pi-code 1.0.73 → 1.0.75

package/extensions/claude-rules.ts

@@ -289,6 +289,9 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
   // Scoped rules still awaiting a matching touch. An attached rule leaves the
   // list, so each attaches at most once and the per-tool-result scan shrinks.
   let attachTargets: AttachTarget[] = []
+  // Every scoped rule of the session, the list attachTargets is rebuilt from when what was
+  // attached leaves the context (see rearm below).
+  let scopedTargets: AttachTarget[] = []
 
   pi.on('session_start', async (_event, ctx) => {
     // Project rules are repository text landing in the system prompt, so they load
@@ -318,6 +321,7 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
       ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(ctx.cwd), file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
       ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: realpathOr(projectRoot), file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
     ]
+    scopedTargets = attachTargets
     pendingScopedRules = attachTargets.length
     // Relative to cwd, which the read tool resolves: an ancestor dir yields a
     // `../…/.claude/rules` the model can follow, where a bare '.claude/rules'
@@ -340,6 +344,16 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     return { systemPrompt: event.systemPrompt + addition }
   })
 
+  // A rule's body sits in the tool result that attached it. Compaction folds that result into
+  // a summary and /tree moves to a branch that never had it, and Claude reloads the rule "as
+  // Claude reads files they apply to", so every rule is armed again.
+  const rearm = (): void => {
+    attachTargets = scopedTargets
+    pendingScopedRules = attachTargets.length
+  }
+  pi.on('session_compact', rearm)
+  pi.on('session_tree', rearm)
+
   // Lazy attach: when a file tool touches a path a scoped rule covers, append the
   // rule body to that tool's result so it enters context, once per rule per session.
   // This mirrors Claude Code, which attaches a scoped rule when a matching file is

package/extensions/context-imports.ts

@@ -145,12 +145,15 @@ export interface ImportBudget {
   files: number
   bytes: number
   dropped: number
-  /** Existing files an @import named that resolve outside the importer's allowed
-   * roots. Collected so the refusal can be reported rather than left silent. */
+  /** Every @import target that resolves outside the importer's allowed roots, whether or not
+   * it exists: the notice to the model must not reveal which of a repo's guesses do. */
   refused: Set<string>
+  /** The subset of `refused` that is an existing file, which is what an approval would
+   * load and so what the user's dialog is about. */
+  refusedPresent: Set<string>
 }
 
-export const createImportBudget = (): ImportBudget => ({ files: MAX_IMPORT_FILES, bytes: MAX_IMPORT_BYTES, dropped: 0, refused: new Set() })
+export const createImportBudget = (): ImportBudget => ({ files: MAX_IMPORT_FILES, bytes: MAX_IMPORT_BYTES, dropped: 0, refused: new Set(), refusedPresent: new Set() })
 
 /** The `@path` targets of a context file, in document order. Claude Code evaluates
  * imports neither in fenced code blocks (backtick or tilde) nor in inline spans. */
@@ -171,16 +174,25 @@ function importTargets(content: string): string[] {
   return targets
 }
 
