pi-code 1.0.8 → 1.0.9

package/extensions/claude-rules.ts

@@ -22,7 +22,7 @@ import * as path from 'node:path'
 import type { ExtensionAPI } from '@earendil-works/pi-coding-agent'
 
 import { publishInstructionLoad } from './internal/instruction-events.js'
-import { globToRegExpSource } from './internal/path-rules.js'
+import { type CompiledGlob, compileGlobs, matchesCompiledGlobs } from './internal/path-rules.js'
 import { isProjectApproved } from './internal/project-approval.js'
 import { findNearestDir } from './internal/project-root.js'
 import { stripBlockComments } from './internal/strip-comments.js'
@@ -81,19 +81,7 @@ export function parseFrontmatter(content: string): Frontmatter {
  * the rule set's root.
  */
 export function pathMatchesGlobs(relPath: string, globs: string[]): boolean {
-  const posix = relPath.split(path.sep).join('/')
-  const base = posix.split('/').pop() ?? posix
-  return globs.some((raw) => {
-    let glob = raw.trim()
-    if (!glob) return false
-    if (glob.startsWith('./')) glob = glob.slice(2)
-    else if (glob.startsWith('/')) glob = glob.slice(1)
-    // A trailing slash means the directory's contents, like gitignore; `docs/` alone
-    // would compile to `^docs/$` and match nothing.
-    if (glob.endsWith('/')) glob += '**'
-    const target = glob.includes('/') ? posix : base
-    return new RegExp(`^${globToRegExpSource(glob)}$`).test(target)
-  })
+  return matchesCompiledGlobs(relPath, compileGlobs(globs))
 }
 
 /** A rule pointer line, annotated with its path scope when present. */
@@ -199,8 +187,10 @@ function rulesSection(title: string, rules: RuleSet, base: string): string {
 
 /** A scoped rule resolved to the root its globs match against, ready to attach. */
 interface AttachTarget {
-  key: string
+  /** The rule's `paths:` globs as written, reported on the instruction-events bus. */
   globs: string[]
+  /** The globs precompiled once at session start for the per-tool-result scan. */
+  compiled: CompiledGlob[]
   body: string
   /** The absolute directory `paths:` globs are matched relative to. */
   root: string
@@ -210,6 +200,15 @@ interface AttachTarget {
   memoryType: 'User' | 'Project'
 }
 
+// Module level because the working list lives in each extension instance's closure.
+let pendingScopedRules = 0
+
+/** Test seam: scoped rules still awaiting attachment in the current session, for
+ * asserting that a fully attached rule leaves the per-tool-result working list. */
+export function pendingScopedRuleCount(): number {
+  return pendingScopedRules
+}
+
 export default function claudeRulesExtension(pi: ExtensionAPI) {
   const globalRulesDir = path.join(os.homedir(), '.claude', 'rules')
   let globalRules: RuleSet = EMPTY_RULES
@@ -218,10 +217,9 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
   // The project rules dir may sit at an ancestor of cwd, where a cwd-relative
   // '.claude/rules' would point the read at a path that does not exist.
   let projectRulesBase = '.claude/rules'
-  // Scoped rules ready to attach when a matching file is touched, and the set of
-  // rules already attached this session so each attaches at most once.
+  // Scoped rules still awaiting a matching touch. An attached rule leaves the
+  // list, so each attaches at most once and the per-tool-result scan shrinks.
   let attachTargets: AttachTarget[] = []
-  const attached = new Set<string>()
 
   pi.on('session_start', async (_event, ctx) => {
     globalRules = readRules(globalRulesDir)
@@ -236,13 +234,14 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
 
     // Global globs are relative to cwd; project globs to the project root (the dir
     // holding .claude), so `db/**` in a repo rule matches repo-relative paths even
-    // from a subdirectory session. Reset per session so a re-run re-attaches.
-    attached.clear()
+    // from a subdirectory session. Globs compile here, once per session, rather
+    // than on every tool result; rebuilt per session so a re-run re-attaches.
     const projectRoot = projectRulesDir ? path.dirname(path.dirname(projectRulesDir)) : ctx.cwd
     attachTargets = [
-      ...globalRules.scoped.map((rule) => ({ key: `global:${rule.rel}`, globs: rule.paths, body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
-      ...projectRules.scoped.map((rule) => ({ key: `project:${rule.rel}`, globs: rule.paths, body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
+      ...globalRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: ctx.cwd, file: path.join(globalRulesDir, rule.rel), memoryType: 'User' as const })),
+      ...projectRules.scoped.map((rule) => ({ globs: rule.paths, compiled: compileGlobs(rule.paths), body: rule.body, root: projectRoot, file: path.join(projectRulesDir ?? path.join(ctx.cwd, '.claude', 'rules'), rule.rel), memoryType: 'Project' as const })),
     ]
+    pendingScopedRules = attachTargets.length
     // Relative to cwd, which the read tool resolves: an ancestor dir yields a
     // `../…/.claude/rules` the model can follow, where a bare '.claude/rules'
     // would point at a nonexistent path under the subdirectory.
@@ -277,21 +276,25 @@ export default function claudeRulesExtension(pi: ExtensionAPI) {
     const abs = path.resolve(ctx.cwd, rel)
 
