pi-code 1.0.62 → 1.0.64

package/extensions/hooks/matcher.ts

@@ -93,7 +93,13 @@ function isRunnableHook(hook: HookCommand): boolean {
   if (hook.type === 'http') return typeof hook.url === 'string' && /^https?:\/\//.test(hook.url)
   if (hook.type === 'prompt' || hook.type === 'agent') return typeof hook.prompt === 'string' && hook.prompt.length > 0
   if (hook.type === 'mcp_tool') return typeof hook.server === 'string' && typeof hook.tool === 'string'
-  return typeof hook.command === 'string' && (hook.type === undefined || hook.type === 'command')
+  // A command hook needs a non-empty command, and exec-form args must all be strings:
+  // spawn('') throws ERR_INVALID_ARG_VALUE and a number has no replaceAll for argument
+  // substitution, both inside the runner's Promise executor, so the event's handler
+  // rejected instead of the hook reporting spawnFailed.
+  if (typeof hook.command !== 'string' || hook.command.length === 0) return false
+  if (hook.args !== undefined && !(Array.isArray(hook.args) && hook.args.every((arg) => typeof arg === 'string'))) return false
+  return hook.type === undefined || hook.type === 'command'
 }
 
 /** The synthetic identity of a non-shell hook entry: an http/prompt/agent/mcp_tool
@@ -188,18 +194,17 @@ export function passesIfFilter(hook: HookCommand, target: IfFilterTarget | undef
 
 /** One `if` pattern against a call's arguments. Claude evaluates the rule "against
  * the tool name and arguments together" in permission-rule syntax, so each tool uses
- * the same specifier engine its permission rules use:
+ * the same specifier engine its permission rules use: a command pattern for Bash, a
+ * `domain:` host for WebFetch, an agent name for Agent, a skill name for Skill, and a
+ * path rule for the file tools. A tool with no specifier syntax matches nothing,
+ * which is also what an unparseable rule does.
  *
  * PAIRED WITH commands.ts's tool_call guard, which dispatches the same tools to the
  * same matchers for `allowed-tools` scopes. The two are deliberately NOT merged: bash
  * differs on purpose (an allow scope requires every segment to match, an `if` filter is
  * best effort and errs toward running the hook), and merging would hide that. They are
  * two lists that must agree, so a new scoped tool has to be added in both places; the
- * shared roster is ARG_RULE_TOOLS in internal/command-file.ts.
- * a command pattern for Bash, a
- * `domain:` host for WebFetch, an agent name for Agent, a skill name for Skill, and a
- * path rule for the file tools. A tool with no specifier syntax matches nothing,
- * which is also what an unparseable rule does. */
+ * shared roster is ARG_RULE_TOOLS in internal/command-file.ts. */
 function matchesToolPattern(piName: string, input: Record<string, unknown> | null, pattern: string, anchors: PathAnchors): boolean {
   const str = (value: unknown): string => (typeof value === 'string' ? value : '')
   switch (piName) {

package/extensions/hooks/runners.ts

@@ -6,11 +6,11 @@
 
 import { type ChildProcess, spawn } from 'node:child_process'
 import * as fs from 'node:fs'
-import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
 import { runAgent } from '../internal/agent-run.js'
 import { callMcpTool } from '../internal/mcp-call.js'
 import { completeText } from '../internal/model-complete.js'
+import { killProcessTree } from '../internal/process-tree.js'
 import { resolveShell } from '../internal/shell-resolve.js'
 import { errorMessage } from '../internal/values.js'
 import { type HookCommand, httpUrlAllowed, isBackgroundHook } from './config.js'
@@ -41,10 +41,6 @@ export interface HookRunResult {
 }
 /** Runs one configured hook entry, whatever its type; boundRunner dispatches. */
 export type HookRunner = (hook: HookCommand, payload: unknown, timeoutMs: number) => Promise<HookRunResult>
-/** The shell path specifically; the statusline reuses it for its own command. With an
- * `args` array it becomes the exec path: `command` is spawned directly with those args.
- * `onChild` hands the caller a kill for the spawned tree, so a background hook that is
- * still running at session end can be reaped (Claude kills async hooks at teardown). */
 /** How one command hook is spawned, beyond the payload and its budget. Grouped rather
  * than trailing off the parameter list: the exec form, the shell choice and the
  * declaring plugin are all per-hook fields that arrive together from one HookCommand. */
@@ -56,6 +52,10 @@ export interface HookSpawnOptions {
   shell?: string
   /** The declaring plugin's paths, exported to the child. */
   plugin?: { root: string; dataDir: string }
+  /** Claude: "set automatically to the current session ID in ... hook command
+   * subprocesses ... this matches the session_id field in the hook JSON input and
+   * is updated on /clear." Absent in a stub context with no session manager. */
+  sessionId?: string
 }
 
