pi-code 1.0.65 → 1.0.67

package/extensions/env-settings.ts

@@ -38,7 +38,7 @@ import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { claudeConfigDir } from './internal/config-dir.js'
 import { readManagedSettings } from './internal/managed-settings.js'
-import { isProjectApprovedSilently } from './internal/project-approval.js'
+import { approvalRecheck, isProjectApprovedSilently } from './internal/project-approval.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
 import { watchSettingsFiles } from './internal/settings-watch.js'
 import { isRecord } from './internal/values.js'
@@ -163,7 +163,9 @@ export default function envSettingsExtension(pi: ExtensionAPI) {
     // The watcher's reapply closes over the cwd value, never ctx: the poll has no awaiter,
     // and every getter of a replaced session's ctx throws, which would exit pi.
     const cwd = ctx.cwd
-    const reapply = (): void => apply(home, approved ? projectEnv(cwd, home) : {})
+    // A reload asks again rather than reusing `approved`: see approvalRecheck.
+    const stillApproved = approvalRecheck(ctx)
+    const reapply = (): void => apply(home, approved && stillApproved() ? projectEnv(cwd, home) : {})
     reapply()
     // Claude: "Claude Code watches your settings files and reloads them when they change,
     // so it applies most edits to the running session without a restart." `env` is not
@@ -177,5 +179,9 @@ export default function envSettingsExtension(pi: ExtensionAPI) {
   pi.on('session_shutdown', async () => {
     disposeWatch()
     disposeWatch = () => {}
+    // pi's CLI loads a fresh extension instance for every session replacement, and its
+    // empty `owned` cannot restore what this one set: everything is handed back here, and
+    // the next instance re-applies managed and user env at factory time, as at startup.
+    applyEnvSettings({}, process.env, owned)
   })
 }

package/extensions/git-checkpoint.ts

@@ -263,9 +263,11 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
    * matches a pathspec through this, so its removal is staged instead of the stale index
    * entry silently riding along into the next checkpoint. */
   async function committedPaths(): Promise<Set<string>> {
-    const listed = await gitShadow(['ls-tree', '-r', '--name-only', 'HEAD'])
+    // -z: without it git quotes and octal-escapes a non-ASCII name, and the quoted form
+    // is a pathspec that matches nothing, which fails every later add of the session.
+    const listed = await gitShadow(['ls-tree', '-r', '--name-only', '-z', 'HEAD'])
     if (listed.code !== 0) return new Set()
-    return new Set(listed.stdout.split('\n').filter(Boolean))
+    return new Set(listed.stdout.split('\0').filter(Boolean))
   }
 
   /** git rejects the whole pathspec when one entry is ignored, so the ignored paths are

package/extensions/hooks/config.ts

@@ -251,9 +251,12 @@ function withoutUserConfigShellCommands(raw: string, source: string): string {
   for (const matchers of Object.values(parsed?.hooks ?? {})) {
     if (!Array.isArray(matchers)) continue
     for (const entry of matchers) {
-      const record = entry as { hooks?: unknown }
-      if (!Array.isArray(record.hooks)) continue
-      const kept = record.hooks.filter((hook) => {
+      // A malformed entry is left for mergeHooksJson to report by name; this pass must
+      // not throw on it, because the inline-manifest caller has no catch.
+      if (!isRecord(entry) || !Array.isArray(entry.hooks)) continue
+      const record = entry
+      const kept = (record.hooks as unknown[]).filter((hook) => {
+        if (!isRecord(hook)) return true
         const candidate = hook as { command?: unknown; args?: unknown }
         if (Array.isArray(candidate.args) || typeof candidate.command !== 'string' || !USER_CONFIG_REF.test(candidate.command)) return true
         console.warn(`pi-code-hooks: ignoring a hook in ${source}: a shell-form command cannot reference \${user_config.*}; use exec form with "args", or read CLAUDE_PLUGIN_OPTION_<KEY> from the environment`)

