pi-code 1.0.70 → 1.0.72

package/extensions/commands.ts

@@ -52,6 +52,7 @@ import { managedSettingsFile, readManagedSettings } from './internal/managed-set
 import { findModel } from './internal/model-lookup.js'
 import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
+import { isPlanModeState, PLAN_MODE_CHANNEL } from './internal/plan-mode-state.js'
 import { type InstalledPlugin, installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { ancestorDirs, repoRoot } from './internal/project-root.js'
@@ -319,6 +320,9 @@ export default function commandsExtension(pi: ExtensionAPI) {
   let projectApproved = false
   /** Tool set to put back once the run a restricted command drove has ended. */
   let pendingRestore: string[] | undefined
+  /** The tools this run's restriction took out of the set. Put back as a delta on whatever is
+   * active by then: overwriting with the snapshot undid every change made meanwhile. */
+  let tookAway = new Set<string>()
   /** `Bash(...)` scopes enforced while that run lasts; lifted with the restriction. */
   let pendingBashRules: string[] | undefined
   /** `WebFetch(domain:...)` scopes enforced the same way. */
@@ -335,12 +339,16 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // setModel can reject (e.g. auth resolution fails), and a floated rejection would
     // escape as unhandled; surface it as a no-op instead of leaving the session silently
     // on the command's override model.
-    set: (model) => {
+    set: async (model) => {
       // A refused switch leaves the turn on the session model rather than the one the
-      // command named, and the reply gives no sign of it, so the refusal is reported.
-      void pi.setModel(model as Parameters<typeof pi.setModel>[0]).catch((error: unknown) => {
+      // command named, and the reply gives no sign of it, so the refusal is reported. The
+      // promise never rejects, so a caller that does not await it (agent_settled) cannot
+      // float a rejection; the shutdown handler awaits it so the exit cannot outrun it.
+      try {
+        await pi.setModel(model as Parameters<typeof pi.setModel>[0])
+      } catch (error) {
         console.warn(`pi-code-commands: could not switch to ${typeof model === 'object' && model !== null && 'id' in model ? String((model as { id: unknown }).id) : String(model)}: ${errorMessage(error)}`)
-      })
+      }
     },
   })
   /** The thinking level to restore after a command's `effort:` override drove its run,
@@ -358,17 +366,26 @@ export default function commandsExtension(pi: ExtensionAPI) {
   // agent_settled fires exactly once, after the run has fully settled and no such
   // continuation remains, which is the grant's true clearing point.
   pi.on('agent_settled', async () => {
-    pendingBashRules = undefined
-    pendingDomainRules = undefined
-    pendingAgentRules = undefined
-    pendingSkillRules = undefined
-    pendingPathRules = undefined
-    modelOverride.settle()
-    effortOverride.settle()
-    if (pendingRestore) {
-      pi.setActiveTools(pendingRestore)
-      pendingRestore = undefined
-    }
+    void modelOverride.settle()
+    void effortOverride.settle()
+    liftToolScope()
+  })
+
+  // "Execute the plan" continues the very run a scoped command started, so the scope it set
+  // for planning would judge every call of the execution and the tools it narrowed away
+  // would stay gone. Leaving plan mode is the point the user approved more than the command
+  // asked for; the model and effort overrides still last until the run settles.
+  pi.events?.on(PLAN_MODE_CHANNEL, (data) => {
+    if (isPlanModeState(data) && !data.active) liftToolScope()
+  })
+
+  // agent_settled never fires when pi is quit mid-run (double Ctrl+C, Ctrl+D, a closed
+  // terminal, SIGTERM), and the switch is already in the transcript: `pi -c` resumed on the
+  // command's override model at its raised level. A run that settled has nothing armed, so
+  // this restores nothing twice.
+  pi.on('session_shutdown', async () => {
+    await modelOverride.settle()
+    await effortOverride.settle()
   })
 
   // The active-tool set has no argument dimension, so a scoped grant hands the turn
@@ -414,6 +431,32 @@ export default function commandsExtension(pi: ExtensionAPI) {
     return original
   }
 