 export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, options?: HookSpawnOptions) => Promise<HookRunResult>
@@ -92,30 +92,9 @@ const MAX_HOOK_OUTPUT = 1_000_000
 /** Conventional exit code for a killed-on-timeout command, as `timeout(1)` reports it. */
 const TIMEOUT_EXIT_CODE = 124
 
-/**
- * Kill the shell and everything it spawned. `sh -c 'a; b'` forks, so signalling the
- * direct child alone leaves a grandchild alive holding stdout/stderr.
- */
+/** Kill the shell and everything it spawned; see internal/process-tree. */
 function killTree(child: ChildProcess): void {
-  if (process.platform === 'win32') {
-    // Windows has no process groups: taskkill /T ends the shell's whole tree. By
-    // absolute path, so a writable PATH entry cannot stand in for it. If taskkill itself
-    // cannot start, the direct kill is all that is left.
-    const taskkill = path.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe')
-    if (child.pid) spawn(taskkill, ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => child.kill('SIGKILL'))
-    else child.kill('SIGKILL')
-    return
-  }
-  try {
-    // Negative pid targets the whole process group, which `detached` gave the shell.
-    if (child.pid) {
-      process.kill(-child.pid, 'SIGKILL')
-      return
-    }
-  } catch {
-    // Group already reaped, or the platform refused it; fall through to the direct kill.
-  }
-  child.kill('SIGKILL')
+  killProcessTree(child, 'SIGKILL')
 }
 
 /** Create the plugin data directory the moment its path is handed to a child. Claude
@@ -136,7 +115,11 @@ function shellInvocation(command: string, shell: string | undefined): { file: st
   return resolved ? { file: resolved.file, spawnArgs: resolved.argsFor(command) } : undefined
 }
 
-export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, { projectDir, args, onChild, shell, plugin } = {}) =>
+/** The shell path specifically; the statusline reuses it for its own command. With an
+ * `args` array it becomes the exec path: `command` is spawned directly with those args.
+ * `onChild` hands the caller a kill for the spawned tree, so a background hook that is
+ * still running at session end can be reaped (Claude kills async hooks at teardown). */
+export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, { projectDir, args, onChild, shell, plugin, sessionId } = {}) =>
   new Promise((resolve) => {
     // /bin/sh by absolute path off Windows, so the shell can't be resolved through an
     // attacker-controlled PATH; on Windows the resolver follows Claude's documented Git
@@ -150,6 +133,11 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, {
     // detection cannot see the captured terminal.
     const env: NodeJS.ProcessEnv = { ...process.env, CLAUDECODE: '1', CLAUDE_CODE_CHILD_SESSION: '1' }
     if (projectDir) env.CLAUDE_PROJECT_DIR = projectDir
+    // Claude: "Claude Code sets this to its own process ID in the subprocesses it
+    // spawns: Bash and PowerShell tool commands and hook commands." Set unconditionally,
+    // since every hook child qualifies.
+    env.CLAUDE_PID = String(process.pid)
+    if (sessionId) env.CLAUDE_CODE_SESSION_ID = sessionId
     // Claude: "All three are exported as environment variables to hook processes and to
     // MCP and LSP server subprocesses", so a plugin script can read them rather than
     // depend on inline substitution. The data directory is "created on first reference",

package/extensions/internal/agent-run.ts

@@ -36,7 +36,7 @@ export function setAgentRunner(fn: AgentRunner | undefined): void {
   runner = fn
 }
 
