@oh-my-pi/pi-coding-agent 15.1.8 → 15.2.1

package/CHANGELOG.md

@@ -2,6 +2,57 @@
 
 ## [Unreleased]
 
+## [15.2.1] - 2026-05-21
+
+### Fixed
+
+- Fixed compaction routing to the wrong provider when `modelRoles.default` is set to a different model than the active chat. Auto- and manual compaction now prefer the active session's model and only fall back to role-based candidates when the current model has no usable credentials. Previously, an Anthropic chat with `modelRoles.default = openai/gpt-5` would compact through OpenAI (including the remote-compaction endpoint), even though the live conversation never used OpenAI.
+
+### Fixed
+
+- Fixed context overflow not being detected when the session's model (e.g. `hf:zai-org/GLM-5.1` via `synthetic` provider) returns a 400 with the upstream "400 status code (no body)" message wrapped inside a JSON envelope. The `isContextOverflow` check now matches the no-body status phrase anywhere in the error string rather than requiring it at the very start, so auto-compaction fires correctly instead of leaving the session silently stuck ([#1251](https://github.com/can1357/oh-my-pi/issues/1251)).
+- Fixed `formatCapturedHttpError` not extracting the error text from `{"error":"string"}` response bodies (only object-valued `error` fields were previously handled), resulting in raw JSON in error messages instead of the human-readable string.
+
+## [15.2.0] - 2026-05-21
+
+### Changed
+
+- Changed the interactive working loader and slash-command progress bars to use the active theme's accent shimmer instead of static muted text.
+
+### Fixed
+
+- Fixed false-positive hashline `~ TEXT` separator-padding warning firing on YAML, JSON, Python, Markdown, TOML, and other indent-sensitive file edits. The padding check is now skipped entirely for indentation-sensitive extensions (`.py`, `.yml`/`.yaml`, `.md`/`.mdx`, `.json`/`.jsonc`/`.json5`, `.toml`, `.rst`, `.tf`, `.nix`, `.coffee`, `.haml`/`.slim`/`.pug`, `.sass`/`.styl`, `.nim`, `.cr`, `.elm`, `.fs`, …), and tightened on every other extension to flag only the `~ beta` typo shape (exactly one leading space before non-space content) rather than any leading-space payload.
+
+### Fixed
+
+- Fixed goal state machine: `get` now returns paused goals (was returning null for `enabled=false`), `complete` now works on paused goals after interrupts, `create` is allowed after a previous goal reaches `complete` status, and the goal tool is re-added to the active tool set on session reload when a paused goal is persisted. Added `resume` and `drop` ops to the goal tool so the agent can re-engage or discard a paused goal without requiring user slash commands. ([#1249](https://github.com/can1357/oh-my-pi/issues/1249))
+
+## [15.1.9] - 2026-05-21
+
+### Fixed
+
+- Fixed `disabledProviders` still probing local discovery endpoints for Ollama, llama.cpp, and LM Studio during background model refresh. Disabled providers are now excluded before implicit and built-in discovery managers are created. ([#1232](https://github.com/can1357/oh-my-pi/issues/1232))
+
+### Fixed
+
+- Fixed `omp acp` auto-discovering host `.mcp.json` servers in parallel with the ACP client's `session/new.mcpServers`, which shadowed client-supplied MCP tools in `search_tool_bm25` and the session tool registry. The ACP session factory now forces `enableMCP: false`, so MCP ownership stays with `AcpAgent#configureMcpServers`. Non-ACP modes keep on-disk discovery. ([#1234](https://github.com/can1357/oh-my-pi/issues/1234))
+
+### Fixed
+
+- Fixed binary `omp update` rollbacks so a downloaded replacement that fails post-install version verification no longer remains installed over the previous working binary. ([#1240](https://github.com/can1357/oh-my-pi/issues/1240))
+
+### Fixed
+
+- Fixed `/force <tool>` rejecting Ollama/local models before the requested tool could run; Ollama now receives a named forced choice that the provider transport narrows to the selected tool. ([#1236](https://github.com/can1357/oh-my-pi/issues/1236))
+
+### Fixed
+
+- Fixed `web_search` freezing the session when an upstream provider stalled. Bun's WinHTTP backend on Windows can silently drop `AbortSignal` once a TCP/TLS connection hangs (oven-sh/bun#15275, oven-sh/bun#18536), so Esc never reached the in-flight fetch and the only recovery was Ctrl+C + `omp --resume`. Every web-search provider's outbound `fetch` (anthropic, brave, codex, exa, gemini, jina, kagi, kimi, parallel, perplexity, searxng, synthetic, tavily, z.ai) now composes the caller signal with a 60s hard timeout via a shared `withHardTimeout` helper, guaranteeing the request settles within a minute even when Bun's abort fails to propagate. Independently, `executeSearch`'s provider-fallback loop was masking real cancellations as ordinary provider errors and returning "All web search providers failed"; it now re-throws as `ToolAbortError` the moment the caller's signal aborts, so the session sees a clean cancel on every platform. ([#1221](https://github.com/can1357/oh-my-pi/issues/1221))
+
+### Added
+
+- Added OSC 8 terminal hyperlink support for file paths in tool output. When the terminal supports hyperlinks (kitty, Ghostty, WezTerm, iTerm2, Alacritty, VS Code) and the new `tui.hyperlinks` setting is `auto` (default) or `always`, OMP wraps file paths emitted by `read`, `find`, `search`, `edit`, `ast_grep`, and `ast_edit` renderers in `file:///abs/path` hyperlinks. `local://` and other fs-backed internal URLs resolve to their backing path. Set `tui.hyperlinks: off` to disable. ([#1244](https://github.com/can1357/oh-my-pi/issues/1244))
+
 ## [15.1.8] - 2026-05-20
 
