pi-code 1.0.71 → 1.0.73

package/extensions/claude-rules.ts

@@ -27,7 +27,7 @@ import { publishInstructionLoad } from './internal/instruction-events.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { type CompiledGlob, compileGlobs, matchesCompiledGlobs } from './internal/path-rules.js'
 import { isProjectApproved } from './internal/project-approval.js'
-import { findNearestDir } from './internal/project-root.js'
+import { findNearestDir, sameLocation } from './internal/project-root.js'
 import { stripBlockComments } from './internal/strip-comments.js'
 import { fileToolTarget } from './internal/tool-target.js'
 
@@ -303,7 +303,10 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     globalRules = readRules(globalRulesDir, isExcluded)
     // Nearest at-or-above cwd, so a subdirectory session still reads the rules the
     // approval walk gated on.
-    const projectRulesDir = approved ? findNearestDir(ctx.cwd, path.join('.claude', 'rules')) : null
+    // Not the user's own rules dir: from $HOME (or under a dotfiles repo rooted there)
+    // the nearest one is ~/.claude/rules, which the global load above already read.
+    const nearestRulesDir = approved ? findNearestDir(ctx.cwd, path.join('.claude', 'rules')) : null
+    const projectRulesDir = nearestRulesDir !== null && sameLocation(nearestRulesDir, globalRulesDir) ? null : nearestRulesDir
     projectRules = projectRulesDir ? readRules(projectRulesDir, isExcluded) : EMPTY_RULES
 
     // Global globs are relative to cwd; project globs to the project root (the dir

package/extensions/commands.ts

@@ -52,9 +52,10 @@ import { managedSettingsFile, readManagedSettings } from './internal/managed-set
 import { findModel } from './internal/model-lookup.js'
 import { capForContext } from './internal/output-guard.js'
 import { matchesPathRules } from './internal/path-rules.js'
+import { isPlanModeState, PLAN_MODE_CHANNEL } from './internal/plan-mode-state.js'
 import { type InstalledPlugin, installedPlugins, pluginComponentPath } from './internal/plugins.js'
 import { isProjectApproved } from './internal/project-approval.js'
-import { ancestorDirs, repoRoot } from './internal/project-root.js'
+import { ancestorDirs, checkoutRoot } from './internal/project-root.js'
 import { agentNamesIn, matchesAgentRules, matchesDomainRules, matchesSkillRules } from './internal/scope-rules.js'
 import { claudeSettingsChain } from './internal/settings-chain.js'
 import { fileToolTarget } from './internal/tool-target.js'
@@ -205,7 +206,7 @@ function commandVars(ctx: { cwd: string }, filePath: string, plugin?: CommandPlu
     // low|medium|high|xhigh|max, and an unset one stays literal in the body.
     CLAUDE_EFFORT: claudeEffortLevel(varCtx.thinkingLevel),
     CLAUDE_SKILL_DIR: path.dirname(filePath),
-    CLAUDE_PROJECT_DIR: repoRoot(ctx.cwd) ?? ctx.cwd,
+    CLAUDE_PROJECT_DIR: checkoutRoot(ctx.cwd),
     CLAUDE_PLUGIN_ROOT: plugin?.root,
     CLAUDE_PLUGIN_DATA: plugin?.dataDir,
   }
@@ -227,7 +228,7 @@ interface SpanRunner {
  * from running.
  */
 export async function expandCommand(runner: SpanRunner, parsed: ParsedCommand, args: string, ctx: { cwd: string }, filePath: string, plugin?: CommandPlugin, options?: { allowShell?: boolean }): Promise<string> {
-  const projectRoot = repoRoot(ctx.cwd) ?? ctx.cwd
+  const projectRoot = checkoutRoot(ctx.cwd)
   const vars = commandVars(ctx, filePath, plugin)
   const { text: withArgs, consumed } = substituteArgsDetailed(parsed.body, args, parsed.argumentNames ?? [])
   // `${user_config.KEY}` is a plugin-command variable only; leave it literal in an
@@ -319,6 +320,9 @@ export default function commandsExtension(pi: ExtensionAPI) {
   let projectApproved = false
   /** Tool set to put back once the run a restricted command drove has ended. */
   let pendingRestore: string[] | undefined
+  /** The tools this run's restriction took out of the set. Put back as a delta on whatever is
+   * active by then: overwriting with the snapshot undid every change made meanwhile. */
+  let tookAway = new Set<string>()
   /** `Bash(...)` scopes enforced while that run lasts; lifted with the restriction. */
   let pendingBashRules: string[] | undefined
   /** `WebFetch(domain:...)` scopes enforced the same way. */
@@ -362,17 +366,17 @@ export default function commandsExtension(pi: ExtensionAPI) {
   // agent_settled fires exactly once, after the run has fully settled and no such
   // continuation remains, which is the grant's true clearing point.
   pi.on('agent_settled', async () => {
-    pendingBashRules = undefined
-    pendingDomainRules = undefined
-    pendingAgentRules = undefined
-    pendingSkillRules = undefined
-    pendingPathRules = undefined
     void modelOverride.settle()
     void effortOverride.settle()
-    if (pendingRestore) {
-      pi.setActiveTools(pendingRestore)
-      pendingRestore = undefined
-    }
+    liftToolScope()
+  })
+
+  // "Execute the plan" continues the very run a scoped command started, so the scope it set
+  // for planning would judge every call of the execution and the tools it narrowed away
+  // would stay gone. Leaving plan mode is the point the user approved more than the command
+  // asked for; the model and effort overrides still last until the run settles.
+  pi.events?.on(PLAN_MODE_CHANNEL, (data) => {
+    if (isPlanModeState(data) && !data.active) liftToolScope()
   })
 
