fix(pi): refuse mid-stream agent commands instead of silently dropping input