pi-code 1.0.76 → 1.1.0

package/extensions/commands.ts

@@ -413,7 +413,9 @@ export default function commandsExtension(pi: ExtensionAPI) {
     const rules = pendingPathRules?.[event.toolName as PathRuleTool]
     if (!rules) return
     // pi's read/edit/write accept `file_path` as an alias for `path`; the shared reader
-    // handles both, and the paired guard in hooks/matcher.ts reads both too.
+    // handles both and normalises the value as pi resolves it. The paired guard in
+    // hooks/matcher.ts judges the same paths against the same rules, so it normalises
+    // through the same helper rather than only aliasing the two keys.
     const filePath = fileToolTarget(event) ?? ''
     const anchors = { cwd: ctx.cwd, projectRoot: checkoutRoot(ctx.cwd), home: os.homedir() }
     if (filePath && matchesPathRules(filePath, rules, anchors)) return

package/extensions/env-settings.ts

@@ -103,7 +103,8 @@ function userEnv(home: string): Record<string, string> {
  * documented drop list: variables that choose where config and files are written
  * (redirecting later home-scope reads and every subprocess), variables that export
  * session content, and variables that change how the agent starts or syncs.
- * PI_CODING_AGENT_DIR is pi's own config-dir analogue of CLAUDE_CONFIG_DIR. */
+ * PI_CODING_AGENT_DIR is pi's own config-dir analogue of CLAUDE_CONFIG_DIR, and the
+ * PI_CODE_ prefix covers pi-code's own control variables (see isRepoHostileEnvKey). */
 const REPO_HOSTILE_ENV_KEYS = new Set([
   'CLAUDE_CONFIG_DIR',
   'CLAUDE_CODE_TMPDIR',
@@ -122,13 +123,24 @@ const REPO_HOSTILE_ENV_KEYS = new Set([
   'PI_CODING_AGENT_DIR',
 ])
 
+/** Whether a repository's settings must not set this key: Claude's documented drop list,
+ * the XDG_ family, and pi-code's own PI_CODE_ control variables. The last matter because
+ * they are read as instructions rather than data: PI_CODE_SUBAGENT makes a session believe
+ * it is a subagent child, which suppresses the USER's own SessionStart, UserPromptSubmit,
+ * Stop and SessionEnd hooks and their auto memory, and PI_CODE_AGENT_HOOKS is then parsed
+ * into hook definitions, which are shell commands. Approving a repository means running the
+ * config it ships, never silently disabling the user's own guardrails. */
+function isRepoHostileEnvKey(key: string): boolean {
+  return REPO_HOSTILE_ENV_KEYS.has(key) || key.startsWith('XDG_') || key.startsWith('PI_CODE_')
+}
+
 /** Drop the keys a repository's settings must not set, warning each, as Claude
  * documents ("Claude Code drops each one and logs a warning"). Set them in the
  * shell, user settings, or managed settings instead. */
 export function sanitizeProjectEnv(env: Record<string, string>, warn: (key: string) => void = (key) => console.warn(`pi-code-env: dropping ${key} from project settings env (a checked-out repository must not control it; set it in user or managed settings)`)): Record<string, string> {
   const kept: Record<string, string> = {}
   for (const [key, value] of Object.entries(env)) {
-    if (REPO_HOSTILE_ENV_KEYS.has(key) || key.startsWith('XDG_')) warn(key)
+    if (isRepoHostileEnvKey(key)) warn(key)
     else kept[key] = value
   }
   return kept

package/extensions/hooks/matcher.ts

@@ -8,6 +8,7 @@ import { matchesBashIfFilter } from '../internal/bash-rules.js'
 import { CLAUDE_TOOL_MAP } from '../internal/claude-tool-names.js'
 import { matchesPathRules, type PathAnchors } from '../internal/path-rules.js'
 import { agentNamesIn, matchesAgentRules, matchesDomainRules, matchesSkillRules } from '../internal/scope-rules.js'
+import { asPiReadsIt } from '../internal/tool-target.js'
 import { errorMessage } from '../internal/values.js'
 import type { HookCommand, HookMatcher } from './config.js'
 
