pi-code 1.0.63 → 1.0.65

package/extensions/mcp/config.ts

@@ -6,10 +6,12 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
+import { getAgentDir } from '@earendil-works/pi-coding-agent'
 import { claudeConfigDir } from '../internal/config-dir.js'
 import type { OAuthServerConfig } from '../internal/mcp-oauth.js'
 import { type InstalledPlugin, pluginComponentPath } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
+import { errorMessage } from '../internal/values.js'
 
 export interface StdioServerConfig {
   type?: 'stdio'
@@ -91,7 +93,9 @@ function claudeJsonPath(home: string): string {
 /** User-scoped MCP config (the user's own; safe to load without project trust). The .pi
  * tree is pi's own and is not relocated by CLAUDE_CONFIG_DIR. */
 export function userConfigPaths(home: string): string[] {
-  return [claudeJsonPath(home), path.join(home, '.pi', 'agent', 'mcp.json')]
+  // mcp.json lives in pi's agent directory, which PI_CODING_AGENT_DIR relocates; the
+  // other agent-directory readers (trust store, OAuth tokens) already follow it.
+  return [claudeJsonPath(home), path.join(getAgentDir(), 'mcp.json')]
 }
 
 /** Project-scoped MCP config, each file the nearest of its name at or above cwd
@@ -107,8 +111,10 @@ export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
     try {
       const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
       Object.assign(servers, parsed.mcpServers ?? {})
-    } catch {
-      // missing or invalid file: skip silently, /mcp reports what loaded
+    } catch (error) {
+      // A missing file is the normal case. A present file that does not parse is
+      // not: one trailing comma silently disabled every server in it.
+      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') console.warn(`pi-code-mcp: ignoring ${file}: ${errorMessage(error)}`)
     }
   }
   return servers
@@ -132,7 +138,8 @@ function projectRecord(home: string, cwd: string): { mcpServers?: Record<string,
   try {
     const claudeJson = JSON.parse(fs.readFileSync(claudeJsonPath(home), 'utf-8'))
     return claudeJson.projects?.[cwd] ?? {}
-  } catch {
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') console.warn(`pi-code-mcp: ignoring ${claudeJsonPath(home)}: ${errorMessage(error)}`)
     return {}
   }
 }

package/extensions/mcp/index.ts

@@ -53,8 +53,7 @@ import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeout
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
 // Re-exports for consumers: the module split keeps the extension's public surface
-// (imported by the test suite) reachable from this entry point unchanged. The managed
-// settings path helpers now live in the shared internal module.
+// (imported by the test suite) reachable from this entry point unchanged.
 export type { HttpServerConfig, ServerConfig, StdioServerConfig } from './config.js'
 export { expandCwd, interpolateEnv, loadConfigFrom, loadPluginServers, loadUserScope, projectConfigPaths, userConfigPaths, warnOnTypelessUrl } from './config.js'
 export type { McpToolInfo } from './listing.js'
@@ -85,6 +84,12 @@ function authUiFor(ctx: ExtensionContext): AuthUi | undefined {
 