package/extensions/hooks/index.ts

@@ -103,7 +103,7 @@ import { isMcpToolAliases, MCP_TOOLS_CHANNEL } from '../internal/mcp-alias.js'
 import { resolveModelOverride } from '../internal/model-lookup.js'
 import { isPlanModeState, PLAN_MODE_CHANNEL } from '../internal/plan-mode-state.js'
 import { installedPlugins, managedForceEnabled } from '../internal/plugins.js'
-import { isProjectApproved } from '../internal/project-approval.js'
+import { approvalRecheck, isProjectApproved } from '../internal/project-approval.js'
 import { repoRoot } from '../internal/project-root.js'
 import { watchSettingsFiles } from '../internal/settings-watch.js'
 import { isSkillHooksEvent, SKILL_HOOKS_CHANNEL } from '../internal/skill-hooks.js'
@@ -457,8 +457,10 @@ export default function hooksExtension(pi: ExtensionAPI) {
     // closes over the cwd value, never ctx: the poll has no awaiter, and every getter of
     // a replaced session's ctx throws, which would exit pi as an uncaughtException.
     const watchCwd = ctx.cwd
+    // The reload asks again rather than reusing `trusted`: see approvalRecheck.
+    const stillApproved = approvalRecheck(ctx)
     disposeSettingsWatch()
-    disposeSettingsWatch = watchSettingsFiles(hookFiles(watchCwd, os.homedir(), trusted), () => resolveConfig(watchCwd, trusted))
+    disposeSettingsWatch = watchSettingsFiles(hookFiles(watchCwd, os.homedir(), trusted), () => resolveConfig(watchCwd, trusted && stillApproved()))
     // A disabled or managed-only resolution leaves config empty (or managed-only),
     // so the SessionStart run below fires exactly what remains active.
     pendingSessionContext = []

package/extensions/hooks/matcher.ts

@@ -135,9 +135,11 @@ function collectCommands(matchers: HookMatcher[] | undefined, applies: (entry: H
       if (raw.spent === true) continue
       const hook = withCommand(raw)
       // Claude runs a handler defined in more than one settings file once; a
-      // plugin's or skill's copy of the same handler stays separate, and http
-      // handlers with the same URL but different headers are distinct.
-      const key = `${hook.origin ?? 'settings'}\n${hook.command}\n${hook.headers ? JSON.stringify(hook.headers) : ''}`
+      // plugin's or skill's copy of the same handler stays separate. Handlers that
+      // share a command but differ in what they run or when (http headers, exec-form
+      // args, an `if` filter, an mcp_tool input) are different handlers: `if` is applied
+      // after this, so collapsing two filters left the other tool call with no guard.
+      const key = `${hook.origin ?? 'settings'}\n${hook.command}\n${JSON.stringify([hook.headers, hook.args, hook.if, hook.input])}`
       if (seen.has(key)) continue
       seen.add(key)
       result.push(hook)

package/extensions/hooks/runners.ts

@@ -163,7 +163,16 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, {
     }
     // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
     // window; windowsHide keeps every hook invisible (a no-op elsewhere).
-    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    // node defers only a few spawn errors to the 'error' event; the rest (E2BIG from a
+    // payload past the argv limit) throw here, inside the promise executor, which would
+    // reject the runner and lose every sibling hook's verdict for the event.
+    let child: ReturnType<typeof spawn>
+    try {
+      child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    } catch (error) {
+      resolve({ code: 0, stdout: '', stderr: errorMessage(error), timedOut: false, spawnFailed: true })
+      return
+    }
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/agent-run.ts

@@ -9,6 +9,8 @@
  * are skipped rather than failing the event.
  */
 
+import { sharedSlot } from './shared-slot.js'
+
 export interface AgentRunRequest {
   /** The agent's task prompt, with `$ARGUMENTS` already substituted. */
   prompt: string
@@ -29,20 +31,21 @@ export interface AgentRunRequest {
 /** Run a subagent to completion and return its final assistant text. */
 export type AgentRunner = (request: AgentRunRequest) => Promise<string>
 
-let runner: AgentRunner | undefined
+const slot = sharedSlot<AgentRunner>('agent-runner')
 
 /** The subagent extension registers its runner here; pass undefined to clear it. */
 export function setAgentRunner(fn: AgentRunner | undefined): void {
-  runner = fn
+  slot.set(fn)
 }
 
 /** Test seam: whether a runner is registered. */
 export function hasAgentRunner(): boolean {
-  return runner !== undefined
+  return slot.get() !== undefined
 }
 
 /** Run a subagent for an agent hook. Rejects when no runner is registered. */
 export function runAgent(request: AgentRunRequest): Promise<string> {
+  const runner = slot.get()
   if (!runner) return Promise.reject(new Error('no subagent runner registered for agent hooks'))
   return runner(request)
 }

package/extensions/internal/command-file.ts

@@ -15,10 +15,8 @@
 
 import * as fs from 'node:fs'
 import * as path from 'node:path'
-
-import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
-
 import { CLAUDE_TOOL_MAP } from './claude-tool-names.js'
+import { parseClaudeFrontmatter } from './frontmatter.js'
 import { escapeRegExp } from './values.js'
 
