@oh-my-pi/pi-coding-agent 15.10.9 → 15.10.10

package/src/modes/controllers/selector-controller.ts

@@ -266,10 +266,6 @@ export class SelectorController {
 				this.ctx.updateEditorBorderColor();
 				break;
 
-			case "clearOnShrink":
-				this.ctx.ui.setClearOnShrink(value as boolean);
-				break;
-
 			case "autocompleteMaxVisible":
 				this.ctx.editor.setAutocompleteMaxVisible(typeof value === "number" ? value : Number(value));
 				break;

package/src/modes/interactive-mode.ts

@@ -409,7 +409,6 @@ export class InteractiveMode implements InteractiveModeContext {
 		}
 
 		this.ui = new TUI(new ProcessTerminal(), settings.get("showHardwareCursor"));
-		this.ui.setClearOnShrink(settings.get("clearOnShrink"));
 		this.ui.setMaxInlineImages(settings.get("tui.maxInlineImages"));
 		// OSC 66 text-sizing is Kitty-only; resolve the setting against the terminal's
 		// capability (`TERMINAL.textSizing` defaults on for Kitty) so it stays off
@@ -429,7 +428,7 @@ export class InteractiveMode implements InteractiveModeContext {
 			this.ui.requestRender(true);
 		};
 		this.editor.onAutocompleteUpdate = () => {
-			this.ui.requestRender(false, { allowUnknownViewportMutation: true });
+			this.ui.requestRender();
 		};
 		this.#syncEditorMaxHeight();
 		this.#resizeHandler = () => {
@@ -959,13 +958,6 @@ export class InteractiveMode implements InteractiveModeContext {
 		}
 		this.editor.setText("");
 		this.editor.imageLinks = undefined;
-		// Reconciliation checkpoint: only retire frozen block snapshots after TUI
-		// proves the native viewport is at the tail and replays scrollback safely.
-		// Unknown host viewports stay frozen; thawing them would expose live rows
-		// over stale native history and can yank or duplicate when ED3 is unsafe.
-		if (this.ui.refreshNativeScrollbackIfDirty()) {
-			this.chatContainer.thaw();
-		}
 		this.ensureLoadingAnimation();
 		this.ui.requestRender();
 		return submission;
@@ -2587,7 +2579,7 @@ export class InteractiveMode implements InteractiveModeContext {
 			this.ui.requestRender(true);
 		};
 		nextEditor.onAutocompleteUpdate = () => {
-			this.ui.requestRender(false, { allowUnknownViewportMutation: true });
+			this.ui.requestRender();
 		};
 		nextEditor.setMaxHeight(this.#computeEditorMaxHeight());
 		if (this.historyStorage) {

package/src/prompts/system/system-prompt.md

@@ -60,10 +60,10 @@ You MUST use the specialized tool over its shell equivalent:
 {{#has tools "search"}}- regex search → `{{toolRefs.search}}`, not `grep`/`rg`/`awk`{{/has}}
 {{#has tools "find"}}- file globbing → `{{toolRefs.find}}`, not `ls **/*.ext`/`fd`{{/has}}
 {{#has tools "eval"}}- Then, you MAY use `{{toolRefs.eval}}` for quick compute, but you SHOULD go step by step.{{/has}}
-{{#has tools "bash"}}- Finally, you MAY use `{{toolRefs.bash}}` for simple one-liners only. But this is a last resort. Bash commands matching the patterns above are intercepted and blocked at runtime.
+{{#has tools "bash"}}- Finally, you MAY use `{{toolRefs.bash}}` for terminal work — builds, tests, git, package managers — and for pipelines that COMPUTE a new fact: `wc -l`, `sort | uniq -c`, `comm`, `diff a b`, checksums. Commands shadowing the tools above are intercepted and blocked at runtime.
+  - Litmus: produces a count, frequency table, set difference, or checksum no tool returns → bash. Merely moves, pages, or trims bytes a tool can fetch → use the tool.
   - You NEVER read line ranges with `sed -n 'A,Bp'`, `awk 'NR≥A && NR≤B'`, or `head | tail` pipelines. Use `{{toolRefs.read}}` with `offset`/`limit`.
-  - You NEVER use `2>&1` or `2>/dev/null` — stdout and stderr are already merged.
-  - You NEVER suffix commands with `| head -n N` or `| tail -n N` — the harness already streams output and returns a truncated view, with the full result available via `artifact://<id>`.
+  - You NEVER trim or silence output: no `| head -n N`, `| tail -n N`, `2>&1`, `2>/dev/null`. stderr is already merged; long output is auto-truncated with the full capture kept at `artifact://<id>`. Trimming destroys data the artifact would have saved.
   - If you catch yourself typing `cat`, `head`, `tail`, `less`, `more`, `ls`, `grep`, `rg`, `find`, `fd`, `sed -i`, `awk -i`, or a heredoc redirect inside a Bash call, stop and switch to the dedicated tool.{{/has}}
 {{#has tools "report_tool_issue"}}
 <critical>

package/src/prompts/tools/bash.md

@@ -13,9 +13,9 @@ Executes bash command in shell session for terminal operations like git, bun, ca
 </instruction>
 