 export default async function mcpExtension(pi: ExtensionAPI) {
   const clients = new Map<string, Client>()
+  // Names with a connect in flight. A name enters `clients` only once its connect
+  // resolves, and shutdown clears that map without awaiting anything in flight, so
+  // without this set a session switch during a slow connect (or a backoff sleep) let
+  // the next session_start connect the same name again; the first client then resolved
+  // into an entry the second overwrote and was never closed.
+  const connecting = new Set<string>()
   // The session's OAuth UI seams, captured at session_start. The reconnect paths below
   // run outside that handler, and passing undefined there made an INTERACTIVE session
   // report the headless "cannot log in" advice on a re-auth it could actually perform.
@@ -99,6 +104,11 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   // Shutdown closes clients while they are still in the map; the onclose handlers
   // must not schedule reconnects for that deliberate teardown.
   let shuttingDown = false
+  // Bumped by every session_start and session_shutdown. A late-connecting server's
+  // deferred summary captured the ctx of the session that started it; pi disposes that
+  // ctx on /new, /resume, /fork and reload (any use of it throws), so the publish must
+  // check it still belongs to the live session before touching ctx.
+  let sessionGeneration = 0
   const callTuning = (name: string): ServerCallTuning => {
     const config = serverConfigs.get(name)
     return config ? serverCallTuning(config) : {}
@@ -189,7 +199,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function reconnectWithBackoff(name: string, config: ServerConfig): Promise<void> {
     for (let attempt = 0; attempt < 5; attempt++) {
       await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** attempt))
-      if (shuttingDown || clients.has(name)) return
+      if (shuttingDown || clients.has(name) || connecting.has(name)) return
       await connectServers({ [name]: config }, sessionAuthUi, true)
       if (clients.has(name)) return
     }
@@ -410,10 +420,15 @@ export default async function mcpExtension(pi: ExtensionAPI) {
         console.warn(`pi-code-mcp: skipping duplicate server name ${name}`)
         continue
       }
+      // The one guard for every connect path (session_start scopes, backoff, auth
+      // reconnect): a name still connecting from the previous session is adopted when
+      // that connect resolves, not connected again.
+      if (connecting.has(name)) continue
       // Seed in config order before connecting: parallel connects settle in completion
       // order, and /mcp plus the session summary iterate the map's insertion order.
       status.set(name, { state: 'connecting', tools: 0 })
       serverConfigs.set(name, config)
+      connecting.add(name)
       pending.push([name, config])
     }
     await Promise.all(
@@ -423,6 +438,14 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           // First connections retry transient failures (Claude: up to three times for
           // HTTP/SSE); the backoff reconnect below carries its own schedule instead.
           const client = noRetry ? await connect(name, config, authUi, sessionDirs) : await connectWithRetries(name, config, authUi, sessionDirs)
+          // A session switch resets shuttingDown before this resolves and adopts the
+          // client; still set, pi is exiting and the shutdown handler already closed
+          // every client it could see, so this late one must close itself.
+          if (shuttingDown) {
+            await withTimeout(client.close(), 3000, 'close').catch(() => {})
+            status.delete(name)
+            return
+          }
           clients.set(name, client)
           const tools = await withTimeout(listAllTools(client), connectTimeoutMs(), `list tools ${name}`)
           registerTools(name, config, tools)
@@ -460,6 +483,8 @@ export default async function mcpExtension(pi: ExtensionAPI) {
             clients.delete(name)
             void leaked.close().catch(() => {})
           }
+        } finally {
+          connecting.delete(name)
         }
       }),
     )
@@ -587,6 +612,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // withdrawn tool keeps its registration and surfaces the server's own error), which
     // is why serverToolCount reads from `registered` to recover the true count here.
     status.clear()
+    const generation = ++sessionGeneration
     // A same-process session switch (/new, /resume) shut the last session down;
     // this one may reconnect again. projectConnected guards against connecting the project
     // scope twice within one session, so it belongs to the session that set it: leaving it
@@ -629,13 +655,23 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           () => false,
         )
     publishConnectionSummary(ctx)
-    if (!settled) void connecting.then(() => publishConnectionSummary(ctx))
+    if (!settled) {
+      // The rejection path exists for the throw a disposed ctx would raise if the
+      // generation check were ever wrong: from a bare `.then` it would be an unhandled
+      // rejection, and pi installs no handler, so Node would take the process down.
+      void connecting
+        .then(() => {
+          if (generation === sessionGeneration) publishConnectionSummary(ctx)
+        })
+        .catch(() => {})
+    }
   })
 