-/** Whether a runner is registered, so agent hooks can be reported as runnable. */
+/** Test seam: whether a runner is registered. */
 export function hasAgentRunner(): boolean {
   return runner !== undefined
 }

package/extensions/internal/bash-rules.ts

@@ -11,8 +11,7 @@
  */
 
 import { hasSubstitution, splitSegments } from './shell-split.js'
-
-const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
+import { escapeRegExp } from './values.js'
 
 /**
  * One rule against one command segment, per Claude's permission table:

package/extensions/internal/claude-tool-names.ts

@@ -1,13 +1,10 @@
 /**
  * The one place pi tool names and Claude tool names are paired.
  *
- * Two independent tables used to encode this: a Claude->pi map for resolving
- * `allowed-tools` entries, and a pi->Claude map for hook payloads and matchers.
- * They disagreed. The second one listed six tools, so a hook matcher written in
- * Claude's vocabulary never fired for `web_fetch`, `subagent`, `question`, `todo`,
- * `slash_command`, `web_search` or `plan_mode_complete`, even though the first table
- * had known those pairings all along. Both directions now derive from this list, so
- * a tool cannot be nameable in one direction and invisible in the other.
+ * Both directions (the Claude->pi map that resolves `allowed-tools` entries, and the
+ * pi->Claude map behind hook payloads and matchers) derive from this one list, so a
+ * tool cannot be nameable in one direction and invisible in the other: two separate
+ * tables let a hook matcher written in Claude's vocabulary miss seven tools.
  *
  * Canonical names are the tools reference's own spellings. `claude: null` marks a pi
  * tool the reference has no counterpart for: it stays untranslated in payloads, and

package/extensions/internal/command-file.ts

@@ -19,6 +19,7 @@ import * as path from 'node:path'
 import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
 
 import { CLAUDE_TOOL_MAP } from './claude-tool-names.js'
+import { escapeRegExp } from './values.js'
 
 /** The pi file tools a Claude path rule can govern. */
 export type PathRuleTool = 'read' | 'edit' | 'write'
@@ -256,7 +257,7 @@ const text = (value: unknown): string => {
  * number rather than a boolean. A flag that gates a command off from the model has to
  * honor them, or a command the user marked off-limits is silently offered to it. */
 const YAML_TRUE = new Set(['true', 'yes', 'on', 'y', '1'])
-const isFlagEnabled = (value: unknown): boolean => value === true || YAML_TRUE.has(text(value).toLowerCase())
+export const isFlagEnabled = (value: unknown): boolean => value === true || YAML_TRUE.has(text(value).toLowerCase())
 
 /** YAML's negative boolean spellings, the mirror of YAML_TRUE. A flag that defaults to
  * true (user-invocable) is turned off only by one of these; any other value, absent
@@ -332,8 +333,6 @@ function splitArgs(args: string): string[] {
   return out
 }
 
-const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
-
 /** One alternation covering every argument placeholder plus the two escape forms.
  * Alternation order is load-bearing: escapes first (so `\$1` never expands), the
  * bracketed forms before `$ARGUMENTS` (so `$ARGUMENTS[0]` is not read as the bare

package/extensions/internal/external-imports.ts

@@ -11,10 +11,9 @@
  * root, or the resolved working directory outside a repository.
  *
  * The key is the git root and not the project root because a repository must not be
- * able to move its own key. The project root also stops at package.json, so declining
- * at the top of a monorepo and starting the next session inside a package produced a
- * different key and asked again, which is not a decision that was kept. A separate
- * worktree of one repository is a separate checkout and is asked separately.
+ * able to move its own key: `.git` cannot be committed, so nothing a repository ships
+ * changes where its own decisions are stored. A separate worktree of one repository
+ * is a separate checkout and is asked separately.
  */
 
 import * as fs from 'node:fs'
@@ -37,7 +36,7 @@ export function externalImportKey(cwd: string): string {
   }
 }
 
-/** The store file. A seam: the tests point it at a temp directory. */
+/** The store file, inside pi's agent directory (tests relocate that through PI_CODING_AGENT_DIR). */
 export function externalImportStorePath(agentDir: string = getAgentDir()): string {
   return path.join(agentDir, 'pi-code-external-imports.json')
 }

package/extensions/internal/goal-evaluator.ts

@@ -6,6 +6,8 @@
  * so goal.ts stays the lifecycle wiring and each contract is pinned on its own.
  */
 
