pi-code 1.0.8 → 1.0.10

package/extensions/git-checkpoint.ts

@@ -149,6 +149,10 @@ async function restoreConversation(ctx: ExtensionCommandContext, entryId: string
 export default function gitCheckpointExtension(pi: ExtensionAPI) {
   const checkpoints = new Map<string, Checkpoint>()
   let pending: { ref: string; createdAt: string } | undefined
+  // A run (one user message) needs a single pre-run snapshot, no matter how many
+  // assistant turns it drives. before_agent_start starts a run; the first turn_start
+  // then snapshots and clears this, so turns 2..n skip the wasted git work.
+  let runNeedsSnapshot = true
   let shadowDir: string | undefined
   let workTree: string | undefined
 
@@ -258,10 +262,24 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     }
   })
 
-  // Snapshot code state before the LLM acts in this turn. The user message
-  // that started the turn is not persisted yet at turn_start (it lands on
-  // message_end), so the checkpoint is only keyed and saved at turn_end.
+  // A new agent loop starts a run: the next turn_start snapshots the pre-run tree.
+  // agent_start, not before_agent_start: before_agent_start does not fire for a queued
+  // follow-up message delivered through agent.continue, so gating on it would leave that
+  // follow-up's user message with no checkpoint. agent_start re-fires per agent.continue
+  // (a retry, a compaction, or a follow-up), and the extra snapshot a retry produces is
+  // discarded at turn_end, since that user message already has its checkpoint.
+  pi.on('agent_start', async () => {
+    runNeedsSnapshot = true
+  })
+
+  // Snapshot code state before the LLM acts, once per run. The user message that
+  // started the turn is not persisted yet at turn_start (it lands on message_end), so
+  // the checkpoint is only keyed and saved at turn_end. The snapshot is awaited here so
+  // `git add -A` captures the tree before the model's first edit; turn_end reads the
+  // resolved value.
   pi.on('turn_start', async () => {
+    if (!runNeedsSnapshot) return
+    runNeedsSnapshot = false
     pending = await snapshot()
   })
 

package/extensions/hooks.ts

@@ -62,6 +62,7 @@ import * as path from 'node:path'
 import type { Api, Model } from '@earendil-works/pi-ai'
 import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent'
 import { runAgent } from './internal/agent-run.js'
+import { claudeConfigDir } from './internal/config-dir.js'
 import { INSTRUCTIONS_CHANNEL, isInstructionLoadEvent } from './internal/instruction-events.js'
 import { readManagedSettings } from './internal/managed-settings.js'
 import { isMcpToolAliases, MCP_TOOLS_CHANNEL } from './internal/mcp-alias.js'
@@ -83,6 +84,9 @@ const DEFAULT_TIMEOUT_S = 60
 interface HookCommand {
   type?: string
   command: string
+  /** exec-form: spawn `command` directly with these args and no shell (shell-form when
+   * absent). $ARGUMENTS in each arg is replaced with the event JSON. */
+  args?: string[]
   timeout?: number
   /** http entries: the endpoint POSTed to; `command` mirrors it for dedup and display. */
   url?: string
@@ -122,14 +126,15 @@ export interface HookRunResult {
 }
 /** Runs one configured hook entry, whatever its type; boundRunner dispatches. */
 export type HookRunner = (hook: HookCommand, payload: unknown, timeoutMs: number) => Promise<HookRunResult>
-/** The shell path specifically; the statusline reuses it for its own command. */
-export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string) => Promise<HookRunResult>
+/** The shell path specifically; the statusline reuses it for its own command. With an
+ * `args` array it becomes the exec path: `command` is spawned directly with those args. */
+export type HookCommandRunner = (command: string, payload: unknown, timeoutMs: number, projectDir?: string, args?: string[]) => Promise<HookRunResult>
 
 /** Settings files to read, newest-winning. Project files load only when trusted, each
  * the nearest of its name at or above cwd (bounded at the repository root, matching
  * the approval walk), so a subdirectory session reads the settings that gated it. */
 export function hookFiles(cwd: string, home: string, trusted: boolean): string[] {
-  const files = [path.join(home, '.claude', 'settings.json')]
+  const files = [path.join(claudeConfigDir(home), 'settings.json')]
   if (!trusted) return files
   for (const name of ['settings.json', 'settings.local.json']) {
     files.push(findNearestFile(cwd, path.join('.claude', name)) ?? path.join(cwd, '.claude', name))
@@ -260,16 +265,24 @@ function foldName(name: string): string {
   return name.toLowerCase().replaceAll('-', '_')
 }
 
