@oh-my-pi/pi-coding-agent 15.9.1 → 15.9.5

package/CHANGELOG.md

@@ -2,6 +2,73 @@
 
 ## [Unreleased]
 
+## [15.9.5] - 2026-06-05
+### Added
+
+- Added a persistent error banner pinned above the editor when an assistant turn ends on a provider error (e.g. Anthropic's "Output blocked by content filtering policy"). The transcript `Error: …` line scrolls away as the conversation grows, so terminal turns that ended on a stream error could pass unnoticed; the banner stays in the fixed region above the input and is cleared when the next turn starts.
+
+- Added bold, underlined, clickable `[Image #N]` placeholders in the draft editor and sent user-message bubbles, backed by extension-bearing blob-store sidecar files so terminal `file://` links open in image viewers.
+- Added the active model identifier (`provider/id`) to the system prompt's `<workstation>` block so the agent knows which model it is running as. Gated by the new `includeModelInPrompt` setting (default on); the base prompt is rebuilt on a mid-session model switch so the surfaced identifier stays current.
+- Added `OLLAMA_HOST` support for implicit local Ollama discovery when `OLLAMA_BASE_URL` is unset, so OMP picks up the same host setting used by Ollama.
+- Added `OLLAMA_CONTEXT_LENGTH` as a positive-integer context-window override for implicit local Ollama discovery, so users can correct OMP context budgeting without writing per-model overrides.
+
+### Changed
+
+- Changed `tools.discoveryMode` to default to `auto`, which keeps discovery off for small tool sets and automatically switches to MCP-only tool discovery when more than 40 tools are registered.
+
+### Fixed
+
+- Fixed user-message rendering to materialize image links from embedded image blocks when rebuilding chat output, so image placeholders remain clickable after replayed or restored messages
+- Fixed queued/steering user messages carrying a pasted image rendering out of order — sometimes dropping the user bubble *below* the very tool output it was sent to steer. `EventController.#handleMessageStart` awaited async image-link materialization between the user `message_start` and `addMessageToChat`; since `AgentSession.#emit` dispatches TUI listeners fire-and-forget, that mid-handler yield let the next synchronously-handled events (assistant `message_start`, tool execution start/end) append their components first, scrambling transcript order and live-region block boundaries. The bubble is now appended synchronously, with clickable image links still materialized via the synchronous blob-store fallback.
+- Fixed tool execution cards to finalize promptly when a turn is abandoned or completed so stale streaming previews and frozen spinner frames no longer keep transcript rows in the live region
+- Fixed `read` and `search` TUI rendering to emit OSC 8 hyperlinks for HTTP URLs, `local://` resources backed by files, and filesystem search targets, including line-specific links for search match rows.
+- Fixed aborted streaming assistant messages staying frozen before their red "Operation aborted" label when status rows were appended underneath on ED3-risk terminals.
+- Fixed `omp` / `omp -c` stacking a fresh welcome screen and transcript on top of the previous run's leftover terminal scrollback. The cold-launch transcript render was the only session-load path that did not pass `clearTerminalHistory`, so the TUI's scrollback-preserving initial paint left the prior run's welcome + conversation above the new one; the cold launch now clears native scrollback before painting, matching every in-process session switch.
+- Fixed a long streamed assistant reply dropping its earlier lines on ED3-risk terminals (Ghostty/kitty/iTerm2) once it grew past the viewport — the head scrolled off the top and never reached scrollback, so the reply rendered as a ~viewport-tall circular buffer of only its latest lines. `AssistantMessageComponent` now reports itself as an append-only transcript block and `TranscriptContainer` surfaces the resulting commit-safe boundary, so the renderer commits the scrolled-off head to native scrollback instead of discarding it (volatile tool previews stay deferred as before).
+
+### Security
+
+- Blocked OSC 8 hyperlink wrapping for URI targets containing terminal control bytes to avoid rendering malformed control-sequence links
+
+## [15.9.4] - 2026-06-05
+### Fixed
+
+- Fixed chat transcript updates after submitting input so frozen scrollback is only thawed when native scrollback replay succeeds, preventing misplaced or duplicated rows when the viewport is not at the tail
+- Fixed `read` of `.zip` archives to list the central directory without inflating every member, so large or corrupt zip payloads no longer freeze directory reads; member contents are inflated only when a specific entry is read.
+- Fixed the Python `eval` kernel being hard-killed (and its persistent session state lost) when a cell blocked in `parallel()` / `agent()` was interrupted. Each `agent()`/`tool.*` call blocks a kernel worker thread in a synchronous `urllib` request to the host bridge, and `parallel()`'s `ThreadPoolExecutor` exit joins those threads — so the kernel cannot unwind a `KeyboardInterrupt` until every in-flight bridge call returns. A wide subagent fan-out's teardown routinely outlasted the kernel's 5s SIGINT-escalation window, so the kernel was force-killed (surfacing `[kernel] Python kernel shutdown`) while the subagents were still winding down. The host bridge now resolves an in-flight call the instant the cell's signal aborts, so the kernel unwinds cleanly and keeps its state; the already-signaled subagent continues tearing down in the background.