 <critical>
-- NEVER use Linux coreutils (`cat`, `head`, `tail`, `less`, `more`, `ls`, `grep`, `rg`, `awk`, `sed`, `find`, `fd`, etc.) when a dedicated tool suffices — ALWAYS prefer `read`, `search`, `find`, `edit`, `write`.
-- NEVER pipe through `| head -n N` or `| tail -n N` — output is already truncated with the full result available via `artifact://<id>`.
-- NEVER redirect with `2>&1` or `2>/dev/null` — stdout and stderr are already merged.
+- NEVER use shell to fetch, display, list, page, or search content a dedicated tool serves: `cat`/`head`/`tail`/`less`/`more`/`ls` → `read`; `grep`/`rg`/`ag`/`ack` → `search`; `find`/`fd` → `find`; `sed -i`/`perl -i`/`awk -i` → `edit`; `echo >`/heredoc → `write`. The tools keep gitignore semantics, line anchors, and structured output that shell loses.
+- NEVER trim or silence output: no `| head -n N`, `| tail -n N`, `| less`, `2>&1`, `2>/dev/null`. stderr is already merged; long output is auto-truncated with the FULL capture kept at `artifact://<id>`. Defensive trimming is a habit from harnesses without artifact recovery — here it only destroys data the artifact would have saved.
+- Pipelines that COMPUTE a new fact are correct bash: `wc -l`, `sort | uniq -c`, `comm`, `cut`, `diff a b`, `shasum`. Litmus: produces a count, frequency table, set difference, or checksum no tool returns → bash. Merely moves or trims bytes a tool can fetch → use the tool.
 </critical>
 
 <output>

package/src/prompts/tools/todo.md

@@ -2,7 +2,7 @@
 
 Manages a phased task list. Pass `ops`: a flat array of operations.
 The next pending task is auto-promoted to `in_progress` after each completion.
-Allowed `op` values are only `init`, `start`, `done`, `drop`, `rm`, `append`, and `note`. `pending` is a task status, not an `op`; leave not-yet-started tasks implicit in `init`/`append` lists.
+Allowed `op` values are only `init`, `start`, `done`, `drop`, `rm`, `append`, `note`, and `view`. `pending` is a task status, not an `op`; leave not-yet-started tasks implicit in `init`/`append` lists.
 
 ## Operations
 
@@ -15,6 +15,7 @@ Allowed `op` values are only `init`, `start`, `done`, `drop`, `rm`, `append`, an
 |`rm`|`task` or `phase`|Remove|
 |`append`|`phase`, `items: string[]`|Append tasks to `phase`; lazily creates phase|
 |`note`|`task`, `text`|Append a note to a task. Reminders for future-you only.|
+|`view`|—|Read-only: echo the current list without modifying it|
 
 ## Anatomy
 - **Task content**: 5–10 words, what is being done, not how. Used as the task identifier — unique.
@@ -25,6 +26,7 @@ Allowed `op` values are only `init`, `start`, `done`, `drop`, `rm`, `append`, an
 - Complete phases in order.
 - On blockers, `append` a new task to the active phase to unblock yourself, or `drop`.
 - `task` and `phase` fields reference content/name verbatim; keep them stable once introduced.
+- Lost track of exact task text? `view` echoes the full list — NEVER guess content from memory; a mismatched `task` string is an error.
 
 ## When to create a list
 - Task requires 3+ distinct steps
@@ -35,6 +37,8 @@ Allowed `op` values are only `init`, `start`, `done`, `drop`, `rm`, `append`, an
 <examples>
 # Initial setup (multi-phase)
 `{"ops":[{"op":"init","list":[{"phase":"Foundation","items":["Scaffold crate","Wire workspace"]},{"phase":"Auth","items":["Port credential store","Wire OAuth providers"]},{"phase":"Verification","items":["Run cargo test"]}]}]}`
+# View current state (read-only)
+`{"ops":[{"op":"view"}]}`
 # Initial setup (single phase)
 `{"ops":[{"op":"init","list":[{"phase":"Implementation","items":["Apply fix","Run tests"]}]}]}`
 # Complete one task

