pi-file-injector 0.1.0 → 0.1.1

package/README.md

@@ -38,9 +38,9 @@ Diff #@a.ts vs #@b.ts
 See #@a.ts.
 ```
 
-On submit, each file shows up as a compact green `read <path>` line directly below your message — one line per file, indistinguishable from the `read` tool. Press `ctrl+o` to expand any of them to the full contents. The `#@` trigger is stripped from each reference, so `Review #@a.ts` appears in your message as `Review a.ts`, with the file delivered to the model underneath — never pasted into your message bubble.
+On submit, each file shows up as a compact green `read <path>` line directly below your message — one line per file, indistinguishable from the `read` tool. Press `ctrl+o` to expand any of them to the full contents. `#@` triggers stay in your message exactly as you typed them (`Review #@a.ts` stays `Review #@a.ts`), so cancelling and re-opening, forking, or re-submitting re-triggers injection. The file bytes are delivered to the model underneath — never pasted into your message bubble.
 
-Markdown files can import other files. If `spec.md` itself contains `#@api.md`, a single `#@spec.md` delivers both — `spec.md` first, then `api.md` — and the import marker is stripped from `spec.md` the same way a top-level marker is:
+Markdown files can import other files. If `spec.md` itself contains `#@api.md`, a single `#@spec.md` delivers both — `spec.md` first, then `api.md`. The import marker stays in `spec.md` verbatim (same as a top-level marker):
 
 ```text
 #@spec.md          # spec.md contains: see #@api.md
@@ -69,7 +69,7 @@ Text uses Pi's native block format, the same one `@file` uses:
 </file>
 ```
 
-That's what the model receives. You won't see it as raw text in the chat — each injected file renders as a green `read <path>` line (just like the `read` tool), with `ctrl+o` to expand. Your own message shows only what you typed.
+That's what the model receives. You won't see it as raw text in the chat — each injected file renders as a green `read <path>` line (just like the `read` tool), with `ctrl+o` to expand. Your own message shows exactly what you typed — including the `#@` markers — so re-opening or forking re-triggers injection automatically.
 
 Images are matched by their real bytes, not just the extension. A text file renamed `fake.png` is injected as text, not attached as a broken image. The check cuts both ways: a real image saved with the wrong extension — a PNG named `photo.jpg`, say — is not attached, because its bytes don't match the `.jpg` signature; it's delivered as a binary note instead. Rename it to its real type to attach it. An empty (0-byte) image attaches nothing.
 

package/file-injector.ts

@@ -340,7 +340,7 @@ function blockPath(block: string): string | undefined {
  *  renderer can slice the body out of the assembled `message.content` WITHOUT duplicating file bytes into
  *  `details` (the body is renderer-only metadata; it must not be persisted in the custom message). Runs in
  *  `before_agent_start` over the FINAL `blocks` array, because the absolute offset of a detail's body within
- *  `blocks.join("\\n\\n")` depends on every PRIOR block's length — `emitText` cannot know it at emit time.
+ *  `blocks.join("\n\n")` depends on every PRIOR block's length — `emitText` cannot know it at emit time.
  *
  *  Pairing: details and blocks are NOT 1:1 — a paged detail emits TWO blocks (head + directive) but only
  *  the head block carries the body. We pair each detail to the NEXT unmatched text/head block with the same
@@ -351,8 +351,8 @@ function blockPath(block: string): string | undefined {
  *  Idempotent + defensive: a detail whose block can't be located is left untouched (renderer falls back to
  *  the regex tier). Mutates `details` in place and returns it for chaining. */
 export function computeDetailOffsets(blocks: string[], details: FileDetail[]): FileDetail[] {
-  const SEP = "\\n\\n";
-  // absolute char offset of each block within blocks.join("\\n\\n")
+  const SEP = "\n\n";
+  // absolute char offset of each block within blocks.join("\n\n")
   const starts: number[] = [];
   let off = 0;
   for (const b of blocks) { starts.push(off); off += b.length + SEP.length; }
@@ -408,12 +408,15 @@ export function computeDetailOffsets(blocks: string[], details: FileDetail[]): F
  * each, and append a Pi-native `<file>` block (text/binary) or attach an ImageContent (image). The
  * whole file ALWAYS reaches the model: injected inline when it fits the remaining context budget,
  * paged via the model's `read` tool when it does not (PRD §5.5). NEVER throws (each file is isolated
- * in try/catch); tokens that miss/are directories/throw are left verbatim. The original prompt text is
- * NOT modified — blocks are appended after `\n\n---\n\n`, joined with `\n\n` (PRD §6.2). `ctx` carries
- * the budget inputs `getContextUsage()` (tokens used) and `model` (contextWindow/maxTokens); both
- * optional so a cwd-only ctx is valid. `injected` counts whole-file injections; `paged` counts files
- * delivered via the page path (PRD §5.5). Return `{injected:0, paged:0}` => caller returns
- * {action:"continue"}; otherwise {action:"transform", text, images}.
