pi-code 1.0.7 → 1.0.9

package/extensions/claude-rules.ts

@@ -22,7 +22,7 @@ import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 import { publishInstructionLoad } from './internal/instruction-events.js'
-import { globToRegExpSource } from './internal/path-rules.js'
+import { type CompiledGlob, compileGlobs, matchesCompiledGlobs } from './internal/path-rules.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { findNearestDir } from './internal/project-root.js'
 import { stripBlockComments } from './internal/strip-comments.js'
@@ -81,19 +81,7 @@ export function parseFrontmatter(content: string): Frontmatter {
  * the rule set's root.
  */
 export function pathMatchesGlobs(relPath: string, globs: string[]): boolean {
-  const posix = relPath.split(path.sep).join('/')
-  const base = posix.split('/').pop() ?? posix
-  return globs.some((raw) => {
-    let glob = raw.trim()
-    if (!glob) return false
-    if (glob.startsWith('./')) glob = glob.slice(2)
-    else if (glob.startsWith('/')) glob = glob.slice(1)
-    // A trailing slash means the directory's contents, like gitignore; `docs/` alone
-    // would compile to `^docs/$` and match nothing.
-    if (glob.endsWith('/')) glob += '**'
-    const target = glob.includes('/') ? posix : base
-    return new RegExp(`^${globToRegExpSource(glob)}$`).test(target)
-  })
+  return matchesCompiledGlobs(relPath, compileGlobs(globs))
 }
 
 /** A rule pointer line, annotated with its path scope when present. */
@@ -199,8 +187,10 @@ function rulesSection(title: string, rules: RuleSet, base: string): string {
 
 /** A scoped rule resolved to the root its globs match against, ready to attach. */
 interface AttachTarget {
-  key: string
+  /** The rule's `paths:` globs as written, reported on the instruction-events bus. */
   globs: string[]
+  /** The globs precompiled once at session start for the per-tool-result scan. */
+  compiled: CompiledGlob[]
   body: string
   /** The absolute directory `paths:` globs are matched relative to. */
   root: string
@@ -210,6 +200,15 @@ interface AttachTarget {
   memoryType: 'User' | 'Project'
 }
 
+// Module level because the working list lives in each extension instance's closure.
+let pendingScopedRules = 0
+
+/** Test seam: scoped rules still awaiting attachment in the current session, for
+ * asserting that a fully attached rule leaves the per-tool-result working list. */
+export function pendingScopedRuleCount(): number {
+  return pendingScopedRules
+}
+
 export default function claudeRulesExtension(pi: ExtensionAPI) {
   const globalRulesDir = path.join(os.homedir(), '.claude', 'rules')
   let globalRules: RuleSet = EMPTY_RULES
@@ -218,10 +217,9 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
   // The project rules dir may sit at an ancestor of cwd, where a cwd-relative
   // '.claude/rules' would point the read at a path that does not exist.
   let projectRulesBase = '.claude/rules'
-  // Scoped rules ready to attach when a matching file is touched, and the set of
-  // rules already attached this session so each attaches at most once.
+  // Scoped rules still awaiting a matching touch. An attached rule leaves the
+  // list, so each attaches at most once and the per-tool-result scan shrinks.
   let attachTargets: AttachTarget[] = []
-  const attached = new Set<string>()
 
   pi.on('session_start', async (_event, ctx) => {
     globalRules = readRules(globalRulesDir)
@@ -236,13 +234,14 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
 
     // Global globs are relative to cwd; project globs to the project root (the dir
     // holding .claude), so `db/**` in a repo rule matches repo-relative paths even
-    // from a subdirectory session. Reset per session so a re-run re-attaches.
-    attached.clear()
+    // from a subdirectory session. Globs compile here, once per session, rather
+    // than on every tool result; rebuilt per session so a re-run re-attaches.
     const projectRoot = projectRulesDir ? path.dirname(path.dirname(projectRulesDir)) : ctx.cwd
     attachTargets = [
-      ...globalRules.scoped.map((rule) => ({ key: `global:${rule.rel}`, globs: rule.paths, body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
-      ...projectRules.scoped.map((rule) => ({ key: `project:${rule.rel}`, globs: rule.paths, body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
+      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
+      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
     ]
+    pendingScopedRules = attachTargets.length
     // Relative to cwd, which the read tool resolves: an ancestor dir yields a
     // `../…/.claude/rules` the model can follow, where a bare '.claude/rules'
     // would point at a nonexistent path under the subdirectory.
@@ -277,21 +276,25 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     const abs = path.resolve(ctx.cwd, rel)
 
