pi-code 1.0.68 → 1.0.70

package/extensions/context-imports.ts

@@ -601,7 +601,8 @@ function nestedContextBlock(file: string, dir: string, load: NestedLoadContext):
   // a body already in the system prompt.
   const seen = new Set([...load.launchLoaded, real])
   const budget = createImportBudget()
-  const imports = collectImports(content, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
+  // The stripped body, as at launch: a commented-out @import never expands.
+  const imports = collectImports(body, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
     importer: real,
     isExcluded: (absPath) => isExcludedPath(absPath, load.excludeGlobs, load.home),
     budget,

package/extensions/git-checkpoint.ts

@@ -168,6 +168,8 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   // assistant turns it drives. before_agent_start starts a run; the first turn_start
   // then snapshots and clears this, so turns 2..n skip the wasted git work.
   let runNeedsSnapshot = true
+  /** Whether the run about to start came from a prompt (see before_agent_start below). */
+  let promptedRun = false
   let shadowDir: string | undefined
   let workTree: string | undefined
   // Absolute paths this session's edit tools targeted: the whole of what a checkpoint
@@ -219,6 +221,17 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     await mirrorLocalExcludes(ctx)
   }
 
+  /** /fork writes a new session file and copies the branch's checkpoint entries into it,
+   * while the shadow repository is keyed to the session file: the refs those entries name
+   * live in the parent's shadow, and a restore from the fork's own answered "invalid
+   * reference". A local bare-to-bare fetch brings them across. Best effort: a parent
+   * shadow already pruned leaves those checkpoints unrestorable, as they were. */
+  async function inheritCheckpointRefs(previousSessionFile: string): Promise<void> {
+    const parentShadow = path.join(getAgentDir(), 'checkpoints', sessionSlug(previousSessionFile))
+    if (parentShadow === shadowDir || !fs.existsSync(parentShadow)) return
+    await gitShadow(['fetch', '--quiet', parentShadow, `+${CHECKPOINT_REF_PREFIX}/*:${CHECKPOINT_REF_PREFIX}/*`])
+  }
+
   /** git reads ignore rules from the tree's .gitignore files, the user's global excludes,
    * and $GIT_DIR/info/exclude. The shadow is the GIT_DIR here, so the repo's own
    * .git/info/exclude (where secrets and scratch that must never be committed live)
@@ -308,12 +321,29 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   /** Fold a file's pre-edit content into the run's checkpoint. A file first edited part
    * way through a run is absent from that run's pre-run snapshot, so without this its
    * checkpoint holds no baseline and /rewind cannot undo that first edit. */
+  /** `file` named by the real directory it sits in, when a symlink inside the work tree
+   * leads there. git refuses a pathspec that passes through a symlink ("beyond a symbolic
+   * link"), so the file has to be tracked where it really is. The real directory is mapped
+   * back under the work tree as the session spells it: a cwd that is itself a symlinked
+   * path (macOS /var) must not push every file outside the tree. */
+  function throughSymlinks(file: string): string {
+    if (!workTree) return file
+    try {
+      const realTree = fs.realpathSync(workTree)
+      const realDir = fs.realpathSync(path.dirname(file))
+      const inside = path.relative(realTree, realDir)
+      if (inside.startsWith('..') || path.isAbsolute(inside)) return file
+      return path.join(workTree, inside, path.basename(file))
+    } catch {
+      return file
+    }
+  }
+
   async function captureBaseline(file: string): Promise<void> {
     const rel = workTreePath(file)
     if (!runRef || rel === undefined || !fs.existsSync(file)) return
     if ((await withoutIgnored([rel])).length === 0) return
-    const add = await gitShadow(['add', '--', rel])
-    if (add.code !== 0) return
+    if (!(await addPaths([rel]))) return
     // A commit, never an amend: the run's checkpoint can be a commit an earlier
     // checkpoint also points at, and rewriting it would strand that one.
     const commit = await commitShadow([])
@@ -329,13 +359,50 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     return files.code === 0 && files.stdout.trim() === ''
   }
 