   // agent_settled never fires when pi is quit mid-run (double Ctrl+C, Ctrl+D, a closed
@@ -411,7 +415,7 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // pi's read/edit/write accept `file_path` as an alias for `path`; the shared reader
     // handles both, and the paired guard in hooks/matcher.ts reads both too.
     const filePath = fileToolTarget(event) ?? ''
-    const anchors = { cwd: ctx.cwd, projectRoot: repoRoot(ctx.cwd) ?? ctx.cwd, home: os.homedir() }
+    const anchors = { cwd: ctx.cwd, projectRoot: checkoutRoot(ctx.cwd), home: os.homedir() }
     if (filePath && matchesPathRules(filePath, rules, anchors)) return
     return {
       block: true,
@@ -427,6 +431,32 @@ export default function commandsExtension(pi: ExtensionAPI) {
     return original
   }
 
+  /** Record what the restriction just applied took out, against the set captured before it. */
+  function noteTakenAway(): void {
+    if (!pendingRestore) return
+    const active = new Set(pi.getActiveTools())
+    tookAway = new Set(pendingRestore.filter((tool) => !active.has(tool)))
+  }
+
+  /** End the run's tool restriction: drop its scopes and put back what it took away, as a
+   * delta on the set in force. A snapshot overwrite undid whatever else changed the set
+   * meanwhile: plan mode's Execute (the session finished read-only, plan mode off, with edit
+   * and write gone) and a tool registered during the run (dropped until a /reload). */
+  function liftToolScope(): void {
+    pendingBashRules = undefined
+    pendingDomainRules = undefined
+    pendingAgentRules = undefined
+    pendingSkillRules = undefined
+    pendingPathRules = undefined
+    const original = pendingRestore
+    if (!original) return
+    const active = pi.getActiveTools()
+    const keep = new Set([...active, ...tookAway])
+    pi.setActiveTools([...original.filter((tool) => keep.has(tool)), ...active.filter((tool) => !original.includes(tool))])
+    pendingRestore = undefined
+    tookAway = new Set()
+  }
+
   /** Apply a command's allowed-tools to the run it drives: intersect with the tools
    * pi actually has, keep the bash and path scopes for the tool_call guard, and let
    * agent_settled restore the previous set. */
@@ -442,6 +472,7 @@ export default function commandsExtension(pi: ExtensionAPI) {
     // intersects to nothing named only tools pi has none of: that restriction cannot
     // be expressed, and applying it as "no tools" is not what the command asked for.
     if (granted.length > 0 || allowed.length === 0) pi.setActiveTools(granted)
+    noteTakenAway()
     // The latest restricted command speaks for the turn: a later unscoped grant
     // lifts an earlier command's scopes rather than stacking under them. Rules get
     // the same ${CLAUDE_*} substitution as the body, so a rule can name a bundled
@@ -460,6 +491,7 @@ export default function commandsExtension(pi: ExtensionAPI) {
     if (!disallowed || disallowed.length === 0) return
     captureRestorePoint()
     pi.setActiveTools(pi.getActiveTools().filter((tool) => !disallowed.includes(tool)))
+    noteTakenAway()
   }
 