+ * in try/catch); tokens that miss/are directories/throw are left verbatim. VERBATIM DELIVERY (PRD
+ * §6.4/§13.8): the original prompt text is NOT modified — nothing is appended to it. The file BYTES
+ * live only in the returned `blocks`/`details` (the caller stashes them for `before_agent_start`'s
+ * custom message); the prompt carries nothing but the user's original text. (Markers are NOT stripped,
+ * so cancel/fork//tree re-open re-triggers injection.) `ctx` carries the budget inputs
+ * `getContextUsage()` (tokens used) and `model` (contextWindow/maxTokens); both optional so a
+ * cwd-only ctx is valid. `injected` counts whole-file injections; `paged` counts files delivered via
+ * the page path (PRD §5.5). Return `{injected:0, paged:0}` => caller returns {action:"continue"};
+ * otherwise the input handler stashes blocks/details and returns {action:"transform", text, images}.
  *
  * Internal state is carried in ONE shared `State` object (PRD §9) — `blocks`, `images`,
  * `injectedSet` (consolidated dedup: prior `<file>` blocks ∪ within-run deliveries), `remaining`
@@ -832,12 +835,18 @@ type Ctx = {
 };
 
 /**
- * PRD §9 / §5.6 step 3 — scan a text (user prompt OR markdown content) for `#@` tokens that resolve,
- * WITHOUT injecting. Pure (no I/O, no state mutation beyond the per-text localSeen set). Per-text dedup
- * via localSeen; global state.injectedSet check skips already-claimed paths (prior <file> blocks OR files
- * injected earlier this run / in a parent recursion). Returns { index; abs }[] in text order.
+ * PRD §9 / §5.6 step 3 — scan a text (user prompt OR markdown content) for `#@`/`@` import markers,
+ * resolving each to an absolute path WITHOUT injecting. Pure (no I/O, no state mutation beyond the
+ * per-text localSeen set). Per-text dedup via localSeen; global state.injectedSet check skips already-
+ * claimed paths (prior <file> blocks OR files injected earlier this run / in a parent recursion).
  *
- * opts.skipCode: when true, scanTokens precomputes code regions once and skips any `#@` match whose
+ * VERBATIM DELIVERY (PRD §6.4 / §12.16): markers are detected here ONLY to resolve imports — they are
+ * NEVER stripped from the text, so no index/prefixLen bookkeeping is returned. The returned paths are
+ * the resolved absolute file paths, in encounter order (the depth-first recursion in processTokenStream
+ * relies on this ordering). Resolution logic is unchanged: cleanToken → isAbsoluteOrTilde →
+ * resolveImportPath → dedup → code-region skip.
+ *
+ * opts.skipCode: when true, scanTokens precomputes code regions once and skips any marker whose
  *   start index lies inside a fenced block or inline code span (PRD §5.6.1). null codeRanges when false →
  *   inCode is never called → top-level (user-prompt) behavior is unchanged. Markdown imports (T2.S3)
  *   pass skipCode:true.
@@ -846,33 +855,33 @@ type Ctx = {
  *   `<exact>.md` then `<exact>.markdown` (markdown-import shorthand, PRD §4.5 rule 3). Top-level user-prompt
  *   scan passes `false` (§4.4 exact-only → top-level behavior is byte-for-byte identical to today).
  * opts.bareAt: OPTIONAL. When truthy, scanTokens ALSO matches bare `@path` markers (BARE_AT_RE, PRD §4.6)
- *   alongside the `#@` markers, returning a union of candidate records sorted by index. Each record carries
- *   `prefixLen` (2 for `#@`, 1 for a bare `@`) so a consumer can strip the correct marker width. Markdown-
- *   only / opt-in; the two regexes never double-match the same `#@` (BARE_AT_RE forbids a preceding `#`).
+ *   alongside the `#@` markers, returning a union of candidate paths sorted by index. Markdown-only /
+ *   opt-in; the two regexes never double-match the same `#@` (BARE_AT_RE forbids a preceding `#`).