     const bodies: string[] = []
+    const remaining: AttachTarget[] = []
     for (const target of attachTargets) {
-      if (attached.has(target.key)) continue
       const relativeToRoot = path.relative(target.root, abs)
       // A file outside the rule root cannot match its project-relative globs. Test for
       // a real parent-traversal segment, not a leading '..' (a file named `..config` is
       // inside the root).
-      if (relativeToRoot === '..' || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)) continue
-      if (!pathMatchesGlobs(relativeToRoot, target.globs)) continue
-      attached.add(target.key)
+      const outsideRoot = relativeToRoot === '..' || relativeToRoot.startsWith(`..${path.sep}`) || path.isAbsolute(relativeToRoot)
+      if (outsideRoot || !matchesCompiledGlobs(relativeToRoot, target.compiled)) {
+        remaining.push(target)
+        continue
+      }
       bodies.push(target.body)
       // The lazy attach is Claude's path_glob_match instruction load; the hooks
-      // extension bridges the bus event to the InstructionsLoaded hook. The
-      // once-per-session attach set above also bounds the events to one per rule.
+      // extension bridges the bus event to the InstructionsLoaded hook. Leaving
+      // the working list also bounds the events to one per rule per session.
       publishInstructionLoad(pi.events, { file_path: target.file, memory_type: target.memoryType, load_reason: 'path_glob_match', globs: target.globs, trigger_file_path: abs })
     }
+    attachTargets = remaining
+    pendingScopedRules = attachTargets.length
     if (bodies.length === 0) return
     return { content: [...event.content, ...bodies.map((text) => ({ type: 'text' as const, text }))] }
   })

package/extensions/context-imports.ts

@@ -52,6 +52,7 @@
  * Docs: https://code.claude.com/docs/en/memory.md (imports)
  */
 
+import { createHash } from 'node:crypto'
 import * as fs from 'node:fs'
 import * as os from 'node:os'
 import * as path from 'node:path'
@@ -507,6 +508,81 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     publishInstructionLoad(pi.events, event)
   }
 
+  // before_agent_start fires every turn, but its inputs almost never change
+  // mid-session. The settings-derived environment (managed settings, exclude
+  // globs, repo root) is cached per cwd, and the whole import expansion is
+  // memoized on its inputs and revalidated by a stat token (mtime and size): a
+  // turn where nothing changed costs a handful of stats instead of re-reading and
+  // re-recursing every @import. A brand-new file satisfying a previously missing
+  // @import is picked up when any recorded stat token moves (or next session),
+  // which is already fresher than Claude, which loads context once at session start.
+  let envCache: { cwd: string; managed: Record<string, unknown>; excludeGlobs: string[]; projectRoot: string } | undefined
+  let importMemo:
+    | {
+        key: string
+        extras: Array<{ path: string; content: string; dir: string }>
+        imported: ImportedFile[]
+        budget: ImportBudget
+        tokens: Array<[string, string]>
+      }
+    | undefined
+  // mtime plus size, so a same-mtime rewrite of a different length still invalidates.
+  const statToken = (file: string): string => {
+    const stat = fs.statSync(file)
+    return `${stat.mtimeMs}:${stat.size}`
+  }
+  const memoIsFresh = (memo: NonNullable<typeof importMemo>): boolean => {
+    try {
+      return memo.tokens.every(([file, token]) => statToken(file) === token)
+    } catch {
+      return false // a recorded file vanished: re-expand
+    }
+  }
+  // Memo lookup or recompute: a turn whose key matches the previous expansion and
+  // whose recorded stat tokens are all unchanged reuses that expansion outright;
+  // otherwise the imports are re-expanded and the memo (with a fresh revalidation
+  // set) is rebuilt for next turn.
+  const resolveImports = (
+    memoKey: string,
+    native: Array<{ path: string; content: string }>,
+    contextFiles: Array<{ path: string; content: string }>,
+    home: string,
+    cwd: string,
+    excluded: (absPath: string) => boolean,
+  ): { extras: Array<{ path: string; content: string; dir: string }>; budget: ImportBudget; imported: ImportedFile[] } => {
+    if (importMemo?.key === memoKey && memoIsFresh(importMemo)) {
+      const { extras, budget, imported } = importMemo
+      return { extras, budget, imported }
+    }
+    // Seed with every loaded context file path, excluded ones included, so pi's own
+    // files are never re-imported and an excluded file cannot return as an import.
+    const seenSet = new Set(realRoots([...native, ...localContexts].map((file) => file.path)))
+
+    // Claude's --add-dir memory loading, env-gated. The files join the seen set
+    // before import expansion so an @import cannot pull one in twice, and they get
+    // the same exclude and comment-strip treatment as native context files.
+    const addDirs = additionalDirsClaudeMdEnabled() ? parseAdditionalDirs(pi.getFlag?.('add-dir'), home, cwd) : []
+    const extras = additionalDirExtras(addDirs, seenSet, excluded, projectApproved)
+
+    // One budget for the whole run, so N context files cannot each spend a full one.
+    // Exclusion applies inside the recursion: an excluded @import is skipped before
+    // it is read, so its transitive imports never load and it spends no budget.
+    const budget = createImportBudget()
+    const imported = expandImports(contextFiles, extras, home, cwd, seenSet, excluded, budget)
+
+    // Revalidation set: every file the expansion read, plus each add-dir itself
+    // (a directory's mtime moves when a memory file is added or removed there).
+    const tokens: Array<[string, string]> = []
+    try {
+      for (const file of [...extras.map((extra) => extra.path), ...imported.map((entry) => entry.path)]) tokens.push([file, statToken(file)])
+      for (const dir of addDirs) tokens.push([dir, statToken(dir)])
+      importMemo = { key: memoKey, extras, budget, imported, tokens }
+    } catch {
+      importMemo = undefined // a file moved mid-expansion: just recompute next turn
+    }
+    return { extras, budget, imported }
+  }
+
   // Claude's --add-dir. Only the memory-loading half is meaningful here: pi has
   // no path-based permission system, so there is no access grant to mirror.
   // Optional-called so the extension still wires under stub hosts without flags.
@@ -520,6 +596,8 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     // a reload anyway; a reload simply re-fires InstructionsLoaded once per file,
     // which is fine, since a reload re-loads the instruction files.
     announced.clear()
+    envCache = undefined
+    importMemo = undefined
     // CLAUDE.local.md is Claude Code's personal sidecar of CLAUDE.md; pi's own loader
     // skips it. A cloned repo can ship one, so it is gated like other project config.
     // Claude loads local context from the whole hierarchy above the working
@@ -545,10 +623,12 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const cwd = event.systemPromptOptions?.cwd ?? process.cwd()
     const native: Array<{ path: string; content: string }> = event.systemPromptOptions?.contextFiles ?? []
 