+function isRegularFile(target: string): boolean {
+  try {
+    return fs.statSync(target).isFile()
+  } catch {
+    return false
+  }
+}
+
 /** Read one `@path` target, or null when it is unresolvable, already seen, outside `allowedRoots`, excluded, or unreadable. */
-function readImport(target: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>, isExcluded: ((realPath: string) => boolean) | undefined, refused: Set<string>): { real: string; body: string } | null {
+function readImport(target: string, fromDir: string, home: string, allowedRoots: string[], seen: Set<string>, isExcluded: ((realPath: string) => boolean) | undefined, refusals: Pick<ImportBudget, 'refused' | 'refusedPresent'>): { real: string; body: string } | null {
   const resolved = path.resolve(fromDir, expandHome(target, home))
   // Always the path the importing file named, never where a symlink pointed: the
   // notice would otherwise hand a repo the real name of whatever the link reaches,
   // which is the disclosure the refusal exists to prevent. An excluded file is not
   // named either, since exclusion removes it from every other surface too.
-  const refuse = (): null => {
-    if (isExcluded?.(resolved) !== true) refused.add(resolved)
-    return null
+  const refuse = (isFile: boolean): void => {
+    if (isExcluded?.(resolved) === true) return
+    refusals.refused.add(resolved)
+    if (isFile) refusals.refusedPresent.add(resolved)
   }
   let real: string
   try {
@@ -190,10 +202,14 @@ function readImport(target: string, fromDir: string, home: string, allowedRoots:
     // reported never depends on whether it exists: a notice that named only the
     // existing ones would enumerate the filesystem for any repo-controlled file
     // willing to write one @line per guess.
-    return isUnder(resolved, allowedRoots) ? null : refuse()
+    if (!isUnder(resolved, allowedRoots)) refuse(false)
+    return null
   }
   if (seen.has(real)) return null
-  if (!isUnder(real, allowedRoots)) return refuse()
+  if (!isUnder(real, allowedRoots)) {
+    refuse(isRegularFile(real))
+    return null
+  }
   // Checked before the read so an excluded file contributes nothing: no body, no
   // transitive imports, no budget spend, no announce. A post-collection filter
   // would drop the file itself but keep its children.
@@ -206,7 +222,8 @@ function readImport(target: string, fromDir: string, home: string, allowedRoots:
     seen.add(real)
     // A file another importer already refused is in context after all; the notice
     // must not claim otherwise.
-    refused.delete(resolved)
+    refusals.refused.delete(resolved)
+    refusals.refusedPresent.delete(resolved)
     return { real, body }
   } catch {
     return null
@@ -243,7 +260,7 @@ function collectFrom(scan: ImportScan, content: string, fromDir: string, depth:
       scan.budget.dropped += 1
       continue
     }
-    const file = readImport(target, fromDir, scan.home, scan.allowedRoots, scan.seen, scan.isExcluded, scan.budget.refused)
+    const file = readImport(target, fromDir, scan.home, scan.allowedRoots, scan.seen, scan.isExcluded, scan.budget)
     if (!file) continue
     scan.budget.files -= 1
     // The budget is bytes: a string slice counts UTF-16 units and lets CJK text through
@@ -272,16 +289,21 @@ export function collectImports(content: string, fromDir: string, home: string, a
 /**
  * Roots an importing file may pull from.
  *
- * A context file under the user's own config may reach the whole config; a project
- * file may not. `~/.claude` holds `.credentials.json`, global settings and every
- * project's transcripts, so granting those roots to a cloned repo's `CLAUDE.md`
- * would let it read them into the system prompt.
+ * A file under the user's own config may import from anywhere: Claude's user-scope memory
+ * files "are files you wrote yourself", and it loads their imports without the dialog and
+ * trusts them like the rest of the user's configuration. A project file may not, so a cloned
+ * repo's `CLAUDE.md` cannot read `~/.claude` (`.credentials.json`, global settings, every
+ * project's transcripts) into the system prompt.
+ *
+ * "Under the user's config" is judged by the path pi reported as well as its realpath: a
+ * dotfiles manager such as GNU stow links `~/.claude/CLAUDE.md` to a repository, so the
+ * real path is outside `~/.claude` although the user put the link there.
  */
 export function rootsForImporter(importer: string, home: string, cwd: string, externalApproved = false): string[] {
-  const userRoots = realRoots([claudeConfigDir(home), path.join(home, '.pi')])
+  const userConfig = [claudeConfigDir(home), path.join(home, '.pi')]
   const [real] = realRoots([importer])
-  const fromUserConfig = real !== undefined && isUnder(real, userRoots)
-  if (fromUserConfig) return realRoots([cwd, ...userRoots])
+  const fromUserConfig = isUnder(path.resolve(importer), userConfig) || (real !== undefined && isUnder(real, realRoots(userConfig)))
+  if (fromUserConfig) return [ANY_ROOT]
   // The project was asked about its external imports and allowed them, so a project
   // file may reach outside, as Claude's dialog grants. The widening is deliberately
   // only for project files: a user-scope file's roots are its own config, and an
@@ -552,7 +574,9 @@ export const EXTERNAL_IMPORT_PROMPT_TITLE = 'Load imports from outside this proj
  *
  * The list is the refusals the enforcing path produced, not a second enumeration of
  * what it might refuse: same files, same depth, same resolution, same exclusions. That
- * is the only way the dialog can promise it names everything the approval lets in.
+ * is the only way the dialog can promise it names everything the approval lets in. Only
+ * files that exist are listed, as in Claude, which asks about the external files it read:
+ * a prose `@/components/ui` names nothing an approval could load.
  */
 async function askExternalImports(ctx: ExtensionContext, root: string, refused: ReadonlySet<string>): Promise<boolean> {
   const listed = [...refused]
@@ -853,8 +877,15 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
   // @import cannot pay for a body that is already there.
   let launchLoadedPaths: string[] = []
   // Nested CLAUDE.md/CLAUDE.local.md files already attached this session, so a second
-  // read in the same subtree does not repeat them.
+  // read in the same subtree does not repeat them. Emptied when compaction or /tree takes
+  // the tool results that carried them out of context: Claude reloads them "as Claude
+  // reads files they apply to".
   const nestedLoaded = new Set<string>()
+  const forgetNested = (): void => {
+    nestedLoaded.clear()
+  }
+  pi.on('session_compact', forgetNested)
+  pi.on('session_tree', forgetNested)
   // Instruction loads already announced on the shared bus, keyed reason:path.
   // before_agent_start fires every turn, so without this a configured
   // InstructionsLoaded hook would fire once per file per turn.
@@ -1023,8 +1054,8 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const key = externalImportKey(cwd)
     const decided = externalImportDecision(key)
     const result = expandWith(decided === true)
-    if (decided !== null || result.budget.refused.size === 0 || ctx?.hasUI !== true) return result
-    const approved = await askExternalImports(ctx, key, result.budget.refused)
+    if (decided !== null || result.budget.refusedPresent.size === 0 || ctx?.hasUI !== true) return result
+    const approved = await askExternalImports(ctx, key, result.budget.refusedPresent)
     rememberExternalImportDecision(key, approved)
     return approved ? expandWith(true) : result
   }

