@oh-my-pi/pi-ai 17.1.7 → 17.2.0

package/CHANGELOG.md

@@ -2,6 +2,70 @@
 
 ## [Unreleased]
 
+## [17.2.0] - 2026-07-30
+
+### Added
+
+- Added first-class parentTurnId support for nested Codex requests, allowing stream options and metadata helpers to accept and safely propagate the initiating turn's ID.
+- Added preservation of the Codex `encrypted_function_args` plaintext-collaboration marker on replayed function calls, keeping server-marked plaintext tool arguments from being reinterpreted as encrypted on subsequent turns.
+- Added interactive Exa API-key login through `/login exa`, opening the official API-key dashboard and saving pasted keys to the credential store ([#1798](https://github.com/can1357/oh-my-pi/issues/1798)).
+- Cursor's modern exec wire protocol is now handled end to end. `agent.proto` models the frames current Cursor CLI builds emit — the seven Pi tools (`ExecServerMessage` 45-51), hooks, subagents, allowlist prechecks, MCP state, smart-mode classification, canvas diagnostics, conversation search, agent-store conflicts and git diff — and every one of them gets a typed answer. The Pi frames run their local equivalents (`read`/`bash`/`edit`/`write`/`grep`/`glob`); the rest answer with the error, not-found or empty-but-valid variant that is actually true of this client. Frames this build cannot name at all now raise `ExecClientControlMessage.throw` with `unknown_exec_variant`, and recognised frames with no truthful answer (`git_diff_request`, whose `GetDiffResponse` has no error variant) raise `exec_variant_unsupported`, instead of a silent ack that leaves the server waiting.
+- `lsp` is advertised in the MCP tool catalog again. It was filtered out as a Cursor-native tool, but the native `diagnostics` frame covers one of roughly ten LSP actions, so the other nine were unreachable.
+- Added `pinSessionOAuthAccount` support for backdating the sticky's last-use timestamp (`options.lastUsedAtMs`), so pins restored from persisted sessions keep the provider's warm-window semantics: resumes inside the prompt-cache TTL reuse the account, stale resumes still re-rank.
+
+### Changed
+
+- Codex turn metadata now reserves the codex-rs `code_mode_tool_names` key, preventing caller-supplied client metadata extras from colliding with the core-owned field.
+- Codex SSE requests to the official endpoint now use zstd-compressed bodies by default to match the official client, which can be disabled with PI_CODEX_ZSTD=0.
+- API-key validation now preserves provider HTTP status and retry headers, allowing authentication, rate-limit, and server failures to retain their original error classifications.
+- The Cursor Pi arg translation (`piReadPath`, `piJoinPath`, `piLsPath`, `piEscapeRegexLiteral`, `piLimit`) moved to `providers/cursor-pi-args`, re-exported from `providers/cursor/exec-modern` so existing imports are unaffected. The legacy pi shim shares these helpers and is compiled into the bundled virtual module registry, where a nested `providers/<dir>/<mod>` specifier is unresolvable under bunfs — and importing them from the exec module would drag the whole protobuf graph in for two string functions.
+
+### Fixed
+
+- Fixed Novita login rejecting valid API keys belonging to Developer and Basic team members by validating against the chat completions endpoint instead of the billing balance endpoint.
+- Fixed Cursor resource_exhausted errors being incorrectly classified as QUOTA_EXHAUSTED (which caused 30-minute credential blocks), mapping them to MODEL_CAPACITY_EXHAUSTED with a shorter backoff instead.
+- Fixed a crash in Amazon Bedrock and Devin providers when Context.systemPrompt is passed as a bare string.
+- Fixed aborted usage-limit recovery incorrectly blocking credentials or waiting on local usage fetches after the session had already changed.
+- Fixed Codex WebSocket sessions echoing stale or missing turn states by capturing x-codex-turn-state refreshes from response metadata event headers.
+- Fixed Harmony-dialect models (e.g., gpt-5.x, openai-codex) failing with invalid_prompt or "Request blocked" errors by escaping reserved control tokens in untrusted user and tool-result text.
+- Fixed named forced tool_choice not being enforced on string-only OpenAI-compatible hosts (such as llama.cpp and LM Studio) by narrowing the advertised tools to the forced tool.
+- Fixed direct Anthropic Claude Opus requests failing with HTTP 400 when the endpoint rejects strict tool fields.
+- Fixed usage-based credential ranking for Anthropic accounts where a missing long-window (7-day) metric was incorrectly treated as a short-window metric.
+- Fixed legacy Codex usage blocks continuing to gate all models after per-meter backoff was introduced, splitting the old shared scope into independent chat and spark blocks while maintaining backward compatibility with older clients and database schemas.
+- Fixed Anthropic retry loops ignoring `maxRetryDelayMs` for long server `retry-after` hints, so over-budget delays surface immediately without losing response details or abort cleanup ([#7003](https://github.com/can1357/oh-my-pi/issues/7003)).
+- Added interactive xAI API-key login with key validation through the xAI models endpoint.
+- Fixed Google Gemini and Vertex tool declarations carrying numeric, boolean, object-valued, or mixed `enum` arrays that the Google Schema wire type cannot represent. Unsupported enums are omitted while valid string enums remain constrained.
+- Umans usage provider: fetches `GET /v1/usage` and surfaces the rolling 5h request window + concurrency limits in `/usage`, `omp usage`, and the TUI status bar.
+- Fixed ranged legacy Cursor reads reporting the returned window byte length as the full file size.
+- Updated the Cursor client build advertisement to activate the modern exec-frame protocol handled by this provider.
+- Fixed a windowed Cursor `read` reporting the window's line count as the file's. `total_lines` and `file_size` were derived from the payload, which is the whole file only for an unranged read — a 20-line page of a 100-line file answered `total_lines: 20`, which a paginating server reads as the end of the file. The count now comes from the read's own record of the file (`details.meta.truncation.totalLines`), falling back to counting the payload when the read returned the file whole.
+- Fixed a `pi_grep` that hit the native backend's internal match ceiling answering as an unqualified success. `GrepTool` folds that cap into the flat `details.truncated` alone, setting neither `details.truncation` nor `perFileLimitReached` — the two fields the Pi result was built from — so the one truncation a caller can neither detect nor page around was the one it was never told about. The flat flag is now translated into a `PiTruncation`, and only when no specific cap already reported itself.
+- Fixed a `pi_grep` frame's `context` and `limit` vanishing from the transcript. The bridge honors both by building a scoped `grep`, but neither is expressible in the model-facing schema, so the synthesized block recorded a plain pattern/path search — replaying a context-widened or capped search as an ordinary grep sitting beside output no ordinary grep produces. Both are now recorded on the block.
+- Fixed a Cursor MCP resource listing shrinking to a count in the transcript. The full URI/name/mime catalog goes out on the wire, but the paired local result recorded `Listed N MCP resource(s)` — and rebuilt history is serialized from that result, so one reload later the model knew it had seen N resources and could name none of them. The paired result now lists what the answer carried.
+- Fixed the `pi_read` range translation padding the slice it asks for. `piReadPath` composed a plain `:N+K` selector, which the local `read` tool expands by one leading and three trailing context line — so a frame naming offset 5/limit 20 received lines 4-27. Ranged Pi reads now compose `:raw:N+K`; the wire result is an opaque output string, so the line-number gutter `raw` also drops carries nothing the contract needs.