-    const managed = readManagedSettings()
-    const excludeGlobs = readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managed)
+    if (envCache?.cwd !== cwd) {
+      const managedNow = readManagedSettings()
+      envCache = { cwd, managed: managedNow, excludeGlobs: readClaudeMdExcludes(claudeMdExcludeFiles(cwd, home, projectApproved), managedNow), projectRoot: repoRoot(cwd) ?? cwd }
+    }
+    const { managed, excludeGlobs, projectRoot } = envCache
     const excluded = (absPath: string): boolean => isExcludedPath(absPath, excludeGlobs, home)
-    const projectRoot = repoRoot(cwd) ?? cwd
 
     // claudeMdExcludes drops an excluded file's block from the assembled prompt and
     // from import expansion; surviving blocks get block-level comments stripped.
@@ -575,21 +655,16 @@ export default function contextImportsExtension(pi: ExtensionAPI) {
     const keptLocals = localContexts.filter((local) => !excluded(local.path)).map((local) => ({ path: local.path, content: stripBlockComments(local.content) }))
     const contextFiles = [...rewrite.kept, ...keptLocals]
 
-    // Seed with every loaded context file path, excluded ones included, so pi's own
-    // files are never re-imported and an excluded file cannot return as an import.
-    const seenSet = new Set(realRoots([...native, ...localContexts].map((file) => file.path)))
+    // Everything the expansion depends on, hashed: a turn whose inputs match the memo
+    // and whose recorded mtimes are unchanged reuses the previous expansion outright.
+    const addDirsRaw = additionalDirsClaudeMdEnabled() ? String(pi.getFlag?.('add-dir') ?? '') : ''
+    const keyHash = createHash('sha256')
+    keyHash.update(`${cwd}\0${home}\0${projectApproved}\0${addDirsRaw}\0${excludeGlobs.join(',')}\0`)
+    for (const file of [...native, ...localContexts]) keyHash.update(`${file.path}\0`)
+    for (const file of contextFiles) keyHash.update(`${file.path}\0${file.content}\0`)
+    const memoKey = keyHash.digest('hex')
 
-    // Claude's --add-dir memory loading, env-gated. The files join the seen set
-    // before import expansion so an @import cannot pull one in twice, and they get
-    // the same exclude and comment-strip treatment as native context files.
-    const addDirs = additionalDirsClaudeMdEnabled() ? parseAdditionalDirs(pi.getFlag?.('add-dir'), home, cwd) : []
-    const extras = additionalDirExtras(addDirs, seenSet, excluded, projectApproved)
-
-    // One budget for the whole run, so N context files cannot each spend a full one.
-    // Exclusion applies inside the recursion: an excluded @import is skipped before
-    // it is read, so its transitive imports never load and it spends no budget.
-    const budget = createImportBudget()
-    const imported = expandImports(contextFiles, extras, home, cwd, seenSet, excluded, budget)
+    const { extras, budget, imported } = resolveImports(memoKey, native, contextFiles, home, cwd, excluded)
 
     let addition = localContextAddition(keptLocals, announce)
     addition += additionalDirsAddition(extras, announce)

package/extensions/git-checkpoint.ts

@@ -149,6 +149,10 @@ async function restoreConversation(ctx: ExtensionCommandContext, entryId: string
 export default function gitCheckpointExtension(pi: ExtensionAPI) {
   const checkpoints = new Map<string, Checkpoint>()
   let pending: { ref: string; createdAt: string } | undefined
+  // A run (one user message) needs a single pre-run snapshot, no matter how many
+  // assistant turns it drives. before_agent_start starts a run; the first turn_start
+  // then snapshots and clears this, so turns 2..n skip the wasted git work.
+  let runNeedsSnapshot = true
   let shadowDir: string | undefined
   let workTree: string | undefined
 
@@ -258,10 +262,24 @@ export default function gitCheckpointExtension(pi: ExtensionAPI) {
     }
   })
 
-  // Snapshot code state before the LLM acts in this turn. The user message
-  // that started the turn is not persisted yet at turn_start (it lands on
-  // message_end), so the checkpoint is only keyed and saved at turn_end.
+  // A new agent loop starts a run: the next turn_start snapshots the pre-run tree.
+  // agent_start, not before_agent_start: before_agent_start does not fire for a queued
+  // follow-up message delivered through agent.continue, so gating on it would leave that
+  // follow-up's user message with no checkpoint. agent_start re-fires per agent.continue
+  // (a retry, a compaction, or a follow-up), and the extra snapshot a retry produces is
+  // discarded at turn_end, since that user message already has its checkpoint.
+  pi.on('agent_start', async () => {
+    runNeedsSnapshot = true
+  })
+
+  // Snapshot code state before the LLM acts, once per run. The user message that
+  // started the turn is not persisted yet at turn_start (it lands on message_end), so
+  // the checkpoint is only keyed and saved at turn_end. The snapshot is awaited here so
+  // `git add -A` captures the tree before the model's first edit; turn_end reads the
+  // resolved value.
   pi.on('turn_start', async () => {
+    if (!runNeedsSnapshot) return
+    runNeedsSnapshot = false
     pending = await snapshot()
   })
 

package/extensions/hooks.ts

@@ -260,16 +260,24 @@ function foldName(name: string): string {
   return name.toLowerCase().replaceAll('-', '_')
 }
 
