pi-code 1.0.69 → 1.0.70

package/extensions/context-imports.ts

@@ -601,7 +601,8 @@ function nestedContextBlock(file: string, dir: string, load: NestedLoadContext):
   // a body already in the system prompt.
   const seen = new Set([...load.launchLoaded, real])
   const budget = createImportBudget()
-  const imports = collectImports(content, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
+  // The stripped body, as at launch: a commented-out @import never expands.
+  const imports = collectImports(body, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
     importer: real,
     isExcluded: (absPath) => isExcludedPath(absPath, load.excludeGlobs, load.home),
     budget,

package/extensions/internal/atomic-write.ts

@@ -6,9 +6,37 @@
 
 import * as fs from 'node:fs'
 
-/** The tmp name carries the pid so concurrent processes do not collide. */
+/** The file a path leads to. A rename onto a symlink replaces the link itself: a settings
+ * file a dotfiles setup links into a repository would silently become a regular file while
+ * the real one kept the old content. The write goes to the real file, in its own directory
+ * so the rename stays on one filesystem. A link that leads nowhere yet is written as is. */
+function throughLinks(filePath: string): string {
+  try {
+    return fs.realpathSync(filePath)
+  } catch {
+    return filePath
+  }
+}
+
+/** The permission bits of `filePath`, or undefined when it does not exist yet. */
+function existingMode(filePath: string): number | undefined {
+  try {
+    return fs.statSync(filePath).mode & 0o777
+  } catch {
+    return undefined
+  }
+}
+
+/** The tmp name carries the pid so concurrent processes do not collide. A rename replaces
+ * the file's inode, so the replacement is created with the mode of the file it replaces:
+ * settings.local.json can hold env secrets, and a fresh temp file is 0644 under the usual
+ * umask. Created with that mode, the temp file is never more permissive than the target;
+ * the chmod then makes it exact where the umask took bits away. */
 export function atomicWriteFile(filePath: string, content: string): void {
-  const tmp = `${filePath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, filePath)
+  const target = throughLinks(filePath)
+  const tmp = `${target}.${process.pid}.tmp`
+  const mode = existingMode(target)
+  fs.writeFileSync(tmp, content, mode === undefined ? undefined : { mode })
+  if (mode !== undefined) fs.chmodSync(tmp, mode)
+  fs.renameSync(tmp, target)
 }

package/extensions/internal/mcp-oauth.ts

@@ -286,12 +286,20 @@ export function waitForAuthCode(server: http.Server, timeoutMs: number, expected
   })
 }
 
-/** Best-effort browser launch; the caller also surfaces the URL as text. */
+/** Best-effort browser launch; the caller also surfaces the URL as text.
+ *
+ * The URL comes from the server's metadata, so two things are not taken on trust. Only a
+ * web page is opened: the SDK rejects javascript:, data: and vbscript: alone, and a file:
+ * URL or a custom protocol handed to the platform launcher opens a file or starts an
+ * application. And on Windows no shell sees it: `cmd /c start` splits its line at every
+ * bare `&`, which every authorization URL has, truncating the URL and running the rest as
+ * commands. rundll32 takes the URL as one argument. */
 export function openBrowser(url: string): void {
+  if (!/^https?:\/\//i.test(url)) return
   let command = 'xdg-open'
   if (process.platform === 'darwin') command = 'open'
-  else if (process.platform === 'win32') command = 'cmd'
-  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  else if (process.platform === 'win32') command = 'rundll32'
+  const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url]
   try {
     const child = spawn(command, args, { stdio: 'ignore', detached: true })
     // A missing launcher (a container or an SSH session with no xdg-open) reports itself

package/extensions/internal/shell-split.ts

@@ -17,6 +17,8 @@ function separatorAt(command: string, i: number): number {
   const pair = command.slice(i, i + 2)
   if (pair === '&&' || pair === '||' || pair === '|&') return 2
   const ch = command[i]
+  // The & of a redirection (`2>&1`, `&>file`) belongs to the command, not between two.
+  if (ch === '&' && (command[i - 1] === '>' || command[i + 1] === '>')) return 0
   return ch === ';' || ch === '|' || ch === '&' || ch === '\n' ? 1 : 0
 }
 

package/extensions/mcp/transport.ts

@@ -37,12 +37,17 @@ const DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS = 1_800_000
 