+- Fixed four Cursor exec frames answering with a result whose oneof was never set. In proto3 that is not an empty result — the server reads it as "the tool ran and produced nothing", indistinguishable from real success. `listMcpResourcesExecResult`, `readMcpResourceExecResult`, `recordScreenResult` and `computerUseResult` now send `ListMcpResourcesSuccess{resources: []}`, `ReadMcpResourceNotFound{uri}`, `RecordScreenFailure` and `ComputerUseError` respectively.
+- The MCP resource frames now answer from the host instead of a fixed verdict. `CursorExecHandlers` gained `listMcpResources`/`readMcpResource`, so a host holding live MCP connections advertises them; the empty catalog and `not_found` above remain the answer when no handler is supplied. A handler that throws surfaces as `ListMcpResourcesError`/`ReadMcpResourceError` rather than collapsing into "none exist", which the model cannot retry. A read carrying `download_path` forwards it and answers with `ReadMcpResourceSuccess.download_path` and no content, which is what that mode means.
+- Fixed Cursor `connect_scm` calls losing their repository and settling on a fabricated verdict. The target rides in the `ConnectScmArgs.target` oneof, so reading a flat `github` property always saw `undefined`; and the authoritative `success`/`error`/`rejected` result only arrives on the completion frame, so answering at the announcement persisted a fixed failure for every call — including the ones the server went on to accept. The block now opens on the start frame and settles from the completion's decoded result.
+- Fixed interleaved Cursor tool calls corrupting each other. The stream decoder tracked a single "current" block and settled it on any `toolCallCompleted`, ignoring the envelope's `call_id`: a completion for one call closed whichever block happened to be open and paired it with the wrong result, and `start A, start B` orphaned A entirely so its own completion settled B while A was never paired — which strips the whole interaction from every rebuilt transcript. Open blocks are now retained per envelope `call_id`, and end-of-stream closes all of them rather than only the last.
+- Fixed a Cursor `search_conversations` call leaving no transcript block. The frame is answered from a fixed verdict, so nothing downstream pairs a result for it, and an unpaired call takes its whole interaction out of every rebuilt transcript.
+- Fixed a Cursor `read_mcp_resource` call leaving no transcript block. The frame runs locally — and in download mode writes a workspace file — but synthesized no tool call and paired no result, so the read was invisible in the UI and absent from every rebuilt history; a resource download could mutate the workspace with nothing on record. The frame now synthesizes a `read_mcp_resource` block (not `read`: it is a remote MCP operation, and the name drives rendering and prune semantics) and pairs a result on success, not-found and error alike. Frames answered without a handler still synthesize nothing, since nothing ran.
+- Fixed a Cursor `list_mcp_resources` call leaving no transcript block. The model consumed the catalog, but the frame synthesized no tool call and paired no result — its streamed `ListMcpResourcesToolCall` announcement was equally unrecognized — so the listing was invisible in the UI and absent from every rebuilt history. Frames a handler answered now synthesize a `list_mcp_resources` block and pair a result derived from the same answer that went on the wire; frames answered from the fixed no-handler catalog still synthesize nothing, since nothing ran.
+- Fixed an unavailable `pi_edit`/`pi_write` answering with the error variant. Both results model refusal and failure as separate oneof cases, and a denial reported as `error` reads as "the tool ran and broke" — inviting a retry of an operation that was never permitted. A frame whose tool is not granted, or whose handler produced nothing, now answers with `PiEditExecRejected`/`PiWriteExecRejected`; execution failures keep the error variant.
+- Fixed a Cursor MCP approval probe actually running the tool. A modern `mcpArgs` frame carrying `smart_mode_approval_only` asks only whether a call would be permitted, not for the call itself. The decoder dropped the flag, so the frame ran a side-effecting MCP tool the user had not been asked about, then ran it again when the real call followed. The flag is now carried through and the probe is answered from the host's policy without executing: approved only for a definite allow, refused for a deny, for a mode that demands a prompt the frame cannot raise, and for a tool the session does not have. No transcript block is synthesized either, since nothing ran.
+- Fixed the Cursor stream's end-of-transport cleanup erasing the arguments of every block still open. Blocks whose args arrive whole (todo, connect-SCM, MCP) never feed the streamed partial-JSON buffer, and reparsing an absent buffer yields `{}`, so a truncated or disconnected turn rebuilt those calls with no arguments at all. Only blocks that actually streamed their args are reparsed now.
+- Fixed a Cursor stream dying mid-turn stranding the call it left open. `connect_scm` and native todo blocks are stamped resolved the moment they open, so the agent loop synthesizes no placeholder and only their completion frame pairs a result — a transport that closed first left the card animating and the call unpaired, which takes the whole interaction out of every rebuilt transcript. The terminal-error path now closes open blocks and pairs those server-owned calls with an interrupted result; the flush ran only on clean completion before, which is not the path a dying stream takes. Exec-settled MCP blocks are left alone, since the dispatch that ran them owns their result.
+- Fixed the Pi exec frames displaying a different operation than the one they run. The provider synthesized its transcript block from a second, hand-rolled translation of the frame args, so `pi_read`'s `offset`/`limit` were shown as a whole-file read, `pi_grep`'s `literal` pattern as an unescaped regex, and `pi_find`'s path/glob join differed from the executed one. Both sides now share a single translation.
+- Fixed the streamed `pi_*_tool_call` announcements that modern builds send alongside each exec frame being unrecognized. The exec channel already synthesizes those blocks when it runs the tool; the duplicate was avoided only because the decoder recognized none of the variants, which would have started double-rendering as soon as any one was added.
+- Fixed `pi_bash` results reaching Cursor clipped with no truncation notice. Two truncation records exist locally: `read`/`grep` set `details.truncation`, which carries an explicit `truncated` flag, while `bash` sets `details.meta.truncation`, whose record has no such flag — its presence is the signal. `piTruncation` read only the first shape and required the flag, so every real Bash truncation was dropped and the server was told the clipped output was complete. Both shapes now translate, and an explicit `truncated: false` still suppresses the field.
+
+## [17.1.8] - 2026-07-28
+
+### Fixed
+
+- Fixed an HTTP 400 error when resuming or replaying OpenAI history after an interrupted native Computer Use turn.
+- Fixed connection 404 errors when using Google Vertex AI in multi-region locations (eu and us) by correctly resolving regional endpoint (REP) hosts.
+- Fixed a resource leak in SqliteAuthCredentialStore.close() where unclosed prepared statements kept the SQLite connection alive, preventing database file cleanup (especially on Windows where files remained locked).
+
 ## [17.1.7] - 2026-07-27
 
