pi-code 1.0.75 → 1.0.77

package/README.md

@@ -19,7 +19,7 @@ What a repository ships is treated as untrusted until you approve it: project MC
 
 ## Requirements
 
-pi `>=0.79.1` (0.84.x recommended) and Node `>=22.19` for current pi.
+pi `>=0.80.4` (0.84.x recommended) and Node `>=22.19` for current pi.
 
 ## Install
 

package/extensions/commands.ts

@@ -413,7 +413,9 @@ export default function commandsExtension(pi: ExtensionAPI) {
     const rules = pendingPathRules?.[event.toolName as PathRuleTool]
     if (!rules) return
     // pi's read/edit/write accept `file_path` as an alias for `path`; the shared reader
-    // handles both, and the paired guard in hooks/matcher.ts reads both too.
+    // handles both and normalises the value as pi resolves it. The paired guard in
+    // hooks/matcher.ts judges the same paths against the same rules, so it normalises
+    // through the same helper rather than only aliasing the two keys.
     const filePath = fileToolTarget(event) ?? ''
     const anchors = { cwd: ctx.cwd, projectRoot: checkoutRoot(ctx.cwd), home: os.homedir() }
     if (filePath && matchesPathRules(filePath, rules, anchors)) return
@@ -554,7 +556,8 @@ export default function commandsExtension(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (_event, ctx) => {
-    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // pi's CLI builds a fresh extension instance per session replacement; only RPC mode can
+    // reuse one across sessions. A mid-turn /new there fires session_start on
     // the same instance while a command's per-run scoping is still pending (its agent_settled
     // never came). Carrying that into the next session would restore an unrelated tool set,
     // bash/path scope, model, or effort onto it, so drop the pending state here. Drop only:

package/extensions/env-settings.ts

@@ -103,7 +103,8 @@ function userEnv(home: string): Record<string, string> {
  * documented drop list: variables that choose where config and files are written
  * (redirecting later home-scope reads and every subprocess), variables that export
  * session content, and variables that change how the agent starts or syncs.
- * PI_CODING_AGENT_DIR is pi's own config-dir analogue of CLAUDE_CONFIG_DIR. */
+ * PI_CODING_AGENT_DIR is pi's own config-dir analogue of CLAUDE_CONFIG_DIR, and the
+ * PI_CODE_ prefix covers pi-code's own control variables (see isRepoHostileEnvKey). */
 const REPO_HOSTILE_ENV_KEYS = new Set([
   'CLAUDE_CONFIG_DIR',
   'CLAUDE_CODE_TMPDIR',
@@ -122,13 +123,24 @@ const REPO_HOSTILE_ENV_KEYS = new Set([
   'PI_CODING_AGENT_DIR',
 ])
 
+/** Whether a repository's settings must not set this key: Claude's documented drop list,
+ * the XDG_ family, and pi-code's own PI_CODE_ control variables. The last matter because
+ * they are read as instructions rather than data: PI_CODE_SUBAGENT makes a session believe
+ * it is a subagent child, which suppresses the USER's own SessionStart, UserPromptSubmit,
+ * Stop and SessionEnd hooks and their auto memory, and PI_CODE_AGENT_HOOKS is then parsed
+ * into hook definitions, which are shell commands. Approving a repository means running the
+ * config it ships, never silently disabling the user's own guardrails. */
+function isRepoHostileEnvKey(key: string): boolean {
+  return REPO_HOSTILE_ENV_KEYS.has(key) || key.startsWith('XDG_') || key.startsWith('PI_CODE_')
+}
+
 /** Drop the keys a repository's settings must not set, warning each, as Claude
  * documents ("Claude Code drops each one and logs a warning"). Set them in the
  * shell, user settings, or managed settings instead. */
 export function sanitizeProjectEnv(env: Record<string, string>, warn: (key: string) => void = (key) => console.warn(`pi-code-env: dropping ${key} from project settings env (a checked-out repository must not control it; set it in user or managed settings)`)): Record<string, string> {
   const kept: Record<string, string> = {}
   for (const [key, value] of Object.entries(env)) {
-    if (REPO_HOSTILE_ENV_KEYS.has(key) || key.startsWith('XDG_')) warn(key)
+    if (isRepoHostileEnvKey(key)) warn(key)
     else kept[key] = value
   }
   return kept

package/extensions/git-checkpoint.ts

@@ -172,6 +172,9 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   let promptedRun = false
   let shadowDir: string | undefined
   let workTree: string | undefined
+  // Set in ensureShadow: whether the live session has no session file (--no-session),
+  // whose shadow repo session_shutdown then knows is safe to remove on a real quit.
+  let ephemeralShadow = false
   // Absolute paths this session's edit tools targeted: the whole of what a checkpoint
   // captures. Seeded on resume from the last commit, so a resumed session keeps
   // snapshotting the files it was already tracking.
@@ -191,6 +194,7 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   async function ensureShadow(ctx: ExtensionContext): Promise<void> {
     workTree = ctx.cwd
     const sessionFile = (ctx.sessionManager as { getSessionFile?: () => string | undefined }).getSessionFile?.()
+    ephemeralShadow = sessionFile === undefined
     const checkpointsRoot = path.join(getAgentDir(), 'checkpoints')
     shadowDir = path.join(checkpointsRoot, sessionSlug(sessionFile))
     // A resumed session can arrive from a different directory than the one the shadow
@@ -454,7 +458,8 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
   }
 