 ### Fixed
@@ -8454,4 +8505,4 @@ Initial public release.
 - Git branch display in footer
 - Message queueing during streaming responses
 - OAuth integration for Gmail and Google Calendar access
-- HTML export with syntax highlighting and collapsible sections
+- HTML export with syntax highlighting and collapsible sections

package/dist/types/cli/update-cli.d.ts

@@ -1,3 +1,17 @@
+/** Result from running the installed binary and parsing its reported version. */
+export interface InstalledVersionVerification {
+    ok: boolean;
+    actual?: string;
+    path?: string;
+}
+/** Paths and verifier used while replacing a downloaded binary update. */
+export interface BinaryReplacementOptions {
+    targetPath: string;
+    tempPath: string;
+    backupPath: string;
+    expectedVersion: string;
+    verifyInstalledVersion: (expectedVersion: string) => Promise<InstalledVersionVerification>;
+}
 /**
  * Parse update subcommand arguments.
  * Returns undefined if not an update command.
@@ -7,6 +21,10 @@ export declare function parseUpdateArgs(args: string[]): {
     check: boolean;
 } | undefined;
 export declare function resolveUpdateMethodForTest(ompPath: string, bunBinDir: string | undefined): "bun" | "binary";
+/**
+ * Atomically replace the installed binary and roll back if version verification fails.
+ */
+export declare function replaceBinaryForUpdate(options: BinaryReplacementOptions): Promise<InstalledVersionVerification>;
 /**
  * Run the update command.
  */

package/dist/types/config/settings-schema.d.ts

@@ -634,6 +634,16 @@ export declare const SETTINGS_SCHEMA: {
         readonly default: 20;
         readonly description: "Maximum height in terminal rows for inline images (default 20). Set to 0 to use only the viewport-based limit (60% of terminal height).";
     };
+    readonly "tui.hyperlinks": {
+        readonly type: "enum";
+        readonly values: readonly ["off", "auto", "always"];
+        readonly default: "auto";
+        readonly ui: {
+            readonly tab: "appearance";
+            readonly label: "Terminal Hyperlinks";
+            readonly description: "Wrap file paths in OSC 8 hyperlinks for terminal-native click-to-open (auto: detect support; off: never; always: unconditional)";
+        };
+    };
     readonly "display.tabWidth": {
         readonly type: "number";
         readonly default: 3;

