pi-code 1.0.62 → 1.0.64

package/extensions/output-styles.ts

@@ -22,14 +22,15 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import { type ExtensionAPI, parseFrontmatter } from '@earendil-works/pi-coding-agent'
 import { atomicWriteFile } from './internal/atomic-write.js'
+import { isFlagEnabled } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
-import { ancestorDirs, findNearestDir, findNearestFile } from './internal/project-root.js'
-import { claudeSettingsChain, readSettingsChain } from './internal/settings-chain.js'
+import { ancestorDirs } from './internal/project-root.js'
+import { claudeSettingsChain, localSettingsFile, readSettingsChain } from './internal/settings-chain.js'
 import { isDirectory } from './internal/values.js'
 
 export interface OutputStyle {
@@ -41,22 +42,27 @@ export interface OutputStyle {
   forceForPlugin: boolean
 }
 
-function field(frontmatter: string, key: string): string {
-  const match = new RegExp(String.raw`^\s*${key}\s*:\s*(.+)$`, 'm').exec(frontmatter)
-  return match ? match[1].trim().replace(/^["']|["']$/g, '') : ''
+/** A frontmatter field as text, or '' when absent or not scalar. */
+function field(frontmatter: Record<string, unknown>, key: string): string {
+  const value = frontmatter[key]
+  if (typeof value === 'string') return value.trim()
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value)
+  return ''
 }
 
-/** Parse an output-style markdown file into its name, description, and body. */
+/** Parse an output-style markdown file into its name, description, and body. pi's
+ * own YAML frontmatter parser, as the command loader uses: a line regex captured to
+ * end of line, so `"Terse" # short` came back as `Terse" # short`. */
 export function parseStyle(content: string, fallbackName: string): OutputStyle {
-  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content)
-  const frontmatter = match ? match[1] : ''
-  const body = match ? content.slice(match[0].length) : content
+  const { frontmatter, body } = parseFrontmatter(content)
   return {
     name: field(frontmatter, 'name') || fallbackName,
     description: field(frontmatter, 'description'),
     body: body.trim(),
-    keepCodingInstructions: field(frontmatter, 'keep-coding-instructions') === 'true',
-    forceForPlugin: field(frontmatter, 'force-for-plugin') === 'true',
+    // Both are YAML booleans (Claude: default `false`), so `yes`/`on`/`True` count as
+    // set, the same reading commands give their own frontmatter flags.
+    keepCodingInstructions: isFlagEnabled(field(frontmatter, 'keep-coding-instructions')),
+    forceForPlugin: isFlagEnabled(field(frontmatter, 'force-for-plugin')),
   }
 }
 
@@ -202,11 +208,10 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
     // Precedence low to high: builtin, plugin, then the user's and project's own
     // dirs, so a same-named user or project style overrides a plugin's.
     styles = loadStyles([BUILTIN_STYLES_DIR, ...pluginStyleDirs(home), ...styleDirs(ctx.cwd, home, trusted)])
-    // Persist the choice where the read chain will find it again: the nearest local
-    // settings file, else inside the nearest .claude directory, else at cwd.
-    const nearestLocal = findNearestFile(ctx.cwd, path.join('.claude', 'settings.local.json'))
-    const claudeDir = findNearestDir(ctx.cwd, '.claude') ?? path.join(ctx.cwd, '.claude')
-    localSettingsPath = nearestLocal ?? path.join(claudeDir, 'settings.local.json')
+    // Persist the choice to the file the read chain reads last, so it is read back:
+    // the nearest local file or .claude directory could sit at an intermediate
+    // ancestor the chain never consults.
+    localSettingsPath = localSettingsFile(ctx.cwd, home)
     // Claude's force-for-plugin: the first loaded forced plugin style applies
     // automatically, overriding the outputStyle setting.
     const forced = forcedPluginStyle(loadStyles(pluginStyleDirs(home)))

package/extensions/question.ts

@@ -6,9 +6,14 @@
  * Multiple questions per call are not batched; ask sequentially.
  */
 
