@oh-my-pi/pi-coding-agent 15.9.67 → 15.10.1

package/src/web/scrapers/github.ts

@@ -1,14 +1,28 @@
 import { $env, ptree } from "@oh-my-pi/pi-utils";
 import type { RenderResult, SpecialHandler } from "./types";
-import { buildResult, loadPage } from "./types";
+import { buildResult, formatMediaDuration, loadPage } from "./types";
 
 interface GitHubUrl {
-	type: "blob" | "tree" | "repo" | "issue" | "issues" | "pull" | "pulls" | "discussion" | "discussions" | "other";
+	type:
+		| "blob"
+		| "tree"
+		| "repo"
+		| "issue"
+		| "issues"
+		| "pull"
+		| "pulls"
+		| "discussion"
+		| "discussions"
+		| "actions-run"
+		| "actions-job"
+		| "other";
 	owner: string;
 	repo: string;
 	ref?: string;
 	path?: string;
 	number?: number;
+	runId?: number;
+	jobId?: number;
 }
 
 interface GitHubIssueComment {
@@ -20,7 +34,7 @@ interface GitHubIssueComment {
 /**
  * Parse GitHub URL into components
  */
-function parseGitHubUrl(url: string): GitHubUrl | null {
+export function parseGitHubUrl(url: string): GitHubUrl | null {
 	try {
 		const parsed = new URL(url);
 		if (parsed.hostname !== "github.com") return null;
@@ -54,6 +68,20 @@ function parseGitHubUrl(url: string): GitHubUrl | null {
 				return { type: "pulls", owner, repo };
 			case "pulls":
 				return { type: "pulls", owner, repo };
+			case "actions": {
+				// /actions/runs/{runId}                      → run summary + jobs
+				// /actions/runs/{runId}/job/{jobId}          → single job (web URL uses singular "job")
+				// /actions/runs/{runId}/jobs/{jobId}         → single job (API-style plural)
+				if (subParts[0] === "runs" && /^\d+$/.test(subParts[1] ?? "")) {
+					const runId = parseInt(subParts[1], 10);
+					const seg = subParts[2];
+					if ((seg === "job" || seg === "jobs") && /^\d+$/.test(subParts[3] ?? "")) {
+						return { type: "actions-job", owner, repo, runId, jobId: parseInt(subParts[3], 10) };
+					}
+					return { type: "actions-run", owner, repo, runId };
+				}
+				return { type: "other", owner, repo };
+			}
 			case "discussions":
 				if (subParts.length > 0 && /^\d+$/.test(subParts[0])) {
 					return { type: "discussion", owner, repo, number: parseInt(subParts[0], 10) };
@@ -371,6 +399,212 @@ async function renderGitHubRepo(
 	return { content: md, ok: true };
 }
 