package/src/task/discovery.ts

@@ -1,13 +1,14 @@
 /**
  * Agent discovery from filesystem.
  *
- * Discovers agent definitions from:
- *   - ~/.omp/agent/agents/*.md (user-level, primary)
- *   - ~/.pi/agent/agents/*.md (user-level, legacy)
- *   - ~/.claude/agents/*.md (user-level, legacy)
- *   - .omp/agents/*.md (project-level, primary)
- *   - .pi/agents/*.md (project-level, legacy)
- *   - .claude/agents/*.md (project-level, legacy)
+ * Discovers agent definitions from OMP-native task-agent roots:
+ *   - ~/.omp/agent/agents/*.md (user-level)
+ *   - .omp/agents/*.md (project-level)
+ *
+ * Claude Code marketplace plugin agents are discovered separately via the
+ * claude-plugins provider. Direct cross-harness roots such as .claude/agents
+ * are intentionally skipped because their frontmatter schema is not the OMP
+ * task-agent contract.
  *
  * Agent files use markdown with YAML frontmatter.
  */
@@ -21,6 +22,8 @@ import { listClaudePluginRoots } from "../discovery/helpers";
 import { loadBundledAgents, parseAgent } from "./agents";
 import type { AgentDefinition, AgentSource } from "./types";
 
+const TASK_AGENT_CONFIG_SOURCE = ".omp";
+
 /** Result of agent discovery */
 export interface DiscoveryResult {
 	agents: AgentDefinition[];
@@ -52,41 +55,31 @@ async function loadAgentsFromDir(dir: string, source: AgentSource): Promise<Agen
 /**
  * Discover agents from filesystem and merge with bundled agents.
  *
- * Precedence (highest wins): .omp > .pi > .claude (project before user), then bundled
- *
+ * Precedence (highest wins): project .omp, user .omp, Claude plugin agents, then bundled
  * @param cwd - Current working directory for project agent discovery
  */
 export async function discoverAgents(cwd: string, home: string = os.homedir()): Promise<DiscoveryResult> {
 	const resolvedCwd = path.resolve(cwd);
-	const agentSources = Array.from(new Set(getConfigDirs("", { project: false }).map(entry => entry.source)));
 
-	// Get user directories (priority order: .omp, .pi, .claude, ...)
 	const userDirs = getConfigDirs("agents", { project: false })
-		.filter(entry => agentSources.includes(entry.source))
+		.filter(entry => entry.source === TASK_AGENT_CONFIG_SOURCE)
 		.map(entry => ({
 			...entry,
 			path: path.resolve(entry.path),
 		}));
 
-	// Get project directories by walking up from cwd (priority order)
 	const projectDirs = findAllNearestProjectConfigDirs("agents", resolvedCwd)
-		.filter(entry => agentSources.includes(entry.source))
+		.filter(entry => entry.source === TASK_AGENT_CONFIG_SOURCE)
 		.map(entry => ({
 			...entry,
 			path: path.resolve(entry.path),
 		}));
 
-	const orderedSources = agentSources.filter(
-		source => userDirs.some(entry => entry.source === source) || projectDirs.some(entry => entry.source === source),
-	);
-
 	const orderedDirs: Array<{ dir: string; source: AgentSource }> = [];
-	for (const source of orderedSources) {
-		const project = projectDirs.find(entry => entry.source === source);
-		if (project) orderedDirs.push({ dir: project.path, source: "project" });
-		const user = userDirs.find(entry => entry.source === source);
-		if (user) orderedDirs.push({ dir: user.path, source: "user" });
-	}
+	const project = projectDirs[0];
+	if (project) orderedDirs.push({ dir: project.path, source: "project" });
+	const user = userDirs[0];
+	if (user) orderedDirs.push({ dir: user.path, source: "user" });
 
 	// Load agents from Claude Code marketplace plugins (respects disabledProviders)
 	const { roots: pluginRoots } = isProviderEnabled("claude-plugins")

package/src/tiny/title-client.ts

@@ -122,7 +122,7 @@ function tinyWorkerSpawnCmd(): string[] {
 }
 
 interface SpawnedSubprocess {
-	proc: Subprocess<"ignore", "inherit", "inherit">;
+	proc: Subprocess<"ignore", "ignore", "ignore">;
 	inbound: Set<(message: TinyTitleWorkerOutbound) => void>;
 	errors: Set<(error: Error) => void>;
 	/**
@@ -147,10 +147,13 @@ export function createTinyTitleSubprocess(): SpawnedSubprocess {
 		cmd: tinyWorkerSpawnCmd(),
 		env: tinyWorkerEnv(),
 		stdin: "ignore",
-		stdout: "inherit",
-		stderr: "inherit",
+		stdout: "ignore",
+		stderr: "ignore",
 		serialization: "advanced",
 		windowsHide: true,
+		// The worker is an implementation detail of the interactive TUI. Native
+		// model runtimes may print progress or decoded text directly; never let
+		// those bytes inherit the terminal and corrupt the chat scrollback.
 		ipc(message) {
 			for (const handler of inbound) handler(message as TinyTitleWorkerOutbound);
 		},

