@oh-my-pi/pi-coding-agent 14.7.1 → 14.7.3

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## [Unreleased]
 
+## [14.7.2] - 2026-05-06
+### Breaking Changes
+
+- Removed the exported `BUILTIN_TOOL_METADATA` API, including `BuiltinEntry`-style metadata exports and discoverable-built-in helper exports, which will break consumers relying on those symbols
+
+### Changed
+
+- Updated discoverable tool search (`search_tool_bm25` and related discovery metadata) to read each tool’s own `summary` field when present, improving discoverability descriptions for built-in tools
+
+### Fixed
+
+- Fixed SearXNG web search Basic Auth validation to reject RFC 7617 control characters and clarified the equivalent `config.yml` and environment variable settings.
+- Fixed extension commands that return without starting a model turn leaving the interactive `Working…` spinner active indefinitely. (#927)
+- Fixed `authHeader: true` provider overrides without custom `models` so built-in model transport headers receive `Authorization: Bearer <resolved-key>` (#929).
+
 ## [14.7.1] - 2026-05-06
 
 ### Added

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "14.7.1",
+	"version": "14.7.3",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://github.com/can1357/oh-my-pi",
 	"author": "Can Boluk",
@@ -46,12 +46,12 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "0.21.0",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/omp-stats": "14.7.1",
-		"@oh-my-pi/pi-agent-core": "14.7.1",
-		"@oh-my-pi/pi-ai": "14.7.1",
-		"@oh-my-pi/pi-natives": "14.7.1",
-		"@oh-my-pi/pi-tui": "14.7.1",
-		"@oh-my-pi/pi-utils": "14.7.1",
+		"@oh-my-pi/omp-stats": "14.7.3",
+		"@oh-my-pi/pi-agent-core": "14.7.3",
+		"@oh-my-pi/pi-ai": "14.7.3",
+		"@oh-my-pi/pi-natives": "14.7.3",
+		"@oh-my-pi/pi-tui": "14.7.3",
+		"@oh-my-pi/pi-utils": "14.7.3",
 		"@puppeteer/browsers": "^2.13.0",
 		"@sinclair/typebox": "^0.34.49",
 		"@types/turndown": "5.0.6",

package/src/config/model-equivalence.ts

@@ -50,6 +50,7 @@ const TRAILING_CANONICAL_MARKERS = [
 	"minimal",
 	"xhigh",
 	"free",
+	"cloud",
 	"exacto",
 	"nitro",
 	"original",

package/src/config/model-registry.ts

@@ -421,6 +421,7 @@ interface ProviderOverride {
 	baseUrl?: string;
 	headers?: Record<string, string>;
 	apiKey?: string;
+	authHeader?: boolean;
 	compat?: Model<Api>["compat"];
 }
 
@@ -667,14 +668,20 @@ function mergeCustomModelHeaders(
 	authHeader: boolean | undefined,
 	apiKeyConfig: string | undefined,
 ): Record<string, string> | undefined {
-	let headers = providerHeaders || modelHeaders ? { ...providerHeaders, ...modelHeaders } : undefined;
-	if (authHeader && apiKeyConfig) {
-		const resolvedKey = resolveApiKeyConfig(apiKeyConfig);
-		if (resolvedKey) {
-			headers = { ...headers, Authorization: `Bearer ${resolvedKey}` };
-		}
+	return mergeAuthHeader({ ...providerHeaders, ...modelHeaders }, authHeader, apiKeyConfig);
+}
+
+function mergeAuthHeader(
+	headers: Record<string, string> | undefined,
+	authHeader: boolean | undefined,
+	apiKeyConfig: string | undefined,
+): Record<string, string> | undefined {
+	const nextHeaders = headers && Object.keys(headers).length > 0 ? { ...headers } : undefined;
+	if (!authHeader || !apiKeyConfig) {
+		return nextHeaders;
 	}
-	return headers;
+	const resolvedKey = resolveApiKeyConfig(apiKeyConfig);
+	return resolvedKey ? { ...nextHeaders, Authorization: `Bearer ${resolvedKey}` } : nextHeaders;
 }
 