  *   When absent/false, ONLY `#@` matches run → byte-for-byte identical to the single-regex form.
  *
- * Returns { index; prefixLen; abs }[] in text order (prefixLen is the marker char width: 2 for `#@`, 1 for `@`).
+ * Returns string[] — the resolved absolute paths in encounter order (markers detected, never stripped:
+ * PRD §6.4 / §12.16).
  */
 export async function scanTokens(
   text: string,
   baseDir: string,
   opts: { allowAbsTilde: boolean; skipCode: boolean; tryMdExt: boolean; bareAt?: boolean },
   state: State,
-): Promise<{ index: number; prefixLen: number; abs: string }[]> {
+): Promise<string[]> {
   const localSeen = new Set<string>();
-  const out: { index: number; prefixLen: number; abs: string }[] = [];
+  const out: string[] = [];
   // §5.6.1 — when scanning markdown content, precompute code regions once and skip `#@` matches whose
   // start index lies inside a fenced block or inline code span (the markdown escape hatch, §4.5 rule 3).
   // null when skipCode:false (top-level user-prompt scan) → inCode is never called → no behavior change.
   const codeRanges = opts.skipCode ? computeCodeRanges(text) : null;
-  // Candidate markers: `#@` always (prefixLen 2); bare `@` only when opts.bareAt (prefixLen 1). BARE_AT_RE
-  // forbids a preceding `#`, so `#@file` appears once (via FILE_INJECT_RE), never twice. When bareAt is
-  // absent/false, cands holds only the FILE_INJECT_RE matches in index-ascending order (matchAll yields
-  // ascending), so the sort is a no-op and the per-candidate body below is byte-for-byte identical to the
-  // prior single-loop form.
-  const cands: { idx: number; token: string; prefixLen: number }[] = [];
-  for (const m of text.matchAll(FILE_INJECT_RE)) cands.push({ idx: m.index!, token: m[2], prefixLen: 2 });
-  if (opts.bareAt) for (const m of text.matchAll(BARE_AT_RE)) cands.push({ idx: m.index!, token: m[2], prefixLen: 1 });
+  // Candidate markers: `#@` always; bare `@` only when opts.bareAt. BARE_AT_RE forbids a preceding `#`,
+  // so `#@file` appears once (via FILE_INJECT_RE), never twice. When bareAt is absent/false, cands holds
+  // only the FILE_INJECT_RE matches in index-ascending order (matchAll yields ascending), so the sort is
+  // a no-op and the per-candidate body below is byte-for-byte identical to the prior single-loop form.
+  // `idx` is retained because it is load-bearing for the code-region exemption (inCode(c.idx, …)).
+  const cands: { idx: number; token: string }[] = [];
+  for (const m of text.matchAll(FILE_INJECT_RE)) cands.push({ idx: m.index!, token: m[2] });
+  if (opts.bareAt) for (const m of text.matchAll(BARE_AT_RE)) cands.push({ idx: m.index!, token: m[2] });
   cands.sort((a, b) => a.idx - b.idx);
   for (const c of cands) {
     if (codeRanges && inCode(c.idx, codeRanges)) continue; // §5.6.1 — skip markers inside code
@@ -883,20 +892,21 @@ export async function scanTokens(
     if (!abs) continue; // nothing resolved → leave verbatim (missing/dir/non-regular)
     if (state.injectedSet.has(abs) || localSeen.has(abs)) continue; // dedup on RESOLVED abs → leave verbatim
     localSeen.add(abs);
-    out.push({ index: c.idx, prefixLen: c.prefixLen, abs });
+    out.push(abs);
   }
   return out;
 }
 
 /**
  * PRD §9 / §12.17 — top-level processor. Scan the text ONCE (before any injection), then inject each
- * resolved token depth-first via injectFile. Returns the start indices of markers that resolved, in scan
- * order, for `#@` stripping by injectFiles. Scan-before-inject gives cross-subtree dedup (a later token
+ * resolved path depth-first via injectFile. Scan-before-inject gives cross-subtree dedup (a later token
  * whose path an earlier import claimed is left verbatim). PRIVATE — exercised indirectly via injectFiles.
  *
- * The belt-and-suspenders `state.injectedSet.has(r.abs)` re-check is a NO-OP at top level in T1.S2
- * (scanTokens' localSeen already made each abs unique in records); it becomes load-bearing in T2 when
- * injectFile recurses into markdown imports.
