pi-code 1.0.66 → 1.0.68

package/extensions/git-checkpoint.ts

@@ -263,9 +263,11 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
    * matches a pathspec through this, so its removal is staged instead of the stale index
    * entry silently riding along into the next checkpoint. */
   async function committedPaths(): Promise<Set<string>> {
-    const listed = await gitShadow(['ls-tree', '-r', '--name-only', 'HEAD'])
+    // -z: without it git quotes and octal-escapes a non-ASCII name, and the quoted form
+    // is a pathspec that matches nothing, which fails every later add of the session.
+    const listed = await gitShadow(['ls-tree', '-r', '--name-only', '-z', 'HEAD'])
     if (listed.code !== 0) return new Set()
-    return new Set(listed.stdout.split('\n').filter(Boolean))
+    return new Set(listed.stdout.split('\0').filter(Boolean))
   }
 
   /** git rejects the whole pathspec when one entry is ignored, so the ignored paths are

package/extensions/hooks/runners.ts

@@ -163,7 +163,16 @@ export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, {
     }
     // On Windows `detached` means DETACHED_PROCESS, which gives a console child its own
     // window; windowsHide keeps every hook invisible (a no-op elsewhere).
-    const child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    // node defers only a few spawn errors to the 'error' event; the rest (E2BIG from a
+    // payload past the argv limit) throw here, inside the promise executor, which would
+    // reject the runner and lose every sibling hook's verdict for the event.
+    let child: ReturnType<typeof spawn>
+    try {
+      child = spawn(target.file, target.spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, windowsHide: true, env })
+    } catch (error) {
+      resolve({ code: 0, stdout: '', stderr: errorMessage(error), timedOut: false, spawnFailed: true })
+      return
+    }
     onChild?.(() => killTree(child))
     let stdout = ''
     let stderr = ''

package/extensions/internal/command-file.ts

@@ -15,10 +15,8 @@
 
 import * as fs from 'node:fs'
 import * as path from 'node:path'
-
-import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
-
 import { CLAUDE_TOOL_MAP } from './claude-tool-names.js'
+import { parseClaudeFrontmatter } from './frontmatter.js'
 import { escapeRegExp } from './values.js'
 
 /** The pi file tools a Claude path rule can govern. */
@@ -291,7 +289,7 @@ export function parseCommandFile(content: string): ParsedCommand {
   // pi's own parser, rather than a hand-rolled one: it reads the YAML shapes Claude
   // command files actually use (flow sequences, block lists, quoted and multi-line
   // values), and a value this misreads is a restriction silently not applied.
-  const { frontmatter, body: raw } = parseFrontmatter(content)
+  const { frontmatter, body: raw } = parseClaudeFrontmatter(content)
   const body = raw.trim()
   const firstLine = body.split('\n').find((line) => line.trim().length > 0) ?? ''
   const disable = frontmatter['disable-model-invocation']

