pi-code 1.0.69 → 1.0.71

package/extensions/commands.ts

@@ -335,12 +335,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // setModel can reject (e.g. auth resolution fails), and a floated rejection would
     // escape as unhandled; surface it as a no-op instead of leaving the session silently
     // on the command's override model.
-    set: (model) => {
+    set: async (model) => {
       // A refused switch leaves the turn on the session model rather than the one the
-      // command named, and the reply gives no sign of it, so the refusal is reported.
-      void pi.setModel(model as Parameters<typeof pi.setModel>[0]).catch((error: unknown) => {
+      // command named, and the reply gives no sign of it, so the refusal is reported. The
+      // promise never rejects, so a caller that does not await it (agent_settled) cannot
+      // float a rejection; the shutdown handler awaits it so the exit cannot outrun it.
+      try {
+        await pi.setModel(model as Parameters<typeof pi.setModel>[0])
+      } catch (error) {
         console.warn(`pi-code-commands: could not switch to ${typeof model === 'object' && model !== null && 'id' in model ? String((model as { id: unknown }).id) : String(model)}: ${errorMessage(error)}`)
-      })
+      }
     },
   })
   /** The thinking level to restore after a command's `effort:` override drove its run,
@@ -363,14 +367,23 @@ export default function commandsExtension(pi: ExtensionAPI) {
     pendingAgentRules = undefined
     pendingSkillRules = undefined
     pendingPathRules = undefined
-    modelOverride.settle()
-    effortOverride.settle()
+    void modelOverride.settle()
+    void effortOverride.settle()
     if (pendingRestore) {
       pi.setActiveTools(pendingRestore)
       pendingRestore = undefined
     }
   })
 
+  // agent_settled never fires when pi is quit mid-run (double Ctrl+C, Ctrl+D, a closed
+  // terminal, SIGTERM), and the switch is already in the transcript: `pi -c` resumed on the
+  // command's override model at its raised level. A run that settled has nothing armed, so
+  // this restores nothing twice.
+  pi.on('session_shutdown', async () => {
+    await modelOverride.settle()
+    await effortOverride.settle()
+  })
+
   // The active-tool set has no argument dimension, so a scoped grant hands the turn
   // the whole tool; the scope is enforced here instead, when the call arrives. Same
   // steering-not-sandbox caveat as plan mode's guard.

package/extensions/context-imports.ts

@@ -601,7 +601,8 @@ function nestedContextBlock(file: string, dir: string, load: NestedLoadContext):
   // a body already in the system prompt.
   const seen = new Set([...load.launchLoaded, real])
   const budget = createImportBudget()
-  const imports = collectImports(content, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
+  // The stripped body, as at launch: a commented-out @import never expands.
+  const imports = collectImports(body, dir, load.home, rootsForImporter(real, load.home, load.cwd), seen, {
     importer: real,
     isExcluded: (absPath) => isExcludedPath(absPath, load.excludeGlobs, load.home),
     budget,