   /** Claude's `model:` frontmatter overrides the model for this run only, then the

package/extensions/context-imports.ts

@@ -76,7 +76,7 @@ import { managedSettingsPath, readManagedSettings } from './internal/managed-set
 import { capForContext, sliceBytes } from './internal/output-guard.js'
 import { globToRegExpSource } from './internal/path-rules.js'
 import { isGatedFileApproved, isProjectApproved, isProjectApprovedSilently } from './internal/project-approval.js'
-import { ancestorFiles, findNearestFile, repoRoot } from './internal/project-root.js'
+import { ancestorFiles, checkoutRoot, findNearestFile, repoRoot, sameLocation } from './internal/project-root.js'
 import { claudeSettingsChain, readSettingsChain } from './internal/settings-chain.js'
 import { statToken } from './internal/stat-token.js'
 import { type Fence, fenceMarker, stepFence, stripBlockComments } from './internal/strip-comments.js'
@@ -293,7 +293,10 @@ export function rootsForImporter(importer: string, home: string, cwd: string, ex
   // granting the importer's own directory. pi also loads home-level context
   // files (~/AGENTS.md) that sit outside the config roots; their directory is
   // $HOME, and allowing it would let @.ssh/... read into every session's prompt.
-  return realRoots([cwd, repoRoot(cwd) ?? cwd])
+  // The checkout the session runs in, and the main checkout too: in a worktree they are
+  // siblings, and the checkout's own files (docs/, a sibling CLAUDE.md) are as much the
+  // project as the shared root a CLAUDE.local.md may live at.
+  return realRoots([cwd, checkoutRoot(cwd), repoRoot(cwd) ?? cwd])
 }
 
 /** Claude's env gate for loading memory files from --add-dir directories. */
@@ -972,7 +975,11 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     // ./.claude/CLAUDE.md (nearest at or above cwd) is repo-controlled too, so both
     // ride the one approval decision.
     const candidates = ancestorFiles(ctx.cwd, 'CLAUDE.local.md')
-    const dotClaudeMd = findNearestFile(ctx.cwd, path.join('.claude', 'CLAUDE.md'))
+    const nearestDotClaudeMd = findNearestFile(ctx.cwd, path.join('.claude', 'CLAUDE.md'))
+    // From $HOME (or under a dotfiles repo rooted there) the nearest one is the user's own
+    // ~/.claude/CLAUDE.md, already loaded above as User memory: not a project file, so no
+    // second block and nothing to approve.
+    const dotClaudeMd = nearestDotClaudeMd !== null && sameLocation(nearestDotClaudeMd, userClaudeMd) ? null : nearestDotClaudeMd
     if ((candidates.length === 0 && dotClaudeMd === null) || !(await isProjectApproved(ctx))) return memory
 
     for (const candidate of candidates) {
@@ -1029,7 +1036,7 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
 