+interface GitHubActionsStep {
+	name: string;
+	status: string;
+	conclusion: string | null;
+	number: number;
+	started_at: string | null;
+	completed_at: string | null;
+}
+
+interface GitHubActionsJob {
+	id: number;
+	run_id: number;
+	name: string;
+	status: string;
+	conclusion: string | null;
+	started_at: string | null;
+	completed_at: string | null;
+	html_url: string | null;
+	steps?: GitHubActionsStep[];
+	runner_name?: string | null;
+	labels?: string[];
+	workflow_name?: string | null;
+	head_branch?: string | null;
+	head_sha?: string;
+}
+
+interface GitHubActionsRun {
+	id: number;
+	name?: string | null;
+	display_title?: string;
+	run_number: number;
+	run_attempt?: number;
+	event: string;
+	status: string;
+	conclusion: string | null;
+	head_branch?: string | null;
+	head_sha?: string;
+	html_url: string;
+	created_at: string;
+	updated_at: string;
+	run_started_at?: string;
+	actor?: { login: string };
+	triggering_actor?: { login: string };
+}
+
+/** Combine status + conclusion into a single label, e.g. `completed (failure)`. */
+function statusLabel(status: string, conclusion: string | null | undefined): string {
+	return conclusion ? `${status} (${conclusion})` : status;
+}
+
+/** Wall-clock duration between two ISO timestamps, formatted HH:MM:SS / MM:SS. Empty when unknown. */
+function actionDuration(start?: string | null, end?: string | null): string {
+	if (!start || !end) return "";
+	const ms = Date.parse(end) - Date.parse(start);
+	if (!Number.isFinite(ms) || ms < 0) return "";
+	return formatMediaDuration(Math.round(ms / 1000));
+}
+
+/** Escape `|` so step/job names can't break a markdown table row. */
+function escapeCell(text: string): string {
+	return text.replaceAll("|", "\\|");
+}
+
+/**
+ * Strip the per-line ISO-8601 timestamp prefix GitHub prepends to every job log line.
+ * Cuts ~28 bytes/line of noise while preserving the message text. Also drops the leading
+ * UTF-8 BOM GitHub puts at the start of the log file (otherwise the first line's timestamp
+ * survives because `^` no longer sits before a digit).
+ */
+export function stripActionsLogTimestamps(logs: string): string {
+	return logs.replace(/^\uFEFF/, "").replace(/^\d{4}-\d{2}-\d{2}T[\d:.]+Z /gm, "");
+}
+
+/** Render a job's steps as a markdown table. Empty string when there are no steps. */
+function renderActionsSteps(steps?: GitHubActionsStep[]): string {
+	if (!steps || steps.length === 0) return "";
+	let md = "| # | Step | Status | Conclusion | Duration |\n";
+	md += "|---|------|--------|------------|----------|\n";
+	for (const step of steps) {
+		const dur = actionDuration(step.started_at, step.completed_at) || "-";
+		md += `| ${step.number} | ${escapeCell(step.name)} | ${step.status} | ${step.conclusion ?? "-"} | ${dur} |\n`;
+	}
+	return `${md}\n`;
+}
+
+/** Run-level metadata lines shared by the run and job renderers. */
+function renderActionsRunMeta(run: GitHubActionsRun): string {
+	let md = `**Workflow:** ${run.name ?? "(unknown)"}\n`;
+	md += `**Run:** #${run.run_number}`;
+	if (run.run_attempt && run.run_attempt > 1) md += ` (attempt ${run.run_attempt})`;
+	md += ` · ${statusLabel(run.status, run.conclusion)}\n`;
+	if (run.head_branch) {
+		md += `**Branch:** ${run.head_branch}${run.head_sha ? ` @ ${run.head_sha.slice(0, 7)}` : ""}\n`;
+	}
+	const actor = run.triggering_actor?.login ?? run.actor?.login;
+	md += `**Event:** ${run.event}${actor ? ` · by @${actor}` : ""}\n`;
+	const started = run.run_started_at ?? run.created_at;
+	const dur = actionDuration(started, run.updated_at);
+	md += `Started: ${started}${dur ? ` · Duration: ${dur}` : ""}\n`;
+	md += `URL: ${run.html_url}\n`;
+	return md;
+}
+
+/** Fetch a job's plain-text logs. Returns null when unavailable (no token / expired / private). */
+async function fetchGitHubJobLogs(
+	owner: string,
+	repo: string,
+	jobId: number,
+	timeout: number,
+	signal?: AbortSignal,
+): Promise<string | null> {
+	const headers: Record<string, string> = {
+		Accept: "application/vnd.github+json",
+		"X-GitHub-Api-Version": "2022-11-28",
+	};
+	const token = $env.GITHUB_TOKEN || $env.GH_TOKEN;
+	if (token) headers.Authorization = `Bearer ${token}`;