     const bodies: string[] = []
+    const remaining: AttachTarget[] = []
     for (const target of attachTargets) {
-      if (attached.has(target.key)) continue
       const relativeToRoot = path.relative(target.root, abs)
       // A file outside the rule root cannot match its project-relative globs. Test for
       // a real parent-traversal segment, not a leading '..' (a file named `..config` is
       // inside the root).
-      if (relativeToRoot === '..' || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) continue
-      if (!pathMatchesGlobs(relativeToRoot, target.globs)) continue
-      attached.add(target.key)
+      const outsideRoot = relativeToRoot === '..' || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)
+      if (outsideRoot || !matchesCompiledGlobs(relativeToRoot, target.compiled)) {
+        remaining.push(target)
+        continue
+      }
       bodies.push(target.body)
       // The lazy attach is Claude's path_glob_match instruction load; the hooks
-      // extension bridges the bus event to the InstructionsLoaded hook. The
-      // once-per-session attach set above also bounds the events to one per rule.
+      // extension bridges the bus event to the InstructionsLoaded hook. Leaving
+      // the working list also bounds the events to one per rule per session.
       publishInstructionLoad(pi.events, { file_path: target.file, memory_type: target.memoryType, load_reason: 'path_glob_match', globs: target.globs, trigger_file_path: abs })
     }
+    attachTargets = remaining
+    pendingScopedRules = attachTargets.length
     if (bodies.length === 0) return
     return { content: [...event.content, ...bodies.map((text) => ({ type: 'text' as const, text }))] }
   })

package/extensions/commands.ts

@@ -46,6 +46,7 @@ import { Type } from 'typebox'
 import { matchesBashRules } from './internal/bash-rules.js'
 import { type CommandExec, type DiscoveredCommand, discoverCommandFiles, expandDynamicContent, type ParsedCommand, parseCommandFile, resolvePowershellBinary, spanExec, substituteArgsDetailed, substituteVars } from './internal/command-file.js'
 import { readManagedSettings } from './internal/managed-settings.js'
+import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
 import { type InstalledPlugin, installedPlugins } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
@@ -315,12 +316,17 @@ export default function commandsExtension(pi: ExtensionAPI) {
     pendingBashRules = undefined
     pendingPathRules = undefined
     if (pendingModelRestore) {
-      void pi.setModel(pendingModelRestore as Parameters<typeof pi.setModel>[0])
+      const restore = pendingModelRestore as Parameters<typeof pi.setModel>[0]
       pendingModelRestore = undefined
+      // setModel can reject (e.g. auth resolution fails), and a floated rejection would
+      // escape as unhandled; surface it instead of leaving the session silently on the
+      // command's override model.
+      void pi.setModel(restore).catch(() => {})
+    }
+    if (pendingRestore) {
+      pi.setActiveTools(pendingRestore)
+      pendingRestore = undefined
     }
-    if (!pendingRestore) return
-    pi.setActiveTools(pendingRestore)
-    pendingRestore = undefined
   })
 