 /** The pi file tools a Claude path rule can govern. */
@@ -291,7 +289,7 @@ export function parseCommandFile(content: string): ParsedCommand {
   // pi's own parser, rather than a hand-rolled one: it reads the YAML shapes Claude
   // command files actually use (flow sequences, block lists, quoted and multi-line
   // values), and a value this misreads is a restriction silently not applied.
-  const { frontmatter, body: raw } = parseFrontmatter(content)
+  const { frontmatter, body: raw } = parseClaudeFrontmatter(content)
   const body = raw.trim()
   const firstLine = body.split('\n').find((line) => line.trim().length > 0) ?? ''
   const disable = frontmatter['disable-model-invocation']

package/extensions/internal/frontmatter.ts

@@ -0,0 +1,59 @@
+/**
+ * Frontmatter of the markdown files Claude Code defines: agents, commands, skills and
+ * output styles.
+ *
+ * pi's parser is strict YAML. Claude's is not: its own /agents generator and Anthropic's
+ * plugins write `description: Use this agent when ... Examples: <example>Context: ...`,
+ * and the command reference documents `argument-hint: [pr-number] [priority]`. Strict
+ * YAML throws on ": " inside a plain scalar and on a second flow sequence, and a throw
+ * costs the whole file, so files that work in Claude Code did not exist here.
+ *
+ * The strict parse is tried first and kept whenever it succeeds. Only when it throws are
+ * the free-text fields quoted and the parse retried. The restriction fields
+ * (allowed-tools, tools, model, ...) are never rewritten: a value misread there is a
+ * restriction silently not applied, so a file whose restrictions do not parse stays
+ * rejected.
+ */
+
+import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
+
+/** Top-level keys whose value is prose. `name` is an identifier and stays strict. */
+const FREE_TEXT_KEYS = new Set(['description', 'argument-hint', 'when_to_use'])
+
+/** A plain scalar, as opposed to a quoted one or a block scalar indicator. */
+const isPlainScalar = (value: string): boolean => value !== '' && !'"\'|>'.includes(value[0])
+
+/** `line` with its free-text plain scalar quoted. A JSON string is a YAML double-quoted
+ * scalar, and its escaping keeps a literal backslash literal, as a plain scalar does. */
+function quoteFreeText(line: string): string {
+  const colon = line.indexOf(':')
+  if (colon === -1 || !FREE_TEXT_KEYS.has(line.slice(0, colon))) return line
+  const value = line.slice(colon + 1).trim()
+  return isPlainScalar(value) ? `${line.slice(0, colon)}: ${JSON.stringify(value)}` : line
+}
+
+/** `content` with the free-text fields of its frontmatter block quoted, or undefined
+ * when there is no block or nothing in it changed. */
+function withQuotedFreeText(content: string): string | undefined {
+  if (!content.startsWith('---')) return undefined
+  const start = content.indexOf('\n') + 1
+  const end = content.indexOf('\n---', start)
+  if (start === 0 || end === -1) return undefined
+  const block = content.slice(start, end)
+  const quoted = block.split('\n').map(quoteFreeText).join('\n')
+  return quoted === block ? undefined : content.slice(0, start) + quoted + content.slice(end)
+}
+
+export function parseClaudeFrontmatter<T extends Record<string, unknown>>(content: string): { frontmatter: T; body: string } {
+  try {
+    return parseFrontmatter<T>(content)
+  } catch (error) {
+    const retry = withQuotedFreeText(content)
+    if (retry === undefined) throw error
+    try {
+      return parseFrontmatter<T>(retry)
+    } catch {
+      throw error
+    }
+  }
+}

package/extensions/internal/mcp-call.ts

@@ -7,6 +7,8 @@
  * callMcpTool. It is the direct-call analogue of the MCP_TOOLS_CHANNEL alias bus.
  */
 
+import { sharedSlot } from './shared-slot.js'
+
 export interface McpToolResult {
   text: string
   isError: boolean
@@ -14,15 +16,16 @@ export interface McpToolResult {
 
 export type McpToolCaller = (server: string, tool: string, input: Record<string, unknown>) => Promise<McpToolResult>
 
-let caller: McpToolCaller | undefined
+const slot = sharedSlot<McpToolCaller>('mcp-tool-caller')
 
 /** The mcp extension registers its caller here; pass undefined to clear it. */
 export function setMcpToolCaller(fn: McpToolCaller | undefined): void {
-  caller = fn
+  slot.set(fn)
 }
 
