@oh-my-pi/pi-agent-core 18.12.2 → 18.12.3

package/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## [Unreleased]
 
+## [18.12.3] - 2026-10-19
+
+### Added
+
+- `AgentTool` gained the optional `approvalCacheTargets` hook, which the `always-ask-cached` approval mode uses to check and record per-file grants ([#16049](https://github.com/can1357/oh-my-pi/pull/16049) by [@Peribunt](https://github.com/Peribunt))
+
+### Changed
+
+- Tools with `lenientArgValidation` now receive unknown root arguments that their closed schema would otherwise drop, so they can reject them ([#16317](https://github.com/can1357/oh-my-pi/issues/16317))
+
 ## [18.12.2] - 2026-10-18
 
 ### Changed

package/dist/types/tool-arguments.d.ts

@@ -10,9 +10,10 @@ import type { AgentTool } from "./types.js";
 export type ToolArgumentSource = "parsed" | "payload";
 /**
  * Validate a call's arguments against `tool`'s schema, honoring
- * {@link AgentTool.lenientArgValidation}: on a schema mismatch a lenient tool
- * receives its raw arguments minus the internal `__parseError`/`__rawJson`
- * sentinels. Malformed JSON from a provider stream is never lenient.
+ * {@link AgentTool.lenientArgValidation}: a lenient tool keeps unknown root
+ * keys its closed schema would heal away, and on a schema mismatch receives its
+ * raw arguments minus the internal `__parseError`/`__rawJson` sentinels.
+ * Malformed JSON from a provider stream is never lenient.
  *
  * @throws the validation error when the tool is strict or the arguments failed to parse.
  */

package/dist/types/types.d.ts

@@ -1034,7 +1034,7 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = any
      * before ordinary dispatch commits its result.
      */
     speculation?: ToolSpeculationPolicy;
-    /** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM. Malformed argument JSON still returns the parse error. */
+    /** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM, and unknown root keys a closed schema would drop stay on the args. Malformed argument JSON still returns the parse error. */
     lenientArgValidation?: boolean;
     /**
      * Whether the agent loop may abort this tool mid-execution — or skip it
@@ -1090,6 +1090,12 @@ export interface AgentTool<TParameters extends TSchema = TSchema, TDetails = any
     approval?: ToolApproval;
     /** Lines appended after the standard approval prompt header. */
     formatApprovalDetails?: (args: unknown) => string | string[] | undefined;
+    /**
+     * Remembered-approval keys for `tools.approvalMode: always-ask-cached`: the files (or URL
+     * targets) this call touches. When every key is already granted the call skips its prompt;
+     * approving the call can record them. Omit it (or return `undefined`) and the call prompts by tier.
+     */
+    approvalCacheTargets?: (args: unknown) => readonly string[] | undefined;
     /** The main execution callback for this tool. */
     execute: AgentToolExecFn<TParameters, TDetails, TTheme>;
     /** Optional custom rendering for tool call display (returns UI component) */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-agent-core",
-	"version": "18.12.2",
+	"version": "18.12.3",
 	"description": "General-purpose agent with transport abstraction, state management, and attachment support",
 	"homepage": "https://omp.sh",
 	"author": {
@@ -38,16 +38,16 @@
 		"fmt": "oxfmt --no-error-on-unmatched-pattern 'src/**/*.{ts,tsx}' '{test,bench,examples,scripts}/**/*.ts' '*.ts'"
 	},
 	"dependencies": {
-		"@oh-my-pi/pi-ai": "18.12.2",
-		"@oh-my-pi/pi-catalog": "18.12.2",
-		"@oh-my-pi/pi-natives": "18.12.2",
-		"@oh-my-pi/pi-utils": "18.12.2",
-		"@oh-my-pi/pi-wire": "18.12.2",
-		"@oh-my-pi/snapcompact": "18.12.2",
+		"@oh-my-pi/pi-ai": "18.12.3",
+		"@oh-my-pi/pi-catalog": "18.12.3",
+		"@oh-my-pi/pi-natives": "18.12.3",
+		"@oh-my-pi/pi-utils": "18.12.3",
+		"@oh-my-pi/pi-wire": "18.12.3",
+		"@oh-my-pi/snapcompact": "18.12.3",
 		"@opentelemetry/api": "^1.9.1"
 	},
 	"devDependencies": {
-		"@oh-my-pi/omptype": "18.12.2",
+		"@oh-my-pi/omptype": "18.12.3",
 		"@opentelemetry/context-async-hooks": "^2.9.0",
 		"@opentelemetry/sdk-trace-base": "^2.9.0",
 		"@types/bun": "^1.3.14"