   // The active-tool set has no argument dimension, so a scoped grant hands the turn
@@ -416,6 +422,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // restored when that run ends. Restoring inline does not work: sendUserMessage is
     // fire-and-forget, so the restore would land before the agent ever read the tool
     // list, leaving the command running with everything enabled.
+    // A command invoked while the agent is streaming must not narrow the in-flight run's
+    // tools or switch its model (that would corrupt a run it does not own), and a bare
+    // sendUserMessage throws mid-stream and would be silently dropped. Queue it as a
+    // follow-up through pi's own queue, which is abort-aware and shown to the user; its
+    // frontmatter scoping is not applied in that case, since it cannot land on a run that
+    // has not started yet.
+    if (!ctx.isIdle()) {
+      pi.sendUserMessage(expanded, { deliverAs: 'followUp' })
+      return
+    }
     applyAllowedTools(parsed, vars)
     applyDisallowedTools(parsed)
     await applyModelOverride(parsed, varCtx)
@@ -500,7 +516,10 @@ export default function commandsExtension(pi: ExtensionAPI) {
         // the tool result is the channel, and frontmatter scoping stays user-path
         // territory (see the header).
         const expanded = await expandCommand(pi, current, args, execCtx, command.filePath, command.plugin, { allowShell: false })
-        return { content: [{ type: 'text' as const, text: `Contents of /${name} (expanded):\n\n${expanded}` }], details: {} }
+        // Cap the tool result: a command body can inline an arbitrarily large @file, and
+        // an uncapped tool result overflows the model's context (every other pi-code tool
+        // routes its output through capForContext). The user-invoked path stays uncapped.
+        return { content: [{ type: 'text' as const, text: capForContext(`Contents of /${name} (expanded):\n\n${expanded}`) }], details: {} }
       },
     })
   })

package/extensions/context-imports.ts

@@ -52,6 +52,7 @@
  * Docs: https://code.claude.com/docs/en/memory.md (imports)
  */
 
+import { createHash } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
@@ -507,6 +508,81 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     publishInstructionLoad(pi.events, event)
   }
 
+  // before_agent_start fires every turn, but its inputs almost never change
+  // mid-session. The settings-derived environment (managed settings, exclude
+  // globs, repo root) is cached per cwd, and the whole import expansion is
+  // memoized on its inputs and revalidated by a stat token (mtime and size): a
+  // turn where nothing changed costs a handful of stats instead of re-reading and
+  // re-recursing every @import. A brand-new file satisfying a previously missing
+  // @import is picked up when any recorded stat token moves (or next session),
+  // which is already fresher than Claude, which loads context once at session start.
+  let envCache: { cwd: string; managed: Record<string, unknown>; excludeGlobs: string[]; projectRoot: string } | undefined
+  let importMemo:
+    | {
+        key: string
+        extras: Array<{ path: string; content: string; dir: string }>
+        imported: ImportedFile[]
+        budget: ImportBudget
+        tokens: Array<[string, string]>
+      }
+    | undefined
+  // mtime plus size, so a same-mtime rewrite of a different length still invalidates.
+  const statToken = (file: string): string => {
+    const stat = fs.statSync(file)
+    return `${stat.mtimeMs}:${stat.size}`
+  }
+  const memoIsFresh = (memo: NonNullable<typeof importMemo>): boolean => {
+    try {
+      return memo.tokens.every(([file, token]) => statToken(file) === token)
+    } catch {
+      return false // a recorded file vanished: re-expand
+    }
+  }
+  // Memo lookup or recompute: a turn whose key matches the previous expansion and
+  // whose recorded stat tokens are all unchanged reuses that expansion outright;
+  // otherwise the imports are re-expanded and the memo (with a fresh revalidation
+  // set) is rebuilt for next turn.
+  const resolveImports = (
+    memoKey: string,
+    native: Array<{ path: string; content: string }>,
+    contextFiles: Array<{ path: string; content: string }>,
+    home: string,
+    cwd: string,
+    excluded: (absPath: string) => boolean,
+  ): { extras: Array<{ path: string; content: string; dir: string }>; budget: ImportBudget; imported: ImportedFile[] } => {
+    if (importMemo?.key === memoKey && memoIsFresh(importMemo)) {
+      const { extras, budget, imported } = importMemo
+      return { extras, budget, imported }
+    }
+    // Seed with every loaded context file path, excluded ones included, so pi's own
+    // files are never re-imported and an excluded file cannot return as an import.
+    const seenSet = new Set(realRoots([...native, ...localContexts].map((file) => file.path)))
+
+    // Claude's --add-dir memory loading, env-gated. The files join the seen set
+    // before import expansion so an @import cannot pull one in twice, and they get
+    // the same exclude and comment-strip treatment as native context files.
+    const addDirs = additionalDirsClaudeMdEnabled() ? parseAdditionalDirs(pi.getFlag?.('add-dir'), home, cwd) : []
+    const extras = additionalDirExtras(addDirs, seenSet, excluded, projectApproved)
+
+    // One budget for the whole run, so N context files cannot each spend a full one.
+    // Exclusion applies inside the recursion: an excluded @import is skipped before
+    // it is read, so its transitive imports never load and it spends no budget.
+    const budget = createImportBudget()
+    const imported = expandImports(contextFiles, extras, home, cwd, seenSet, excluded, budget)
+
+    // Revalidation set: every file the expansion read, plus each add-dir itself
+    // (a directory's mtime moves when a memory file is added or removed there).
+    const tokens: Array<[string, string]> = []
+    try {
+      for (const file of [...extras.map((extra) => extra.path), ...imported.map((entry) => entry.path)]) tokens.push([file, statToken(file)])
+      for (const dir of addDirs) tokens.push([dir, statToken(dir)])
+      importMemo = { key: memoKey, extras, budget, imported, tokens }
+    } catch {
+      importMemo = undefined // a file moved mid-expansion: just recompute next turn
+    }
+    return { extras, budget, imported }
+  }
+
   // Claude's --add-dir. Only the memory-loading half is meaningful here: pi has
   // no path-based permission system, so there is no access grant to mirror.
   // Optional-called so the extension still wires under stub hosts without flags.
@@ -520,6 +596,8 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     // a reload anyway; a reload simply re-fires InstructionsLoaded once per file,
     // which is fine, since a reload re-loads the instruction files.
     announced.clear()
+    envCache = undefined
+    importMemo = undefined
     // CLAUDE.local.md is Claude Code's personal sidecar of CLAUDE.md; pi's own loader
     // skips it. A cloned repo can ship one, so it is gated like other project config.
     // Claude loads local context from the whole hierarchy above the working
@@ -545,10 +623,12 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const cwd = event.systemPromptOptions?.cwd ?? process.cwd()
     const native: Array<{ path: string; content: string }> = event.systemPromptOptions?.contextFiles ?? []
 
