@oh-my-pi/pi-coding-agent 16.1.11 → 16.1.12

package/dist/types/export/share.d.ts

@@ -1,6 +1,6 @@
 import type { AgentState } from "@oh-my-pi/pi-agent-core";
 import { DEFAULT_SHARE_URL } from "@oh-my-pi/pi-wire";
-import type { SecretObfuscator } from "../secrets/obfuscator";
+import { type SecretObfuscator } from "../secrets/obfuscator";
 import type { SessionManager } from "../session/session-manager";
 import { type SessionData } from "./html";
 export { DEFAULT_SHARE_URL };
@@ -12,10 +12,15 @@ export interface ShareSessionOptions {
     /** Agent state for system prompt + tool descriptions in the snapshot. */
     state?: AgentState;
     /**
-     * Redacts the snapshot before sealing: deep-walks every string (entries,
-     * header, system prompt, tool descriptions) through the obfuscator, so
-     * secrets that landed in persisted entries (tool outputs reading .env,
-     * etc.) never leave the machine. Pass undefined to skip.
+     * Redacts the snapshot before sealing via a typed, per-field walk over the
+     * session (header title/cwd, system prompt, tool descriptions, entry summaries,
+     * labels, and message text — including tool-result output and `@file` mentions),
+     * so secrets that landed in persisted entries (tool outputs reading .env, etc.)
+     * never leave the machine. Inline image bytes are preserved (size-trimmed
+     * separately); opaque provider-replay blobs (`providerPayload`,
+     * `redactedThinking`, `compaction.preserveData`) and untyped extension payloads
+     * (`details`/`data`/`outputSchema`) are dropped rather than walked. Pass
+     * undefined to skip redaction entirely.
      */
     obfuscator?: SecretObfuscator;
 }

package/dist/types/secrets/index.d.ts

@@ -1,5 +1,5 @@
 import type { SecretEntry } from "./obfuscator";
-export { deobfuscateSessionContext, obfuscateMessages, obfuscateProviderContext, obfuscateProviderTools, type SecretEntry, SecretObfuscator, } from "./obfuscator";
+export { deobfuscateSessionContext, deobfuscateToolArguments, obfuscateMessages, obfuscateProviderContext, type SecretEntry, SecretObfuscator, } from "./obfuscator";
 /**
  * Load secrets from project-local and global secrets.yml files.
  * Project-local entries override global entries with matching content.