+  /** Stage what `git add` silently skipped. For a path under another repository (a
+   * workspace of clones, a submodule, $HOME) it exits 0 and stages nothing, so the edit
+   * was never snapshotted while /rewind still reported success. Such a file is written to
+   * the index directly, which `checkout` restores like any other entry. A deletion needs
+   * nothing here: `git add` does stage the removal of an entry the index already holds. */
+  async function stageSkippedPaths(paths: string[]): Promise<void> {
+    if (!workTree) return
+    const listed = await gitShadow(['ls-files', '-z', '--', ...paths])
+    if (listed.code !== 0) return
+    const indexed = new Set(listed.stdout.split('\0').filter(Boolean))
+    for (const rel of paths) {
+      if (!indexed.has(rel) && fs.existsSync(path.join(workTree, rel))) await indexDirectly(rel)
+    }
+  }
+
+  async function indexDirectly(rel: string): Promise<void> {
+    if (!workTree) return
+    const blob = await gitShadow(['hash-object', '-w', '--', rel])
+    if (blob.code !== 0) return
+    const executable = (fs.statSync(path.join(workTree, rel)).mode & 0o111) !== 0
+    await gitShadow(['update-index', '--add', '--cacheinfo', `${executable ? '100755' : '100644'},${blob.stdout.trim()},${rel}`])
+  }
+
+  /** Stage the tracked paths. git fails the whole add when one pathspec is refused, which
+   * used to end checkpointing for the session over a single path. On a failure each path
+   * is added alone and one git still refuses is dropped from the edit set, so it costs
+   * its own checkpoint and nobody else's. False only when nothing could be staged. */
+  async function addPaths(paths: string[]): Promise<boolean> {
+    if ((await gitShadow(['add', '--', ...paths])).code === 0) {
+      await stageSkippedPaths(paths)
+      return true
+    }
+    let staged = 0
+    for (const rel of paths) {
+      if ((await gitShadow(['add', '--', rel])).code === 0) staged++
+      else if (workTree) touched.delete(path.resolve(workTree, rel))
+    }
+    return staged > 0
+  }
+
   async function snapshot(): Promise<{ ref: string; createdAt: string } | undefined> {
     const createdAt = new Date().toISOString()
     const paths = await addablePaths()
-    if (paths.length > 0) {
-      const add = await gitShadow(['add', '--', ...paths])
-      if (add.code !== 0) return undefined
-    }
+    if (paths.length > 0 && !(await addPaths(paths))) return undefined
     // Decide "nothing changed" from the index, not from the commit exit code: a commit can
     // also fail on the user's global signing or hooks config, and reusing HEAD then would
     // record a ref that predates the current tree, so /rewind restores the wrong state.
@@ -386,7 +453,7 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     ctx.ui.notify('Rewind complete', 'info')
   }
 