 ### Changed

package/dist/types/auth-broker/server.d.ts

@@ -20,6 +20,11 @@ export interface AuthBrokerServerOptions {
      * without long sleeps. Default {@link DEFAULT_STREAM_KEEPALIVE_MS}.
      */
     streamKeepaliveMs?: number;
+    /**
+     * Override cross-process SQLite change polling in milliseconds.
+     * Internal-only — tests use a short interval. Default 250ms.
+     */
+    externalChangePollMs?: number;
 }
 export interface AuthBrokerServerHandle {
     /** Bound URL (`http://host:port`). */

package/dist/types/auth-broker/types.d.ts

@@ -131,6 +131,10 @@ export type SnapshotStreamEvent = SnapshotStreamSnapshotEvent | SnapshotStreamEn
  * unauthenticated for liveness probes; everything else requires a bearer.
  */
 export declare const AUTH_BROKER_API_PREFIX = "/v1";
+/** Request header used by clients to advertise optional auth-broker protocol features. */
+export declare const AUTH_BROKER_CAPABILITIES_HEADER = "OMP-Auth-Broker-Capabilities";
+/** Client understands independent Codex `chat` and `spark` credential-block scopes. */
+export declare const AUTH_BROKER_CAPABILITY_CODEX_METER_BLOCK_SCOPES = "codex-meter-block-scopes";
 /** Default port when none is configured. Loopback-only, no external exposure. */
 export declare const DEFAULT_AUTH_BROKER_BIND = "127.0.0.1:8765";
 /** Default broker→provider refresh skew. Refresh credentials this close to expiry. */