-function exactListApplies(matcher: string, names: readonly string[]): boolean {
-  const tokens = new Set(
+/** A matcher string's compiled form: a set of folded exact names, or a regex. */
+type CompiledMatcher = { tokens: Set<string> } | { regex: RegExp }
+
+function exactTokens(matcher: string): Set<string> {
+  return new Set(
     matcher
       .split(/[|,]/)
       .map((token) => foldName(token.trim()))
       .filter(Boolean),
   )
-  return names.some((name) => tokens.has(foldName(name)))
 }
 
+/** Hook config is static per session and dispatch consults every matcher on every
+ * event, so each matcher string compiles once. Matchers are few; the bound is a
+ * safety net, clearing the (cheap to rebuild) cache rather than evicting. */
+const compiledMatchers = new Map<string, CompiledMatcher>()
+const COMPILED_MATCHER_BOUND = 1000
+
 /** A matcher entry pi-code can run: an object whose `hooks` is a list. Anything else
  * is reported by name and skipped, so one bad entry costs its own hooks, not the
  * session's tool calls. */
@@ -290,15 +298,48 @@ function isUsableMatcher(entry: unknown, file: string, event: string): entry is
   return true
 }
 
+let matcherCompiles = 0
+
+/** Test seam: matcher compilations performed, for asserting memoization. */
+export function matcherCompileCount(): number {
+  return matcherCompiles
+}
+
+/** Test seam: drop compiled matchers so a test observes fresh compiles. */
+export function resetMatcherCache(): void {
+  compiledMatchers.clear()
+  matcherCompiles = 0
+}
+
+function compileMatcher(matcher: string): CompiledMatcher {
+  const cached = compiledMatchers.get(matcher)
+  if (cached !== undefined) return cached
+  matcherCompiles += 1
+  let compiled: CompiledMatcher
+  if (EXACT_MATCHER.test(matcher)) {
+    compiled = { tokens: exactTokens(matcher) }
+  } else {
+    try {
+      compiled = { regex: new RegExp(matcher, 'i') }
+    } catch {
+      // An invalid regex matcher falls back to exact-name matching, as before.
+      compiled = { tokens: exactTokens(matcher) }
+    }
+  }
+  if (compiledMatchers.size >= COMPILED_MATCHER_BOUND) compiledMatchers.clear()
+  compiledMatchers.set(matcher, compiled)
+  return compiled
+}
+
 function matcherApplies(matcher: string | undefined, names: readonly string[]): boolean {
   if (!matcher || matcher === '*') return true
-  if (EXACT_MATCHER.test(matcher)) return exactListApplies(matcher, names)
-  try {
-    const regex = new RegExp(matcher, 'i')
+  const compiled = compileMatcher(matcher)
+  if ('regex' in compiled) {
+    const { regex } = compiled
     return names.some((name) => regex.test(name))
-  } catch {
-    return exactListApplies(matcher, names)
   }
+  const { tokens } = compiled
+  return names.some((name) => tokens.has(foldName(name)))
 }
 
 /** A hook entry pi-code can run: a shell command, an http POST, an in-process

package/extensions/internal/path-rules.ts

@@ -132,6 +132,51 @@ function resolveRule(rule: string, anchors: PathAnchors): string {
   return path.join(anchors.cwd, rel)
 }
 
+/** One rule glob precompiled for repeated matching: its anchored regex, and whether
+ * it applies to the basename (a slashless pattern, gitignore-style) or the full
+ * root-relative path. */
+export interface CompiledGlob {
+  regex: RegExp
+  matchesBasename: boolean
+}
+
+let globsCompiled = 0
+let globsEvaluated = 0
+
+/** Test seam: cumulative compiled-glob work, for asserting that callers compile
+ * each glob once upfront and stop evaluating rules that no longer apply. */
+export function globCompileStats(): { compiled: number; evaluated: number } {
+  return { compiled: globsCompiled, evaluated: globsEvaluated }
+}
+
+/** Rule `paths:` globs compiled once for repeated matching, with claude-rules'
+ * pathMatchesGlobs semantics: `./` and leading `/` anchors are stripped, a trailing
+ * slash scopes to the directory's contents, and blank entries drop out. */
+export function compileGlobs(globs: string[]): CompiledGlob[] {
+  const compiled: CompiledGlob[] = []
+  for (const raw of globs) {
+    let glob = raw.trim()
+    if (!glob) continue
+    if (glob.startsWith('./')) glob = glob.slice(2)
+    else if (glob.startsWith('/')) glob = glob.slice(1)
+    // A trailing slash means the directory's contents, like gitignore; `docs/` alone
+    // would compile to `^docs/$` and match nothing.
+    if (glob.endsWith('/')) glob += '**'
+    globsCompiled += 1
+    compiled.push({ regex: new RegExp(`^${globToRegExpSource(glob)}$`), matchesBasename: !glob.includes('/') })
+  }
+  return compiled
+}
+
+/** Whether a root-relative path matches at least one compiled glob. No globs means
+ * no match. */
+export function matchesCompiledGlobs(relPath: string, globs: CompiledGlob[]): boolean {
+  globsEvaluated += 1
+  const posix = relPath.split(path.sep).join('/')
+  const base = posix.split('/').pop() ?? posix
+  return globs.some((glob) => glob.regex.test(glob.matchesBasename ? base : posix))
+}
+
 /** Whether the accessed file matches at least one rule. No rules means no match:
  * a granted-but-scoped tool with an empty scope set stays blocked, never open. */
 export function matchesPathRules(filePath: string, rules: string[], anchors: PathAnchors): boolean {

package/extensions/internal/plugins.ts

@@ -90,16 +90,70 @@ function pluginConfigsMap(settingsFiles: string[]): Record<string, Record<string
   return merged
 }
 