   pi.on('session_start', async (event, ctx) => {
-    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // pi's CLI builds a fresh extension instance per session replacement; only RPC mode can
+    // reuse one across sessions. A mid-turn /new there fires session_start on
     // the same instance after turn_start took the pre-run snapshot but before turn_end saved
     // it; that pending ref belongs to the previous session and must not attach to the next
     // session's first turn_end. Re-arm runNeedsSnapshot too, so the next run snapshots its
@@ -480,6 +485,17 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     for (const checkpoint of capCheckpoints(stored)) checkpoints.set(checkpoint.entryId, checkpoint)
   })
 
+  // A --no-session run has no session file, so nothing can ever resume it or run
+  // /rewind from it again once the process exits: its shadow repo, left in place, was
+  // pure waste for the 30 days until the retention sweep reached it. Only a genuine
+  // quit removes it eagerly; 'new', 'resume' and 'reload' keep the process (and this
+  // extension instance) alive, and 'fork' can write a session from the live run's
+  // in-memory entries and then fetch refs from exactly this shadow at its own
+  // session_start, so this one case is left for the retention sweep as before.
+  pi.on('session_shutdown', async (event) => {
+    if (ephemeralShadow && shadowDir && event.reason === 'quit') fs.rmSync(shadowDir, { recursive: true, force: true })
+  })
+
   // A new agent loop starts a run: the next turn_start snapshots the pre-run tree.
   // agent_start, not before_agent_start: before_agent_start does not fire for a queued
   // follow-up message delivered through agent.continue, so gating on it would leave that

package/extensions/goal.ts

@@ -446,7 +446,8 @@ export default function goalExtension(pi: ExtensionAPI) {
   })
 
   pi.on('session_start', (_event, ctx) => {
-    // One extension instance serves every session: drop the previous session's goal and
+    // pi's CLI builds a fresh extension instance per session replacement; RPC mode can reuse
+    // one across sessions, so drop the previous session's goal and
     // timers before reading this session's persisted state.
     sessionCtx = ctx
     goal = undefined

package/extensions/hooks/index.ts

@@ -446,7 +446,8 @@ export default function hooksExtension(pi: ExtensionAPI) {
 
   pi.on('session_start', async (event, ctx) => {
     sessionCtx = ctx
-    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // pi's CLI builds a fresh extension instance per session replacement; only RPC mode can
+    // reuse one across sessions. A mid-turn /new there fires session_start on
     // the same instance while a Stop-hook continuation streak is in flight; it must not
     // carry into the next session, so reset before any early return (disableAllHooks below).
     stopHookActive = false

package/extensions/hooks/matcher.ts

@@ -8,6 +8,7 @@ import { matchesBashIfFilter } from '../internal/bash-rules.js'
 import { CLAUDE_TOOL_MAP } from '../internal/claude-tool-names.js'
 import { matchesPathRules, type PathAnchors } from '../internal/path-rules.js'
 import { agentNamesIn, matchesAgentRules, matchesDomainRules, matchesSkillRules } from '../internal/scope-rules.js'
+import { asPiReadsIt } from '../internal/tool-target.js'
 import { errorMessage } from '../internal/values.js'
 import type { HookCommand, HookMatcher } from './config.js'
 
@@ -219,8 +220,13 @@ function matchesToolPattern(piName: string, input: Record<string, unknown> | nul
     case 'slash_command':
       return matchesSkillRules(str(input?.command), [pattern])
     default: {
-      const filePath = str(input?.path) || str(input?.file_path)
-      return filePath.length > 0 && matchesPathRules(filePath, [pattern], anchors)
+      // Normalised as pi's file tools resolve it (~, a leading @, a file:// URL), because
+      // the rule side expands ~ against home too: comparing the raw string let an
+      // `if: Edit(~/.ssh/*)` guard miss the very call it names. The value is normalised
+      // rather than routed through fileToolTarget, which would drop every tool outside
+      // read/edit/write and so stop matching rules that match today.
+      const named = str(input?.path) || str(input?.file_path)
+      return named.length > 0 && matchesPathRules(asPiReadsIt(named), [pattern], anchors)
     }
   }
 }

package/extensions/internal/html-markdown.ts

@@ -58,30 +58,125 @@ const trimNewlines = (value: string): string => {
   return value.slice(start, end)
 }
 