+- Fixed `github` tool `run_watch` op ignoring the explicit `repo` argument and silently watching the cwd-inferred repository in nested/umbrella workspaces. `executeRunWatch` passed `undefined` for the user-supplied `repo` to `resolveGitHubRepo`, so a call like `{op: "run_watch", repo: "owner/cxf", branch: "main"}` fell back to `gh repo view` in cwd and streamed `watching <sha> on <cwd-repo>` against the wrong repository. The explicit `repo` now takes precedence over the cwd inference, and the no-`branch`/no-`run` path refuses to derive the watched commit from `git HEAD` unless the cwd actually points at the resolved repo — otherwise it raises a `ToolError` telling the caller to pass `branch` or `run` instead of silently rebinding to an unrelated commit ([#1949](https://github.com/can1357/oh-my-pi/issues/1949)).
+- Fixed `omp plugin install <local-path>` failing with `Invalid package name: .` (and similar) for cwd-relative (`.`, `./pkg`), absolute (`/abs`, `C:\…`, `\\unc`), and tilde-prefixed (`~/pkg`) specs. `classifyInstallTarget` now returns a `local` arm in addition to `marketplace`/`npm`, and `plugin install` routes those specs to `PluginManager.link()` — the same code path as `omp plugin link`. ([#1945](https://github.com/can1357/oh-my-pi/issues/1945))
+- Fixed the `web_search` result renderer capping the synthesized answer at 12 lines even when expanded, while the Sources list expanded in full — so a long answer stayed truncated ("… N more lines") after `Ctrl+O`, making the expand toggle look like a no-op and dwarfing the answer next to its sources. The answer now renders the full text (markdown-formatted) when expanded and a short markdown preview when collapsed, matching the sources' collapse/expand behavior. The answer is also rendered through the Markdown component instead of dimmed raw lines, so headings, bold, lists, and code in the answer display formatted.
+
+## [15.9.3] - 2026-06-05
+
+### Fixed
+
+- Fixed `@`-mention auto-read injecting an unrelated, same-named file when a mention did not point at a real path — e.g. an npm scope like `@scope/`, a partial path, or a bare token. `generateFileMentionMessages` resolution previously fell back to prefix and repo-wide fuzzy matching (globbing the whole project on every such mention) and auto-read the single "best" guess. Resolution is now exact-only: a mention is auto-read only when it resolves to an existing file or directory; otherwise it is left as prose. The TUI `@`-selector already inserts the real, complete path before send, so post-send guessing was both unnecessary and the source of the wrong-file reads. Directories still resolve and are listed. Removes the per-mention `**/*` project scan.
+
+## [15.9.2] - 2026-06-05
+
+### Added
+
+- Added an encrypted local auth-broker snapshot cache for `discoverAuthStorage`, with `OMP_AUTH_BROKER_SNAPSHOT_TTL_MS` and `OMP_AUTH_BROKER_SNAPSHOT_CACHE`, so fresh cached broker credentials can boot without a blocking `/v1/snapshot` fetch and survive broker-down startup windows.
+- Added `dry-balance` CLI command to perform a dry-run OAuth account balancing check across configurable random session IDs, with sample and concurrency options, JSON output, and success/failure summary reporting
+- Added `--json` output mode and machine-readable result format to `omp dry-balance` for automated use
+- Added `omitMaxOutputTokens` to `models.yml` model definitions and `modelOverrides`, so users can opt a model out of the on-the-wire `max_output_tokens` / `max_tokens` cap while keeping the catalog `maxTokens` for local budgeting. Intended for Ollama-style proxies whose upstream output limit OMP cannot discover. ([#1881](https://github.com/can1357/oh-my-pi/issues/1881))
+
+### Fixed
+
+- Fixed TTSR rule-violation injections leaking the absolute home directory to the model: the `ttsr-interrupt` / `ttsr-tool-reminder` blocks rendered the matched rule's `path` as its absolute on-disk path (e.g. `/Users/me/Projects/app/.omp/rules/no-any.md`). The path is now relativized to the session cwd when the rule lives in the project (`.omp/rules/no-any.md`), or `~`-relative when it lives under home, so no absolute path is fed into the agent's context outside the system prompt.
+- Fixed `AsyncJobManager.instance()` being cleared while the owning top-level session was still live, which broke the `task` async path with "Async execution is enabled but no async job manager is available" until process restart. Any in-process secondary top-level `createAgentSession()` call (e.g. the Agent Control Center's create flow in `agent-dashboard.ts`) constructed a fresh `AsyncJobManager`, overwrote the singleton, and then cleared it on its own dispose. Secondary sessions now leave the live singleton untouched, and their dispose-time cleanup is scoped so it can no longer cancel the primary session's running bash/task jobs. `bash` / `task` / `job` tools and session job snapshots now resolve the manager through session-scoped async manager wiring rather than `AsyncJobManager.instance()`, so a secondary in-process top-level session cannot accidentally register background work on the owning session's manager or report the owning session's jobs; subagents still inherit the parent's manager via their scoped async manager. Startup failures after a top-level session installs its manager now clear and dispose that manager before the next session decides whether it can create its own ([#1923](https://github.com/can1357/oh-my-pi/issues/1923)).