package/src/tools/todo.ts

@@ -51,7 +51,7 @@ export interface TodoToolDetails {
 // =============================================================================
 
 const TodoOp = z
-	.enum(["init", "start", "done", "rm", "drop", "append", "note"] as const)
+	.enum(["init", "start", "done", "rm", "drop", "append", "note", "view"] as const)
 	.describe("operation to apply");
 
 const InitListEntry = z.object({
@@ -380,6 +380,8 @@ function applyEntry(phases: TodoPhase[], entry: TodoOpEntryValue, errors: string
 		}
 		case "append":
 			return appendItems(phases, entry, errors);
+		case "view":
+			return phases;
 	}
 }
 
@@ -523,9 +525,12 @@ export function markdownToPhases(md: string): { phases: TodoPhase[]; errors: str
 	return { phases, errors };
 }
 
-function formatSummary(phases: TodoPhase[], errors: string[]): string {
+function formatSummary(phases: TodoPhase[], errors: string[], readOnly = false): string {
 	const tasks = phases.flatMap(phase => phase.tasks);
-	if (tasks.length === 0) return errors.length > 0 ? `Errors: ${errors.join("; ")}` : "Todo list cleared.";
+	if (tasks.length === 0) {
+		if (errors.length > 0) return `Errors: ${errors.join("; ")}`;
+		return readOnly ? "Todo list is empty." : "Todo list cleared.";
+	}
 
 	const remainingByPhase = phases
 		.map(phase => ({
@@ -608,15 +613,19 @@ export class TodoTool implements AgentTool<typeof todoSchema, TodoToolDetails> {
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<TodoToolDetails>> {
 		const previousPhases = clonePhases(this.session.getTodoPhases?.() ?? []);
-		const { phases: updated, errors } = applyParams(clonePhases(previousPhases), params);
-		const completedTasks = getCompletionTransitions(previousPhases, updated);
-		this.session.setTodoPhases?.(updated);
+		// Pure-view calls are reads: no normalization, no state write.
+		const readOnly = params.ops.every(entry => entry.op === "view");
+		const { phases: updated, errors } = readOnly
+			? { phases: previousPhases, errors: [] as string[] }
+			: applyParams(clonePhases(previousPhases), params);
+		const completedTasks = readOnly ? [] : getCompletionTransitions(previousPhases, updated);
+		if (!readOnly) this.session.setTodoPhases?.(updated);
 		const storage = this.session.getSessionFile() ? "session" : "memory";
 		const details: TodoToolDetails = { phases: updated, storage };
 		if (completedTasks.length > 0) details.completedTasks = completedTasks;
 
 		return {
-			content: [{ type: "text", text: formatSummary(updated, errors) }],
+			content: [{ type: "text", text: formatSummary(updated, errors, readOnly) }],
 			details,
 			isError: errors.length > 0 ? true : undefined,
 		};

package/src/web/search/providers/anthropic.ts

@@ -16,6 +16,7 @@ import {
 	type FetchImpl,
 	stripClaudeToolPrefix,
 	withAuth,
+	wrapFetchForCch,
 } from "@oh-my-pi/pi-ai";
 import { $env } from "@oh-my-pi/pi-utils";
 import type {
@@ -64,7 +65,9 @@ function buildSystemBlocks(
 	model: string,
 	systemPrompt?: string,
 ): AnthropicSystemBlock[] | undefined {
-	const includeClaudeCode = !model.startsWith("claude-3-5-haiku");
+	// Match the streaming path: the CC billing header + system instruction are
+	// an OAuth fingerprint and must not be claimed on API-key requests.
+	const includeClaudeCode = auth.isOAuth && !model.startsWith("claude-3-5-haiku");
 	const extraInstructions = auth.isOAuth ? ["You are a helpful AI assistant with web search capabilities."] : [];
 
 	return buildAnthropicSystemBlocks(systemPrompt ? [systemPrompt] : undefined, {
@@ -118,7 +121,10 @@ async function callSearch(
 		body.system = systemBlocks;
 	}
 
-	const response = await fetchImpl(url, {
+	// OAuth requests inject the CC billing header (buildSystemBlocks); patch its
+	// cch attestation like the streaming path instead of shipping `cch=00000`.
+	const doFetch = auth.isOAuth ? wrapFetchForCch(fetchImpl) : fetchImpl;
+	const response = await doFetch(url, {
 		method: "POST",
 		headers,
 		body: JSON.stringify(body),