDECODE marks every subprocess; the long-lived server deliberately gets no
   // CLAUDE_CODE_CHILD_SESSION, which Claude reserves for per-call children.
   const env: Record<string, string> = { ...getDefaultEnvironment(), CLAUDECODE: '1' }
   for (const [key, value] of Object.entries(config.env ?? {})) env[key] = fill(value)
   if (session) env.CLAUDE_PROJECT_DIR = session.projectDir
+  if (session?.sessionId) env.CLAUDE_CODE_SESSION_ID = session.sessionId
   if (config.pluginRoot !== undefined) env.CLAUDE_PLUGIN_ROOT = config.pluginRoot
+  // The data dir is "created on first reference"; handing the path to a server is that
+  // reference, so the server does not have to mkdir it before using it.
+  if (config.pluginDataDir !== undefined) {
+    env.CLAUDE_PLUGIN_DATA = config.pluginDataDir
+    try {
+      fs.mkdirSync(config.pluginDataDir, { recursive: true })
+    } catch {
+      // The server still starts; one that needs the directory reports its own failure.
+    }
+  }
   return env
 }
 
@@ -234,7 +255,12 @@ export async function connect(name: string, config: ServerConfig, authUi?: AuthU
     await connectWithTimeout(client, transport, `connect ${name}`)
     return client
   }
-  const url = new URL(fill(config.url))
+  // An absent or blank `url` is a server nobody finished configuring, not a malformed
+  // one. `new URL('')` throws "Invalid URL", which reads as a typo in a real address and
+  // sends people looking for one; name the actual state instead.
+  const rawUrl = fill(config.url ?? '').trim()
+  if (rawUrl === '') throw new Error(`${name} is not configured: it has no url`)
+  const url = new URL(rawUrl)
   if (config.type === 'ws' || config.type === 'websocket') {
     // The SDK's WebSocket transport takes only a url: it carries no headers, bearer
     // token, or headersHelper output. Warn rather than silently dropping configured

package/extensions/question.ts

@@ -6,9 +6,14 @@
  * Multiple questions per call are not batched; ask sequentially.
  */
 
+import * as fs from 'node:fs'
+import * as os from 'node:os'
+import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext, Theme } from '@earendil-works/pi-coding-agent'
 import { Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth } from '@earendil-works/pi-tui'
 import { Type } from 'typebox'
+import { claudeConfigDir } from './internal/config-dir.js'
+import { readManagedSettings } from './internal/managed-settings.js'
 
 interface OptionWithDesc {
   label: string
@@ -24,6 +29,8 @@ interface QuestionDetails {
   answer: string | null
   wasCustom?: boolean
   multiSelect?: boolean
+  /** Auto-continued on askUserQuestionTimeout rather than answered or cancelled. */
+  timedOut?: boolean
 }
 
 // Options with labels and optional descriptions
@@ -70,6 +77,33 @@ function questionList(params: Partial<QuestionSpec> & { questions?: QuestionSpec
 const HEADER_MAX = 12
 export const shortHeader = (header: string | undefined): string | undefined => (header === undefined ? undefined : header.slice(0, HEADER_MAX))
 
+/** Claude's three accepted askUserQuestionTimeout spellings (`60s`, `5m`, `10m`), as
+ * milliseconds. Anything else, including unset, means no auto-continue. */
+export function parseAskUserQuestionTimeout(value: unknown): number | undefined {
+  if (typeof value !== 'string') return undefined
+  const match = /^(\d+)([sm])$/.exec(value.trim())
+  if (!match) return undefined
+  const amount = Number(match[1])
+  return match[2] === 's' ? amount * 1000 : amount * 60 * 1000
+}
+
+/** Claude scopes askUserQuestionTimeout to "User or managed": a project's own
+ * settings.json cannot set it, so a checked-out repository can never make the
+ * user's own dialogs auto-answer themselves. Managed wins over the user's file, as
+ * every managed setting does. `home` defaults to the real one and is a parameter
+ * only so a test can point it at a fixture without mocking node:os. */
+export function askUserQuestionTimeoutMs(home: string = os.homedir()): number | undefined {
+  const managed = readManagedSettings() as { askUserQuestionTimeout?: unknown }
+  const fromManaged = parseAskUserQuestionTimeout(managed.askUserQuestionTimeout)
+  if (fromManaged !== undefined) return fromManaged
+  try {
+    const parsed = JSON.parse(fs.readFileSync(path.join(claudeConfigDir(home), 'settings.json'), 'utf-8')) as { askUserQuestionTimeout?: unknown }
+    return parseAskUserQuestionTimeout(parsed.askUserQuestionTimeout)
+  } catch {
+    return undefined
+  }
+}
+
 function checkbox(checked: boolean | undefined): string {
   if (checked === undefined) return ''
   return checked ? '[x] ' : '[ ] '
@@ -98,10 +132,13 @@ interface QuestionView {
   checked: boolean[]
   editor: Editor
   theme: Theme
+  /** Claude: "You see a countdown for the last 20 seconds." Undefined the rest of
+   * the idle window, and always when there is no configured timeout at all. */
+  countdownSeconds?: number
 }
 