+/** Every match of the global regex `re` in `html`, as `{start, end}` spans. One linear
+ * scan: `matchAll` resumes after each match rather than restarting the search. */
+function matchSpans(html: string, re: RegExp): Array<{ start: number; end: number }> {
+  return [...html.matchAll(re)].map((m) => ({ start: m.index, end: m.index + m[0].length }))
+}
+
+/**
+ * Replace every `open...close` span with `transform(open, body)`. `closeSource(open)`
+ * gives the close pattern's regex source for this particular open (a fixed literal for
+ * most callers; a backreference to `open[1]` for a shared tag family like
+ * script|style|noscript, so each open pairs only with its own tag name). An open with no
+ * reachable close is left as literal text, the same as a non-matching `[\s\S]*?` regex
+ * would leave it.
+ *
+ * Both the opens and each distinct close pattern are found with one bounded, linear scan
+ * (`openRe`'s attrs never cross a `<`/`>`, and neither does a close tag's), then paired by
+ * a single forward walk with a cursor per close pattern that only advances. A page that
+ * repeats one unclosed tag thousands of times used to cost one rescan to the end of the
+ * document per occurrence (O(n^2) for the lazy `[\s\S]*?<\/tag>` shape this replaces);
+ * this costs one pass.
+ */
+function replaceTagSpans(html: string, openRe: RegExp, closeSource: (open: RegExpMatchArray) => string, transform: (open: RegExpMatchArray, body: string) => string): string {
+  const opens = [...html.matchAll(openRe)]
+  if (opens.length === 0) return html
+
+  const closeSpans = new Map<string, Array<{ start: number; end: number }>>()
+  const closeCursor = new Map<string, number>()
+
+  let out = ''
+  let cursor = 0
+  for (const open of opens) {
+    const openStart = open.index ?? 0
+    if (openStart < cursor) continue // inside a span an earlier open of this pass already consumed
+    const source = closeSource(open)
+    if (!closeSpans.has(source)) {
+      closeSpans.set(source, matchSpans(html, new RegExp(source, 'gi')))
+      closeCursor.set(source, 0)
+    }
+    const spans = closeSpans.get(source) as Array<{ start: number; end: number }>
+    const openEnd = openStart + open[0].length
+    let idx = closeCursor.get(source) as number
+    while (idx < spans.length && spans[idx].start < openEnd) idx++
+    closeCursor.set(source, idx)
+    if (idx >= spans.length) continue // no close anywhere after this open: leave it as text
+    out += html.slice(cursor, openStart) + transform(open, html.slice(openEnd, spans[idx].start))
+    cursor = spans[idx].end
+  }
+  return out + html.slice(cursor)
+}
+
 export function htmlToMarkdown(html: string): string {
   // Pre blocks are lifted out first so no later transform touches their content.
   const preBodies: string[] = []
-  let work = html
-    .replace(/<!--[\s\S]*?-->/g, ' ')
-    .replace(/<(script|style|noscript|head|svg)\b[^<>]*>[\s\S]*?<\/\1[^<>]*>/gi, ' ')
-    .replace(/<pre\b[^<>]*>([\s\S]*?)<\/pre>/gi, (_whole, inner: string) => {
-      preBodies.push(trimNewlines(decodeAllEntities(removeTags(inner))))
+  // Each of these bodies can legitimately hold anything up to and including another `<`, so
+  // the body itself cannot be bounded like an open tag's attrs; replaceTagSpans keeps the
+  // pass linear instead by pairing opens and closes in one pass rather than rescanning the
+  // document from every open that turns out to have no close (a broken template or a fetch
+  // truncated mid-tag repeats that shape often enough to matter).
+  let work = replaceTagSpans(
+    html,
+    /<!--/g,
+    () => '-->',
+    () => ' ',
+  )
+  work = replaceTagSpans(
+    work,
+    /<(script|style|noscript|head|svg)\b[^<>]*>/gi,
+    (open) => `</${open[1]}[^<>]*>`,
+    () => ' ',
+  )
+  work = replaceTagSpans(
+    work,
+    /<pre\b[^<>]*>/gi,
+    () => '</pre[^<>]*>',
+    (_open, body) => {
+      preBodies.push(trimNewlines(decodeAllEntities(removeTags(body))))
       return `\n\n\uE000PRE${preBodies.length - 1}\uE000\n\n`
-    })
+    },
+  )
 