+ * VERBATIM DELIVERY (PRD §6.4 / §12.16): the prompt text is NEVER modified here — markers are detected
+ * only to resolve imports (see scanTokens); nothing is stripped, so there is no index accumulator to
+ * return. This function returns Promise<void> and injects each resolved abs depth-first. The belt-and-
+ * suspenders `state.injectedSet.has(abs)` re-check stays for cross-subtree dedup once injectFile recurses
+ * into markdown imports.
  *
  * `opts.tryMdExt` is threaded straight through to scanTokens/resolveImportPath: the top-level user-prompt
  * call site passes `false` (§4.4 exact-only), and the markdown-import path passes `true` (§4.5 shorthand).
@@ -904,18 +914,15 @@ export async function scanTokens(
 async function processTokenStream(
   text: string,
   baseDir: string,
-  opts: { allowAbsTilde: boolean; skipCode: boolean; tryMdExt: boolean; bareAt: boolean },
+  opts: { allowAbsTilde: boolean; skipCode: boolean; tryMdExt: boolean; bareAt?: boolean },
   state: State,
   ctx: Ctx,
-): Promise<number[]> {
-  const records = await scanTokens(text, baseDir, opts, state); // scan once, before any injection (opts carries tryMdExt)
-  const resolved: number[] = [];
-  for (const r of records) {
-    if (state.injectedSet.has(r.abs)) continue; // cross-subtree dedup since scan (no-op at top level in T1.S2)
-    const ok = await injectFile(r.abs, state, ctx); // claims abs, emits block(s); never throws
-    if (ok) resolved.push(r.index);
+): Promise<void> {
+  const absPaths = await scanTokens(text, baseDir, opts, state); // scan once, before any injection (opts carries tryMdExt)
+  for (const abs of absPaths) {
+    if (state.injectedSet.has(abs)) continue; // cross-subtree dedup since scan
+    await injectFile(abs, state, ctx); // claims abs, emits block(s); never throws
   }
-  return resolved;
 }
 
 /**
@@ -1044,7 +1051,7 @@ export function emitText(abs: string, content: string, state: State): void {
 }
 
 /**
- * PRD §5.6 — markdown transitive imports (the six-step algorithm). Called by injectFile's markdown branch
+ * PRD §5.6 — markdown transitive imports (the five-step algorithm). Called by injectFile's markdown branch
  * (a delivered .md/.markdown is an import source). Recursion contract:
  *   • RELATIVE-ONLY (§4.5 rule 1): imports starting with / or ~ are ignored (left verbatim) — only relative
  *     tokens resolve. (Contrast: top-level user tokens allow / and ~.)
@@ -1054,40 +1061,27 @@ export function emitText(abs: string, content: string, state: State): void {
  *     so a self-import or cycle (a.md→b.md→a.md) dedups to verbatim and cannot recurse infinitely. The set
  *     of injectable files is finite and each is processed at most once — termination is guaranteed without
  *     a depth counter.
- *   • PRE-ORDER depth-first: this file's block is emitted (Step 5) BEFORE recursing into imports (Step 6),
+ *   • PRE-ORDER depth-first: this file's block is emitted (Step 4) BEFORE recursing into imports (Step 5),
  *     so the model sees a parent's context before the detail it pulls in.
+ *   • VERBATIM DELIVERY (§6.4/§12.16): markers are detected here ONLY to resolve imports — they are NEVER
+ *     stripped from the delivered content. The block is emitted on the verbatim `content` exactly as read
+ *     from disk (import markers stay as honest references; the bytes also live in the custom message, §6.2).
  *
- * Six steps (PRD §5.6):
+ * Five steps (PRD §5.6; Step 1 read/decode is in injectFile):
  *   2. Claim self (idempotent: injectFile pre-claimed abs; included for contract self-containedness).
- *   3. scanTokens(content, dirname(abs), { allowAbsTilde:false, skipCode:true, bareAt:state.bareAt }) → resolved
- *      import records. §4.6 markdown-only bare-@ opt-in: passes `bareAt: state.bareAt` (the seam P1.M2.T1.S1
- *      created — state.bareAt is derived from cfg.markdownBareAtImports in injectFiles). bareAt:false (default)
- *      → BARE_AT_RE not run → byte-for-byte identical to today (all records prefixLen 2).