package/extensions/internal/mcp-oauth.ts

@@ -188,6 +188,19 @@ export class FileOAuthProvider implements OAuthClientProvider {
     return this.data.tokens !== undefined
   }
 
+  /** Called by the SDK when the server rejects what is stored: `invalid_grant` for an expired
+   * or revoked refresh token, `invalid_client` for a forgotten registration. It restarts
+   * authorization once this returns, which reaches the login prompt. Without it the
+   * rejection propagated and the dead credentials stayed on disk, so the server failed the
+   * same way on every connect. Discovery state is not stored, and the redirect port is kept
+   * so a re-login can still bind the port the client was registered with. */
+  invalidateCredentials(scope: 'all' | 'client' | 'tokens' | 'verifier' | 'discovery'): void {
+    if (scope === 'all' || scope === 'client') delete this.data.client
+    if (scope === 'all' || scope === 'tokens') delete this.data.tokens
+    if (scope === 'all' || scope === 'verifier') delete this.data.verifier
+    this.persist()
+  }
+
   /** The CSRF token the SDK adds to the authorization URL as `state`; waitForAuthCode
    * verifies the redirect echoes exactly this value. */
   state(): string {

package/extensions/internal/plugins.ts

@@ -6,8 +6,10 @@
  * active only when `enabledPlugins` in the settings chain says true, under the
  * bare name or the marketplace-qualified `name@marketplace`. Only an explicit
  * true enables: Claude writes the entry on install, so a cached plugin with no
- * entry is not one the user turned on. With no version index on disk, the
- * newest version directory wins, matching the update-then-grace-period layout.
+ * entry is not one the user turned on. The version that loads is the one Claude's
+ * installed_plugins.json records; without a usable record, the newest directory
+ * not marked `.orphaned_at`, since an update leaves the old version in the cache
+ * for a grace period and some directories are named by commit sha.
  * The persistent data directory (${CLAUDE_PLUGIN_DATA}) survives updates at
  * ~/.claude/plugins/data/<id>, id being the qualified name folded to dashes.
  */
@@ -59,6 +61,12 @@ function listDirs(dir: string): string[] {
   }
 }
 
