@oh-my-pi/pi-coding-agent 15.9.5 → 15.10.0

package/src/eval/bridge-timeout.ts

@@ -0,0 +1,44 @@
+/**
+ * Timeout suspension for in-flight host-side eval bridge calls.
+ *
+ * The eval watchdog caps a cell's `timeout` as a budget on the cell runtime's
+ * own work. Host-side `agent()` / `parallel()` / `llm()` bridge calls hand
+ * control to the outer TypeScript process, where the Python kernel or JS VM is
+ * only waiting for a result. While that delegated work is in flight, the cell
+ * timeout must be ignored completely; once the bridge returns and the runtime is
+ * back in control, the watchdog starts a fresh timeout window.
+ *
+ * Bridge helpers express that handoff with synthetic pause/resume status events
+ * on the existing `emitStatus → onStatus` path. Consumers MUST treat these as
+ * timeout-control events only: update the watchdog and drop them from rendered
+ * or persisted cell output.
+ */
+import type { JsStatusEvent } from "./js/shared/types";
+
+/** Synthetic status op emitted when a bridge call leaves the cell runtime. */
+export const EVAL_TIMEOUT_PAUSE_OP = "timeout-pause";
+
+/** Synthetic status op emitted when a bridge call returns control to the runtime. */
+export const EVAL_TIMEOUT_RESUME_OP = "timeout-resume";
+
+/** Whether a status event is pure eval-timeout control and should not render. */
+export function isEvalTimeoutControlEvent(event: JsStatusEvent): boolean {
+	return event.op === EVAL_TIMEOUT_PAUSE_OP || event.op === EVAL_TIMEOUT_RESUME_OP;
+}
+
+/**
+ * Run {@link operation} while suspending the eval watchdog through
+ * {@link emitStatus}. A no-op wrapper when no status sink is wired.
+ */
+export async function withBridgeTimeoutPause<T>(
+	emitStatus: ((event: JsStatusEvent) => void) | undefined,
+	operation: () => Promise<T>,
+): Promise<T> {
+	if (!emitStatus) return operation();
+	emitStatus({ op: EVAL_TIMEOUT_PAUSE_OP });
+	try {
+		return await operation();
+	} finally {
+		emitStatus({ op: EVAL_TIMEOUT_RESUME_OP });
+	}
+}

package/src/eval/idle-timeout.ts

@@ -1,17 +1,15 @@
 /**
- * Inactivity watchdog for eval cells.
+ * Watchdog for eval cell work.
  *
- * A cell's `timeout` is treated as an *idle* budget rather than a hard
- * wall-clock deadline: the watchdog aborts {@link signal} (with a
- * `TimeoutError` reason, matching `AbortSignal.timeout`) only once `idleMs`
- * elapses with no {@link bump}. Every progress signal re-arms it, so a
- * long-running fanout that keeps reporting progress (e.g. `agent()` status
- * updates, `log()`/`phase()`) never trips the timeout, while a genuinely
- * stalled cell still gets interrupted.
+ * A cell's `timeout` bounds time while the Python kernel or JS VM is in control.
+ * Host-side bridge calls can {@link pause} the watchdog so delegated
+ * `agent()`/`parallel()`/`llm()` work is ignored completely, then {@link resume}
+ * starts a fresh timeout window once the runtime gets control back.
  *
- * The timer self-reschedules instead of being torn down and recreated on every
- * bump, so a high-frequency stream of bumps (sub-second agent progress) costs
- * one timestamp write per event rather than churning a timer each time.
+ * The active timer self-reschedules instead of being torn down on every
+ * activity event, so frequent activity costs one timestamp write per event.
+ * Pause is reference-counted because `parallel()` can have multiple bridge calls
+ * in flight at once.
  */
 export class IdleTimeout {
 	readonly #controller = new AbortController();
@@ -20,6 +18,7 @@ export class IdleTimeout {
 	#deadlineMs: number;
 	#timer: NodeJS.Timeout | undefined;
 	#settled = false;
+	#pauseDepth = 0;
 
 	constructor(idleMs: number) {
 		this.#idleMs = Math.max(1, Math.floor(idleMs));
@@ -27,20 +26,39 @@ export class IdleTimeout {
 		this.#arm(this.#idleMs);
 	}
 