@@ -219,8 +220,13 @@ function matchesToolPattern(piName: string, input: Record<string, unknown> | nul
     case 'slash_command':
       return matchesSkillRules(str(input?.command), [pattern])
     default: {
-      const filePath = str(input?.path) || str(input?.file_path)
-      return filePath.length > 0 && matchesPathRules(filePath, [pattern], anchors)
+      // Normalised as pi's file tools resolve it (~, a leading @, a file:// URL), because
+      // the rule side expands ~ against home too: comparing the raw string let an
+      // `if: Edit(~/.ssh/*)` guard miss the very call it names. The value is normalised
+      // rather than routed through fileToolTarget, which would drop every tool outside
+      // read/edit/write and so stop matching rules that match today.
+      const named = str(input?.path) || str(input?.file_path)
+      return named.length > 0 && matchesPathRules(asPiReadsIt(named), [pattern], anchors)
     }
   }
 }

package/extensions/internal/managed-settings.ts

@@ -34,12 +34,29 @@ export function managedSettingsFile(): string {
   return managedSettingsFileOverride ?? managedSettingsPath()
 }
 
+/** Files already reported as unparsable. Managed settings are read from sixteen call
+ * sites, several of them once per turn, so one warning per broken file is the whole
+ * budget; the same warn-once shape project-approval.ts uses for its runtime notice. */
+const warnedUnparsable = new Set<string>()
+
 function readOneSettingsFile(file: string): Record<string, unknown> {
+  let raw: string
+  try {
+    raw = fs.readFileSync(file, 'utf-8')
+  } catch {
+    return {} // no such file: genuinely no managed policy on this machine
+  }
   try {
-    const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'))
-    if (parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed as Record<string, unknown>
+    const parsed: unknown = JSON.parse(raw)
+    if (isRecord(parsed)) return parsed
   } catch {
-    // No managed policy on this machine.
+    // Present but unparsable is an administrator's typo, not an absent policy. Silence
+    // there disabled every policy the file carries (exclusion lists, MCP allow and deny,
+    // enabledPlugins, disableAllHooks) on every session, with nothing said anywhere.
+    if (!warnedUnparsable.has(file)) {
+      warnedUnparsable.add(file)
+      console.warn(`pi-code: ignoring ${file}: not valid JSON; the managed policy it carries is not applied`)
+    }
   }
   return {}
 }

package/extensions/internal/plugins.ts

@@ -19,7 +19,8 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { claudeConfigDir } from './config-dir.js'
 import { readManagedSettings } from './managed-settings.js'
-import { errorMessage } from './values.js'
+import { statToken } from './stat-token.js'
+import { errorMessage, isRecord } from './values.js'
 
 export interface InstalledPlugin {
   name: string
@@ -40,8 +41,10 @@ function readJson(file: string): Record<string, unknown> {
     return {} // no such file: nothing to read, and most callers expect that
   }
   try {
-    const parsed = JSON.parse(raw)
-    return parsed !== null && typeof parsed === 'object' ? parsed : {}
+    const parsed: unknown = JSON.parse(raw)
+    // isRecord, not a hand-written object check: a manifest or settings file that is a
+    // JSON array is not a config object, and every caller here reads it by key.
+    return isRecord(parsed) ? parsed : {}
   } catch (error) {
     // A manifest that does not parse leaves the plugin with no components at all, and
     // settings that do not parse drop the enablement or configuration they carried.
@@ -176,12 +179,13 @@ export function resetInstalledPluginsCache(): void {
   pluginCache.clear()
 }
 