package/extensions/hooks/index.ts

@@ -223,6 +223,12 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let managedHooksOnly = false
   /** Skill hooks registered this session, re-applied when a settings edit reloads. */
   const registeredSkillHooks: Array<{ skillName: string; hooks: Record<string, unknown> }> = []
+  /** Whether this process is a subagent's child. Claude runs settings hooks inside a
+   * subagent for tool events, but Stop is the main agent's, a subagent completes with
+   * SubagentStop, and a subagent run is neither a session (SessionStart, SessionEnd) nor
+   * a prompt the user submitted (UserPromptSubmit). The child is a full pi process loading
+   * the same settings, so without this every one of them fired in it. */
+  const inSubagentChild = (): boolean => process.env.PI_CODE_SUBAGENT === '1'
   /** Stops the settings watcher of the previous session. */
   let disposeSettingsWatch: () => void = () => {}
   /** Claude's disableAllHooks escape hatch was set somewhere in the honored chain. */
@@ -466,7 +472,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     pendingSessionContext = []
     // "reload" re-fires in-process with the same conversation and would double-run hooks;
     // a fork is a genuine session begin, which Claude reports as source "fork".
-    if (event.reason === 'reload') return
+    if (event.reason === 'reload' || inSubagentChild()) return
     const source = claudeSpelling(SESSION_START_SOURCE, event.reason)
     const commands = matchingCommands(config.SessionStart, source.names)
     const payload = { hook_event_name: 'SessionStart', source: source.value }
@@ -593,7 +599,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   pi.on('input', async (event, ctx) => {
     // Only genuine user input; extension-injected messages (plan-mode, subagent) are not
     // prompts the user submitted.
-    if (event.source === 'extension') return { action: 'continue' }
+    if (event.source === 'extension' || inSubagentChild()) return { action: 'continue' }
     // The user typed, so the pending idle_prompt no longer applies.
     cancelIdlePrompt()
     // Genuine user input is progress, so it breaks a Stop-hook continuation streak: the
@@ -605,12 +611,15 @@ export default function hooksExtension(pi: ExtensionAPI) {
       ctx.ui.notify(decision.reason ?? 'Prompt blocked by hook', 'error')
       return { action: 'handled' }
     }
-    // Claude injects a UserPromptSubmit hook's context ahead of the prompt; transform is
-    // pi's seam for rewriting the submitted text. The prompt itself always survives:
     // "UserPromptSubmit: can't replace the prompt; it only injects additionalContext
-    // alongside it". suppressOriginalPrompt scopes to the block message, which never
+    // alongside it", as a system reminder with no visible transcript entry. So the context
+    // is a hidden message next to the prompt and the prompt text is left alone: prepended,
+    // it moved a `/skill:` or `/template` invocation off position 0 and pi stopped
+    // expanding it. pi appends a "nextTurn" message to this very prompt (after this handler
+    // runs); one typed mid-stream never reaches before_agent_start, so it is queued in the
+    // prompt's own mode. suppressOriginalPrompt scopes to the block message, which never
     // carries the prompt here, so it needs nothing of its own.
-    if (decision.context) return { action: 'transform', text: `${decision.context}\n\n${event.text}` }
+    if (decision.context) pi.sendMessage({ customType: 'claude-hook-context', content: decision.context, display: false }, { deliverAs: event.streamingBehavior ?? 'nextTurn' })
     return { action: 'continue' }
   })
 
@@ -630,6 +639,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
    * turn cancels it. Observational only; exit codes and JSON output are ignored. */
   const armIdlePrompt = (ctx: ExtensionContext): void => {
     cancelIdlePrompt()
+    if (inSubagentChild()) return
     const notifyCommands = matchingCommands(config.Notification, ['idle_prompt'])
     if (notifyCommands.length > 0) {
       const runner = boundRunner(ctx)
@@ -639,21 +649,26 @@ export default function hooksExtension(pi: ExtensionAPI) {
       idlePromptTimer.unref?.()
     }
   }
+  /** In a subagent child, the agent-frontmatter Stop hooks were converted to SubagentStop
+   * and fire at the child's own end, notify-style, before the Stop early-returns, which do
+   * not apply to them. Only the agent's own frontmatter hooks (stamped agent:<name>): the
+   * settings-level SubagentStop is fired by the parent when the child completes, so the
+   * child firing it too ran it twice. */
+  const fireChildSubagentStop = async (event: { messages?: Array<{ role: string; content: unknown }> }, ctx: ExtensionContext): Promise<void> => {
+    if (!agentIdentity) return
+    const subStop = matchingCommands(config.SubagentStop, agentIdentity.agent).filter((command) => command.origin?.startsWith('agent:'))
+    if (subStop.length === 0) return
+    const subText = lastAssistantText(event.messages ?? [])
+    const subPayload = { hook_event_name: 'SubagentStop', agent_type: agentIdentity.agent, ...(agentIdentity.id ? { agent_id: agentIdentity.id } : {}), stop_hook_active: false, ...(subText ? { last_assistant_message: subText } : {}) }
+    await runNotifyHooks(subStop, subPayload, boundRunner(ctx)).catch(() => {})
+  }
+
   pi.on('agent_end', async (event, ctx) => {
     armIdlePrompt(ctx)
+    await fireChildSubagentStop(event as { messages?: Array<{ role: string; content: unknown }> }, ctx)
 
