# Changelog

## 0.1.4 (2026-09-21)

### Security

- **Project `.pi/settings.json` is now only read when the project is trusted**
  (`ctx.isProjectTrusted()`). Previously, opening a session in an untrusted
  checkout would auto-run `git clone` of attacker-controlled URLs at startup
  and inject attacker-written reference descriptions into the system prompt.
  The global config (`~/.pi/agent/settings.json`, `PI_CODING_AGENT_DIR`-aware)
  is still read unconditionally. Tests: 30 → 33.

## 0.1.3 (2026-09-20)

### Fixed

- **`cacheRoot` now derives from `os.homedir()`** instead of
  `process.env.HOME || ""` — on Windows (where `HOME` is typically unset) the
  git-clone cache path collapsed to a bogus root-relative
  `/.pi/agent/refs/<alias>` target.
- README/doc-comment now state that git refs clone **eagerly at session
  start**, not "lazily on first use" (the code has always cloned all refs in
  the `session_start` handler).

## 0.1.2 (2026-09-12)

### Fixed

- **Removed the false header claim that resolved roots are "added to the
  permission allowlist for path tools."** No such code exists — references
  only inject into the system prompt; path access still follows whatever
  permission rules the user has configured.
- README: hidden refs with a description are **not** advertised — the snippet
  builder filters `description && !hidden`, so `hidden` wins. The table row
  previously claimed the opposite.
- `~`-prefixed local paths now expand via `os.homedir()` (previously kept
  literally, so the agent's path tools could never resolve them).
- `/refs` guards a missing `ctx.ui` instead of crashing.

## 0.1.1

- **Fixed: settings.json config now actually works.** The SDK's ExtensionAPI has
  no `getSetting`/`config` (only `registerFlag`/`getFlag` for CLI flags), so the
  previous `pi.getSetting?.("references")` silently returned undefined and every
  documented reference block was ignored in production. Config is now read
  directly from `.pi/settings.json` → `~/.pi/agent/settings.json` via
  `readSettingsKey`. Tests: 22 → 24.

## 0.1.0

- Initial release.
- `references` config: alias local directories or git repositories as `@alias`.
- Git refs clone lazily into `~/.pi/agent/refs/<alias>/` on first use.
- References with `description` injected into the system prompt every turn.
- `/refs` command lists configured references and resolved paths.
- String shorthand (`"../dir"` → path, `"owner/repo"` → repository).
- Alias validation (no `/`, whitespace, comma, backtick).
- Zero dependencies, plain JS.