   pi.on('session_shutdown', async () => {
     // Closing fires each client's onclose while it is still in the map; the flag
     // stops those handlers (and any in-flight backoff loop) from reconnecting.
     shuttingDown = true
+    sessionGeneration++
     // Close in parallel with a per-client timeout so one hung server can't stall pi's exit.
     await Promise.all([...clients.values()].map((client) => withTimeout(client.close(), 3000, 'close').catch(() => {})))
     // Drop the closed clients and their status now rather than waiting on each client's

package/extensions/mcp/policy.ts

@@ -6,10 +6,9 @@
 
 import * as fs from 'node:fs'
 import * as path from 'node:path'
-import { claudeConfigDir } from '../internal/config-dir.js'
 import { managedSettingsFile } from '../internal/managed-settings.js'
-import { findNearestFile } from '../internal/project-root.js'
-import { errorMessage } from '../internal/values.js'
+import { claudeSettingsChain } from '../internal/settings-chain.js'
+import { errorMessage, escapeRegExp } from '../internal/values.js'
 import { interpolateEnv, type ServerConfig } from './config.js'
 
 export interface ProjectServerPolicy {
@@ -38,11 +37,17 @@ export function projectServerPolicy(cwd: string, home: string, projectApproved:
     }
   }
   const names = (value: unknown): string[] => (Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [])
-  const userSettings = read(path.join(claudeConfigDir(home), 'settings.json'))
-  const projectSettings = read(findNearestFile(cwd, path.join('.claude', 'settings.json')) ?? path.join(cwd, '.claude', 'settings.json'))
-  const localSettings = read(findNearestFile(cwd, path.join('.claude', 'settings.local.json')) ?? path.join(cwd, '.claude', 'settings.local.json'))
-  const disabled = new Set([...names(userSettings.disabledMcpjsonServers), ...names(projectSettings.disabledMcpjsonServers), ...names(localSettings.disabledMcpjsonServers)])
-  const consentSources = projectApproved ? [userSettings, localSettings] : [userSettings]
+  // The files come from the one settings chain, so placement follows Claude's rules
+  // everywhere: the project's settings.json is read from cwd only (never an ancestor),
+  // and settings.local.json from the main checkout, with the chain's legacy cwd copy
+  // read too. Resolving them by nearest-file here gave a subdirectory session an
+  // ancestor's project file and a worktree session its own local file instead.
+  const [userFile, projectFile, ...localFiles] = claudeSettingsChain(cwd, home, true)
+  const userSettings = read(userFile)
+  const projectSettings = read(projectFile)
+  const localSettings = localFiles.map(read)
+  const disabled = new Set([...names(userSettings.disabledMcpjsonServers), ...names(projectSettings.disabledMcpjsonServers), ...localSettings.flatMap((settings) => names(settings.disabledMcpjsonServers))])
+  const consentSources = projectApproved ? [userSettings, ...localSettings] : [userSettings]
   const consented = new Set(consentSources.flatMap((settings) => names(settings.enabledMcpjsonServers)))
   const consentAll = consentSources.some((settings) => settings.enableAllProjectMcpServers === true)
   return { disabled, consented, consentAll }
@@ -127,10 +132,7 @@ export function mcpAllowDeny(scopeFiles: string[] = [], managedFile: string = ma
 
 /** `*` in a policy URL pattern matches any run of characters; everything else is literal. */
 function wildcardRegExp(pattern: string): RegExp {
-  const source = pattern
-    .split('*')
-    .map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`))
-    .join('.*')
+  const source = pattern.split('*').map(escapeRegExp).join('.*')
   return new RegExp(`^${source}$`)
 }
 

package/extensions/mcp/transport.ts

@@ -18,6 +18,7 @@ import { WebSocketClientTransport } from '@modelcontextprotocol/sdk/client/webso
 import { ListRootsRequestSchema } from '@modelcontextprotocol/sdk/types.js'
 import { FileOAuthProvider, type OAuthServerConfig } from '../internal/mcp-oauth.js'
 import { resolveShell } from '../internal/shell-resolve.js'
+import { parseNumericEnv } from '../internal/values.js'
 import { expandCwd, type HttpServerConfig, interpolateEnv, type ServerConfig, type StdioServerConfig } from './config.js'
 import { runInteractiveOAuth, serializeInteractiveOAuth } from './oauth-flow.js'
 