+  /** Record what the restriction just applied took out, against the set captured before it. */
+  function noteTakenAway(): void {
+    if (!pendingRestore) return
+    const active = new Set(pi.getActiveTools())
+    tookAway = new Set(pendingRestore.filter((tool) => !active.has(tool)))
+  }
+
+  /** End the run's tool restriction: drop its scopes and put back what it took away, as a
+   * delta on the set in force. A snapshot overwrite undid whatever else changed the set
+   * meanwhile: plan mode's Execute (the session finished read-only, plan mode off, with edit
+   * and write gone) and a tool registered during the run (dropped until a /reload). */
+  function liftToolScope(): void {
+    pendingBashRules = undefined
+    pendingDomainRules = undefined
+    pendingAgentRules = undefined
+    pendingSkillRules = undefined
+    pendingPathRules = undefined
+    const original = pendingRestore
+    if (!original) return
+    const active = pi.getActiveTools()
+    const keep = new Set([...active, ...tookAway])
+    pi.setActiveTools([...original.filter((tool) => keep.has(tool)), ...active.filter((tool) => !original.includes(tool))])
+    pendingRestore = undefined
+    tookAway = new Set()
+  }
+
   /** Apply a command's allowed-tools to the run it drives: intersect with the tools
    * pi actually has, keep the bash and path scopes for the tool_call guard, and let
    * agent_settled restore the previous set. */
@@ -429,6 +472,7 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // intersects to nothing named only tools pi has none of: that restriction cannot
     // be expressed, and applying it as "no tools" is not what the command asked for.
     if (granted.length > 0 || allowed.length === 0) pi.setActiveTools(granted)
+    noteTakenAway()
     // The latest restricted command speaks for the turn: a later unscoped grant
     // lifts an earlier command's scopes rather than stacking under them. Rules get
     // the same ${CLAUDE_*} substitution as the body, so a rule can name a bundled
@@ -447,6 +491,7 @@ export default function commandsExtension(pi: ExtensionAPI) {
     if (!disallowed || disallowed.length === 0) return
     captureRestorePoint()
     pi.setActiveTools(pi.getActiveTools().filter((tool) => !disallowed.includes(tool)))
+    noteTakenAway()
   }
 
   /** Claude's `model:` frontmatter overrides the model for this run only, then the

package/extensions/hooks/index.ts

@@ -223,6 +223,12 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let managedHooksOnly = false
   /** Skill hooks registered this session, re-applied when a settings edit reloads. */
   const registeredSkillHooks: Array<{ skillName: string; hooks: Record<string, unknown> }> = []
+  /** Whether this process is a subagent's child. Claude runs settings hooks inside a
+   * subagent for tool events, but Stop is the main agent's, a subagent completes with
+   * SubagentStop, and a subagent run is neither a session (SessionStart, SessionEnd) nor
+   * a prompt the user submitted (UserPromptSubmit). The child is a full pi process loading
+   * the same settings, so without this every one of them fired in it. */
+  const inSubagentChild = (): boolean => process.env.PI_CODE_SUBAGENT === '1'
   /** Stops the settings watcher of the previous session. */
   let disposeSettingsWatch: () => void = () => {}
   /** Claude's disableAllHooks escape hatch was set somewhere in the honored chain. */
@@ -466,7 +472,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     pendingSessionContext = []
     // "reload" re-fires in-process with the same conversation and would double-run hooks;
     // a fork is a genuine session begin, which Claude reports as source "fork".
-    if (event.reason === 'reload') return
+    if (event.reason === 'reload' || inSubagentChild()) return
     const source = claudeSpelling(SESSION_START_SOURCE, event.reason)
     const commands = matchingCommands(config.SessionStart, source.names)
     const payload = { hook_event_name: 'SessionStart', source: source.value }
@@ -593,7 +599,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
   pi.on('input', async (event, ctx) => {
     // Only genuine user input; extension-injected messages (plan-mode, subagent) are not
     // prompts the user submitted.
-    if (event.source === 'extension') return { action: 'continue' }
+    if (event.source === 'extension' || inSubagentChild()) return { action: 'continue' }
     // The user typed, so the pending idle_prompt no longer applies.
     cancelIdlePrompt()
     // Genuine user input is progress, so it breaks a Stop-hook continuation streak: the
@@ -605,12 +611,15 @@ export default function hooksExtension(pi: ExtensionAPI) {
       ctx.ui.notify(decision.reason ?? 'Prompt blocked by hook', 'error')
       return { action: 'handled' }
     }
-    // Claude injects a UserPromptSubmit hook's context ahead of the prompt; transform is
-    // pi's seam for rewriting the submitted text. The prompt itself always survives:
     // "UserPromptSubmit: can't replace the prompt; it only injects additionalContext
-    // alongside it". suppressOriginalPrompt scopes to the block message, which never
+    // alongside it", as a system reminder with no visible transcript entry. So the context
+    // is a hidden message next to the prompt and the prompt text is left alone: prepended,
+    // it moved a `/skill:` or `/template` invocation off position 0 and pi stopped
+    // expanding it. pi appends a "nextTurn" message to this very prompt (after this handler
+    // runs); one typed mid-stream never reaches before_agent_start, so it is queued in the
+    // prompt's own mode. suppressOriginalPrompt scopes to the block message, which never
     // carries the prompt here, so it needs nothing of its own.
-    if (decision.context) return { action: 'transform', text: `${decision.context}\n\n${event.text}` }
+    if (decision.context) pi.sendMessage({ customType: 'claude-hook-context', content: decision.context, display: false }, { deliverAs: event.streamingBehavior ?? 'nextTurn' })
     return { action: 'continue' }
   })
 