-  pi.on('session_start', async (_event, ctx) => {
+  pi.on('session_start', async (event, ctx) => {
     // One extension instance serves every session. A mid-turn /new fires session_start on
     // the same instance after turn_start took the pre-run snapshot but before turn_end saved
     // it; that pending ref belongs to the previous session and must not attach to the next
@@ -394,8 +461,11 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     // own tree even though the prior run left it false.
     pending = undefined
     runNeedsSnapshot = true
+    promptedRun = false
     runRef = undefined
     await ensureShadow(ctx)
+    const forkedFrom = event.reason === 'fork' ? event.previousSessionFile : undefined
+    if (forkedFrom) await inheritCheckpointRefs(forkedFrom)
     touched.clear()
     for (const rel of await committedPaths()) touched.add(path.resolve(ctx.cwd, rel))
     checkpoints.clear()
@@ -425,13 +495,39 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   // the checkpoint is only keyed and saved at turn_end. The snapshot is awaited here so
   // `git add -A` captures the tree before the model's first edit; turn_end reads the
   // resolved value.
-  pi.on('turn_start', async () => {
+  // Only a prompt fires before_agent_start. A provider retry, an overflow recovery and a
+  // queued follow-up all re-enter through agent.continue(), with agent_start alone.
+  pi.on('before_agent_start', async () => {
+    promptedRun = true
+  })
+
+  /** The checkpoint a continued run is still working under: it re-entered with no new user
+   * message, so its prompt already has one. A snapshot taken there stages every tracked
+   * file at its MID-run content into the index the recorded checkpoint is later extended
+   * from (a baseline captured afterwards moved the checkpoint onto that content), and a
+   * file first edited in that turn had its baseline folded into the discarded ref. */
+  function continuedCheckpoint(ctx: ExtensionContext): Checkpoint | undefined {
+    // A queued follow-up is a new user message and needs its own snapshot. Optional: the
+    // peer range reaches runtimes that may not have the method.
+    if (ctx.hasPendingMessages?.()) return undefined
+    const target = findLastUserMessage(ctx)
+    return target ? checkpoints.get(target.entryId) : undefined
+  }
+
+  pi.on('turn_start', async (_event, ctx) => {
     if (!runNeedsSnapshot) return
     runNeedsSnapshot = false
+    const prompted = promptedRun
+    promptedRun = false
     // Claude: "Set to 1 to disable file checkpointing. The /rewind command will not be
     // able to restore code changes." No snapshot means turn_end's `if (!snap) return`
     // always fires, so no checkpoint is ever recorded.
     if (process.env.CLAUDE_CODE_DISABLE_FILE_CHECKPOINTING === '1') return
+    const continued = prompted ? undefined : continuedCheckpoint(ctx)
+    if (continued) {
+      runRef = continued.ref
+      return
+    }
     pending = await snapshot()
   })
 
@@ -442,7 +538,7 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     if (!EDIT_TOOLS.has(event.toolName)) return
     const target = fileToolTarget(event)
     if (target === undefined) return
-    const file = path.resolve(ctx.cwd, target)
+    const file = throughSymlinks(path.resolve(ctx.cwd, target))
     if (touched.has(file)) return
     touched.add(file)
     await captureBaseline(file)

package/extensions/internal/atomic-write.ts

@@ -6,9 +6,37 @@
 
 import * as fs from 'node:fs'
 
-/** The tmp name carries the pid so concurrent processes do not collide. */
+/** The file a path leads to. A rename onto a symlink replaces the link itself: a settings
+ * file a dotfiles setup links into a repository would silently become a regular file while
+ * the real one kept the old content. The write goes to the real file, in its own directory
+ * so the rename stays on one filesystem. A link that leads nowhere yet is written as is. */
+function throughLinks(filePath: string): string {
+  try {
+    return fs.realpathSync(filePath)
+  } catch {
+    return filePath
+  }
+}
+
+/** The permission bits of `filePath`, or undefined when it does not exist yet. */
+function existingMode(filePath: string): number | undefined {
+  try {
+    return fs.statSync(filePath).mode & 0o777
+  } catch {
+    return undefined
+  }
+}
+
+/** The tmp name carries the pid so concurrent processes do not collide. A rename replaces
+ * the file's inode, so the replacement is created with the mode of the file it replaces:
+ * settings.local.json can hold env secrets, and a fresh temp file is 0644 under the usual
+ * umask. Created with that mode, the temp file is never more permissive than the target;
+ * the chmod then makes it exact where the umask took bits away. */
 export function atomicWriteFile(filePath: string, content: string): void {
-  const tmp = `${filePath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, filePath)
+  const target = throughLinks(filePath)
+  const tmp = `${target}.${process.pid}.tmp`
+  const mode = existingMode(target)
+  fs.writeFileSync(tmp, content, mode === undefined ? undefined : { mode })
+  if (mode !== undefined) fs.chmodSync(tmp, mode)
+  fs.renameSync(tmp, target)
 }

package/extensions/internal/mcp-oauth.ts

@@ -286,12 +286,20 @@ export function waitForAuthCode(server: http.Server, timeoutMs: number, expected
   })
 }
 