-  work = work
-    .replace(/<code\b[^<>]*>([\s\S]*?)<\/code>/gi, (_whole, inner: string) => `\`${removeTags(inner)}\``)
-    // Only real web links become markdown links; fragment and javascript hrefs
-    // keep their label and lose the target.
-    .replace(/<a\b[^<>]*?href=(?:"([^"]*)"|'([^']*)')[^<>]*>([\s\S]*?)<\/a>/gi, (_whole, dq: string | undefined, sq: string | undefined, inner: string) => {
-      const href = decodeAllEntities(dq ?? sq ?? '')
-      const label = removeTags(inner).trim()
+  work = replaceTagSpans(
+    work,
+    /<code\b[^<>]*>/gi,
+    () => '</code[^<>]*>',
+    (_open, body) => `\`${removeTags(body)}\``,
+  )
+  // Only real web links become markdown links; fragment and javascript hrefs
+  // keep their label and lose the target.
+  work = replaceTagSpans(
+    work,
+    /<a\b[^<>]*?href=(?:"([^"]*)"|'([^']*)')[^<>]*>/gi,
+    () => '</a[^<>]*>',
+    (open, body) => {
+      const href = decodeAllEntities(open[1] ?? open[2] ?? '')
+      const label = removeTags(body).trim()
       if (!label) return ' '
       return /^https?:\/\//i.test(href) ? `[${label}](${href})` : label
-    })
-    .replace(/<(strong|b)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `**${removeTags(inner).trim()}**`)
-    .replace(/<(em|i)\b[^<>]*>([\s\S]*?)<\/\1>/gi, (_whole, _tag, inner: string) => `*${removeTags(inner).trim()}*`)
-    .replace(/<h([1-6])\b[^<>]*>([\s\S]*?)<\/h\1>/gi, (_whole, level: string, inner: string) => `\n\n${'#'.repeat(Number(level))} ${removeTags(inner).trim()}\n\n`)
+    },
+  )
+  work = replaceTagSpans(
+    work,
+    /<(strong|b)\b[^<>]*>/gi,
+    (open) => `</${open[1]}[^<>]*>`,
+    (_open, body) => `**${removeTags(body).trim()}**`,
+  )
+  work = replaceTagSpans(
+    work,
+    /<(em|i)\b[^<>]*>/gi,
+    (open) => `</${open[1]}[^<>]*>`,
+    (_open, body) => `*${removeTags(body).trim()}*`,
+  )
+  work = replaceTagSpans(
+    work,
+    /<h([1-6])\b[^<>]*>/gi,
+    (open) => `</h${open[1]}[^<>]*>`,
+    (open, body) => `\n\n${'#'.repeat(Number(open[1]))} ${removeTags(body).trim()}\n\n`,
+  )
+
+  work = work
     .replace(/<img\b[^<>]*?alt=(?:"([^"]*)"|'([^']*)')[^<>]*>/gi, (_whole, dq?: string, sq?: string) => dq ?? sq ?? '')
     .replace(/<li\b[^<>]*>/gi, '\n- ')
     .replace(/<blockquote\b[^<>]*>/gi, '\n\n> ')

package/extensions/internal/managed-settings.ts

@@ -34,12 +34,29 @@ export function managedSettingsFile(): string {
   return managedSettingsFileOverride ?? managedSettingsPath()
 }
 
+/** Files already reported as unparsable. Managed settings are read from sixteen call
+ * sites, several of them once per turn, so one warning per broken file is the whole
+ * budget; the same warn-once shape project-approval.ts uses for its runtime notice. */
+const warnedUnparsable = new Set<string>()
+
 function readOneSettingsFile(file: string): Record<string, unknown> {
+  let raw: string
+  try {
+    raw = fs.readFileSync(file, 'utf-8')
+  } catch {
+    return {} // no such file: genuinely no managed policy on this machine
+  }
   try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
-    if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed as Record<string, unknown>
+    const parsed: unknown = JSON.parse(raw)
+    if (isRecord(parsed)) return parsed
   } catch {
-    // No managed policy on this machine.
+    // Present but unparsable is an administrator's typo, not an absent policy. Silence
+    // there disabled every policy the file carries (exclusion lists, MCP allow and deny,
+    // enabledPlugins, disableAllHooks) on every session, with nothing said anywhere.
+    if (!warnedUnparsable.has(file)) {
+      warnedUnparsable.add(file)
+      console.warn(`pi-code: ignoring ${file}: not valid JSON; the managed policy it carries is not applied`)
+    }
   }
   return {}
 }

package/extensions/internal/plugins.ts

@@ -19,7 +19,8 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { claudeConfigDir } from './config-dir.js'
 import { readManagedSettings } from './managed-settings.js'
-import { errorMessage } from './values.js'
+import { statToken } from './stat-token.js'
+import { errorMessage, isRecord } from './values.js'
 
 export interface InstalledPlugin {
   name: string
@@ -40,8 +41,10 @@ function readJson(file: string): Record<string, unknown> {
     return {} // no such file: nothing to read, and most callers expect that
   }
   try {
-    const parsed = JSON.parse(raw)
-    return parsed !== null && typeof parsed === 'object' ? parsed : {}
+    const parsed: unknown = JSON.parse(raw)
+    // isRecord, not a hand-written object check: a manifest or settings file that is a
+    // JSON array is not a config object, and every caller here reads it by key.
+    return isRecord(parsed) ? parsed : {}
   } catch (error) {
     // A manifest that does not parse leaves the plugin with no components at all, and
     // settings that do not parse drop the enablement or configuration they carried.
@@ -176,12 +179,13 @@ export function resetInstalledPluginsCache(): void {
   pluginCache.clear()
 }
 