+- Fixed the `task` tool returning a hard `Async execution is enabled but no async job manager is available.` error when `async.enabled` was true but `AsyncJobManager.instance()` returned `undefined`, leaving `task` non-functional for the rest of the session. The tool now falls back to the existing synchronous execution path (which still runs subagents concurrently via `mapWithConcurrencyLimit`), and logs a warning so the missing-manager state stays diagnosable ([#1922](https://github.com/can1357/oh-my-pi/issues/1922)).
+- Fixed Hindsight retain/recall/reflect calls staying pinned to the bank that was selected when the session started after the operator edited `hindsight.bankId`, `hindsight.bankIdPrefix`, or `hindsight.scoping` mid-session. The backend now subscribes to those settings via `onHindsightScopeChanged` and rebuilds the active `HindsightSessionState` against the recomputed scope, disposing the old state after flushing its queue so in-flight tool-initiated retains still land in the bank they were enqueued for. Also renamed `ensureBankMission` to `ensureBankExists` so a blank `bankMission` no longer skips bank creation entirely, and called it before mental-model bootstrap so `createMentalModel` is never the first POST against a missing bank. `AgentSession.dispose` now flushes the retain queue before clearing `#hindsightSessionState`, since the queue's identity guard would otherwise drop the spliced batch ([#1902](https://github.com/can1357/oh-my-pi/issues/1902)).
+- Fixed `/tree` rendering a bare "No entries found" line on a fresh session where the only persisted entries are the `model_change` + `thinking_level_change` written by `sdk.ts` at startup — both are hidden by the tree-selector's default filter, so `#filteredNodes.length === 0` while `tree.length === 2` and the controller's `tree.length === 0` short-circuit never fired. The selector now splits the empty-state into three distinct shapes — truly empty tree, search query with no matches, and filter mode rejecting every entry — surfacing the cause and the recovery key (`Alt+A` to show all, `Backspace` to clear a stale search) so users on a fresh session can see immediately that the panel isn't broken ([#1909](https://github.com/can1357/oh-my-pi/issues/1909)).
+- Fixed remote MCP OAuth refresh failures leaving stale credentials in `agent.db`: when the token endpoint returns a definitive failure (`invalid_grant`, `invalid_token`, `revoked`, plain 401/403 not classified as transient), `MCPManager#resolveAuthConfig` now drops the credential via `AuthStorage.remove(credentialId)` and skips re-attaching the dead `Authorization: Bearer …` header. Previously a revoked refresh token kept producing `401 invalid_token` on every MCP request and survived restarts, so users had to hand-clear the credential row to recover; the next connect now surfaces a clean auth error and `/mcp reauth <server>` (or `/mcp unauth`) recovers without restarting. Transient refresh failures (network/`fetch failed`/`ECONNREFUSED`) still fall back to the existing access token ([#1908](https://github.com/can1357/oh-my-pi/issues/1908)).
+- Fixed `omp://docs` and `omp://docs/...` internal documentation URLs in the distributed package to resolve through the embedded documentation index instead of failing with `Documentation file not found` ([#1898](https://github.com/can1357/oh-my-pi/issues/1898)).
+- Fixed the `github` discovery provider silently ignoring `.github/skills/<name>/SKILL.md`, GitHub's documented Agent Skills layout. The provider now registers a `skills` capability (priority 30, project-only) that scans `.github/skills/` non-recursively via `scanSkillsFromDir` with `requireDescription: true`, matching the Agent Skills spec and the sibling `native`/`omp-plugins` providers ([#1906](https://github.com/can1357/oh-my-pi/issues/1906)).
+- Fixed inline images rendering as a wall of empty PUA box glyphs with laggy scrolling on Kitty-protocol terminals that do not honor Unicode placeholders (most notably WezTerm and tmux/screen passthrough to a non-Kitty outer terminal). The 15.9 placeholder rollout enabled the `U=1`/U+10EEEE grid for every Kitty-protocol path; it now defaults on only for `kitty` and `ghostty`, with `PI_NO_KITTY_PLACEHOLDERS=1` as a hard opt-out and `PI_KITTY_PLACEHOLDERS=1` as opt-in for terminals (e.g. wezterm nightlies) that have since added support ([#1877](https://github.com/can1357/oh-my-pi/issues/1877)).
+- Fixed auto session-title generation failures being swallowed without an actionable diagnostic. Title generation now logs structured start, missing-model/API-key, provider-error, empty-result, and exception outcomes with the session id and resolved title model; the interactive auto-title caller also logs uncaught persistence/generation errors instead of dropping them. ([#1892](https://github.com/can1357/oh-my-pi/issues/1892))
+- Fixed `TranscriptContainer` reporting the live block boundary to the TUI again, so ED3-risk foreground streaming can append newly sealed transcript blocks to native scrollback once while deferring only the active live block.
+
 ## [15.9.1] - 2026-06-04
 