     if (envCache?.cwd !== cwd) {
       const managedNow = readManagedSettings()
-      envCache = { cwd, managed: managedNow, excludeGlobs: readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managedNow), projectRoot: repoRoot(cwd) ?? cwd }
+      envCache = { cwd, managed: managedNow, excludeGlobs: readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managedNow), projectRoot: checkoutRoot(cwd) }
     }
     const { managed, excludeGlobs, projectRoot } = envCache
     // CLAUDE_CODE_DISABLE_CLAUDE_MDS also covers pi's own auto-discovered native context
@@ -1136,7 +1143,7 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     if (touchedDir === undefined) return
 
     const home = os.homedir()
-    const projectRoot = repoRoot(ctx.cwd) ?? ctx.cwd
+    const projectRoot = checkoutRoot(ctx.cwd)
     const excludeGlobs = readClaudeMdExcludes(claudeMdExcludeFiles(ctx.cwd, home, projectApproved), readManagedSettings())
     const load: NestedLoadContext = { home, cwd: ctx.cwd, realCwd, projectRoot, excludeGlobs, touched, launchLoaded: launchLoadedPaths }
     const { bodies, events } = nestedContextAttachments(touchedDir, load, nestedLoaded, gatedFilesApproved)

package/extensions/hooks/index.ts

@@ -104,7 +104,7 @@ import { resolveModelOverride } from '../internal/model-lookup.js'
 import { isPlanModeState, PLAN_MODE_CHANNEL } from '../internal/plan-mode-state.js'
 import { installedPlugins, managedForceEnabled } from '../internal/plugins.js'
 import { approvalRecheck, isProjectApproved } from '../internal/project-approval.js'
-import { repoRoot } from '../internal/project-root.js'
+import { checkoutRoot } from '../internal/project-root.js'
 import { watchSettingsFiles } from '../internal/settings-watch.js'
 import { isSkillHooksEvent, SKILL_HOOKS_CHANNEL } from '../internal/skill-hooks.js'
 import { isSubagentPhaseEvent, SUBAGENT_CHANNEL } from '../internal/subagent-events.js'
@@ -457,7 +457,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
     // Claude's CLAUDE_PROJECT_DIR is the project root, not the session cwd; a hook
     // referencing $CLAUDE_PROJECT_DIR/.claude/hooks/helper.sh must resolve from a
     // subdirectory session too.
-    projectDir = repoRoot(ctx.cwd) ?? ctx.cwd
+    projectDir = checkoutRoot(ctx.cwd)
     resolveConfig(ctx.cwd, trusted)
     // Claude picks up direct settings edits mid-session via a file watcher. The reload
     // closes over the cwd value, never ctx: the poll has no awaiter, and every getter of

package/extensions/init.ts

@@ -23,7 +23,7 @@ export { CONTEXT_FILE_CANDIDATES }
 
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
-import { repoRoot } from './internal/project-root.js'
+import { checkoutRoot } from './internal/project-root.js'
 
 function statOf(target: string): fs.Stats | undefined {
   try {
@@ -73,7 +73,7 @@ export default function initExtension(pi: ExtensionAPI) {
   pi.registerCommand('init', {
     description: 'Analyze the codebase and create or improve the project context file (AGENTS.md)',
     handler: async (_args, ctx) => {
-      const root = repoRoot(ctx.cwd) ?? ctx.cwd
+      const root = checkoutRoot(ctx.cwd)
       const existing = findExistingContextFile(root)
       const cursorRules = statOf(path.join(root, '.cursor', 'rules'))?.isDirectory() === true || statOf(path.join(root, '.cursorrules'))?.isFile() === true
       const copilotRules = statOf(path.join(root, '.github', 'copilot-instructions.md'))?.isFile() === true

package/extensions/internal/project-root.ts

@@ -29,6 +29,29 @@ export function repoRoot(from: string): string | undefined {
   return mainCheckout(root)
 }
 