-/** mtime plus size; cheap, but blind to a same-size rewrite within one
- * timestamp tick, so only directory-tree entries use it. */
-function statToken(target: string): string {
+/** mtime plus size; cheap, but blind to a same-size rewrite within one timestamp tick, so
+ * only directory-tree entries use it. The shared token is the one that owns the format
+ * (internal/stat-token.ts); it throws where this caller wants a value for a path that is
+ * simply not there, which is the catch below rather than a second copy of the format. */
+function statTokenOrMissing(target: string): string {
   try {
-    const stat = fs.statSync(target)
-    return `${stat.mtimeMs}:${stat.size}`
+    return statToken(target)
   } catch {
     return 'missing'
   }
@@ -208,18 +212,18 @@ function pluginFingerprint(cacheDir: string, settingsFiles: string[], index: Map
   const parts = settingsFiles.map(contentToken)
   for (const marketplace of listDirs(cacheDir)) {
     const marketplaceDir = path.join(cacheDir, marketplace)
-    parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
+    parts.push(`${marketplace}:${statTokenOrMissing(marketplaceDir)}`)
     for (const pluginDir of listPluginDirs(marketplaceDir)) {
       const pluginPath = path.join(marketplaceDir, pluginDir)
-      parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
+      parts.push(`${marketplace}/${pluginDir}:${statTokenOrMissing(pluginPath)}`)
       const versions = listDirs(pluginPath)
       for (const version of versions) {
-        parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
+        parts.push(`${marketplace}/${pluginDir}/${version}:${statTokenOrMissing(path.join(pluginPath, version))}`)
       }
       // resolvePlugin reads only the resolved version's manifest, so its stat token is
       // what an in-place edit (no directory entry changing) must move.
       const resolved = versionDir(pluginPath, index?.get(`${pluginDir}@${marketplace}`))
-      if (resolved) parts.push(`${marketplace}/${pluginDir}/${path.basename(resolved)}/manifest:${statToken(path.join(resolved, '.claude-plugin', 'plugin.json'))}`)
+      if (resolved) parts.push(`${marketplace}/${pluginDir}/${path.basename(resolved)}/manifest:${statTokenOrMissing(path.join(resolved, '.claude-plugin', 'plugin.json'))}`)
     }
   }
   return parts.join('\n')

package/extensions/internal/tool-target.ts

@@ -21,8 +21,10 @@ const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g
  * some models add) stripped, ~ expanded, a file:// URL decoded, unicode spaces folded.
  * pi does this in resolveToCwd (dist/core/tools/path-utils), which the package does not
  * export. A reader that skips it judges a different file than the one pi opens: a
- * command scoped to `Read(*.md)` allowed `~/secret/notes.md`, read as <cwd>/~/secret. */
-function asPiReadsIt(target: string): string {
+ * command scoped to `Read(*.md)` allowed `~/secret/notes.md`, read as <cwd>/~/secret.
+ * Exported for the hook `if` filter, which judges the same paths against the same rules
+ * but reaches them through tool names this module's FILE_TOOLS set does not cover. */
+export function asPiReadsIt(target: string): string {
   const folded = target.replace(UNICODE_SPACES, ' ')
   const bare = folded.startsWith('@') ? folded.slice(1) : folded
   if (bare === '~') return os.homedir()

package/extensions/mcp/policy.ts

@@ -8,7 +8,7 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { managedSettingsFile } from '../internal/managed-settings.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
-import { errorMessage, escapeRegExp } from '../internal/values.js'
+import { errorMessage, escapeRegExp, isRecord } from '../internal/values.js'
 import { interpolateEnv, type ServerConfig } from './config.js'
 
 export interface ProjectServerPolicy {
@@ -29,10 +29,22 @@ export interface ProjectServerPolicy {
  * disabledMcpjsonServers counts from every file, including the repo's own, and wins
  * over consent: a repo may always restrict itself further, never less. */
 export function projectServerPolicy(cwd: string, home: string, projectApproved: boolean): ProjectServerPolicy {
+  // Tells a missing file from an unparsable one, like mcpAllowDeny below: silence for the
+  // second silently emptied disabledMcpjsonServers, so a server the repository had
+  // explicitly disabled connected. That direction fails open, against this function's own
+  // rule that a repo may always restrict itself further, never less.
   const read = (file: string): Record<string, unknown> => {
+    let raw: string
+    try {
+      raw = fs.readFileSync(file, 'utf-8')
+    } catch {
+      return {} // no such file: genuinely no policy
+    }
     try {
-      return JSON.parse(fs.readFileSync(file, 'utf-8'))
+      const parsed: unknown = JSON.parse(raw)
+      return isRecord(parsed) ? parsed : {}
     } catch {
+      console.warn(`pi-code-mcp: ignoring ${file}: not valid JSON; its MCP server consent and disable lists are not applied`)
       return {}
     }
   }

package/extensions/memory.ts

@@ -243,18 +243,25 @@ function readMemory(dir: string, name: string): MemoryToolResult {
   }
 }
 