 /** Invoke a tool on a connected MCP server. Throws when no server is connected. */
 export function callMcpTool(server: string, tool: string, input: Record<string, unknown>): Promise<McpToolResult> {
+  const caller = slot.get()
   if (!caller) return Promise.reject(new Error(`no MCP server connected to serve ${server}/${tool}`))
   return caller(server, tool, input)
 }

package/extensions/internal/model-complete.ts

@@ -72,5 +72,8 @@ export async function completeText(model: Model<Api>, prompt: string, options: C
     messages: [{ role: 'user', content: prompt, timestamp: Date.now() }],
   }
   const message = await complete(model, context, { maxTokens: options.maxTokens ?? 1024, signal: options.signal })
+  // pi-ai reports a provider failure or a fired signal by resolving, never rejecting: the
+  // message then has no text, and returned as an answer it is indistinguishable from one.
+  if (message.stopReason === 'error' || message.stopReason === 'aborted') throw new Error(message.errorMessage ?? `completion ${message.stopReason}`)
   return { text: assistantText(message), usage: message.usage }
 }

package/extensions/internal/project-approval.ts

@@ -23,6 +23,7 @@ import * as path from 'node:path'
 import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
 
 import { ROOT_MARKERS } from './project-root.js'
+import { localSettingsFile } from './settings-chain.js'
 
 /** Project files pi-code acts on that pi's own trust check does not look for. */
 const CLAUDE_SHAPED = [
@@ -52,6 +53,12 @@ const CLAUDE_SHAPED = [
  * home that is in no repository would otherwise walk up into it and report the user's
  * own settings as a project waiting to be approved. */
 export function hasClaudeShapedConfig(cwd: string, home: string = os.homedir()): boolean {
+  // settings.local.json is read from the main checkout, which a worktree's .git file
+  // names and which is a sibling of cwd, never on the walk below. An archive can carry
+  // both ends of that pointer, so the file the chain will read is checked where it is.
+  // At home the file is the user's own, as the walk also holds.
+  const relocated = localSettingsFile(cwd, home)
+  if (path.dirname(path.dirname(relocated)) !== home && fs.existsSync(relocated)) return true
   let currentDir = cwd
   while (true) {
     // The home check comes first: at home itself the .claude found is the user's own.
@@ -129,6 +136,22 @@ export function isProjectApprovedSilently(ctx: Pick<ApprovalContext, 'cwd' | 'is
   return deps.savedDecision(ctx.cwd) === true
 }
 
+/**
+ * A re-check of the approval decision for code that outlives session_start, such as a
+ * settings watcher's reload. The answer given at session_start cannot be reused: a
+ * repository with nothing Claude-shaped reads as approved without a question, so config
+ * that appears later (a branch checkout, an unpacked archive) would inherit an answer
+ * nobody gave. ctx is read once, here: the returned function holds values only, because
+ * a poll outlives the session and every getter of a replaced session's ctx throws. It
+ * never prompts, so a project that turned Claude-shaped mid-session stays out until the
+ * next session asks.
+ */
+export function approvalRecheck(ctx: Pick<ApprovalContext, 'cwd' | 'isProjectTrusted'>, deps: ApprovalDeps = defaultDeps): () => boolean {
+  const cwd = ctx.cwd
+  const piTrusted = ctx.isProjectTrusted?.() === true
+  return () => isProjectApprovedSilently({ cwd, isProjectTrusted: () => piTrusted }, deps)
+}
+
 /**
  * The approval decision for a file that is itself the thing to gate.
  *

package/extensions/internal/project-root.ts

@@ -77,9 +77,26 @@ function mainCheckout(root: string): string {
   const marker = `${path.sep}.git${path.sep}worktrees${path.sep}`
   const cut = worktreeDir.lastIndexOf(marker)
   if (cut === -1) return root
+  // The .git file is attacker-writable: an unpacked archive can ship one naming any
+  // directory, and following it as text moved the repository root, and with it the
+  // CLAUDE.md import boundary, to wherever it pointed.
+  if (!pointsBackAt(worktreeDir, dotGit)) return root
   return worktreeDir.slice(0, cut)
 }
 
+/** Whether a worktree's admin directory names `dotGit` as its worktree. git writes
+ * `<main>/.git/worktrees/<name>/gitdir` holding the path of the worktree's `.git` file
+ * (relative to that directory since git 2.48), and nothing outside an archive can be made
+ * to. Compared by realpath: git records the real path, a session cwd may be a symlink. */
+function pointsBackAt(worktreeDir: string, dotGit: string): boolean {
+  try {
+    const [line = ''] = fs.readFileSync(path.join(worktreeDir, 'gitdir'), 'utf-8').split('\n')
+    return fs.realpathSync(path.resolve(worktreeDir, line.trim())) === fs.realpathSync(dotGit)
+  } catch {
+    return false
+  }
+}
+
 function statOf(target: string): fs.Stats | null {
   try {
     return fs.statSync(target)

package/extensions/internal/settings-watch.ts

@@ -6,7 +6,7 @@
  */
 
 import * as fs from 'node:fs'
-import { parseNumericEnv } from './values.js'
+import { errorMessage, parseNumericEnv } from './values.js'
 