- *   3.5. EXISTENCE PRE-CHECK (PRD §10 / §5.4): scanTokens records a token as soon as it RESOLVES (it does
- *      NOT stat), so a markdown import resolving to a MISSING file or DIRECTORY would otherwise have its
- *      '#@' marker stripped (Step 4) even though injectFile later returns false and nothing is injected for
- *      it. PRD §10 requires such markers be left VERBATIM. Pre-order (Step 6) emits THIS file's block BEFORE
- *      recursing, so the strip decision must be made NOW — unlike the top-level path (processTokenStream),
- *      which can inject-then-strip because the user prompt is not a pre-order block. Stat each import; keep
- *      only those that stat-succeed AND are regular files (isFile also rejects directories, matching §5.4
- *      and injectFile's own check). injectFile re-stats harmlessly on recursion. `injectable ⊆ records`, and
- *      `injectable` carries `prefixLen` (forwarded from records) so Step 4 can strip the correct marker width.
- *   4. Strip the marker from each INJECTABLE record (high→low, leaving the path) by `r.index + r.prefixLen`
- *      → `stripped` = block content. prefixLen is 2 for `#@` (r.index is the '#'), 1 for bare `@` (r.index is
- *      the '@'); both regexes' lookbehinds are zero-width, so r.index is always the marker's first char.
- *      Missing/dir imports keep the marker verbatim. Unresolved/deduped/absolute/inside-code markers were never
- *      in records and keep the marker verbatim. (byte-for-byte default: every default record has prefixLen 2,
- *      so `+ r.prefixLen` == the old `+ 2`.)
- *   5. emitText(abs, stripped, state) — the paged decision runs on the STRIPPED content (so directive text
- *      the model won't see does not bias the budget). emitText owns the subtract + paged bump (NOT count).
- *   6. Recurse into INJECTABLE imports in ENCOUNTER order: if not already claimed, await injectFile(abs)
- *      (which claims, classifies, bumps count, and recurses again if the import is itself markdown).
+ *   3. scanTokens(content, dirname(abs), { allowAbsTilde:false, skipCode:true, tryMdExt:true, bareAt:state.bareAt })
+ *      → absPaths: string[] (resolved import paths in encounter order). §4.6 markdown-only bare-@ opt-in:
+ *      passes bareAt: state.bareAt (the seam created in injectFiles — derived from cfg.markdownBareAtImports).
+ *   4. emitText(abs, content, state) — the paged decision runs on the VERBATIM content (§6.4: markers NOT
+ *      stripped). emitText owns the subtract + paged bump (NOT count).
+ *   5. Recurse into absPaths in ENCOUNTER order: if not already claimed, await injectFile(abs) (which claims,
+ *      classifies, bumps count, and recurses again if the import is itself markdown).
  *
  * PRIVATE — exercised indirectly via injectFiles (PRD §11 cases 15-19 + 20/MD1/MD2). Does NOT bump count
  * (injectFile owns the single count++ per claimed file; imports bump count in their own injectFile).
  *
  * @param abs     the importing markdown's absolute path (already claimed by injectFile; resolution base = dirname)
- * @param content the markdown's decoded UTF-8 content (buf.toString("utf8") from injectFile)
+ * @param content the markdown's decoded UTF-8 content (buf.toString("utf8") from injectFile) — delivered VERBATIM
  * @param state   the shared State (blocks/images/injectedSet/remaining/count/paged) threaded across the prompt
  * @param ctx     threaded to the recursive injectFile calls (cwd unused — imports resolve from dirname(abs))
  */
@@ -1100,62 +1094,20 @@ async function injectMarkdown(abs: string, content: string, state: State, ctx: C
   // Step 3 — scan for imports: relative-only (allowAbsTilde:false), outside code (skipCode:true),
   // markdown shorthand ON (tryMdExt:true → extensionless tokens try .md then .markdown, PRD §4.5 rule 3).
   // §4.6 — thread state.bareAt (set from cfg in injectFiles — the P1.M2.T1.S1 seam) so a markdown author who
-  // opts into markdownBareAtImports can write a bare @api.md (prefixLen 1). bareAt:false (default) → BARE_AT_RE
-  // is not run → records are byte-for-byte identical to today (all prefixLen 2).