-    const managed = readManagedSettings()
-    const excludeGlobs = readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managed)
+    if (envCache?.cwd !== cwd) {
+      const managedNow = readManagedSettings()
+      envCache = { cwd, managed: managedNow, excludeGlobs: readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managedNow), projectRoot: repoRoot(cwd) ?? cwd }
+    }
+    const { managed, excludeGlobs, projectRoot } = envCache
     const excluded = (absPath: string): boolean => isExcludedPath(absPath, excludeGlobs, home)
-    const projectRoot = repoRoot(cwd) ?? cwd
 
     // claudeMdExcludes drops an excluded file's block from the assembled prompt and
     // from import expansion; surviving blocks get block-level comments stripped.
@@ -575,21 +655,16 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const keptLocals = localContexts.filter((local) => !excluded(local.path)).map((local) => ({ path: local.path, content: stripBlockComments(local.content) }))
     const contextFiles = [...rewrite.kept, ...keptLocals]
 
-    // Seed with every loaded context file path, excluded ones included, so pi's own
-    // files are never re-imported and an excluded file cannot return as an import.
-    const seenSet = new Set(realRoots([...native, ...localContexts].map((file) => file.path)))
+    // Everything the expansion depends on, hashed: a turn whose inputs match the memo
+    // and whose recorded mtimes are unchanged reuses the previous expansion outright.
+    const addDirsRaw = additionalDirsClaudeMdEnabled() ? String(pi.getFlag?.('add-dir') ?? '') : ''
+    const keyHash = createHash('sha256')
+    keyHash.update(`${cwd}\0${home}\0${projectApproved}\0${addDirsRaw}\0${excludeGlobs.join(',')}\0`)
+    for (const file of [...native, ...localContexts]) keyHash.update(`${file.path}\0`)
+    for (const file of contextFiles) keyHash.update(`${file.path}\0${file.content}\0`)
+    const memoKey = keyHash.digest('hex')
 