+import { parseNumericEnv } from './values.js'
+
 /** Claude caps a goal condition at 4,000 characters. */
 export const GOAL_CONDITION_MAX_CHARS = 4000
 
@@ -238,9 +240,8 @@ export const MAX_IDLE_CHECKINS = 3
  * goal: CLAUDE_CODE_GOAL_CHECKIN_MINUTES (0 turns check-ins off, junk falls back to
  * the default) scaled by Claude's doubling. */
 export function checkinIntervalMs(env: Record<string, string | undefined>, delivered: number): number {
-  const raw = env.CLAUDE_CODE_GOAL_CHECKIN_MINUTES
-  const parsed = raw === undefined || raw.trim() === '' ? Number.NaN : Number(raw)
-  const minutes = Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_CHECKIN_MINUTES
+  const parsed = parseNumericEnv(env.CLAUDE_CODE_GOAL_CHECKIN_MINUTES)
+  const minutes = parsed !== undefined && parsed >= 0 ? parsed : DEFAULT_CHECKIN_MINUTES
   return minutes * 60_000 * 2 ** Math.min(delivered, MAX_CHECKIN_DOUBLINGS)
 }
 

package/extensions/internal/instruction-events.ts

@@ -49,11 +49,11 @@ export function memoryTypeForPath(filePath: string, home: string, projectRoot: s
   if (path.basename(filePath) === 'CLAUDE.local.md') return 'Local'
   const isUnder = (root: string): boolean => root.length > 0 && (filePath === root || filePath.startsWith(root + path.sep))
   if (isUnder(projectRoot)) return 'Project'
-  // Monorepo: repoRoot stops at the nearest .git OR package.json, so a git-root
-  // CLAUDE.md can sit above the projectRoot a subpackage session reports. A file
-  // whose directory is a strict ancestor of the project root is still project
-  // memory. The home directory itself stays User: a home-level context file is
-  // user config even when the project lives under home.
+  // Nested repositories: repoRoot stops at the nearest .git, so a session inside a
+  // nested checkout reports it as the project root while the outer repository's
+  // CLAUDE.md sits above it. A file whose directory is a strict ancestor of the
+  // project root is still project memory. The home directory itself stays User: a
+  // home-level context file is user config even when the project lives under home.
   const dir = path.dirname(filePath)
   if (dir !== home && (projectRoot === dir || projectRoot.startsWith(dir + path.sep))) return 'Project'
   if (isUnder(home)) return 'User'

package/extensions/internal/managed-settings.ts

@@ -17,7 +17,7 @@ import { isRecord } from './values.js'
 /** The OS managed-settings.json path Claude Code documents per platform. */
 export function managedSettingsPath(platform: NodeJS.Platform = process.platform): string {
   if (platform === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json'
-  // The legacy C:\ProgramData\ClaudeCode path was dropped in Claude Code v2.1.75.
+  // Claude reads the Windows file from Program Files; the older ProgramData location is not consulted.
   if (platform === 'win32') return String.raw`C:\Program Files\ClaudeCode\managed-settings.json`
   return '/etc/claude-code/managed-settings.json'
 }

package/extensions/internal/mcp-oauth.ts

@@ -61,8 +61,8 @@ function storeFileFor(serverName: string, endpoint?: string): string {
     .digest('hex')
     .slice(0, 8)
   // Collapse disallowed runs to a single hyphen, then strip leading and trailing
-  // hyphens by index. The old /^-+|-+$/g trim rescanned on every hyphen of a long run
-  // (its trailing-anchored branch backtracks per start position), which is quadratic.
+  // hyphens by index: a trailing-anchored regex trim rescans per hyphen of a long run
+  // (quadratic).
   const collapsed = serverName.replace(/[^A-Za-z0-9_-]+/g, '-')
   let start = 0
   let end = collapsed.length
@@ -72,6 +72,14 @@ function storeFileFor(serverName: string, endpoint?: string): string {
   return path.join(getAgentDir(), 'mcp-oauth', `${safe}-${digest}.json`)
 }
 