package/dist/types/auth-storage.d.ts

@@ -257,6 +257,13 @@ export interface CredentialRefreshLeaseFence {
 }
 export interface AuthCredentialStore {
     close(): void;
+    /**
+     * Stateful probe for commits made by another process to the backing store.
+     * Returns true once per observed change.
+     */
+    pollExternalChanges?(): boolean;
+    /** Record the current auth revision after a local mutation already notified consumers. */
+    acknowledgeLocalChanges?(): void;
     /** Optional hook to notify the underlying store that usage report cache is stale. */
     invalidateUsageCache?(signal?: AbortSignal): Promise<void>;
     listAuthCredentials(provider?: string): StoredAuthCredential[];
@@ -711,6 +718,11 @@ export declare class AuthStorage {
      */
     close(): void;
     getGeneration(): number;
+    /**
+     * Reload state after another process commits to the backing store, then
+     * notify snapshot consumers even when only credential blocks changed.
+     */
+    pollExternalChanges(): Promise<boolean>;
     onGenerationChanged(listener: (generation: number) => void): () => void;
     offGenerationChanged(listener: (generation: number) => void): void;
     /**
@@ -1041,8 +1053,15 @@ export declare class AuthStorage {
      * The durable credential id keeps the pin stable across credential refreshes,
      * storage reordering, and process restarts. Normal auth retry and usage-limit
      * handling may still route around an unavailable account.
+     *
+     * `options.lastUsedAtMs` backdates the sticky's last-use timestamp so a pin
+     * restored from a persisted session keeps the provider's warm-window
+     * semantics: a resume inside the prompt-cache TTL reuses the account, a
+     * stale resume still re-ranks.
      */
-    pinSessionOAuthAccount(provider: string, sessionId: string, credentialId: number): boolean;
+    pinSessionOAuthAccount(provider: string, sessionId: string, credentialId: number, options?: {
+        lastUsedAtMs?: number;
+    }): boolean;
     /**
      * Resolve every stored OAuth credential for `provider` independently.
      *
@@ -1314,5 +1333,11 @@ export declare class SqliteAuthCredentialStore implements AuthCredentialStore {
      * Delete all credentials for a provider.
      */
     deleteProvider(provider: string): void;
+    /**
+     * SQLite increments `data_version` when another connection commits. Own
+     * writes leave it unchanged and already notify AuthStorage directly.
+     */
+    pollExternalChanges(): boolean;
+    acknowledgeLocalChanges(): void;
     close(): void;
 }

package/dist/types/error/classes.d.ts

@@ -31,12 +31,16 @@ export declare class OpenAIHttpError extends ProviderHttpError {
         code: string | undefined;
     };
 }
+/** Test-only control for the otherwise bounded Anthropic error-body drain. */
+export declare const __anthropicApiErrorForTesting: {
+    setBodyReadTimeoutMs(timeoutMs: number | undefined): void;
+};
 /** Non-2xx response from the Anthropic API. */
 export declare class AnthropicApiError extends ProviderHttpError {
     readonly headers: Headers;
     readonly requestId: string | null;
     constructor(status: number, message: string, headers: Headers);
-    static fromResponse(response: Response): Promise<AnthropicApiError>;
+    static fromResponse(response: Response, signal?: AbortSignal): Promise<AnthropicApiError>;
 }
 /** Network-level failure (DNS, TLS, socket reset) after retries were exhausted. */
 export declare class AnthropicConnectionError extends Error {

package/dist/types/error/rate-limit.d.ts

@@ -5,11 +5,12 @@
 export type RateLimitReason = "QUOTA_EXHAUSTED" | "RATE_LIMIT_EXCEEDED" | "MODEL_CAPACITY_EXHAUSTED" | "SERVER_ERROR" | "UNKNOWN";
 /**
  * Classify a rate-limit error message into a reason category.
- * Priority order: QUOTA (Antigravity "quota will reset") > MODEL_CAPACITY > QUOTA (account) >
- * RATE_LIMIT > QUOTA (generic) > SERVER_ERROR > UNKNOWN.
+ * Priority order: explicit details in a resource-exhausted error > QUOTA
+ * (Antigravity "quota will reset") > MODEL_CAPACITY > QUOTA (account) >
+ * RATE_LIMIT > QUOTA (generic) > SERVER_ERROR > bare resource-exhausted > UNKNOWN.
  *
- * "resource exhausted" maps to MODEL_CAPACITY (transient, short wait)
- * "quota exceeded" / "quota will reset" maps to QUOTA_EXHAUSTED (long wait, switch account)
+ * Bare "resource exhausted" / "resource_exhausted" maps to MODEL_CAPACITY (transient, short wait).
+ * Explicit details such as "quota exceeded" retain their normal classification.
  */
 export declare function parseRateLimitReason(errorMessage: string): RateLimitReason;
 /**

package/dist/types/providers/anthropic-client.d.ts

@@ -9,6 +9,12 @@ export interface AnthropicRequestOptions {
     timeout?: number;
     /** Per-request retry budget override. */
     maxRetries?: number;
+    /**
+     * Maximum delay in milliseconds to wait for a server-directed retry. If the
+     * server's `retry-after` hint exceeds this value, the retry is declined and
+     * the original error is surfaced. Non-positive values disable the cap. Defaults to 60000.
+     */
+    maxRetryDelayMs?: number;
     /** Per-request headers merged after client defaults. */
     headers?: Record<string, string>;
 }
@@ -38,6 +44,12 @@ export interface AnthropicClientOptions {
     authToken?: string | null;
     baseURL?: string | null;
     maxRetries?: number;
+    /**
+     * Maximum delay in milliseconds to wait for a server-directed retry. If the
+     * server's `retry-after` hint exceeds this value, the retry is declined and
+     * the original error is surfaced. Non-positive values disable the cap. Defaults to 60000.
+     */
+    maxRetryDelayMs?: number;
     /** Pre-response timeout in milliseconds. Defaults to 10 minutes. */
     timeout?: number;
     defaultHeaders?: Record<string, string>;
@@ -45,7 +57,7 @@ export interface AnthropicClientOptions {
     fetchOptions?: AnthropicFetchOptions;
 }
 /** Server-suggested delay (`retry-after-ms`, then `retry-after` seconds or HTTP date). */
-export declare function retryDelayFromHeaders(headers: Headers | undefined): number | undefined;
+export declare function retryDelayFromHeaders(headers: Pick<Headers, "get"> | undefined): number | undefined;
 export declare function calculateAnthropicRetryDelayMs(attempt: number): number;
 /**
  * Lazy in-flight request handle. The HTTP request starts on the first