+/** The plugin directories of a marketplace. A dot-directory is never one: Claude clones a
+ * marketplace into `temp_git_*` first, and its `.git` was loaded as a plugin. */
+function listPluginDirs(marketplaceDir: string): string[] {
+  return listDirs(marketplaceDir).filter((name) => !name.startsWith('.'))
+}
+
 /** One version string split for comparison: optional v prefix dropped, numeric
  * base segments, and whatever follows a dash as the prerelease tag. */
 function parseVersion(version: string): { base: number[]; pre: string | undefined } {
@@ -88,6 +96,39 @@ function newestVersion(versions: string[]): string | undefined {
   return [...versions].sort(compareVersions).at(-1)
 }
 
+/** Claude's record of what is installed, `plugins/installed_plugins.json`: per plugin id a
+ * list of installs (an object in the older layout), each with its scope and `installPath`.
+ * Maps each id to its recorded directories, user scope first: enablement here is the
+ * user's own, and a project or local install is another project's copy. Undefined when the
+ * file is absent or unusable, which leaves the directory walk to decide. */
+function readInstallIndex(home: string): Map<string, string[]> | undefined {
+  const file = path.join(claudeConfigDir(home), 'plugins', 'installed_plugins.json')
+  const plugins = readJson(file).plugins
+  if (plugins === null || typeof plugins !== 'object') return undefined
+  const installs = new Map<string, string[]>()
+  for (const [id, entry] of Object.entries(plugins)) {
+    const recorded = (Array.isArray(entry) ? entry : [entry]).filter((one): one is { scope?: unknown; installPath: string } => typeof one?.installPath === 'string')
+    recorded.sort((a, b) => Number(b.scope === 'user') - Number(a.scope === 'user'))
+    installs.set(
+      id,
+      recorded.map((one) => one.installPath),
+    )
+  }
+  return installs
+}
+
+/** The version directory of one cached plugin that loads: a recorded install that still
+ * exists and sits directly under the plugin's cache directory (the record is a file, and a
+ * path into another plugin's tree would load that plugin's code under this one's name),
+ * else the newest version not marked orphaned. */
+function versionDir(pluginPath: string, recorded: string[] | undefined): string | undefined {
+  const installed = recorded?.find((dir) => path.dirname(path.resolve(dir)) === pluginPath && listDirs(pluginPath).includes(path.basename(dir)))
+  if (installed) return installed
+  const live = listDirs(pluginPath).filter((version) => !fs.existsSync(path.join(pluginPath, version, '.orphaned_at')))
+  const newest = newestVersion(live)
+  return newest === undefined ? undefined : path.join(pluginPath, newest)
+}
+
 /** The enablement map, later files winning per key, as settings scopes merge. */
 function enabledMap(settingsFiles: string[]): Record<string, boolean> {
   const merged: Record<string, boolean> = {}
@@ -159,26 +200,26 @@ function contentToken(target: string): string {
 /**
  * A cheap change signature for one home's plugin config: the settings files'
  * content hashes plus the cache tree's directory names and mtimes down through each plugin's
- * version directories, and the stat token of the resolved (newest) version's manifest
+ * version directories, and the stat token of the resolved version's manifest (which moves when Claude's install record selects another)
  * so an in-place edit of it invalidates the cache. Costs a few stats where the full
  * walk reads and parses the settings and every manifest.
  */
-function pluginFingerprint(cacheDir: string, settingsFiles: string[]): string {
+function pluginFingerprint(cacheDir: string, settingsFiles: string[], index: Map<string, string[]> | undefined): string {
   const parts = settingsFiles.map(contentToken)
   for (const marketplace of listDirs(cacheDir)) {
     const marketplaceDir = path.join(cacheDir, marketplace)
     parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
-    for (const pluginDir of listDirs(marketplaceDir)) {
+    for (const pluginDir of listPluginDirs(marketplaceDir)) {
       const pluginPath = path.join(marketplaceDir, pluginDir)
       parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
       const versions = listDirs(pluginPath)
       for (const version of versions) {
         parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
       }
-      // resolvePlugin reads only the newest version's manifest, so its stat token is
+      // resolvePlugin reads only the resolved version's manifest, so its stat token is
       // what an in-place edit (no directory entry changing) must move.
-      const newest = newestVersion(versions)
-      if (newest) parts.push(`${marketplace}/${pluginDir}/${newest}/manifest:${statToken(path.join(pluginPath, newest, '.claude-plugin', 'plugin.json'))}`)
+      const resolved = versionDir(pluginPath, index?.get(`${pluginDir}@${marketplace}`))
+      if (resolved) parts.push(`${marketplace}/${pluginDir}/${path.basename(resolved)}/manifest:${statToken(path.join(resolved, '.claude-plugin', 'plugin.json'))}`)
     }
   }
   return parts.join('\n')
@@ -199,15 +240,16 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
   const cacheDir = path.join(claudeConfigDir(home), 'plugins', 'cache')
   const settingsFiles = [path.join(claudeConfigDir(home), 'settings.json'), ...extraSettingsFiles]
   const key = [home, ...extraSettingsFiles].join('\n')
-  const fingerprint = pluginFingerprint(cacheDir, settingsFiles)
+  const index = readInstallIndex(home)
+  const fingerprint = pluginFingerprint(cacheDir, settingsFiles, index)
   const cached = pluginCache.get(key)
   if (cached?.fingerprint === fingerprint) return cached.plugins
   const enabled = enabledMap(settingsFiles)
   const configs = pluginConfigsMap(settingsFiles)
   const plugins: InstalledPlugin[] = []
   for (const marketplace of listDirs(cacheDir)) {
-    for (const pluginDir of listDirs(path.join(cacheDir, marketplace))) {
-      const plugin = resolvePlugin(home, cacheDir, marketplace, pluginDir, enabled, configs)
+    for (const pluginDir of listPluginDirs(path.join(cacheDir, marketplace))) {
+      const plugin = resolvePlugin(home, cacheDir, marketplace, pluginDir, enabled, configs, index)
       if (plugin) plugins.push(plugin)
     }
   }
@@ -243,11 +285,10 @@ function pluginEnabled(qualified: string, pluginDir: string, enabled: Record<str
 