 // Captured at module load: the poll must run on real time even under a test's
 // fake timers (the stat watcher it replaced lived in libuv and was immune too);
@@ -37,7 +37,13 @@ export function watchSettingsFiles(files: string[], reload: () => void): () => v
     const next = files.map(snapshot)
     if (next.some((content, index) => content !== last[index])) {
       last = next
-      reload()
+      // The poll has no awaiter: a throw here is an uncaughtException, and pi exits on
+      // one. A reload that cannot cope with what it read costs that reload, not the session.
+      try {
+        reload()
+      } catch (error) {
+        console.warn(`pi-code: settings reload failed: ${errorMessage(error)}`)
+      }
     }
   }, interval)
   // A watcher alone must never keep a one-shot run alive.

package/extensions/internal/shared-slot.ts

@@ -0,0 +1,23 @@
+/**
+ * A process-wide slot for a function one extension registers and another calls.
+ *
+ * pi loads every extension entry through its own module graph, so a module-level `let`
+ * in a file two extensions import is a separate variable in each: the setter and the
+ * caller never meet, and the seam reads as "nothing registered" for the life of the
+ * process. `globalThis` is the one object the graphs share, and a registered symbol
+ * resolves to the same key from every copy of this module. pi's event bus carries the
+ * cross-extension data (see mcp-alias); a slot is for a call that returns a result.
+ *
+ * Each session replacement loads fresh extension instances, which register again and
+ * replace the previous instance's function.
+ */
+export function sharedSlot<T>(name: string): { get: () => T | undefined; set: (value: T | undefined) => void } {
+  const key = Symbol.for(`pi-code.${name}`)
+  const holder = globalThis as Record<symbol, unknown>
+  return {
+    get: () => holder[key] as T | undefined,
+    set: (value) => {
+      holder[key] = value
+    },
+  }
+}

package/extensions/internal/subagent-hooks.ts

@@ -6,17 +6,20 @@
  * pattern as mcp-call.
  */
 
+import { sharedSlot } from './shared-slot.js'
+
 export type SubagentStartHookRunner = (agentType: string, agentId: string) => Promise<string[]>
 
-let runner: SubagentStartHookRunner | undefined
+const slot = sharedSlot<SubagentStartHookRunner>('subagent-start-hook-runner')
 
 export function setSubagentStartHookRunner(fn: SubagentStartHookRunner | undefined): void {
-  runner = fn
+  slot.set(fn)
 }
 
 /** Context strings SubagentStart hooks contribute; empty when no runner is
  * registered or the runner fails (hooks must never block a spawn). */
 export async function runSubagentStartHooks(agentType: string, agentId: string): Promise<string[]> {
+  const runner = slot.get()
   if (!runner) return []
   try {
     return await runner(agentType, agentId)

package/extensions/mcp/config.ts

@@ -11,7 +11,7 @@ import { claudeConfigDir } from '../internal/config-dir.js'
 import type { OAuthServerConfig } from '../internal/mcp-oauth.js'
 import { type InstalledPlugin, pluginComponentPath } from '../internal/plugins.js'
 import { findNearestFile } from '../internal/project-root.js'
-import { errorMessage } from '../internal/values.js'
+import { errorMessage, isRecord } from '../internal/values.js'
 
 export interface StdioServerConfig {
   type?: 'stdio'
@@ -105,12 +105,26 @@ export function projectConfigPaths(cwd: string): string[] {
   return ['.mcp.json', path.join('.pi', 'mcp.json')].map((rel) => findNearestFile(cwd, rel) ?? path.join(cwd, rel))
 }
 