+import * as os from 'node:os'
+import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext, Theme } from '@earendil-works/pi-coding-agent'
 import { Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth } from '@earendil-works/pi-tui'
 import { Type } from 'typebox'
+import { claudeConfigDir } from './internal/config-dir.js'
+import { readManagedSettings } from './internal/managed-settings.js'
+import { readSettingsFile } from './internal/settings-chain.js'
 
 interface OptionWithDesc {
   label: string
@@ -24,6 +29,8 @@ interface QuestionDetails {
   answer: string | null
   wasCustom?: boolean
   multiSelect?: boolean
+  /** Auto-continued on askUserQuestionTimeout rather than answered or cancelled. */
+  timedOut?: boolean
 }
 
 // Options with labels and optional descriptions
@@ -70,6 +77,28 @@ function questionList(params: Partial<QuestionSpec> & { questions?: QuestionSpec
 const HEADER_MAX = 12
 export const shortHeader = (header: string | undefined): string | undefined => (header === undefined ? undefined : header.slice(0, HEADER_MAX))
 
+/** Claude's three accepted askUserQuestionTimeout spellings (`60s`, `5m`, `10m`), as
+ * milliseconds. Anything else, including unset, means no auto-continue. */
+export function parseAskUserQuestionTimeout(value: unknown): number | undefined {
+  if (typeof value !== 'string') return undefined
+  const match = /^(\d+)([sm])$/.exec(value.trim())
+  if (!match) return undefined
+  const amount = Number(match[1])
+  return match[2] === 's' ? amount * 1000 : amount * 60 * 1000
+}
+
+/** Claude scopes askUserQuestionTimeout to "User or managed": a project's own
+ * settings.json cannot set it, so a checked-out repository can never make the
+ * user's own dialogs auto-answer themselves. Managed wins over the user's file, as
+ * every managed setting does. `home` defaults to the real one and is a parameter
+ * only so a test can point it at a fixture without mocking node:os. */
+export function askUserQuestionTimeoutMs(home: string = os.homedir()): number | undefined {
+  const managed = readManagedSettings() as { askUserQuestionTimeout?: unknown }
+  const fromManaged = parseAskUserQuestionTimeout(managed.askUserQuestionTimeout)
+  if (fromManaged !== undefined) return fromManaged
+  return parseAskUserQuestionTimeout(readSettingsFile(path.join(claudeConfigDir(home), 'settings.json'))?.askUserQuestionTimeout)
+}
+
 function checkbox(checked: boolean | undefined): string {
   if (checked === undefined) return ''
   return checked ? '[x] ' : '[ ] '
@@ -98,10 +127,13 @@ interface QuestionView {
   checked: boolean[]
   editor: Editor
   theme: Theme
+  /** Claude: "You see a countdown for the last 20 seconds." Undefined the rest of
+   * the idle window, and always when there is no configured timeout at all. */
+  countdownSeconds?: number
 }
 
 function buildQuestionLines(view: QuestionView): string[] {
-  const { width, question, header, options, optionIndex, editMode, multiSelect, checked, editor, theme } = view
+  const { width, question, header, options, optionIndex, editMode, multiSelect, checked, editor, theme, countdownSeconds } = view
   const lines: string[] = []
   const add = (s: string) => lines.push(truncateToWidth(s, width))
 
@@ -129,6 +161,9 @@ function buildQuestionLines(view: QuestionView): string[] {
 
   lines.push('')
   add(theme.fg('dim', navHint(editMode, multiSelect)))
+  if (countdownSeconds !== undefined) {
+    add(theme.fg('warning', ` Auto-continuing in ${countdownSeconds}s if idle · press any key to stay`))
+  }
   add(theme.fg('accent', '─'.repeat(width)))
 
   return lines
@@ -202,6 +237,11 @@ export default function question(pi: ExtensionAPI) {
         return new Text(theme.fg('warning', 'Cancelled'), 0, 0)
       }
 
+      if (details.timedOut) {
+        const already = details.answer ? theme.fg('muted', ` (already selected: ${details.answer})`) : ''
+        return new Text(theme.fg('warning', '⏱ Auto-continued (no response)') + already, 0, 0)
+      }
+
       if (details.wasCustom) {
         return new Text(theme.fg('success', '✓ ') + theme.fg('muted', '(wrote) ') + theme.fg('accent', details.answer), 0, 0)
       }
@@ -240,8 +280,10 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
 
   // ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it resolves
   // undefined immediately, which would read as a cancel without ever asking. Ask
-  // through the dialog primitives there instead.
-  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect) : await askViaDialogs(params, ctx, allOptions, multiSelect)
+  // through the dialog primitives there instead. askUserQuestionTimeout is a TUI
+  // concept (a countdown, a keypress resetting it): the dialog-primitive fallback
+  // has no keyboard or visible countdown to drive it, so it is not applied there.
+  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect, askUserQuestionTimeoutMs()) : await askViaDialogs(params, ctx, allOptions, multiSelect)
 
   // Build simple options list for details; header/multiSelect appear only when set,
   // so single-select details are unchanged.
@@ -255,6 +297,18 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
     }
   }
 
+  if (result.timedOut) {
+    // Claude: "tells Claude you may be away from your keyboard, so Claude proceeds
+    // on its own judgment and can re-ask later." Not framed as a cancel: `answer` is
+    // '' rather than null, so renderResult and a batch's own null-check both read it
+    // as "answered nothing, but not declined" rather than the user having said no.
+    const already = multiSelect && result.answer ? ` Already selected: ${result.answer}.` : ''
+    return {
+      content: [{ type: 'text', text: `No response after the configured idle timeout; the user may be away from the keyboard.${already} Proceed on your own judgment; you can ask again later if needed.` }],
+      details: { ...base, answer: result.answer, timedOut: true } as QuestionDetails,
+    }
+  }
+
   if (result.wasCustom) {
     return {
       content: [{ type: 'text', text: `User wrote: ${result.answer}` }],
@@ -268,15 +322,82 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
   }
 }
 
-/** Terminal path: the full custom overlay (options list, checkboxes, inline editor). */
-function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
-  return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number } | null) => void) => {
+/** Claude: "You see a countdown for the last 20 seconds." */
+const COUNTDOWN_WINDOW_MS = 20_000
+/** Granularity of the idle-timer tick: fine enough that the countdown's displayed
+ * second changes on time, coarse enough not to re-render needlessly often. */
+const IDLE_TICK_MS = 250
+
+/** Terminal path: the full custom overlay (options list, checkboxes, inline editor).
+ *
+ * `timeoutMs`, when set, is Claude's askUserQuestionTimeout: "After a question sits
+ * that long with no input, the dialog closes on its own: it submits any options
+ * you'd already selected and tells Claude you may be away from your keyboard, so
+ * Claude proceeds on its own judgment and can re-ask later. You see a countdown for
+ * the last 20 seconds. Press any key to restart the timer." Terminal focus-in
+ * restarting the timer, the other documented reset trigger, is not implemented:
+ * pi's TUI input stream is not confirmed to carry the terminal's own focus-report
+ * escape sequences, and guessing at that risks misreading ordinary input as a
+ * focus event on a terminal that reports it differently. Exported so the timer
+ * mechanics are testable directly, independent of where timeoutMs itself is read
+ * from (askUserQuestionTimeoutMs, tested separately).
+ */
+export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean, timeoutMs?: number): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
+  return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null) => void) => {
     let optionIndex = 0
     let editMode = false
     const checked: boolean[] = allOptions.map(() => false)
     let cachedLines: string[] | undefined
     let cachedWidth: number | undefined
 