-	/** Aborts with a `TimeoutError` reason once the inactivity budget is exhausted. */
+	/** Aborts with a `TimeoutError` reason once the active timeout window is exhausted. */
 	get signal(): AbortSignal {
 		return this.#controller.signal;
 	}
 
-	/** Configured inactivity budget in milliseconds. */
+	/** Configured active timeout window in milliseconds. */
 	get idleMs(): number {
 		return this.#idleMs;
 	}
 
-	/** Record activity, pushing the inactivity deadline forward by `idleMs`. */
+	/** Record runtime activity, pushing the active deadline forward by `idleMs`. */
 	bump(): void {
+		if (this.#settled || this.#pauseDepth > 0) return;
+		this.#deadlineMs = Date.now() + this.#idleMs;
+	}
+	/** Suspend timeout accounting while control is delegated to host-side work. */
+	pause(): void {
 		if (this.#settled) return;
+		this.#pauseDepth++;
+		if (this.#pauseDepth !== 1) return;
+		if (this.#timer) {
+			clearTimeout(this.#timer);
+			this.#timer = undefined;
+		}
+	}
+
+	/** Resume timeout accounting with a fresh timeout window. */
+	resume(): void {
+		if (this.#settled || this.#pauseDepth === 0) return;
+		this.#pauseDepth--;
+		if (this.#pauseDepth > 0) return;
 		this.#deadlineMs = Date.now() + this.#idleMs;
+		this.#arm(this.#idleMs);
 	}
 
 	/** Stop the watchdog. Safe to call multiple times. */
@@ -65,7 +83,7 @@ export class IdleTimeout {
 	}
 
 	#onExpire(): void {
-		if (this.#settled) return;
+		if (this.#settled || this.#pauseDepth > 0) return;
 		const remainingMs = this.#deadlineMs - Date.now();
 		if (remainingMs > 0) {
 			// A bump moved the deadline forward after this timer was armed; wait

package/src/eval/js/executor.ts

@@ -1,7 +1,7 @@
 import { DEFAULT_MAX_BYTES, OutputSink } from "../../session/streaming-output";
 import type { ToolSession } from "../../tools";
 import { resolveOutputMaxColumns, resolveOutputSinkHeadBytes } from "../../tools/output-meta";
-import { EVAL_HEARTBEAT_OP } from "../heartbeat";
+import { isEvalTimeoutControlEvent } from "../bridge-timeout";
 import { executeInVmContext, type JsDisplayOutput } from "./context-manager";
 import type { JsStatusEvent } from "./shared/types";
 
@@ -10,9 +10,9 @@ export interface JsExecutorOptions {
 	timeoutMs?: number;
 	deadlineMs?: number;
 	/**
-	 * Inactivity budget (ms). Used for worker cold-start headroom and
-	 * timeout-annotation text when the caller drives cancellation via an
-	 * idle-aware `signal` instead of `deadlineMs`/`timeoutMs`. Never arms a timer.
+	 * Runtime-work budget (ms). Used for worker cold-start headroom and
+	 * timeout-annotation text when the caller drives cancellation via the eval
+	 * watchdog `signal` instead of `deadlineMs`/`timeoutMs`. Never arms a timer.
 	 */
 	idleTimeoutMs?: number;
 	onChunk?: (chunk: string) => Promise<void> | void;
@@ -85,9 +85,9 @@ export async function executeJs(code: string, options: JsExecutorOptions): Promi
 		options.signal && timeoutSignal
 			? AbortSignal.any([options.signal, timeoutSignal])
 			: (options.signal ?? timeoutSignal);
-	// The eval tool drives cancellation via an idle-aware `signal` and passes only
-	// an inactivity budget; use it solely as worker cold-start headroom and never
-	// derive a competing fixed timer from it.
+	// The eval tool drives cancellation via its own watchdog `signal` and passes
+	// only the runtime-work budget; use it solely as worker cold-start headroom
+	// and never derive a competing fixed timer from it.
 	const acquireBudgetMs = legacyTimeoutMs ?? options.idleTimeoutMs;
 