@@ -36,19 +37,12 @@ const DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS = 1_800_000
 
 /** Claude's numeric env vars accept scientific notation and digit-separator spellings
  * (2e3 as 2000, 64_000 as 64000). A non-numeric value is undefined, not zero. */
-function parseNumericEnv(raw: string): number | undefined {
-  const cleaned = raw.replaceAll('_', '')
-  if (cleaned.trim() === '') return undefined
-  const value = Number(cleaned)
-  return Number.isFinite(value) ? Math.floor(value) : undefined
-}
-
 /** A positive-integer env override, or the default when unset or unparseable. */
 function envTimeout(name: string, fallback: number): number {
   const raw = process.env[name]
   if (raw === undefined) return fallback
   const value = parseNumericEnv(raw)
-  return value !== undefined && value > 0 ? value : fallback
+  return value !== undefined && value > 0 ? Math.floor(value) : fallback
 }
 
 // Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.

package/extensions/memory.ts

@@ -12,7 +12,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { StringEnum } from '@earendil-works/pi-ai'
-import { type ExtensionAPI, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
+import { type ExtensionAPI, getAgentDir, withFileMutationQueue } from '@earendil-works/pi-coding-agent'
 import { Type } from 'typebox'
 import { atomicWriteFile } from './internal/atomic-write.js'
 import { claudeConfigDir } from './internal/config-dir.js'
@@ -63,7 +63,7 @@ function memoryProject(cwd: string): string {
 }
 
 export function memoryDir(cwd: string): string {
-  return path.join(os.homedir(), '.pi', 'agent', 'memory', projectSlug(memoryProject(cwd)))
+  return path.join(getAgentDir(), 'memory', projectSlug(memoryProject(cwd)))
 }
 
 /** The store location, honoring an `autoMemoryDirectory` override. Claude requires
@@ -142,7 +142,7 @@ export function stripNonLoaded(text: string): string {
 export function migrateLegacyStore(cwd: string): void {
   const current = memoryDir(cwd)
   if (fs.existsSync(current)) return
-  const base = path.join(os.homedir(), '.pi', 'agent', 'memory')
+  const base = path.join(getAgentDir(), 'memory')
   // projectSlug(cwd) differs from current only for a subdirectory session (current is
   // keyed on the repo root); for a repo-root session it equals current and is skipped.
   const candidates = [path.join(base, projectSlug(cwd)), path.join(base, legacySlug(cwd))]
@@ -177,7 +177,7 @@ export function indexWouldOverflow(index: string, name: string, description: str
 /** Where the index stands against the read limits, measured on the loaded content
  * (frontmatter and comments stripped): 'over' past either bound, 'near' within
  * 10% of one, else 'ok'. Claude reminds near a limit and errors over it. */
-export function indexReadState(index: string): 'ok' | 'near' | 'over' {
+function indexReadState(index: string): 'ok' | 'near' | 'over' {
   const loaded = stripNonLoaded(index)
   const lines = loaded.split('\n').length
   const bytes = Buffer.byteLength(loaded, 'utf-8')

package/extensions/notify.ts

@@ -16,12 +16,12 @@
  */
 
 import { execFile } from 'node:child_process'
-import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 import { claudeConfigDir } from './internal/config-dir.js'
+import { readSettingsFile } from './internal/settings-chain.js'
 