-    // In a subagent child, the agent-frontmatter Stop hooks were converted to
-    // SubagentStop and fire here, at the child's own end, notify-style; before the
-    // Stop early-returns, which do not apply to them.
-    if (agentIdentity) {
-      const subStop = matchingCommands(config.SubagentStop, agentIdentity.agent)
-      if (subStop.length > 0) {
-        const subText = lastAssistantText((event as { messages?: Array<{ role: string; content: unknown }> }).messages ?? [])
-        const subPayload = { hook_event_name: 'SubagentStop', agent_type: agentIdentity.agent, ...(agentIdentity.id ? { agent_id: agentIdentity.id } : {}), stop_hook_active: false, ...(subText ? { last_assistant_message: subText } : {}) }
-        await runNotifyHooks(subStop, subPayload, boundRunner(ctx)).catch(() => {})
-      }
-    }
-
+    // Stop is the main agent's event; the child's completion was handled above.
+    if (inSubagentChild()) return
     // Stop has no matcher support (a stray matcher is ignored, as Claude documents)
     // and an `if`-carrying hook never runs on a non-tool event.
     const commands = allCommands(config.Stop).filter((command) => passesIfFilter(command, undefined))
@@ -771,13 +786,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
     const reason = claudeSpelling(SESSION_END_REASON, event.reason)
     // SessionEnd rides Claude's short shared budget (see sessionEndTimeoutMs) so a
     // slow hook cannot stall session exit, /new or /resume.
-    const sessionEndCommands = matchingCommands(config.SessionEnd, reason.names).filter((command) => passesIfFilter(command, undefined))
+    const sessionEndCommands = inSubagentChild() ? [] : matchingCommands(config.SessionEnd, reason.names).filter((command) => passesIfFilter(command, undefined))
     const runner = boundRunner(ctx)
     const results = await Promise.all(sessionEndCommands.map((command) => runner(command, { hook_event_name: 'SessionEnd', reason: reason.value }, sessionEndTimeoutMs(command))))
     surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
-    // Claude kills async hooks still running at teardown; the session that spawned
-    // these is over, and their delivery would target a disposed context anyway.
-    for (const kill of backgroundKills) kill()
+    // Claude: "In non-interactive mode with the -p flag, Claude Code kills any async hook
+    // still running at teardown". Only there: an interactive session leaves them running, so
+    // an async SessionEnd hook, started by this very shutdown, can finish instead of being
+    // killed a microtask after it spawned. Their delivery targets a disposed context and is
+    // caught (see deliverBackgroundResult).
+    if (ctx.hasUI !== true) for (const kill of backgroundKills) kill()
     backgroundKills.clear()
   })
 

package/extensions/internal/atomic-write.ts

@@ -6,9 +6,37 @@
 
 import * as fs from 'node:fs'
 