package/dist/types/secrets/obfuscator.d.ts

@@ -1,4 +1,5 @@
-import type { Context, Message, Tool } from "@oh-my-pi/pi-ai";
+import type { AgentMessage } from "@oh-my-pi/pi-agent-core";
+import type { AssistantMessage, Context, Message } from "@oh-my-pi/pi-ai";
 import type { SessionContext } from "../session/session-context";
 export interface SecretEntry {
     type: "plain" | "regex";
@@ -7,6 +8,12 @@ export interface SecretEntry {
     replacement?: string;
     flags?: string;
 }
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue | undefined;
+};
+export type JsonRecord = {
+    [key: string]: JsonValue | undefined;
+};
 export declare class SecretObfuscator {
     #private;
     constructor(entries: SecretEntry[]);
@@ -15,15 +22,42 @@ export declare class SecretObfuscator {
     obfuscate(text: string): string;
     /** Deobfuscate obfuscate-mode placeholders back to original secrets. Replace-mode is NOT reversed. */
     deobfuscate(text: string): string;
-    /** Deep-walk an object, deobfuscating all string values. */
-    deobfuscateObject<T>(obj: T): T;
-    /** Deep-walk an object, obfuscating all string values. */
-    obfuscateObject<T>(obj: T): T;
 }
+/**
+ * Restore secret placeholders for local display. Only message kinds the model
+ * itself authored from obfuscated context carry placeholders — assistant
+ * content and the LLM-written branch/compaction summaries. User, developer, and
+ * tool-result messages are persisted with their literal text, so a literal
+ * `#ABCD#` the operator typed must survive untouched; those roles are never
+ * walked.
+ */
 export declare function deobfuscateSessionContext(sessionContext: SessionContext, obfuscator: SecretObfuscator | undefined): SessionContext;
-/** Obfuscate all string content in LLM messages (for outbound interception). */
+export declare function deobfuscateAgentMessages(obfuscator: SecretObfuscator, messages: AgentMessage[]): AgentMessage[];
+/**
+ * Restore placeholders in assistant content: visible text, thinking text, and
+ * tool-call arguments/intent/rawBlock. Signatures and redacted-thinking bytes
+ * are opaque provider-replay data and pass through byte-identical.
+ */
+export declare function deobfuscateAssistantContent(obfuscator: SecretObfuscator, content: AssistantMessage["content"]): AssistantMessage["content"];
+/**
+ * Restore placeholders inside a tool call's arguments. Arguments are arbitrary
+ * model-authored JSON, so tool-call arguments are the ONLY place a recursive
+ * JSON walk runs.
+ */
+export declare function deobfuscateToolArguments(obfuscator: SecretObfuscator, args: Record<string, unknown>): Record<string, unknown>;
+/** Redact secrets inside a tool call's arguments (same JSON-walk exception as {@link deobfuscateToolArguments}). */
+export declare function obfuscateToolArguments(obfuscator: SecretObfuscator, args: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Redact secrets from outbound messages. Opt-in by origin: only user messages,
+ * tool results, and user-authored developer messages (e.g. `@file` mentions)
+ * can carry operator secrets. System prompts, tool schemas, and assistant
+ * output are author-controlled or model-generated and pass through untouched.
+ * Within a targeted message only `text` blocks are rewritten — inline image
+ * bytes are never walked.
+ */
 export declare function obfuscateMessages(obfuscator: SecretObfuscator, messages: Message[]): Message[];
-/** Obfuscate provider request context without walking live tool schema instances. */
+/**
+ * Redact outbound provider context. Only conversation messages are rewritten;
+ * the static system prompt and tool schemas pass through unchanged.
+ */
 export declare function obfuscateProviderContext(obfuscator: SecretObfuscator | undefined, context: Context): Context;
-/** Convert tool schemas to wire JSON Schema before obfuscating provider-visible strings. */
-export declare function obfuscateProviderTools(obfuscator: SecretObfuscator | undefined, tools: Tool[] | undefined): Tool[] | undefined;

package/dist/types/utils/image-loading.d.ts

@@ -4,10 +4,9 @@ export declare const MAX_IMAGE_INPUT_BYTES: number;
 export declare const SUPPORTED_INPUT_IMAGE_MIME_TYPES: Set<string>;
 /**
  * Ollama and its local-backend family decode image input through llama.cpp /
- * `stb_image`, which is compiled without WebP support. The first-party Codex
- * Responses backend also rejects WebP `input_image.image_url` data URLs. Detect
- * those models so the resize pipeline encodes to PNG/JPEG instead — the
- * automatic equivalent of `OMP_NO_WEBP=1`.
+ * `stb_image`, which is compiled without WebP support, so a WebP upload fails
+ * with an opaque HTTP 400. Detect those models so the resize pipeline encodes
+ * to PNG/JPEG instead — the automatic equivalent of `OMP_NO_WEBP=1`.
  */
 export declare function modelLacksWebpSupport(model: Pick<Model, "provider" | "api" | "imageInputDecoder"> | undefined): boolean;
 /**

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "16.1.11",
+	"version": "16.1.12",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -48,17 +48,17 @@
 		"@agentclientprotocol/sdk": "0.25.0",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "16.1.11",
-		"@oh-my-pi/omp-stats": "16.1.11",
-		"@oh-my-pi/pi-agent-core": "16.1.11",
-		"@oh-my-pi/pi-ai": "16.1.11",
-		"@oh-my-pi/pi-catalog": "16.1.11",
-		"@oh-my-pi/pi-mnemopi": "16.1.11",
-		"@oh-my-pi/pi-natives": "16.1.11",
-		"@oh-my-pi/pi-tui": "16.1.11",
-		"@oh-my-pi/pi-utils": "16.1.11",
-		"@oh-my-pi/pi-wire": "16.1.11",
-		"@oh-my-pi/snapcompact": "16.1.11",
+		"@oh-my-pi/hashline": "16.1.12",
+		"@oh-my-pi/omp-stats": "16.1.12",
+		"@oh-my-pi/pi-agent-core": "16.1.12",
+		"@oh-my-pi/pi-ai": "16.1.12",
+		"@oh-my-pi/pi-catalog": "16.1.12",
+		"@oh-my-pi/pi-mnemopi": "16.1.12",
+		"@oh-my-pi/pi-natives": "16.1.12",
+		"@oh-my-pi/pi-tui": "16.1.12",
+		"@oh-my-pi/pi-utils": "16.1.12",
+		"@oh-my-pi/pi-wire": "16.1.12",
+		"@oh-my-pi/snapcompact": "16.1.12",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/context-async-hooks": "^2.7.1",
 		"@opentelemetry/exporter-trace-otlp-proto": "^0.218.0",