package/src/tool-arguments.ts

@@ -12,9 +12,10 @@ export type ToolArgumentSource = "parsed" | "payload";
 
 /**
  * Validate a call's arguments against `tool`'s schema, honoring
- * {@link AgentTool.lenientArgValidation}: on a schema mismatch a lenient tool
- * receives its raw arguments minus the internal `__parseError`/`__rawJson`
- * sentinels. Malformed JSON from a provider stream is never lenient.
+ * {@link AgentTool.lenientArgValidation}: a lenient tool keeps unknown root
+ * keys its closed schema would heal away, and on a schema mismatch receives its
+ * raw arguments minus the internal `__parseError`/`__rawJson` sentinels.
+ * Malformed JSON from a provider stream is never lenient.
  *
  * @throws the validation error when the tool is strict or the arguments failed to parse.
  */
@@ -24,7 +25,9 @@ export function validateAgentToolArguments(
 	source: ToolArgumentSource = "parsed",
 ): ToolCall["arguments"] {
 	try {
-		return validateToolArguments(tool, toolCall);
+		const validated = validateToolArguments(tool, toolCall, { keepUnknownRootKeys: tool.lenientArgValidation });
+		// Kept unknown root keys must not smuggle the internal sentinels past validation.
+		return tool.lenientArgValidation ? withoutSentinels(validated) : validated;
 	} catch (error) {
 		const args: unknown = toolCall.arguments;
 		if (!tool.lenientArgValidation) throw error;
@@ -36,3 +39,12 @@ export function validateAgentToolArguments(
 		return fallback;
 	}
 }
+
+function withoutSentinels(args: ToolCall["arguments"]): ToolCall["arguments"] {
+	if (args === null || typeof args !== "object" || Array.isArray(args)) return args;
+	if (!Object.hasOwn(args, "__parseError") && !Object.hasOwn(args, "__rawJson")) return args;
+	const stripped = { ...(args as Record<string, unknown>) };
+	delete stripped.__parseError;
+	delete stripped.__rawJson;
+	return stripped;
+}

package/src/types.ts

@@ -1170,7 +1170,7 @@ export interface AgentTool<
 	 * before ordinary dispatch commits its result.
 	 */
 	speculation?: ToolSpeculationPolicy;
-	/** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM. Malformed argument JSON still returns the parse error. */
+	/** If true, schema validation errors are non-fatal: raw args are passed to execute() instead of returning an error to the LLM, and unknown root keys a closed schema would drop stay on the args. Malformed argument JSON still returns the parse error. */
 	lenientArgValidation?: boolean;
 	/**
 	 * Whether the agent loop may abort this tool mid-execution — or skip it
@@ -1229,6 +1229,13 @@ export interface AgentTool<
 	/** Lines appended after the standard approval prompt header. */
 	formatApprovalDetails?: (args: unknown) => string | string[] | undefined;
 
+	/**
+	 * Remembered-approval keys for `tools.approvalMode: always-ask-cached`: the files (or URL
+	 * targets) this call touches. When every key is already granted the call skips its prompt;
+	 * approving the call can record them. Omit it (or return `undefined`) and the call prompts by tier.
+	 */
+	approvalCacheTargets?: (args: unknown) => readonly string[] | undefined;
+
 	/** The main execution callback for this tool. */
 	execute: AgentToolExecFn<TParameters, TDetails, TTheme>;