package/extensions/internal/frontmatter.ts

@@ -0,0 +1,59 @@
+/**
+ * Frontmatter of the markdown files Claude Code defines: agents, commands, skills and
+ * output styles.
+ *
+ * pi's parser is strict YAML. Claude's is not: its own /agents generator and Anthropic's
+ * plugins write `description: Use this agent when ... Examples: <example>Context: ...`,
+ * and the command reference documents `argument-hint: [pr-number] [priority]`. Strict
+ * YAML throws on ": " inside a plain scalar and on a second flow sequence, and a throw
+ * costs the whole file, so files that work in Claude Code did not exist here.
+ *
+ * The strict parse is tried first and kept whenever it succeeds. Only when it throws are
+ * the free-text fields quoted and the parse retried. The restriction fields
+ * (allowed-tools, tools, model, ...) are never rewritten: a value misread there is a
+ * restriction silently not applied, so a file whose restrictions do not parse stays
+ * rejected.
+ */
+
+import { parseFrontmatter } from '@earendil-works/pi-coding-agent'
+
+/** Top-level keys whose value is prose. `name` is an identifier and stays strict. */
+const FREE_TEXT_KEYS = new Set(['description', 'argument-hint', 'when_to_use'])
+
+/** A plain scalar, as opposed to a quoted one or a block scalar indicator. */
+const isPlainScalar = (value: string): boolean => value !== '' && !'"\'|>'.includes(value[0])
+
+/** `line` with its free-text plain scalar quoted. A JSON string is a YAML double-quoted
+ * scalar, and its escaping keeps a literal backslash literal, as a plain scalar does. */
+function quoteFreeText(line: string): string {
+  const colon = line.indexOf(':')
+  if (colon === -1 || !FREE_TEXT_KEYS.has(line.slice(0, colon))) return line
+  const value = line.slice(colon + 1).trim()
+  return isPlainScalar(value) ? `${line.slice(0, colon)}: ${JSON.stringify(value)}` : line
+}
+
+/** `content` with the free-text fields of its frontmatter block quoted, or undefined
+ * when there is no block or nothing in it changed. */
+function withQuotedFreeText(content: string): string | undefined {
+  if (!content.startsWith('---')) return undefined
+  const start = content.indexOf('\n') + 1
+  const end = content.indexOf('\n---', start)
+  if (start === 0 || end === -1) return undefined
+  const block = content.slice(start, end)
+  const quoted = block.split('\n').map(quoteFreeText).join('\n')
+  return quoted === block ? undefined : content.slice(0, start) + quoted + content.slice(end)
+}
+
+export function parseClaudeFrontmatter<T extends Record<string, unknown>>(content: string): { frontmatter: T; body: string } {
+  try {
+    return parseFrontmatter<T>(content)
+  } catch (error) {
+    const retry = withQuotedFreeText(content)
+    if (retry === undefined) throw error
+    try {
+      return parseFrontmatter<T>(retry)
+    } catch {
+      throw error
+    }
+  }
+}

package/extensions/internal/project-approval.ts

@@ -23,6 +23,7 @@ import * as path from 'node:path'
 import { getAgentDir, hasTrustRequiringProjectResources, ProjectTrustStore } from '@earendil-works/pi-coding-agent'
 
 import { ROOT_MARKERS } from './project-root.js'
+import { localSettingsFile } from './settings-chain.js'
 
 /** Project files pi-code acts on that pi's own trust check does not look for. */
 const CLAUDE_SHAPED = [
@@ -52,6 +53,12 @@ const CLAUDE_SHAPED = [
  * home that is in no repository would otherwise walk up into it and report the user's
  * own settings as a project waiting to be approved. */
 export function hasClaudeShapedConfig(cwd: string, home: string = os.homedir()): boolean {
+  // settings.local.json is read from the main checkout, which a worktree's .git file
+  // names and which is a sibling of cwd, never on the walk below. An archive can carry
+  // both ends of that pointer, so the file the chain will read is checked where it is.
+  // At home the file is the user's own, as the walk also holds.
+  const relocated = localSettingsFile(cwd, home)
+  if (path.dirname(path.dirname(relocated)) !== home && fs.existsSync(relocated)) return true
   let currentDir = cwd
   while (true) {
     // The home check comes first: at home itself the .claude found is the user's own.

package/extensions/internal/project-root.ts

@@ -77,9 +77,26 @@ function mainCheckout(root: string): string {
   const marker = `${path.sep}.git${path.sep}worktrees${path.sep}`
   const cut = worktreeDir.lastIndexOf(marker)
   if (cut === -1) return root
+  // The .git file is attacker-writable: an unpacked archive can ship one naming any
+  // directory, and following it as text moved the repository root, and with it the
+  // CLAUDE.md import boundary, to wherever it pointed.
+  if (!pointsBackAt(worktreeDir, dotGit)) return root
   return worktreeDir.slice(0, cut)
 }
 