 	try {
@@ -105,10 +105,10 @@ export async function executeJs(code: string, options: JsExecutorOptions): Promi
 				onText: chunk => outputSink.push(chunk),
 				onDisplay: output => {
 					if (output.type === "status") {
-						// Heartbeats are pure idle-watchdog keepalives: forward them so
-						// the eval tool re-arms its timer, but never store or render them.
+						// Timeout-control events drive the eval watchdog only; never
+						// store or render them as cell output.
 						options.onStatus?.(output.event);
-						if (output.event.op === EVAL_HEARTBEAT_OP) return;
+						if (isEvalTimeoutControlEvent(output.event)) return;
 					}
 					displayOutputs.push(output);
 				},

package/src/eval/llm-bridge.ts

@@ -18,7 +18,7 @@ import { extractTextContent, extractToolCall, parseJsonPayload } from "../commit
 import { expandRoleAlias, formatModelString, resolveModelFromString } from "../config/model-resolver";
 import type { ToolSession } from "../tools";
 import { ToolError } from "../tools/tool-errors";
-import { withBridgeHeartbeat } from "./heartbeat";
+import { withBridgeTimeoutPause } from "./bridge-timeout";
 import type { JsStatusEvent } from "./js/shared/types";
 
 /** Synthetic bridge name reserved for the `llm()` helper across both runtimes. */
@@ -132,10 +132,9 @@ export async function runEvalLlm(args: unknown, options: EvalLlmBridgeOptions):
 
 	const telemetry = resolveTelemetry(options.session.getTelemetry?.(), options.session.getSessionId?.() ?? undefined);
 
-	// A oneshot completion emits no status until it returns, so pump a heartbeat
-	// while it runs to keep the eval idle watchdog armed across a slow (e.g.
-	// reasoning-tier) request that would otherwise look like a stalled cell.
-	const response = await withBridgeHeartbeat(options.emitStatus, () =>
+	// Suspend eval timeout accounting while the model request owns control. The
+	// timeout clock restarts once the bridge returns to the cell runtime.
+	const response = await withBridgeTimeoutPause(options.emitStatus, () =>
 		instrumentedCompleteSimple(
 			model,
 			{

package/src/eval/py/executor.ts

@@ -5,7 +5,7 @@ import { Settings } from "../../config/settings";
 import { OutputSink } from "../../session/streaming-output";
 import type { ToolSession } from "../../tools";
 import { resolveOutputMaxColumns, resolveOutputSinkHeadBytes } from "../../tools/output-meta";
-import { EVAL_HEARTBEAT_OP } from "../heartbeat";
+import { isEvalTimeoutControlEvent } from "../bridge-timeout";
 import type { JsStatusEvent } from "../js/shared/types";
 import {
 	checkPythonKernelAvailability,
@@ -27,8 +27,8 @@ export interface PythonExecutorOptions {
 	/** Absolute wall-clock deadline in milliseconds since epoch */
 	deadlineMs?: number;
 	/**
-	 * Inactivity budget (ms). Used only for timeout-annotation text when the
-	 * caller drives cancellation via an idle-aware `signal` instead of a
+	 * Runtime-work budget (ms). Used only for timeout-annotation text when the
+	 * caller drives cancellation via the eval watchdog `signal` instead of a
 	 * wall-clock `deadlineMs`/`timeoutMs`. Does not arm a timer.
 	 */
 	idleTimeoutMs?: number;
@@ -492,10 +492,10 @@ async function executeWithKernel(
 	// long-running bridge helpers (e.g. `agent()`) surface progress mid-cell.
 	const collectDisplay = (output: KernelDisplayOutput) => {
 		if (output.type === "status") {
-			// Heartbeats are pure idle-watchdog keepalives: forward them so the
-			// eval tool re-arms its timer, but never store or render them.
+			// Timeout-control events drive the eval watchdog only; never store or
+			// render them as cell output.
 			options?.onStatus?.(output.event);
-			if (output.event.op === EVAL_HEARTBEAT_OP) return;
+			if (isEvalTimeoutControlEvent(output.event)) return;
 		}
 		displayOutputs.push(output);
 	};