-/** mtime plus size; cheap, but blind to a same-size rewrite within one
- * timestamp tick, so only directory-tree entries use it. */
-function statToken(target: string): string {
+/** mtime plus size; cheap, but blind to a same-size rewrite within one timestamp tick, so
+ * only directory-tree entries use it. The shared token is the one that owns the format
+ * (internal/stat-token.ts); it throws where this caller wants a value for a path that is
+ * simply not there, which is the catch below rather than a second copy of the format. */
+function statTokenOrMissing(target: string): string {
   try {
-    const stat = fs.statSync(target)
-    return `${stat.mtimeMs}:${stat.size}`
+    return statToken(target)
   } catch {
     return 'missing'
   }
@@ -208,18 +212,18 @@ function pluginFingerprint(cacheDir: string, settingsFiles: string[], index: Map
   const parts = settingsFiles.map(contentToken)
   for (const marketplace of listDirs(cacheDir)) {
     const marketplaceDir = path.join(cacheDir, marketplace)
-    parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
+    parts.push(`${marketplace}:${statTokenOrMissing(marketplaceDir)}`)
     for (const pluginDir of listPluginDirs(marketplaceDir)) {
       const pluginPath = path.join(marketplaceDir, pluginDir)
-      parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
+      parts.push(`${marketplace}/${pluginDir}:${statTokenOrMissing(pluginPath)}`)
       const versions = listDirs(pluginPath)
       for (const version of versions) {
-        parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
+        parts.push(`${marketplace}/${pluginDir}/${version}:${statTokenOrMissing(path.join(pluginPath, version))}`)
       }
       // resolvePlugin reads only the resolved version's manifest, so its stat token is
       // what an in-place edit (no directory entry changing) must move.
       const resolved = versionDir(pluginPath, index?.get(`${pluginDir}@${marketplace}`))
-      if (resolved) parts.push(`${marketplace}/${pluginDir}/${path.basename(resolved)}/manifest:${statToken(path.join(resolved, '.claude-plugin', 'plugin.json'))}`)
+      if (resolved) parts.push(`${marketplace}/${pluginDir}/${path.basename(resolved)}/manifest:${statTokenOrMissing(path.join(resolved, '.claude-plugin', 'plugin.json'))}`)
     }
   }
   return parts.join('\n')

package/extensions/internal/tool-target.ts

@@ -21,8 +21,10 @@ const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g
  * some models add) stripped, ~ expanded, a file:// URL decoded, unicode spaces folded.
  * pi does this in resolveToCwd (dist/core/tools/path-utils), which the package does not
  * export. A reader that skips it judges a different file than the one pi opens: a
- * command scoped to `Read(*.md)` allowed `~/secret/notes.md`, read as <cwd>/~/secret. */
-function asPiReadsIt(target: string): string {
+ * command scoped to `Read(*.md)` allowed `~/secret/notes.md`, read as <cwd>/~/secret.
+ * Exported for the hook `if` filter, which judges the same paths against the same rules
+ * but reaches them through tool names this module's FILE_TOOLS set does not cover. */
+export function asPiReadsIt(target: string): string {
   const folded = target.replace(UNICODE_SPACES, ' ')
   const bare = folded.startsWith('@') ? folded.slice(1) : folded
   if (bare === '~') return os.homedir()

package/extensions/mcp/policy.ts

@@ -8,7 +8,7 @@ import * as fs from 'node:fs'
 import * as path from 'node:path'
 import { managedSettingsFile } from '../internal/managed-settings.js'
 import { claudeSettingsChain } from '../internal/settings-chain.js'
-import { errorMessage, escapeRegExp } from '../internal/values.js'
+import { errorMessage, escapeRegExp, isRecord } from '../internal/values.js'
 import { interpolateEnv, type ServerConfig } from './config.js'
 