-function exactListApplies(matcher: string, names: readonly string[]): boolean {
-  const tokens = new Set(
+/** A matcher string's compiled form: a set of folded exact names, or a regex. */
+type CompiledMatcher = { tokens: Set<string> } | { regex: RegExp }
+
+function exactTokens(matcher: string): Set<string> {
+  return new Set(
     matcher
       .split(/[|,]/)
       .map((token) => foldName(token.trim()))
       .filter(Boolean),
   )
-  return names.some((name) => tokens.has(foldName(name)))
 }
 
+/** Hook config is static per session and dispatch consults every matcher on every
+ * event, so each matcher string compiles once. Matchers are few; the bound is a
+ * safety net, clearing the (cheap to rebuild) cache rather than evicting. */
+const compiledMatchers = new Map<string, CompiledMatcher>()
+const COMPILED_MATCHER_BOUND = 1000
+
 /** A matcher entry pi-code can run: an object whose `hooks` is a list. Anything else
  * is reported by name and skipped, so one bad entry costs its own hooks, not the
  * session's tool calls. */
@@ -290,15 +303,48 @@ function isUsableMatcher(entry: unknown, file: string, event: string): entry is
   return true
 }
 
+let matcherCompiles = 0
+
+/** Test seam: matcher compilations performed, for asserting memoization. */
+export function matcherCompileCount(): number {
+  return matcherCompiles
+}
+
+/** Test seam: drop compiled matchers so a test observes fresh compiles. */
+export function resetMatcherCache(): void {
+  compiledMatchers.clear()
+  matcherCompiles = 0
+}
+
+function compileMatcher(matcher: string): CompiledMatcher {
+  const cached = compiledMatchers.get(matcher)
+  if (cached !== undefined) return cached
+  matcherCompiles += 1
+  let compiled: CompiledMatcher
+  if (EXACT_MATCHER.test(matcher)) {
+    compiled = { tokens: exactTokens(matcher) }
+  } else {
+    try {
+      compiled = { regex: new RegExp(matcher, 'i') }
+    } catch {
+      // An invalid regex matcher falls back to exact-name matching, as before.
+      compiled = { tokens: exactTokens(matcher) }
+    }
+  }
+  if (compiledMatchers.size >= COMPILED_MATCHER_BOUND) compiledMatchers.clear()
+  compiledMatchers.set(matcher, compiled)
+  return compiled
+}
+
 function matcherApplies(matcher: string | undefined, names: readonly string[]): boolean {
   if (!matcher || matcher === '*') return true
-  if (EXACT_MATCHER.test(matcher)) return exactListApplies(matcher, names)
-  try {
-    const regex = new RegExp(matcher, 'i')
+  const compiled = compileMatcher(matcher)
+  if ('regex' in compiled) {
+    const { regex } = compiled
     return names.some((name) => regex.test(name))
-  } catch {
-    return exactListApplies(matcher, names)
   }
+  const { tokens } = compiled
+  return names.some((name) => tokens.has(foldName(name)))
 }
 
 /** A hook entry pi-code can run: a shell command, an http POST, an in-process
@@ -431,14 +477,23 @@ function killTree(child: ChildProcess): void {
   child.kill('SIGKILL')
 }
 
-export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir) =>
+export const runHookCommand: HookCommandRunner = (command, payload, timeoutMs, projectDir, args) =>
   new Promise((resolve) => {
     // Absolute path so the shell can't be resolved through an attacker-controlled PATH.
     // `detached` makes the shell its own process group leader so the timeout can kill
     // the descendants too. CLAUDE_PROJECT_DIR is Claude's documented way for a hook to
-    // reference project files regardless of the shell's cwd.
-    const env = projectDir ? { ...process.env, CLAUDE_PROJECT_DIR: projectDir } : process.env
-    const child = spawn('/bin/sh', ['-c', command], { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env })
+    // reference project files regardless of the shell's cwd. CLAUDECODE=1 marks every
+    // subprocess Claude spawns, so it is set on the child unconditionally.
+    const env: NodeJS.ProcessEnv = { ...process.env, CLAUDECODE: '1' }
+    if (projectDir) env.CLAUDE_PROJECT_DIR = projectDir
+    // An exec-form hook (an `args` array) spawns the executable directly with those args
+    // and no shell, so shell metacharacters in the args arrive literally; $ARGUMENTS in
+    // each arg is replaced with the event JSON by a replacer function (so $$/$& in the
+    // payload survive verbatim). Without args it stays the shell path. Both share the
+    // same detached process group, so killTree reaches the descendants either way.
+    const file = Array.isArray(args) ? command : '/bin/sh'
+    const spawnArgs = Array.isArray(args) ? args.map((arg) => substituteArguments(arg, payload)) : ['-c', command]
+    const child = spawn(file, spawnArgs, { stdio: ['pipe', 'pipe', 'pipe'], detached: true, env })
     let stdout = ''
     let stderr = ''
     let settled = false
@@ -632,6 +687,18 @@ export function lastAssistantText(messages: ReadonlyArray<{ role: string; conten
   return ''
 }
 