package/dist/types/eval/py/kernel.d.ts

@@ -21,6 +21,12 @@ export interface KernelExecuteResult {
     cancelled: boolean;
     timedOut: boolean;
     stdinRequested: boolean;
+    /**
+     * True when the kernel subprocess was killed as part of settling this
+     * execution (e.g. SIGINT was ignored and we escalated to shutdown, or the
+     * kernel died unexpectedly). When false, the kernel remains reusable.
+     */
+    kernelKilled?: boolean;
 }
 export interface KernelShutdownResult {
     confirmed: boolean;

package/dist/types/goals/state.d.ts

@@ -17,7 +17,7 @@ export interface GoalModeState {
     goal: Goal;
 }
 export interface GoalToolDetails {
-    op: "create" | "get" | "complete";
+    op: "create" | "get" | "complete" | "resume" | "drop";
     goal?: Goal | null;
     remainingTokens?: number | null;
     completionBudgetReport?: string | null;

package/dist/types/goals/tools/goal-tool.d.ts

@@ -9,7 +9,9 @@ declare const goalSchema: z.ZodObject<{
     op: z.ZodEnum<{
         complete: "complete";
         create: "create";
+        drop: "drop";
         get: "get";
+        resume: "resume";
     }>;
     objective: z.ZodOptional<z.ZodString>;
     token_budget: z.ZodOptional<z.ZodNumber>;
@@ -32,7 +34,9 @@ export declare class GoalTool implements AgentTool<typeof goalSchema, GoalToolDe
         op: z.ZodEnum<{
             complete: "complete";
             create: "create";
+            drop: "drop";
             get: "get";
+            resume: "resume";
         }>;
         objective: z.ZodOptional<z.ZodString>;
         token_budget: z.ZodOptional<z.ZodNumber>;

package/dist/types/hashline/parser.d.ts

@@ -1,7 +1,11 @@
 import type { HashlineCursor, HashlineEdit } from "./types";
 export declare function cloneCursor(cursor: HashlineCursor): HashlineCursor;
-export declare function parseHashline(diff: string): HashlineEdit[];
-export declare function parseHashlineWithWarnings(diff: string): {
+export declare function parseHashline(diff: string, opts?: ParseHashlineOptions): HashlineEdit[];
+export interface ParseHashlineOptions {
+    /** File path the diff targets. Used to suppress indent-sensitive false-positive warnings. */
+    path?: string;
+}
+export declare function parseHashlineWithWarnings(diff: string, opts?: ParseHashlineOptions): {
     edits: HashlineEdit[];
     warnings: string[];
 };

package/dist/types/internal-urls/memory-protocol.d.ts

@@ -1,4 +1,10 @@
 import type { InternalResource, InternalUrl, ProtocolHandler } from "./types";
+/**
+ * Snapshot of memory roots for every registered session, deduped.
+ * Each session has its own cwd (possibly a worktree), so subagents and main
+ * may see different roots.
+ */
+export declare function memoryRootsFromRegistry(): string[];
 /**
  * Resolve a memory:// URL to an absolute filesystem path under memory root.
  */