+/** The object entries of a raw `mcpServers` map. A string or null entry (a JSON "comment"
+ * key, a nulled-out server) would throw in the connect batch outside its per-server catch
+ * and sink every server with it, the project trust prompt included, so it is dropped here
+ * by name. */
+function serverEntries(raw: unknown, source: string): Record<string, ServerConfig> {
+  const servers: Record<string, ServerConfig> = {}
+  for (const [name, entry] of Object.entries(isRecord(raw) ? raw : {})) {
+    // Shape only: the fields are validated where a transport is chosen.
+    if (isRecord(entry)) servers[name] = entry as unknown as ServerConfig
+    else console.warn(`pi-code-mcp: ignoring mcpServers entry "${name}" in ${source}: not an object`)
+  }
+  return servers
+}
+
 export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
   const servers: Record<string, ServerConfig> = {}
   for (const file of files) {
     try {
       const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
-      Object.assign(servers, parsed.mcpServers ?? {})
+      Object.assign(servers, serverEntries(parsed?.mcpServers, file))
     } catch (error) {
       // A missing file is the normal case. A present file that does not parse is
       // not: one trailing comma silently disabled every server in it.
@@ -128,7 +142,7 @@ export function loadConfigFrom(files: string[]): Record<string, ServerConfig> {
  */
 export function loadUserScope(home: string, cwd: string): Record<string, ServerConfig> {
   const servers = loadConfigFrom(userConfigPaths(home))
-  Object.assign(servers, projectRecord(home, cwd).mcpServers ?? {})
+  Object.assign(servers, serverEntries(projectRecord(home, cwd).mcpServers, claudeJsonPath(home)))
   return servers
 }
 

package/extensions/memory.ts

@@ -277,14 +277,22 @@ export function capIndexForPrompt(index: string): string {
   return `${text}\n(${dropped} more memories not shown; use the memory tool with action "list")`
 }
 
+/** A memory's file name. Letters and digits of any script survive: an ASCII-only slug
+ * reduced every non-Latin name to one fallback, so distinct memories overwrote each
+ * other. `memory` is never produced, because on a case-insensitive filesystem memory.md
+ * is the MEMORY.md index, and writing one destroys the other. Cut by code point, so a
+ * character outside the basic plane is never split. */
 export function slugifyName(name: string): string {
-  return (
-    name
+  const slug = [
+    ...name
       .toLowerCase()
-      .replaceAll(/[^a-z0-9]+/g, '-')
-      .replaceAll(/^-|-$/g, '')
-      .slice(0, 64) || 'memory'
-  )
+      .replaceAll(/[^\p{L}\p{N}]+/gu, '-')
+      .replaceAll(/^-|-$/g, ''),
+  ]
+    .slice(0, 64)
+    .join('')
+  if (slug === '') return 'untitled'
+  return slug === 'memory' ? 'memory-note' : slug
 }
 
 /** The exact key prefix of a memory's index line; matching on a substring would also

package/extensions/output-styles.ts

@@ -22,16 +22,17 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { atomicWriteFile } from './internal/atomic-write.js'
 import { isFlagEnabled } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs } from './internal/project-root.js'
 import { claudeSettingsChain, localSettingsFile, readSettingsChain } from './internal/settings-chain.js'
-import { isDirectory } from './internal/values.js'
+import { errorMessage, isDirectory } from './internal/values.js'
 
 export interface OutputStyle {
   name: string
@@ -54,7 +55,7 @@ function field(frontmatter: Record<string, unknown>, key: string): string {
  * own YAML frontmatter parser, as the command loader uses: a line regex captured to
  * end of line, so `"Terse" # short` came back as `Terse" # short`. */
 export function parseStyle(content: string, fallbackName: string): OutputStyle {
-  const { frontmatter, body } = parseFrontmatter(content)
+  const { frontmatter, body } = parseClaudeFrontmatter(content)
   return {
     name: field(frontmatter, 'name') || fallbackName,
     description: field(frontmatter, 'description'),
@@ -121,6 +122,25 @@ export function pluginStyleDirs(home: string): string[] {
   })
 }
 
+/** One style file, or undefined when it cannot be used. A directory named *.md or an
+ * unreadable file is skipped silently. pi's frontmatter parser is strict YAML and throws:
+ * one unparseable file must cost that style, not every style of the session. */
+function readStyleFile(dir: string, entry: string): OutputStyle | undefined {
+  const file = path.join(dir, entry)
+  let content: string
+  try {
+    content = fs.readFileSync(file, 'utf-8')
+  } catch {
+    return undefined
+  }
+  try {
+    return parseStyle(content, entry.replace(/\.md$/, ''))
+  } catch (error) {
+    console.warn(`pi-code-output-styles: skipping ${file}: ${errorMessage(error).split('\n')[0]}`)
+    return undefined
+  }
+}
+
 /** All output styles, project entries overriding user entries of the same name. */
 export function loadStyles(dirs: string[]): OutputStyle[] {
   const byName = new Map<string, OutputStyle>()
@@ -131,16 +151,9 @@ export function loadStyles(dirs: string[]): OutputStyle[] {
     } catch {
       continue
     }
-    for (const entry of entries) {
-      if (!entry.endsWith('.md')) continue
-      let content: string
-      try {
-        content = fs.readFileSync(path.join(dir, entry), 'utf-8')
-      } catch {
-        continue // a directory named *.md or an unreadable file must not take down session start
-      }
-      const style = parseStyle(content, entry.replace(/\.md$/, ''))
-      byName.set(style.name, style)
+    for (const entry of entries.filter((name) => name.endsWith('.md'))) {
+      const style = readStyleFile(dir, entry)
+      if (style) byName.set(style.name, style)
     }
   }
   return [...byName.values()]