+/** MCP_OAUTH_CALLBACK_PORT parsed, or undefined when unset or not a plain integer. */
+function envCallbackPort(): number | undefined {
+  const raw = process.env.MCP_OAUTH_CALLBACK_PORT
+  if (raw === undefined || raw.trim() === '') return undefined
+  const parsed = Number(raw)
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : undefined
+}
+
 export class FileOAuthProvider implements OAuthClientProvider {
   private readonly storePath: string
   private readonly data: StoredAuth
@@ -107,15 +115,19 @@ export class FileOAuthProvider implements OAuthClientProvider {
   }
 
   /** The configured callbackPort alone, absent when only a remembered port exists.
-   * The caller needs the two apart: a configured port is a hard requirement. */
+   * The caller needs the two apart: a configured port is a hard requirement. Falls
+   * back to MCP_OAUTH_CALLBACK_PORT, Claude's "alternative to --callback-port when
+   * adding an MCP server with pre-configured credentials"; pi-code has no `mcp add`
+   * command, so the env var applies as a default for any server naming no port of
+   * its own rather than only ones added that way. */
   configuredRedirectPort(): number | undefined {
-    return this.oauth?.callbackPort
+    return this.oauth?.callbackPort ?? envCallbackPort()
   }
 
   /** The configured callbackPort (Claude: for pre-registered redirect URIs), else
    * the port a prior login registered, so a re-login can bind the same one. */
   savedRedirectPort(): number | undefined {
-    return this.oauth?.callbackPort ?? this.data.redirectPort
+    return this.oauth?.callbackPort ?? envCallbackPort() ?? this.data.redirectPort
   }
 
   /** Record the loopback port the callback server actually bound; the redirect
@@ -236,7 +248,17 @@ export function waitForAuthCode(server: http.Server, timeoutMs: number, expected
     // abandoned or resolved out of band, the event loop can still drain.
     timer.unref?.()
     server.on('request', (request, response) => {
-      const url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      // Node's parser passes an absolute-form target through unvalidated, and a throw
+      // from a 'request' listener is not caught by node:http: it was an
+      // uncaughtException during the login window, from any local process that could
+      // reach the port.
+      let url: URL
+      try {
+        url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      } catch {
+        response.writeHead(400).end()
+        return
+      }
       // Only the redirect path settles the login. A stray request (a favicon fetch, a
       // local port scan, or a forged redirect from another process or an open web page)
       // is answered but ignored, so it can neither inject a code nor abort the login by

package/extensions/internal/model-complete.ts

@@ -59,7 +59,13 @@ export interface CompleteOptions {
  * tool call, only assistant text.
  */
 export async function completeText(model: Model<Api>, prompt: string, options: CompleteOptions = {}): Promise<{ text: string; usage: Usage }> {
-  backend ??= realBackend()
+  // A rejected creation must not stay cached: ModelRuntime.create can fail on a
+  // transient (a credential store read), and caching that promise made every later
+  // call rethrow the same stale error for the life of the process.
+  backend ??= realBackend().catch((error: unknown) => {
+    backend = null
+    throw error
+  })
   const complete = await backend
   const context: Context = {
     systemPrompt: options.system,

package/extensions/internal/model-lookup.ts

@@ -11,10 +11,17 @@ export interface ModelLookupContext<M> {
   modelRegistry?: { getAvailable?: () => ReadonlyArray<{ id: string; name?: string }> }
 }
 
+/** The one fuzzy model rule every surface shares (goal, prompt hooks, commands,
+ * subagent aliases): an exact id (case-insensitive) first, then a substring of the
+ * id or the display name. Three private copies had diverged, so `model: opus` could
+ * resolve differently per surface. */
+export function findModel<M extends { id: string; name?: string }>(needle: string, available: ReadonlyArray<M>): M | undefined {
+  const wanted = needle.toLowerCase()
+  return available.find((model) => model.id.toLowerCase() === wanted) ?? available.find((model) => model.id.toLowerCase().includes(wanted) || model.name?.toLowerCase().includes(wanted))
+}
+
 export function resolveModelOverride<M>(ctx: ModelLookupContext<M>, override: string | undefined): M | undefined {
   if (!override) return ctx.model
   const available = ctx.modelRegistry?.getAvailable?.() ?? []
-  const needle = override.toLowerCase()
-  const match = available.find((model) => model.id.toLowerCase() === needle) ?? available.find((model) => model.id.toLowerCase().includes(needle) || model.name?.toLowerCase().includes(needle))
-  return (match as M | undefined) ?? ctx.model
+  return (findModel(override, available) as M | undefined) ?? ctx.model
 }