package/dist/types/main.d.ts

@@ -5,16 +5,40 @@
  * createAgentSession() options. The SDK does the heavy lifting.
  */
 import type { Args } from "./cli/args";
+import { ModelRegistry } from "./config/model-registry";
 import { Settings } from "./config/settings";
 import { InteractiveMode, runAcpMode } from "./modes";
 import type { SubmittedUserInput } from "./modes/types";
-import { createAgentSession, discoverAuthStorage } from "./sdk";
+import { type CreateAgentSessionOptions, type CreateAgentSessionResult, createAgentSession, discoverAuthStorage } from "./sdk";
 import type { AgentSession } from "./session/agent-session";
+import type { AuthStorage } from "./session/auth-storage";
 export interface InteractiveModeNotify {
     kind: "warn" | "error" | "info";
     message: string;
 }
 export declare function submitInteractiveInput(mode: Pick<InteractiveMode, "markPendingSubmissionStarted" | "finishPendingSubmission" | "showError" | "checkShutdownRequested">, session: Pick<AgentSession, "prompt" | "promptCustomMessage">, input: SubmittedUserInput): Promise<void>;
+type AcpSessionFactory = (cwd: string) => Promise<AgentSession>;
+export interface AcpSessionFactoryOptions {
+    baseOptions: CreateAgentSessionOptions;
+    settings: Settings;
+    sessionDir?: string;
+    authStorage: AuthStorage;
+    modelRegistry: ModelRegistry;
+    parsedArgs: Pick<Args, "apiKey">;
+    rawArgs: string[];
+    createSession: (options: CreateAgentSessionOptions) => Promise<CreateAgentSessionResult>;
+}
+/**
+ * Build the per-`session/new` factory used by ACP mode.
+ *
+ * MCP servers in ACP sessions are owned exclusively by the ACP client, which
+ * supplies them through `session/new.mcpServers` and re-applies them via
+ * {@link AcpAgent#configureMcpServers}. We therefore force `enableMCP: false`
+ * on every session created here so {@link createAgentSession} skips the on-disk
+ * `.mcp.json` discovery path — otherwise host MCP tools land in the session's
+ * tool registry and shadow the client-supplied servers (issue #1234).
+ */
+export declare function createAcpSessionFactory(args: AcpSessionFactoryOptions): AcpSessionFactory;
 interface RunRootCommandDependencies {
     createAgentSession?: typeof createAgentSession;
     discoverAuthStorage?: typeof discoverAuthStorage;

package/dist/types/modes/theme/shimmer.d.ts

@@ -0,0 +1,27 @@
+import type { Theme, ThemeColor } from "./theme";
+type ShimmerTheme = Pick<Theme, "bold" | "fg">;
+/** Three-tier color stack a shimmer character cycles through as the band sweeps. */
+export interface ShimmerPalette {
+    /** Color for chars outside / at the edge of the band (intensity < 0.2). */
+    low: ThemeColor;
+    /** Color for chars approaching the crest (0.2 <= intensity < 0.6). */
+    mid: ThemeColor;
+    /** Color at the band's crest (intensity >= 0.6). */
+    high: ThemeColor;
+    /** Whether to bold the crest tier. Default `false`. */
+    bold?: boolean;
+}
+/** One run of text that shares a palette inside a larger shimmer sweep. */
+export interface ShimmerSegment {
+    text: string;
+    palette?: ShimmerPalette;
+}
+export declare const DEFAULT_SHIMMER_PALETTE: ShimmerPalette;
+/**
+ * Apply a shimmer sweep across one or more segments, treating them as a single
+ * continuous string for band positioning. Each segment can supply its own
+ * palette so the gradient stays in lockstep while the colors differ.
+ */
+export declare function shimmerSegments(segments: readonly ShimmerSegment[], theme: ShimmerTheme): string;
+export declare function shimmerText(text: string, theme: ShimmerTheme, palette?: ShimmerPalette): string;
+export {};

package/dist/types/slash-commands/helpers/format.d.ts

@@ -1,7 +1,10 @@
+import { type Theme } from "../../modes/theme/theme";
 /** Format a millisecond duration as a coarse-grained human label. */
 export declare function formatDuration(ms: number): string;
+type ProgressBarTheme = Pick<Theme, "bold" | "fg">;
 /**
  * Render an ASCII progress bar with a trailing percent label.
  * `fraction` is clamped to `[0, 1]`. `undefined` renders a dotted placeholder.
  */
-export declare function renderAsciiBar(fraction: number | undefined, width?: number): string;
+export declare function renderAsciiBar(fraction: number | undefined, width?: number, uiTheme?: ProgressBarTheme): string;
+export {};