package/dist/types/providers/anthropic.d.ts

@@ -1,4 +1,4 @@
-import type { FetchImpl, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
+import type { Api, FetchImpl, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions, StreamFunction, StreamOptions, Usage } from "../types.js";
 import { type AnthropicFetchOptions, type AnthropicMessagesClientLike } from "./anthropic-client.js";
 import { type FallbackParam, type MessageParam, type TextBlockParam } from "./anthropic-wire.js";
 export type AnthropicHeaderOptions = {
@@ -26,6 +26,12 @@ type AnthropicCacheControl = NonNullable<TextBlockParam["cache_control"]>;
  * hasn't been materialized yet.
  */
 export declare function clearAnthropicFastModeFallback(providerSessionState: Map<string, ProviderSessionState> | undefined): void;
+/**
+ * Whether the direct Anthropic model's endpoint-scoped fast-mode fallback is
+ * currently active. Reading the map directly is intentional: inspection must
+ * not materialize a state entry for a model that has never streamed.
+ */
+export declare function isAnthropicFastModeFallbackDisabled(providerSessionState: Map<string, ProviderSessionState> | undefined, model: Model<Api>): boolean;
 export * from "./claude-code-fingerprint.js";
 export declare function mapStainlessOs(platform: string): "MacOS" | "Windows" | "Linux" | "FreeBSD" | `Other::${string}`;
 export declare function mapStainlessArch(arch: string): "x64" | "arm64" | "x86" | `other::${string}`;
@@ -156,6 +162,7 @@ export type AnthropicClientOptionsArgs = {
     thinkingDisplay?: AnthropicThinkingDisplay;
     disableStrictTools?: boolean;
     fetch?: FetchImpl;
+    maxRetryDelayMs?: number;
     claudeCodeSessionId?: string;
 };
 export type AnthropicClientOptionsResult = {
@@ -164,6 +171,7 @@ export type AnthropicClientOptionsResult = {
     authToken?: string | null;
     baseURL?: string;
     maxRetries: number;
+    maxRetryDelayMs?: number;
     defaultHeaders: Record<string, string>;
     fetch?: FetchImpl;
     fetchOptions?: AnthropicFetchOptions;