+/** Claude overrides a Stop hook after it blocks this many times in a row with no user
+ * progress, ending the turn with a warning rather than looping forever. */
+const DEFAULT_STOP_HOOK_BLOCK_CAP = 8
+
+/** The consecutive-block cap for the Stop hook: CLAUDE_CODE_STOP_HOOK_BLOCK_CAP when it
+ * is a positive integer, else the default. A non-positive or malformed value falls back
+ * to the default rather than capping at zero (which would suppress the very first block). */
+export function stopHookBlockCap(env: Record<string, string | undefined> = process.env): number {
+  const override = Number.parseInt(env.CLAUDE_CODE_STOP_HOOK_BLOCK_CAP ?? '', 10)
+  return Number.isInteger(override) && override > 0 ? override : DEFAULT_STOP_HOOK_BLOCK_CAP
+}
+
 /** Above 2^31-1 ms Node clamps a timer to 1ms, which would kill the hook instantly. */
 const MAX_TIMEOUT_S = 2_147_483
 
@@ -792,6 +859,9 @@ export default function hooksExtension(pi: ExtensionAPI) {
   let allowedHttpHookUrls: string[] | undefined
   let pendingSessionContext: string[] = []
   let stopHookActive = false
+  /** Consecutive Stop-hook blocks with no user progress between them. Reset on user input
+   * and on a non-blocking Stop; at the cap the continuation is suppressed and the turn ends. */
+  let stopHookBlockCount = 0
   let sessionCtx: ExtensionContext | undefined
   /** Claude's disableAllHooks escape hatch was set somewhere in the honored chain. */
   let hooksDisabled = false
@@ -815,7 +885,7 @@ export default function hooksExtension(pi: ExtensionAPI) {
       if (hook.type === 'prompt') return runPromptHook(hook, merged, ctx.model, ms)
       if (hook.type === 'agent') return runAgentHook(hook, merged, ms, (ctx.model as { id?: string } | undefined)?.id)
       if (hook.type === 'mcp_tool') return runMcpToolHook(hook, merged, ms)
-      return runHookCommand(hook.command, merged, ms, projectDir)
+      return runHookCommand(hook.command, merged, ms, projectDir, hook.args)
     }
   // Claude matchers name MCP tools mcp__<server>__<tool>; pi-code registers them as
   // <server>_<tool>. The mcp extension publishes the mapping on pi's shared bus.
@@ -955,6 +1025,9 @@ export default function hooksExtension(pi: ExtensionAPI) {
     // Only genuine user input; extension-injected messages (plan-mode, subagent) are not
     // prompts the user submitted.
     if (event.source === 'extension') return { action: 'continue' }
+    // Genuine user input is progress, so it breaks a Stop-hook continuation streak: the
+    // block cap counts only consecutive blocks with nothing from the user in between.
+    stopHookBlockCount = 0
     const decision = await runUserPromptSubmit(config, event.text, boundRunner(ctx), (message) => ctx.ui.notify(message, 'warning'))
     if (decision.block) {
       // pi's input result has no reason channel, so surface why before consuming it.
@@ -1007,8 +1080,25 @@ export default function hooksExtension(pi: ExtensionAPI) {
         return { block: false, reason: '' }
       })
       .find((verdict) => verdict.block)
-    stopHookActive = block !== undefined
-    if (block) pi.sendMessage({ customType: 'claude-stop-hook', content: block.reason, display: true }, { triggerTurn: true })
+    if (!block) {
+      // A non-blocking Stop breaks the streak: the next block starts a fresh count.
+      stopHookActive = false
+      stopHookBlockCount = 0
+      return
+    }
+    stopHookBlockCount += 1
+    const cap = stopHookBlockCap()
+    if (stopHookBlockCount >= cap) {
+      // Claude overrides a Stop hook that has blocked cap times in a row with no user
+      // progress: suppress the continuation, warn, and let the turn end so the loop cannot
+      // run forever. Reset the count so a later run (or user turn) starts clean.
+      stopHookActive = false
+      stopHookBlockCount = 0
+      ctx.ui.notify(`Stop hook block cap reached (${cap} consecutive blocks); ending the turn.`, 'warning')
+      return
+    }
+    stopHookActive = true
+    pi.sendMessage({ customType: 'claude-stop-hook', content: block.reason, display: true }, { triggerTurn: true })
   })
 