 export interface ProjectServerPolicy {
@@ -29,10 +29,22 @@ export interface ProjectServerPolicy {
  * disabledMcpjsonServers counts from every file, including the repo's own, and wins
  * over consent: a repo may always restrict itself further, never less. */
 export function projectServerPolicy(cwd: string, home: string, projectApproved: boolean): ProjectServerPolicy {
+  // Tells a missing file from an unparsable one, like mcpAllowDeny below: silence for the
+  // second silently emptied disabledMcpjsonServers, so a server the repository had
+  // explicitly disabled connected. That direction fails open, against this function's own
+  // rule that a repo may always restrict itself further, never less.
   const read = (file: string): Record<string, unknown> => {
+    let raw: string
+    try {
+      raw = fs.readFileSync(file, 'utf-8')
+    } catch {
+      return {} // no such file: genuinely no policy
+    }
     try {
-      return JSON.parse(fs.readFileSync(file, 'utf-8'))
+      const parsed: unknown = JSON.parse(raw)
+      return isRecord(parsed) ? parsed : {}
     } catch {
+      console.warn(`pi-code-mcp: ignoring ${file}: not valid JSON; its MCP server consent and disable lists are not applied`)
       return {}
     }
   }

package/extensions/memory.ts

@@ -243,18 +243,25 @@ function readMemory(dir: string, name: string): MemoryToolResult {
   }
 }
 
-/** The delete action: remove a memory file and its index line, queued on the index
- * like save (single key, no deadlock). The index is read before anything is removed,
- * and any failure (a bad index read, or an unreadable store the queue key cannot
- * realpath) leaves both the memory file and the index as they were. */
+/** The delete action: remove a memory's index line and then its file, queued on the index
+ * like save (single key, no deadlock). The index moves first because it is what the prompt
+ * and /memory show: a failure before it is written leaves both the file and the index as
+ * they were, and a failure after it leaves an orphan file rather than an index line
+ * pointing at a file that is gone. Each outcome is reported as what actually happened. */
 async function deleteMemory(dir: string, indexPath: string, name: string): Promise<MemoryToolResult> {
   try {
     return await withFileMutationQueue(indexPath, async (): Promise<MemoryToolResult> => {
       const index = readIndex(dir)
-      fs.rmSync(path.join(dir, `${name}.md`), { force: true })
       const remaining = removeIndexLine(index, name)
       if (remaining) writeIndex(indexPath, remaining)
       else fs.rmSync(indexPath, { force: true })
+      try {
+        fs.rmSync(path.join(dir, `${name}.md`), { force: true })
+      } catch (error) {
+        // Out of the index, so it is gone from every surface the user sees; saying the
+        // delete failed would be false, and silence would leave the stray file unexplained.
+        return { content: [{ type: 'text', text: `Deleted memory ${name} from the index, but its file could not be removed: ${errorMessage(error)}.` }], details: {} }
+      }
       return { content: [{ type: 'text', text: `Deleted memory ${name}.` }], details: {} }
     })
   } catch (error) {

package/extensions/question.ts

@@ -4,8 +4,11 @@
  * only), or space-toggled checkboxes when `multiSelect` is set. An optional `header`
  * labels the question. Escape in the editor returns to options; Escape in options cancels.
  * Multiple questions per call are not batched; ask sequentially.
+ * On the TUI each question is also offered to a remote responder over pi.events
+ * (REMOTE_QUESTION_CHANNEL); the first answer, local or remote, wins.
  */
 
+import { randomUUID } from 'node:crypto'
 import * as os from 'node:os'
 import * as path from 'node:path'
 import type { ExtensionAPI, ExtensionContext, Theme } from '@earendil-works/pi-coding-agent'
@@ -64,6 +67,26 @@ export interface QuestionSpec {
   multiSelect?: boolean
 }
 
+/** In-process, question-owned offer; arbitrary custom TUI components are not sent. */
+export const REMOTE_QUESTION_CHANNEL = 'pi-code:question:v1'
+export type RemoteQuestionOutcome = { action: 'answer'; indices: number[] } | { action: 'text'; text: string } | { action: 'cancel' } | { action: 'pass' }
+
+export interface RemoteQuestionOffer {
+  version: 1
+  requestId: string
+  sessionId: string
+  question: string
+  header?: string
+  options: OptionWithDesc[]
+  multiSelect: boolean
+  allowFreeText: boolean
+  signal: AbortSignal
+  /** Must be called during event emission; only one listener receives a settle handle. */
+  claim: () => ((outcome: RemoteQuestionOutcome) => boolean) | undefined
+  /** The claimed responder reports input activity to reset a configured idle timer. */
+  touch: () => boolean
+}
+
 /** Normalize either accepted shape into the list of questions to ask. */
 function questionList(params: Partial<QuestionSpec> & { questions?: QuestionSpec[] }): QuestionSpec[] {
   if (params.questions && params.questions.length > 0) return params.questions
@@ -194,19 +217,19 @@ export default function question(pi: ExtensionAPI) {
     // parallel leave the first unanswerable and the run unable to finish.
     executionMode: 'sequential',
 