+    // deadline stays undefined for the whole overlay life when no timeout is
+    // configured, so every idle-timer branch below is a no-op in that case.
+    let deadline: number | undefined = timeoutMs !== undefined ? Date.now() + timeoutMs : undefined
+    let idleTimer: ReturnType<typeof setInterval> | undefined
+    let lastCountdown: number | undefined
+
+    function stopIdleTimer(): void {
+      if (idleTimer !== undefined) clearInterval(idleTimer)
+      idleTimer = undefined
+    }
+
+    /** Every exit path (an answer, a cancel, or the timeout itself) goes through
+     * here, so the interval can never outlive the overlay it belongs to. */
+    function finish(value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null): void {
+      stopIdleTimer()
+      done(value)
+    }
+
+    function resetIdleTimer(): void {
+      if (timeoutMs === undefined) return
+      deadline = Date.now() + timeoutMs
+    }
+
+    function fireTimeout(): void {
+      // Claude: "submits any options you'd already selected". Single-select has
+      // nothing pre-committed (a selection only exists once Enter confirms it), so
+      // its timeout answer is empty rather than whatever option merely had focus.
+      const answer = multiSelect ? selectedLabels(allOptions, checked) : ''
+      finish({ answer, wasCustom: false, timedOut: true })
+    }
+
+    if (timeoutMs !== undefined) {
+      idleTimer = setInterval(() => {
+        if (deadline === undefined) return
+        const remainingMs = deadline - Date.now()
+        if (remainingMs <= 0) {
+          fireTimeout()
+          return
+        }
+        const remainingSeconds = Math.ceil(remainingMs / 1000)
+        const nextCountdown = remainingMs <= COUNTDOWN_WINDOW_MS ? remainingSeconds : undefined
+        if (nextCountdown !== lastCountdown) {
+          lastCountdown = nextCountdown
+          refresh()
+        }
+      }, IDLE_TICK_MS)
+    }
+
     const editorTheme: EditorTheme = {
       borderColor: (s) => theme.fg('accent', s),
       selectList: {
@@ -292,7 +413,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
     editor.onSubmit = (value) => {
       const trimmed = value.trim()
       if (trimmed) {
-        done({ answer: trimmed, wasCustom: true })
+        finish({ answer: trimmed, wasCustom: true })
       } else {
         editMode = false
         editor.setText('')
@@ -306,6 +427,11 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
     }
 
     function handleInput(data: string) {
+      // Claude: "Press any key to restart the timer." Every branch below returns
+      // through this function, so resetting unconditionally on entry covers all of
+      // them, including the ones (arrow keys, space) that never reach `finish`.
+      resetIdleTimer()
+
       if (editMode) {
         if (matchesKey(data, Key.escape)) {
           editMode = false
@@ -337,7 +463,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
 
       if (matchesKey(data, Key.enter)) {
         if (multiSelect) {
-          done({ answer: selectedLabels(allOptions, checked), wasCustom: false })
+          finish({ answer: selectedLabels(allOptions, checked), wasCustom: false })
           return
         }
         const selected = allOptions[optionIndex]
@@ -345,20 +471,20 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
           editMode = true
           refresh()
         } else {
-          done({ answer: selected.label, wasCustom: false, index: optionIndex + 1 })
+          finish({ answer: selected.label, wasCustom: false, index: optionIndex + 1 })
         }
         return
       }
 
       if (matchesKey(data, Key.escape)) {
-        done(null)
+        finish(null)
       }
     }
 
     function render(width: number): string[] {
       if (cachedLines && cachedWidth === width) return cachedLines
       cachedWidth = width
-      cachedLines = buildQuestionLines({ width, question: params.question, header: shortHeader(params.header), options: allOptions, optionIndex, editMode, multiSelect, checked, editor, theme })
+      cachedLines = buildQuestionLines({ width, question: params.question, header: shortHeader(params.header), options: allOptions, optionIndex, editMode, multiSelect, checked, editor, theme, countdownSeconds: lastCountdown })
       return cachedLines
     }
 
@@ -369,6 +495,10 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
         cachedLines = undefined
       },
       handleInput,
+      // Belt and suspenders alongside finish()'s own stopIdleTimer: if the host ever
+      // tears the overlay down through a path that does not go through `done`
+      // (finish's only caller), the interval still gets cleared here.
+      dispose: stopIdleTimer,
     }
   })
 }
@@ -376,7 +506,7 @@ function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions:
 /** Dialog-primitive fallback for UI without a terminal (RPC mode supports
  * select/input/notify but not custom components). Mirrors the overlay's result
  * shape; a dismissed dialog reads as a cancel, same as Escape in the overlay. */
-async function askViaDialogs(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number } | null> {
+async function askViaDialogs(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
   const header = shortHeader(params.header)
   const title = header ? `[${header}] ${params.question}` : params.question
   // Number the labels: ctx.ui.select returns the chosen label string, so duplicate

package/extensions/session-title.ts

@@ -93,6 +93,11 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
   })
 