package/dist/types/providers/cursor/exec-modern.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Proto builders for the modern Cursor CLI exec frames (`ExecServerMessage`
+ * 27-31, 36-38, 40-55).
+ *
+ * Split out of `cursor.ts` because these are pure `create(...)` shapes with no
+ * transport, stream, or block-state coupling: the dispatcher decides *which*
+ * answer a frame gets, this module knows *what* that answer looks like on the
+ * wire. Every builder returns a result whose oneof case is set — an
+ * `ExecClientMessage` carrying a result with an unset oneof is a fake success
+ * the server reads as "the tool ran and produced nothing".
+ */
+import { type ExecuteHookRequest, type ExecuteHookResult, type McpStateExecResult, type McpToolDefinition, type PiBashExecResult, type PiEditExecResult, type PiFindExecResult, type PiGrepExecResult, type PiLsExecResult, type PiReadExecResult, type PiTruncation, type PiWriteExecResult } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
+import type { ToolResultMessage } from "../../types.js";
+/**
+ * The pure arg translation lives in `../cursor-pi-args` so the legacy pi shim
+ * can share it without pulling this module's protobuf graph into the bundled
+ * virtual registry. Re-exported here because this is where the frame builders
+ * and their translation are consumed together.
+ */
+export { piEscapeRegexLiteral, piGrepSkip, piJoinPath, piLimit, piLsPath, piReadDisplayPath, piReadPath, piTimeout, } from "../cursor-pi-args.js";
+/** Flatten a tool result's content into the single `output` string the Pi frames carry. */
+export declare function piOutputText(toolResult: ToolResultMessage): string;
+/**
+ * Translate a local tool's truncation summary into `PiTruncation`.
+ *
+ * Two shapes reach here. `read`/`grep` set `details.truncation`
+ * (`TruncationResult`), which carries an explicit `truncated` boolean. `bash`
+ * sets `details.meta.truncation` (`TruncationMeta`), which has **no** such
+ * flag — its presence *is* the signal, and requiring the boolean silently
+ * dropped every Bash truncation, handing Cursor clipped output with no notice
+ * that it was clipped.
+ *
+ * Returns `undefined` when nothing was truncated: the field is `optional` on
+ * every Pi success message, and emitting a zeroed `PiTruncation` would tell the
+ * server the output was trimmed to nothing.
+ */
+export declare function piTruncation(toolResult: ToolResultMessage): PiTruncation | undefined;
+export declare function buildPiReadResult(toolResult: ToolResultMessage): PiReadExecResult;
+export declare function buildPiReadError(error: string): PiReadExecResult;
+export declare function buildPiBashResult(toolResult: ToolResultMessage): PiBashExecResult;
+export declare function buildPiBashError(error: string): PiBashExecResult;
+/**
+ * `PiEditExecSuccess` requires `diff` and `patch` alongside `output`. The local
+ * `edit` tool reports them under `details`; when it does not, the strings stay
+ * empty rather than being faked from the output text.
+ */
+export declare function buildPiEditResult(toolResult: ToolResultMessage): PiEditExecResult;
+export declare function buildPiEditError(error: string): PiEditExecResult;
+/**
+ * A refusal is not an execution failure: `PiEditExecResult` models them as
+ * separate variants, and answering a denied call with `error` reads as "the
+ * edit ran and broke", which invites a retry of an operation that was never
+ * permitted.
+ */
+export declare function buildPiEditRejected(reason: string): PiEditExecResult;
+export declare function buildPiWriteResult(toolResult: ToolResultMessage): PiWriteExecResult;
+export declare function buildPiWriteError(error: string): PiWriteExecResult;
+/** Same variant split as {@link buildPiEditRejected}. */
+export declare function buildPiWriteRejected(reason: string): PiWriteExecResult;
+export declare function buildPiGrepResult(toolResult: ToolResultMessage): PiGrepExecResult;
+export declare function buildPiGrepError(error: string): PiGrepExecResult;
+export declare function buildPiFindResult(toolResult: ToolResultMessage): PiFindExecResult;
+export declare function buildPiFindError(error: string): PiFindExecResult;
+export declare function buildPiLsResult(toolResult: ToolResultMessage): PiLsExecResult;
+export declare function buildPiLsError(error: string): PiLsExecResult;
+/**
+ * Answer `mcpStateExecArgs` (frame 36) from the catalog already advertised in
+ * `RequestContext.tools`.
+ *
+ * This client hosts no MCP servers of its own: every forwarded tool is a local
+ * pi-agent tool published under a synthetic `providerIdentifier`. Regrouping
+ * the same list keeps the server's view of "which servers exist and what do
+ * they expose" consistent with what it was told at context time, instead of
+ * claiming zero servers while tool calls for them keep arriving.
+ *
+ * `serverIdentifiers` filters the answer when the server asks about specific
+ * servers. `kickOnly` is a restart request — there is nothing to restart, so it
+ * is answered with the same state rather than an error.
+ */
+export declare function buildMcpStateResult(tools: McpToolDefinition[], serverIdentifiers: readonly string[]): McpStateExecResult;
+/**
+ * Build the neutral response for a hook query: the matching response case with
+ * every field unset.
+ *
+ * This client runs no Cursor hooks, and every field of every response variant
+ * is `optional` — so an empty response of the right case means "no hook had
+ * anything to say", which is exactly true. It is NOT the unset-oneof fake
+ * success: the case itself is set, only the payload is empty.
+ *
+ * `ExecuteHookRequest` and `ExecuteHookResponse` are parallel oneofs whose case
+ * names line up, but the two unions are unrelated to the compiler: a `switch`
+ * is what makes each pairing individually type-checked, and it forces a
+ * deliberate branch when a future regen adds a request case.
+ *
+ * Returns `null` for a request case this build does not model, which the
+ * dispatcher answers with `ExecClientThrow` rather than guessing a case.
+ */
+export declare function buildNeutralHookResult(request: ExecuteHookRequest | undefined): ExecuteHookResult | null;