-    async execute(_toolCallId, rawParams, _signal, _onUpdate, ctx) {
+    async execute(_toolCallId, rawParams, signal, _onUpdate, ctx) {
       const specs = questionList(rawParams as Partial<QuestionSpec> & { questions?: QuestionSpec[] })
       if (specs.length === 0) {
         return { content: [{ type: 'text', text: 'Error: No question provided' }], details: { question: '', options: [], answer: null } as QuestionDetails }
       }
-      if (specs.length === 1) return await askOne(specs[0], ctx)
+      if (specs.length === 1) return await askOne(specs[0], ctx, pi.events, signal)
 
       // Several questions are asked in sequence; a cancel ends the run, since the
       // remaining answers would be guesses about a flow the user just declined.
       const texts: string[] = []
       const collected: QuestionDetails[] = []
       for (const spec of specs) {
-        const result = await askOne(spec, ctx)
+        const result = await askOne(spec, ctx, pi.events, signal)
         const detail = result.details as QuestionDetails
         collected.push(detail)
         texts.push(`${spec.question}\n${result.content[0].text}`)
@@ -258,7 +281,135 @@ export default function question(pi: ExtensionAPI) {
   })
 }
 
-async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ content: Array<{ type: 'text'; text: string }>; details: QuestionDetails }> {
+type QuestionAnswer = Awaited<ReturnType<typeof askViaOverlay>>
+
+/** A claimed offer raced against the open overlay: whichever answers first wins. */
+interface RemoteQuestion {
+  /** Routes remote answers into the overlay and remote activity into its idle timer. */
+  attach: (answer: (value: QuestionAnswer) => void, touch: () => void) => void
+  /** Ends the offer; the responder's settle handle and touch are rejected from then on. */
+  close: () => void
+}
+type RemoteOffer = { kind: 'settled'; value: QuestionAnswer } | { kind: 'claimed'; remote: RemoteQuestion }
+
+function validIndices(indices: unknown, count: number, multiSelect: boolean): indices is number[] {
+  if (!Array.isArray(indices) || (!multiSelect && indices.length !== 1)) return false
+  return new Set(indices).size === indices.length && indices.every((index) => Number.isInteger(index) && index >= 1 && index <= count)
+}
+
+/** A remote outcome as the answer it stands for: null is a cancel, undefined is a
+ * pass or anything this question cannot accept, which must never become an answer. */
+function remoteAnswer(outcome: RemoteQuestionOutcome, options: DisplayOption[], multiSelect: boolean): QuestionAnswer | undefined {
+  if (outcome === null || typeof outcome !== 'object') return undefined
+  if (outcome.action === 'cancel') return null
+  if (outcome.action === 'text') {
+    const text = typeof outcome.text === 'string' ? outcome.text.trim() : ''
+    return !multiSelect && text ? { answer: text, wasCustom: true } : undefined
+  }
+  if (outcome.action !== 'answer') return undefined
+  // Read once and copied, so a getter or Proxy cannot answer with other indices
+  // than the ones that passed validation.
+  const raw: unknown = outcome.indices
+  const indices: unknown = Array.isArray(raw) ? [...raw] : undefined
+  if (!validIndices(indices, options.length, multiSelect)) return undefined
+  const checked = options.map((_, index) => indices.includes(index + 1))
+  return { answer: selectedLabels(options, checked), wasCustom: false, ...(multiSelect ? {} : { index: indices[0] }) }
+}
+
+/** Undefined when nobody claims synchronously, so the overlay opens with no async gap. */
+function offerRemoteQuestion(params: QuestionSpec, allOptions: DisplayOption[], ctx: ExtensionContext, events: ExtensionAPI['events'] | undefined, signal: AbortSignal | undefined): RemoteOffer | undefined {
+  if (!events) return undefined
+  if (signal?.aborted) return { kind: 'settled', value: null }
+
+  const multiSelect = params.multiSelect === true
+  const controller = new AbortController()