package/src/eval/py/kernel.ts

@@ -18,6 +18,7 @@ import { type KernelDisplayOutput, renderKernelDisplay } from "./display";
 import { PYTHON_PRELUDE } from "./prelude";
 import RUNNER_SCRIPT from "./runner.py" with { type: "text" };
 import { enumeratePythonRuntimes, filterEnv, type PythonRuntime, resolvePythonRuntime } from "./runtime";
+import { hostHasInheritableConsole, shouldHideKernelWindow } from "./spawn-options";
 
 export type { KernelDisplayOutput, PythonStatusEvent } from "./display";
 export { renderKernelDisplay } from "./display";
@@ -253,7 +254,16 @@ export class PythonKernel {
 			stdin: "pipe",
 			stdout: "pipe",
 			stderr: "pipe",
-			windowsHide: true,
+			// Detached from any inherited console only when the host itself
+			// has no console — kernel32!GetConsoleWindow() is authoritative
+			// (works even when every stdio stream is redirected), with a
+			// TTY-OR fallback when the FFI probe is unavailable. See #1960
+			// for the numpy/pandas LoadLibraryExW hang + SIGINT-recovery
+			// failure that motivates the predicate.
+			windowsHide: shouldHideKernelWindow({
+				platform: process.platform,
+				hostHasInheritableConsole: hostHasInheritableConsole(),
+			}),
 		});
 		kernel.#proc = proc;
 		kernel.#stdin = proc.stdin;

package/src/eval/py/spawn-options.ts

@@ -0,0 +1,126 @@
+/**
+ * Subprocess spawn-option helpers for the Python kernel.
+ *
+ * Pure helpers (`shouldHideKernelWindow`, `consoleAttachedViaTTY`) live here
+ * so they can be unit-tested without dragging in the kernel's runtime
+ * dependencies. The effectful `hostHasInheritableConsole` wraps a Win32 FFI
+ * probe with a TTY fallback and is the function `kernel.ts` actually calls.
+ */
+import { dlopen, FFIType } from "bun:ffi";
+
+/**
+ * Decide whether the long-lived Python kernel subprocess should be spawned
+ * with `windowsHide: true`.
+ *
+ * On Windows, Bun maps `windowsHide: true` to the `CREATE_NO_WINDOW` flag,
+ * which detaches the child from any inherited console. The Python kernel
+ * runs user code that imports NumPy/pandas; those native extensions
+ * (`numpy/_core/_multiarray_umath.pyd` + bundled OpenBLAS/SLEEF thread-pool
+ * init) can deadlock inside `LoadLibraryExW` when no console is attached,
+ * and a console-less child cannot receive SIGINT via
+ * `GenerateConsoleCtrlEvent` (the recovery path the host relies on). See
+ * issue #1960.
+ *
+ * So on Windows we hide only when the host itself has no console to share.
+ * In any launch where a console is attached — even one with every stdio
+ * stream redirected — the kernel inherits the parent's console, matching
+ * `python.exe` invoked from `cmd.exe`, which keeps native imports and
+ * SIGINT recovery working.
+ *
+ * Short-lived helper subprocesses elsewhere in the codebase (LSP probes,
+ * git, plugin installs) keep `windowsHide: true` because they don't load
+ * complex native modules and the brief console flash would be user-visible
+ * noise.
+ */
+export function shouldHideKernelWindow(opts: {
+	platform: NodeJS.Platform;
+	hostHasInheritableConsole: boolean;
+}): boolean {
+	if (opts.platform !== "win32") return false;
+	return !opts.hostHasInheritableConsole;
+}
+
+/**
+ * TTY-based fallback used when the Win32 console probe is unavailable.