   pi.on('agent_settled', async (_event, ctx) => {
+    // Claude: "Set to 1 to disable automatic terminal title updates based on conversation
+    // context. In Agent SDK and claude -p sessions, this also skips the background
+    // small/fast-model request that generates the session title." setSessionName is pi's
+    // only title sink, so skipping the call here skips both effects at once.
+    if (process.env.CLAUDE_CODE_DISABLE_TERMINAL_TITLE === '1') return
     if (titled) return
     // Never clobber an existing name: a user-chosen or resumed name wins.
     if (pi.getSessionName?.()) return

package/extensions/skills.ts

@@ -35,10 +35,6 @@ import { claudeSettingsChain, readSettingsChain } from './internal/settings-chai
 import { SKILL_HOOKS_CHANNEL } from './internal/skill-hooks.js'
 import { errorMessage, isDirectory, isRecord } from './internal/values.js'
 
-/** Existing `.claude/skills` directories, user first then project. The project
- * directory is included only for approved projects: pi's loader surfaces every skill's
- * name and description to the model, so an untrusted repository would otherwise get
- * text into the prompt without the user ever agreeing to load its config. */
 /** The extra skill directories a manifest declares, as a list. A string is one entry,
  * a list is itself, anything else declares none. */
 function declaredSkillDirs(declared: unknown): string[] {
@@ -46,11 +42,20 @@ function declaredSkillDirs(declared: unknown): string[] {
   return typeof declared === 'string' ? [declared] : []
 }
 
+/** Existing `.claude/skills` directories, user first then project. The project
+ * directory is included only for approved projects: pi's loader surfaces every skill's
+ * name and description to the model, so an untrusted repository would otherwise get
+ * text into the prompt without the user ever agreeing to load its config. */
 export function skillDirs(cwd: string, home: string, trusted: boolean): string[] {
   // Claude's precedence: enterprise (the skills directory beside the managed
   // settings file) overrides personal, and personal overrides project; discovery
   // here is first-match, so higher precedence goes first.
-  const candidates = [path.join(path.dirname(managedSettingsFile()), '.claude', 'skills'), path.join(claudeConfigDir(home), 'skills')]
+  // Claude: "Set to 1 to skip loading skills from the system-wide managed skills
+  // directory. Useful for container or CI sessions that should not load
+  // operator-provisioned skills." The enterprise dir beside managed-settings.json is
+  // that directory here; personal and project skills are unaffected.
+  const enterprise = process.env.CLAUDE_CODE_DISABLE_POLICY_SKILLS === '1' ? [] : [path.join(path.dirname(managedSettingsFile()), '.claude', 'skills')]
+  const candidates = [...enterprise, path.join(claudeConfigDir(home), 'skills')]
   // Enabled plugins contribute their skills directories. pi's loader names a
   // skill by its directory, so a plugin skill registers without Claude's
   // /plugin: prefix; a rename-free approximation, disclosed in the README.
@@ -108,7 +113,7 @@ function skillAt(root: string, dirName: string): { name: string; filePath: strin
 
 /** A Claude-contributed skill by the name pi's loader gives it. One directory
  * level, the standard layout. */
-export function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined {
+function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined {
   for (const root of roots) {
     let entries: fs.Dirent[]
     try {

package/extensions/subagent/agents.ts

@@ -11,6 +11,7 @@ import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
 import { errorMessage } from '../internal/values.js'
@@ -29,7 +30,7 @@ import { errorMessage } from '../internal/values.js'
 function parseToolsField(raw: unknown, granting: boolean): string[] | undefined | null {
   if (raw === undefined) return undefined
   // Shares the command parser's splitting, so a comma inside an argument scope stays
-  // inside it here too: `Bash(mv, write, cp)` used to hand the child pi's real `write`.
+  // inside it here too: split naively, `Bash(mv, write, cp)` grants the child pi's real `write`.
   if (raw !== null && !Array.isArray(raw) && typeof raw !== 'string') return null
   if (Array.isArray(raw) && raw.some((item) => typeof item !== 'string')) return null
   const grants = parseToolGrants(raw)
@@ -65,10 +66,9 @@ function parseModelAlias(raw: unknown): string | undefined {
 /** Resolve a Claude tier alias to a concrete model id the user can actually run.
  * Returning undefined leaves the child on the session model, which is what the
  * unresolvable case degraded to before and still does. */
-export function resolveModelAlias(alias: string | undefined, available: ReadonlyArray<{ id: string; provider?: string }>): string | undefined {
+export function resolveModelAlias(alias: string | undefined, available: ReadonlyArray<{ id: string; name?: string; provider?: string }>): string | undefined {
   if (!alias || alias === 'inherit') return undefined
-  const needle = alias.toLowerCase()
-  return available.find((model) => model.id.toLowerCase().includes(needle))?.id
+  return findModel(alias, available)?.id
 }
 