package/dist/types/tools/ast-edit.d.ts

@@ -31,6 +31,9 @@ export interface AstEditToolDetails {
     /** Pre-formatted text for the user-visible TUI render. Mirrors `result.text` lines but uses
      * a `│` gutter (no model-only hashline anchors). The TUI uses this directly so it never parses model-facing text. */
     displayContent?: string;
+    /** Absolute base directory used during the edit. Used by the renderer to resolve
+     * display-relative paths to absolute paths for OSC 8 hyperlinks. */
+    searchPath?: string;
 }
 export declare class AstEditTool implements AgentTool<typeof astEditSchema, AstEditToolDetails> {
     private readonly session;

package/dist/types/tools/ast-grep.d.ts

@@ -28,6 +28,9 @@ export interface AstGrepToolDetails {
     /** Pre-formatted text for the user-visible TUI render. Mirrors `result.text` lines but uses
      * a `│` gutter and `*` to mark match lines. The TUI uses this directly so it never parses model-facing text. */
     displayContent?: string;
+    /** Absolute base directory used during search. Used by the renderer to resolve
+     * display-relative paths to absolute paths for OSC 8 hyperlinks. */
+    searchPath?: string;
 }
 export declare class AstGrepTool implements AgentTool<typeof astGrepSchema, AstGrepToolDetails> {
     private readonly session;

package/dist/types/tools/find.d.ts

@@ -23,6 +23,9 @@ export interface FindToolDetails {
     files?: string[];
     truncated?: boolean;
     error?: string;
+    /** Working directory at search time. Used by the renderer to resolve relative
+     * file paths to absolute paths for OSC 8 hyperlinks. */
+    cwd?: string;
     /** User-supplied paths whose base directory was missing on disk. The tool
      * skipped these and continued with the surviving entries; surfaced as a
      * non-fatal warning in the renderer and in the model-facing text. */

package/dist/types/tools/search.d.ts

@@ -43,6 +43,9 @@ export interface SearchToolDetails {
      * `result.text` lines but uses a `│` gutter and `*` to mark match lines (vs space for
      * context). The TUI uses this directly so it never parses model-facing hashline anchors. */
     displayContent?: string;
+    /** Absolute base directory used during search. Used by the renderer to resolve
+     * display-relative paths to absolute paths for OSC 8 hyperlinks. */
+    searchPath?: string;
     /** User-supplied paths whose base directory was missing on disk. The tool
      * skipped these and continued with the surviving entries; surfaced as a
      * non-fatal warning in the renderer and in the model-facing text. */

package/dist/types/tui/file-list.d.ts

@@ -4,6 +4,9 @@
 import type { Theme } from "../modes/theme/theme";
 export interface FileEntry {
     path: string;
+    /** Absolute filesystem path. When provided together with {@link FileListOptions.hyperlinkFn}, the
+     * rendered path text is wrapped in an OSC 8 hyperlink. */
+    absPath?: string;
     isDirectory?: boolean;
     meta?: string;
 }
@@ -12,5 +15,8 @@ export interface FileListOptions {
     expanded?: boolean;
     maxCollapsed?: number;
     showIcons?: boolean;
+    /** When provided, called with the entry's absolute path and the ANSI-styled display string to
+     * optionally wrap the path in an OSC 8 hyperlink. Only invoked when {@link FileEntry.absPath} is set. */
+    hyperlinkFn?: (absPath: string, displayText: string) => string;
 }
 export declare function renderFileList(options: FileListOptions, theme: Theme): string[];