   pi.on('session_before_compact', async (event, ctx) => {

package/extensions/internal/command-file.ts

@@ -35,7 +35,16 @@ export interface ParsedCommand {
    * command's injected spans run (see spanExec). */
   shell?: string
   model?: string
+  /** `effort:` per-command thinking-level override, one of pi's ThinkingLevel values
+   * (off/minimal/low/medium/high/xhigh/max); undefined when absent or unrecognized. */
+  effort?: string
+  /** `when_to_use:` extra trigger text appended to the slash_command tool listing only,
+   * never to the user-facing command description. */
+  whenToUse?: string
   disableModelInvocation: boolean
+  /** `user-invocable:` false hides the command from the slash-command surface while
+   * keeping it callable by the model through the slash_command tool. Default true. */
+  userInvocable: boolean
   body: string
 }
 
@@ -236,6 +245,15 @@ const text = (value: unknown): string => {
 const YAML_TRUE = new Set(['true', 'yes', 'on', 'y', '1'])
 const isFlagEnabled = (value: unknown): boolean => value === true || YAML_TRUE.has(text(value).toLowerCase())
 
+/** YAML's negative boolean spellings, the mirror of YAML_TRUE. A flag that defaults to
+ * true (user-invocable) is turned off only by one of these; any other value, absent
+ * included, leaves it on, so an unrelated string never silently hides a command. */
+const YAML_FALSE = new Set(['false', 'no', 'off', 'n', '0'])
+const isFlagDisabled = (value: unknown): boolean => value === false || YAML_FALSE.has(text(value).toLowerCase())
+
+/** pi's ThinkingLevel union, the values a command's `effort:` override may name. */
+const THINKING_LEVELS = new Set(['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'])
+
 /** Claude writes `argument-hint: [pr]`, which YAML reads as a list; render it back. */
 const hint = (value: unknown): string => (Array.isArray(value) ? `[${value.join(', ')}]` : text(value))
 
@@ -265,6 +283,7 @@ export function parseCommandFile(content: string): ParsedCommand {
   const disable = frontmatter['disable-model-invocation']
   const grants = parseToolGrants(frontmatter['allowed-tools'])
   const shell = text(frontmatter.shell).toLowerCase()
+  const effort = text(frontmatter.effort).toLowerCase()
   return {
     description: text(frontmatter.description) || firstLine.slice(0, 60),
     argumentHint: hint(frontmatter['argument-hint']) || undefined,
@@ -276,7 +295,11 @@ export function parseCommandFile(content: string): ParsedCommand {
     disallowedTools: parseToolGrants(frontmatter['disallowed-tools'])?.tools,
     shell: SHELLS.has(shell) ? shell : undefined,
     model: text(frontmatter.model) || undefined,
+    // An unrecognized effort is dropped rather than passed to setThinkingLevel.
+    effort: THINKING_LEVELS.has(effort) ? effort : undefined,
+    whenToUse: text(frontmatter.when_to_use) || undefined,
     disableModelInvocation: isFlagEnabled(disable),
+    userInvocable: !isFlagDisabled(frontmatter['user-invocable']),
     body,
   }
 }
@@ -453,7 +476,9 @@ export function spanExec(shell: string | undefined, projectDir: string, script:
   if (shell === 'powershell') {
     const binary = resolveBinary()
     if (binary !== undefined) {
-      const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'`
+      // CLAUDECODE=1 marks every subprocess Claude spawns; pi.exec takes no env, so
+      // it is exported in the script alongside CLAUDE_PROJECT_DIR.
+      const preamble = `$ErrorActionPreference='Continue'\n$env:CLAUDE_PROJECT_DIR='${powershellQuote(projectDir)}'\n$env:CLAUDECODE='1'`
       // No in-script 2>&1: under pwsh 7 it does not merge a native command's
       // stderr on a script block, so mergeStreams has the caller append it. The
       // trailing exit forwards a failed native command's code, which pwsh
@@ -470,7 +495,7 @@ export function spanExec(shell: string | undefined, projectDir: string, script:
   // comment-only span is a hard sh syntax error (exit 2) that aborted the whole
   // invocation, and `:` keeps such a span the harmless no-op it was on HEAD
   // while the group still merges stderr for real spans.
-  return { command: '/bin/sh', args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\n{ :\n${script}\n} 2>&1`] }
+  return { command: '/bin/sh', args: ['-c', `export CLAUDE_PROJECT_DIR='${quoted}'\nexport CLAUDECODE=1\n{ :\n${script}\n} 2>&1`] }
 }
 