 /** Claude's numeric env vars accept scientific notation and digit-separator spellings
  * (2e3 as 2000, 64_000 as 64000). A non-numeric value is undefined, not zero. */
+/** The longest delay setTimeout holds: it keeps the delay in 32 bits, and a larger one fires
+ * after 1 ms. A user's "never" (3000000000) made every call time out at once, so a timeout
+ * is clamped to this, about 24.8 days. */
+const MAX_TIMER_MS = 2_147_483_647
+
 /** A positive-integer env override, or the default when unset or unparseable. */
 function envTimeout(name: string, fallback: number): number {
   const raw = process.env[name]
   if (raw === undefined) return fallback
   const value = parseNumericEnv(raw)
-  return value !== undefined && value > 0 ? Math.floor(value) : fallback
+  return value !== undefined && value > 0 ? Math.min(Math.floor(value), MAX_TIMER_MS) : fallback
 }
 
 // Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.
@@ -97,7 +102,7 @@ export function callRequestOptions(wall: number, tuning: ServerCallTuning = {}):
  * per-server timeout. Per Claude, timeout values below 1000 are ignored and fall
  * through to MCP_TOOL_TIMEOUT. */
 export function serverCallTuning(config: ServerConfig): ServerCallTuning {
-  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
+  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? Math.min(config.timeout, MAX_TIMER_MS) : undefined
   return { stdio: isStdio(config), ...(declared !== undefined ? { serverTimeoutMs: declared } : {}) }
 }
 

package/extensions/plan-mode/utils.ts

@@ -5,7 +5,9 @@
 
 import { hasSubstitution, splitSegments } from '../internal/shell-split.js'
 
-// Destructive commands blocked in plan mode
+// Destructive commands blocked in plan mode. Tested against the segment's command word,
+// the one word that runs: an allowlisted head never executes its arguments, so `code`
+// in a path, `touch` in a quoted pattern or `cp` in a file name is not a command.
 const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\brmdir\b/i,
@@ -21,8 +23,6 @@ const DESTRUCTIVE_PATTERNS = [
   /\btruncate\b/i,
   /\bdd\b/i,
   /\bshred\b/i,
-  /(^|[^<])>(?!>)/,
-  />>/,
   /\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
   /\byarn\s+(add|remove|install|publish)/i,
   /\bpnpm\s+(add|remove|install|publish)/i,
@@ -40,7 +40,17 @@ const DESTRUCTIVE_PATTERNS = [
   /\bsystemctl\s+(start|stop|restart|enable|disable)/i,
   /\bservice\s+\S+\s+(start|stop|restart)/i,
   /\b(vim?|nano|emacs|code|subl)\b/i,
-]
+].map((pattern) => new RegExp(String.raw`^\s*(?:${pattern.source})`, pattern.flags))
+
+// A redirect writes wherever it points, from any position in the segment.
+const REDIRECT_PATTERNS = [/(^|[^<])>(?!>)/, />>/]
+
+// Redirections that write nothing: onto /dev/null, and a descriptor duplicated onto
+// another (`2>&1`, `>&2`, `>&-`). `>&file` is not one: it writes the file. Every run is
+// bounded: the text is chosen by the model, and an unbounded `\d*` in front of an
+// unanchored match backtracks quadratically (40,000 digits took over a second).
+const DEV_NULL_REDIRECT = /(?:&|\d{0,3})>>?[ \t]{0,8}\/dev\/null(?=\s|$)/g
+const DESCRIPTOR_REDIRECT = /\d{0,3}>&(?:\d{1,3}|-)(?=\s|$)/g
 
 // Safe read-only commands allowed in plan mode. Deliberately excludes env/printenv
 // (secret disclosure, and env is an exec wrapper), curl/wget (fetch plus -o writes),
@@ -55,6 +65,7 @@ const SAFE_PATTERNS = [
   /^\s*find\b/,
   /^\s*ls\b/,
   /^\s*pwd\b/,
+  /^\s*cd(\s|$)/,
   /^\s*echo\b/,
   /^\s*printf\b/,
   /^\s*wc\b/,
@@ -92,13 +103,93 @@ const SAFE_PATTERNS = [
   /^\s*eza\b/,
 ]
 