-    // Claude's --add-dir memory loading, env-gated. The files join the seen set
-    // before import expansion so an @import cannot pull one in twice, and they get
-    // the same exclude and comment-strip treatment as native context files.
-    const addDirs = additionalDirsClaudeMdEnabled() ? parseAdditionalDirs(pi.getFlag?.('add-dir'), home, cwd) : []
-    const extras = additionalDirExtras(addDirs, seenSet, excluded, projectApproved)
-
-    // One budget for the whole run, so N context files cannot each spend a full one.
-    // Exclusion applies inside the recursion: an excluded @import is skipped before
-    // it is read, so its transitive imports never load and it spends no budget.
-    const budget = createImportBudget()
-    const imported = expandImports(contextFiles, extras, home, cwd, seenSet, excluded, budget)
+    const { extras, budget, imported } = resolveImports(memoKey, native, contextFiles, home, cwd, excluded)
 
     let addition = localContextAddition(keptLocals, announce)
     addition += additionalDirsAddition(extras, announce)

package/extensions/git-checkpoint.ts

@@ -149,6 +149,10 @@ async function restoreConversation(ctx: ExtensionCommandContext, entryId: string
 export default function gitCheckpointExtension(pi: ExtensionAPI) {
   const checkpoints = new Map<string, Checkpoint>()
   let pending: { ref: string; createdAt: string } | undefined
+  // A run (one user message) needs a single pre-run snapshot, no matter how many
+  // assistant turns it drives. before_agent_start starts a run; the first turn_start
+  // then snapshots and clears this, so turns 2..n skip the wasted git work.
+  let runNeedsSnapshot = true
   let shadowDir: string | undefined
   let workTree: string | undefined
 
@@ -258,10 +262,24 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     }
   })
 
-  // Snapshot code state before the LLM acts in this turn. The user message
-  // that started the turn is not persisted yet at turn_start (it lands on
-  // message_end), so the checkpoint is only keyed and saved at turn_end.
+  // A new agent loop starts a run: the next turn_start snapshots the pre-run tree.
+  // agent_start, not before_agent_start: before_agent_start does not fire for a queued
+  // follow-up message delivered through agent.continue, so gating on it would leave that
+  // follow-up's user message with no checkpoint. agent_start re-fires per agent.continue
+  // (a retry, a compaction, or a follow-up), and the extra snapshot a retry produces is
+  // discarded at turn_end, since that user message already has its checkpoint.
+  pi.on('agent_start', async () => {
+    runNeedsSnapshot = true
+  })
+
+  // Snapshot code state before the LLM acts, once per run. The user message that
+  // started the turn is not persisted yet at turn_start (it lands on message_end), so
+  // the checkpoint is only keyed and saved at turn_end. The snapshot is awaited here so
+  // `git add -A` captures the tree before the model's first edit; turn_end reads the
+  // resolved value.
   pi.on('turn_start', async () => {
+    if (!runNeedsSnapshot) return
+    runNeedsSnapshot = false
     pending = await snapshot()
   })
 

package/extensions/hooks.ts

@@ -260,16 +260,24 @@ function foldName(name: string): string {
   return name.toLowerCase().replaceAll('-', '_')
 }
 
-function exactListApplies(matcher: string, names: readonly string[]): boolean {
-  const tokens = new Set(
+/** A matcher string's compiled form: a set of folded exact names, or a regex. */
+type CompiledMatcher = { tokens: Set<string> } | { regex: RegExp }
+
+function exactTokens(matcher: string): Set<string> {
+  return new Set(
     matcher
       .split(/[|,]/)
       .map((token) => foldName(token.trim()))
       .filter(Boolean),
   )
-  return names.some((name) => tokens.has(foldName(name)))
 }
 
+/** Hook config is static per session and dispatch consults every matcher on every
+ * event, so each matcher string compiles once. Matchers are few; the bound is a
+ * safety net, clearing the (cheap to rebuild) cache rather than evicting. */
+const compiledMatchers = new Map<string, CompiledMatcher>()
+const COMPILED_MATCHER_BOUND = 1000
+
 /** A matcher entry pi-code can run: an object whose `hooks` is a list. Anything else
  * is reported by name and skipped, so one bad entry costs its own hooks, not the
  * session's tool calls. */
@@ -290,15 +298,48 @@ function isUsableMatcher(entry: unknown, file: string, event: string): entry is
   return true
 }
 
