@oh-my-pi/pi-agent-core 18.12.1 → 18.12.3

package/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 ## [Unreleased]
 
+## [18.12.3] - 2026-10-19
+
+### Added
+
+- `AgentTool` gained the optional `approvalCacheTargets` hook, which the `always-ask-cached` approval mode uses to check and record per-file grants ([#16049](https://github.com/can1357/oh-my-pi/pull/16049) by [@Peribunt](https://github.com/Peribunt))
+
+### Changed
+
+- Tools with `lenientArgValidation` now receive unknown root arguments that their closed schema would otherwise drop, so they can reject them ([#16317](https://github.com/can1357/oh-my-pi/issues/16317))
+
+## [18.12.2] - 2026-10-18
+
+### Changed
+
+- The failed-tool-call correction sent to DeepSeek models now also covers chat-template tool-call tokens written out as text, not only malformed DSML ([#16216](https://github.com/can1357/oh-my-pi/pull/16216) by [@H4vC](https://github.com/H4vC))
+
+### Fixed
+
+- Fixed Ollama chat history estimates counting stripped native thinking and missing foreign thinking replayed as text, which skewed compaction after model switches ([#16164](https://github.com/can1357/oh-my-pi/issues/16164))
+
 ## [18.12.0] - 2026-10-17
 
 ### Fixed

package/dist/types/tool-arguments.d.ts

@@ -10,9 +10,10 @@ import type { AgentTool } from "./types.js";
 export type ToolArgumentSource = "parsed" | "payload";
 /**
  * Validate a call's arguments against `tool`'s schema, honoring
- * {@link AgentTool.lenientArgValidation}: on a schema mismatch a lenient tool
- * receives its raw arguments minus the internal `__parseError`/`__rawJson`
- * sentinels. Malformed JSON from a provider stream is never lenient.
+ * {@link AgentTool.lenientArgValidation}: a lenient tool keeps unknown root
+ * keys its closed schema would heal away, and on a schema mismatch receives its
+ * raw arguments minus the internal `__parseError`/`__rawJson` sentinels.
+ * Malformed JSON from a provider stream is never lenient.
  *
  * @throws the validation error when the tool is strict or the arguments failed to parse.
  */

package/dist/types/types.d.ts

@@ -1034,7 +1034,7 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = any
      * before ordinary dispatch commits its result.
      */
     speculation?: ToolSpeculationPolicy;
-    /** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM. Malformed argument JSON still returns the parse error. */
+    /** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM, and unknown root keys a closed schema would drop stay on the args. Malformed argument JSON still returns the parse error. */
     lenientArgValidation?: boolean;
     /**
      * Whether the agent loop may abort this tool mid-execution — or skip it
@@ -1090,6 +1090,12 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = any
     approval?: ToolApproval;
     /** Lines appended after the standard approval prompt header. */
     formatApprovalDetails?: (args: unknown) => string | string[] | undefined;
+    /**
+     * Remembered-approval keys for `tools.approvalMode: always-ask-cached`: the files (or URL
+     * targets) this call touches. When every key is already granted the call skips its prompt;
+     * approving the call can record them. Omit it (or return `undefined`) and the call prompts by tier.
+     */
+    approvalCacheTargets?: (args: unknown) => readonly string[] | undefined;
     /** The main execution callback for this tool. */
     execute: AgentToolExecFn<TParameters, TDetails, TTheme>;
     /** Optional custom rendering for tool call display (returns UI component) */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-agent-core",
-	"version": "18.12.1",
+	"version": "18.12.3",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://omp.sh",
 	"author": {
@@ -38,16 +38,16 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-ai": "18.12.1",
-		"@oh-my-pi/pi-catalog": "18.12.1",
-		"@oh-my-pi/pi-natives": "18.12.1",
-		"@oh-my-pi/pi-utils": "18.12.1",
-		"@oh-my-pi/pi-wire": "18.12.1",
-		"@oh-my-pi/snapcompact": "18.12.1",
+		"@oh-my-pi/pi-ai": "18.12.3",
+		"@oh-my-pi/pi-catalog": "18.12.3",
+		"@oh-my-pi/pi-natives": "18.12.3",
+		"@oh-my-pi/pi-utils": "18.12.3",
+		"@oh-my-pi/pi-wire": "18.12.3",
+		"@oh-my-pi/snapcompact": "18.12.3",
 		"@opentelemetry/api": "^1.9.1"
 	},
 	"devDependencies": {
-		"@oh-my-pi/omptype": "18.12.1",
+		"@oh-my-pi/omptype": "18.12.3",
 		"@opentelemetry/context-async-hooks": "^2.9.0",
 		"@opentelemetry/sdk-trace-base": "^2.9.0",
 		"@types/bun": "^1.3.14"