 function buildQuestionLines(view: QuestionView): string[] {
-  const { width, question, header, options, optionIndex, editMode, multiSelect, checked, editor, theme } = view
+  const { width, question, header, options, optionIndex, editMode, multiSelect, checked, editor, theme, countdownSeconds } = view
   const lines: string[] = []
   const add = (s: string) => lines.push(truncateToWidth(s, width))
 
@@ -129,6 +166,9 @@ function buildQuestionLines(view: QuestionView): string[] {
 
   lines.push('')
   add(theme.fg('dim', navHint(editMode, multiSelect)))
+  if (countdownSeconds !== undefined) {
+    add(theme.fg('warning', ` Auto-continuing in ${countdownSeconds}s if idle · press any key to stay`))
+  }
   add(theme.fg('accent', '─'.repeat(width)))
 
   return lines
@@ -202,6 +242,11 @@ export default function question(pi: ExtensionAPI) {
         return new Text(theme.fg('warning', 'Cancelled'), 0, 0)
       }
 
+      if (details.timedOut) {
+        const already = details.answer ? theme.fg('muted', ` (already selected: ${details.answer})`) : ''
+        return new Text(theme.fg('warning', '⏱ Auto-continued (no response)') + already, 0, 0)
+      }
+
       if (details.wasCustom) {
         return new Text(theme.fg('success', '✓ ') + theme.fg('muted', '(wrote) ') + theme.fg('accent', details.answer), 0, 0)
       }
@@ -240,8 +285,10 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
 
   // ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it resolves
   // undefined immediately, which would read as a cancel without ever asking. Ask
-  // through the dialog primitives there instead.
-  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect) : await askViaDialogs(params, ctx, allOptions, multiSelect)
+  // through the dialog primitives there instead. askUserQuestionTimeout is a TUI
+  // concept (a countdown, a keypress resetting it): the dialog-primitive fallback
+  // has no keyboard or visible countdown to drive it, so it is not applied there.
+  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect, askUserQuestionTimeoutMs()) : await askViaDialogs(params, ctx, allOptions, multiSelect)
 
   // Build simple options list for details; header/multiSelect appear only when set,
   // so single-select details are unchanged.
@@ -255,6 +302,18 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
     }
   }
 
+  if (result.timedOut) {
+    // Claude: "tells Claude you may be away from your keyboard, so Claude proceeds
+    // on its own judgment and can re-ask later." Not framed as a cancel: `answer` is
+    // '' rather than null, so renderResult and a batch's own null-check both read it
+    // as "answered nothing, but not declined" rather than the user having said no.
+    const already = multiSelect && result.answer ? ` Already selected: ${result.answer}.` : ''
+    return {
+      content: [{ type: 'text', text: `No response after the configured idle timeout; the user may be away from the keyboard.${already} Proceed on your own judgment; you can ask again later if needed.` }],
+      details: { ...base, answer: result.answer, timedOut: true } as QuestionDetails,
+    }
+  }
+
   if (result.wasCustom) {
     return {
       content: [{ type: 'text', text: `User wrote: ${result.answer}` }],
@@ -268,15 +327,82 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
   }
 }
 
-/** Terminal path: the full custom overlay (options list, checkboxes, inline editor). */
-function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
-  return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number } | null) => void) => {
+/** Claude: "You see a countdown for the last 20 seconds." */
+const COUNTDOWN_WINDOW_MS = 20_000
+/** Granularity of the idle-timer tick: fine enough that the countdown's displayed
+ * second changes on time, coarse enough not to re-render needlessly often. */
+const IDLE_TICK_MS = 250
+
+/** Terminal path: the full custom overlay (options list, checkboxes, inline editor).
+ *
+ * `timeoutMs`, when set, is Claude's askUserQuestionTimeout: "After a question sits
+ * that long with no input, the dialog closes on its own: it submits any options
+ * you'd already selected and tells Claude you may be away from your keyboard, so
+ * Claude proceeds on its own judgment and can re-ask later. You see a countdown for
+ * the last 20 seconds. Press any key to restart the timer." Terminal focus-in
+ * restarting the timer, the other documented reset trigger, is not implemented:
+ * pi's TUI input stream is not confirmed to carry the terminal's own focus-report
+ * escape sequences, and guessing at that risks misreading ordinary input as a
+ * focus event on a terminal that reports it differently. Exported so the timer
+ * mechanics are testable directly, independent of where timeoutMs itself is read
+ * from (askUserQuestionTimeoutMs, tested separately).
+ */
+export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean, timeoutMs?: number): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
+  return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null) => void) => {
     let optionIndex = 0
     let editMode = false
     const checked: boolean[] = allOptions.map(() => false)
     let cachedLines: string[] | undefined
     let cachedWidth: number | undefined
 