-  const records = await scanTokens(content, dir, { allowAbsTilde: false, skipCode: true, tryMdExt: true, bareAt: state.bareAt }, state);
-
-  // Step 3.5 — READABILITY PRE-CHECK (PRD §5.4 / §10 / §12.5). scanTokens records a token as soon as it
-  // RESOLVES (it does NOT stat), so a markdown import resolving to a MISSING file, DIRECTORY, or a file
-  // that EXISTS but is UNREADABLE would otherwise have its '#@' marker stripped (Step 4) even though
-  // injectFile later returns false and nothing is injected for it. PRD §5.4/§12.5/§10 require such markers
-  // be left VERBATIM. Pre-order (§5.6 step 6) emits THIS file's block BEFORE recursing, so the strip
-  // decision must be made NOW (the top-level path can inject-then-strip because the user prompt is not a
-  // pre-order block; the markdown path cannot). Stat each import; keep only those that stat-succeed AND are
-  // regular files (isFile also rejects directories, matching injectFile's own check and §5.4: directory →
-  // verbatim), AND additionally gate on readability via fs.access(R_OK) so a marker is stripped ONLY when
-  // delivery will truly succeed for the text/markdown/binary case that dominates (PRD §5.4/§12.5: on any
-  // error leave the token verbatim). injectFile re-stats harmlessly on recursion.
-  // ACCEPTED NARROW RESIDUAL: the R_OK gate predicts readability, NOT resize success — a READABLE image
-  // whose resizeImage THROWS (rather than returning null) still gets stripped, because we cannot predict
-  // a resize failure without running the resize (expensive, duplicative). That is out of scope here; the
-  // full closure is the structural "strip only markers whose injectFile returned true" approach (PRD calls
-  // it "more invasive"). It is backstopped by injectFile's own try/catch (no crash, no block appended).
-  // TOCTOU: a file could become unreadable between this access and injectFile's readFile, but that races
-  // the top-level path too and is acceptable (injectFile's readFile try/catch is the final safety net).
-  // TYPE-ONLY widening: records carry prefixLen (scanTokens P1.M1.T1.S1); widening the declared element type
-  // lets Step 4 read r.prefixLen. The filter body (injectable.push(r)) forwards the WHOLE record unchanged —
-  // do NOT build a new object literal here (that would DROP prefixLen, the codebase_delta §8.2 anti-pattern).
-  // No new import: fs.constants.R_OK (=== 4) is reachable via the existing `import { promises as fs }`.
-  const injectable: { index: number; prefixLen: number; abs: string }[] = [];
-  for (const r of records) {
-    try {
-      const st = await fs.stat(r.abs);
-      if (!st.isFile()) continue; // directory/socket/etc → verbatim (§5.4) — unchanged
-      await fs.access(r.abs, fs.constants.R_OK); // gate strip on READABILITY (PRD §5.4 / §12.5)
-      injectable.push(r);
-    } catch {
-      /* missing / directory / unreadable → leave verbatim (not stripped, not injected) */
-    }
-  }
-
-  // Step 4 — strip the marker from each INJECTABLE import (high→low so earlier offsets stay valid), leaving
-  // the path. `stripped` becomes THIS file's block content. Missing/dir imports keep the marker verbatim.
-  // §4.6 — strip by the marker's width: prefixLen 2 for `#@` (r.index is the '#'), 1 for bare `@` (r.index is
-  // the '@'); both regexes' lookbehinds are zero-width, so r.index is always the marker's first char.
-  let stripped = content;
-  for (const r of [...injectable].sort((a, b) => b.index - a.index)) {
-    stripped = stripped.slice(0, r.index) + stripped.slice(r.index + r.prefixLen);
-  }
-
-  // Step 5 — emit THIS file's block. The paged decision runs on the STRIPPED content (§5.6 step 5).
-  emitText(abs, stripped, state); // emitText owns formatTextFileBlock + subtract + the paged head/directive + state.paged++
-
-  // Step 6 — recurse into INJECTABLE imports, depth-first, ENCOUNTER ORDER (pre-order). Missing/dir imports
-  // are absent here (they would no-op in injectFile anyway). The injectedSet re-check is belt-and-suspenders
-  // (cross-subtree dedup since the scan).
-  for (const r of injectable) {
-    if (state.injectedSet.has(r.abs)) continue; // already claimed (e.g. by a sibling subtree meanwhile)
-    await injectFile(r.abs, state, ctx); // claims abs, classifies, bumps count, recurses again if markdown
+  // opts into markdownBareAtImports can write a bare @api.md. scanTokens returns the resolved import paths as
+  // a string[] (absPaths, in encounter order); markers are detected ONLY to resolve imports, never stripped.