 /** Resolve one cached plugin directory into an enabled InstalledPlugin, or null to skip
  * it: turned off by managed/user settings or defaultEnabled, or no version yet. */
-function resolvePlugin(home: string, cacheDir: string, marketplace: string, pluginDir: string, enabled: Record<string, boolean>, configs: Record<string, Record<string, string>>): InstalledPlugin | null {
+function resolvePlugin(home: string, cacheDir: string, marketplace: string, pluginDir: string, enabled: Record<string, boolean>, configs: Record<string, Record<string, string>>, installs: Map<string, string[]> | undefined): InstalledPlugin | null {
   const qualified = `${pluginDir}@${marketplace}`
-  const version = newestVersion(listDirs(path.join(cacheDir, marketplace, pluginDir)))
-  if (!version) return null
-  const root = path.join(cacheDir, marketplace, pluginDir, version)
+  const root = versionDir(path.join(cacheDir, marketplace, pluginDir), installs?.get(qualified))
+  if (!root) return null
   const manifest = readJson(path.join(root, '.claude-plugin', 'plugin.json'))
   if (!pluginEnabled(qualified, pluginDir, enabled, manifest)) return null
   const name = typeof manifest.name === 'string' && manifest.name.length > 0 ? manifest.name : pluginDir

package/extensions/mcp/index.ts

@@ -49,7 +49,7 @@ import { disabledServerNames, loadConfigFrom, loadPluginServers, loadUserScope,
 import { collectServerResourceEntries, listAllPrompts, listAllTools, type McpToolInfo, resourceServerFilter } from './listing.js'
 import { formatPromptCommandName, formatToolName, type McpContentBlock, type McpPromptInfo, mapContent, mapPromptArguments, normalizeSchema, promptMessageContent } from './mapping.js'
 import { applyServerPolicy, loadManagedMcpServers, type McpPolicy, mcpAllowDeny, projectServerPolicy, splitByPolicy } from './policy.js'
-import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isUnauthorized, mcpConnectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
+import { type AuthUi, callRequestOptions, callTimeoutMs, connect, connectTimeoutMs, connectWithRetries, isConnectionLost, isUnauthorized, mcpConnectTimeoutMs, type ServerCallTuning, type SessionDirs, serverCallTuning, withTimeout } from './transport.js'
 
 export { managedSettingsPath, setManagedSettingsPath } from '../internal/managed-settings.js'
 // Re-exports for consumers: the module split keeps the extension's public surface
@@ -189,6 +189,19 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     return count
   }
 