-/** The tmp name carries the pid so concurrent processes do not collide. */
+/** The file a path leads to. A rename onto a symlink replaces the link itself: a settings
+ * file a dotfiles setup links into a repository would silently become a regular file while
+ * the real one kept the old content. The write goes to the real file, in its own directory
+ * so the rename stays on one filesystem. A link that leads nowhere yet is written as is. */
+function throughLinks(filePath: string): string {
+  try {
+    return fs.realpathSync(filePath)
+  } catch {
+    return filePath
+  }
+}
+
+/** The permission bits of `filePath`, or undefined when it does not exist yet. */
+function existingMode(filePath: string): number | undefined {
+  try {
+    return fs.statSync(filePath).mode & 0o777
+  } catch {
+    return undefined
+  }
+}
+
+/** The tmp name carries the pid so concurrent processes do not collide. A rename replaces
+ * the file's inode, so the replacement is created with the mode of the file it replaces:
+ * settings.local.json can hold env secrets, and a fresh temp file is 0644 under the usual
+ * umask. Created with that mode, the temp file is never more permissive than the target;
+ * the chmod then makes it exact where the umask took bits away. */
 export function atomicWriteFile(filePath: string, content: string): void {
-  const tmp = `${filePath}.${process.pid}.tmp`
-  fs.writeFileSync(tmp, content)
-  fs.renameSync(tmp, filePath)
+  const target = throughLinks(filePath)
+  const tmp = `${target}.${process.pid}.tmp`
+  const mode = existingMode(target)
+  fs.writeFileSync(tmp, content, mode === undefined ? undefined : { mode })
+  if (mode !== undefined) fs.chmodSync(tmp, mode)
+  fs.renameSync(tmp, target)
 }

package/extensions/internal/mcp-oauth.ts

@@ -286,12 +286,20 @@ export function waitForAuthCode(server: http.Server, timeoutMs: number, expected
   })
 }
 
-/** Best-effort browser launch; the caller also surfaces the URL as text. */
+/** Best-effort browser launch; the caller also surfaces the URL as text.
+ *
+ * The URL comes from the server's metadata, so two things are not taken on trust. Only a
+ * web page is opened: the SDK rejects javascript:, data: and vbscript: alone, and a file:
+ * URL or a custom protocol handed to the platform launcher opens a file or starts an
+ * application. And on Windows no shell sees it: `cmd /c start` splits its line at every
+ * bare `&`, which every authorization URL has, truncating the URL and running the rest as
+ * commands. rundll32 takes the URL as one argument. */
 export function openBrowser(url: string): void {
+  if (!/^https?:\/\//i.test(url)) return
   let command = 'xdg-open'
   if (process.platform === 'darwin') command = 'open'
-  else if (process.platform === 'win32') command = 'cmd'
-  const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
+  else if (process.platform === 'win32') command = 'rundll32'
+  const args = process.platform === 'win32' ? ['url.dll,FileProtocolHandler', url] : [url]
   try {
     const child = spawn(command, args, { stdio: 'ignore', detached: true })
     // A missing launcher (a container or an SSH session with no xdg-open) reports itself

package/extensions/internal/shell-split.ts

@@ -17,6 +17,8 @@ function separatorAt(command: string, i: number): number {
   const pair = command.slice(i, i + 2)
   if (pair === '&&' || pair === '||' || pair === '|&') return 2
   const ch = command[i]
+  // The & of a redirection (`2>&1`, `&>file`) belongs to the command, not between two.
+  if (ch === '&' && (command[i - 1] === '>' || command[i + 1] === '>')) return 0
   return ch === ';' || ch === '|' || ch === '&' || ch === '\n' ? 1 : 0
 }
 

package/extensions/internal/turn-override.ts

@@ -26,14 +26,15 @@ export interface TurnOverride<T> {
   reset(): void
   /** Restore the captured prior via `set` and clear the capture. A conditional override
    * stands down when the current value has moved off the target. No-op when nothing is
-   * armed. */
-  settle(): void
+   * armed. Returns what `set` returns, so a caller that must not exit before an async
+   * restore has landed (a shutdown) can await it. */
+  settle(): void | Promise<void>
 }
 