+    // deadline stays undefined for the whole overlay life when no timeout is
+    // configured, so every idle-timer branch below is a no-op in that case.
+    let deadline: number | undefined = timeoutMs !== undefined ? Date.now() + timeoutMs : undefined
+    let idleTimer: ReturnType<typeof setInterval> | undefined
+    let lastCountdown: number | undefined
+
+    function stopIdleTimer(): void {
+      if (idleTimer !== undefined) clearInterval(idleTimer)
+      idleTimer = undefined
+    }
+
+    /** Every exit path (an answer, a cancel, or the timeout itself) goes through
+     * here, so the interval can never outlive the overlay it belongs to. */
+    function finish(value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null): void {
+      stopIdleTimer()
+      done(value)
+    }
+
+    function resetIdleTimer(): void {
+      if (timeoutMs === undefined) return
+      deadline = Date.now() + timeoutMs
+    }
+
+    function fireTimeout(): void {
+      // Claude: "submits any options you'd already selected". Single-select has
+      // nothing pre-committed (a selection only exists once Enter confirms it), so
+      // its timeout answer is empty rather than whatever option merely had focus.
+      const answer = multiSelect ? selectedLabels(allOptions, checked) : ''
+      finish({ answer, wasCustom: false, timedOut: true })
+    }
+
+    if (timeoutMs !== undefined) {
+      idleTimer = setInterval(() => {
+        if (deadline === undefined) return
+        const remainingMs = deadline - Date.now()
+        if (remainingMs <= 0) {
+          fireTimeout()
+          return
+        }
+        const remainingSeconds = Math.ceil(remainingMs / 1000)
+        const nextCountdown = remainingMs <= COUNTDOWN_WINDOW_MS ? remainingSeconds : undefined
+        if (nextCountdown !== lastCountdown) {
+          lastCountdown = nextCountdown
+          refresh()
+        }
+      }, IDLE_TICK_MS)
+    }
+
     const editorTheme: EditorTheme = {
       borderColor: (s) => theme.fg('accent', s),
       selectList: {
@@ -292,7 +418,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
     editor.onSubmit = (value) => {
       const trimmed = value.trim()
       if (trimmed) {
-        done({ answer: trimmed, wasCustom: true })
+        finish({ answer: trimmed, wasCustom: true })
       } else {
         editMode = false
         editor.setText('')
@@ -306,6 +432,11 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
     }
 
     function handleInput(data: string) {
+      // Claude: "Press any key to restart the timer." Every branch below returns
+      // through this function, so resetting unconditionally on entry covers all of
+      // them, including the ones (arrow keys, space) that never reach `finish`.
+      resetIdleTimer()
+
       if (editMode) {
         if (matchesKey(data, Key.escape)) {
           editMode = false
@@ -337,7 +468,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
 
       if (matchesKey(data, Key.enter)) {
         if (multiSelect) {
-          done({ answer: selectedLabels(allOptions, checked), wasCustom: false })
+          finish({ answer: selectedLabels(allOptions, checked), wasCustom: false })
           return
         }
         const selected = allOptions[optionIndex]
@@ -345,20 +476,20 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
           editMode = true
           refresh()
         } else {
-          done({ answer: selected.label, wasCustom: false, index: optionIndex + 1 })
+          finish({ answer: selected.label, wasCustom: false, index: optionIndex + 1 })
         }
         return
       }
 
       if (matchesKey(data, Key.escape)) {
-        done(null)
+        finish(null)
       }
     }
 
     function render(width: number): string[] {
       if (cachedLines && cachedWidth === width) return cachedLines
       cachedWidth = width
-      cachedLines = buildQuestionLines({ width, question: params.question, header: shortHeader(params.header), options: allOptions, optionIndex, editMode, multiSelect, checked, editor, theme })
+      cachedLines = buildQuestionLines({ width, question: params.question, header: shortHeader(params.header), options: allOptions, optionIndex, editMode, multiSelect, checked, editor, theme, countdownSeconds: lastCountdown })
       return cachedLines
     }
 