@@ -630,6 +639,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
    * turn cancels it. Observational only; exit codes and JSON output are ignored. */
   const armIdlePrompt = (ctx: ExtensionContext): void => {
     cancelIdlePrompt()
+    if (inSubagentChild()) return
     const notifyCommands = matchingCommands(config.Notification, ['idle_prompt'])
     if (notifyCommands.length > 0) {
       const runner = boundRunner(ctx)
@@ -639,21 +649,26 @@ export default function hooksExtension(pi: ExtensionAPI) {
       idlePromptTimer.unref?.()
     }
   }
+  /** In a subagent child, the agent-frontmatter Stop hooks were converted to SubagentStop
+   * and fire at the child's own end, notify-style, before the Stop early-returns, which do
+   * not apply to them. Only the agent's own frontmatter hooks (stamped agent:<name>): the
+   * settings-level SubagentStop is fired by the parent when the child completes, so the
+   * child firing it too ran it twice. */
+  const fireChildSubagentStop = async (event: { messages?: Array<{ role: string; content: unknown }> }, ctx: ExtensionContext): Promise<void> => {
+    if (!agentIdentity) return
+    const subStop = matchingCommands(config.SubagentStop, agentIdentity.agent).filter((command) => command.origin?.startsWith('agent:'))
+    if (subStop.length === 0) return
+    const subText = lastAssistantText(event.messages ?? [])
+    const subPayload = { hook_event_name: 'SubagentStop', agent_type: agentIdentity.agent, ...(agentIdentity.id ? { agent_id: agentIdentity.id } : {}), stop_hook_active: false, ...(subText ? { last_assistant_message: subText } : {}) }
+    await runNotifyHooks(subStop, subPayload, boundRunner(ctx)).catch(() => {})
+  }
+
   pi.on('agent_end', async (event, ctx) => {
     armIdlePrompt(ctx)
+    await fireChildSubagentStop(event as { messages?: Array<{ role: string; content: unknown }> }, ctx)
 
-    // In a subagent child, the agent-frontmatter Stop hooks were converted to
-    // SubagentStop and fire here, at the child's own end, notify-style; before the
-    // Stop early-returns, which do not apply to them.
-    if (agentIdentity) {
-      const subStop = matchingCommands(config.SubagentStop, agentIdentity.agent)
-      if (subStop.length > 0) {
-        const subText = lastAssistantText((event as { messages?: Array<{ role: string; content: unknown }> }).messages ?? [])
-        const subPayload = { hook_event_name: 'SubagentStop', agent_type: agentIdentity.agent, ...(agentIdentity.id ? { agent_id: agentIdentity.id } : {}), stop_hook_active: false, ...(subText ? { last_assistant_message: subText } : {}) }
-        await runNotifyHooks(subStop, subPayload, boundRunner(ctx)).catch(() => {})
-      }
-    }
-
+    // Stop is the main agent's event; the child's completion was handled above.
+    if (inSubagentChild()) return
     // Stop has no matcher support (a stray matcher is ignored, as Claude documents)
     // and an `if`-carrying hook never runs on a non-tool event.
     const commands = allCommands(config.Stop).filter((command) => passesIfFilter(command, undefined))
@@ -771,13 +786,16 @@ export default function hooksExtension(pi: ExtensionAPI) {
     const reason = claudeSpelling(SESSION_END_REASON, event.reason)
     // SessionEnd rides Claude's short shared budget (see sessionEndTimeoutMs) so a
     // slow hook cannot stall session exit, /new or /resume.
-    const sessionEndCommands = matchingCommands(config.SessionEnd, reason.names).filter((command) => passesIfFilter(command, undefined))
+    const sessionEndCommands = inSubagentChild() ? [] : matchingCommands(config.SessionEnd, reason.names).filter((command) => passesIfFilter(command, undefined))
     const runner = boundRunner(ctx)
     const results = await Promise.all(sessionEndCommands.map((command) => runner(command, { hook_event_name: 'SessionEnd', reason: reason.value }, sessionEndTimeoutMs(command))))
     surfaceSystemMessages(results, (message) => ctx.ui.notify(message, 'warning'))
-    // Claude kills async hooks still running at teardown; the session that spawned
-    // these is over, and their delivery would target a disposed context anyway.
-    for (const kill of backgroundKills) kill()
+    // Claude: "In non-interactive mode with the -p flag, Claude Code kills any async hook
+    // still running at teardown". Only there: an interactive session leaves them running, so
+    // an async SessionEnd hook, started by this very shutdown, can finish instead of being
+    // killed a microtask after it spawned. Their delivery targets a disposed context and is
+    // caught (see deliverBackgroundResult).
+    if (ctx.hasUI !== true) for (const kill of backgroundKills) kill()
     backgroundKills.clear()
   })
 