 interface FenceBlock {

package/extensions/internal/config-dir.ts

@@ -0,0 +1,24 @@
+/**
+ * CLAUDE_CONFIG_DIR: Claude Code's override for the home configuration directory.
+ *
+ * Claude relocates the entire ~/.claude configuration tree (settings.json, commands,
+ * agents, skills, plugins, output-styles, CLAUDE.md) when CLAUDE_CONFIG_DIR is set,
+ * so a user can keep that config outside their home directory. This resolves the
+ * home-scope config root for every consumer; a project's own `.claude/` directory is
+ * a separate scope and is never affected. A leading `~` expands against `home`, and
+ * the result is resolved to an absolute path so a relative value cannot depend on the
+ * reader's working directory.
+ */
+
+import * as path from 'node:path'
+
+/** The home-scope Claude config directory: CLAUDE_CONFIG_DIR (expanded, absolute)
+ * when set to a non-empty value, otherwise `<home>/.claude`. */
+export function claudeConfigDir(home: string): string {
+  const override = process.env.CLAUDE_CONFIG_DIR
+  if (override && override.trim().length > 0) {
+    const expanded = override.startsWith('~') ? path.join(home, override.slice(1)) : override
+    return path.resolve(expanded)
+  }
+  return path.join(home, '.claude')
+}

package/extensions/internal/path-rules.ts

@@ -132,6 +132,51 @@ function resolveRule(rule: string, anchors: PathAnchors): string {
   return path.join(anchors.cwd, rel)
 }
 
+/** One rule glob precompiled for repeated matching: its anchored regex, and whether
+ * it applies to the basename (a slashless pattern, gitignore-style) or the full
+ * root-relative path. */
+export interface CompiledGlob {
+  regex: RegExp
+  matchesBasename: boolean
+}
+
+let globsCompiled = 0
+let globsEvaluated = 0
+
+/** Test seam: cumulative compiled-glob work, for asserting that callers compile
+ * each glob once upfront and stop evaluating rules that no longer apply. */
+export function globCompileStats(): { compiled: number; evaluated: number } {
+  return { compiled: globsCompiled, evaluated: globsEvaluated }
+}
+
+/** Rule `paths:` globs compiled once for repeated matching, with claude-rules'
+ * pathMatchesGlobs semantics: `./` and leading `/` anchors are stripped, a trailing
+ * slash scopes to the directory's contents, and blank entries drop out. */
+export function compileGlobs(globs: string[]): CompiledGlob[] {
+  const compiled: CompiledGlob[] = []
+  for (const raw of globs) {
+    let glob = raw.trim()
+    if (!glob) continue
+    if (glob.startsWith('./')) glob = glob.slice(2)
+    else if (glob.startsWith('/')) glob = glob.slice(1)
+    // A trailing slash means the directory's contents, like gitignore; `docs/` alone
+    // would compile to `^docs/$` and match nothing.
+    if (glob.endsWith('/')) glob += '**'
+    globsCompiled += 1
+    compiled.push({ regex: new RegExp(`^${globToRegExpSource(glob)}$`), matchesBasename: !glob.includes('/') })
+  }
+  return compiled
+}
+
+/** Whether a root-relative path matches at least one compiled glob. No globs means
+ * no match. */
+export function matchesCompiledGlobs(relPath: string, globs: CompiledGlob[]): boolean {
+  globsEvaluated += 1
+  const posix = relPath.split(path.sep).join('/')
+  const base = posix.split('/').pop() ?? posix
+  return globs.some((glob) => glob.regex.test(glob.matchesBasename ? base : posix))
+}
+
 /** Whether the accessed file matches at least one rule. No rules means no match:
  * a granted-but-scoped tool with an empty scope set stays blocked, never open. */
 export function matchesPathRules(filePath: string, rules: string[], anchors: PathAnchors): boolean {

package/extensions/internal/plugins.ts

@@ -15,6 +15,8 @@
 import * as fs from 'node:fs'
 import * as path from 'node:path'
 