package/extensions/internal/path-rules.ts

@@ -14,6 +14,7 @@
  */
 
 import * as path from 'node:path'
+import { escapeRegExp } from './values.js'
 
 export interface PathAnchors {
   cwd: string
@@ -21,8 +22,6 @@ export interface PathAnchors {
   home: string
 }
 
-const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
-
 /** Cap on brace-expanded alternatives per pattern, mirroring Claude's ~1000
  * budget; an over-budget pattern is used unexpanded. */
 const BRACE_EXPANSION_LIMIT = 1000
@@ -96,10 +95,29 @@ function bracketEnd(pattern: string, start: number): number {
 
 /** A bracket expression body as a regex character class, escaping regex-relevant
  * characters while keeping `-` ranges; a leading `!` (or `^`) negates. */
-function bracketClass(body: string): string {
+function bracketClass(body: string): string | null {
   const negated = body.startsWith('!') || body.startsWith('^')
   const members = (negated ? body.slice(1) : body).replace(/[\\\]^]/g, (ch) => `\\${ch}`)
-  return `[${negated ? '^' : ''}${members}]`
+  const source = `[${negated ? '^' : ''}${members}]`
+  // A range whose endpoints descend, `["- ]` for instance, is not a character class
+  // JavaScript will build: RegExp throws "Range out of order in character class". The
+  // `-` cannot simply be escaped, since `[a-z]` is the whole point of the syntax, so the
+  // class is validated by construction and an unbuildable one is treated exactly as an
+  // unterminated `[` already is: the pattern is invalid and matches nothing. It must
+  // not throw: compileGlobs does not catch, and the permission check that called it
+  // would fail with it.
+  return isBuildableClass(source) ? source : null
+}
+
+/** Whether JavaScript will build this character class. Asking RegExp is the only
+ * faithful test: the invalid forms are its rules, not ones worth re-deriving here. */
+function isBuildableClass(source: string): boolean {
+  try {
+    new RegExp(source)
+    return true
+  } catch {
+    return false
+  }
 }
 
 /** A `*` run starting at `i`: a double star followed by a slash spans whole
@@ -114,39 +132,33 @@ function translateStar(pattern: string, i: number): { source: string; next: numb
   return { source: '[^/]*', next: i + 1 }
 }
 
+/** The regex source for the construct at `i` and the index after it, or null when the
+ * pattern is invalid there and so matches nothing. */
+function translateAt(pattern: string, i: number): { source: string; next: number } | null {
+  const ch = pattern[i]
+  // Claude: to match a literal bracket, escape it; the escape consumes both chars.
+  if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) return { source: escapeRegExp(pattern[i + 1]), next: i + 2 }
+  // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be read
+  // as one, or a body that is not a buildable class, makes the pattern invalid.
+  if (ch === '[') {
+    const end = bracketEnd(pattern, i)
+    if (end === -1) return null
+    const cls = bracketClass(pattern.slice(i + 1, end))
+    return cls === null ? null : { source: cls, next: end + 1 }
+  }
+  if (ch === '*') return translateStar(pattern, i)
+  if (ch === '?') return { source: '[^/]', next: i + 1 }
+  return { source: escapeRegExp(ch), next: i + 1 }
+}
+
 function translateGlob(pattern: string): string | null {
   let out = ''
   let i = 0
   while (i < pattern.length) {
-    const ch = pattern[i]
-    // Claude: to match a literal bracket, escape it; the escape consumes both chars.
-    if (ch === '\\' && (pattern[i + 1] === '[' || pattern[i + 1] === ']')) {
-      out += escapeRegExp(pattern[i + 1])
-      i += 2
-      continue
-    }
-    // Claude: `[` starts a bracket expression such as `[abc]`; a `[` that cannot be
-    // read as one makes the pattern invalid, matching nothing.
-    if (ch === '[') {
-      const end = bracketEnd(pattern, i)
-      if (end === -1) return null
-      out += bracketClass(pattern.slice(i + 1, end))
-      i = end + 1
-      continue
-    }
-    if (ch === '*') {
-      const star = translateStar(pattern, i)
-      out += star.source
-      i = star.next
-      continue
-    }
-    if (ch === '?') {
-      out += '[^/]'
-      i += 1
-      continue
-    }
-    out += escapeRegExp(ch)
-    i += 1
+    const step = translateAt(pattern, i)
+    if (step === null) return null
+    out += step.source
+    i = step.next
   }
   return out
 }
@@ -183,9 +195,7 @@ function resolveRule(rule: string, anchors: PathAnchors): string {
   return path.join(anchors.cwd, rel)
 }
 