-/** Best-effort browser launch; the caller also surfaces the URL as text. */
+/** Best-effort browser launch; the caller also surfaces the URL as text.
+ *
+ * The URL comes from the server's metadata, so two things are not taken on trust. Only a
+ * web page is opened: the SDK rejects javascript:, data: and vbscript: alone, and a file:
+ * URL or a custom protocol handed to the platform launcher opens a file or starts an
+ * application. And on Windows no shell sees it: `cmd /c start` splits its line at every
+ * bare `&`, which every authorization URL has, truncating the URL and running the rest as
+ * commands. rundll32 takes the URL as one argument. */
 export function openBrowser(url: string): void {
+  if (!/^https?:\/\//i.test(url)) return
   let command = 'xdg-open'
   if (process.platform === 'darwin') command = 'open'
-  else if (process.platform === 'win32') command = 'cmd'
-  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  else if (process.platform === 'win32') command = 'rundll32'
+  const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url]
   try {
     const child = spawn(command, args, { stdio: 'ignore', detached: true })
     // A missing launcher (a container or an SSH session with no xdg-open) reports itself

package/extensions/internal/shell-split.ts

@@ -17,6 +17,8 @@ function separatorAt(command: string, i: number): number {
   const pair = command.slice(i, i + 2)
   if (pair === '&&' || pair === '||' || pair === '|&') return 2
   const ch = command[i]
+  // The & of a redirection (`2>&1`, `&>file`) belongs to the command, not between two.
+  if (ch === '&' && (command[i - 1] === '>' || command[i + 1] === '>')) return 0
   return ch === ';' || ch === '|' || ch === '&' || ch === '\n' ? 1 : 0
 }
 

package/extensions/mcp/transport.ts

@@ -37,12 +37,17 @@ const DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS = 1_800_000
 
 /** Claude's numeric env vars accept scientific notation and digit-separator spellings
  * (2e3 as 2000, 64_000 as 64000). A non-numeric value is undefined, not zero. */
+/** The longest delay setTimeout holds: it keeps the delay in 32 bits, and a larger one fires
+ * after 1 ms. A user's "never" (3000000000) made every call time out at once, so a timeout
+ * is clamped to this, about 24.8 days. */
+const MAX_TIMER_MS = 2_147_483_647
+
 /** A positive-integer env override, or the default when unset or unparseable. */
 function envTimeout(name: string, fallback: number): number {
   const raw = process.env[name]
   if (raw === undefined) return fallback
   const value = parseNumericEnv(raw)
-  return value !== undefined && value > 0 ? Math.floor(value) : fallback
+  return value !== undefined && value > 0 ? Math.min(Math.floor(value), MAX_TIMER_MS) : fallback
 }
 
 // Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.
@@ -97,7 +102,7 @@ export function callRequestOptions(wall: number, tuning: ServerCallTuning = {}):
  * per-server timeout. Per Claude, timeout values below 1000 are ignored and fall
  * through to MCP_TOOL_TIMEOUT. */
 export function serverCallTuning(config: ServerConfig): ServerCallTuning {
-  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
+  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? Math.min(config.timeout, MAX_TIMER_MS) : undefined
   return { stdio: isStdio(config), ...(declared !== undefined ? { serverTimeoutMs: declared } : {}) }
 }
 

package/extensions/plan-mode/utils.ts

@@ -5,7 +5,9 @@
 
 import { hasSubstitution, splitSegments } from '../internal/shell-split.js'
 
-// Destructive commands blocked in plan mode
+// Destructive commands blocked in plan mode. Tested against the segment's command word,
+// the one word that runs: an allowlisted head never executes its arguments, so `code`
+// in a path, `touch` in a quoted pattern or `cp` in a file name is not a command.
 const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\brmdir\b/i,
@@ -21,8 +23,6 @@ const DESTRUCTIVE_PATTERNS = [
   /\btruncate\b/i,
   /\bdd\b/i,
   /\bshred\b/i,
-  /(^|[^<])>(?!>)/,
-  />>/,
   /\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
   /\byarn\s+(add|remove|install|publish)/i,
   /\bpnpm\s+(add|remove|install|publish)/i,
@@ -40,7 +40,17 @@ const DESTRUCTIVE_PATTERNS = [
   /\bsystemctl\s+(start|stop|restart|enable|disable)/i,
   /\bservice\s+\S+\s+(start|stop|restart)/i,
   /\b(vim?|nano|emacs|code|subl)\b/i,
-]
+].map((pattern) => new RegExp(String.raw`^\s*(?:${pattern.source})`, pattern.flags))
+
+// A redirect writes wherever it points, from any position in the segment.
+const REDIRECT_PATTERNS = [/(^|[^<])>(?!>)/, />>/]
+
+// Redirections that write nothing: onto /dev/null, and a descriptor duplicated onto
+// another (`2>&1`, `>&2`, `>&-`). `>&file` is not one: it writes the file. Every run is
+// bounded: the text is chosen by the model, and an unbounded `\d*` in front of an
+// unanchored match backtracks quadratically (40,000 digits took over a second).
+const DEV_NULL_REDIRECT = /(?:&|\d{0,3})>>?[ \t]{0,8}\/dev\/null(?=\s|$)/g
+const DESCRIPTOR_REDIRECT = /\d{0,3}>&(?:\d{1,3}|-)(?=\s|$)/g
 