package/src/export/share.ts

@@ -19,13 +19,16 @@
 import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
-import type { AgentState } from "@oh-my-pi/pi-agent-core";
+import type { AgentMessage, AgentState } from "@oh-my-pi/pi-agent-core";
+import type { AssistantMessage, ImageContent, TextContent } from "@oh-my-pi/pi-ai";
 import { $which, logger } from "@oh-my-pi/pi-utils";
 import { DEFAULT_SHARE_URL } from "@oh-my-pi/pi-wire";
 import { $ } from "bun";
-import type { SecretObfuscator } from "../secrets/obfuscator";
+import { obfuscateToolArguments, type SecretObfuscator } from "../secrets/obfuscator";
+import type { SessionEntry, SessionHeader } from "../session/session-entries";
 import type { SessionManager } from "../session/session-manager";
-import { buildSessionData, type SessionData } from "./html";
+import type { OutputMeta } from "../tools/output-meta";
+import { buildSessionData, type SessionData, type SubSession } from "./html";
 
 export { DEFAULT_SHARE_URL };
 
@@ -53,10 +56,15 @@ export interface ShareSessionOptions {
 	/** Agent state for system prompt + tool descriptions in the snapshot. */
 	state?: AgentState;
 	/**
-	 * Redacts the snapshot before sealing: deep-walks every string (entries,
-	 * header, system prompt, tool descriptions) through the obfuscator, so
-	 * secrets that landed in persisted entries (tool outputs reading .env,
-	 * etc.) never leave the machine. Pass undefined to skip.
+	 * Redacts the snapshot before sealing via a typed, per-field walk over the
+	 * session (header title/cwd, system prompt, tool descriptions, entry summaries,
+	 * labels, and message text — including tool-result output and `@file` mentions),
+	 * so secrets that landed in persisted entries (tool outputs reading .env, etc.)
+	 * never leave the machine. Inline image bytes are preserved (size-trimmed
+	 * separately); opaque provider-replay blobs (`providerPayload`,
+	 * `redactedThinking`, `compaction.preserveData`) and untyped extension payloads
+	 * (`details`/`data`/`outputSchema`) are dropped rather than walked. Pass
+	 * undefined to skip redaction entirely.
 	 */
 	obfuscator?: SecretObfuscator;
 }
@@ -75,7 +83,189 @@ export interface ShareSessionResult {
 /** Build the snapshot that gets sealed and uploaded, redacted when an obfuscator is provided. */
 export function buildShareSnapshot(sm: SessionManager, options?: ShareSessionOptions): SessionData {
 	const data = buildSessionData(sm, options?.state);
-	return options?.obfuscator?.hasSecrets() ? options.obfuscator.obfuscateObject(data) : data;
+	return options?.obfuscator?.hasSecrets() ? redactSessionDataForShare(options.obfuscator, data) : data;
+}
+
+/**
+ * Redact secrets from a share snapshot. A share blob leaves the machine, so
+ * every text-bearing field is rewritten through the obfuscator. The walk is
+ * typed end-to-end (no generic object traversal): inline image bytes are left
+ * intact (size-trimmed later by {@link stripImagePayloads}) and opaque,
+ * untyped payloads we cannot redact field-by-field (`compaction.preserveData`,
+ * extension `details`/`data`, `mode_change.data`, structured output schemas)
+ * are dropped so they cannot leak.
+ */
+function redactShareHeader(o: SecretObfuscator, header: SessionHeader | null): SessionHeader | null {
+	if (!header) return header;
+	return {
+		...header,
+		title: header.title === undefined ? undefined : o.obfuscate(header.title),
+		cwd: o.obfuscate(header.cwd),
+	};
+}
+
+function redactSessionDataForShare(o: SecretObfuscator, data: SessionData): SessionData {
+	return {
+		...data,
+		header: redactShareHeader(o, data.header),
+		systemPrompt: data.systemPrompt === undefined ? undefined : o.obfuscate(data.systemPrompt),
+		tools: data.tools?.map(tool => ({ ...tool, description: o.obfuscate(tool.description) })),
+		entries: data.entries.map(entry => redactShareEntry(o, entry)),
+		subSessions: data.subSessions
+			? Object.fromEntries(
+					Object.entries(data.subSessions).map(([key, sub]) => [key, redactShareSubSession(o, sub)]),
+				)
+			: data.subSessions,
+	};
+}
+
+function redactShareSubSession(o: SecretObfuscator, sub: SubSession): SubSession {
+	return {
+		...sub,
+		header: redactShareHeader(o, sub.header),
+		entries: sub.entries.map(entry => redactShareEntry(o, entry)),
+	};
+}
+
+function redactShareEntry(o: SecretObfuscator, entry: SessionEntry): SessionEntry {
+	switch (entry.type) {
+		case "message":
+			return { ...entry, message: redactShareMessage(o, entry.message) };
+		case "compaction":
+			return {
+				...entry,
+				summary: o.obfuscate(entry.summary),