package/extensions/question.ts

@@ -190,6 +190,9 @@ export default function question(pi: ExtensionAPI) {
     description:
       'Ask the user a question and let them pick from options. Use when you need user input to proceed. Pass question and options, for example {"question": "Which one?", "options": [{"label": "alpha"}, {"label": "beta"}]}. To ask 2-4 questions at once, pass questions instead, with the same fields per entry.',
     parameters: QuestionParams,
+    // The host shows a custom dialog in one editor slot, so two questions running in
+    // parallel leave the first unanswerable and the run unable to finish.
+    executionMode: 'sequential',
 
     async execute(_toolCallId, rawParams, _signal, _onUpdate, ctx) {
       const specs = questionList(rawParams as Partial<QuestionSpec> & { questions?: QuestionSpec[] })

package/extensions/session-title.ts

@@ -121,12 +121,14 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
       return // no model, provider error: leave the session untitled (best-effort)
     }
     if (!title) return
-    // A /new during the await moved us to a different session, or a name has since been set;
-    // applying this title now would rename the wrong session, so drop it.
-    if (generation !== startedGeneration || pi.getSessionName?.()) return
     // Post-await ctx getters throw once the session is disposed, and an escaping rejection
-    // from this un-awaited settle can exit pi; apply the title best-effort.
+    // from this un-awaited settle can exit pi; apply the title best-effort. The name read
+    // belongs inside the guard too: pi's CLI never delivers the next session_start to this
+    // instance, so only that throw reveals a session replaced during the call.
     try {
+      // A /new during the await moved us to a different session, or a name has since been
+      // set; applying this title now would rename the wrong session, so drop it.
+      if (generation !== startedGeneration || pi.getSessionName?.()) return
       // pi.setSessionName refreshes the terminal/tab title natively (pi changelog), so a
       // separate ctx.ui.setTitle call would only duplicate that. The guard stays: a
       // disposed session throws from setSessionName post-await, and an escaping rejection

package/extensions/skills.ts

@@ -22,11 +22,12 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, type ExtensionContext, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { expandCommand, shellExecutionDisabled } from './commands.js'
 import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
@@ -103,7 +104,7 @@ function skillAt(root: string, dirName: string): { name: string; filePath: strin
   }
   let name = dirName
   try {
-    const declared = parseFrontmatter<Record<string, unknown>>(content).frontmatter.name
+    const declared = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter.name
     if (typeof declared === 'string' && declared.trim()) name = declared.trim()
   } catch {
     // Malformed frontmatter: pi's loader falls back to the directory name too.
@@ -210,7 +211,7 @@ async function expandSkillInvocation(pi: ExtensionAPI, rawText: string, ctx: Ext
   // Claude registers hooks a skill's frontmatter declares when the skill is
   // invoked, for the rest of the session; the hooks extension owns running them,
   // so the declaration is announced over the shared bus.
-  const frontmatter = parseFrontmatter<Record<string, unknown>>(content).frontmatter
+  const frontmatter = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter
   const declaredHooks = frontmatter.hooks
   if (declaredHooks !== null && typeof declaredHooks === 'object' && !Array.isArray(declaredHooks)) {
     pi.events?.emit(SKILL_HOOKS_CHANNEL, { skillName: name, hooks: declaredHooks })