 ### Added
@@ -20,7 +87,6 @@
 ### Fixed
 
 - Fixed a streamed assistant message freezing at a partial prefix (e.g. only "Nat" of "Natives built, now…") on ED3-risk terminals (Ghostty/kitty/iTerm2/Alacritty), with the final text appearing only after a resize. `TranscriptContainer` freezes each non-live block by replaying its last live render, but render coalescing can finalize a block's content and append the next block within the same throttled frame — so the block was sealed at its stale mid-stream snapshot and never repainted until the next `thaw`. The block that was live on the previous render is now recomputed once on the live→frozen transition, sealing it at its final content.
-
 - Fixed ACP/RPC stdio startup so protocol frames are no longer consumed as one-shot piped prompt input before the JSON-RPC transport starts.
 - Fixed `omp completions` to await the completion script write before exiting.
 - Fixed `AssistantMessageComponent` exposing its stable-prefix completion API again so streamed assistant messages remain unstable until explicitly completed.
@@ -9333,4 +9399,4 @@ Initial public release.
 - Git branch display in footer
 - Message queueing during streaming responses
 - OAuth integration for Gmail and Google Calendar access
-- HTML export with syntax highlighting and collapsible sections
+- HTML export with syntax highlighting and collapsible sections

package/dist/types/cli/classify-install-target.d.ts

@@ -1,4 +1,7 @@
-export declare function classifyInstallTarget(spec: string, knownMarketplaces: Set<string>): {
+export type ClassifiedInstallTarget = {
+    type: "local";
+    path: string;
+} | {
     type: "marketplace";
     name: string;
     marketplace: string;
@@ -6,3 +9,4 @@ export declare function classifyInstallTarget(spec: string, knownMarketplaces: S
     type: "npm";
     spec: string;
 };
+export declare function classifyInstallTarget(spec: string, knownMarketplaces: Set<string>): ClassifiedInstallTarget;

package/dist/types/cli/dry-balance-cli.d.ts

@@ -0,0 +1,104 @@
+import type { Api, AssistantMessageEventStream, Context, Model, OAuthAccess, OAuthAccessResolution, SimpleStreamOptions } from "@oh-my-pi/pi-ai";
+import type { CanonicalModelVariant } from "../config/model-equivalence";
+import { type CanonicalModelQueryOptions } from "../config/model-registry";
+import { Settings } from "../config/settings";
+export interface DryBalanceCommandArgs {
+    model?: string;
+    flags: {
+        model?: string;
+        count?: number;
+        concurrency?: number;
+        json?: boolean;
+        bench?: boolean;
+    };
+}
+export interface DryBalanceAuthOptions {
+    baseUrl?: string;
+    modelId?: string;
+    signal?: AbortSignal;
+}
+export interface DryBalanceAuthStorage {
+    getOAuthAccess(provider: string, sessionId?: string, options?: DryBalanceAuthOptions): Promise<OAuthAccess | undefined>;
+    getOAuthAccesses?(provider: string, options?: DryBalanceAuthOptions): Promise<OAuthAccessResolution[]>;
+}
+export interface DryBalanceModelRegistry {
+    authStorage: DryBalanceAuthStorage;
+    getAll(): Model<Api>[];
+    getAvailable(): Model<Api>[];
+    getApiKey(model: Model<Api>, sessionId?: string): Promise<string | undefined>;
+    getCanonicalVariants(canonicalId: string, options?: CanonicalModelQueryOptions): CanonicalModelVariant[];
+    resolveCanonicalModel?(canonicalId: string, options?: CanonicalModelQueryOptions): Model<Api> | undefined;
+    getCanonicalId?(model: Model<Api>): string | undefined;
+}
+export interface DryBalanceRuntime {
+    modelRegistry: DryBalanceModelRegistry;
+    settings?: Settings;
+    close?: () => void;
+}
+export interface DryBalanceAccountStat {
+    account: string;
+    count: number;
+    percent: number;
+}
+export interface DryBalanceFailureStat {
+    reason: string;
+    count: number;
+    percent: number;
+}
+export interface DryBalanceBenchSuccessResult {
+    ok: true;
+    account: string;
+    ttftMs: number;
+    durationMs: number;
+    outputTokens: number;
+    tokensPerSecond: number;
+}
+export interface DryBalanceBenchFailureResult {
+    ok: false;
+    account?: string;
+    error: string;
+}
+export type DryBalanceBenchResult = DryBalanceBenchSuccessResult | DryBalanceBenchFailureResult;
+export interface DryBalanceBenchSummary {
+    total: number;
+    success: {
+        total: number;
+        averageTtftMs: number | null;
+        averageTokensPerSecond: number | null;
+    };
+    failure: {
+        total: number;
+        reasons: DryBalanceFailureStat[];
+    };
+    results: DryBalanceBenchResult[];
+}
+export interface DryBalanceSummary {
+    model: string;
+    provider: string;
+    samples: number;
+    concurrency: number;
+    success: {
+        total: number;
+        accounts: DryBalanceAccountStat[];
+    };
+    failure: {
+        total: number;
+        reasons: DryBalanceFailureStat[];
+    };
+    bench?: DryBalanceBenchSummary;
+}
+type DryBalanceStreamSimple = (model: Model<Api>, context: Context, options?: SimpleStreamOptions) => AssistantMessageEventStream;
+export interface DryBalanceDependencies {
+    createRuntime?: () => Promise<DryBalanceRuntime>;
+    randomSessionId?: () => string;
+    writeStdout?: (text: string) => void;
+    writeStderr?: (text: string) => void;
+    setExitCode?: (code: number) => void;
+    streamSimple?: DryBalanceStreamSimple;
+    now?: () => number;
+    stdoutIsTTY?: boolean;
+    stderrIsTTY?: boolean;
+}
+export declare function formatDryBalanceText(summary: DryBalanceSummary): string;
+export declare function runDryBalanceCommand(command: DryBalanceCommandArgs, deps?: DryBalanceDependencies): Promise<DryBalanceSummary>;
+export {};

