Fix #40 keep detached exit-summary secrets off disk

[jayzeng]

Follow-up to #40. Replaces the temporary JSON payload file with a one-shot stdin pipe, so API keys, conversation prompts, and model metadata are never persisted to disk. Adds fallback behavior when pipe setup is unavailable and tests for no temp-file leakage.

[chatgpt-codex-connector]

💡 Codex Review

pi-memory/index.ts

Line 1681 in 9b7c812

if (outcome !== "fallback") return;

Clear the pending qmd timer before returning

When detached mode successfully spawns or skips a summary, this early return bypasses the finally block that clears updateTimer. If a memory write scheduled scheduleQmdUpdate() shortly before the user quits, the referenced timer—and then its qmd update child—can keep the parent process alive for up to the command timeout, defeating detached mode's instant-exit guarantee. Clear the pending timer before returning from these outcomes.

---

pi-memory/index.ts

Lines 545 to 546 in 9b7c812

	child.stdin.end(JSON.stringify(payload), "utf-8");
	(child.stdin as typeof child.stdin & { unref?: () => void }).unref?.();

Handle errors emitted by the worker stdin pipe

If the detached worker exits before consuming the payload—for example because startup or module loading fails—this write can asynchronously emit EPIPE on child.stdin. The surrounding try and the listener on child do not handle errors emitted by the stdin stream, so a large exit-summary payload can produce an unhandled error in the parent during shutdown instead of degrading cleanly. Attach an error handler to the pipe and treat delivery failure as a failed handoff.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".