+/** Memoized discovery per (home, extra settings files), revalidated by fingerprint. */
+const pluginCache = new Map<string, { fingerprint: string; plugins: InstalledPlugin[] }>()
+
+/** Drop every memoized discovery; the next installedPlugins call walks afresh. */
+export function resetInstalledPluginsCache(): void {
+  pluginCache.clear()
+}
+
+/** mtime plus size, so a same-instant rewrite with different content still differs. */
+function statToken(target: string): string {
+  try {
+    const stat = fs.statSync(target)
+    return `${stat.mtimeMs}:${stat.size}`
+  } catch {
+    return 'missing'
+  }
+}
+
+/**
+ * A cheap change signature for one home's plugin config: the settings files' stat
+ * tokens plus the cache tree's directory names and mtimes down through each plugin's
+ * version directories, and the stat token of the resolved (newest) version's manifest
+ * so an in-place edit of it invalidates the cache. Costs a few stats where the full
+ * walk reads and parses the settings and every manifest.
+ */
+function pluginFingerprint(cacheDir: string, settingsFiles: string[]): string {
+  const parts = settingsFiles.map(statToken)
+  for (const marketplace of listDirs(cacheDir)) {
+    const marketplaceDir = path.join(cacheDir, marketplace)
+    parts.push(`${marketplace}:${statToken(marketplaceDir)}`)
+    for (const pluginDir of listDirs(marketplaceDir)) {
+      const pluginPath = path.join(marketplaceDir, pluginDir)
+      parts.push(`${marketplace}/${pluginDir}:${statToken(pluginPath)}`)
+      const versions = listDirs(pluginPath)
+      for (const version of versions) {
+        parts.push(`${marketplace}/${pluginDir}/${version}:${statToken(path.join(pluginPath, version))}`)
+      }
+      // resolvePlugin reads only the newest version's manifest, so its stat token is
+      // what an in-place edit (no directory entry changing) must move.
+      const newest = newestVersion(versions)
+      if (newest) parts.push(`${marketplace}/${pluginDir}/${newest}/manifest:${statToken(path.join(pluginPath, newest, '.claude-plugin', 'plugin.json'))}`)
+    }
+  }
+  return parts.join('\n')
+}
+
 /**
  * Enabled plugins from the cache. Enablement is decided by the user's own
  * settings only: plugins install to the user's machine and carry code (hook
  * scripts, MCP server commands), so a checked-out repo must not be able to flip
  * which of them run. `extraSettingsFiles`, when given, are additional
  * user-controlled settings sources, not project files.
+ *
+ * Several extensions call this at session start and per discovery, so the walk
+ * is memoized behind the fingerprint above; callers always see current data
+ * because any settings edit or cache-tree change invalidates it.
  */
 export function installedPlugins(home: string, extraSettingsFiles: string[] = []): InstalledPlugin[] {
   const cacheDir = path.join(home, '.claude', 'plugins', 'cache')
   const settingsFiles = [path.join(home, '.claude', 'settings.json'), ...extraSettingsFiles]
+  const key = [home, ...extraSettingsFiles].join('\n')
+  const fingerprint = pluginFingerprint(cacheDir, settingsFiles)
+  const cached = pluginCache.get(key)
+  if (cached?.fingerprint === fingerprint) return cached.plugins
   const enabled = enabledMap(settingsFiles)
   const configs = pluginConfigsMap(settingsFiles)
   const plugins: InstalledPlugin[] = []
@@ -109,6 +163,7 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
       if (plugin) plugins.push(plugin)
     }
   }
+  pluginCache.set(key, { fingerprint, plugins })
   return plugins
 }
 

package/extensions/mcp.ts

@@ -649,6 +649,23 @@ type HttpFamilyTransport = SSEClientTransport | StreamableHTTPClientTransport //
 
 type MakeTransport = (authProvider?: OAuthClientProvider) => HttpFamilyTransport
 
+/** Interactive OAuth logins block on a confirm dialog and open a browser tab, so two
+ * at once (a user-scope and a consented project-scope server both 401ing, connecting in
+ * parallel) would stack dialogs and browser tabs. This chains them so a second
+ * interactive login waits for the first to settle; the tail is reset to a resolved
+ * promise regardless of outcome, so a failed login never poisons the queue. Silent
+ * (stored-token) connects do not pass through here and stay fully parallel. */
+let oauthQueue: Promise<unknown> = Promise.resolve()
+
+function serializeInteractiveOAuth<T>(run: () => Promise<T>): Promise<T> {
+  const result = oauthQueue.then(run, run)
+  oauthQueue = result.then(
+    () => {},
+    () => {},
+  )
+  return result
+}
+
 /**
  * Connect an http-family server, running Claude's OAuth login when the server
  * demands one. Stored tokens ride the first attempt so the SDK refreshes
@@ -671,7 +688,7 @@ async function connectHttpFamily(name: string, config: { url: string }, makeTran
   } catch (error) {
     if (bearerToken || !isUnauthorized(error)) throw error
     if (!authUi) throw new OAuthRequiredError(`${name} requires a login; run pi interactively to authenticate`)
-    return await runInteractiveOAuth(name, config, makeTransport, label, authUi, newClient)
+    return await serializeInteractiveOAuth(() => runInteractiveOAuth(name, config, makeTransport, label, authUi, newClient))
   }
 }
 
@@ -1113,17 +1130,11 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     )
   }
 