package/dist/types/commands/dry-balance.d.ts

@@ -0,0 +1,31 @@
+import { Command } from "@oh-my-pi/pi-utils/cli";
+export default class DryBalance extends Command {
+    static description: string;
+    static args: {
+        model: import("@oh-my-pi/pi-utils/cli").ArgDescriptor & {
+            description: string;
+            required: false;
+        };
+    };
+    static flags: {
+        model: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"string"> & {
+            description: string;
+        };
+        count: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"integer"> & {
+            description: string;
+            default: number;
+        };
+        concurrency: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"integer"> & {
+            description: string;
+            default: number;
+        };
+        json: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        bench: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/types/config/model-registry.d.ts

@@ -104,6 +104,7 @@ export declare const ModelsConfigFile: ConfigFile<{
             premiumMultiplier?: number | undefined;
             contextWindow?: number | undefined;
             maxTokens?: number | undefined;
+            omitMaxOutputTokens?: boolean | undefined;
             headers?: Record<string, string> | undefined;
             compat?: {
                 supportsStore?: boolean | undefined;
@@ -166,6 +167,7 @@ export declare const ModelsConfigFile: ConfigFile<{
             premiumMultiplier?: number | undefined;
             contextWindow?: number | undefined;
             maxTokens?: number | undefined;
+            omitMaxOutputTokens?: boolean | undefined;
             headers?: Record<string, string> | undefined;
             compat?: {
                 supportsStore?: boolean | undefined;

package/dist/types/config/models-config-schema.d.ts

@@ -109,6 +109,7 @@ export declare const ModelOverrideSchema: z.ZodObject<{
     premiumMultiplier: z.ZodOptional<z.ZodNumber>;
     contextWindow: z.ZodOptional<z.ZodNumber>;
     maxTokens: z.ZodOptional<z.ZodNumber>;
+    omitMaxOutputTokens: z.ZodOptional<z.ZodBoolean>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     compat: z.ZodOptional<z.ZodObject<{
         supportsStore: z.ZodOptional<z.ZodBoolean>;
@@ -336,6 +337,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             premiumMultiplier: z.ZodOptional<z.ZodNumber>;
             contextWindow: z.ZodOptional<z.ZodNumber>;
             maxTokens: z.ZodOptional<z.ZodNumber>;
+            omitMaxOutputTokens: z.ZodOptional<z.ZodBoolean>;
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             compat: z.ZodOptional<z.ZodObject<{
                 supportsStore: z.ZodOptional<z.ZodBoolean>;
@@ -449,6 +451,7 @@ export declare const ModelsConfigSchema: z.ZodObject<{
             premiumMultiplier: z.ZodOptional<z.ZodNumber>;
             contextWindow: z.ZodOptional<z.ZodNumber>;
             maxTokens: z.ZodOptional<z.ZodNumber>;
+            omitMaxOutputTokens: z.ZodOptional<z.ZodBoolean>;
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             compat: z.ZodOptional<z.ZodObject<{
                 supportsStore: z.ZodOptional<z.ZodBoolean>;