+
+	// 302 → signed log URL on a different origin; fetch strips Authorization on the cross-origin hop.
+	const result = await loadPage(`https://api.github.com/repos/${owner}/${repo}/actions/jobs/${jobId}/logs`, {
+		timeout,
+		headers,
+		signal,
+	});
+	return result.ok && result.content ? result.content : null;
+}
+
+/**
+ * Render a workflow run: run metadata plus a per-job breakdown. Steps are listed for any job that
+ * did not succeed (the debugging-relevant ones); successful jobs collapse to a single line.
+ */
+async function renderGitHubActionsRun(
+	gh: GitHubUrl,
+	timeout: number,
+	signal?: AbortSignal,
+): Promise<{ content: string; ok: boolean }> {
+	const runResult = await fetchGitHubApi(`/repos/${gh.owner}/${gh.repo}/actions/runs/${gh.runId}`, timeout, signal);
+	if (!runResult.ok || !runResult.data) return { content: "", ok: false };
+
+	const run = runResult.data as GitHubActionsRun;
+	let md = `# ${run.display_title || run.name || `Run #${run.run_number}`}\n\n`;
+	md += renderActionsRunMeta(run);
+	md += `\n---\n\n`;
+
+	const jobsResult = await fetchGitHubApi(
+		`/repos/${gh.owner}/${gh.repo}/actions/runs/${gh.runId}/jobs?per_page=100`,
+		timeout,
+		signal,
+	);
+	if (jobsResult.ok && jobsResult.data) {
+		const jobs = (jobsResult.data as { jobs?: GitHubActionsJob[] }).jobs ?? [];
+		md += `## Jobs (${jobs.length})\n\n`;
+		for (const job of jobs) {
+			const dur = actionDuration(job.started_at, job.completed_at);
+			md += `### ${escapeCell(job.name)} — ${statusLabel(job.status, job.conclusion)}${dur ? ` (${dur})` : ""}\n\n`;
+			if (job.conclusion !== "success") {
+				md += renderActionsSteps(job.steps);
+			}
+		}
+	}
+
+	return { content: md, ok: true };
+}
+
+/**
+ * Render a single workflow job: run context, step table, and the full job logs.
+ */
+async function renderGitHubActionsJob(
+	gh: GitHubUrl,
+	timeout: number,
+	signal?: AbortSignal,
+): Promise<{ content: string; ok: boolean }> {
+	const jobResult = await fetchGitHubApi(`/repos/${gh.owner}/${gh.repo}/actions/jobs/${gh.jobId}`, timeout, signal);
+	if (!jobResult.ok || !jobResult.data) return { content: "", ok: false };
+
+	const job = jobResult.data as GitHubActionsJob;
+
+	// Best-effort run context for nicer headers; the job render stands on its own without it.
+	const runResult = await fetchGitHubApi(`/repos/${gh.owner}/${gh.repo}/actions/runs/${job.run_id}`, timeout, signal);
+	const run = runResult.ok && runResult.data ? (runResult.data as GitHubActionsRun) : null;
+
+	let md = `# ${escapeCell(job.name)}\n\n`;
+	if (run) {
+		md += renderActionsRunMeta(run);
+	} else if (job.workflow_name) {
+		md += `**Workflow:** ${job.workflow_name}\n`;
+		if (job.head_branch) md += `**Branch:** ${job.head_branch}\n`;
+	}
+	const dur = actionDuration(job.started_at, job.completed_at);
+	md += `**Job:** ${escapeCell(job.name)} · ${statusLabel(job.status, job.conclusion)}${dur ? ` · ${dur}` : ""}\n`;
+	if (job.runner_name) md += `**Runner:** ${job.runner_name}\n`;
+	if (job.html_url) md += `URL: ${job.html_url}\n`;
+	md += `\n---\n\n`;
+
+	const steps = renderActionsSteps(job.steps);
+	if (steps) md += `## Steps\n\n${steps}`;
+
+	const logs = await fetchGitHubJobLogs(gh.owner, gh.repo, job.id, timeout, signal);
+	md += `## Logs\n\n`;
+	md += logs
+		? stripActionsLogTimestamps(logs)
+		: "*Logs unavailable — requires a GITHUB_TOKEN/GH_TOKEN with read access, or the run's logs have expired.*\n";
+
+	return { content: md, ok: true };
+}
+
 /**
  * Handle GitHub URLs specially
  */
@@ -445,6 +679,24 @@ export const handleGitHub: SpecialHandler = async (
 			}
 			break;
 		}
+
+		case "actions-run": {
+			notes.push(`Fetched via GitHub API`);
+			const result = await renderGitHubActionsRun(gh, timeout, signal);
+			if (result.ok) {
+				return buildResult(result.content, { url, method: "github-actions-run", fetchedAt, notes });
+			}
+			break;
+		}
+
+		case "actions-job": {
+			notes.push(`Fetched via GitHub API`);
+			const result = await renderGitHubActionsJob(gh, timeout, signal);
+			if (result.ok) {
+				return buildResult(result.content, { url, method: "github-actions-job", fetchedAt, notes });
+			}
+			break;
+		}
 	}
 