+  /** A client that is gone: flip the status and free the name so a reconnect can take it.
+   * Claude reconnects a dropped remote server with exponential backoff; stdio servers are
+   * local processes and are not reconnected. Shutdown closes clients while they are still
+   * in the map, so the flag guards against scheduling a reconnect for a deliberate
+   * teardown. Called by the transport's onclose and by a call that found the connection
+   * dead (isConnectionLost), so several calls failing together schedule one reconnect. */
+  function dropClient(name: string, client: Client, config: ServerConfig): void {
+    if (clients.get(name) !== client) return
+    clients.delete(name)
+    status.set(name, { state: 'disconnected', tools: 0 })
+    if (!shuttingDown && !serverCallTuning(config).stdio) void reconnectWithBackoff(name, config)
+  }
+
   /** Claude's mid-session reconnect for a dropped remote server: five attempts with
    * a delay doubling from one second. connectServers redoes the full bring-up
    * (tools, prompts, subscriptions, a fresh onclose) and its duplicate guard skips
@@ -205,17 +218,27 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     }
   }
 
+  // One auth recovery per server at a time, shared by every call that met the same 401.
+  const authReconnects = new Map<string, Promise<void>>()
+
   /** Claude's 401/403 tool-call recovery: drop the client and reconnect once, so the
    * headersHelper re-runs (fresh credential) or the OAuth tokens refresh, then the
    * caller retries the call once. The map delete precedes the close so the onclose
-   * guard does not also schedule a backoff reconnect. */
-  async function reconnectForAuth(name: string, config: ServerConfig): Promise<void> {
-    const old = clients.get(name)
-    if (old) {
+   * guard does not also schedule a backoff reconnect. Parallel calls that all met the
+   * expired credential share the one reconnect: `failed` is the client a call was made
+   * on, and a map holding another one means a sibling already replaced it, so closing
+   * "the client in the map" would tear down the fresh connection under that sibling. */
+  function reconnectForAuth(name: string, config: ServerConfig, failed: Client | undefined): Promise<void> {
+    const inFlight = authReconnects.get(name)
+    if (inFlight !== undefined) return inFlight
+    if (clients.get(name) !== failed) return Promise.resolve()
+    const recovery = (async () => {
       clients.delete(name)
-      await withTimeout(old.close(), 3000, 'close').catch(() => {})
-    }
-    await connectServers({ [name]: config }, sessionAuthUi, true)
+      if (failed) await withTimeout(failed.close(), 3000, 'close').catch(() => {})
+      await connectServers({ [name]: config }, sessionAuthUi, true)
+    })().finally(() => authReconnects.delete(name))
+    authReconnects.set(name, recovery)
+    return recovery
   }
 
   /** A tool call with the auth retry: on a 401/403 rejection, reconnect once and
@@ -223,16 +246,26 @@ export default async function mcpExtension(pi: ExtensionAPI) {
   async function callToolWithAuthRetry(name: string, config: ServerConfig, args: { name: string; arguments: Record<string, unknown> }, label: string): Promise<Awaited<ReturnType<Client['callTool']>>> {
     const tuning = serverCallTuning(config)
     const wall = tuning.serverTimeoutMs ?? callTimeoutMs()
+    let used: Client | undefined
     const callOnce = async () => {
       const current = clients.get(name)
       if (!current) throw new Error(`MCP server "${name}" is not connected`)
-      return await withTimeout(current.callTool(args, undefined, callRequestOptions(wall, tuning)), wall, label)
+      used = current
+      try {
+        return await withTimeout(current.callTool(args, undefined, callRequestOptions(wall, tuning)), wall, label)
+      } catch (error) {
+        if (isConnectionLost(error)) {
+          dropClient(name, current, config)
+          void withTimeout(current.close(), 3000, 'close').catch(() => {})
+        }
+        throw error
+      }
     }
     try {
       return await callOnce()
     } catch (error) {
       if (!isUnauthorized(error)) throw error
-      await reconnectForAuth(name, config)
+      await reconnectForAuth(name, config, used)
       return await callOnce()
     }
   }
@@ -463,16 +496,7 @@ export default async function mcpExtension(pi: ExtensionAPI) {
           // A server that dies mid-session would otherwise stay "connected" in /mcp
           // while every call fails with the SDK's bare "Not connected"; flip the
           // status and free the name so a later session start can reconnect it.
-          client.onclose = () => {
-            if (clients.get(name) !== client) return
-            clients.delete(name)
-            status.set(name, { state: 'disconnected', tools: 0 })
-            // Claude reconnects a dropped remote server with exponential backoff;
-            // stdio servers are local processes and are not reconnected. Shutdown
-            // closes clients while they are still in the map, so the flag guards
-            // against scheduling a reconnect for a deliberate teardown.
-            if (!shuttingDown && !serverCallTuning(config).stdio) void reconnectWithBackoff(name, config)
-          }
+          client.onclose = () => dropClient(name, client, config)
         } catch (error) {
           status.set(name, { state: `failed: ${errorMessage(error)}`, tools: 0 })
           // Connected but failed after (tool listing hung or errored): left in the