package/dist/types/config/settings-schema.d.ts

@@ -659,7 +659,7 @@ export declare const SETTINGS_SCHEMA: {
         readonly ui: {
             readonly tab: "appearance";
             readonly label: "Terminal Hyperlinks";
-            readonly description: "Wrap file paths in OSC 8 hyperlinks for terminal-native click-to-open (auto: detect support; off: never; always: unconditional)";
+            readonly description: "Wrap paths and URLs in OSC 8 hyperlinks for terminal-native click-to-open (auto: detect support; off: never; always: unconditional)";
         };
     };
     readonly "display.tabWidth": {
@@ -745,6 +745,15 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Render full tool descriptions in the system prompt instead of a tool name list";
         };
     };
+    readonly includeModelInPrompt: {
+        readonly type: "boolean";
+        readonly default: true;
+        readonly ui: {
+            readonly tab: "model";
+            readonly label: "Include Model In Prompt";
+            readonly description: "Surface the active model identifier in the system prompt so the agent knows which model it is";
+        };
+    };
     readonly temperature: {
         readonly type: "number";
         readonly default: -1;
@@ -2828,12 +2837,12 @@ export declare const SETTINGS_SCHEMA: {
     };
     readonly "tools.discoveryMode": {
         readonly type: "enum";
-        readonly values: readonly ["off", "mcp-only", "all"];
-        readonly default: "off";
+        readonly values: readonly ["auto", "off", "mcp-only", "all"];
+        readonly default: "auto";
         readonly ui: {
             readonly tab: "tools";
             readonly label: "Tool Discovery";
-            readonly description: "Hide tools behind a search tool to save tokens. 'mcp-only' hides MCP tools; 'all' hides all non-essential built-ins too.";
+            readonly description: "Hide tools behind a search tool to save tokens. 'auto' hides MCP tools once the tool set has more than 40 tools; 'mcp-only' always hides MCP tools; 'all' hides all non-essential built-ins too.";
         };
     };
     readonly "tools.essentialOverride": {

package/dist/types/config/settings.d.ts

@@ -132,6 +132,17 @@ export declare class Settings {
  * can register independently without overwriting each other.
  */
 export declare function onAppendOnlyModeChanged(cb: (value: string) => void): () => void;
+/**
+ * Subscribe to changes in the Hindsight bank-scoping settings. Lets the
+ * Hindsight backend rebuild the active `HindsightSessionState` when the
+ * operator switches `hindsight.bankId`, `hindsight.bankIdPrefix`, or
+ * `hindsight.scoping` mid-session so subsequent retain/recall calls land in
+ * the new bank instead of the one selected at session start.
+ *
+ * Returns an unsubscribe function. The callback receives no arguments — the
+ * caller is expected to re-read the relevant settings via `Settings.get`.
+ */
+export declare function onHindsightScopeChanged(cb: () => void): () => void;
 export declare function isSettingsInitialized(): boolean;
 /**
  * Reset the global singleton for testing.

package/dist/types/discovery/helpers.d.ts

@@ -102,6 +102,7 @@ export interface ParsedAgentFields {
     output?: unknown;
     thinkingLevel?: ThinkingLevel;
     autoloadSkills?: string[];
+    readSummarize?: boolean;
     blocking?: boolean;
 }
 /**

package/dist/types/extensibility/plugins/legacy-pi-compat.d.ts

@@ -20,9 +20,8 @@ export declare function __computeBunfsPackageRoot(metaDir: string, pathImpl?: ty
  * and `__dirname`-relative `readFileSync` asset loads (HTML/CSS bundled next to
  * the entry) resolve exactly as they do under the original Pi runtime — no
  * temp-directory mirroring and no asset copying. An `onLoad` hook scoped to the
- * entry's relative-import graph rewrites only the legacy `@(scope)/pi-*` and
- * `@sinclair/typebox` imports in the extension's own source; everything else
- * resolves natively.
+ * entry's source graph rewrites only host-resolved compatibility imports in the
+ * extension's own source; everything else resolves natively.
  */
 export declare function loadLegacyPiModule(resolvedPath: string): Promise<unknown>;
 export declare function installLegacyPiSpecifierShim(): void;

package/dist/types/hindsight/bank.d.ts

@@ -1,5 +1,5 @@
 /**
- * Bank ID derivation, project-tag scoping, and first-use mission setup.
+ * Bank ID derivation, project-tag scoping, and first-use bank setup.
  *
  * Three scoping modes (`HindsightConfig.scoping`):
  *   - `global`              — single shared bank, no per-project filter.
@@ -11,10 +11,13 @@
  * The base bank id is `bankIdPrefix-bankId` (default `omp`). Per-project mode
  * appends `-<project>`; tagged mode leaves the bank untouched and uses tags.
  *
- * Mission setup is idempotent at module level — a missionsSet keeps track of
- * banks we've already POSTed to so each session boundary doesn't fire a fresh
- * `createBank` call. Failures are swallowed: missions are an optimisation, not
- * a precondition for retain/recall.
+ * Bank existence is idempotent at module level — a banksSet keeps track of
+ * banks we've already PUT so each session boundary doesn't fire a fresh
+ * `createBank` call. The PUT is idempotent server-side, so re-firing on a hot
+ * path would only burn round-trips. Failures are swallowed: missing the
+ * mission patch is an optimisation, but the bank ITSELF must exist before
+ * mental-model bootstrap or the first retain, otherwise the very first POST
+ * lands against a missing bank.
  */
 import type { HindsightApi } from "./client";
 import type { HindsightConfig } from "./config";
@@ -46,9 +49,14 @@ export declare function computeBankScope(config: HindsightConfig, directory: str
  */
 export declare function deriveBankId(config: HindsightConfig, directory: string): string;
 /**
- * Ensure a bank's reflect/retain mission is set, exactly once per process.
+ * Ensure a bank exists, and patch its reflect/retain mission on first use.
  *
- * Tracked via the supplied set; on overflow we drop the oldest half so the set
- * cannot grow unboundedly across long-lived processes.
+ * Idempotent: skips the PUT when the bank id is already in the supplied set.
+ * The mission body is optional — when `bankMission` is blank we still PUT to
+ * make sure the bank itself is created, so mental-model bootstrap and the
+ * first retain don't land against a non-existent bank.
+ *
+ * The set is capped; on overflow we drop the oldest half so it cannot grow
+ * unboundedly across long-lived processes.
  */
-export declare function ensureBankMission(client: HindsightApi, bankId: string, config: HindsightConfig, missionsSet: Set<string>): Promise<void>;
+export declare function ensureBankExists(client: HindsightApi, bankId: string, config: HindsightConfig, banksSet: Set<string>): Promise<void>;