+/** The root of the checkout a session runs in, or `from` itself outside one. Claude's
+ * `CLAUDE_PROJECT_DIR` is "the project root where the session started", and `/`-rooted path
+ * rules anchor there. In a worktree that is the worktree, not the main checkout repoRoot
+ * resolves to: right for shared state (settings.local.json, auto memory), wrong here, where
+ * a hook script or a rule anchor must land in the tree the session is editing. */
+export function checkoutRoot(from: string): string {
+  return gitRoot(from) ?? from
+}
+
+/** Whether two paths are the same file or directory once symlinks resolve. A session at
+ * `$HOME` finds the user's own `~/.claude/{rules,agents,CLAUDE.md}` as its "project" ones;
+ * comparing by realpath also catches a stow-style symlinked `~/.claude`. */
+export function sameLocation(a: string, b: string): boolean {
+  const resolve = (target: string): string => {
+    try {
+      return fs.realpathSync(target)
+    } catch {
+      return path.resolve(target)
+    }
+  }
+  return resolve(a) === resolve(b)
+}
+
 /** The git checkout at or above `from`, or undefined outside one.
  *
  * Narrower than repoRoot on purpose: repoRoot resolves a worktree to its main checkout,

package/extensions/mcp/index.ts

@@ -42,7 +42,7 @@ import { setMcpToolCaller } from '../internal/mcp-call.js'
 import { capForContext } from '../internal/output-guard.js'
 import { installedPlugins } from '../internal/plugins.js'
 import { isProjectApproved, isProjectApprovedSilently } from '../internal/project-approval.js'
-import { repoRoot } from '../internal/project-root.js'
+import { checkoutRoot } from '../internal/project-root.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
 import { errorMessage } from '../internal/values.js'
 import { disabledServerNames, loadConfigFrom, loadPluginServers, loadUserScope, localScopeServerNames, projectConfigPaths, type ServerConfig, warnOnTypelessUrl } from './config.js'
@@ -539,7 +539,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // Plugin servers merge under the user scope (plugins are user-installed);
     // the user's own entry wins a name clash with a plugin's. A server toggled off
     // in ~/.claude.json's per-project disabledMcpServers list never connects.
-    const pluginServers = loadPluginServers(installedPlugins(os.homedir()), repoRoot(ctx.cwd) ?? ctx.cwd)
+    const pluginServers = loadPluginServers(installedPlugins(os.homedir()), checkoutRoot(ctx.cwd))
     const disabled = disabledServerNames(os.homedir(), ctx.cwd)
     const merged = Object.fromEntries(Object.entries({ ...pluginServers, ...loadUserScope(os.homedir(), ctx.cwd) }).filter(([name]) => !disabled.has(name)))
     const scoped = applyServerPolicy(merged, policy)
@@ -622,7 +622,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     projectConnected = false
     // Claude answers roots/list with the session's launch directory and exports the
     // project root as CLAUDE_PROJECT_DIR to stdio servers; both derive from ctx.cwd.
-    sessionDirs = { projectDir: repoRoot(ctx.cwd) ?? ctx.cwd, launchDir: ctx.cwd, sessionId: ctx.sessionManager?.getSessionId?.() }
+    sessionDirs = { projectDir: checkoutRoot(ctx.cwd), launchDir: ctx.cwd, sessionId: ctx.sessionManager?.getSessionId?.() }
     const authUi = authUiFor(ctx)
     sessionAuthUi = authUi
     // The allow/deny lists filter every scope, including a managed-mcp.json set. They

package/extensions/plan-mode/index.ts

@@ -64,18 +64,28 @@ export default function planModeExtension(pi: ExtensionAPI): void {
   let todoItems: TodoItem[] = []
   let planFromTool = false
   let savedTools: string[] = []
+  /** Every tool pi had registered when the set was saved, active or not: a tool outside it
+   * was registered later, and pi activated it on top of whatever set was in force. */
+  let toolsAtSave = new Set<string>()
   let stalledRuns = 0
   let runProgress = false
 
+  const registeredTools = (): Set<string> => new Set((pi.getAllTools?.() ?? []).map((tool) => tool.name))
+
   function enterPlanTools(): void {
     savedTools = pi.getActiveTools()
+    toolsAtSave = registeredTools()
     pi.setActiveTools(PLAN_MODE_TOOLS.filter((t) => savedTools.includes(t)))
   }
 