-/** One rule glob precompiled for repeated matching: its anchored regex, and whether
- * it applies to the basename (a slashless pattern, gitignore-style) or the full
- * root-relative path. */
+/** One rule glob precompiled for repeated matching: its anchored regex. */
 export interface CompiledGlob {
   regex: RegExp
 }
@@ -199,13 +209,13 @@ export function globCompileStats(): { compiled: number; evaluated: number } {
   return { compiled: globsCompiled, evaluated: globsEvaluated }
 }
 
-/** Rule `paths:` globs compiled once for repeated matching, with claude-rules'
- * pathMatchesGlobs semantics: `./` and leading `/` anchors are stripped, a trailing
- * slash scopes to the directory's contents, and blank entries drop out. */
 /** Claude's shared list budget: rule patterns past ~1000 compiled entries are
  * ignored rather than compiled without bound. */
 const LIST_PATTERN_BUDGET = 1000
 
+/** Rule `paths:` globs compiled once for repeated matching, with claude-rules'
+ * pathMatchesGlobs semantics: `./` and leading `/` anchors are stripped, a trailing
+ * slash scopes to the directory's contents, and blank entries drop out. */
 export function compileGlobs(globs: string[]): CompiledGlob[] {
   const compiled: CompiledGlob[] = []
   for (const raw of globs) {
@@ -231,8 +241,6 @@ export function matchesCompiledGlobs(relPath: string, globs: CompiledGlob[]): bo
   return globs.some((glob) => glob.regex.test(posix))
 }
 
-/** Whether the accessed file matches at least one rule. No rules means no match:
- * a granted-but-scoped tool with an empty scope set stays blocked, never open. */
 /** Both comparison sides in posix form. On Windows, resolve stamps the drive on
  * the target while join-built rules stay drive-less, and backslash separators
  * collide with glob syntax, so unnormalized rules could never match. */
@@ -260,6 +268,8 @@ export function stripRuleDrive(rule: string, windows: boolean): string {
   return rule.replace(/^([A-Za-z]):\//, '/').replace(/^\/[A-Za-z]\//, '/')
 }
 
+/** Whether the accessed file matches at least one rule. No rules means no match:
+ * a granted-but-scoped tool with an empty scope set stays blocked, never open. */
 export function matchesPathRules(filePath: string, rules: string[], anchors: PathAnchors): boolean {
   const target = toPosix(path.resolve(anchors.cwd, filePath))
   return rules.some((rule) => {

package/extensions/internal/plugins.ts

@@ -258,11 +258,6 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
   return { name, root, dataDir: path.join(claudeConfigDir(home), 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) }
 }
 
-/** The two plugin path variables, textually substituted into plugin-shipped
- * config (hook commands, MCP server definitions, command bodies). A caller
- * substituting into text that is still raw JSON must pass an escapeValue that
- * JSON-escapes: a Windows root (C:\Users\...) inserted verbatim injects invalid
- * escape sequences and the subsequent parse throws. */
 /** A plugin component path, resolved inside the plugin root. Claude "rejects a component
  * path that resolves outside the plugin root, such as `../shared-utils`", so an escaping
  * entry yields undefined and its caller skips that component. The check is lexical, which
@@ -277,6 +272,11 @@ export function pluginComponentPath(plugin: Pick<InstalledPlugin, 'name' | 'root
   return resolved
 }
 