package/dist/types/providers/cursor-pi-args.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Translate a Pi frame's args into the local tool kwargs that run it.
+ *
+ * Shared deliberately by three consumers: the provider synthesizes a display
+ * block from these, the coding-agent bridge executes with them, and the legacy
+ * pi shim performs the identical translation for the old wire. Separate
+ * hand-rolled copies drift, and the drift is invisible — the transcript shows
+ * one operation while a different one runs.
+ *
+ * Kept apart from `cursor/exec-modern.ts` on purpose: these are pure
+ * string/path functions with no protobuf coupling, while that module pulls in
+ * `@bufbuild/protobuf` and the generated `agent_pb` graph. The legacy shim is
+ * compiled into the bundled virtual module registry, so importing it from a
+ * nested path would drag the whole exec implementation in with it — and
+ * `./providers/*` is a single-segment wildcard export that cannot serve a
+ * nested specifier under bunfs (issue #3442).
+ *
+ * Every `optional int32` here is presence-sensitive: `0` is a supplied value,
+ * not "unset", so it must never be folded into a default.
+ */
+/**
+ * A `pi_read` range composed onto the path as `read`'s inline `:raw:N+K`
+ * selector.
+ *
+ * `read` exposes no range kwargs, so an uncomposed range reads the whole file.
+ * `offset` is a 1-indexed start clamped like the reference's
+ * `Math.max(0, offset - 1)` over 0-indexed lines; `limit` is a line count.
+ * `null` marks a present `limit: 0` — zero lines, which no selector expresses
+ * and which must not degrade into a whole-file read.
+ *
+ * The range is `raw` because a plain `:N+K` deliberately pads with one leading
+ * and three trailing context lines: helpful for a human reading a snippet,
+ * wrong for a caller that asked for exactly `limit` lines from `offset`. The
+ * wire result is an opaque `output` string, so the hashline and line-number
+ * gutter that `raw` also drops carry nothing the frame's contract needs.
+ * A range-free read keeps the ordinary form — whole-file reads want them.
+ */
+export declare function piReadPath(readPath: string, offset?: number, limit?: number): string | null;
+/**
+ * The same range as {@link piReadPath}, rendered for a transcript block rather
+ * than for execution.
+ *
+ * Differs only at `limit: 0`, where `piReadPath` returns `null` because no
+ * selector reads zero lines and the frame is answered with empty output
+ * directly. The block still has to say so: falling back to the bare path there
+ * would record a whole-file read whose result is empty, which is the widest
+ * possible gap between what a rebuilt transcript shows and what happened.
+ * `+0` is never executed — it exists to be read.
+ */
+export declare function piReadDisplayPath(readPath: string, offset?: number, limit?: number): string;
+/**
+ * A legacy `grep` frame's pagination `offset` as the local tool's file `skip`.
+ *
+ * `grep` paginates by file and reports "use skip=N for the next page" in that
+ * same unit, so the offset maps across directly. A present `0` means "start at
+ * the beginning", which is the unskipped search rather than a skip of zero.
+ *
+ * Shared because both the executing bridge and the provider's transcript
+ * synthesis need it: a block showing an unskipped search beside a result from
+ * a later file window misreports what was searched.
+ */
+export declare function piGrepSkip(offset?: number): number | undefined;
+/**
+ * Join a Pi frame's optional `path` with the `glob`/`pattern` it scopes.
+ *
+ * The local `grep`/`glob` tools take one combined path spec. An absolute
+ * pattern ignores the path, and an absent or `.` path leaves the pattern
+ * standing alone rather than building a `./`- or `//`-prefixed spec.
+ *
+ * Uses `node:path` rather than string surgery so Windows absolutes (`C:\…`,
+ * UNC) are recognised and separators stay normalized.
+ */
+export declare function piJoinPath(basePath: string | undefined, pattern: string): string;
+/**
+ * The path a `pi_ls` frame lists.
+ *
+ * The frame's `limit` is deliberately NOT mapped. It caps directory *entries*
+ * (the reference does a flat `readdir` and slices the entry array), while the
+ * local `read` tool renders a depth-2 tree with per-directory caps and elision
+ * summaries and applies a selector as a *rendered line* slice. Nested rows,
+ * headers and "N more" lines all count toward that slice, so `:1+K` would cap
+ * a different unit while looking honored — worse than leaving it unset, which
+ * at least reports the local listing's own truncation faithfully.
+ */
+export declare function piLsPath(basePath: string | undefined): string;
+/** Escape a literal string so the regex-only local `grep` tool matches it verbatim. */
+export declare function piEscapeRegexLiteral(value: string): string;
+/** Clamp a present `optional int32` result cap the way the reference does; `undefined` stays unset. */
+export declare function piLimit(limit: number | undefined): number | undefined;
+/**
+ * A `pi_bash` frame's timeout as the local `bash` tool's kwarg.
+ *
+ * Presence-sensitive like every other `optional int32` here, and unusually
+ * load-bearing: `bash` documents `timeout: 0` as "disables the command
+ * deadline", so folding a supplied `0` into `undefined` applies the 300s
+ * default and kills exactly the long-running command that asked not to be.
+ * Negative values have no local meaning and fall back to the default.
+ */
+export declare function piTimeout(timeout: number | undefined): number | undefined;