 	// Fall back to null (let normal rendering handle it)

package/src/web/scrapers/youtube.ts

@@ -113,8 +113,9 @@ export const handleYouTube: SpecialHandler = async (
 	const notes: string[] = [];
 	const videoUrl = `https://www.youtube.com/watch?v=${yt.videoId}`;
 
-	// Prefer Parallel extract when credentials are available
-	if (settings.get("providers.parallelFetch") && findParallelApiKey(storage)) {
+	// Prefer Parallel extract when it sits in the reader chain and creds exist
+	const fetchPreference = settings.get("providers.fetch");
+	if ((fetchPreference === "auto" || fetchPreference === "parallel") && findParallelApiKey(storage)) {
 		try {
 			const parallelResult = await extractWithParallel(
 				[videoUrl],

package/src/web/search/providers/anthropic.ts

@@ -7,12 +7,14 @@
 import {
 	type AnthropicAuthConfig,
 	type AnthropicSystemBlock,
+	type ApiKey,
 	type AuthStorage,
 	buildAnthropicAuthConfig,
 	buildAnthropicSearchHeaders,
 	buildAnthropicSystemBlocks,
 	buildAnthropicUrl,
 	stripClaudeToolPrefix,
+	withAuth,
 } from "@oh-my-pi/pi-ai";
 import { $env } from "@oh-my-pi/pi-utils";
 import type {
@@ -247,18 +249,13 @@ export async function searchAnthropic(
 ): Promise<SearchResponse> {
 	const searchApiKey = $env.ANTHROPIC_SEARCH_API_KEY;
 	const searchBaseUrl = $env.ANTHROPIC_SEARCH_BASE_URL;
-	let auth: AnthropicAuthConfig | undefined;
+	const keyOrResolver: ApiKey | undefined = searchApiKey
+		? searchApiKey
+		: "authStorage" in params
+			? params.authStorage.resolver("anthropic", { sessionId: params.sessionId })
+			: undefined;
 
-	if (searchApiKey) {
-		auth = buildAnthropicAuthConfig(searchApiKey, searchBaseUrl);
-	} else if ("authStorage" in params) {
-		const apiKey = await params.authStorage.getApiKey("anthropic", params.sessionId, {
-			signal: params.signal,
-		});
-		if (apiKey) auth = buildAnthropicAuthConfig(apiKey, searchBaseUrl);
-	}
-
-	if (!auth) {
+	if (!keyOrResolver) {
 		throw new Error(
 			"No Anthropic credentials found. Set ANTHROPIC_SEARCH_API_KEY or ANTHROPIC_API_KEY, or configure Anthropic OAuth.",
 		);
@@ -267,14 +264,23 @@ export async function searchAnthropic(
 	const model = getModel();
 	const systemPrompt = "authStorage" in params ? params.systemPrompt : params.system_prompt;
 	const maxTokens = "authStorage" in params ? params.maxOutputTokens : params.max_tokens;
-	const response = await callSearch(
-		auth,
-		model,
-		params.query,
-		systemPrompt,
-		maxTokens,
-		params.temperature,
-		params.signal,
+	const response = await withAuth(
+		keyOrResolver,
+		key =>
+			callSearch(
+				buildAnthropicAuthConfig(key, searchBaseUrl),
+				model,
+				params.query,
+				systemPrompt,
+				maxTokens,
+				params.temperature,
+				params.signal,
+			),
+		{
+			signal: params.signal,
+			missingKeyMessage:
+				"No Anthropic credentials found. Set ANTHROPIC_SEARCH_API_KEY or ANTHROPIC_API_KEY, or configure Anthropic OAuth.",
+		},
 	);
 