 export function createTurnOverride<T>(opts: {
   /** Applies the restore value. Consumers wrap their setter here (async-with-catch for
    * commands' model, plain for the thinking level). */
-  set: (value: T) => void
+  set: (value: T) => void | Promise<void>
   /** Reads the current value, for a conditional restore. Only consulted when
    * `conditional` is set. */
   get?: () => T | undefined
@@ -67,7 +68,7 @@ export function createTurnOverride<T>(opts: {
         const current = opts.get?.()
         if (current !== undefined && current !== movedTo) return
       }
-      opts.set(restore)
+      return opts.set(restore)
     },
   }
 }

package/extensions/mcp/transport.ts

@@ -37,12 +37,17 @@ const DEFAULT_STDIO_CALL_IDLE_TIMEOUT_MS = 1_800_000
 
 /** Claude's numeric env vars accept scientific notation and digit-separator spellings
  * (2e3 as 2000, 64_000 as 64000). A non-numeric value is undefined, not zero. */
+/** The longest delay setTimeout holds: it keeps the delay in 32 bits, and a larger one fires
+ * after 1 ms. A user's "never" (3000000000) made every call time out at once, so a timeout
+ * is clamped to this, about 24.8 days. */
+const MAX_TIMER_MS = 2_147_483_647
+
 /** A positive-integer env override, or the default when unset or unparseable. */
 function envTimeout(name: string, fallback: number): number {
   const raw = process.env[name]
   if (raw === undefined) return fallback
   const value = parseNumericEnv(raw)
-  return value !== undefined && value > 0 ? Math.floor(value) : fallback
+  return value !== undefined && value > 0 ? Math.min(Math.floor(value), MAX_TIMER_MS) : fallback
 }
 
 // Claude honors MCP_TIMEOUT (connect) and MCP_TOOL_TIMEOUT (per-call), both in ms.
@@ -97,7 +102,7 @@ export function callRequestOptions(wall: number, tuning: ServerCallTuning = {}):
  * per-server timeout. Per Claude, timeout values below 1000 are ignored and fall
  * through to MCP_TOOL_TIMEOUT. */
 export function serverCallTuning(config: ServerConfig): ServerCallTuning {
-  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? config.timeout : undefined
+  const declared = typeof config.timeout === 'number' && config.timeout >= 1000 ? Math.min(config.timeout, MAX_TIMER_MS) : undefined
   return { stdio: isStdio(config), ...(declared !== undefined ? { serverTimeoutMs: declared } : {}) }
 }
 

package/extensions/plan-mode/utils.ts

@@ -5,7 +5,9 @@
 
 import { hasSubstitution, splitSegments } from '../internal/shell-split.js'
 
-// Destructive commands blocked in plan mode
+// Destructive commands blocked in plan mode. Tested against the segment's command word,
+// the one word that runs: an allowlisted head never executes its arguments, so `code`
+// in a path, `touch` in a quoted pattern or `cp` in a file name is not a command.
 const DESTRUCTIVE_PATTERNS = [
   /\brm\b/i,
   /\brmdir\b/i,
@@ -21,8 +23,6 @@ const DESTRUCTIVE_PATTERNS = [
   /\btruncate\b/i,
   /\bdd\b/i,
   /\bshred\b/i,
-  /(^|[^<])>(?!>)/,
-  />>/,
   /\bnpm\s+(install|uninstall|update|ci|link|publish)/i,
   /\byarn\s+(add|remove|install|publish)/i,
   /\bpnpm\s+(add|remove|install|publish)/i,
@@ -40,7 +40,17 @@ const DESTRUCTIVE_PATTERNS = [
   /\bsystemctl\s+(start|stop|restart|enable|disable)/i,
   /\bservice\s+\S+\s+(start|stop|restart)/i,
   /\b(vim?|nano|emacs|code|subl)\b/i,
-]
+].map((pattern) => new RegExp(String.raw`^\s*(?:${pattern.source})`, pattern.flags))
+
+// A redirect writes wherever it points, from any position in the segment.
+const REDIRECT_PATTERNS = [/(^|[^<])>(?!>)/, />>/]
+
+// Redirections that write nothing: onto /dev/null, and a descriptor duplicated onto
+// another (`2>&1`, `>&2`, `>&-`). `>&file` is not one: it writes the file. Every run is
+// bounded: the text is chosen by the model, and an unbounded `\d*` in front of an
+// unanchored match backtracks quadratically (40,000 digits took over a second).
+const DEV_NULL_REDIRECT = /(?:&|\d{0,3})>>?[ \t]{0,8}\/dev\/null(?=\s|$)/g
+const DESCRIPTOR_REDIRECT = /\d{0,3}>&(?:\d{1,3}|-)(?=\s|$)/g
 