+let matcherCompiles = 0
+
+/** Test seam: matcher compilations performed, for asserting memoization. */
+export function matcherCompileCount(): number {
+  return matcherCompiles
+}
+
+/** Test seam: drop compiled matchers so a test observes fresh compiles. */
+export function resetMatcherCache(): void {
+  compiledMatchers.clear()
+  matcherCompiles = 0
+}
+
+function compileMatcher(matcher: string): CompiledMatcher {
+  const cached = compiledMatchers.get(matcher)
+  if (cached !== undefined) return cached
+  matcherCompiles += 1
+  let compiled: CompiledMatcher
+  if (EXACT_MATCHER.test(matcher)) {
+    compiled = { tokens: exactTokens(matcher) }
+  } else {
+    try {
+      compiled = { regex: new RegExp(matcher, 'i') }
+    } catch {
+      // An invalid regex matcher falls back to exact-name matching, as before.
+      compiled = { tokens: exactTokens(matcher) }
+    }
+  }
+  if (compiledMatchers.size >= COMPILED_MATCHER_BOUND) compiledMatchers.clear()
+  compiledMatchers.set(matcher, compiled)
+  return compiled
+}
+
 function matcherApplies(matcher: string | undefined, names: readonly string[]): boolean {
   if (!matcher || matcher === '*') return true
-  if (EXACT_MATCHER.test(matcher)) return exactListApplies(matcher, names)
-  try {
-    const regex = new RegExp(matcher, 'i')
+  const compiled = compileMatcher(matcher)
+  if ('regex' in compiled) {
+    const { regex } = compiled
     return names.some((name) => regex.test(name))
-  } catch {
-    return exactListApplies(matcher, names)
   }
+  const { tokens } = compiled
+  return names.some((name) => tokens.has(foldName(name)))
 }
 
 /** A hook entry pi-code can run: a shell command, an http POST, an in-process
@@ -565,7 +606,7 @@ export async function runPromptHook(hook: HookCommand, payload: unknown, model:
   const prompt = substituteArguments(hook.prompt, payload)
   const signal = AbortSignal.timeout(timeoutMs)
   try {
-    const answer = await completeText(model, prompt, { system: PROMPT_HOOK_SYSTEM, maxTokens: 512, signal })
+    const { text: answer } = await completeText(model, prompt, { system: PROMPT_HOOK_SYSTEM, maxTokens: 512, signal })
     return { code: 0, stdout: answer, stderr: '', timedOut: false }
   } catch (error) {
     return abortAwareFailure(signal, error)
@@ -971,6 +1012,12 @@ export default function hooksExtension(pi: ExtensionAPI) {
   // turn, and stop_hook_active in the payload tells the next firing it is already
   // continuing from a stop hook, which is the hook script's documented loop guard.
   // Only exit 2 and decision:"block" continue; continue:false means "stay stopped".
+  //
+  // On agent_end rather than agent_settled: agent_settled is only emitted after every
+  // agent_end handler returns, and a peer extension (plan mode) blocks its agent_end
+  // handler on a UI dialog, which would starve the Stop hook and idle notification
+  // until the user answers it. agent_end can fire slightly early before a rare
+  // automatic retry or compaction; that is the better tradeoff.
   pi.on('agent_end', async (event, ctx) => {
     // Claude's Notification event, for the one type pi can honestly source: the
     // agent finished and is waiting for input (idle_prompt). Observational only;

package/extensions/init.ts

@@ -75,7 +75,9 @@ export default function initExtension(pi: ExtensionAPI) {
       const existing = findExistingContextFile(root)
       const cursorRules = statOf(path.join(root, '.cursor', 'rules'))?.isDirectory() === true || statOf(path.join(root, '.cursorrules'))?.isFile() === true
       const copilotRules = statOf(path.join(root, '.github', 'copilot-instructions.md'))?.isFile() === true
-      pi.sendUserMessage(buildInitPrompt({ ...(existing !== undefined ? { existingContextFile: existing } : {}), cursorRules, copilotRules }))
+      // A bare send throws (and is silently swallowed) while the agent is
+      // streaming, so mid-stream invocations queue as a follow-up turn.
+      pi.sendUserMessage(buildInitPrompt({ ...(existing !== undefined ? { existingContextFile: existing } : {}), cursorRules, copilotRules }), ctx.isIdle() ? {} : { deliverAs: 'followUp' })
     },
   })
 }

package/extensions/internal/model-complete.ts

@@ -14,7 +14,7 @@
  * throw and the caller falls back to its non-model behavior.
  */
 