 /**
@@ -726,6 +733,69 @@ function buildCustomModelOverlay(
 	};
 }
 
+// Custom provider entries often front a known upstream model through a local proxy.
+// Use bundled metadata for missing pricing/capability fields, but keep the custom transport.
+function shouldReplaceCustomReference(existing: Model<Api> | undefined, candidate: Model<Api>): boolean {
+	if (!existing) return true;
+	if (candidate.contextWindow !== existing.contextWindow) {
+		return candidate.contextWindow > existing.contextWindow;
+	}
+	if (candidate.maxTokens !== existing.maxTokens) {
+		return candidate.maxTokens > existing.maxTokens;
+	}
+	const existingHasCachePricing = existing.cost.cacheRead > 0 || existing.cost.cacheWrite > 0;
+	const candidateHasCachePricing = candidate.cost.cacheRead > 0 || candidate.cost.cacheWrite > 0;
+	if (candidateHasCachePricing !== existingHasCachePricing) {
+		return candidateHasCachePricing;
+	}
+	return existing.provider !== "openai" && candidate.provider === "openai";
+}
+
+function buildCustomReferenceMap(): Map<string, Model<Api>> {
+	const references = new Map<string, Model<Api>>();
+	for (const provider of getBundledProviders()) {
+		for (const model of getBundledModels(provider as Parameters<typeof getBundledModels>[0])) {
+			const candidate = model as Model<Api>;
+			if (shouldReplaceCustomReference(references.get(candidate.id), candidate)) {
+				references.set(candidate.id, candidate);
+			}
+		}
+	}
+	return references;
+}
+
+const customReferenceMap = buildCustomReferenceMap();
+
+function getCustomReferenceCandidateIds(modelId: string): string[] {
+	const candidates = new Set<string>();
+	const queue = [modelId];
+	for (let index = 0; index < queue.length; index += 1) {
+		const candidate = queue[index]?.trim();
+		if (!candidate || candidates.has(candidate)) continue;
+		candidates.add(candidate);
+
+		for (const suffix of [":cloud", "-cloud"] as const) {
+			if (candidate.toLowerCase().endsWith(suffix)) {
+				queue.push(candidate.slice(0, -suffix.length));
+			}
+		}
+
+		const colonToDash = candidate.replace(/:/g, "-");
+		if (colonToDash !== candidate) {
+			queue.push(colonToDash);
+		}
+	}
+	return [...candidates];
+}
+
+function resolveCustomModelReference(modelId: string): Model<Api> | undefined {
+	for (const candidate of getCustomReferenceCandidateIds(modelId)) {
+		const reference = customReferenceMap.get(candidate);
+		if (reference) return reference;
+	}
+	return undefined;
+}
+
 function applyStandaloneCustomModelPolicies(model: CustomModelOverlay): CustomModelOverlay {
 	if (model.id !== "gpt-5.4" || model.provider === "github-copilot" || model.contextWindow !== undefined) {
 		return model;
@@ -735,23 +805,27 @@ function applyStandaloneCustomModelPolicies(model: CustomModelOverlay): CustomMo
 
 function finalizeCustomModel(model: CustomModelOverlay, options: CustomModelBuildOptions): Model<Api> {
 	const resolvedModel = options.useDefaults ? applyStandaloneCustomModelPolicies(model) : model;
+	const reference = options.useDefaults ? resolveCustomModelReference(resolvedModel.id) : undefined;
 	const cost =
-		resolvedModel.cost ?? (options.useDefaults ? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } : undefined);
-	const input = resolvedModel.input ?? (options.useDefaults ? ["text"] : undefined);
+		resolvedModel.cost ??
+		reference?.cost ??
+		(options.useDefaults ? { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } : undefined);
+	const input = resolvedModel.input ?? reference?.input ?? (options.useDefaults ? ["text"] : undefined);
 	return enrichModelThinking({
 		id: resolvedModel.id,
 		name: resolvedModel.name ?? (options.useDefaults ? resolvedModel.id : undefined),
 		api: resolvedModel.api,
 		provider: resolvedModel.provider,
 		baseUrl: resolvedModel.baseUrl,
-		reasoning: resolvedModel.reasoning ?? (options.useDefaults ? false : undefined),
-		thinking: resolvedModel.thinking,
+		reasoning: resolvedModel.reasoning ?? reference?.reasoning ?? (options.useDefaults ? false : undefined),
+		thinking: resolvedModel.thinking ?? reference?.thinking,
 		input: input as ("text" | "image")[],
 		cost,
-		contextWindow: resolvedModel.contextWindow ?? (options.useDefaults ? 128000 : undefined),
-		maxTokens: resolvedModel.maxTokens ?? (options.useDefaults ? 16384 : undefined),
+		contextWindow:
+			resolvedModel.contextWindow ?? reference?.contextWindow ?? (options.useDefaults ? 128000 : undefined),
+		maxTokens: resolvedModel.maxTokens ?? reference?.maxTokens ?? (options.useDefaults ? 16384 : undefined),
 		headers: resolvedModel.headers,
-		compat: resolvedModel.compat,
+		compat: mergeCompat(reference?.compat, resolvedModel.compat),
 		contextPromotionTarget: resolvedModel.contextPromotionTarget,
 		premiumMultiplier: resolvedModel.premiumMultiplier,
 		isOAuth: resolvedModel.isOAuth,
@@ -954,10 +1028,9 @@ export class ModelRegistry {
 