+  const absPaths = await scanTokens(content, dir, { allowAbsTilde: false, skipCode: true, tryMdExt: true, bareAt: state.bareAt }, state);
+
+  // Step 4 — emit THIS file's block. The paged decision runs on the VERBATIM content (import markers are NOT
+  // stripped — §6.4/§12.16: the file is delivered exactly as read from disk). emitText owns formatTextFileBlock
+  // + subtract + the paged head/directive + state.paged++.
+  emitText(abs, content, state);
+
+  // Step 5 — recurse into the resolved imports, depth-first, ENCOUNTER ORDER (pre-order). The injectedSet
+  // re-check is belt-and-suspenders (cross-subtree dedup since the scan).
+  for (const abs2 of absPaths) {
+    if (state.injectedSet.has(abs2)) continue; // already claimed (e.g. by a sibling subtree meanwhile)
+    await injectFile(abs2, state, ctx); // claims abs, classifies, bumps count, recurses again if markdown
   }
 }
 
@@ -1184,9 +1136,9 @@ export async function injectFiles(
 
   // PRIOR-INJECTION SET (defense-in-depth — validator finding F-NEW-1, recommendation #2). Collect
   // EVERY `<file name="<path>">` already present in `text` — whether stamped by a prior copy of THIS
-  // extension (under the `\n\n---\n\n` separator, PRD §6.2) or by Pi's own `@file` argv expander — so
-  // per-token dedup below is robust to path-string quirks (a prior copy may have resolved against a
-  // different cwd, expanded `~` differently, or been a sentinel/legacy build). This is a SUPERSET of
+  // extension that appended to the text, by a hand-edited prompt, or by Pi's own `@file` argv expander —
+  // so per-token dedup below is robust to path-string quirks (a prior copy may have resolved against a
+  // different cwd, expanded `~` differently, or been a legacy build). This is a SUPERSET of
   // a single exact-path substring test and is strictly additive: it never suppresses a token whose
   // resolved path is NOT already in the set, so multi-file prompts (inject A then B) still work even
   // when a prior copy already injected A. NOTE: like any in-this-copy check, it cannot stop a LATER
@@ -1216,34 +1168,27 @@ export async function injectFiles(
   };
 
   // process the USER PROMPT: baseDir = cwd, absolute/tilde allowed, no code-skipping.
-  // processTokenStream scans ONCE (before any injection) then calls injectFile per record (PRD §12.17),
-  // returning the start indices of markers that ACTUALLY injected. Failed tokens (missing/dir/error)
-  // and deduped repeats are never returned → they keep '#@' verbatim (PRD §6.2). scanTokens' per-text
-  // localSeen + state.injectedSet give cross-subtree dedup (a later token whose path an earlier import
-  // claimed is left verbatim); processTokenStream's belt-and-suspenders injectedSet re-check is a no-op
-  // at top level in T1.S2 (each abs is already unique in records) but load-bearing for T2 recursion.
-  const resolvedIdx = await processTokenStream(
+  // processTokenStream scans ONCE (before any injection) then calls injectFile per resolved abs (PRD §12.17);
+  // it returns void — it does NOT report marker indices, because markers are NEVER stripped from the prompt
+  // (§6.4/§13.8: the user message is returned byte-for-byte verbatim so cancel/fork//tree re-open re-triggers
+  // injection). Failed tokens (missing/dir/error) and deduped repeats are never injected → they keep '#@'
+  // verbatim (§6.2). scanTokens' per-text localSeen + state.injectedSet give cross-subtree dedup (a later
+  // token whose path an earlier import claimed is left verbatim); processTokenStream's belt-and-suspenders
+  // injectedSet re-check is a no-op at top level (each abs is already unique in absPaths) but load-bearing
+  // for markdown recursion.
+  await processTokenStream(
     text, ctx.cwd, { allowAbsTilde: true, skipCode: false, tryMdExt: false, bareAt: false }, state, ctx);
 
   if (state.count === 0) return { text, images: imagesIn, injected: 0, paged: 0, blocks: [], details: [] }; // ORIGINAL ref — nothing injected → byte-for-byte (§10 row 1)
 
-  // Strip the #@ trigger from each inline marker — the PATH stays put as a readable reference. The
-  // model doesn't need the #@ syntax (the appended <file name="abs"> blocks carry the data), and
-  // every #@ is 2 tokens of pure noise. Reached only when count > 0, so the nothing-injected path
-  // above still returns the prompt byte-for-byte (missing/dir/error tokens keep their #@ verbatim).