package/src/prompts/dsml-tool-call-leak.md

@@ -1,4 +1,4 @@
-Tool call failed: your previous response tried to invoke a tool, but the DSML markup was malformed, so it arrived as plain text, no tool was executed, and the broken markup was removed from your response. Usually the opening `<｜DSML｜tool_calls>` and/or `<｜DSML｜invoke name="…">` tags are missing, or the tool name was written as a plain line.
+Tool call failed: your previous response tried to invoke a tool, but the tool-call markup was malformed, so it arrived as plain text, no tool was executed, and the broken markup was removed from your response. Usually the opening `<｜DSML｜tool_calls>` and/or `<｜DSML｜invoke name="…">` tags are missing, the tool name was written as a plain line, or the chat template's tool-call special tokens were typed out as text.
 
 A tool call must be one complete envelope:
 

package/src/tokenizer.ts

@@ -1,6 +1,11 @@
 import type { AssistantMessage, Model } from "@oh-my-pi/pi-ai";
+import { renderDemotedThinking } from "@oh-my-pi/pi-ai/dialect/demotion";
+import { ollamaChatDropsOwnThinking } from "@oh-my-pi/pi-ai/providers/ollama";
 import { isColdReplayableResponsesTurn } from "@oh-my-pi/pi-ai/providers/openai-shared";
-import { shouldDropTruncatedThinkingOnlyAssistant } from "@oh-my-pi/pi-ai/providers/transform-messages";
+import {
+	isSameModelTurn,
+	shouldDropTruncatedThinkingOnlyAssistant,
+} from "@oh-my-pi/pi-ai/providers/transform-messages";
 import {
 	getOpenAIResponsesHistoryItems,
 	sanitizeOpenAIResponsesAssistantHistoryItemsForReplay,
@@ -207,6 +212,7 @@ export class Tokenizer {
 	readonly #frameBilling: snapcompact.FrameBilling;
 	readonly frameBillingKey: string;
 	readonly #reasoningReader: ReasoningReplayReader | undefined;
+	readonly #dropsOllamaThinking: boolean;
 	/** Claude's own API and prefix-bound hosts keep another model's signature from their deployment. */
 	readonly #readsDeploymentSignatures: boolean;
 	readonly reasoningReplayKey: string;
@@ -244,6 +250,7 @@ export class Tokenizer {
 		this.#frameBilling = snapcompact.frameBilling(model ?? undefined);
 		this.frameBillingKey = snapcompact.frameBillingKey(this.#frameBilling);
 		this.#reasoningReader = reasoningReplayReader(model);
+		this.#dropsOllamaThinking = ollamaChatDropsOwnThinking(model);
 		const compat = model?.compat;
 		this.#readsDeploymentSignatures =
 			model?.api === "anthropic-messages" &&
@@ -415,6 +422,8 @@ export class Tokenizer {
 				// reaches the wire then (the payload items replay instead); a turn whose
 				// backend reported no reasoning tokens keeps the signature as its price.
 				const replayedReasoning = this.#replayedReasoningTokens(message);
+				const ollamaReader = this.#reasoningReader?.api === "ollama-chat" ? this.#reasoningReader : undefined;
+				const ownOllamaTurn = ollamaReader !== undefined && isSameModelTurn(message, ollamaReader);
 				if (typeof replayedReasoning === "number") extra += replayedReasoning;
 				const signaturesPriced = this.thinkingReplayTokens === "signature";
 				// The replay's signature rule (`transformMessages`): an aborted or
@@ -441,6 +450,13 @@ export class Tokenizer {
 					if (block.type === "text") {
 						fragments.push(block.text);
 					} else if (block.type === "thinking") {
+						// `transformMessages` drops another model's empty thinking and demotes the
+						// rest to visible text; only the reader's own thinking stays native.
+						if (ollamaReader && !ownOllamaTurn) {
+							if (block.thinking.trim()) fragments.push(renderDemotedThinking(ollamaReader.id, block.thinking));
+							continue;
+						}
+						if (this.#dropsOllamaThinking && ownOllamaTurn) continue;
 						fragments.push(block.thinking);
 						// Providers charge for the opaque signature/reasoning payload that
 						// rides alongside the thinking text (OpenAI Responses encrypted
@@ -561,6 +577,7 @@ export class Tokenizer {
 			snapcompact.frameBillingKey(snapcompact.frameBilling(model ?? undefined)) === this.frameBillingKey &&
 			reasoningReplayKey(model) === this.reasoningReplayKey &&
 			resolveThinkingReplayTokens(model ?? {}) === this.thinkingReplayTokens &&
+			ollamaChatDropsOwnThinking(model) === this.#dropsOllamaThinking &&
 			(options?.nativeHistoryReplay ?? true) === this.nativeHistoryReplay
 		);
 	}