package/dist/types/tui/hyperlink.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Returns true when OSC 8 hyperlinks should be emitted.
+ *
+ * Respects `tui.hyperlinks` setting:
+ * - `"off"`: never
+ * - `"auto"`: when `process.stdout.isTTY`, `NO_COLOR` is unset, and the detected terminal reports hyperlink support
+ * - `"always"`: unconditionally (useful for viewers that support OSC 8 without advertising it)
+ */
+export declare function isHyperlinkEnabled(): boolean;
+/**
+ * Wrap `displayText` in an OSC 8 hyperlink pointing at the given absolute file path.
+ *
+ * Returns `displayText` unchanged when hyperlinks are disabled or when
+ * the text already contains an OSC 8 sequence (prevents double-wrapping).
+ *
+ * The caller is responsible for passing an absolute path. Relative paths
+ * produce invalid `file://` URIs and are accepted silently to avoid runtime
+ * errors in renderer hot paths.
+ *
+ * @param absPath - Absolute filesystem path
+ * @param displayText - Text to render as the hyperlink anchor (may contain ANSI codes)
+ * @param opts - Optional line/col position appended as `?line=N&col=M` query params
+ */
+export declare function fileHyperlink(absPath: string, displayText: string, opts?: {
+    line?: number;
+    col?: number;
+}): string;
+/**
+ * Synchronously resolve a filesystem-backed internal URL (e.g. `local://foo.md`,
+ * `memory://root/notes.md`) to its absolute filesystem path. Returns `undefined`
+ * for inputs that aren't fs-backed, aren't resolvable in the current session
+ * registry, or fail to parse.
+ *
+ * Used by renderers to wrap fs-backed internal URLs in OSC 8 hyperlinks even
+ * when the resolved path isn't yet available from tool result details (e.g.
+ * during the call/streaming phase before a result lands).
+ *
+ * Async-resolved schemes (`artifact://`, `agent://`, `skill://`, `rule://`,
+ * `omp://`) are not handled here — those rely on `details.resolvedPath` set
+ * by the read tool's router resolution.
+ */
+export declare function tryResolveInternalUrlSync(input: string): string | undefined;

package/dist/types/tui/index.d.ts

@@ -3,6 +3,7 @@
  */
 export * from "./code-cell";
 export * from "./file-list";
+export * from "./hyperlink";
 export * from "./output-block";
 export * from "./status-line";
 export * from "./tree-list";

package/dist/types/utils/tool-choice.d.ts

@@ -1,6 +1,7 @@
 import type { Api, Model, ToolChoice } from "@oh-my-pi/pi-ai";
 /**
  * Build a provider-aware tool choice that targets one specific tool when supported.
- * Some providers only support "any tool" forcing, not a named tool.
+ * Providers that only expose required/any forcing may still honor named choices by
+ * narrowing their request tool list before transport.
  */
 export declare function buildNamedToolChoice(toolName: string, model?: Model<Api>): ToolChoice | undefined;