+/** Whether a worktree's admin directory names `dotGit` as its worktree. git writes
+ * `<main>/.git/worktrees/<name>/gitdir` holding the path of the worktree's `.git` file
+ * (relative to that directory since git 2.48), and nothing outside an archive can be made
+ * to. Compared by realpath: git records the real path, a session cwd may be a symlink. */
+function pointsBackAt(worktreeDir: string, dotGit: string): boolean {
+  try {
+    const [line = ''] = fs.readFileSync(path.join(worktreeDir, 'gitdir'), 'utf-8').split('\n')
+    return fs.realpathSync(path.resolve(worktreeDir, line.trim())) === fs.realpathSync(dotGit)
+  } catch {
+    return false
+  }
+}
+
 function statOf(target: string): fs.Stats | null {
   try {
     return fs.statSync(target)

package/extensions/internal/tool-target.ts

@@ -7,16 +7,41 @@
  * context-imports and the command path-scope guard all go through it).
  */
 
+import * as os from 'node:os'
+import * as path from 'node:path'
+import { fileURLToPath } from 'node:url'
+
 /** The tools that name a file pi-code acts on. */
 const FILE_TOOLS: ReadonlySet<string> = new Set(['read', 'edit', 'write'])
 
+/** The spaces pi folds to a plain one before resolving (pi dist/utils/paths). */
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g
+
+/** `target` as pi's file tools read it before resolving against cwd: a leading @ (which
+ * some models add) stripped, ~ expanded, a file:// URL decoded, unicode spaces folded.
+ * pi does this in resolveToCwd (dist/core/tools/path-utils), which the package does not
+ * export. A reader that skips it judges a different file than the one pi opens: a
+ * command scoped to `Read(*.md)` allowed `~/secret/notes.md`, read as <cwd>/~/secret. */
+function asPiReadsIt(target: string): string {
+  const folded = target.replace(UNICODE_SPACES, ' ')
+  const bare = folded.startsWith('@') ? folded.slice(1) : folded
+  if (bare === '~') return os.homedir()
+  if (bare.startsWith('~/') || (process.platform === 'win32' && bare.startsWith('~\\'))) return path.join(os.homedir(), bare.slice(2))
+  if (!bare.startsWith('file://')) return bare
+  try {
+    return fileURLToPath(bare)
+  } catch {
+    return bare
+  }
+}
+
 /** The path a file tool call named, or undefined for any other tool, an errored call,
- * or a call that named none. The path is as the tool gave it: callers resolve it
- * against their own cwd. */
+ * or a call that named none. Normalised as pi normalises it, and still relative when
+ * the model gave a relative path: callers resolve it against their own cwd. */
 export function fileToolTarget(event: { toolName: string; input?: unknown; isError?: boolean }): string | undefined {
   if (event.isError === true) return undefined
   if (!FILE_TOOLS.has(event.toolName)) return undefined
   const input = event.input as { path?: unknown; file_path?: unknown } | undefined
   const target = typeof input?.path === 'string' ? input.path : input?.file_path
-  return typeof target === 'string' && target.length > 0 ? target : undefined
+  return typeof target === 'string' && target.length > 0 ? asPiReadsIt(target) : undefined
 }

package/extensions/memory.ts

@@ -277,14 +277,22 @@ export function capIndexForPrompt(index: string): string {
   return `${text}\n(${dropped} more memories not shown; use the memory tool with action "list")`
 }
 
+/** A memory's file name. Letters and digits of any script survive: an ASCII-only slug
+ * reduced every non-Latin name to one fallback, so distinct memories overwrote each
+ * other. `memory` is never produced, because on a case-insensitive filesystem memory.md
+ * is the MEMORY.md index, and writing one destroys the other. Cut by code point, so a
+ * character outside the basic plane is never split. */
 export function slugifyName(name: string): string {
-  return (
-    name
+  const slug = [
+    ...name
       .toLowerCase()
-      .replaceAll(/[^a-z0-9]+/g, '-')
-      .replaceAll(/^-|-$/g, '')
-      .slice(0, 64) || 'memory'
-  )
+      .replaceAll(/[^\p{L}\p{N}]+/gu, '-')
+      .replaceAll(/^-|-$/g, ''),
+  ]
+    .slice(0, 64)
+    .join('')
+  if (slug === '') return 'untitled'
+  return slug === 'memory' ? 'memory-note' : slug
 }
 