package/dist/types/hindsight/mental-models.d.ts

@@ -70,7 +70,7 @@ export declare function resolveSeedsForScope(scope: BankScope, scoping: Hindsigh
  * Idempotently create any seed mental models that don't already exist on the
  * bank. Best-effort: a list/create failure does not throw — mental models are
  * an optimization, not a precondition for retain/recall, and we mirror the
- * swallow-on-failure pattern used by `ensureBankMission`.
+ * swallow-on-failure pattern used by `ensureBankExists`.
  *
  * Existing models are NEVER modified. See module docstring.
  */

package/dist/types/hindsight/state.d.ts

@@ -19,12 +19,12 @@ export interface HindsightSessionStateOptions {
     recallTagsMatch?: "any" | "all" | "any_strict" | "all_strict";
     config: HindsightConfig;
     session: AgentSession;
-    missionsSet: Set<string>;
+    banksSet: Set<string>;
     lastRetainedTurn?: number;
     hasRecalledForFirstTurn?: boolean;
     /**
      * When set, this entry is a subagent alias that reuses the parent's bank,
-     * scope, config, client, and missionsSet. Aliases skip auto-recall and
+     * scope, config, client, and banksSet. Aliases skip auto-recall and
      * auto-retain — those run on the parent only — but the recall/retain/reflect
      * tools resolve via the alias so they persist to the same bank as the parent.
      */
@@ -60,7 +60,7 @@ export declare class HindsightSessionState {
     recallTagsMatch?: "any" | "all" | "any_strict" | "all_strict";
     config: HindsightConfig;
     session: AgentSession;
-    missionsSet: Set<string>;
+    banksSet: Set<string>;
     lastRetainedTurn: number;
     hasRecalledForFirstTurn: boolean;
     lastRecallSnippet?: string;
@@ -75,6 +75,12 @@ export declare class HindsightSessionState {
      */
     mentalModelsLoadPromise?: Promise<void>;
     unsubscribe?: () => void;
+    /**
+     * Releases the `onHindsightScopeChanged` subscription that drives live
+     * rebuilds when `hindsight.bankId` / `bankIdPrefix` / `scoping` change.
+     * Only set on primary states; aliases inherit the parent's subscription.
+     */
+    unsubscribeScope?: () => void;
     /** Alias states delegate persistence config to a primary parent state. */
     aliasOf?: HindsightSessionState;
     readonly retainQueue: HindsightRetainQueue;

package/dist/types/mcp/manager.d.ts

@@ -1,4 +1,4 @@
-import type { TSchema } from "@oh-my-pi/pi-ai";
+import { type TSchema } from "@oh-my-pi/pi-ai";
 import type { SourceMeta } from "../capability/types";
 import type { CustomTool } from "../extensibility/custom-tools/types";
 import type { AuthStorage } from "../session/auth-storage";

package/dist/types/modes/components/assistant-message.d.ts

@@ -13,6 +13,17 @@ export declare class AssistantMessageComponent extends Container {
     constructor(message?: AssistantMessage, hideThinkingBlock?: boolean, onImageUpdate?: (() => void) | undefined, thinkingRenderers?: readonly AssistantThinkingRenderer[], imageBudget?: ImageBudget | undefined);
     invalidate(): void;
     setHideThinkingBlock(hide: boolean): void;
+    isTranscriptBlockFinalized(): boolean;
+    /**
+     * Assistant text/thinking streams in append-only: earlier rendered rows never
+     * re-layout, new content only grows the block at the bottom. The transcript
+     * reports this so the renderer may commit scrolled-off head rows of a long
+     * streamed reply to native scrollback instead of dropping them (see
+     * `NativeScrollbackLiveRegion#getNativeScrollbackCommitSafeEnd`). Volatile
+     * blocks (tool previews that collapse) intentionally do not implement this.
+     */
+    isTranscriptBlockAppendOnly(): boolean;
+    markTranscriptBlockFinalized(): void;
     setToolResultImages(toolCallId: string, images: ImageContent[]): void;
     setUsageInfo(usage: Usage): void;
     updateContent(message: AssistantMessage): void;