-import type { Api, AssistantMessage, Context, Model, ModelsSimpleStreamOptions } from '@earendil-works/pi-ai'
+import type { Api, AssistantMessage, Context, Model, ModelsSimpleStreamOptions, Usage } from '@earendil-works/pi-ai'
 import { ModelRuntime } from '@earendil-works/pi-coding-agent'
 
 /** The completion backend: model + context -> assistant message. Overridable for tests. */
@@ -52,11 +52,13 @@ export interface CompleteOptions {
 }
 
 /**
- * Run `prompt` through `model` as a single user turn and return the reply text.
+ * Run `prompt` through `model` as a single user turn and return the reply text plus
+ * the call's usage. A tool that makes a nested LLM call must return that usage on
+ * its tool result, or the call's tokens and cost vanish from pi's session totals.
  * Throws on any failure so the caller can fall back; never returns a partial or a
  * tool call, only assistant text.
  */
-export async function completeText(model: Model<Api>, prompt: string, options: CompleteOptions = {}): Promise<string> {
+export async function completeText(model: Model<Api>, prompt: string, options: CompleteOptions = {}): Promise<{ text: string; usage: Usage }> {
   backend ??= realBackend()
   const complete = await backend
   const context: Context = {
@@ -64,5 +66,5 @@ export async function completeText(model: Model<Api>, prompt: string, options: C
     messages: [{ role: 'user', content: prompt, timestamp: Date.now() }],
   }
   const message = await complete(model, context, { maxTokens: options.maxTokens ?? 1024, signal: options.signal })
-  return assistantText(message)
+  return { text: assistantText(message), usage: message.usage }
 }

package/extensions/internal/path-rules.ts

@@ -132,6 +132,51 @@ function resolveRule(rule: string, anchors: PathAnchors): string {
   return path.join(anchors.cwd, rel)
 }
 
+/** One rule glob precompiled for repeated matching: its anchored regex, and whether
+ * it applies to the basename (a slashless pattern, gitignore-style) or the full
+ * root-relative path. */
+export interface CompiledGlob {
+  regex: RegExp
+  matchesBasename: boolean
+}
+
+let globsCompiled = 0
+let globsEvaluated = 0
+
+/** Test seam: cumulative compiled-glob work, for asserting that callers compile
+ * each glob once upfront and stop evaluating rules that no longer apply. */
+export function globCompileStats(): { compiled: number; evaluated: number } {
+  return { compiled: globsCompiled, evaluated: globsEvaluated }
+}
+
+/** Rule `paths:` globs compiled once for repeated matching, with claude-rules'
+ * pathMatchesGlobs semantics: `./` and leading `/` anchors are stripped, a trailing
+ * slash scopes to the directory's contents, and blank entries drop out. */
+export function compileGlobs(globs: string[]): CompiledGlob[] {
+  const compiled: CompiledGlob[] = []
+  for (const raw of globs) {
+    let glob = raw.trim()
+    if (!glob) continue
+    if (glob.startsWith('./')) glob = glob.slice(2)
+    else if (glob.startsWith('/')) glob = glob.slice(1)
+    // A trailing slash means the directory's contents, like gitignore; `docs/` alone
+    // would compile to `^docs/$` and match nothing.
+    if (glob.endsWith('/')) glob += '**'
+    globsCompiled += 1
+    compiled.push({ regex: new RegExp(`^${globToRegExpSource(glob)}$`), matchesBasename: !glob.includes('/') })
+  }
+  return compiled
+}
+
+/** Whether a root-relative path matches at least one compiled glob. No globs means
+ * no match. */
+export function matchesCompiledGlobs(relPath: string, globs: CompiledGlob[]): boolean {
+  globsEvaluated += 1
+  const posix = relPath.split(path.sep).join('/')
+  const base = posix.split('/').pop() ?? posix
+  return globs.some((glob) => glob.regex.test(glob.matchesBasename ? base : posix))
+}
+
 /** Whether the accessed file matches at least one rule. No rules means no match:
  * a granted-but-scoped tool with an empty scope set stays blocked, never open. */
 export function matchesPathRules(filePath: string, rules: string[], anchors: PathAnchors): boolean {