 /** How a finished turn is announced, from Claude's `preferredNotifChannel`. */
 export type NotifChannel = 'desktop' | 'bell' | 'both' | 'off'
@@ -56,12 +56,7 @@ export function isAway(lastInputAt: number | undefined, now: number, thresholdMs
  * preference, so only user scope is read; a checked-out repo does not get to silence
  * or change your notifications. */
 function readPreferredNotifChannel(home: string): unknown {
-  try {
-    const settings = JSON.parse(fs.readFileSync(path.join(claudeConfigDir(home), 'settings.json'), 'utf-8'))
-    return settings?.preferredNotifChannel
-  } catch {
-    return undefined
-  }
+  return readSettingsFile(path.join(claudeConfigDir(home), 'settings.json'))?.preferredNotifChannel
 }
 
 function windowsToastScript(title: string, body: string): string {

package/extensions/output-styles.ts

@@ -22,14 +22,15 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
+import { type ExtensionAPI, parseFrontmatter } from '@earendil-works/pi-coding-agent'
 import { atomicWriteFile } from './internal/atomic-write.js'
+import { isFlagEnabled } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
-import { ancestorDirs, findNearestDir, findNearestFile } from './internal/project-root.js'
-import { claudeSettingsChain, readSettingsChain } from './internal/settings-chain.js'
+import { ancestorDirs } from './internal/project-root.js'
+import { claudeSettingsChain, localSettingsFile, readSettingsChain } from './internal/settings-chain.js'
 import { isDirectory } from './internal/values.js'
 
 export interface OutputStyle {
@@ -41,22 +42,27 @@ export interface OutputStyle {
   forceForPlugin: boolean
 }
 
-function field(frontmatter: string, key: string): string {
-  const match = new RegExp(String.raw`^\s*${key}\s*:\s*(.+)$`, 'm').exec(frontmatter)
-  return match ? match[1].trim().replace(/^["']|["']$/g, '') : ''
+/** A frontmatter field as text, or '' when absent or not scalar. */
+function field(frontmatter: Record<string, unknown>, key: string): string {
+  const value = frontmatter[key]
+  if (typeof value === 'string') return value.trim()
+  if (typeof value === 'number' || typeof value === 'boolean') return String(value)
+  return ''
 }
 
-/** Parse an output-style markdown file into its name, description, and body. */
+/** Parse an output-style markdown file into its name, description, and body. pi's
+ * own YAML frontmatter parser, as the command loader uses: a line regex captured to
+ * end of line, so `"Terse" # short` came back as `Terse" # short`. */
 export function parseStyle(content: string, fallbackName: string): OutputStyle {
-  const match = /^---\r?\n([\s\S]*?)\r?\n---/.exec(content)
-  const frontmatter = match ? match[1] : ''
-  const body = match ? content.slice(match[0].length) : content
+  const { frontmatter, body } = parseFrontmatter(content)
   return {
     name: field(frontmatter, 'name') || fallbackName,
     description: field(frontmatter, 'description'),
     body: body.trim(),
-    keepCodingInstructions: field(frontmatter, 'keep-coding-instructions') === 'true',
-    forceForPlugin: field(frontmatter, 'force-for-plugin') === 'true',
+    // Both are YAML booleans (Claude: default `false`), so `yes`/`on`/`True` count as
+    // set, the same reading commands give their own frontmatter flags.
+    keepCodingInstructions: isFlagEnabled(field(frontmatter, 'keep-coding-instructions')),
+    forceForPlugin: isFlagEnabled(field(frontmatter, 'force-for-plugin')),
   }
 }
 
@@ -202,11 +208,10 @@ export default function outputStylesExtension(pi: ExtensionAPI) {
     // Precedence low to high: builtin, plugin, then the user's and project's own
     // dirs, so a same-named user or project style overrides a plugin's.
     styles = loadStyles([BUILTIN_STYLES_DIR, ...pluginStyleDirs(home), ...styleDirs(ctx.cwd, home, trusted)])
-    // Persist the choice where the read chain will find it again: the nearest local
-    // settings file, else inside the nearest .claude directory, else at cwd.
-    const nearestLocal = findNearestFile(ctx.cwd, path.join('.claude', 'settings.local.json'))
-    const claudeDir = findNearestDir(ctx.cwd, '.claude') ?? path.join(ctx.cwd, '.claude')
-    localSettingsPath = nearestLocal ?? path.join(claudeDir, 'settings.local.json')
+    // Persist the choice to the file the read chain reads last, so it is read back:
+    // the nearest local file or .claude directory could sit at an intermediate
+    // ancestor the chain never consults.
+    localSettingsPath = localSettingsFile(ctx.cwd, home)
     // Claude's force-for-plugin: the first loaded forced plugin style applies
     // automatically, overriding the outputStyle setting.
     const forced = forcedPluginStyle(loadStyles(pluginStyleDirs(home)))