-  // §6.2 — strip the '#@' trigger ONLY from tokens that ACTUALLY injected. Failed tokens
-  // (missing/dir/error) and deduped repeats were never returned, so they keep '#@' verbatim.
-  // INDEX-BASED SPLICE (not substring replace): an injected match can be a prefix of another token
-  // (e.g. '#@a.ts' ⊂ '#@a.ts.bak'), so a substring replace would corrupt the longer token. Group 1
-  // of FILE_INJECT_RE is zero-width → m.index is exactly the '#'; removing 2 chars drops exactly
-  // '#@'. Process high→low so earlier offsets stay valid.
-  let strippedText = text;
-  for (const i of [...resolvedIdx].sort((a, b) => b - a)) {
-    strippedText = strippedText.slice(0, i) + strippedText.slice(i + 2);
-  }
-  // §6.4 — the user message is JUST the stripped prompt (no appended blocks, no `\n\n---\n\n`). The blocks +
-  // details are returned for the caller (P1.M1.T2.S1 stashes them for the before_agent_start custom message).
-  return { text: strippedText, images: state.images, injected: state.count, paged: state.paged, blocks: state.blocks, details: state.details };
+  // §6.4 / §13.8 — the user message is the ORIGINAL `text`, byte-for-byte VERBATIM. Markers are NEVER stripped
+  // (no `#@` removal, no appended blocks, no `\n\n---\n\n`): stripping discards the triggers from the STORED
+  // message, and Pi re-feeds that stored text on cancel / fork / `/tree`-navigate (`navigateTree` prefills the
+  // editor from `targetEntry.message.content`, with no extension hook to override), so a stripped prompt would
+  // never re-trigger injection. The file BYTES live only in the returned `blocks`/`details` (the caller — the
+  // input handler — stashes them for `before_agent_start`'s custom message); the prompt carries nothing but the
+  // user's original text. (The count===0 path above already returns this same `text` verbatim.)
+  return { text, images: state.images, injected: state.count, paged: state.paged, blocks: state.blocks, details: state.details };
 }
 
 /**
@@ -1252,10 +1197,12 @@ export async function injectFiles(
  * Lets a user attach an ENTIRE file to their prompt by writing `#@<path>` anywhere in the submitted
  * text. On the `input` event — which fires inside `AgentSession.prompt()` for ALL input contexts
  * (interactive TUI messages, the initial CLI / `-p` / RPC message, and RPC calls alike) — every
- * `#@<path>` token is resolved, the whole file is read, and its contents are appended to the prompt in
- * Pi-native `<file name="...">...</file>` blocks below a `---` separator. Image files are attached as
- * `ImageContent` (resized to provider limits) plus a reference block; non-image binaries get a clear
- * note instead of decoded garbage.
+ * `#@<path>` token is resolved, the whole file is read, and delivered to the model in Pi-native
+ * `<file name="...">...</file>` blocks via a separate custom message in `before_agent_start`. The
+ * prompt text itself is returned byte-for-byte VERBATIM (markers are never stripped, so cancel/fork/
+ * `/tree` re-open re-triggers injection). Image files are attached as `ImageContent` (resized to
+ * provider limits) plus a reference block; non-image binaries get a clear note instead of decoded
+ * garbage.
  *
  * Trigger syntax:  `#@<path>`  — e.g. `#@src/index.ts`, `#@~/notes.md`, `#@pic.png`,
  *                  `(#@a.txt and #@b.md)`. The two-char `#@` trigger is collision-free with Pi's
@@ -1320,7 +1267,7 @@ export default function (pi: ExtensionAPI) {
     const whole = injected - paged;
     const msg = `#@ injected ${whole} whole${paged > 0 ? `, ${paged} paged` : ""}`;
     if (ctx.hasUI) ctx.ui.notify(msg, "info"); // §5.5 unified whole/paged wording; guarded for print/json headless modes (api_verification §5)
-    return { action: "transform" as const, text, images }; // rewrite prompt with injected content + merged images
+    return { action: "transform" as const, text: event.text, images }; // §6.4 — text VERBATIM (event.text, unchanged; the prompt is never modified so cancel/fork/re-open re-triggers injection; §13.8)
   });
 
   // §6.2 publish the stashed files as ONE custom message, appended after the user message. Fires once per

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-file-injector",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "#@file — inject the whole file into your Pi prompt, every time and everywhere, only when you want it. Renders as a compact read-tool line.",
   "author": "Dustin Schultz",
   "license": "MIT",