 			return models.map(m => {
 				if (!providerOverride) return m;
+				const withTransportOverride = this.#applyProviderTransportOverride(m, providerOverride);
 				return {
-					...m,
-					baseUrl: providerOverride.baseUrl ?? m.baseUrl,
-					headers: providerOverride.headers ? { ...m.headers, ...providerOverride.headers } : m.headers,
+					...withTransportOverride,
 					compat: mergeCompat(m.compat, providerOverride.compat),
 				};
 			});
@@ -1143,11 +1216,12 @@ export class ModelRegistry {
 		const configuredProviders = new Set(Object.keys(value.providers ?? {}));
 
 		for (const [providerName, providerConfig] of providerEntries) {
-			// Always set overrides when baseUrl/headers/apiKey/compat/disableStrictTools are present
+			// Always set overrides when baseUrl/headers/apiKey/authHeader/compat/disableStrictTools are present
 			if (
 				providerConfig.baseUrl ||
 				providerConfig.headers ||
 				providerConfig.apiKey ||
+				providerConfig.authHeader !== undefined ||
 				providerConfig.compat ||
 				providerConfig.disableStrictTools
 			) {
@@ -1156,6 +1230,7 @@ export class ModelRegistry {
 					baseUrl: providerConfig.baseUrl,
 					headers: providerConfig.headers,
 					apiKey: providerConfig.apiKey,
+					authHeader: providerConfig.authHeader,
 					compat: mergeCompat(providerConfig.compat, disableStrictCompat),
 				});
 			}
@@ -1738,18 +1813,24 @@ export class ModelRegistry {
 		return {
 			baseUrl: override.baseUrl ?? baseOverride?.baseUrl,
 			apiKey: override.apiKey ?? baseOverride?.apiKey,
+			authHeader: override.authHeader ?? baseOverride?.authHeader,
 			headers: override.headers ? { ...(baseOverride?.headers ?? {}), ...override.headers } : baseOverride?.headers,
 			compat: override.compat ? mergeCompat(baseOverride?.compat, override.compat) : baseOverride?.compat,
 		};
 	}
 	#applyProviderTransportOverride<T extends { baseUrl?: string; headers?: Record<string, string> }>(
 		entry: T,
-		override: Pick<ProviderOverride, "baseUrl" | "headers">,
+		override: Pick<ProviderOverride, "baseUrl" | "headers" | "authHeader" | "apiKey">,
 	): T {
+		const headers = mergeAuthHeader(
+			override.headers ? { ...entry.headers, ...override.headers } : entry.headers,
+			override.authHeader,
+			override.apiKey,
+		);
 		return {
 			...entry,
 			baseUrl: override.baseUrl ?? entry.baseUrl,
-			headers: override.headers ? { ...entry.headers, ...override.headers } : entry.headers,
+			headers,
 		};
 	}
 	#applyRuntimeProviderOverrides(models: Model<Api>[]): Model<Api>[] {
@@ -2206,8 +2287,13 @@ export class ModelRegistry {
 			return;
 		}
 
-		if (config.baseUrl || config.headers) {
-			const transportOverride = { baseUrl: config.baseUrl, headers: config.headers };
+		if (config.baseUrl || config.headers || config.apiKey || config.authHeader !== undefined) {
+			const transportOverride = {
+				baseUrl: config.baseUrl,
+				headers: config.headers,
+				apiKey: config.apiKey,
+				authHeader: config.authHeader,
+			};
 			const nextRuntimeOverride = this.#mergeProviderOverride(
 				this.#runtimeProviderOverrides.get(providerName),
 				transportOverride,

package/src/config/settings-schema.ts

@@ -1955,6 +1955,30 @@ export const SETTINGS_SCHEMA = {
 		default: 60_000,
 	},
 
+	// Tool Discovery
+	"tools.discoveryMode": {
+		type: "enum",
+		values: ["off", "mcp-only", "all"] as const,
+		default: "off",
+		ui: {
+			tab: "tools",
+			label: "Tool Discovery",
+			description:
+				"Hide tools behind a search tool to save tokens. 'mcp-only' hides MCP tools; 'all' hides all non-essential built-ins too.",
+		},
+	},
+
+	"tools.essentialOverride": {
+		type: "array",
+		default: [] as string[],
+		ui: {
+			tab: "tools",
+			label: "Essential Tools Override",
+			description:
+				"Override the always-loaded built-in tools (default: read, bash, edit). Leave empty to use defaults.",
+		},
+	},
+
 	// MCP
 	"mcp.enableProjectConfig": {
 		type: "boolean",
@@ -2006,6 +2030,17 @@ export const SETTINGS_SCHEMA = {
 	// Tasks
 	// ────────────────────────────────────────────────────────────────────────
 