package/extensions/question.ts

@@ -6,7 +6,6 @@
  * Multiple questions per call are not batched; ask sequentially.
  */
 
-import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext, Theme } from '@earendil-works/pi-coding-agent'
@@ -14,6 +13,7 @@ import { Editor, type EditorTheme, Key, matchesKey, Text, truncateToWidth } from
 import { Type } from 'typebox'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
+import { readSettingsFile } from './internal/settings-chain.js'
 
 interface OptionWithDesc {
   label: string
@@ -96,12 +96,7 @@ export function askUserQuestionTimeoutMs(home: string = os.homedir()): number |
   const managed = readManagedSettings() as { askUserQuestionTimeout?: unknown }
   const fromManaged = parseAskUserQuestionTimeout(managed.askUserQuestionTimeout)
   if (fromManaged !== undefined) return fromManaged
-  try {
-    const parsed = JSON.parse(fs.readFileSync(path.join(claudeConfigDir(home), 'settings.json'), 'utf-8')) as { askUserQuestionTimeout?: unknown }
-    return parseAskUserQuestionTimeout(parsed.askUserQuestionTimeout)
-  } catch {
-    return undefined
-  }
+  return parseAskUserQuestionTimeout(readSettingsFile(path.join(claudeConfigDir(home), 'settings.json'))?.askUserQuestionTimeout)
 }
 
 function checkbox(checked: boolean | undefined): string {

package/extensions/skills.ts

@@ -35,10 +35,6 @@ import { claudeSettingsChain, readSettingsChain } from './internal/settings-chai
 import { SKILL_HOOKS_CHANNEL } from './internal/skill-hooks.js'
 import { errorMessage, isDirectory, isRecord } from './internal/values.js'
 
-/** Existing `.claude/skills` directories, user first then project. The project
- * directory is included only for approved projects: pi's loader surfaces every skill's
- * name and description to the model, so an untrusted repository would otherwise get
- * text into the prompt without the user ever agreeing to load its config. */
 /** The extra skill directories a manifest declares, as a list. A string is one entry,
  * a list is itself, anything else declares none. */
 function declaredSkillDirs(declared: unknown): string[] {
@@ -46,6 +42,10 @@ function declaredSkillDirs(declared: unknown): string[] {
   return typeof declared === 'string' ? [declared] : []
 }
 
+/** Existing `.claude/skills` directories, user first then project. The project
+ * directory is included only for approved projects: pi's loader surfaces every skill's
+ * name and description to the model, so an untrusted repository would otherwise get
+ * text into the prompt without the user ever agreeing to load its config. */
 export function skillDirs(cwd: string, home: string, trusted: boolean): string[] {
   // Claude's precedence: enterprise (the skills directory beside the managed
   // settings file) overrides personal, and personal overrides project; discovery
@@ -113,7 +113,7 @@ function skillAt(root: string, dirName: string): { name: string; filePath: strin
 