package/extensions/mcp/mapping.ts

@@ -4,11 +4,25 @@
  * blocks mapped into pi's output budget.
  */
 
+import { createHash } from 'node:crypto'
+
 import { DEFAULT_MAX_BYTES } from '@earendil-works/pi-coding-agent'
 import { capForContext } from '../internal/output-guard.js'
 
+/** Providers take a tool name only as `^[a-zA-Z0-9_-]{1,64}$` (64 is OpenAI's cap, the
+ * tighter of the two) and reject the whole request otherwise, so one bad name failed every
+ * turn of the session. */
+const MAX_TOOL_NAME = 64
+
+/** The pi tool name for a server's tool: `server_tool` with every character a provider
+ * rejects (the MCP spec allows dots; a server name is whatever the user typed) as an
+ * underscore. A name over the limit is cut and ends in a hash of the whole, so two long
+ * tools of one server stay apart and a tool keeps its name from one session to the next. */
 export function formatToolName(server: string, tool: string): string {
-  return `${server}_${tool}`.replaceAll('-', '_')
+  const name = `${server}_${tool}`.replace(/\W/g, '_')
+  if (name.length <= MAX_TOOL_NAME) return name
+  const digest = createHash('sha256').update(name).digest('hex').slice(0, 8)
+  return `${name.slice(0, MAX_TOOL_NAME - digest.length - 1)}_${digest}`
 }
 
 /** Claude exposes server prompts as /mcp__<server>__<prompt> slash commands: any

package/extensions/mcp/transport.ts

@@ -339,6 +339,21 @@ export function isTransientConnectError(error: unknown): boolean {
   return /ECONNREFUSED|ECONNRESET|ETIMEDOUT|timed out after/.test(String(error))
 }
 
+/** Whether a failed call means the server is gone, not that the call was wrong: a refused,
+ * reset or unreachable connection, the 404 a restarted stateful server answers for a
+ * session it forgot (the spec has the client start a new one), or the SDK's own
+ * closed-connection errors. The SDK fires `Client.onclose` only from `close()`, never when
+ * an HTTP or SSE server disappears, so a call is the one place a dead server shows.
+ * Narrower than isTransientConnectError on purpose: a tool timing out, or a tool's own
+ * 5xx, says nothing about the connection and must not drop a healthy server. The closed
+ * connection is matched by the SDK's message, not its -32000 code, which servers also use
+ * for errors of their own. */
+export function isConnectionLost(error: unknown): boolean {
+  const code = typeof error === 'object' && error !== null ? (error as { code?: unknown }).code : undefined
+  if (code === 404 || errorCodes(error).some((one) => TRANSIENT_CODES.has(one))) return true
+  return /\(HTTP 404\)|^Not connected$|^MCP error -32000: Connection closed$/.test(error instanceof Error ? error.message : '')
+}
+
 const delay = (ms: number): Promise<void> => new Promise((resolve) => setTimeout(resolve, ms))
 