package/dist/types/web/search/providers/utils.d.ts

@@ -1,4 +1,4 @@
-import type { SearchSource } from "../../../web/search/types";
+import { SearchProviderError, type SearchProviderId, type SearchSource } from "../../../web/search/types";
 /**
  * Search for an API credential by checking an env-derived key first,
  * then falling back to agent.db stored credentials for the given providers.
@@ -12,6 +12,31 @@ export declare function findCredential(envKey: string | null | undefined, ...sto
  * Swallows lookup errors and reports unavailability.
  */
 export declare function isApiKeyAvailable(findApiKey: () => string | null | Promise<string | null>): Promise<boolean>;
+/**
+ * Default hard ceiling for a single web-search round-trip. 60s tolerates
+ * legitimate slow LLM-mediated responses (anthropic web_search_20250305,
+ * perplexity, gemini, codex) while still guaranteeing the session unfreezes
+ * within a minute if Bun's `AbortSignal` fails to propagate on Windows.
+ *
+ * Pure search APIs (brave, exa, jina, tavily, searxng, synthetic, zai)
+ * settle far faster in practice; reusing the same ceiling keeps the wiring
+ * uniform without compromising correctness.
+ */
+export declare const SEARCH_HARD_TIMEOUT_MS = 60000;
+/**
+ * Compose a caller-supplied {@link AbortSignal} with a hard timeout so an
+ * outbound `fetch()` is guaranteed to settle within `ms` even when the
+ * runtime fails to propagate cancellation to the underlying transport.
+ *
+ * Bun's WinHTTP backend on Windows is known to ignore `AbortSignal` once a
+ * TCP/TLS connection stalls (oven-sh/bun#15275, oven-sh/bun#18536); without
+ * this safety net a stalled web-search request freezes the entire session
+ * because the user's Esc is never delivered to the native layer.
+ *
+ * @param signal - Caller cancellation signal, if any.
+ * @param ms - Hard timeout in milliseconds. Defaults to {@link SEARCH_HARD_TIMEOUT_MS}.
+ */
+export declare function withHardTimeout(signal: AbortSignal | undefined, ms?: number): AbortSignal;
 /**
  * Map a provider's raw source list to the unified SearchSource shape,
  * clamped to the requested result count and annotated with ageSeconds.
@@ -22,3 +47,4 @@ export declare function toSearchSources(sources: ReadonlyArray<{
     snippet?: string;
     publishedDate?: string;
 }>, numResults: number): SearchSource[];
+export declare function classifyProviderHttpError(provider: SearchProviderId, status: number, body: string): SearchProviderError | null;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "15.1.8",
+	"version": "15.2.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -47,12 +47,12 @@
 		"@agentclientprotocol/sdk": "0.21.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/omp-stats": "15.1.8",
-		"@oh-my-pi/pi-agent-core": "15.1.8",
-		"@oh-my-pi/pi-ai": "15.1.8",
-		"@oh-my-pi/pi-natives": "15.1.8",
-		"@oh-my-pi/pi-tui": "15.1.8",
-		"@oh-my-pi/pi-utils": "15.1.8",
+		"@oh-my-pi/omp-stats": "15.2.1",
+		"@oh-my-pi/pi-agent-core": "15.2.1",
+		"@oh-my-pi/pi-ai": "15.2.1",
+		"@oh-my-pi/pi-natives": "15.2.1",
+		"@oh-my-pi/pi-tui": "15.2.1",
+		"@oh-my-pi/pi-utils": "15.2.1",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",

package/src/cli/update-cli.ts

@@ -20,6 +20,22 @@ interface ReleaseInfo {
 	version: string;
 }
 
+/** Result from running the installed binary and parsing its reported version. */
+export interface InstalledVersionVerification {
+	ok: boolean;
+	actual?: string;
+	path?: string;
+}
+
+/** Paths and verifier used while replacing a downloaded binary update. */
+export interface BinaryReplacementOptions {
+	targetPath: string;
+	tempPath: string;
+	backupPath: string;
+	expectedVersion: string;
+	verifyInstalledVersion: (expectedVersion: string) => Promise<InstalledVersionVerification>;
+}
+
 /**
  * Parse update subcommand arguments.
  * Returns undefined if not an update command.
@@ -197,9 +213,7 @@ function resolveOmpPath(): string | undefined {
 /**
  * Run the resolved omp binary and check if it reports the expected version.
  */
-async function verifyInstalledVersion(
-	expectedVersion: string,
-): Promise<{ ok: boolean; actual?: string; path?: string }> {
+async function verifyInstalledVersion(expectedVersion: string): Promise<InstalledVersionVerification> {
 	const ompPath = resolveOmpPath();
 	if (!ompPath) return { ok: false };
 	try {
@@ -215,29 +229,69 @@ async function verifyInstalledVersion(
 	}
 }
 