-  /** Connect the project scope under the per-server policy. Returns whether the scope
-   * is settled, so a refused confirm can be retried on a later session start. */
-  async function connectProjectScope(ctx: ExtensionContext): Promise<boolean> {
-    // The stored decision, read without prompting: consent recorded inside the
-    // project only counts once the project itself has been approved.
-    const approved = isProjectApprovedSilently(ctx)
-    const policy = projectServerPolicy(ctx.cwd, os.homedir(), approved)
-    const { allowed, denied } = mcpAllowDeny()
-    const { consented, gated } = splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), policy)
-    const authUi = authUiFor(ctx)
-    if (Object.keys(consented).length > 0) await connectServers(consented, authUi)
+  /** Connect the approval-gated project servers, behind the whole-project confirm.
+   * Returns whether the scope is settled, so a refused confirm can be retried on a
+   * later session start. The consented half of the project scope connects earlier,
+   * concurrently with the user scope, from session_start itself. */
+  async function connectGatedProjectServers(ctx: ExtensionContext, gated: Record<string, ServerConfig>, authUi?: AuthUi): Promise<boolean> {
     if (Object.keys(gated).length === 0) return true
     if (!(await isProjectApproved(ctx))) return false
     await connectServers(gated, authUi)
@@ -1148,16 +1159,28 @@ export default async function mcpExtension(pi: ExtensionAPI) {
     // entry cannot shadow a trusted user server by reusing its name. A gated project
     // server still awaiting the approval prompt does not preempt the user server: that is
     // a deliberate narrowing of Claude's rule to keep the safe default.
+    // The stored project decision, read without prompting: consent recorded inside
+    // the project only counts once the project itself has been approved.
     const projectPolicy = projectServerPolicy(ctx.cwd, os.homedir(), isProjectApprovedSilently(ctx))
-    const projectWinners = new Set(Object.keys(splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), projectPolicy).consented))
+    const { consented, gated } = splitByPolicy(applyServerPolicy(loadConfigFrom(projectConfigPaths(ctx.cwd)), allowed, denied), projectPolicy)
+    const projectWinners = new Set(Object.keys(consented))
     const userServers = Object.fromEntries(Object.entries(scoped).filter(([name]) => !clients.has(name) && !projectWinners.has(name)))
-    if (Object.keys(userServers).length > 0) await connectServers(userServers, authUiFor(ctx))
+    const authUi = authUiFor(ctx)
+    // The consented project servers carry no ordering dependency on the user scope:
+    // projectWinners already excludes their names from userServers, so the two batches
+    // are disjoint and connect concurrently, and startup pays the slower scope rather
+    // than the sum of both. Reconnect attempts after a refused confirm are safe:
+    // connectServers skips names that already connected.
+    const connects: Promise<void>[] = []
+    if (Object.keys(userServers).length > 0) connects.push(connectServers(userServers, authUi))
+    if (!projectConnected && Object.keys(consented).length > 0) connects.push(connectServers(consented, authUi))
+    await Promise.all(connects)
     // A project .mcp.json can run arbitrary commands on connect, so only honor it once
     // the project is trusted. Per-server settings refine that: disabled servers never
-    // connect, servers the user consented to individually connect without the
-    // whole-project confirm, and the rest stay behind it. Reconnect attempts after a
-    // refusal are safe: connectServers skips names that already connected.
-    if (!projectConnected) projectConnected = await connectProjectScope(ctx)
+    // connect, servers the user consented to individually connected above without the
+    // whole-project confirm, and the rest stay behind it, sequentially after both
+    // scopes so the confirm dialog never races a connect.
+    if (!projectConnected) projectConnected = await connectGatedProjectServers(ctx, gated, authUi)
 
     pi.events.emit(MCP_TOOLS_CHANNEL, [...aliases])
 

package/extensions/memory.ts

@@ -310,6 +310,27 @@ export default function memoryExtension(pi: ExtensionAPI) {
   let dir = memoryDir(process.cwd())
   let enabled = true
 
+  // The index is injected every turn but changes only through the tool or an external
+  // edit, so a turn costs one stat instead of a full read. The stat token (mtime plus
+  // size) catches external edits; save and delete drop the cache outright, since a
+  // rename landing within one mtime tick at the same size would slip past the token.
+  let indexCache: { token: string; index: string } | null = null
+
+  const indexStatToken = (): string => {
+    try {
+      const stat = fs.statSync(path.join(dir, INDEX_FILE))
+      return `${stat.mtimeMs}:${stat.size}`
+    } catch {
+      return 'missing'
+    }
+  }
+
+  const readIndexCached = (): string => {
+    const token = indexStatToken()
+    if (indexCache?.token !== token) indexCache = { token, index: readIndexQuietly(dir) }
+    return indexCache.index
+  }
+
   // These extensions also load inside spawned subagent processes, which carry the
   // PI_CODE_SUBAGENT marker. Claude does not load the main conversation's auto memory
   // into subagents (they get their own store through the agent `memory:` field), so
@@ -325,6 +346,7 @@ export default function memoryExtension(pi: ExtensionAPI) {
     enabled = autoMemoryEnabled(settings.autoMemoryEnabled, process.env)
     const override = typeof settings.autoMemoryDirectory === 'string' ? settings.autoMemoryDirectory : undefined
     dir = enabled ? resolveMemoryDir(ctx.cwd, override) : memoryDir(ctx.cwd)
+    indexCache = null
     if (!enabled) return
     const count = readIndexQuietly(dir)
       .split('\n')
@@ -334,7 +356,7 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
   pi.on('before_agent_start', async (event) => {
     if (inSubagent() || !enabled) return
-    const index = readIndexQuietly(dir)
+    const index = readIndexCached()
     if (!index.trim()) return
     return {
       systemPrompt: `${event.systemPrompt}\n\n## Memory\n\nPersistent memories from earlier sessions (index):\n\n${capIndexForPrompt(index)}\nUse the memory tool with action "read" to load a memory's full content when relevant.`,
@@ -362,6 +384,8 @@ export default function memoryExtension(pi: ExtensionAPI) {
           return await saveMemory(dir, indexPath, name, params.description, params.content)
         } catch (error) {
           return { content: [{ type: 'text' as const, text: `Memory save failed: ${error instanceof Error ? error.message : String(error)}. The index was left untouched.` }], details: {} }
+        } finally {
+          indexCache = null
         }
       }
 