 // Safe read-only commands allowed in plan mode. Deliberately excludes env/printenv
 // (secret disclosure, and env is an exec wrapper), curl/wget (fetch plus -o writes),
@@ -55,6 +65,7 @@ const SAFE_PATTERNS = [
   /^\s*find\b/,
   /^\s*ls\b/,
   /^\s*pwd\b/,
+  /^\s*cd(\s|$)/,
   /^\s*echo\b/,
   /^\s*printf\b/,
   /^\s*wc\b/,
@@ -92,13 +103,93 @@ const SAFE_PATTERNS = [
   /^\s*eza\b/,
 ]
 
-// find is allowlisted for traversal only; these actions run commands or delete.
-const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprintf)\b/
+// find is allowlisted for traversal only; these actions run commands, delete or write.
+const FIND_ACTIONS = /\s-(exec|execdir|ok|okdir|delete|fls|fprint|fprint0|fprintf)\b/
+
+// Flags that turn an allowlisted read into a write or an execution, per command.
+const UNSAFE_FLAGS: ReadonlyArray<readonly [head: RegExp, flag: RegExp]> = [
+  [/^\s*find\b/, FIND_ACTIONS],
+  [/^\s*sort\b/, /\s(-[a-zA-Z]*o|--output\b|--compress-program\b)/],
+  [/^\s*tree\b/, /\s-[a-zA-Z]*o/],
+  [/^\s*rg\b/, /\s--(pre|hostname-bin)\b/],
+  [/^\s*git\s/, /\s--output(=|\s|$)/],
+]
+
+/** `segment` with its quoted spans removed, so a `>` or a flag inside a pattern reads as
+ * text. Follows splitSegments: a backslash outside quotes escapes the next character,
+ * and inside quotes only the closing quote matters. */
+function withoutQuoted(segment: string): string {
+  let bare = ''
+  let quote: string | undefined
+  for (let i = 0; i < segment.length; i++) {
+    const ch = segment[i]
+    if (quote !== undefined) {
+      if (ch === quote) quote = undefined
+    } else if (ch === "'" || ch === '"') {
+      quote = ch
+    } else if (ch === '\\') {
+      i++
+    } else {
+      bare += ch
+    }
+  }
+  return bare
+}
+
+function writesThroughRedirect(segment: string): boolean {
+  const bare = withoutQuoted(segment).replace(DEV_NULL_REDIRECT, ' ').replace(DESCRIPTOR_REDIRECT, ' ')
+  return REDIRECT_PATTERNS.some((pattern) => pattern.test(bare))
+}
+
+/** uniq [INPUT [OUTPUT]] writes its second operand. An option's value (-f N, -s N, -w N)
+ * is not an operand. */
+function uniqWrites(args: string[]): boolean {
+  let operands = 0
+  for (let i = 0; i < args.length; i++) {
+    if (['-f', '-s', '-w'].includes(args[i])) i++
+    else if (!args[i].startsWith('-')) operands++
+  }
+  return operands >= 2
+}
+
+const BRANCH_LISTS = /^(-l|--list|--contains|--no-contains|--merged|--no-merged|--points-at)$/
+const BRANCH_WRITE_LONG_FLAGS = new Set(['--delete', '--move', '--copy', '--force', '--unset-upstream', '--set-upstream-to', '--edit-description', '--track', '--no-track', '--create-reflog'])
+
+/** A `git branch` flag that changes a branch: -d -D -m -M -c -C -u -f -t, alone or in a
+ * cluster, or the long form of one. */
+function isBranchWriteFlag(arg: string): boolean {
+  if (arg.startsWith('--')) return BRANCH_WRITE_LONG_FLAGS.has(arg.split('=')[0])
+  return arg.startsWith('-') && /[dDmMcCuft]/.test(arg)
+}
+
+/** `git branch` lists unless it is given a name to create or a flag that changes one. */
+function gitBranchWrites(args: string[]): boolean {
+  if (args.some(isBranchWriteFlag)) return true
+  return args.some((arg) => !arg.startsWith('-')) && !args.some((arg) => BRANCH_LISTS.test(arg))
+}
+
+/** `git remote` lists and shows; every other subcommand edits the configuration. */
+function gitRemoteWrites(args: string[]): boolean {
+  const subcommand = args.find((arg) => !arg.startsWith('-'))
+  return subcommand !== undefined && !['show', 'get-url'].includes(subcommand)
+}
+
+/** Whether an allowlisted command carries a flag or operand that makes it write. */
+function writesThroughOperands(segment: string): boolean {
+  const bare = withoutQuoted(segment)
+  if (UNSAFE_FLAGS.some(([head, flag]) => head.test(segment) && flag.test(bare))) return true
+  const [command = '', subcommand = '', ...rest] = segment.trim().split(/\s+/)
+  if (command === 'uniq') return uniqWrites([subcommand, ...rest].filter(Boolean))
+  if (command !== 'git') return false
+  if (subcommand === 'branch') return gitBranchWrites(rest)
+  return subcommand === 'remote' && gitRemoteWrites(rest)
+}
 