+ *
+ * Returns `true` if any of stdin/stdout/stderr is currently a TTY. This
+ * correctly detects the common interactive launches and the partial-
+ * redirection cases (`omp -p > out.txt`, `< in.txt`, `2> err.log`) where at
+ * least one stream stays bound to the terminal. The all-stdio-redirected
+ * case (`< in > out 2> err` from a console) is the reason we prefer the
+ * Win32 probe over this fallback whenever possible.
+ */
+export function consoleAttachedViaTTY(opts: {
+	stdinIsTTY: boolean;
+	stdoutIsTTY: boolean;
+	stderrIsTTY: boolean;
+}): boolean {
+	return opts.stdinIsTTY || opts.stdoutIsTTY || opts.stderrIsTTY;
+}
+
+/**
+ * Probe `kernel32.dll!GetConsoleWindow()` to detect whether the current
+ * Windows process owns a console window.
+ *
+ * Returns `true` for a non-NULL HWND, `false` when NULL (no console — true
+ * service / `DETACHED_PROCESS` / GUI parent), and `null` when the probe
+ * itself fails (off-Windows, FFI disabled, or unexpected kernel32 layout).
+ * A `null` return means "don't trust me, use the TTY fallback".
+ *
+ * Cached on first call because in practice the console attachment of a
+ * long-lived OMP host never changes for the lifetime of the process, and
+ * we don't want to re-dlopen kernel32 on every kernel spawn.
+ */
+type ConsoleProbeResult = boolean | null;
+let cachedWindowsConsoleProbe: { value: ConsoleProbeResult } | undefined;
+
+function probeWindowsConsoleWindow(): ConsoleProbeResult {
+	if (cachedWindowsConsoleProbe) return cachedWindowsConsoleProbe.value;
+	let value: ConsoleProbeResult = null;
+	try {
+		const lib = dlopen("kernel32.dll", {
+			GetConsoleWindow: { args: [], returns: FFIType.ptr },
+		});
+		try {
+			const hwnd = lib.symbols.GetConsoleWindow();
+			// FFIType.ptr returns `Pointer | null`; a 0 pointer should also be
+			// treated as NULL defensively in case Bun ever returns 0n / 0.
+			value = hwnd !== null && hwnd !== 0;
+		} finally {
+			lib.close();
+		}
+	} catch {
+		value = null;
+	}
+	cachedWindowsConsoleProbe = { value };
+	return value;
+}
+
+/** Reset the cached Win32 probe result. Test-only; not part of the public surface. */
+export function __resetWindowsConsoleProbeCache(): void {
+	cachedWindowsConsoleProbe = undefined;
+}
+
+/**
+ * Whether the host process owns a console its children can inherit.
+ *
+ * - On Windows, the authoritative signal is `GetConsoleWindow()`. It returns
+ *   a non-NULL HWND whenever the process has a console attached, regardless
+ *   of how the standard streams are redirected — so an `omp -p ... < in.txt
+ *   > out.txt 2> err.log` launched from a real Windows Terminal session is
+ *   correctly classified as console-attached and the kernel keeps its
+ *   inheritable console.
+ * - On any other platform, or if the FFI probe fails, fall back to the
+ *   TTY-OR heuristic. That still catches the common interactive cases.
+ */
+export function hostHasInheritableConsole(): boolean {
+	if (process.platform === "win32") {
+		const native = probeWindowsConsoleWindow();
+		if (native !== null) return native;
+	}
+	return consoleAttachedViaTTY({
+		stdinIsTTY: !!process.stdin.isTTY,
+		stdoutIsTTY: !!process.stdout.isTTY,
+		stderrIsTTY: !!process.stderr.isTTY,
+	});
+}