-/** The delete action: remove a memory file and its index line, queued on the index
- * like save (single key, no deadlock). The index is read before anything is removed,
- * and any failure (a bad index read, or an unreadable store the queue key cannot
- * realpath) leaves both the memory file and the index as they were. */
+/** The delete action: remove a memory's index line and then its file, queued on the index
+ * like save (single key, no deadlock). The index moves first because it is what the prompt
+ * and /memory show: a failure before it is written leaves both the file and the index as
+ * they were, and a failure after it leaves an orphan file rather than an index line
+ * pointing at a file that is gone. Each outcome is reported as what actually happened. */
 async function deleteMemory(dir: string, indexPath: string, name: string): Promise<MemoryToolResult> {
   try {
     return await withFileMutationQueue(indexPath, async (): Promise<MemoryToolResult> => {
       const index = readIndex(dir)
-      fs.rmSync(path.join(dir, `${name}.md`), { force: true })
       const remaining = removeIndexLine(index, name)
       if (remaining) writeIndex(indexPath, remaining)
       else fs.rmSync(indexPath, { force: true })
+      try {
+        fs.rmSync(path.join(dir, `${name}.md`), { force: true })
+      } catch (error) {
+        // Out of the index, so it is gone from every surface the user sees; saying the
+        // delete failed would be false, and silence would leave the stray file unexplained.
+        return { content: [{ type: 'text', text: `Deleted memory ${name} from the index, but its file could not be removed: ${errorMessage(error)}.` }], details: {} }
+      }
       return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
     })
   } catch (error) {

package/extensions/notify.ts

@@ -86,7 +86,11 @@ function notifyWindows(title: string, body: string): void {
 }
 
 function notifyDesktop(title: string, body: string): void {
-  if (process.env.WT_SESSION) {
+  // Windows Terminal sets WT_SESSION for a WSL session it hosts too, but WSL is a Linux
+  // process: notifyWindows's fixed C:\Windows\... path is a Windows path and cannot
+  // resolve there, so PowerShell never actually launched and no toast ever fired. The
+  // escape-sequence fallback below travels over the same pty either way.
+  if (process.env.WT_SESSION && process.platform === 'win32') {
     notifyWindows(title, body)
   } else if (process.env.KITTY_WINDOW_ID) {
     notifyOSC99(title, body)
@@ -100,25 +104,44 @@ export default function notifyExtension(pi: ExtensionAPI) {
   // When the user last submitted a prompt, so a turn's duration can stand in for
   // Claude's "appear to be away" check. Undefined until the first prompt this session.
   let lastInputAt: number | undefined
+  // Set by agent_end, consumed and cleared by agent_settled. agent_end alone cannot
+  // tell a genuine "done, waiting for you" end from one an automatic retry, a /goal
+  // continuation, or a compaction is about to follow with no user involved: each of
+  // those fires its own agent_end too, with nobody ever actually waiting until the
+  // last one. agent_settled ("no automatic retry, compaction, or queued continuation
+  // will run") is that signal, but only firing there would delay the common, single-
+  // turn case behind a peer extension's agent_end handler blocking on a UI dialog
+  // (plan mode); capturing state at agent_end and only acting on it once agent_settled
+  // confirms this was the final step keeps both properties.
+  let pending = false
+  // Whether the run's own last assistant message ended with stopReason: 'aborted', i.e.
+  // the user pressed Esc: they are at the keyboard by definition, whatever isAway's
+  // timer-based guess would otherwise say.
+  let lastAborted = false
 
   pi.on('session_start', async (_event, _ctx) => {
     channel = resolveNotifChannel(readPreferredNotifChannel(os.homedir()))
     lastInputAt = undefined
+    pending = false
   })
 
-  pi.on('input', async () => {
+  pi.on('input', async (event) => {
+    // A goal continuation or a subagent's own prompt is not the user; only their own
+    // input is evidence they are at the keyboard (mirroring goal.ts's own check).
+    if (event.source === 'extension') return
     lastInputAt = Date.now()
   })
 