 // Safe read-only commands allowed in plan mode. Deliberately excludes env/printenv
 // (secret disclosure, and env is an exec wrapper), curl/wget (fetch plus -o writes),
@@ -55,6 +65,7 @@ const SAFE_PATTERNS = [
   /^\s*find\b/,
   /^\s*ls\b/,
   /^\s*pwd\b/,
+  /^\s*cd(\s|$)/,
   /^\s*echo\b/,
   /^\s*printf\b/,
   /^\s*wc\b/,
@@ -92,13 +103,93 @@ const SAFE_PATTERNS = [
   /^\s*eza\b/,
 ]
 
-// find is allowlisted for traversal only; these actions run commands or delete.
-const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
+// find is allowlisted for traversal only; these actions run commands, delete or write.
+const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprint0|fprintf)\b/
+
+// Flags that turn an allowlisted read into a write or an execution, per command.
+const UNSAFE_FLAGS: ReadonlyArray<readonly [head: RegExp, flag: RegExp]> = [
+  [/^\s*find\b/, FIND_ACTIONS],
+  [/^\s*sort\b/, /\s(-[a-zA-Z]*o|--output\b|--compress-program\b)/],
+  [/^\s*tree\b/, /\s-[a-zA-Z]*o/],
+  [/^\s*rg\b/, /\s--(pre|hostname-bin)\b/],
+  [/^\s*git\s/, /\s--output(=|\s|$)/],
+]
+
+/** `segment` with its quoted spans removed, so a `>` or a flag inside a pattern reads as
+ * text. Follows splitSegments: a backslash outside quotes escapes the next character,
+ * and inside quotes only the closing quote matters. */
+function withoutQuoted(segment: string): string {
+  let bare = ''
+  let quote: string | undefined
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i]
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined
+    } else if (ch === "'" || ch === '"') {
+      quote = ch
+    } else if (ch === '\\') {
+      i++
+    } else {
+      bare += ch
+    }
+  }
+  return bare
+}
+
+function writesThroughRedirect(segment: string): boolean {
+  const bare = withoutQuoted(segment).replace(DEV_NULL_REDIRECT, ' ').replace(DESCRIPTOR_REDIRECT, ' ')
+  return REDIRECT_PATTERNS.some((pattern) => pattern.test(bare))
+}
+
+/** uniq [INPUT [OUTPUT]] writes its second operand. An option's value (-f N, -s N, -w N)
+ * is not an operand. */
+function uniqWrites(args: string[]): boolean {
+  let operands = 0
+  for (let i = 0; i < args.length; i++) {
+    if (['-f', '-s', '-w'].includes(args[i])) i++
+    else if (!args[i].startsWith('-')) operands++
+  }
+  return operands >= 2
+}
+
+const BRANCH_LISTS = /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/
+const BRANCH_WRITE_LONG_FLAGS = new Set(['--delete', '--move', '--copy', '--force', '--unset-upstream', '--set-upstream-to', '--edit-description', '--track', '--no-track', '--create-reflog'])
+
+/** A `git branch` flag that changes a branch: -d -D -m -M -c -C -u -f -t, alone or in a
+ * cluster, or the long form of one. */
+function isBranchWriteFlag(arg: string): boolean {
+  if (arg.startsWith('--')) return BRANCH_WRITE_LONG_FLAGS.has(arg.split('=')[0])
+  return arg.startsWith('-') && /[dDmMcCuft]/.test(arg)
+}
+
+/** `git branch` lists unless it is given a name to create or a flag that changes one. */
+function gitBranchWrites(args: string[]): boolean {
+  if (args.some(isBranchWriteFlag)) return true
+  return args.some((arg) => !arg.startsWith('-')) && !args.some((arg) => BRANCH_LISTS.test(arg))
+}
+
+/** `git remote` lists and shows; every other subcommand edits the configuration. */
+function gitRemoteWrites(args: string[]): boolean {
+  const subcommand = args.find((arg) => !arg.startsWith('-'))
+  return subcommand !== undefined && !['show', 'get-url'].includes(subcommand)
+}
+
+/** Whether an allowlisted command carries a flag or operand that makes it write. */
+function writesThroughOperands(segment: string): boolean {
+  const bare = withoutQuoted(segment)
+  if (UNSAFE_FLAGS.some(([head, flag]) => head.test(segment) && flag.test(bare))) return true
+  const [command = '', subcommand = '', ...rest] = segment.trim().split(/\s+/)
+  if (command === 'uniq') return uniqWrites([subcommand, ...rest].filter(Boolean))
+  if (command !== 'git') return false
+  if (subcommand === 'branch') return gitBranchWrites(rest)
+  return subcommand === 'remote' && gitRemoteWrites(rest)
+}
 