 /** Connect with Claude's first-connection retry: an HTTP or SSE server's transient

package/extensions/subagent/background.ts

@@ -29,6 +29,9 @@ export interface BackgroundRun {
   partial?: boolean
   /** Temp dir holding a prompt file rebuilt for a resume; removed with the run. */
   rebuiltPromptDir?: string
+  /** Temp dir the child persists its session in, apart from the project's session dir;
+   * removed with the run. */
+  sessionDir?: string
   /** Set while running so the run can be cancelled; cleared on completion. */
   kill?: () => void
   /** True until the child process actually closes: a cancelled child that ignores
@@ -90,7 +93,7 @@ export function activeBackgroundRuns(): number {
 /** Test seam: the registry is module state, so tests reset it between cases to
  * stay order-independent. */
 export function resetBackgroundRuns(): void {
-  for (const run of runs.values()) removeRebuiltPrompt(run)
+  for (const run of runs.values()) removeRunFiles(run)
   runs.clear()
   state.finishSequence = 0
 }
@@ -99,7 +102,7 @@ function evictFinishedRuns(): void {
   const finished = [...runs.values()].filter((run) => !run.live && run.state !== 'running')
   finished.sort((a, b) => (a.finishedAt ?? 0) - (b.finishedAt ?? 0))
   for (const stale of finished.slice(0, Math.max(0, finished.length - MAX_FINISHED_RUNS))) {
-    removeRebuiltPrompt(stale)
+    removeRunFiles(stale)
     runs.delete(stale.id)
   }
 }
@@ -178,7 +181,7 @@ export function cancelAllBackgroundRuns(): number {
     if (cancelBackgroundRun(id) === 'cancelled') count++
   }
   // Called at quit: nothing in this registry is resumable once pi exits.
-  for (const run of runs.values()) removeRebuiltPrompt(run)
+  for (const run of runs.values()) removeRunFiles(run)
   return count
 }
 
@@ -259,12 +262,14 @@ function withRebuiltPrompt(spawnSpec: BackgroundSpawn, agent: string): { args: s
   }
 }
 
-/** The rebuilt prompt lives as long as its run can be resumed, so it goes when the run
- * leaves the registry: eviction, quit, or the test reset. */
-function removeRebuiltPrompt(run: BackgroundRun): void {
-  if (!run.rebuiltPromptDir) return
-  fs.rmSync(run.rebuiltPromptDir, { recursive: true, force: true })
+/** A run's temp files (the rebuilt prompt, its session) live as long as the run can be
+ * resumed, so they go when it leaves the registry: eviction, quit, or the test reset. */
+function removeRunFiles(run: BackgroundRun): void {
+  for (const dir of [run.rebuiltPromptDir, run.sessionDir]) {
+    if (dir) fs.rmSync(dir, { recursive: true, force: true })
+  }
   run.rebuiltPromptDir = undefined
+  run.sessionDir = undefined
 }
 
 export function startBackgroundRun(agent: string, task: string, invocation: BackgroundSpawn, onComplete: (run: BackgroundRun) => void, presetId?: string): string | null {
@@ -276,12 +281,15 @@ export function startBackgroundRun(agent: string, task: string, invocation: Back
   // id the run will carry.
   const id = presetId ?? `bg-${randomUUID().slice(0, 8)}`
   // A stable session id per run: the child persists its session, so a follow-up can
-  // resume it instead of starting cold.
+  // resume it instead of starting cold. It persists into a directory of its own: in the
+  // project's session dir it would be the newest session there, which `pi -c` and /resume
+  // offer as the user's previous one. The same args serve the resume, so it finds the file.
   const sessionId = `pi-code-${id}-${randomUUID().slice(0, 8)}`
+  const sessionDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pi-code-bg-session-'))
   const args = invocation.args.map((arg) => (arg === '--no-session' ? '--session-id' : arg))
-  const withSession = args.includes('--session-id') ? args.flatMap((arg) => (arg === '--session-id' ? ['--session-id', sessionId] : [arg])) : args
+  const withSession = args.includes('--session-id') ? args.flatMap((arg) => (arg === '--session-id' ? ['--session-id', sessionId, '--session-dir', sessionDir] : [arg])) : args
   const spawnSpec: BackgroundSpawn = { ...invocation, args: withSession }
-  const run: BackgroundRun = { id, agent, task, state: 'running', turns: 0, sessionId, spawn: spawnSpec }
+  const run: BackgroundRun = { id, agent, task, state: 'running', turns: 0, sessionId, sessionDir, spawn: spawnSpec }
   runs.set(id, run)
   driveRun(run, spawnSpec, onComplete)
   return id

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.73",
+  "version": "1.0.75",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",