+	// Plan mode
+	"plan.enabled": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "tasks",
+			label: "Plan Mode",
+			description: "Enable plan mode for read-only exploration and planning before execution",
+		},
+	},
+
 	// Delegation
 	"task.isolation.mode": {
 		type: "enum",
@@ -2278,7 +2313,7 @@ export const SETTINGS_SCHEMA = {
 				{ value: "kagi", label: "Kagi", description: "Requires KAGI_API_KEY and Kagi Search API beta access" },
 				{ value: "synthetic", label: "Synthetic", description: "Requires SYNTHETIC_API_KEY" },
 				{ value: "parallel", label: "Parallel", description: "Requires PARALLEL_API_KEY" },
-				{ value: "searxng", label: "SearXNG", description: "Requires searxng.endpoint" },
+				{ value: "searxng", label: "SearXNG", description: "Requires SEARXNG_ENDPOINT or searxng.endpoint" },
 			],
 		},
 	},

package/src/discovery/helpers.ts

@@ -811,9 +811,10 @@ export async function listClaudePluginRoots(
 
 	// ── OMP installed plugins registry ───────────────────────────────────────
 	// OMP registry is authoritative: its entries replace Claude's entries for the same plugin ID.
-	// getPluginsDir() resolves to the same path the marketplace writer uses
-	// (XDG-aware via the dir resolver), so reads and writes always agree.
-	const ompRegistryPath = path.join(getPluginsDir(), "installed_plugins.json");
+	// In production `home` is `os.homedir()`, so `getPluginsDir(home)` resolves to the
+	// same XDG-aware path the marketplace writer uses (reads and writes always agree).
+	// Tests pass a temp dir, which short-circuits the resolver for deterministic isolation.
+	const ompRegistryPath = path.join(getPluginsDir(home), "installed_plugins.json");
 	const ompContent = await readFile(ompRegistryPath);
 	if (ompContent) {
 		const ompRegistry = parseClaudePluginsRegistry(ompContent);

package/src/edit/index.ts

@@ -246,6 +246,7 @@ async function executeSinglePathEntries(
 export class EditTool implements AgentTool<TInput> {
 	readonly name = "edit";
 	readonly label = "Edit";
+	readonly loadMode = "essential";
 	readonly nonAbortable = true;
 	readonly concurrency = "exclusive";
 	readonly strict = true;

package/src/eval/py/gateway-coordinator.ts

@@ -2,13 +2,12 @@ import * as fs from "node:fs";
 import { createServer } from "node:net";
 import * as path from "node:path";
 import { Process } from "@oh-my-pi/pi-natives";
-import { getAgentDir, isEnoent, logger, procmgr } from "@oh-my-pi/pi-utils";
+import { getPythonGatewayDir, isEnoent, logger, procmgr } from "@oh-my-pi/pi-utils";
 import type { Subprocess } from "bun";
 import { Settings } from "../../config/settings";
 import { getOrCreateSnapshot } from "../../utils/shell-snapshot";
 import { filterEnv, resolvePythonRuntime } from "./runtime";
 
-const GATEWAY_DIR_NAME = "python-gateway";
 const GATEWAY_INFO_FILE = "gateway.json";
 const GATEWAY_LOCK_FILE = "gateway.lock";
 const GATEWAY_STARTUP_TIMEOUT_MS = 30000;
@@ -66,7 +65,7 @@ async function allocatePort(): Promise<number> {
 }
 
 function getGatewayDir(): string {
-	return path.join(getAgentDir(), GATEWAY_DIR_NAME);
+	return getPythonGatewayDir();
 }
 
 function getGatewayInfoPath(): string {

package/src/eval/py/runtime.ts

@@ -34,6 +34,7 @@ const DEFAULT_ENV_ALLOWLIST = new Set([
 	"CONDA_DEFAULT_ENV",
 	"VIRTUAL_ENV",
 	"PYTHONPATH",
+	"LD_LIBRARY_PATH",
 ]);
 
 const WINDOWS_ENV_ALLOWLIST = new Set([