package/dist/types/modes/components/custom-editor.d.ts

@@ -6,8 +6,10 @@ type ConfigurableEditorAction = Extract<AppKeybinding, "app.interrupt" | "app.cl
  */
 export declare class CustomEditor extends Editor {
     #private;
+    imageLinks?: readonly (string | undefined)[];
     /** Gradient-highlight the "ultrathink" / "orchestrate" / "workflow" keywords as the user types
-     *  them, skipping any occurrence inside code spans, fenced blocks, or XML sections. */
+     *  them, skipping any occurrence inside code spans, fenced blocks, or XML sections. Also make
+     *  pasted image placeholders visually distinct and hyperlink them once their blob file exists. */
     decorateText: (text: string) => string;
     onEscape?: () => void;
     onClear?: () => void;

package/dist/types/modes/components/error-banner.d.ts

@@ -0,0 +1,11 @@
+import { Container } from "@oh-my-pi/pi-tui";
+/**
+ * A persistent error banner pinned above the editor. Unlike the transcript
+ * "Error: …" line (which scrolls away as the conversation grows), this stays in
+ * the fixed region directly above the input so a turn that ended on a provider
+ * error — e.g. Anthropic's "Output blocked by content filtering policy" — cannot
+ * be missed. It is cleared when the next turn starts.
+ */
+export declare class ErrorBannerComponent extends Container {
+    constructor(message: string);
+}

package/dist/types/modes/components/tool-execution.d.ts

@@ -52,6 +52,21 @@ export declare class ToolExecutionComponent extends Container {
         details?: any;
         isError?: boolean;
     }, isPartial?: boolean, _toolCallId?: string): void;
+    /**
+     * Whether this block has reached a terminal state for transcript freezing.
+     * Reports `false` while it can still visually change so the
+     * {@link TranscriptContainer} keeps it inside the repaintable live region:
+     * a foreground tool awaiting its result, or one streaming partial output.
+     * A final (non-partial) result, a background-async tool the agent has moved
+     * past, or an explicit {@link seal} flips it to `true`.
+     */
+    isTranscriptBlockFinalized(): boolean;
+    /**
+     * Mark the tool terminal even though no result arrived (the turn aborted or
+     * abandoned it) and stop animating, so it can freeze and stops pinning the
+     * transcript live region.
+     */
+    seal(): void;
     /**
      * Stop spinner animation and cleanup resources.
      */

package/dist/types/modes/components/transcript-container.d.ts

@@ -1,4 +1,4 @@
-import { Container } from "@oh-my-pi/pi-tui";
+import { Container, type NativeScrollbackLiveRegion } from "@oh-my-pi/pi-tui";
 /**
  * Transcript container that freezes the rendered output of every block except
  * the bottom-most (live) one on terminals where committed native scrollback is
@@ -21,10 +21,12 @@ import { Container } from "@oh-my-pi/pi-tui";
  * and any drift reconciles safely. On terminals that can rebuild history this
  * freezing is unnecessary, so it renders every block live for full fidelity.
  */
-export declare class TranscriptContainer extends Container {
+export declare class TranscriptContainer extends Container implements NativeScrollbackLiveRegion {
     #private;
     invalidate(): void;
     clear(): void;
+    getNativeScrollbackLiveRegionStart(): number | undefined;
+    getNativeScrollbackCommitSafeEnd(): number | undefined;
     /**
      * Retire all frozen snapshots so the next render reflects each block's current
      * state. Call at reconciliation checkpoints (prompt submit) where the whole

package/dist/types/modes/components/user-message.d.ts

@@ -3,6 +3,6 @@ import { Container } from "@oh-my-pi/pi-tui";
  * Component that renders a user message
  */
 export declare class UserMessageComponent extends Container {
-    constructor(text: string, synthetic?: boolean);
+    constructor(text: string, synthetic?: boolean, imageLinks?: readonly (string | undefined)[]);
     render(width: number): string[];
 }

package/dist/types/modes/image-references.d.ts

@@ -0,0 +1,17 @@
+import type { ImageContent } from "@oh-my-pi/pi-ai";
+import { type BlobPutResult } from "../session/blob-store";
+type ImageBlobWriter = (data: Buffer, options?: {
+    extension?: string;
+}) => Promise<BlobPutResult>;
+type ImageBlobWriterSync = (data: Buffer, options?: {
+    extension?: string;
+}) => BlobPutResult;
+export interface ImageReferenceRenderers {
+    renderText: (text: string) => string;
+    renderReference: (label: string, index: number) => string;
+}
+export declare function renderImageReferences(text: string, renderers: ImageReferenceRenderers): string;
+export declare function imageReferenceHyperlink(label: string, index: number, imageLinks: readonly (string | undefined)[] | undefined, renderLabel: (text: string) => string): string;
+export declare function materializeImageReferenceLinks(images: readonly ImageContent[] | undefined, putBlob: ImageBlobWriter): Promise<(string | undefined)[] | undefined>;
+export declare function materializeImageReferenceLinksSync(images: readonly ImageContent[] | undefined, putBlob: ImageBlobWriterSync): (string | undefined)[] | undefined;
+export {};