 	const result = parseResponse(response);

package/src/web/search/providers/exa.ts

@@ -6,7 +6,7 @@
  * Requests per-result summaries via `contents.summary` and synthesizes
  * them into a combined `answer` string on the SearchResponse.
  */
-import { type AuthStorage, getEnvApiKey } from "@oh-my-pi/pi-ai";
+import { type ApiKey, type AuthStorage, getEnvApiKey, withAuth } from "@oh-my-pi/pi-ai";
 import { settings } from "../../../config/settings";
 import { callExaTool, findApiKey, isSearchResponse } from "../../../exa/mcp-client";
 
@@ -228,11 +228,19 @@ async function callExaMcpSearch(params: ExaSearchParams): Promise<ExaSearchRespo
 
 /** Execute Exa web search */
 export async function searchExa(params: ExaSearchParams): Promise<SearchResponse> {
+	// AuthStorage-backed key takes precedence (existing behavior); probe it once
+	// so the env-key and keyless-MCP fallbacks below stay intact, then drive the
+	// authStorage path through the central force-refresh/rotate retry policy.
 	const storedKey = params.authStorage
 		? await params.authStorage.getApiKey("exa", params.sessionId, { signal: params.signal })
 		: undefined;
-	const apiKey = storedKey ?? getEnvApiKey("exa");
-	const response = apiKey ? await callExaSearch(apiKey, params) : await callExaMcpSearch(params);
+	const keyOrResolver: ApiKey | undefined =
+		storedKey && params.authStorage
+			? params.authStorage.resolver("exa", { sessionId: params.sessionId })
+			: getEnvApiKey("exa");
+	const response = keyOrResolver
+		? await withAuth(keyOrResolver, key => callExaSearch(key, params), { signal: params.signal })
+		: await callExaMcpSearch(params);
 
 	// Convert to unified SearchResponse
 	const sources: SearchSource[] = [];

package/src/web/search/providers/kimi.ts

@@ -4,7 +4,7 @@
  * Uses Moonshot Kimi Code search API to retrieve web results.
  * Endpoint: POST https://api.kimi.com/coding/v1/search
  */
-import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { type ApiKey, type AuthStorage, withAuth } from "@oh-my-pi/pi-ai";
 import { $env } from "@oh-my-pi/pi-utils";
 
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
@@ -54,20 +54,26 @@ function resolveBaseUrl(): string {
 	return asTrimmed($env.MOONSHOT_SEARCH_BASE_URL) ?? asTrimmed($env.KIMI_SEARCH_BASE_URL) ?? KIMI_SEARCH_URL;
 }
 
-/** Find Kimi search credentials from environment or AuthStorage. */
-async function findApiKey(
+/**
+ * Resolve the Kimi search credential. Highest precedence is the static env key;
+ * otherwise an AuthStorage-backed resolver for whichever stored provider id
+ * holds a key (`moonshot` first, then `kimi-code`), so a stale token triggers
+ * the central force-refresh / sibling-rotate retry. Returns `undefined` when
+ * neither is configured.
+ */
+async function resolveKey(
 	authStorage: AuthStorage,
 	sessionId: string | undefined,
 	signal: AbortSignal | undefined,
-): Promise<string | null> {
+): Promise<ApiKey | undefined> {
 	const envKey = asTrimmed($env.MOONSHOT_SEARCH_API_KEY) ?? asTrimmed($env.KIMI_SEARCH_API_KEY);
 	if (envKey) return envKey;
 
-	return (
-		(await authStorage.getApiKey("moonshot", sessionId, { signal })) ??
-		(await authStorage.getApiKey("kimi-code", sessionId, { signal })) ??
-		null
-	);
+	for (const provider of ["moonshot", "kimi-code"] as const) {
+		const stored = await authStorage.getApiKey(provider, sessionId, { signal });
+		if (stored) return authStorage.resolver(provider, { sessionId });
+	}
+	return undefined;
 }
 
 async function callKimiSearch(
@@ -108,20 +114,25 @@ async function callKimiSearch(
 