 /** The exact key prefix of a memory's index line; matching on a substring would also

package/extensions/output-styles.ts

@@ -22,10 +22,11 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 import { atomicWriteFile } from './internal/atomic-write.js'
 import { isFlagEnabled } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
@@ -54,7 +55,7 @@ function field(frontmatter: Record<string, unknown>, key: string): string {
  * own YAML frontmatter parser, as the command loader uses: a line regex captured to
  * end of line, so `"Terse" # short` came back as `Terse" # short`. */
 export function parseStyle(content: string, fallbackName: string): OutputStyle {
-  const { frontmatter, body } = parseFrontmatter(content)
+  const { frontmatter, body } = parseClaudeFrontmatter(content)
   return {
     name: field(frontmatter, 'name') || fallbackName,
     description: field(frontmatter, 'description'),

package/extensions/session-title.ts

@@ -121,12 +121,14 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
       return // no model, provider error: leave the session untitled (best-effort)
     }
     if (!title) return
-    // A /new during the await moved us to a different session, or a name has since been set;
-    // applying this title now would rename the wrong session, so drop it.
-    if (generation !== startedGeneration || pi.getSessionName?.()) return
     // Post-await ctx getters throw once the session is disposed, and an escaping rejection
-    // from this un-awaited settle can exit pi; apply the title best-effort.
+    // from this un-awaited settle can exit pi; apply the title best-effort. The name read
+    // belongs inside the guard too: pi's CLI never delivers the next session_start to this
+    // instance, so only that throw reveals a session replaced during the call.
     try {
+      // A /new during the await moved us to a different session, or a name has since been
+      // set; applying this title now would rename the wrong session, so drop it.
+      if (generation !== startedGeneration || pi.getSessionName?.()) return
       // pi.setSessionName refreshes the terminal/tab title natively (pi changelog), so a
       // separate ctx.ui.setTitle call would only duplicate that. The guard stays: a
       // disposed session throws from setSessionName post-await, and an escaping rejection

package/extensions/skills.ts

@@ -22,11 +22,12 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { type ExtensionAPI, type ExtensionContext, parseFrontmatter } from '@earendil-works/pi-coding-agent'
+import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { expandCommand, shellExecutionDisabled } from './commands.js'
 import { runAgent } from './internal/agent-run.js'
 import { parseCommandFile } from './internal/command-file.js'
 import { claudeConfigDir } from './internal/config-dir.js'
+import { parseClaudeFrontmatter } from './internal/frontmatter.js'
 import { managedSettingsFile } from './internal/managed-settings.js'
 import { installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApprovedSilently } from './internal/project-approval.js'
@@ -103,7 +104,7 @@ function skillAt(root: string, dirName: string): { name: string; filePath: strin
   }
   let name = dirName
   try {
-    const declared = parseFrontmatter<Record<string, unknown>>(content).frontmatter.name
+    const declared = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter.name
     if (typeof declared === 'string' && declared.trim()) name = declared.trim()
   } catch {
     // Malformed frontmatter: pi's loader falls back to the directory name too.
@@ -166,11 +167,37 @@ function refusedByOverride(name: string, ctx: ExtensionContext, trusted: boolean
   return { action: 'handled' }
 }
 