@@ -369,6 +500,10 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
         cachedLines = undefined
       },
       handleInput,
+      // Belt and suspenders alongside finish()'s own stopIdleTimer: if the host ever
+      // tears the overlay down through a path that does not go through `done`
+      // (finish's only caller), the interval still gets cleared here.
+      dispose: stopIdleTimer,
     }
   })
 }
@@ -376,7 +511,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
 /** Dialog-primitive fallback for UI without a terminal (RPC mode supports
  * select/input/notify but not custom components). Mirrors the overlay's result
  * shape; a dismissed dialog reads as a cancel, same as Escape in the overlay. */
-async function askViaDialogs(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
+async function askViaDialogs(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
   const header = shortHeader(params.header)
   const title = header ? `[${header}] ${params.question}` : params.question
   // Number the labels: ctx.ui.select returns the chosen label string, so duplicate

package/extensions/session-title.ts

@@ -93,6 +93,11 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
   })
 
   pi.on('agent_settled', async (_event, ctx) => {
+    // Claude: "Set to 1 to disable automatic terminal title updates based on conversation
+    // context. In Agent SDK and claude -p sessions, this also skips the background
+    // small/fast-model request that generates the session title." setSessionName is pi's
+    // only title sink, so skipping the call here skips both effects at once.
+    if (process.env.CLAUDE_CODE_DISABLE_TERMINAL_TITLE === '1') return
     if (titled) return
     // Never clobber an existing name: a user-chosen or resumed name wins.
     if (pi.getSessionName?.()) return

package/extensions/skills.ts

@@ -39,18 +39,41 @@ import { errorMessage, isDirectory, isRecord } from './internal/values.js'
  * directory is included only for approved projects: pi's loader surfaces every skill's
  * name and description to the model, so an untrusted repository would otherwise get
  * text into the prompt without the user ever agreeing to load its config. */
+/** The extra skill directories a manifest declares, as a list. A string is one entry,
+ * a list is itself, anything else declares none. */
+function declaredSkillDirs(declared: unknown): string[] {
+  if (Array.isArray(declared)) return declared.map(String)
+  return typeof declared === 'string' ? [declared] : []
+}
+
 export function skillDirs(cwd: string, home: string, trusted: boolean): string[] {
   // Claude's precedence: enterprise (the skills directory beside the managed
   // settings file) overrides personal, and personal overrides project; discovery
   // here is first-match, so higher precedence goes first.
-  const candidates = [path.join(path.dirname(managedSettingsFile()), '.claude', 'skills'), path.join(claudeConfigDir(home), 'skills')]
+  // Claude: "Set to 1 to skip loading skills from the system-wide managed skills
+  // directory. Useful for container or CI sessions that should not load
+  // operator-provisioned skills." The enterprise dir beside managed-settings.json is
+  // that directory here; personal and project skills are unaffected.
+  const enterprise = process.env.CLAUDE_CODE_DISABLE_POLICY_SKILLS === '1' ? [] : [path.join(path.dirname(managedSettingsFile()), '.claude', 'skills')]
+  const candidates = [...enterprise, path.join(claudeConfigDir(home), 'skills')]
   // Enabled plugins contribute their skills directories. pi's loader names a
   // skill by its directory, so a plugin skill registers without Claude's
   // /plugin: prefix; a rename-free approximation, disclosed in the README.
   for (const plugin of installedPlugins(home)) {
-    const declared = plugin.manifest.skills
-    const dirs = Array.isArray(declared) ? declared : [typeof declared === 'string' ? declared : 'skills']
+    // Claude: "Adds to the default: `skills`. The default `skills/` directory is always
+    // scanned, and directories listed in `skills` are loaded alongside it." Treating the
+    // declaration as a replacement silently dropped every skill in the conventional
+    // location. (The reference's one exception, a marketplace entry whose source resolves
+    // to the marketplace root, is a marketplace shape pi-code does not model.)
+    const extra = declaredSkillDirs(plugin.manifest.skills)
+    const dirs = [...extra, 'skills']
     candidates.push(...dirs.map((dir) => pluginComponentPath(plugin, String(dir))).filter((dir): dir is string => dir !== undefined))
+    // NOT SUPPORTED: Claude's single-skill layout, "a plugin that ships exactly one skill
+    // can place SKILL.md directly at the plugin root". skillPaths is handed to pi's own
+    // loader, which owns the layout and looks for <dir>/<name>/SKILL.md; adding the plugin
+    // root here does not surface root/SKILL.md and does start scanning every sibling
+    // directory (hooks/, agents/, commands/) for skills. Supporting it needs a loader that
+    // accepts a directory that IS the skill, which is pi's call, not this extension's.
   }
   // Claude loads skills from every .claude/skills between cwd and the repository
   // root; the list goes nearest-first so findClaudeSkill's first match is the