 function isSafeSegment(segment: string): boolean {
-  if (DESTRUCTIVE_PATTERNS.some((p) => p.test(segment))) return false
-  if (!SAFE_PATTERNS.some((p) => p.test(segment))) return false
-  return !(/^\s*find\b/.test(segment) && FIND_ACTIONS.test(segment))
+  if (DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  if (writesThroughRedirect(segment)) return false
+  if (!SAFE_PATTERNS.some((pattern) => pattern.test(segment))) return false
+  return !writesThroughOperands(segment)
 }
 
 /**

package/extensions/skills.ts

@@ -123,7 +123,9 @@ function findClaudeSkill(name: string, roots: string[]): FoundSkill | undefined
       continue
     }
     for (const entry of entries) {
-      if (!entry.isDirectory()) continue
+      // A link counts: pi's loader follows it, and skillAt already turns a link that
+      // leads to no SKILL.md (dangling, or to a plain file) into undefined.
+      if (!entry.isDirectory() && !entry.isSymbolicLink()) continue
       const skill = skillAt(root, entry.name)
       if (skill?.name === name) return { filePath: skill.filePath, baseDir: path.dirname(skill.filePath) }
     }

package/extensions/status-line.ts

@@ -360,6 +360,10 @@ export default function statusLine(pi: ExtensionAPI) {
           killInflight = kill
         },
       })
+      // A newer trigger killed this run and queued its rerun: what a killed script left
+      // behind is not its output, and applying it blanked the custom segment until the
+      // rerun finished. Claude cancels the in-flight script and shows nothing for it.
+      if (rerunQueued) return
       // Claude: "Your script can output multiple lines to create a richer display."
       // pi has one row for every extension status and replaces newlines with spaces
       // before rendering it (footer.js sanitizeStatusText), so the rows are joined

package/extensions/subagent/background.ts

@@ -13,7 +13,7 @@ import * as path from 'node:path'
 import { killProcessTree } from '../internal/process-tree.js'
 import { sharedSlot } from '../internal/shared-slot.js'
 import { errorMessage } from '../internal/values.js'
-import { spawnChild } from './run.js'
+import { spawnChild, utf8Chunks } from './run.js'
 