 /** A Claude-contributed skill by the name pi's loader gives it. One directory
  * level, the standard layout. */
-export function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined {
+function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined {
   for (const root of roots) {
     let entries: fs.Dirent[]
     try {

package/extensions/status-line.ts

@@ -559,5 +559,9 @@ export default function statusLine(pi: ExtensionAPI) {
   pi.on('session_shutdown', async () => {
     clearInterval(refreshTimer)
     clearTimeout(debounceTimer)
+    // pi's CLI loads a fresh extension instance for every session replacement, so no later
+    // session_start reaches this watcher: left armed, it polls for the life of the process.
+    disposeSettingsWatch()
+    disposeSettingsWatch = () => {}
   })
 }

package/extensions/subagent/agents.ts

@@ -11,6 +11,7 @@ import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
 import { errorMessage } from '../internal/values.js'
@@ -29,7 +30,7 @@ import { errorMessage } from '../internal/values.js'
 function parseToolsField(raw: unknown, granting: boolean): string[] | undefined | null {
   if (raw === undefined) return undefined
   // Shares the command parser's splitting, so a comma inside an argument scope stays
-  // inside it here too: `Bash(mv, write, cp)` used to hand the child pi's real `write`.
+  // inside it here too: split naively, `Bash(mv, write, cp)` grants the child pi's real `write`.
   if (raw !== null && !Array.isArray(raw) && typeof raw !== 'string') return null
   if (Array.isArray(raw) && raw.some((item) => typeof item !== 'string')) return null
   const grants = parseToolGrants(raw)
@@ -65,10 +66,9 @@ function parseModelAlias(raw: unknown): string | undefined {
 /** Resolve a Claude tier alias to a concrete model id the user can actually run.
  * Returning undefined leaves the child on the session model, which is what the
  * unresolvable case degraded to before and still does. */
-export function resolveModelAlias(alias: string | undefined, available: ReadonlyArray<{ id: string; provider?: string }>): string | undefined {
+export function resolveModelAlias(alias: string | undefined, available: ReadonlyArray<{ id: string; name?: string; provider?: string }>): string | undefined {
   if (!alias || alias === 'inherit') return undefined
-  const needle = alias.toLowerCase()
-  return available.find((model) => model.id.toLowerCase().includes(needle))?.id
+  return findModel(alias, available)?.id
 }
 
 /** pi's extended thinking levels; Claude's effort values are a subset, so they map 1:1. */

package/extensions/subagent/background.ts

@@ -6,12 +6,13 @@
  * across a same-process session switch keeps going under the new session.
  */
 
-import { spawn } from 'node:child_process'
 import { randomUUID } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
+import { killProcessTree } from '../internal/process-tree.js'
 import { errorMessage } from '../internal/values.js'
+import { spawnChild } from './run.js'
 
 export interface BackgroundRun {
   id: string
@@ -209,8 +210,8 @@ export function resumeBackgroundRun(id: string, task: string, onComplete: (run:
   run.spawn = { ...run.spawn, args: rebuilt.args }
   if (rebuilt.dir) run.rebuiltPromptDir = rebuilt.dir
   // The task prompt is always the final argument: both spawn paths push it last and the
-  // invocation helper only prepends. Matching a 'Task: ' prefix missed it whenever
-  // SubagentStart hooks placed their context ahead of it, so the resume re-ran the old task.
+  // invocation helper only prepends. A 'Task: ' prefix match is wrong whenever
+  // SubagentStart hooks placed their context ahead of it.
   const args = rebuilt.args.map((arg, index) => (index === rebuilt.args.length - 1 ? `Task: ${task}` : arg))
   run.state = 'running'
   run.task = task
@@ -281,29 +282,41 @@ export function startBackgroundRun(agent: string, task: string, invocation: Back
 