 function isSafeSegment(segment: string): boolean {
-  if (DESTRUCTIVE_PATTERNS.some((p) => p.test(segment))) return false
-  if (!SAFE_PATTERNS.some((p) => p.test(segment))) return false
-  return !(/^\s*find\b/.test(segment) && FIND_ACTIONS.test(segment))
+  if (DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  if (writesThroughRedirect(segment)) return false
+  if (!SAFE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  return !writesThroughOperands(segment)
 }
 
 /**

package/extensions/skills.ts

@@ -123,7 +123,9 @@ function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined
       continue
     }
     for (const entry of entries) {
-      if (!entry.isDirectory()) continue
+      // A link counts: pi's loader follows it, and skillAt already turns a link that
+      // leads to no SKILL.md (dangling, or to a plain file) into undefined.
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue
       const skill = skillAt(root, entry.name)
       if (skill?.name === name) return { filePath: skill.filePath, baseDir: path.dirname(skill.filePath) }
     }

package/extensions/status-line.ts

@@ -360,6 +360,10 @@ export default function statusLine(pi: ExtensionAPI) {
           killInflight = kill
         },
       })
+      // A newer trigger killed this run and queued its rerun: what a killed script left
+      // behind is not its output, and applying it blanked the custom segment until the
+      // rerun finished. Claude cancels the in-flight script and shows nothing for it.
+      if (rerunQueued) return
       // Claude: "Your script can output multiple lines to create a richer display."
       // pi has one row for every extension status and replaces newlines with spaces
       // before rendering it (footer.js sanitizeStatusText), so the rows are joined

package/extensions/subagent/background.ts

@@ -11,8 +11,9 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import { killProcessTree } from '../internal/process-tree.js'
+import { sharedSlot } from '../internal/shared-slot.js'
 import { errorMessage } from '../internal/values.js'
-import { spawnChild } from './run.js'
+import { spawnChild, utf8Chunks } from './run.js'
 
 export interface BackgroundRun {
   id: string
@@ -57,7 +58,14 @@ export interface BackgroundSpawn {
   maxTurns?: number
 }
 
-const runs = new Map<string, BackgroundRun>()
+/** The registry, held on globalThis rather than in module state. /reload and a /resume into
+ * another directory clear pi's extension cache and evaluate this module again; a registry
+ * that died with the old instance left live children unlisted, uncancellable, and running
+ * on past pi's exit, since the quit path signals only what the registry holds. */
+const registry = sharedSlot<{ runs: Map<string, BackgroundRun>; finishSequence: number }>('background-runs')
+const state = registry.get() ?? { runs: new Map<string, BackgroundRun>(), finishSequence: 0 }
+registry.set(state)
+const runs = state.runs
 