+/** Forked skills still running in the background, by name. */
+const runningForks = new Set<string>()
+
+/** Whether a context: fork skill holds the invoking turn for its result. Claude: "The
+ * forked subagent runs in the background: you keep working while it runs, and its result
+ * arrives in your conversation when it completes. Set background: false in the frontmatter
+ * to instead wait for the result in the turn that invoked the skill." It also waits in
+ * non-interactive mode, when CLAUDE_CODE_DISABLE_BACKGROUND_TASKS is 1, and "when you
+ * invoke a forked skill while an earlier invocation of the same skill is still running". */
+function forkWaits(name: string, frontmatter: Record<string, unknown>, ctx: ExtensionContext): boolean {
+  if (String(frontmatter.background).trim().toLowerCase() === 'false') return true
+  return !ctx.hasUI || process.env.CLAUDE_CODE_DISABLE_BACKGROUND_TASKS === '1' || runningForks.has(name)
+}
+
+/** Start a forked skill in the background and hand its result to the conversation when it
+ * completes. The promise has no awaiter, and sendMessage on a pi whose session was
+ * replaced meanwhile throws: the catch keeps that from exiting pi, at the cost of the
+ * delivery, as a background subagent run's completion notice is lost the same way. */
+function startForkedSkill(pi: ExtensionAPI, ctx: ExtensionContext, fork: { name: string; filePath: string; expanded: string; agentName: string | undefined }): { action: 'handled' } {
+  runningForks.add(fork.name)
+  ctx.ui.notify(`Skill ${fork.name} is running in a forked subagent in the background; its result arrives here when it completes.`, 'info')
+  void runForkedSkill(fork.name, fork.filePath, fork.expanded, fork.agentName)
+    .then((result) => pi.sendMessage({ customType: 'skill-fork', content: result.text, display: true }, { triggerTurn: true }))
+    .catch(() => {})
+    .finally(() => runningForks.delete(fork.name))
+  return { action: 'handled' }
+}
+
 /** Claude's context: fork run: the expanded skill content becomes the prompt that
- * drives a subagent, without the conversation history. Divergence: Claude
- * backgrounds the fork by default; pi-code waits for the result in the invoking
- * turn (Claude's background: false behavior, which is also what Claude itself
- * does in -p and SDK runs). */
+ * drives a subagent, without the conversation history. Never rejects: a failed run
+ * is reported in the returned block. */
 async function runForkedSkill(name: string, filePath: string, expanded: string, agentName: string | undefined): Promise<{ action: 'transform'; text: string }> {
   try {
     const output = await runAgent({ prompt: expanded, fullTools: true, ...(agentName ? { agent: agentName } : {}) })
@@ -210,14 +237,16 @@ async function expandSkillInvocation(pi: ExtensionAPI, rawText: string, ctx: Ext
   // Claude registers hooks a skill's frontmatter declares when the skill is
   // invoked, for the rest of the session; the hooks extension owns running them,
   // so the declaration is announced over the shared bus.
-  const frontmatter = parseFrontmatter<Record<string, unknown>>(content).frontmatter
+  const frontmatter = parseClaudeFrontmatter<Record<string, unknown>>(content).frontmatter
   const declaredHooks = frontmatter.hooks
   if (declaredHooks !== null && typeof declaredHooks === 'object' && !Array.isArray(declaredHooks)) {
     pi.events?.emit(SKILL_HOOKS_CHANNEL, { skillName: name, hooks: declaredHooks })
   }
   const expanded = await expandCommand(pi, parsed, args, { cwd: ctx.cwd }, found.filePath, undefined, { allowShell: !shellExecutionDisabled(ctx.cwd, os.homedir(), trusted) })
   if (typeof frontmatter.context === 'string' && frontmatter.context.trim().toLowerCase() === 'fork') {
-    return runForkedSkill(name, found.filePath, expanded, typeof frontmatter.agent === 'string' ? frontmatter.agent.trim() : undefined)
+    const agentName = typeof frontmatter.agent === 'string' ? frontmatter.agent.trim() : undefined
+    if (forkWaits(name, frontmatter, ctx)) return runForkedSkill(name, found.filePath, expanded, agentName)
+    return startForkedSkill(pi, ctx, { name, filePath: found.filePath, expanded, agentName })
   }
   return { action: 'transform', text: `<skill name="${name}" location="${found.filePath}">\nReferences are relative to ${found.baseDir}.\n\n${expanded}\n</skill>` }
 }

package/extensions/status-line.ts

@@ -114,12 +114,15 @@ function toNumber(value: string | undefined): number | undefined {
 }
 