+import { claudeConfigDir } from './config-dir.js'
+
 export interface InstalledPlugin {
   name: string
   /** The version directory: ${CLAUDE_PLUGIN_ROOT}. */
@@ -90,16 +92,70 @@ function pluginConfigsMap(settingsFiles: string[]): Record<string, Record<string
   return merged
 }
 
+/** Memoized discovery per (home, extra settings files), revalidated by fingerprint. */
+const pluginCache = new Map<string, { fingerprint: string; plugins: InstalledPlugin[] }>()
+
+/** Drop every memoized discovery; the next installedPlugins call walks afresh. */
+export function resetInstalledPluginsCache(): void {
+  pluginCache.clear()
+}
+
+/** mtime plus size, so a same-instant rewrite with different content still differs. */
+function statToken(target: string): string {
+  try {
+    const stat = fs.statSync(target)
+    return `${stat.mtimeMs}:${stat.size}`
+  } catch {
+    return 'missing'
+  }
+}
+
+/**
+ * A cheap change signature for one home's plugin config: the settings files' stat
+ * tokens plus the cache tree's directory names and mtimes down through each plugin's
+ * version directories, and the stat token of the resolved (newest) version's manifest
+ * so an in-place edit of it invalidates the cache. Costs a few stats where the full
+ * walk reads and parses the settings and every manifest.
+ */
+function pluginFingerprint(cacheDir: string, settingsFiles: string[]): string {
+  const parts = settingsFiles.map(statToken)
+  for (const marketplace of listDirs(cacheDir)) {
+    const marketplaceDir = path.join(cacheDir, marketplace)
+    parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
+    for (const pluginDir of listDirs(marketplaceDir)) {
+      const pluginPath = path.join(marketplaceDir, pluginDir)
+      parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
+      const versions = listDirs(pluginPath)
+      for (const version of versions) {
+        parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
+      }
+      // resolvePlugin reads only the newest version's manifest, so its stat token is
+      // what an in-place edit (no directory entry changing) must move.
+      const newest = newestVersion(versions)
+      if (newest) parts.push(`${marketplace}/${pluginDir}/${newest}/manifest:${statToken(path.join(pluginPath, newest, '.claude-plugin', 'plugin.json'))}`)
+    }
+  }
+  return parts.join('\n')
+}
+
 /**
  * Enabled plugins from the cache. Enablement is decided by the user's own
  * settings only: plugins install to the user's machine and carry code (hook
  * scripts, MCP server commands), so a checked-out repo must not be able to flip
  * which of them run. `extraSettingsFiles`, when given, are additional
  * user-controlled settings sources, not project files.
+ *
+ * Several extensions call this at session start and per discovery, so the walk
+ * is memoized behind the fingerprint above; callers always see current data
+ * because any settings edit or cache-tree change invalidates it.
  */
 export function installedPlugins(home: string, extraSettingsFiles: string[] = []): InstalledPlugin[] {
-  const cacheDir = path.join(home, '.claude', 'plugins', 'cache')
-  const settingsFiles = [path.join(home, '.claude', 'settings.json'), ...extraSettingsFiles]
+  const cacheDir = path.join(claudeConfigDir(home), 'plugins', 'cache')
+  const settingsFiles = [path.join(claudeConfigDir(home), 'settings.json'), ...extraSettingsFiles]
+  const key = [home, ...extraSettingsFiles].join('\n')
+  const fingerprint = pluginFingerprint(cacheDir, settingsFiles)
+  const cached = pluginCache.get(key)
+  if (cached?.fingerprint === fingerprint) return cached.plugins
   const enabled = enabledMap(settingsFiles)
   const configs = pluginConfigsMap(settingsFiles)
   const plugins: InstalledPlugin[] = []
@@ -109,6 +165,7 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
       if (plugin) plugins.push(plugin)
     }
   }
+  pluginCache.set(key, { fingerprint, plugins })
   return plugins
 }
 
@@ -125,7 +182,7 @@ function resolvePlugin(home: string, cacheDir: string, marketplace: string, plug
   const name = typeof manifest.name === 'string' && manifest.name.length > 0 ? manifest.name : pluginDir
   const id = qualified.replace(/[^A-Za-z0-9]+/g, '-')
   const userConfig = configs[qualified] ?? configs[pluginDir] ?? configs[name]
-  return { name, root, dataDir: path.join(home, '.claude', 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) }
+  return { name, root, dataDir: path.join(claudeConfigDir(home), 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) }
 }
 
 /** The two plugin path variables, textually substituted into plugin-shipped