package/src/export/ttsr.ts

@@ -294,6 +294,9 @@ export class TtsrManager {
 
 	/** Add a TTSR rule to be monitored. */
 	addRule(rule: Rule): boolean {
+		if (!this.#settings.enabled) {
+			return false;
+		}
 		if (this.#rules.has(rule.name)) {
 			return false;
 		}
@@ -357,6 +360,9 @@ export class TtsrManager {
 	}
 
 	#matchBuffer(buffer: string, context: TtsrMatchContext): Rule[] {
+		if (!this.#settings.enabled) {
+			return [];
+		}
 		const matches: Rule[] = [];
 		for (const [name, entry] of this.#rules) {
 			if (!this.#canTrigger(name)) {
@@ -433,6 +439,9 @@ export class TtsrManager {
 
 	/** Check if any TTSR rules are registered. */
 	hasRules(): boolean {
+		if (!this.#settings.enabled) {
+			return false;
+		}
 		return this.#rules.size > 0;
 	}
 

package/src/extensibility/extensions/runner.ts

@@ -354,6 +354,9 @@ export class ExtensionRunner {
 		"ctrl+o": true,
 		"ctrl+t": true,
 		"ctrl+g": true,
+		"alt+m": true,
+		// Default chord for `app.message.followUp` (Windows Terminal can't deliver Ctrl+Enter; #1903).
+		"ctrl+q": true,
 		"shift+tab": true,
 		"shift+ctrl+p": true,
 		"alt+enter": true,

package/src/extensibility/plugins/doctor.ts

@@ -25,7 +25,6 @@ export async function runDoctorChecks(): Promise<DoctorCheck[]> {
 	const apiKeys = [
 		{ name: "ANTHROPIC_API_KEY", description: "Anthropic API" },
 		{ name: "OPENAI_API_KEY", description: "OpenAI API" },
-		{ name: "PERPLEXITY_API_KEY", description: "Perplexity search" },
 		{ name: "EXA_API_KEY", description: "Exa search" },
 	];
 

package/src/extensibility/plugins/marketplace-auto-update.ts

@@ -0,0 +1,49 @@
+import { getProjectDir, logger } from "@oh-my-pi/pi-utils";
+
+type MarketplaceAutoUpdateMode = "off" | "notify" | "auto";
+
+interface MarketplaceAutoUpdateOptions {
+	autoUpdate: MarketplaceAutoUpdateMode;
+	resolveActiveProjectRegistryPath: (cwd: string) => Promise<string | null>;
+	clearPluginRootsCache: () => void;
+}
+
+export function scheduleMarketplaceAutoUpdate(options: MarketplaceAutoUpdateOptions): void {
+	if (options.autoUpdate === "off") {
+		return;
+	}
+
+	void runMarketplaceAutoUpdate(options);
+}
+
+async function runMarketplaceAutoUpdate(options: MarketplaceAutoUpdateOptions): Promise<void> {
+	try {
+		// Startup perf: marketplace manager pulls scraper/fetch/cache code; keep it out of the initial TUI graph.
+		const {
+			MarketplaceManager,
+			getInstalledPluginsRegistryPath,
+			getMarketplacesCacheDir,
+			getMarketplacesRegistryPath,
+			getPluginsCacheDir,
+		} = await import("./marketplace");
+		const mgr = new MarketplaceManager({
+			marketplacesRegistryPath: getMarketplacesRegistryPath(),
+			installedRegistryPath: getInstalledPluginsRegistryPath(),
+			projectInstalledRegistryPath: (await options.resolveActiveProjectRegistryPath(getProjectDir())) ?? undefined,
+			marketplacesCacheDir: getMarketplacesCacheDir(),
+			pluginsCacheDir: getPluginsCacheDir(),
+			clearPluginRootsCache: options.clearPluginRootsCache,
+		});
+		await mgr.refreshStaleMarketplaces();
+		const updates = await mgr.checkForUpdates();
+		if (updates.length === 0) return;
+		if (options.autoUpdate === "auto") {
+			await mgr.upgradeAllPlugins();
+			logger.debug(`Auto-upgraded ${updates.length} marketplace plugin(s)`);
+		} else {
+			logger.debug(`${updates.length} marketplace plugin update(s) available — /marketplace upgrade`);
+		}
+	} catch {
+		// Silently ignore — network failure, corrupt data, offline.
+	}
+}

package/src/goals/tools/goal-tool.ts

@@ -8,7 +8,7 @@ import type { Theme, ThemeColor } from "../../modes/theme/theme";
 import goalDescription from "../../prompts/tools/goal.md" with { type: "text" };
 import { formatDuration } from "../../slash-commands/helpers/format";
 import type { ToolSession } from "../../tools";
-import { formatErrorMessage, TRUNCATE_LENGTHS } from "../../tools/render-utils";
+import { formatErrorDetail, TRUNCATE_LENGTHS } from "../../tools/render-utils";
 import { ToolError } from "../../tools/tool-errors";
 import { renderStatusLine, truncateToWidth } from "../../tui";
 import { completionBudgetReport, remainingTokens } from "../runtime";
@@ -190,7 +190,7 @@ export const goalToolRenderer = {
 
 		if (result.isError) {
 			const header = renderStatusLine({ icon: "error", title: "Goal", description }, uiTheme);
-			const body = formatErrorMessage(fallbackText || "Goal tool failed", uiTheme);
+			const body = formatErrorDetail(fallbackText || "Goal tool failed", uiTheme);
 			return new Text([header, body].join("\n"), 0, 0);
 		}