-  // Fires on agent_end rather than agent_settled deliberately: agent_settled is only
-  // emitted after every agent_end handler returns, and a peer extension (plan mode)
-  // blocks its agent_end handler on a UI dialog, which would starve this notification
-  // exactly when the user has stepped away. agent_end can fire slightly early before a
-  // rare automatic retry or compaction, which is a better failure than never notifying.
-  pi.on('agent_end', async () => {
-    if (channel === 'off') return
-    // Piped or headless stdout (pi -p, CI) must not receive raw escape bytes.
-    if (!process.stdout.isTTY) return
+  pi.on('agent_end', async (event) => {
+    const last = [...event.messages].reverse().find((message) => message.role === 'assistant')
+    lastAborted = last?.stopReason === 'aborted'
+    pending = channel !== 'off' && process.stdout.isTTY === true
+  })
+
+  pi.on('agent_settled', async () => {
+    if (!pending) return
+    pending = false
+    if (lastAborted) return
     if (!isAway(lastInputAt, Date.now(), AWAY_AFTER_MS)) return
     if (channel === 'bell') {
       process.stdout.write('\x07')

package/extensions/plan-mode/index.ts

@@ -426,7 +426,8 @@ After completing a step, include a [DONE:n] tag in your response.`,
 
   // Restore state on session start/resume
   pi.on('session_start', async (_event, ctx) => {
-    // One extension instance serves every session, so clear prior state first: a fresh
+    // pi's CLI builds a fresh extension instance per session replacement; RPC mode can reuse
+    // one across sessions, so clear prior state first there too: a fresh
     // session (/new, no plan entry) must not inherit the last session's plan or execution.
     planModeEnabled = false
     executionMode = false

package/extensions/session-title.ts

@@ -8,10 +8,12 @@
  * (pi changelog); a separate ctx.ui.setTitle call would only duplicate that, so there is none.
  *
  * It runs in every mode, not just the TUI: naming a session is cheap and harmless, and a
- * headless run that persists its session still benefits from a readable name later. Titling
- * is best-effort throughout: a session that already has a name, a run with no user text (a
- * slash-command-only turn), a headless run with no model, or any provider error leaves the
- * session untitled and never throws.
+ * headless run that persists its session still benefits from a readable name later. The one
+ * exception is a subagent child (PI_CODE_SUBAGENT=1): its session is never browsed by name,
+ * so the call is skipped outright rather than spending a model round trip nobody sees.
+ * Titling is best-effort throughout: a session that already has a name, a run with no user
+ * text (a slash-command-only turn), a headless run with no model, or any provider error
+ * leaves the session untitled and never throws.
  *
  * Cost: one model call per session at most. The guard is claimed before the completion so
  * repeated settles cannot each fire a call, and a failed attempt is not retried until a
@@ -98,6 +100,10 @@ export default function sessionTitleExtension(pi: ExtensionAPI) {
     // small/fast-model request that generates the session title." setSessionName is pi's
     // only title sink, so skipping the call here skips both effects at once.
     if (process.env.CLAUDE_CODE_DISABLE_TERMINAL_TITLE === '1') return
+    // A subagent child's session (--no-session, or its own --session-dir once it persists
+    // one for a resumable follow-up) is never browsed by name in a session picker: the
+    // model call would only add latency and cost to how soon the child can exit.
+    if (process.env.PI_CODE_SUBAGENT === '1') return
     if (titled) return
     // Never clobber an existing name: a user-chosen or resumed name wins.
     if (pi.getSessionName?.()) return

package/extensions/subagent/index.ts

@@ -250,11 +250,12 @@ export default function subagentExtension(pi: ExtensionAPI) {
       if (params.tasks?.length) return runParallelMode(params.tasks, mode)
       if (params.agent && params.task) return runSingleMode(params.agent, params.task, params.cwd, mode)
 
-      const available = agents.map((a) => `${a.name} (${a.source})`).join(', ') || 'none'
-      return {
-        content: [{ type: 'text', text: `Invalid parameters. Available agents: ${available}` }],
-        details: makeDetails('single')([]),
-      }
+      // Unreachable: the modeCount guard above returns unless exactly one of these three
+      // is set, and nothing between it and here touches params. It was a second copy of
+      // that guard's message, which no input could ever produce, so a reader had to work
+      // out for themselves that it was dead. Stated as the invariant it actually is, so a
+      // future edit that breaks it says so instead of printing a confusing refusal.
+      throw new Error('subagent: exactly one mode must be set here; the mode guard should have returned')
     },
 
     renderCall(args, theme, _context) {

package/extensions/thinking.ts

@@ -56,7 +56,8 @@ export default function thinkingExtension(pi: ExtensionAPI) {
   })
 
   pi.on('session_start', () => {
-    // One extension instance serves every session. A mid-turn /new fires session_start on
+    // pi's CLI builds a fresh extension instance per session replacement; only RPC mode can
+    // reuse one across sessions. A mid-turn /new there fires session_start on
     // the same instance while an escalation is still pending (its agent_settled never came),
     // and that stale restore must be dropped rather than fired into the next session, whose
     // level the new session owns. Drop only: do NOT setThinkingLevel here.