@@ -372,7 +396,13 @@ export default function memoryExtension(pi: ExtensionAPI) {
 
       if (params.action === 'delete') {
         if (!name) return { content: [{ type: 'text' as const, text: 'delete requires name.' }], details: {} }
-        return deleteMemory(dir, indexPath, name)
+        // In a finally like the save path: a delete that throws mid-write must still
+        // drop the cache, or the next turn injects a stale index.
+        try {
+          return await deleteMemory(dir, indexPath, name)
+        } finally {
+          indexCache = null
+        }
       }
 
       const index = readIndexQuietly(dir)

package/extensions/status-line.ts

@@ -13,8 +13,10 @@
  * the built-in segment stands in.
  *
  * Without a configured statusLine, the built-in segment shows turn state plus
- * running session cost, summed from per-message usage on the current branch so it
- * stays correct across /tree navigation and forks. The built-in segment is also
+ * running session cost: a total seeded from the branch's per-message usage at
+ * session start, accumulated per message_end, and reseeded when compaction or
+ * /tree navigation reshapes the branch, so it stays correct across navigation
+ * and forks without re-walking the branch on every render. The built-in segment is also
  * the fallback while a configured command produces no output. Multi-line output
  * is truncated to its first line: the segment is one footer row in pi.
  *
@@ -48,6 +50,8 @@ interface UsageEntry {
   message?: { usage?: { cost?: { total?: number } } }
 }
 
+/** Full branch walk: used only to (re)seed the running total, at session start
+ * and on the events that reshape the branch. Renders read the total instead. */
 function sessionCost(ctx: ExtensionContext): number {
   let total = 0
   for (const entry of ctx.sessionManager.getBranch() as UsageEntry[]) {
@@ -95,8 +99,17 @@ export default function statusLine(pi: ExtensionAPI) {
   let sessionCtx: ExtensionContext | undefined
   let commandLine: string | undefined
   let permissionMode = 'default'
-  let projectApproved = false
   let sessionStartMs = Date.now()
+  // Running session cost; seeded and reseeded by sessionCost(), see below.
+  let costTotal = 0
+  // The output-style settings chain and active style name, resolved once at
+  // session start: the chain's upward walk and per-file reads are too costly for
+  // every refresh tick. /output-style persists a choice straight to settings with
+  // no bus event, and the new style applies from the next turn anyway, so the
+  // cached name is re-read lazily at most once per turn (styleDirty, turn_start).
+  let styleFiles: string[] = []
+  let styleName: string | undefined
+  let styleDirty = false
   // Lines changed, counted from successful edit/write inputs: newText and content
   // lines add, oldText lines remove. An approximation of Claude's counters, which
   // is honest for the tools pi has; bash-side changes are invisible to both.
@@ -114,8 +127,7 @@ export default function statusLine(pi: ExtensionAPI) {
 
   function segmentText(ctx: ExtensionContext, symbol: string): string {
     const theme = ctx.ui.theme
-    const cost = sessionCost(ctx)
-    const costText = cost > 0 ? theme.fg('muted', ` ${formatCost(cost)}`) : ''
+    const costText = costTotal > 0 ? theme.fg('muted', ` ${formatCost(costTotal)}`) : ''
     const turnText = turnCount > 0 ? theme.fg('dim', ` turn ${turnCount}`) : theme.fg('dim', ' ready')
     return symbol + turnText + costText
   }
@@ -128,9 +140,11 @@ export default function statusLine(pi: ExtensionAPI) {
   function buildPayload(ctx: ExtensionContext): Record<string, unknown> {
     const usage = ctx.getContextUsage() ?? { tokens: null, contextWindow: 0, percent: null }
     const model = ctx.model as { id?: string; name?: string } | undefined
-    // Same gate as the config read above: an unapproved project's style is not applied,
-    // so reporting it here would describe a style the session is not using.
-    const styleName = readActiveStyleName(settingsFiles(ctx.cwd, os.homedir(), projectApproved))
+    // Refresh the cached style name only when a turn boundary may have changed it.
+    if (styleDirty) {
+      styleName = readActiveStyleName(styleFiles)
+      styleDirty = false
+    }
     const payload: Record<string, unknown> = {
       hook_event_name: 'Status',
       session_id: ctx.sessionManager.getSessionId(),
@@ -141,7 +155,7 @@ export default function statusLine(pi: ExtensionAPI) {
       // read .model.display_name and render the literal "null" when it is missing.
       model: { id: model?.id ?? '', display_name: model?.name ?? model?.id ?? '' },
       cost: {
-        total_cost_usd: sessionCost(ctx),
+        total_cost_usd: costTotal,
         total_duration_ms: Date.now() - sessionStartMs,
         total_api_duration_ms: apiDurationMs,
         total_lines_added: linesAdded,
@@ -250,10 +264,13 @@ export default function statusLine(pi: ExtensionAPI) {
     if (requestStartMs !== undefined) apiDurationMs += Date.now() - requestStartMs
     requestStartMs = undefined
   })
-  // The last message's token usage, for the breakdown getContextUsage() omits.
+  // The last message's token usage, for the breakdown getContextUsage() omits,
+  // and the running cost total, so renders never re-walk the branch.
   pi.on('message_end', async (event) => {
-    const usage = (event as { message?: { usage?: NonNullable<typeof lastUsage> } }).message?.usage
-    if (usage) lastUsage = usage
+    const usage = (event as { message?: { usage?: NonNullable<typeof lastUsage> & { cost?: { total?: number } } } }).message?.usage
+    if (!usage) return
+    lastUsage = usage
+    costTotal += usage.cost?.total ?? 0
   })
 