+  /** Put back the saved set, plus any tool registered since: pi activates a late one (an MCP
+   * server past its connect window) on top of the restricted set, and overwriting with the
+   * snapshot dropped it for the rest of the session. A tool that was registered but not
+   * active at entry is not late, and stays out. */
   function restoreTools(): void {
-    if (savedTools.length > 0) {
-      pi.setActiveTools(savedTools)
-    }
+    if (savedTools.length === 0) return
+    const late = pi.getActiveTools().filter((name) => !toolsAtSave.has(name) && !savedTools.includes(name))
+    pi.setActiveTools([...savedTools, ...late])
   }
 
   /** Hooks report Claude's permission_mode from this bus state. */
@@ -457,6 +467,7 @@ After completing a step, include a [DONE:n] tag in your response.`,
       // snapshot when plan mode is off would instead push a stale set over whatever
       // pi has registered since, so it stays scoped to this branch.
       savedTools = restored.savedTools ?? pi.getActiveTools()
+      toolsAtSave = registeredTools()
       pi.setActiveTools(PLAN_MODE_TOOLS.filter((t) => savedTools.includes(t)))
       // --plan enters plan mode without ever toggling, so nothing has persisted yet
       // and a /reload would find no snapshot to restore from. Record it now, while

package/extensions/status-line.ts

@@ -36,7 +36,7 @@ import { claudeEffortLevel } from './internal/effort.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { isPlanModeState, PLAN_MODE_CHANNEL } from './internal/plan-mode-state.js'
 import { approvalRecheck, isProjectApprovedSilently } from './internal/project-approval.js'
-import { gitRoot, repoRoot } from './internal/project-root.js'
+import { checkoutRoot, gitRoot } from './internal/project-root.js'
 import { readSettingsChain } from './internal/settings-chain.js'
 import { watchSettingsFiles } from './internal/settings-watch.js'
 import { readActiveStyleName, settingsFiles } from './output-styles.js'
@@ -283,7 +283,7 @@ export default function statusLine(pi: ExtensionAPI) {
       // directory. added_dirs comes from the --add-dir flag pi-code registers.
       workspace: {
         current_dir: ctx.cwd,
-        project_dir: repoRoot(ctx.cwd) ?? ctx.cwd,
+        project_dir: checkoutRoot(ctx.cwd),
         git_worktree: isGitWorktree(ctx.cwd),
         added_dirs: addedDirs(),
       },

package/extensions/subagent/agents.ts

@@ -14,7 +14,7 @@ import { claudeConfigDir } from '../internal/config-dir.js'
 import { parseClaudeFrontmatter } from '../internal/frontmatter.js'
 import { findModel } from '../internal/model-lookup.js'
 import { installedPlugins, pluginComponentPath } from '../internal/plugins.js'
-import { ancestorDirs, findNearestDir } from '../internal/project-root.js'
+import { ancestorDirs, findNearestDir, sameLocation } from '../internal/project-root.js'
 import { errorMessage } from '../internal/values.js'
 
 /**
@@ -371,7 +371,12 @@ export function discoverAgents(cwd: string, scope: AgentScope): AgentDiscoveryRe
   // Claude scans every .claude/agents between cwd and the repository root, the
   // definition closest to cwd winning a name clash; root-first load order makes
   // the nearer directory's entry overwrite in the map below.
-  const projectClaudeDirs = ancestorDirs(cwd, path.join('.claude', 'agents')).reverse()
+  // The user's own directory is not a project one: at $HOME, or under a dotfiles repo
+  // rooted there, the walk reaches ~/.claude/agents and would gate the user's agents as
+  // repo-controlled.
+  const projectClaudeDirs = ancestorDirs(cwd, path.join('.claude', 'agents'))
+    .filter((dir) => !sameLocation(dir, claudeUserDir))
+    .reverse()
 
   // Plugins load after builtins and before the user's own dirs, so a user agent
   // wins a name clash with a plugin's, and ~/.pi/agent/agents wins over ~/.claude.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.71",
+  "version": "1.0.73",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",