package/extensions/web.ts

@@ -178,11 +178,28 @@ async function resolveAndPin(url: URL): Promise<LookupFunction> {
 
 const MAX_REDIRECTS = 5
 
-/** Read a response body up to MAX_RAW_CHARS, then stop the download. Bounds memory and parsing cost. */
+/** The charset a content-type header declares, or 'utf-8' when it names none. */
+function declaredCharset(contentType: string): string {
+  const match = /charset=(?:"([^"]*)"|'([^']*)'|([^;\s]*))/i.exec(contentType)
+  return (match?.[1] ?? match?.[2] ?? match?.[3] ?? '').trim() || 'utf-8'
+}
+
+/** A decoder for `contentType`'s declared charset, or the platform default (UTF-8) for a
+ * label TextDecoder does not recognize: a bad or made-up charset must not fail the fetch. */
+function decoderFor(contentType: string): TextDecoder {
+  try {
+    return new TextDecoder(declaredCharset(contentType))
+  } catch {
+    return new TextDecoder()
+  }
+}
+
+/** Read a response body up to MAX_RAW_CHARS, decoded as the content-type header's charset
+ * (UTF-8 when it names none), then stop the download. Bounds memory and parsing cost. */
 async function readCapped(response: Response): Promise<string> {
+  const decoder = decoderFor(response.headers.get('content-type') ?? '')
   const reader = response.body?.getReader()
-  if (!reader) return (await response.text()).slice(0, MAX_RAW_CHARS)
-  const decoder = new TextDecoder()
+  if (!reader) return decoder.decode(await response.arrayBuffer()).slice(0, MAX_RAW_CHARS)
   let text = ''
   while (text.length < MAX_RAW_CHARS) {
     const { done, value } = await reader.read()
@@ -234,13 +251,23 @@ function redirectTarget(response: Response, url: URL, rawUrl: string, crossHost:
   return { kind: 'next', next }
 }
 
-async function fetchText(rawUrl: string, crossHost: CrossHost, transport = httpFetch): Promise<FetchOutcome> {
+/** The per-hop timeout, combined with the caller's own signal (the tool call's, fired on
+ * Esc) when there is one: cancelling must not lose the ceiling that keeps a silently
+ * hanging host from holding the turn forever, but Esc must not have to wait for it either. */
+function hopSignal(signal: AbortSignal | undefined): AbortSignal {
+  const timeout = AbortSignal.timeout(FETCH_TIMEOUT_MS)
+  return signal ? AbortSignal.any([signal, timeout]) : timeout
+}
+
+async function fetchText(rawUrl: string, crossHost: CrossHost, signal?: AbortSignal, transport = httpFetch): Promise<FetchOutcome> {
   let url = new URL(rawUrl)
   for (let hop = 0; hop <= MAX_REDIRECTS; hop++) {
+    // Cancelled between hops (a redirect chain), not just mid-request.
+    signal?.throwIfAborted()
     // Resolve, validate and pin per hop: a redirect target gets the same guarantee.
     const lookup = await resolveAndPin(url)
     const response = await transport(url, {
-      signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+      signal: hopSignal(signal),
       lookup,
       userAgent: USER_AGENT,
     })
@@ -317,9 +344,9 @@ export default function webExtension(pi: ExtensionAPI) {
       allowed_domains: Type.Optional(Type.Array(Type.String(), { description: 'Only include results from these domains' })),
       blocked_domains: Type.Optional(Type.Array(Type.String(), { description: 'Exclude results from these domains' })),
     }),
-    async execute(_id, params) {
+    async execute(_id, params, signal) {
       // Claude documents allowed/blocked domains as mutually exclusive; allowed wins.
-      const outcome = await fetchText(SEARCH_ENDPOINT + encodeURIComponent(params.query), 'follow')
+      const outcome = await fetchText(SEARCH_ENDPOINT + encodeURIComponent(params.query), 'follow', signal)
       const text = outcome.kind === 'body' ? outcome.text : ''
       const limit = Math.min(params.count ?? 5, 10)
       const results = filterByDomain(parseSearchResults(text, 10), params.allowed_domains, params.blocked_domains).slice(0, limit)
@@ -356,7 +383,7 @@ export default function webExtension(pi: ExtensionAPI) {
       if (cached && cached.expires > now) {
         body = cached.body
       } else {
-        const outcome = await fetchText(target, 'report')
+        const outcome = await fetchText(target, 'report', signal)
         // A cross-host redirect has no body to cache or summarize: the naming result is
         // the answer, and Claude fetches the target with a second call if it wants it.
         if (outcome.kind === 'redirect') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.75",
+  "version": "1.0.77",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",
@@ -57,9 +57,9 @@
     "typebox": "^1.3.6"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": ">=0.79.1",
-    "@earendil-works/pi-coding-agent": ">=0.79.1",
-    "@earendil-works/pi-tui": ">=0.79.1"
+    "@earendil-works/pi-ai": ">=0.80.4",
+    "@earendil-works/pi-coding-agent": ">=0.80.4",
+    "@earendil-works/pi-tui": ">=0.80.4"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.5.4",