+function printVerifiedVersion(expectedVersion: string): void {
+	console.log(chalk.green(`\n${theme.status.success} Updated to ${expectedVersion}`));
+}
+
+function formatVerificationFailure(result: InstalledVersionVerification, expectedVersion: string): string {
+	if (result.actual) {
+		return `${APP_NAME} at ${result.path} still reports ${result.actual} (expected ${expectedVersion})`;
+	}
+	return `could not verify updated version${result.path ? ` at ${result.path}` : ""}`;
+}
+
 /**
  * Print post-update verification result.
  */
 async function printVerification(expectedVersion: string): Promise<void> {
 	const result = await verifyInstalledVersion(expectedVersion);
 	if (result.ok) {
-		console.log(chalk.green(`\n${theme.status.success} Updated to ${expectedVersion}`));
+		printVerifiedVersion(expectedVersion);
 		return;
 	}
-	if (result.actual) {
-		console.log(
-			chalk.yellow(
-				`\nWarning: ${APP_NAME} at ${result.path} still reports ${result.actual} (expected ${expectedVersion})`,
-			),
-		);
-	} else {
-		console.log(
-			chalk.yellow(`\nWarning: could not verify updated version${result.path ? ` at ${result.path}` : ""}`),
-		);
-	}
+	console.log(chalk.yellow(`\nWarning: ${formatVerificationFailure(result, expectedVersion)}`));
 	console.log(chalk.yellow(`You may need to reinstall: curl -fsSL https://omp.sh/install | sh`));
 }
 
+async function unlinkIfExists(filePath: string): Promise<void> {
+	try {
+		await fs.promises.unlink(filePath);
+	} catch (err) {
+		if (!isEnoent(err)) throw err;
+	}
+}
+
+/**
+ * Atomically replace the installed binary and roll back if version verification fails.
+ */
+export async function replaceBinaryForUpdate(options: BinaryReplacementOptions): Promise<InstalledVersionVerification> {
+	let backupReady = false;
+	try {
+		await unlinkIfExists(options.backupPath);
+		await fs.promises.rename(options.targetPath, options.backupPath);
+		backupReady = true;
+		await fs.promises.rename(options.tempPath, options.targetPath);
+
+		const verification = await options.verifyInstalledVersion(options.expectedVersion);
+		if (!verification.ok) {
+			throw new Error(
+				`${formatVerificationFailure(verification, options.expectedVersion)}; restored previous ${APP_NAME} binary`,
+			);
+		}
+
+		backupReady = false;
+		await unlinkIfExists(options.backupPath);
+		return verification;
+	} catch (err) {
+		if (backupReady) {
+			await unlinkIfExists(options.targetPath);
+			await fs.promises.rename(options.backupPath, options.targetPath);
+		}
+		await unlinkIfExists(options.tempPath);
+		throw err;
+	}
+}
+
 /**
  * Update via bun package manager.
  */
@@ -271,27 +325,15 @@ async function updateViaBinaryAt(targetPath: string, expectedVersion: string): P
 	await pipeline(response.body, fileStream);
 
 	console.log(chalk.dim("Installing update..."));
-	try {
-		try {
-			await fs.promises.unlink(backupPath);
-		} catch (err) {
-			if (!isEnoent(err)) throw err;
-		}
-		await fs.promises.rename(targetPath, backupPath);
-		await fs.promises.rename(tempPath, targetPath);
-		await fs.promises.unlink(backupPath);
-
-		await printVerification(expectedVersion);
-		console.log(chalk.dim(`Restart ${APP_NAME} to use the new version`));
-	} catch (err) {
-		if (fs.existsSync(backupPath) && !fs.existsSync(targetPath)) {
-			await fs.promises.rename(backupPath, targetPath);
-		}
-		if (fs.existsSync(tempPath)) {
-			await fs.promises.unlink(tempPath);
-		}
-		throw err;
-	}
+	await replaceBinaryForUpdate({
+		targetPath,
+		tempPath,
+		backupPath,
+		expectedVersion,
+		verifyInstalledVersion,
+	});
+	printVerifiedVersion(expectedVersion);
+	console.log(chalk.dim(`Restart ${APP_NAME} to use the new version`));
 }
 
 /**