 export interface BackgroundRun {
   id: string
@@ -350,13 +350,15 @@ function driveRun(run: BackgroundRun, invocation: BackgroundSpawn, onComplete: (
       : undefined,
   )
   let stderrTail = ''
-  proc.stdout.on('data', (data) => parser.push(data.toString()))
+  const decodeStdout = utf8Chunks()
+  const decodeStderr = utf8Chunks()
+  proc.stdout.on('data', (data) => parser.push(decodeStdout(data)))
   // An 'error' on a stream with no listener is rethrown by EventEmitter, and this one
   // belongs to a detached child, so a pipe read failure would exit pi the same way an
   // unguarded completion would. The foreground runner guards its streams the same way.
   proc.stdout.on('error', () => {})
   proc.stderr?.on('data', (data) => {
-    stderrTail = (stderrTail + data.toString()).slice(-STDERR_TAIL_CHARS)
+    stderrTail = (stderrTail + decodeStderr(data)).slice(-STDERR_TAIL_CHARS)
   })
   proc.stderr?.on('error', () => {})
   proc.on('close', (code) => {

package/extensions/subagent/run.ts

@@ -12,6 +12,7 @@ import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { Readable } from 'node:stream'
+import { StringDecoder } from 'node:string_decoder'
 
 import type { AgentToolResult } from '@earendil-works/pi-agent-core'
 import type { Message } from '@earendil-works/pi-ai'
@@ -125,6 +126,14 @@ function appendPartialNote(result: SingleResult): void {
   if (result.partial) appendResultNote(result, '[Output is partial: the subagent stopped at its maxTurns limit.]')
 }
 
+/** A decoder for one child stream. A pipe delivers whatever bytes are ready, so a read can
+ * end inside a multi-byte character: decoded on its own, each half became U+FFFD. This one
+ * holds the incomplete bytes until the rest arrive. One per stream, never shared. */
+export function utf8Chunks(): (chunk: Buffer | string) => string {
+  const decoder = new StringDecoder('utf8')
+  return (chunk) => (typeof chunk === 'string' ? chunk : decoder.write(chunk))
+}
+
 /** The pi child, or the error spawning it threw synchronously. Node normally
  * reports a spawn failure through the child's async 'error' event, but some
  * failures (confirmed on Linux: posix_spawn detects E2BIG immediately) throw at
@@ -328,8 +337,10 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
         if (onAbort && signal) signal.removeEventListener('abort', onAbort)
       }
 
+      const decodeStdout = utf8Chunks()
+      const decodeStderr = utf8Chunks()
       proc.stdout.on('data', (data) => {
-        buffer += data.toString()
+        buffer += decodeStdout(data)
         const lines = buffer.split('\n')
         buffer = lines.pop() || ''
         for (const line of lines) processLine(line)
@@ -337,7 +348,7 @@ async function runSingleAgentInner(options: RunAgentOptions): Promise<SingleResu
       proc.stdout.on('error', () => {})
 
       proc.stderr.on('data', (data) => {
-        currentResult.stderr += data.toString()
+        currentResult.stderr += decodeStderr(data)
       })
       proc.stderr.on('error', () => {})
 

package/extensions/thinking.ts

@@ -91,11 +91,17 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     // the keyword in the prompt.
   })
 
+  // agent_settled never fires when pi is quit mid-run, and the escalation is already in the
+  // transcript: `pi -c` would resume at the raised level for good.
+  pi.on('session_shutdown', async () => {
+    await override.settle()
+  })
+
   pi.on('agent_settled', () => {
     // Restore the pre-escalation level, but only if nothing else moved it since (a
     // command's effort restore, a manual change): the conditional override stands down in
     // that case and restores unconditionally when the level cannot be read, the prior
     // best-effort behavior.
-    override.settle()
+    void override.settle()
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.69",
+  "version": "1.0.71",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",