+/** The two plugin path variables, textually substituted into plugin-shipped
+ * config (hook commands, MCP server definitions, command bodies). A caller
+ * substituting into text that is still raw JSON must pass an escapeValue that
+ * JSON-escapes: a Windows root (C:\Users\...) inserted verbatim injects invalid
+ * escape sequences and the subsequent parse throws. */
 export function substitutePluginVars(value: string, plugin: InstalledPlugin, escapeValue: (substituted: string) => string = (substituted) => substituted): string {
   return value
     .replaceAll('${CLAUDE_PLUGIN_ROOT}', escapeValue(plugin.root))

package/extensions/internal/process-tree.ts

@@ -0,0 +1,39 @@
+/**
+ * Kill a detached child and everything it spawned. `sh -c 'a; b'` forks, and so does
+ * a child pi running a build, so signalling the direct child alone leaves a grandchild
+ * alive holding stdout/stderr. One copy for hooks and both subagent runners: the three
+ * private copies had drifted, and only the hooks one handled Windows, so a subagent
+ * cancel there killed the direct child only.
+ */
+
+import { type ChildProcess, spawn } from 'node:child_process'
+import * as path from 'node:path'
+
+export function killProcessTree(child: ChildProcess, signal: NodeJS.Signals, platform: NodeJS.Platform = process.platform): void {
+  if (platform === 'win32') {
+    // Windows has no process groups: taskkill /T ends the whole tree, and it has no
+    // graceful signal, so SIGTERM and SIGKILL both force. By absolute path, so a
+    // writable PATH entry cannot stand in for it. If taskkill itself cannot start, or
+    // there is no pid to hand it, the direct kill with the requested signal is all
+    // that is left (Node maps either signal to TerminateProcess there).
+    const taskkill = path.join(process.env.SystemRoot ?? String.raw`C:\Windows`, 'System32', 'taskkill.exe')
+    if (child.pid) spawn(taskkill, ['/pid', String(child.pid), '/T', '/F'], { stdio: 'ignore', windowsHide: true }).on('error', () => child.kill(signal))
+    else child.kill(signal)
+    return
+  }
+  try {
+    // Negative pid targets the whole process group, which `detached` gave the child.
+    // A child that never spawned has no pid and no group; the direct kill is all there is.
+    if (child.pid) {
+      process.kill(-child.pid, signal)
+      return
+    }
+  } catch {
+    // Group already reaped, or the platform refused it; fall through to the direct kill.
+  }
+  try {
+    child.kill(signal)
+  } catch {
+    // already gone
+  }
+}

package/extensions/internal/project-approval.ts

@@ -118,13 +118,6 @@ function runtimeLacksProjectTrust(ctx: { isProjectTrusted?: () => boolean; ui?:
   return true
 }
 
-/**
- * Whether project-controlled config may be acted on.
- *
- * Refuses without a UI rather than deferring: pi reached this point without consulting
- * `defaultProjectTrust` at all, so there is no user preference to fall back on. A run
- * that cannot ask has not been approved.
- */
 /** The same decision as isProjectApproved, but never prompts: an undecided project
  * reads as unapproved. For surfaces that only display project config, like the
  * subagent roster, where a mid-turn dialog would be wrong. */
@@ -150,6 +143,13 @@ export function isGatedFileApproved(ctx: Pick<ApprovalContext, 'cwd' | 'isProjec
   return isProjectApprovedSilently(ctx, { ...deps, hasClaudeShaped: () => true })
 }
 
+/**
+ * Whether project-controlled config may be acted on.
+ *
+ * Refuses without a UI rather than deferring: pi reached this point without consulting
+ * `defaultProjectTrust` at all, so there is no user preference to fall back on. A run
+ * that cannot ask has not been approved.
+ */
 export async function isProjectApproved(ctx: ApprovalContext, deps: ApprovalDeps = defaultDeps): Promise<boolean> {
   if (runtimeLacksProjectTrust(ctx)) return false // pi predates project-trust support
   if (ctx.isProjectTrusted?.() !== true) return false // pi declined trust for this project