+				shortSummary: entry.shortSummary === undefined ? undefined : o.obfuscate(entry.shortSummary),
+				details: undefined,
+				preserveData: undefined,
+			};
+		case "branch_summary":
+			return { ...entry, summary: o.obfuscate(entry.summary), details: undefined };
+		case "custom_message":
+			return { ...entry, content: redactShareContent(o, entry.content), details: undefined };
+		case "custom":
+			return { ...entry, data: undefined };
+		case "mode_change":
+			return { ...entry, data: undefined };
+		case "session_init":
+			return {
+				...entry,
+				systemPrompt: o.obfuscate(entry.systemPrompt),
+				task: o.obfuscate(entry.task),
+				outputSchema: undefined,
+			};
+		case "label":
+			return { ...entry, label: entry.label === undefined ? undefined : o.obfuscate(entry.label) };
+		default:
+			return entry;
+	}
+}
+
+function redactShareContent(
+	o: SecretObfuscator,
+	content: string | (TextContent | ImageContent)[],
+): string | (TextContent | ImageContent)[] {
+	if (typeof content === "string") return o.obfuscate(content);
+	return content.map(block => (block.type === "text" ? { ...block, text: o.obfuscate(block.text) } : block));
+}
+
+/** Redact freeform strings in tool output metadata (source path/URL, diagnostics); numeric truncation info is preserved. */
+function redactShareOutputMeta(o: SecretObfuscator, meta: OutputMeta | undefined): OutputMeta | undefined {
+	if (!meta) return meta;
+	return {
+		...meta,
+		source: meta.source ? { ...meta.source, value: o.obfuscate(meta.source.value) } : meta.source,
+		diagnostics: meta.diagnostics
+			? {
+					summary: o.obfuscate(meta.diagnostics.summary),
+					messages: meta.diagnostics.messages.map(message => o.obfuscate(message)),
+				}
+			: meta.diagnostics,
+	};
+}
+
+function redactShareMessage(o: SecretObfuscator, message: AgentMessage): AgentMessage {
+	switch (message.role) {
+		case "user":
+		case "developer":
+			return {
+				...message,
+				providerPayload: undefined,
+				content: redactShareContent(o, message.content),
+			} as AgentMessage;
+		case "custom":
+		case "hookMessage":
+			return { ...message, details: undefined, content: redactShareContent(o, message.content) } as AgentMessage;
+		case "toolResult":
+			return {
+				...message,
+				details: undefined,
+				content: redactShareContent(o, message.content) as (TextContent | ImageContent)[],
+			};
+		case "assistant":
+			// Drop opaque provider-replay state (encrypted reasoning / native history) the viewer
+			// never reads and we cannot redact field-by-field: `providerPayload` and any
+			// `redactedThinking` blocks.
+			return {
+				...message,
+				providerPayload: undefined,
+				errorMessage: message.errorMessage === undefined ? undefined : o.obfuscate(message.errorMessage),
+				content: message.content.flatMap((block): AssistantMessage["content"] => {
+					if (block.type === "redactedThinking") return [];
+					if (block.type === "text") return [{ ...block, text: o.obfuscate(block.text) }];
+					if (block.type === "thinking") return [{ ...block, thinking: o.obfuscate(block.thinking) }];
+					if (block.type === "toolCall") {
+						return [
+							{
+								...block,
+								arguments: obfuscateToolArguments(o, block.arguments),
+								intent: block.intent === undefined ? undefined : o.obfuscate(block.intent),
+								rawBlock: block.rawBlock === undefined ? undefined : o.obfuscate(block.rawBlock),
+							},
+						];
+					}
+					return [block];
+				}),
+			};
+		case "bashExecution":
+			return {
+				...message,
+				command: o.obfuscate(message.command),
+				output: o.obfuscate(message.output),
+				meta: redactShareOutputMeta(o, message.meta),
+			};
+		case "pythonExecution":
+			return {
+				...message,
+				code: o.obfuscate(message.code),
+				output: o.obfuscate(message.output),
+				meta: redactShareOutputMeta(o, message.meta),
+			};
+		case "branchSummary":
+			return { ...message, summary: o.obfuscate(message.summary) };
+		case "compactionSummary":
+			return {
+				...message,
+				providerPayload: undefined,
+				summary: o.obfuscate(message.summary),
+				shortSummary: message.shortSummary === undefined ? undefined : o.obfuscate(message.shortSummary),
+				blocks:
+					message.blocks === undefined
+						? undefined
+						: (redactShareContent(o, message.blocks) as (TextContent | ImageContent)[]),
+			};
+		case "fileMention":
+			return {
+				...message,
+				files: message.files.map(file => ({
+					...file,
+					path: o.obfuscate(file.path),
+					content: o.obfuscate(file.content),
+				})),
+			};
+		default:
+			return message;
+	}
 }
 