-// find is allowlisted for traversal only; these actions run commands or delete.
-const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
+// find is allowlisted for traversal only; these actions run commands, delete or write.
+const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprint0|fprintf)\b/
+
+// Flags that turn an allowlisted read into a write or an execution, per command.
+const UNSAFE_FLAGS: ReadonlyArray<readonly [head: RegExp, flag: RegExp]> = [
+  [/^\s*find\b/, FIND_ACTIONS],
+  [/^\s*sort\b/, /\s(-[a-zA-Z]*o|--output\b|--compress-program\b)/],
+  [/^\s*tree\b/, /\s-[a-zA-Z]*o/],
+  [/^\s*rg\b/, /\s--(pre|hostname-bin)\b/],
+  [/^\s*git\s/, /\s--output(=|\s|$)/],
+]
+
+/** `segment` with its quoted spans removed, so a `>` or a flag inside a pattern reads as
+ * text. Follows splitSegments: a backslash outside quotes escapes the next character,
+ * and inside quotes only the closing quote matters. */
+function withoutQuoted(segment: string): string {
+  let bare = ''
+  let quote: string | undefined
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i]
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined
+    } else if (ch === "'" || ch === '"') {
+      quote = ch
+    } else if (ch === '\\') {
+      i++
+    } else {
+      bare += ch
+    }
+  }
+  return bare
+}
+
+function writesThroughRedirect(segment: string): boolean {
+  const bare = withoutQuoted(segment).replace(DEV_NULL_REDIRECT, ' ').replace(DESCRIPTOR_REDIRECT, ' ')
+  return REDIRECT_PATTERNS.some((pattern) => pattern.test(bare))
+}
+
+/** uniq [INPUT [OUTPUT]] writes its second operand. An option's value (-f N, -s N, -w N)
+ * is not an operand. */
+function uniqWrites(args: string[]): boolean {
+  let operands = 0
+  for (let i = 0; i < args.length; i++) {
+    if (['-f', '-s', '-w'].includes(args[i])) i++
+    else if (!args[i].startsWith('-')) operands++
+  }
+  return operands >= 2
+}
+
+const BRANCH_LISTS = /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/
+const BRANCH_WRITE_LONG_FLAGS = new Set(['--delete', '--move', '--copy', '--force', '--unset-upstream', '--set-upstream-to', '--edit-description', '--track', '--no-track', '--create-reflog'])
+
+/** A `git branch` flag that changes a branch: -d -D -m -M -c -C -u -f -t, alone or in a
+ * cluster, or the long form of one. */
+function isBranchWriteFlag(arg: string): boolean {
+  if (arg.startsWith('--')) return BRANCH_WRITE_LONG_FLAGS.has(arg.split('=')[0])
+  return arg.startsWith('-') && /[dDmMcCuft]/.test(arg)
+}
+
+/** `git branch` lists unless it is given a name to create or a flag that changes one. */
+function gitBranchWrites(args: string[]): boolean {
+  if (args.some(isBranchWriteFlag)) return true
+  return args.some((arg) => !arg.startsWith('-')) && !args.some((arg) => BRANCH_LISTS.test(arg))
+}
+
+/** `git remote` lists and shows; every other subcommand edits the configuration. */
+function gitRemoteWrites(args: string[]): boolean {
+  const subcommand = args.find((arg) => !arg.startsWith('-'))
+  return subcommand !== undefined && !['show', 'get-url'].includes(subcommand)
+}
+
+/** Whether an allowlisted command carries a flag or operand that makes it write. */
+function writesThroughOperands(segment: string): boolean {
+  const bare = withoutQuoted(segment)
+  if (UNSAFE_FLAGS.some(([head, flag]) => head.test(segment) && flag.test(bare))) return true
+  const [command = '', subcommand = '', ...rest] = segment.trim().split(/\s+/)
+  if (command === 'uniq') return uniqWrites([subcommand, ...rest].filter(Boolean))
+  if (command !== 'git') return false
+  if (subcommand === 'branch') return gitBranchWrites(rest)
+  return subcommand === 'remote' && gitRemoteWrites(rest)
+}
 
 function isSafeSegment(segment: string): boolean {
-  if (DESTRUCTIVE_PATTERNS.some((p) => p.test(segment))) return false
-  if (!SAFE_PATTERNS.some((p) => p.test(segment))) return false
-  return !(/^\s*find\b/.test(segment) && FIND_ACTIONS.test(segment))
+  if (DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  if (writesThroughRedirect(segment)) return false
+  if (!SAFE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  return !writesThroughOperands(segment)
 }
 