 /** One rate-limit window from the `anthropic-ratelimit-<prefix>-*` header family,
- * taking a direct `-utilization` percentage when present, else computing it from
- * `-limit` and `-remaining`. resets_at comes from `-reset` when the header is set.
- * Header names vary, so only what is present is read and a bare number is enough. */
+ * taking `-utilization` when present, else computing the percentage from `-limit` and
+ * `-remaining`. `-utilization` is a 0 to 1 fraction, while Claude documents
+ * used_percentage as "from 0 to 100": it is scaled and rounded to one decimal, as
+ * Claude Code does (Math.round(utilization * 1000) / 10). resets_at comes from `-reset`
+ * when the header is set. Header names vary, so only what is present is read. */
 function readRateLimitWindow(headers: Record<string, string>, prefix: string): RateLimitWindow | undefined {
   const base = `anthropic-ratelimit-${prefix}`
-  let usedPercentage = toNumber(headers[`${base}-utilization`])
+  const utilization = toNumber(headers[`${base}-utilization`])
+  let usedPercentage = utilization === undefined ? undefined : Math.round(utilization * 1000) / 10
   if (usedPercentage === undefined) {
     const limit = toNumber(headers[`${base}-limit`])
     const remaining = toNumber(headers[`${base}-remaining`])

package/extensions/subagent/agents.ts

@@ -5,12 +5,13 @@
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
-import { getAgentDir, parseFrontmatter, stripFrontmatter } from '@earendil-works/pi-coding-agent'
+import { getAgentDir, stripFrontmatter } from '@earendil-works/pi-coding-agent'
 // The same mapping a command's `allowed-tools` gets: an agent's `tools:` is the same
 // Claude field, and `--tools` is an exact-name allowlist, so a name pi has no tool for
 // is not merely ignored, it narrows the child's registry.
 import { parseToolGrants } from '../internal/command-file.js'
 import { claudeConfigDir } from '../internal/config-dir.js'
+import { parseClaudeFrontmatter } from '../internal/frontmatter.js'
 import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
 import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
@@ -176,7 +177,7 @@ function agentName(frontmatter: Record<string, unknown>, filePath: string, plugi
 function parseAgentFile(content: string, source: AgentSource, filePath: string, pluginName?: string): AgentConfig | null {
   let parsed: { frontmatter: Record<string, unknown>; body: string }
   try {
-    parsed = parseFrontmatter<Record<string, unknown>>(content)
+    parsed = parseClaudeFrontmatter<Record<string, unknown>>(content)
   } catch (error) {
     // Malformed YAML must not abort discovery for the whole directory, but a silent drop
     // reads as "that agent does not exist", so it is named like the other rejections here.

package/extensions/thinking.ts

@@ -83,8 +83,10 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     const current = pi.getThinkingLevel?.() ?? ctx.thinkingLevel ?? 'off'
     // A keyword only raises reasoning: leave a level already at or above the target.
     if (thinkingRank(current) >= thinkingRank(target)) return
-    override.arm(current, target)
+    // Armed with the level pi actually stored: it clamps to what the model supports, and
+    // an override armed with the level asked for never recognises its own escalation.
     pi.setThinkingLevel?.(target)
+    override.arm(current, pi.getThinkingLevel?.() ?? target)
     // Return nothing so the input is neither consumed nor transformed: Claude keeps
     // the keyword in the prompt.
   })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.66",
+  "version": "1.0.68",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",