package/dist/types/providers/cursor.d.ts

@@ -3,10 +3,10 @@ import { type JsonValue } from "@bufbuild/protobuf";
 import type { McpToolDefinition } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import { type AgentServerMessage, type ConversationStateStructure } from "@oh-my-pi/pi-catalog/discovery/cursor-gen/agent_pb";
 import type { AssistantMessage, CursorExecHandlerResult, CursorExecHandlers, CursorExecPairing, CursorTodoSyncHandler, CursorToolResultHandler, Message, StreamFunction, StreamOptions, TextContent, ThinkingContent, Tool, ToolCall, ToolResultMessage } from "../types.js";
-import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
+import { kCursorExecResolved, kStreamingBlockIndex, kStreamingBlockKind, kStreamingEnvelopeId, kStreamingLastParseLen, kStreamingPartialJson } from "../utils/block-symbols.js";
 import { AssistantMessageEventStream } from "../utils/event-stream.js";
 export declare const CURSOR_API_URL = "https://api2.cursor.sh";
-export declare const CURSOR_CLIENT_VERSION = "cli-2026.01.09-231024f";
+export declare const CURSOR_CLIENT_VERSION = "cli-2026.07.23-e383d2b";
 export interface CursorOptions extends StreamOptions {
     customSystemPrompt?: string;
     conversationId?: string;
@@ -32,7 +32,8 @@ export type ToolCallState = ToolCall & {
     [kStreamingBlockIndex]: number;
     [kStreamingPartialJson]?: string;
     [kStreamingLastParseLen]?: number;
-    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec";
+    [kStreamingBlockKind]: "mcp" | "todo" | "cursor-exec" | "connect-scm";
+    [kStreamingEnvelopeId]?: string;
     [kCursorExecResolved]?: true;
 };
 export interface BlockState {
@@ -43,6 +44,17 @@ export interface BlockState {
         [kStreamingBlockIndex]: number;
     }) | null;
     currentToolCall: ToolCallState | null;
+    /**
+     * Open streamed tool-call blocks, keyed by the interaction envelope's
+     * `call_id`.
+     *
+     * Cursor interleaves calls: two `toolCallStarted` frames can arrive before
+     * either completes. A single "current" slot would let the second overwrite
+     * the first, orphaning a block that nothing then settles. Every keyed block
+     * stays reachable until its own completion, and `currentToolCall` remains
+     * only as the fallback for frames that carry no `call_id`.
+     */
+    openToolCalls: Map<string, ToolCallState>;
     /** MCP call IDs synthesized from exec frames before their redundant streamed block arrives. */
     resolvedMcpToolCallIds: Set<string>;
     firstTokenTime: number | undefined;
@@ -102,6 +114,44 @@ export declare function resolveExecHandler<TArgs, TResult>(args: TArgs, handler:
  * specific recovery hint.
  */
 export declare function emptyGrepPatternRejection(pattern: string | undefined, glob: string | undefined): string | null;
+/**
+ * Retain a freshly opened streamed tool-call block.
+ *
+ * Keyed by the interaction envelope's `call_id`, which is the only key every
+ * `ToolCall*Update` for that call shares. The block's own `id` is deliberately
+ * not the key: MCP, Pi and connect-SCM blocks are filed under the id carried
+ * inside the call's `args`, because that is what the exec channel pairs its
+ * result under and what the transcript files the visible block under.
+ *
+ * `currentToolCall` is still set, as the fallback for frames that carry no
+ * `call_id` (proto3-optional, and unset on what older builds send).
+ */
+/**
+ * Close every tool-call block still open when the stream ends.
+ *
+ * Not just the last one started: with interleaved calls several can be open at
+ * once, and an unclosed block leaves its live card animating and its call
+ * unpaired.
+ *
+ * Only blocks fed by a streamed argument buffer get reparsed. Todo,
+ * connect-SCM and MCP-settled frames arrive with complete `arguments` and
+ * never set the partial buffer; `parseStreamingJson(undefined)` returns `{}`,
+ * so reparsing unconditionally would erase the arguments of every such block
+ * caught open by a truncated stream.
+ *
+ * Server-owned blocks are also paired here. `connect-scm` and `todo` are
+ * stamped {@link kCursorExecResolved} the moment they open, so `agent-loop.ts`
+ * synthesizes no placeholder for them and only their `toolCallCompleted` frame
+ * pairs a result. A transport that closes before that frame would leave the
+ * call unpaired, and `buildSessionContext` strips a dangling call from every
+ * rebuilt transcript — the interaction disappears. An interrupted result is
+ * emitted instead.
+ *
+ * MCP blocks are excluded even when resolved: the exec dispatch that marked
+ * them owns their result, and `drainInFlightDispatches` awaits it before this
+ * runs, so pairing here would duplicate one against the same `toolCallId`.
+ */
+export declare function flushOpenToolCalls(output: AssistantMessage, stream: AssistantMessageEventStream, state: BlockState): void;
 /**
  * Merge the decoded completion-frame `McpArgs` map into the args assembled
  * from streamed `args_text_delta` snapshots.

package/dist/types/providers/error-message.d.ts

@@ -1,10 +1,8 @@
 import type { Api, Model } from "../types.js";
 export declare function createProviderErrorMessage(model: Model<Api>, err: unknown): {
     role: "assistant";
-    content: {
-        type: "text";
-        text: string;
-    }[];
+    content: never[];
+    errorMessage: string;
     api: Api;
     provider: string;
     model: string;

package/dist/types/providers/openai-codex-responses.d.ts

@@ -27,6 +27,14 @@ export interface OpenAICodexResponsesOptions extends StreamOptions {
      * keys are ignored; extras are never emitted as top-level metadata fields.
      */
     clientMetadata?: Record<string, string>;
+    /**
+     * Turn id of the initiating (parent) Codex turn for nested requests such as
+     * subagent spawns (codex-rs `parent_turn_id`, #35835). Emitted both as the
+     * flat `client_metadata.parent_turn_id` key and inside the
+     * `x-codex-turn-metadata` JSON blob; blank values are ignored. The key is
+     * reserved: `clientMetadata` extras cannot supply it.
+     */
+    parentTurnId?: string;
     /**
      * Invoked when the server streams a `response.metadata` event carrying
      * ChatGPT moderation metadata (`metadata.openai_chatgpt_moderation_metadata`)
@@ -44,6 +52,8 @@ export interface OpenAICodexCompatibilityMetadataOptions {
     startNewTurn?: boolean;
     turnStartedAtUnixMs?: number;
     clientMetadata?: Readonly<Record<string, string>>;
+    /** Parent Codex turn id for nested requests; see {@link OpenAICodexResponsesOptions.parentTurnId}. */
+    parentTurnId?: string;
     /** Add the direct installation header required by `/responses/compact`. */
     includeInstallationHeader?: boolean;
 }

package/dist/types/providers/openai-responses-wire.d.ts

@@ -2453,6 +2453,14 @@ export interface ResponseFunctionToolCall {
      * The namespace of the function to run.
      */
     namespace?: string;
+    /**
+     * Plaintext-argument marker for collaboration tool calls (codex-rs
+     * `encrypted_function_args`, #35845): an empty array marks the arguments as
+     * plaintext agent-message payloads rather than encrypted blobs. Preserved
+     * verbatim across history replay so the backend keeps treating them as
+     * plaintext; omitted entirely for ordinary function calls.
+     */
+    encrypted_function_args?: string[];
     /**
      * The status of the item. One of `in_progress`, `completed`, or `incomplete`.
      * Populated when items are returned via API.