+  let claimed = false
+  let early: { value: QuestionAnswer } | undefined
+  let deliver: ((value: QuestionAnswer) => void) | undefined
+  let touchOverlay: (() => void) | undefined
+  const close = (): void => {
+    controller.abort()
+    signal?.removeEventListener('abort', abort)
+  }
+  const settle = (value: QuestionAnswer): void => {
+    close()
+    if (deliver) deliver(value)
+    else early = { value }
+  }
+  // Pi aborts the turn before a session replacement invalidates ctx, so this is
+  // also the session-replacement path; ctx is never read after emission.
+  const abort = (): void => settle(null)
+  signal?.addEventListener('abort', abort, { once: true })
+
+  const offer: RemoteQuestionOffer = {
+    version: 1,
+    requestId: randomUUID(),
+    sessionId: ctx.sessionManager.getSessionId(),
+    question: params.question,
+    header: shortHeader(params.header),
+    options: params.options.map(({ label, description }) => ({ label, ...(description === undefined ? {} : { description }) })),
+    multiSelect,
+    allowFreeText: allOptions.some((option) => option.isOther === true),
+    signal: controller.signal,
+    claim: () => {
+      if (claimed || controller.signal.aborted) return undefined
+      claimed = true
+      return (outcome) => {
+        if (controller.signal.aborted) return false
+        const value = remoteAnswer(outcome, params.options, multiSelect)
+        if (value !== undefined) {
+          settle(value)
+          return true
+        }
+        // A pass or invalid reply only withdraws the remote side; the overlay stays
+        // open, and a turn abort must still cancel it.
+        controller.abort()
+        return outcome?.action === 'pass'
+      }
+    },
+    touch: () => {
+      if (!claimed || controller.signal.aborted) return false
+      touchOverlay?.()
+      return true
+    },
+  }
+
+  events.emit(REMOTE_QUESTION_CHANNEL, offer)
+  if (early) return { kind: 'settled', value: early.value }
+  if (!claimed || controller.signal.aborted) {
+    close()
+    return undefined
+  }
+  return {
+    kind: 'claimed',
+    remote: {
+      attach: (answer, touch) => {
+        deliver = answer
+        touchOverlay = touch
+      },
+      close,
+    },
+  }
+}
+
+/** ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it resolves
+ * undefined immediately, which would read as a cancel without ever asking. Ask
+ * through the dialog primitives there instead. askUserQuestionTimeout is a TUI
+ * concept (a countdown, a keypress resetting it): the dialog-primitive fallback
+ * has no keyboard or visible countdown to drive it, so it is not applied there. */
+async function collectAnswer(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean, events?: ExtensionAPI['events'], signal?: AbortSignal): Promise<QuestionAnswer> {
+  if (ctx.mode !== 'tui') return askViaDialogs(params, ctx, allOptions, multiSelect)
+  const offer = offerRemoteQuestion(params, allOptions, ctx, events, signal)
+  if (offer?.kind === 'settled') return offer.value
+  const remote = offer?.remote
+  try {
+    return await askViaOverlay(params, ctx, allOptions, multiSelect, askUserQuestionTimeoutMs(), remote)
+  } finally {
+    remote?.close()
+  }
+}
+
+async function askOne(params: QuestionSpec, ctx: ExtensionContext, events?: ExtensionAPI['events'], signal?: AbortSignal): Promise<{ content: Array<{ type: 'text'; text: string }>; details: QuestionDetails }> {
   if (!ctx.hasUI) {
     return {
       content: [{ type: 'text', text: 'Error: UI not available (running in non-interactive mode)' }],
@@ -281,12 +432,7 @@ async function askOne(params: QuestionSpec, ctx: ExtensionContext): Promise<{ co
   // The free-text option does not compose with checkbox selection, so it is single-select only.
   const allOptions: DisplayOption[] = multiSelect ? [...params.options] : [...params.options, { label: 'Type something.', isOther: true }]
 