package/extensions/internal/plugins.ts

@@ -90,16 +90,70 @@ function pluginConfigsMap(settingsFiles: string[]): Record<string, Record<string
   return merged
 }
 
+/** Memoized discovery per (home, extra settings files), revalidated by fingerprint. */
+const pluginCache = new Map<string, { fingerprint: string; plugins: InstalledPlugin[] }>()
+
+/** Drop every memoized discovery; the next installedPlugins call walks afresh. */
+export function resetInstalledPluginsCache(): void {
+  pluginCache.clear()
+}
+
+/** mtime plus size, so a same-instant rewrite with different content still differs. */
+function statToken(target: string): string {
+  try {
+    const stat = fs.statSync(target)
+    return `${stat.mtimeMs}:${stat.size}`
+  } catch {
+    return 'missing'
+  }
+}
+
+/**
+ * A cheap change signature for one home's plugin config: the settings files' stat
+ * tokens plus the cache tree's directory names and mtimes down through each plugin's
+ * version directories, and the stat token of the resolved (newest) version's manifest
+ * so an in-place edit of it invalidates the cache. Costs a few stats where the full
+ * walk reads and parses the settings and every manifest.
+ */
+function pluginFingerprint(cacheDir: string, settingsFiles: string[]): string {
+  const parts = settingsFiles.map(statToken)
+  for (const marketplace of listDirs(cacheDir)) {
+    const marketplaceDir = path.join(cacheDir, marketplace)
+    parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
+    for (const pluginDir of listDirs(marketplaceDir)) {
+      const pluginPath = path.join(marketplaceDir, pluginDir)
+      parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
+      const versions = listDirs(pluginPath)
+      for (const version of versions) {
+        parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
+      }
+      // resolvePlugin reads only the newest version's manifest, so its stat token is
+      // what an in-place edit (no directory entry changing) must move.
+      const newest = newestVersion(versions)
+      if (newest) parts.push(`${marketplace}/${pluginDir}/${newest}/manifest:${statToken(path.join(pluginPath, newest, '.claude-plugin', 'plugin.json'))}`)
+    }
+  }
+  return parts.join('\n')
+}
+
 /**
  * Enabled plugins from the cache. Enablement is decided by the user's own
  * settings only: plugins install to the user's machine and carry code (hook
  * scripts, MCP server commands), so a checked-out repo must not be able to flip
  * which of them run. `extraSettingsFiles`, when given, are additional
  * user-controlled settings sources, not project files.
+ *
+ * Several extensions call this at session start and per discovery, so the walk
+ * is memoized behind the fingerprint above; callers always see current data
+ * because any settings edit or cache-tree change invalidates it.
  */
 export function installedPlugins(home: string, extraSettingsFiles: string[] = []): InstalledPlugin[] {
   const cacheDir = path.join(home, '.claude', 'plugins', 'cache')
   const settingsFiles = [path.join(home, '.claude', 'settings.json'), ...extraSettingsFiles]
+  const key = [home, ...extraSettingsFiles].join('\n')
+  const fingerprint = pluginFingerprint(cacheDir, settingsFiles)
+  const cached = pluginCache.get(key)
+  if (cached?.fingerprint === fingerprint) return cached.plugins
   const enabled = enabledMap(settingsFiles)
   const configs = pluginConfigsMap(settingsFiles)
   const plugins: InstalledPlugin[] = []
@@ -109,6 +163,7 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
       if (plugin) plugins.push(plugin)
     }
   }
+  pluginCache.set(key, { fingerprint, plugins })
   return plugins
 }