 /** pi's extended thinking levels; Claude's effort values are a subset, so they map 1:1. */

package/extensions/subagent/background.ts

@@ -6,12 +6,13 @@
  * across a same-process session switch keeps going under the new session.
  */
 
-import { spawn } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
+import { killProcessTree } from '../internal/process-tree.js'
 import { errorMessage } from '../internal/values.js'
+import { spawnChild } from './run.js'
 
 export interface BackgroundRun {
   id: string
@@ -209,8 +210,8 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   run.spawn = { ...run.spawn, args: rebuilt.args }
   if (rebuilt.dir) run.rebuiltPromptDir = rebuilt.dir
   // The task prompt is always the final argument: both spawn paths push it last and the
-  // invocation helper only prepends. Matching a 'Task: ' prefix missed it whenever
-  // SubagentStart hooks placed their context ahead of it, so the resume re-ran the old task.
+  // invocation helper only prepends. A 'Task: ' prefix match is wrong whenever
+  // SubagentStart hooks placed their context ahead of it.
   const args = rebuilt.args.map((arg, index) => (index === rebuilt.args.length - 1 ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
@@ -281,29 +282,41 @@ export function startBackgroundRun(agent: string, task: string, invocation: Back
 
 /** Spawn the child for a run and wire its lifecycle back onto the record. */
 function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (run: BackgroundRun) => void): void {
-  const proc = spawn(invocation.command, invocation.args, {
-    cwd: invocation.cwd,
-    shell: false,
-    stdio: ['ignore', 'pipe', 'pipe'],
-    // Its own group, so cancelling reaches any grandchild the agent spawned.
-    detached: true,
-    // The marker lets the child's subagent tool refuse to nest further.
-    env: { ...process.env, PI_CODE_SUBAGENT: '1', ...invocation.env },
-  })
-  run.live = true
-  const killGroup = (signal: NodeJS.Signals): void => {
+  // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
+  let completed = false
+  const complete = (): void => {
+    if (completed) return
+    completed = true
+    run.finishedAt = ++finishSequence
+    evictFinishedRuns()
+    // A run outlives the session that started it, and pi's loader wires assertActive()
+    // into every runtime call, so notifying a disposed session throws. This fires from
+    // the child's 'close'/'error' listener, where nothing upstream catches: an escaping
+    // error reaches Node as an uncaughtException and takes pi down with it. The run
+    // state is already recorded by this point, so there is nothing to do but drop the
+    // notification for a session that is no longer there to receive it.
     try {
-      // A child that never spawned has no pid and no group; the direct kill is all there is.
-      if (proc.pid) process.kill(-proc.pid, signal)
-      else proc.kill(signal)
+      onComplete(run)
     } catch {
-      try {
-        proc.kill(signal)
-      } catch {
-        // already gone
-      }
+      // the session that asked for this run is gone
     }
   }
+  // The marker in env lets the child's subagent tool refuse to nest further. The run is
+  // already registered as running by the caller, so a spawn that throws synchronously
+  // (see spawnChild) must settle the record here: left as it was, the phantom held a cap
+  // slot with no kill and no eviction for the life of the process.
+  const spawned = spawnChild(invocation.command, invocation.args, { cwd: invocation.cwd, env: { ...process.env, PI_CODE_SUBAGENT: '1', ...invocation.env } })
+  if ('error' in spawned) {
+    run.live = false
+    run.state = 'failed'
+    run.exitCode = 1
+    run.stderr = spawned.error.message
+    complete()
+    return
+  }
+  const proc = spawned.proc
+  run.live = true
+  const killGroup = (signal: NodeJS.Signals): void => killProcessTree(proc, signal)
   run.kill = () => {
     killGroup('SIGTERM')
     // A child ignoring SIGTERM would hold its cap slot and process forever.
@@ -330,25 +343,6 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       : undefined,
   )
   let stderrTail = ''
-  // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
-  let completed = false
-  const complete = (): void => {
-    if (completed) return
-    completed = true
-    run.finishedAt = ++finishSequence
-    evictFinishedRuns()
-    // A run outlives the session that started it, and pi's loader wires assertActive()
-    // into every runtime call, so notifying a disposed session throws. This fires from
-    // the child's 'close'/'error' listener, where nothing upstream catches: an escaping
-    // error reaches Node as an uncaughtException and takes pi down with it. The run
-    // state is already recorded by this point, so there is nothing to do but drop the
-    // notification for a session that is no longer there to receive it.
-    try {
-      onComplete(run)
-    } catch {
-      // the session that asked for this run is gone
-    }
-  }
   proc.stdout.on('data', (data) => parser.push(data.toString()))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an