 /**

package/extensions/skills.ts

@@ -123,7 +123,9 @@ function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined
       continue
     }
     for (const entry of entries) {
-      if (!entry.isDirectory()) continue
+      // A link counts: pi's loader follows it, and skillAt already turns a link that
+      // leads to no SKILL.md (dangling, or to a plain file) into undefined.
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue
       const skill = skillAt(root, entry.name)
       if (skill?.name === name) return { filePath: skill.filePath, baseDir: path.dirname(skill.filePath) }
     }

package/extensions/status-line.ts

@@ -360,6 +360,10 @@ export default function statusLine(pi: ExtensionAPI) {
           killInflight = kill
         },
       })
+      // A newer trigger killed this run and queued its rerun: what a killed script left
+      // behind is not its output, and applying it blanked the custom segment until the
+      // rerun finished. Claude cancels the in-flight script and shows nothing for it.
+      if (rerunQueued) return
       // Claude: "Your script can output multiple lines to create a richer display."
       // pi has one row for every extension status and replaces newlines with spaces
       // before rendering it (footer.js sanitizeStatusText), so the rows are joined

package/extensions/subagent/background.ts

@@ -13,7 +13,7 @@ import * as path from 'node:path'
 import { killProcessTree } from '../internal/process-tree.js'
 import { sharedSlot } from '../internal/shared-slot.js'
 import { errorMessage } from '../internal/values.js'
-import { spawnChild } from './run.js'
+import { spawnChild, utf8Chunks } from './run.js'
 
 export interface BackgroundRun {
   id: string
@@ -350,13 +350,15 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       : undefined,
   )
   let stderrTail = ''
-  proc.stdout.on('data', (data) => parser.push(data.toString()))
+  const decodeStdout = utf8Chunks()
+  const decodeStderr = utf8Chunks()
+  proc.stdout.on('data', (data) => parser.push(decodeStdout(data)))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an
   // unguarded completion would. The foreground runner guards its streams the same way.
   proc.stdout.on('error', () => {})
   proc.stderr?.on('data', (data) => {
-    stderrTail = (stderrTail + data.toString()).slice(-STDERR_TAIL_CHARS)
+    stderrTail = (stderrTail + decodeStderr(data)).slice(-STDERR_TAIL_CHARS)
   })
   proc.stderr?.on('error', () => {})
   proc.on('close', (code) => {

package/extensions/subagent/run.ts

@@ -12,6 +12,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 
 import type { AgentToolResult } from '@earendil-works/pi-agent-core'
 import type { Message } from '@earendil-works/pi-ai'
@@ -125,6 +126,14 @@ function appendPartialNote(result: SingleResult): void {
   if (result.partial) appendResultNote(result, '[Output is partial: the subagent stopped at its maxTurns limit.]')
 }
 
+/** A decoder for one child stream. A pipe delivers whatever bytes are ready, so a read can
+ * end inside a multi-byte character: decoded on its own, each half became U+FFFD. This one
+ * holds the incomplete bytes until the rest arrive. One per stream, never shared. */
+export function utf8Chunks(): (chunk: Buffer | string) => string {
+  const decoder = new StringDecoder('utf8')
+  return (chunk) => (typeof chunk === 'string' ? chunk : decoder.write(chunk))
+}
+
 /** The pi child, or the error spawning it threw synchronously. Node normally
  * reports a spawn failure through the child's async 'error' event, but some
  * failures (confirmed on Linux: posix_spawn detects E2BIG immediately) throw at
@@ -328,8 +337,10 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         if (onAbort && signal) signal.removeEventListener('abort', onAbort)
       }
 
+      const decodeStdout = utf8Chunks()
+      const decodeStderr = utf8Chunks()
       proc.stdout.on('data', (data) => {
-        buffer += data.toString()
+        buffer += decodeStdout(data)
         const lines = buffer.split('\n')
         buffer = lines.pop() || ''
         for (const line of lines) processLine(line)
@@ -337,7 +348,7 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
       proc.stdout.on('error', () => {})
 
       proc.stderr.on('data', (data) => {
-        currentResult.stderr += data.toString()
+        currentResult.stderr += decodeStderr(data)
       })
       proc.stderr.on('error', () => {})
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.69",
+  "version": "1.0.70",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",