-  // ui.custom() is terminal-only: with a UI but no terminal (RPC mode) it resolves
-  // undefined immediately, which would read as a cancel without ever asking. Ask
-  // through the dialog primitives there instead. askUserQuestionTimeout is a TUI
-  // concept (a countdown, a keypress resetting it): the dialog-primitive fallback
-  // has no keyboard or visible countdown to drive it, so it is not applied there.
-  const result = ctx.mode === 'tui' ? await askViaOverlay(params, ctx, allOptions, multiSelect, askUserQuestionTimeoutMs()) : await askViaDialogs(params, ctx, allOptions, multiSelect)
+  const result = await collectAnswer(params, ctx, allOptions, multiSelect, events, signal)
 
   // Build simple options list for details; header/multiSelect appear only when set,
   // so single-select details are unchanged.
@@ -345,7 +491,7 @@ const IDLE_TICK_MS = 250
  * mechanics are testable directly, independent of where timeoutMs itself is read
  * from (askUserQuestionTimeoutMs, tested separately).
  */
-export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean, timeoutMs?: number): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
+export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOptions: DisplayOption[], multiSelect: boolean, timeoutMs?: number, remote?: RemoteQuestion): Promise<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null> {
   return ctx.ui.custom<{ answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null>((tui: Parameters<Parameters<ExtensionContext['ui']['custom']>[0]>[0], theme: Theme, _kb: unknown, done: (value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null) => void) => {
     let optionIndex = 0
     let editMode = false
@@ -368,6 +514,8 @@ export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOp
      * here, so the interval can never outlive the overlay it belongs to. */
     function finish(value: { answer: string; wasCustom: boolean; index?: number; timedOut?: boolean } | null): void {
       stopIdleTimer()
+      // Closed before done, so a remote reply racing a local answer is rejected.
+      remote?.close()
       done(value)
     }
 
@@ -376,6 +524,8 @@ export function askViaOverlay(params: QuestionSpec, ctx: ExtensionContext, allOp
       deadline = Date.now() + timeoutMs
     }
 
+    remote?.attach(finish, resetIdleTimer)
+
     function fireTimeout(): void {
       // Claude: "submits any options you'd already selected". Single-select has
       // nothing pre-committed (a selection only exists once Enter confirms it), so

package/extensions/subagent/index.ts

@@ -250,11 +250,12 @@ export default function subagentExtension(pi: ExtensionAPI) {
       if (params.tasks?.length) return runParallelMode(params.tasks, mode)
       if (params.agent && params.task) return runSingleMode(params.agent, params.task, params.cwd, mode)
 
-      const available = agents.map((a) => `${a.name} (${a.source})`).join(', ') || 'none'
-      return {
-        content: [{ type: 'text', text: `Invalid parameters. Available agents: ${available}` }],
-        details: makeDetails('single')([]),
-      }
+      // Unreachable: the modeCount guard above returns unless exactly one of these three
+      // is set, and nothing between it and here touches params. It was a second copy of
+      // that guard's message, which no input could ever produce, so a reader had to work
+      // out for themselves that it was dead. Stated as the invariant it actually is, so a
+      // future edit that breaks it says so instead of printing a confusing refusal.
+      throw new Error('subagent: exactly one mode must be set here; the mode guard should have returned')
     },
 
     renderCall(args, theme, _context) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.76",
+  "version": "1.1.0",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, subagents, and goals",
   "keywords": [
     "pi",