package/src/tool-arguments.ts

@@ -12,9 +12,10 @@ export type ToolArgumentSource = "parsed" | "payload";
 
 /**
  * Validate a call's arguments against `tool`'s schema, honoring
- * {@link AgentTool.lenientArgValidation}: on a schema mismatch a lenient tool
- * receives its raw arguments minus the internal `__parseError`/`__rawJson`
- * sentinels. Malformed JSON from a provider stream is never lenient.
+ * {@link AgentTool.lenientArgValidation}: a lenient tool keeps unknown root
+ * keys its closed schema would heal away, and on a schema mismatch receives its
+ * raw arguments minus the internal `__parseError`/`__rawJson` sentinels.
+ * Malformed JSON from a provider stream is never lenient.
  *
  * @throws the validation error when the tool is strict or the arguments failed to parse.
  */
@@ -24,7 +25,9 @@ export function validateAgentToolArguments(
 	source: ToolArgumentSource = "parsed",
 ): ToolCall["arguments"] {
 	try {
-		return validateToolArguments(tool, toolCall);
+		const validated = validateToolArguments(tool, toolCall, { keepUnknownRootKeys: tool.lenientArgValidation });
+		// Kept unknown root keys must not smuggle the internal sentinels past validation.
+		return tool.lenientArgValidation ? withoutSentinels(validated) : validated;
 	} catch (error) {
 		const args: unknown = toolCall.arguments;
 		if (!tool.lenientArgValidation) throw error;
@@ -36,3 +39,12 @@ export function validateAgentToolArguments(
 		return fallback;
 	}
 }
+
+function withoutSentinels(args: ToolCall["arguments"]): ToolCall["arguments"] {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	if (!Object.hasOwn(args, "__parseError") && !Object.hasOwn(args, "__rawJson")) return args;
+	const stripped = { ...(args as Record<string, unknown>) };
+	delete stripped.__parseError;
+	delete stripped.__rawJson;
+	return stripped;
+}

package/src/types.ts

@@ -1170,7 +1170,7 @@ export interface AgentTool<
 	 * before ordinary dispatch commits its result.
 	 */
 	speculation?: ToolSpeculationPolicy;
-	/** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM. Malformed argument JSON still returns the parse error. */
+	/** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM, and unknown root keys a closed schema would drop stay on the args. Malformed argument JSON still returns the parse error. */
 	lenientArgValidation?: boolean;
 	/**
 	 * Whether the agent loop may abort this tool mid-execution — or skip it
@@ -1229,6 +1229,13 @@ export interface AgentTool<
 	/** Lines appended after the standard approval prompt header. */
 	formatApprovalDetails?: (args: unknown) => string | string[] | undefined;
 
+	/**
+	 * Remembered-approval keys for `tools.approvalMode: always-ask-cached`: the files (or URL
+	 * targets) this call touches. When every key is already granted the call skips its prompt;
+	 * approving the call can record them. Omit it (or return `undefined`) and the call prompts by tier.
+	 */
+	approvalCacheTargets?: (args: unknown) => readonly string[] | undefined;
+
 	/** The main execution callback for this tool. */
 	execute: AgentToolExecFn<TParameters, TDetails, TTheme>;