package/extensions/status-line.ts

@@ -352,8 +352,10 @@ export default function statusLine(pi: ExtensionAPI) {
       // Everything below can touch ctx after an await, and every ctx getter throws
       // once the session is disposed. This promise is started from a timer with no
       // awaiter, so an escaping rejection becomes an uncaughtException and exits pi.
-      const result = await runHookCommand(config.command, buildPayload(ctx), COMMAND_TIMEOUT_MS, undefined, undefined, (kill) => {
-        killInflight = kill
+      const result = await runHookCommand(config.command, buildPayload(ctx), COMMAND_TIMEOUT_MS, {
+        onChild: (kill) => {
+          killInflight = kill
+        },
       })
       // Claude: "Your script can output multiple lines to create a richer display."
       // pi has one row for every extension status and replaces newlines with spaces

package/extensions/subagent/child.ts

@@ -12,6 +12,7 @@ import * as path from 'node:path'
 
 import type { AgentRunRequest } from '../internal/agent-run.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { sliceBytes } from '../internal/output-guard.js'
 import { repoRoot } from '../internal/project-root.js'
 import { autoMemoryEnabled, capIndexForPrompt, INDEX_MAX_BYTES, INDEX_MAX_LINES, memorySettingsFiles, readMemorySettings } from '../memory.js'
 import { type AgentConfig, type AgentMemoryScope, expandMcpToolPatterns, withPreloadedSkills } from './agents.js'
@@ -188,10 +189,24 @@ export function agentHooksEnv(agent: AgentConfig, agentId: string): Record<strin
   return { PI_CODE_AGENT_HOOKS: JSON.stringify({ agent: agent.name, id: agentId, hooks }) }
 }
 
+/** This string becomes the whole of one argv element to the spawned child
+ * (run.ts, `spawn(..., { shell: false })`). Linux's MAX_ARG_STRLEN, a per-argument
+ * limit distinct from the much larger total ARG_MAX, is 128KiB; confirmed on a real
+ * Linux host that a single argv string over it fails execve with E2BIG. Neither the
+ * model's task text nor a SubagentStart hook's additionalContext is capped
+ * upstream, so this is where the assembled string caps itself. The budget leaves
+ * headroom under the hard limit for the "Task: " prefix, the notice below, and
+ * platforms whose limit differs from Linux's. */
+const TASK_ARGV_MAX_BYTES = 96 * 1024
+
 /** The task argument with any SubagentStart hook context ahead of it, per Claude:
  * "added to the subagent's context at the start of its conversation, before its
- * first prompt". */
+ * first prompt". Capped as one combined string, since either the context or the
+ * task alone can already be oversized. */
 export function taskWithStartContext(task: string, contexts: string[]): string {
   const context = contexts.filter(Boolean).join('\n')
-  return context ? `${context}\n\nTask: ${task}` : `Task: ${task}`
+  const assembled = context ? `${context}\n\nTask: ${task}` : `Task: ${task}`
+  if (Buffer.byteLength(assembled, 'utf-8') <= TASK_ARGV_MAX_BYTES) return assembled
+  const kept = sliceBytes(assembled, TASK_ARGV_MAX_BYTES)
+  return `${kept}\n\n[truncated: too long for the child process to receive]`
 }

package/extensions/subagent/index.ts

@@ -56,8 +56,10 @@ export default function subagentExtension(pi: ExtensionAPI) {
 
   const notifyBackgroundCompletion = (run: { id: string; agent: string; state: string; turns: number; output?: string; stderr?: string }): void => {
     // Runs through driveRun's guard, same as the background-mode callback above.
-    // The stop event fires here too, so SubagentStop hooks see resumed runs end.
-    pi.events.emit(SUBAGENT_CHANNEL, { phase: 'stop', agentType: run.agent, agentId: run.id })
+    // The stop event fires here too, so SubagentStop hooks see resumed runs end, and it
+    // carries the run's final assistant text: docs/subagents.md states SubagentStop
+    // receives last_assistant_message unconditionally, and a resumed run is no exception.
+    pi.events.emit(SUBAGENT_CHANNEL, { phase: 'stop', agentType: run.agent, agentId: run.id, lastAssistantMessage: run.output })
     pi.sendMessage({ customType: 'subagent-background', content: backgroundCompletionText(run), display: true }, { triggerTurn: true })
   }