 /** Share the session; tries a secret gist first, then the share server. */

package/src/main.ts

@@ -149,8 +149,16 @@ const RPC_BACKGROUND_DEFAULTED_SETTING_PATHS: SettingPath[] = [
 	"bash.autoBackground.thresholdMs",
 ];
 
+// Protocol-mode hosts opt into a small set of paths whose host-default we
+// re-apply at startup so embedders inherit OMP's neutral defaults instead of
+// the local user's globally-persisted preferences for interactive use. The
+// guard preserves any explicit configuration — caller `Settings.isolated`
+// overrides, project `.claude/settings.yml`, `--config` overlays, or global
+// `config.yml` — so the host default only kicks in when nothing is set. Without
+// it the override clobbers every caller/host choice (#2598, #3207).
 function applyDefaultSettingOverrides(settingPaths: SettingPath[], targetSettings: Settings): void {
 	for (const settingPath of settingPaths) {
+		if (targetSettings.isConfigured(settingPath)) continue;
 		targetSettings.override(settingPath, getDefault(settingPath));
 	}
 }

package/src/sdk.ts

@@ -97,6 +97,7 @@ import { AgentRegistry, MAIN_AGENT_ID } from "./registry/agent-registry";
 import {
 	collectEnvSecrets,
 	deobfuscateSessionContext,
+	deobfuscateToolArguments,
 	loadSecrets,
 	obfuscateMessages,
 	obfuscateProviderContext,
@@ -2535,7 +2536,7 @@ export async function createAgentSession(options: CreateAgentSessionOptions = {}
 					result = { ...result, timeout: Math.min(result.timeout, maxTimeout) };
 				}
 				if (obfuscator?.hasSecrets()) {
-					result = obfuscator.deobfuscateObject(result);
+					result = deobfuscateToolArguments(obfuscator, result);
 				}
 				return result;
 			},

package/src/secrets/index.ts

@@ -6,9 +6,9 @@ import { compileSecretRegex } from "./regex";
 
 export {
 	deobfuscateSessionContext,
+	deobfuscateToolArguments,
 	obfuscateMessages,
 	obfuscateProviderContext,
-	obfuscateProviderTools,
 	type SecretEntry,
 	SecretObfuscator,
 } from "./obfuscator";