   pi.on('session_start', async (_event, ctx) => {
@@ -268,11 +285,18 @@ export default function statusLine(pi: ExtensionAPI) {
     requestStartMs = undefined
     lastUsage = undefined
     clearInterval(refreshTimer)
+    // Seed the running cost from the branch: a resumed or forked session starts
+    // with history, and message_end only accumulates from here on.
+    costTotal = sessionCost(ctx)
     // Reading config must never open a trust dialog: several extensions resolve
     // approval at session start, and a second prompt stacks over the first and eats
     // the keys meant for it. An undecided project simply skips project settings.
     const trusted = isProjectApprovedSilently(ctx)
-    projectApproved = trusted
+    // Same gate for the style chain: an unapproved project's style is not applied,
+    // so reporting it in the payload would describe a style the session is not using.
+    styleFiles = settingsFiles(ctx.cwd, os.homedir(), trusted)
+    styleName = readActiveStyleName(styleFiles)
+    styleDirty = false
     const files = hookFiles(ctx.cwd, os.homedir(), trusted)
     // Claude's disableAllHooks also turns off the custom statusLine command; the
     // built-in segment still renders as the fallback.
@@ -286,6 +310,9 @@ export default function statusLine(pi: ExtensionAPI) {
 
   pi.on('turn_start', async (_event, ctx) => {
     turnCount++
+    // A /output-style between turns lands in settings silently; its style applies
+    // from this turn, so this is the moment the cached name can go stale.
+    styleDirty = true
     const theme = ctx.ui.theme
     show(ctx, theme.fg('accent', '●') + theme.fg('dim', ` turn ${turnCount}...`))
   })
@@ -300,10 +327,17 @@ export default function statusLine(pi: ExtensionAPI) {
     scheduleRefresh()
   })
 
-  pi.on('session_compact', async (_event, _ctx) => {
+  pi.on('session_compact', async (_event, ctx) => {
+    // Compaction replaces the branch entries; reseed the total from what remains.
+    costTotal = sessionCost(ctx)
     scheduleRefresh()
   })
 
+  pi.on('session_tree', async (_event, ctx) => {
+    // Tree navigation swaps the branch wholesale with no message_end events.
+    costTotal = sessionCost(ctx)
+  })
+
   pi.on('session_shutdown', async () => {
     clearInterval(refreshTimer)
     clearTimeout(debounceTimer)

package/extensions/subagent/index.ts

@@ -1352,7 +1352,16 @@ export default function subagentExtension(pi: ExtensionAPI) {
   // available model list are captured per session so a hook run lands in the right repo.
   let hookCwd = process.cwd()
   let hookModels: ReadonlyArray<{ id: string }> = []
+
+  // Discovery walks the plugin cache, the builtin dir, and every agent dir, parsing
+  // each file: dozens of fs ops per call. The roster injection below runs every turn
+  // for a list that almost never changes mid-session, so it reuses one discovery per
+  // (cwd, scope), dropped on session_start. The tool's execute() keeps rediscovering
+  // per invocation, so a just-added agent is still runnable without a restart.
+  let rosterCache: { key: string; agents: AgentConfig[] } | null = null
+
   pi.on('session_start', async (_event, ctx) => {
+    rosterCache = null
     hookCwd = ctx.cwd
     try {
       hookModels = ctx.modelRegistry?.getAvailable?.() ?? []
@@ -1378,12 +1387,15 @@ export default function subagentExtension(pi: ExtensionAPI) {
   })
 
   // Claude surfaces each agent's description so the model can pick one autonomously.
-  // Rebuilt per turn (agents are rediscovered per invocation too); project agents are
-  // included only when the project is already approved, read without prompting, since
-  // a trust dialog must not appear mid-turn and their descriptions are project text.
+  // Served from the session-level cache above (keyed on cwd and scope, so an approval
+  // granted mid-session still widens it); project agents are included only when the
+  // project is already approved, read without prompting, since a trust dialog must
+  // not appear mid-turn and their descriptions are project text.
   pi.on('before_agent_start', async (event, ctx) => {
-    const scope = isProjectApprovedSilently(ctx) ? 'both' : 'user'
-    const { agents } = discoverAgents(ctx.cwd, scope)
+    const scope: AgentScope = isProjectApprovedSilently(ctx) ? 'both' : 'user'
+    const key = `${scope}\n${ctx.cwd}`
+    if (rosterCache?.key !== key) rosterCache = { key, agents: discoverAgents(ctx.cwd, scope).agents }
+    const { agents } = rosterCache
     if (agents.length === 0) return
     const line = (text: string): string => text.replace(/\s+/g, ' ').trim().slice(0, 200)
     const roster = agents.map((agent) => `- ${agent.name} (${agent.source}): ${line(agent.description)}`).join('\n')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-code",
-  "version": "1.0.8",
+  "version": "1.0.9",
   "description": "Claude Code experience for the pi coding agent: reads your .claude config (rules, commands, skills, hooks, output styles, MCP servers, agents) and adds todo, checkpoints, memory, web, and subagents",
   "keywords": [
     "pi",