 /** Execute Kimi web search. */
 export async function searchKimi(params: KimiSearchParams): Promise<SearchResponse> {
-	const apiKey = await findApiKey(params.authStorage, params.sessionId, params.signal);
-	if (!apiKey) {
+	const keyOrResolver = await resolveKey(params.authStorage, params.sessionId, params.signal);
+	if (!keyOrResolver) {
 		throw new Error(
 			"Kimi search credentials not found. Set MOONSHOT_SEARCH_API_KEY, KIMI_SEARCH_API_KEY, MOONSHOT_API_KEY, or login with 'omp /login moonshot'.",
 		);
 	}
 
 	const limit = clampNumResults(params.num_results, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
-	const { response, requestId } = await callKimiSearch(apiKey, {
-		query: params.query,
-		limit,
-		includeContent: params.include_content ?? false,
-		signal: params.signal,
-	});
+	const { response, requestId } = await withAuth(
+		keyOrResolver,
+		key =>
+			callKimiSearch(key, {
+				query: params.query,
+				limit,
+				includeContent: params.include_content ?? false,
+				signal: params.signal,
+			}),
+		{ signal: params.signal },
+	);
 	const sources: SearchSource[] = [];
 
 	for (const result of response.search_results ?? []) {

package/src/web/search/providers/parallel.ts

@@ -1,4 +1,4 @@
-import { type AuthStorage, getEnvApiKey } from "@oh-my-pi/pi-ai";
+import { type ApiKey, type AuthStorage, getEnvApiKey, withAuth } from "@oh-my-pi/pi-ai";
 import type { SearchResponse } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import { ParallelApiError, type ParallelSearchResult, type ParallelSearchSource } from "../../parallel";
@@ -123,30 +123,41 @@ async function searchWithAuthStorage(
 		);
 	}
 
-	const response = await fetch(PARALLEL_SEARCH_URL, {
-		method: "POST",
-		headers: {
-			Accept: "application/json",
-			"Content-Type": "application/json",
-			"x-api-key": apiKey,
-			"parallel-beta": PARALLEL_BETA_HEADER,
-		},
-		body: JSON.stringify({
-			objective,
-			search_queries: queries,
-			mode: "fast",
-			excerpts: {
-				max_chars_per_result: 10_000,
-			},
-		}),
-		signal: withHardTimeout(params.signal),
-	});
-	if (!response.ok) {
-		throw parseParallelErrorResponse(response.status, await response.text());
-	}
+	// Drive the (already-present) credential through the central force-refresh /
+	// sibling-rotate retry policy. The `ParallelApiError` thrown below carries a
+	// `statusCode`, which `withAuth`'s default classifier reads to detect a
+	// retryable 401 / usage-limit.
+	const keyOrResolver: ApiKey = authStorage.resolver("parallel", { sessionId });
+	return withAuth(
+		keyOrResolver,
+		async key => {
+			const response = await fetch(PARALLEL_SEARCH_URL, {
+				method: "POST",
+				headers: {
+					Accept: "application/json",
+					"Content-Type": "application/json",
+					"x-api-key": key,
+					"parallel-beta": PARALLEL_BETA_HEADER,
+				},
+				body: JSON.stringify({
+					objective,
+					search_queries: queries,
+					mode: "fast",
+					excerpts: {
+						max_chars_per_result: 10_000,
+					},
+				}),
+				signal: withHardTimeout(params.signal),
+			});
+			if (!response.ok) {
+				throw parseParallelErrorResponse(response.status, await response.text());
+			}
 
-	const payload: unknown = await response.json();
-	return parseSearchPayload(payload);
+			const payload: unknown = await response.json();
+			return parseSearchPayload(payload);
+		},
+		{ signal: params.signal },
+	);
 }
 
 export async function searchParallel(