package/extensions/internal/turn-override.ts

@@ -26,14 +26,15 @@ export interface TurnOverride<T> {
   reset(): void
   /** Restore the captured prior via `set` and clear the capture. A conditional override
    * stands down when the current value has moved off the target. No-op when nothing is
-   * armed. */
-  settle(): void
+   * armed. Returns what `set` returns, so a caller that must not exit before an async
+   * restore has landed (a shutdown) can await it. */
+  settle(): void | Promise<void>
 }
 
 export function createTurnOverride<T>(opts: {
   /** Applies the restore value. Consumers wrap their setter here (async-with-catch for
    * commands' model, plain for the thinking level). */
-  set: (value: T) => void
+  set: (value: T) => void | Promise<void>
   /** Reads the current value, for a conditional restore. Only consulted when
    * `conditional` is set. */
   get?: () => T | undefined
@@ -67,7 +68,7 @@ export function createTurnOverride<T>(opts: {
         const current = opts.get?.()
         if (current !== undefined && current !== movedTo) return
       }
-      opts.set(restore)
+      return opts.set(restore)
     },
   }
 }

package/extensions/plan-mode/index.ts

@@ -64,18 +64,28 @@ export default function planModeExtension(pi: ExtensionAPI): void {
   let todoItems: TodoItem[] = []
   let planFromTool = false
   let savedTools: string[] = []
+  /** Every tool pi had registered when the set was saved, active or not: a tool outside it
+   * was registered later, and pi activated it on top of whatever set was in force. */
+  let toolsAtSave = new Set<string>()
   let stalledRuns = 0
   let runProgress = false
 
+  const registeredTools = (): Set<string> => new Set((pi.getAllTools?.() ?? []).map((tool) => tool.name))
+
   function enterPlanTools(): void {
     savedTools = pi.getActiveTools()
+    toolsAtSave = registeredTools()
     pi.setActiveTools(PLAN_MODE_TOOLS.filter((t) => savedTools.includes(t)))
   }
 
+  /** Put back the saved set, plus any tool registered since: pi activates a late one (an MCP
+   * server past its connect window) on top of the restricted set, and overwriting with the
+   * snapshot dropped it for the rest of the session. A tool that was registered but not
+   * active at entry is not late, and stays out. */
   function restoreTools(): void {
-    if (savedTools.length > 0) {
-      pi.setActiveTools(savedTools)
-    }
+    if (savedTools.length === 0) return
+    const late = pi.getActiveTools().filter((name) => !toolsAtSave.has(name) && !savedTools.includes(name))
+    pi.setActiveTools([...savedTools, ...late])
   }
 
   /** Hooks report Claude's permission_mode from this bus state. */
@@ -457,6 +467,7 @@ After completing a step, include a [DONE:n] tag in your response.`,
       // snapshot when plan mode is off would instead push a stale set over whatever
       // pi has registered since, so it stays scoped to this branch.
       savedTools = restored.savedTools ?? pi.getActiveTools()
+      toolsAtSave = registeredTools()
       pi.setActiveTools(PLAN_MODE_TOOLS.filter((t) => savedTools.includes(t)))
       // --plan enters plan mode without ever toggling, so nothing has persisted yet
       // and a /reload would find no snapshot to restore from. Record it now, while

package/extensions/thinking.ts

@@ -91,11 +91,17 @@ export default function thinkingExtension(pi: ExtensionAPI) {
     // the keyword in the prompt.
   })
 
+  // agent_settled never fires when pi is quit mid-run, and the escalation is already in the
+  // transcript: `pi -c` would resume at the raised level for good.
+  pi.on('session_shutdown', async () => {
+    await override.settle()
+  })
+
   pi.on('agent_settled', () => {
     // Restore the pre-escalation level, but only if nothing else moved it since (a
     // command's effort restore, a manual change): the conditional override stands down in
     // that case and restores unconditionally when the level cannot be read, the prior
     // best-effort behavior.
-    override.settle()
+    void override.settle()
   })
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.70",
+  "version": "1.0.72",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",