 /** Cap on simultaneously running background children. */
 export const MAX_BACKGROUND_RUNS = 8
@@ -76,16 +84,15 @@ export function activeBackgroundRuns(): number {
   return [...runs.values()].filter((run) => run.live || run.state === 'running').length
 }
 
-/** Stamps BackgroundRun.finishedAt; a counter rather than a clock so two runs
- * completing in the same millisecond still evict in their true finish order. */
-let finishSequence = 0
+// state.finishSequence stamps BackgroundRun.finishedAt: a counter rather than a clock, so
+// two runs completing in the same millisecond still evict in their true finish order.
 
 /** Test seam: the registry is module state, so tests reset it between cases to
  * stay order-independent. */
 export function resetBackgroundRuns(): void {
   for (const run of runs.values()) removeRebuiltPrompt(run)
   runs.clear()
-  finishSequence = 0
+  state.finishSequence = 0
 }
 
 function evictFinishedRuns(): void {
@@ -287,7 +294,7 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
   const complete = (): void => {
     if (completed) return
     completed = true
-    run.finishedAt = ++finishSequence
+    run.finishedAt = ++state.finishSequence
     evictFinishedRuns()
     // A run outlives the session that started it, and pi's loader wires assertActive()
     // into every runtime call, so notifying a disposed session throws. This fires from
@@ -343,13 +350,15 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       : undefined,
   )
   let stderrTail = ''
-  proc.stdout.on('data', (data) => parser.push(data.toString()))
+  const decodeStdout = utf8Chunks()
+  const decodeStderr = utf8Chunks()
+  proc.stdout.on('data', (data) => parser.push(decodeStdout(data)))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an
   // unguarded completion would. The foreground runner guards its streams the same way.
   proc.stdout.on('error', () => {})
   proc.stderr?.on('data', (data) => {
-    stderrTail = (stderrTail + data.toString()).slice(-STDERR_TAIL_CHARS)
+    stderrTail = (stderrTail + decodeStderr(data)).slice(-STDERR_TAIL_CHARS)
   })
   proc.stderr?.on('error', () => {})
   proc.on('close', (code) => {

package/extensions/subagent/run.ts

@@ -12,6 +12,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 
 import type { AgentToolResult } from '@earendil-works/pi-agent-core'
 import type { Message } from '@earendil-works/pi-ai'
@@ -125,6 +126,14 @@ function appendPartialNote(result: SingleResult): void {
   if (result.partial) appendResultNote(result, '[Output is partial: the subagent stopped at its maxTurns limit.]')
 }
 
+/** A decoder for one child stream. A pipe delivers whatever bytes are ready, so a read can
+ * end inside a multi-byte character: decoded on its own, each half became U+FFFD. This one
+ * holds the incomplete bytes until the rest arrive. One per stream, never shared. */
+export function utf8Chunks(): (chunk: Buffer | string) => string {
+  const decoder = new StringDecoder('utf8')
+  return (chunk) => (typeof chunk === 'string' ? chunk : decoder.write(chunk))
+}
+
 /** The pi child, or the error spawning it threw synchronously. Node normally
  * reports a spawn failure through the child's async 'error' event, but some
  * failures (confirmed on Linux: posix_spawn detects E2BIG immediately) throw at
@@ -328,8 +337,10 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         if (onAbort && signal) signal.removeEventListener('abort', onAbort)
       }
 
+      const decodeStdout = utf8Chunks()
+      const decodeStderr = utf8Chunks()
       proc.stdout.on('data', (data) => {
-        buffer += data.toString()
+        buffer += decodeStdout(data)
         const lines = buffer.split('\n')
         buffer = lines.pop() || ''
         for (const line of lines) processLine(line)
@@ -337,7 +348,7 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
       proc.stdout.on('error', () => {})
 
       proc.stderr.on('data', (data) => {
-        currentResult.stderr += data.toString()
+        currentResult.stderr += decodeStderr(data)
       })
       proc.stderr.on('error', () => {})
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.68",
+  "version": "1.0.70",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",