 /** Spawn the child for a run and wire its lifecycle back onto the record. */
 function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (run: BackgroundRun) => void): void {
-  const proc = spawn(invocation.command, invocation.args, {
-    cwd: invocation.cwd,
-    shell: false,
-    stdio: ['ignore', 'pipe', 'pipe'],
-    // Its own group, so cancelling reaches any grandchild the agent spawned.
-    detached: true,
-    // The marker lets the child's subagent tool refuse to nest further.
-    env: { ...process.env, PI_CODE_SUBAGENT: '1', ...invocation.env },
-  })
-  run.live = true
-  const killGroup = (signal: NodeJS.Signals): void => {
+  // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
+  let completed = false
+  const complete = (): void => {
+    if (completed) return
+    completed = true
+    run.finishedAt = ++finishSequence
+    evictFinishedRuns()
+    // A run outlives the session that started it, and pi's loader wires assertActive()
+    // into every runtime call, so notifying a disposed session throws. This fires from
+    // the child's 'close'/'error' listener, where nothing upstream catches: an escaping
+    // error reaches Node as an uncaughtException and takes pi down with it. The run
+    // state is already recorded by this point, so there is nothing to do but drop the
+    // notification for a session that is no longer there to receive it.
     try {
-      // A child that never spawned has no pid and no group; the direct kill is all there is.
-      if (proc.pid) process.kill(-proc.pid, signal)
-      else proc.kill(signal)
+      onComplete(run)
     } catch {
-      try {
-        proc.kill(signal)
-      } catch {
-        // already gone
-      }
+      // the session that asked for this run is gone
     }
   }
+  // The marker in env lets the child's subagent tool refuse to nest further. The run is
+  // already registered as running by the caller, so a spawn that throws synchronously
+  // (see spawnChild) must settle the record here: left as it was, the phantom held a cap
+  // slot with no kill and no eviction for the life of the process.
+  const spawned = spawnChild(invocation.command, invocation.args, { cwd: invocation.cwd, env: { ...process.env, PI_CODE_SUBAGENT: '1', ...invocation.env } })
+  if ('error' in spawned) {
+    run.live = false
+    run.state = 'failed'
+    run.exitCode = 1
+    run.stderr = spawned.error.message
+    complete()
+    return
+  }
+  const proc = spawned.proc
+  run.live = true
+  const killGroup = (signal: NodeJS.Signals): void => killProcessTree(proc, signal)
   run.kill = () => {
     killGroup('SIGTERM')
     // A child ignoring SIGTERM would hold its cap slot and process forever.
@@ -330,25 +343,6 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       : undefined,
   )
   let stderrTail = ''
-  // Node fires both 'error' and 'close' on a spawn failure (ENOENT); complete once.
-  let completed = false
-  const complete = (): void => {
-    if (completed) return
-    completed = true
-    run.finishedAt = ++finishSequence
-    evictFinishedRuns()
-    // A run outlives the session that started it, and pi's loader wires assertActive()
-    // into every runtime call, so notifying a disposed session throws. This fires from
-    // the child's 'close'/'error' listener, where nothing upstream catches: an escaping
-    // error reaches Node as an uncaughtException and takes pi down with it. The run
-    // state is already recorded by this point, so there is nothing to do but drop the
-    // notification for a session that is no longer there to receive it.
-    try {
-      onComplete(run)
-    } catch {
-      // the session that asked for this run is gone
-    }
-  }
   proc.stdout.on('data', (data) => parser.push(data.toString()))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an

package/extensions/subagent/child.ts

@@ -27,8 +27,6 @@ export const AGENT_HOOK_SYSTEM = [
   'Use "allow" to let the action proceed, "deny" to block it, "ask" to require the user to confirm.',
 ].join('\n')
 
-/** A throwaway agent config for one agent-hook run: read-only inspection tools, the
- * hook's model (a fast default when unset), and the decision-returning system prompt. */
 /** The agent a context: fork skill runs as when it names none: full toolset, no
  * extra system prompt (the child keeps pi's default), the skill content as the
  * task. */
@@ -43,6 +41,8 @@ export function forkAgent(request: Pick<AgentRunRequest, 'model' | 'systemPrompt
   }
 }
 
+/** A throwaway agent config for one agent-hook run: read-only inspection tools, the
+ * hook's model (a fast default when unset), and the decision-returning system prompt. */
 export function buildHookAgent(request: Pick<AgentRunRequest, 'model' | 'systemPrompt'>): AgentConfig {
   return {
     name: 'agent-hook',