package/extensions/status-line.ts

@@ -35,7 +35,7 @@ import { hookFiles, readDisableAllHooks, runHookCommand } from './hooks/index.js
 import { claudeEffortLevel } from './internal/effort.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { isPlanModeState, PLAN_MODE_CHANNEL } from './internal/plan-mode-state.js'
-import { isProjectApprovedSilently } from './internal/project-approval.js'
+import { approvalRecheck, isProjectApprovedSilently } from './internal/project-approval.js'
 import { gitRoot, repoRoot } from './internal/project-root.js'
 import { readSettingsChain } from './internal/settings-chain.js'
 import { watchSettingsFiles } from './internal/settings-watch.js'
@@ -503,10 +503,15 @@ export default function statusLine(pi: ExtensionAPI) {
     armRefresh()
     // Claude re-runs the script when the statusLine settings change mid-session; a
     // command change re-resolves and re-runs.
+    // The reload asks again rather than reusing `trusted` (see approvalRecheck), and reads
+    // the chain that answer allows: a statusLine command is executed, not just displayed.
+    const watchCwd = ctx.cwd
+    const stillApproved = approvalRecheck(ctx)
     disposeSettingsWatch()
     disposeSettingsWatch = watchSettingsFiles(files, () => {
       const previousCommand = config?.command
-      config = readDisableAllHooks(files) ? undefined : readStatusLineConfig(files)
+      const liveFiles = hookFiles(watchCwd, os.homedir(), trusted && stillApproved())
+      config = readDisableAllHooks(liveFiles) ? undefined : readStatusLineConfig(liveFiles)
       armRefresh()
       // The debounce batches rapid triggers, but a command the user just edited has
       // nothing to batch with: run it now so the result of the edit is immediate.

package/extensions/subagent/agents.ts

@@ -5,12 +5,13 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works/pi-coding-agent'
+import { getAgentDir, stripFrontmatter } from '@earendil-works/pi-coding-agent'
 // The same mapping a command's `allowed-tools` gets: an agent's `tools:` is the same
 // Claude field, and `--tools` is an exact-name allowlist, so a name pi has no tool for
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { parseClaudeFrontmatter } from '../internal/frontmatter.js'
 import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
@@ -176,7 +177,7 @@ function agentName(frontmatter: Record<string, unknown>, filePath: string, plugi
 function parseAgentFile(content: string, source: AgentSource, filePath: string, pluginName?: string): AgentConfig | null {
   let parsed: { frontmatter: Record<string, unknown>; body: string }
   try {
-    parsed = parseFrontmatter<Record<string, unknown>>(content)
+    parsed = parseClaudeFrontmatter<Record<string, unknown>>(content)
   } catch (error) {
     // Malformed YAML must not abort discovery for the whole directory, but a silent drop
     // reads as "that agent does not exist", so it is named like the other rejections here.

package/extensions/subagent/run.ts

@@ -133,16 +133,22 @@ function appendPartialNote(result: SingleResult): void {
  * try/catch around an inline spawn() call loses. */
 export function spawnChild(command: string, args: string[], options: { cwd: string; env: NodeJS.ProcessEnv }): { proc: ChildProcessByStdio<null, Readable, Readable> } | { error: Error } {
   try {
-    return {
-      proc: spawn(command, args, {
-        ...options,
-        shell: false,
-        stdio: ['ignore', 'pipe', 'pipe'],
-        // Its own group, so an abort reaches grandchildren too: killing only the
-        // direct child orphans a build or dev server the agent started.
-        detached: true,
-      }),
+    const proc = spawn(command, args, {
+      ...options,
+      shell: false,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      // Its own group, so an abort reaches grandchildren too: killing only the
+      // direct child orphans a build or dev server the agent started.
+      detached: true,
+    })
+    // A third failure shape: at the descriptor limit (EMFILE, ENFILE) node returns a child
+    // with no stdio and emits 'error' on the next tick. The callers wire stdout first, so
+    // the deferred event would find no listener, and an unhandled 'error' exits pi.
+    if (!proc.stdout) {
+      proc.on('error', () => {})
+      return { error: new Error('spawn returned no stdio: the file descriptor limit is likely exhausted (EMFILE)') }
     }
+    return { proc }
   } catch (error) {
     return { error: error as Error }
   }
@@ -338,7 +344,9 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
       proc.on('close', (code) => {
         cleanup()
         if (buffer.trim()) processLine(buffer)
-        resolve(code ?? 0)
+        // A capped run was stopped by this module's own SIGTERM, which pi's print mode
+        // answers with exit 143: that is not the agent failing, as background.ts also holds.
+        resolve(currentResult.partial ? 0 : (code ?? 0))
       })
 
       proc.on('error', (error: Error) => {

package/extensions/thinking.ts

@@ -83,8 +83,10 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     const current = pi.getThinkingLevel?.() ?? ctx.thinkingLevel ?? 'off'
     // A keyword only raises reasoning: leave a level already at or above the target.
     if (thinkingRank(current) >= thinkingRank(target)) return
-    override.arm(current, target)
+    // Armed with the level pi actually stored: it clamps to what the model supports, and
+    // an override armed with the level asked for never recognises its own escalation.
     pi.setThinkingLevel?.(target)
+    override.arm(current, pi.getThinkingLevel?.() ?? target)
     // Return nothing so the input is neither consumed nor transformed: Claude keeps
     // the keyword in the prompt.
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.65",
+  "version": "1.0.67",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",