package/extensions/subagent/child.ts

@@ -12,6 +12,7 @@ import * as path from 'node:path'
 
 import type { AgentRunRequest } from '../internal/agent-run.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { sliceBytes } from '../internal/output-guard.js'
 import { repoRoot } from '../internal/project-root.js'
 import { autoMemoryEnabled, capIndexForPrompt, INDEX_MAX_BYTES, INDEX_MAX_LINES, memorySettingsFiles, readMemorySettings } from '../memory.js'
 import { type AgentConfig, type AgentMemoryScope, expandMcpToolPatterns, withPreloadedSkills } from './agents.js'
@@ -26,8 +27,6 @@ export const AGENT_HOOK_SYSTEM = [
   'Use "allow" to let the action proceed, "deny" to block it, "ask" to require the user to confirm.',
 ].join('\n')
 
-/** A throwaway agent config for one agent-hook run: read-only inspection tools, the
- * hook's model (a fast default when unset), and the decision-returning system prompt. */
 /** The agent a context: fork skill runs as when it names none: full toolset, no
  * extra system prompt (the child keeps pi's default), the skill content as the
  * task. */
@@ -42,6 +41,8 @@ export function forkAgent(request: Pick<AgentRunRequest, 'model' | 'systemPrompt
   }
 }
 
+/** A throwaway agent config for one agent-hook run: read-only inspection tools, the
+ * hook's model (a fast default when unset), and the decision-returning system prompt. */
 export function buildHookAgent(request: Pick<AgentRunRequest, 'model' | 'systemPrompt'>): AgentConfig {
   return {
     name: 'agent-hook',
@@ -188,10 +189,24 @@ export function agentHooksEnv(agent: AgentConfig, agentId: string): Record<strin
   return { PI_CODE_AGENT_HOOKS: JSON.stringify({ agent: agent.name, id: agentId, hooks }) }
 }
 
+/** This string becomes the whole of one argv element to the spawned child
+ * (run.ts, `spawn(..., { shell: false })`). Linux's MAX_ARG_STRLEN, a per-argument
+ * limit distinct from the much larger total ARG_MAX, is 128KiB; confirmed on a real
+ * Linux host that a single argv string over it fails execve with E2BIG. Neither the
+ * model's task text nor a SubagentStart hook's additionalContext is capped
+ * upstream, so this is where the assembled string caps itself. The budget leaves
+ * headroom under the hard limit for the "Task: " prefix, the notice below, and
+ * platforms whose limit differs from Linux's. */
+const TASK_ARGV_MAX_BYTES = 96 * 1024
+
 /** The task argument with any SubagentStart hook context ahead of it, per Claude:
  * "added to the subagent's context at the start of its conversation, before its
- * first prompt". */
+ * first prompt". Capped as one combined string, since either the context or the
+ * task alone can already be oversized. */
 export function taskWithStartContext(task: string, contexts: string[]): string {
   const context = contexts.filter(Boolean).join('\n')
-  return context ? `${context}\n\nTask: ${task}` : `Task: ${task}`
+  const assembled = context ? `${context}\n\nTask: ${task}` : `Task: ${task}`
+  if (Buffer.byteLength(assembled, 'utf-8') <= TASK_ARGV_MAX_BYTES) return assembled
+  const kept = sliceBytes(assembled, TASK_ARGV_MAX_BYTES)
+  return `${kept}\n\n[truncated: too long for the child process to receive]`
 }