@oh-my-pi/pi-coding-agent 16.1.14 → 16.1.15

package/src/mcp/transports/stdio.ts

@@ -212,7 +212,18 @@ function buildCmdExeCommand(command: string, args: readonly string[]): string {
 	return `"${quotedCommand}"`;
 }
 
-/** Resolve the subprocess argv used to launch an MCP stdio server. */
+/**
+ * Resolve the subprocess argv used to launch an MCP stdio server.
+ *
+ * On Windows, our PATH/PATHEXT walk may return `null` for a bare command
+ * (e.g. `npx`) — `Bun.env.PATH` empty under a restricted parent process,
+ * UNC/network mounts that reject `fs.access`, locked-down shells. The
+ * legacy fallback handed `Bun.spawn` the bare name, but `CreateProcess`
+ * only appends `.exe` for extensionless names — `.cmd`/`.bat` are never
+ * tried, so `npx` (which exists only as `npx.cmd` on Windows) crashes the
+ * subprocess immediately. When the resolver can't pin the command down,
+ * route through `cmd.exe /d /s /c` so Windows's own PATHEXT lookup runs.
+ */
 export async function resolveStdioSpawnCommand(
 	config: MCPStdioServerConfig,
 	options: ResolveStdioSpawnOptions,
@@ -220,11 +231,16 @@ export async function resolveStdioSpawnCommand(
 	const args = config.args ?? [];
 	if (options.platform !== "win32") return { cmd: [config.command, ...args] };
 
-	const resolvedCommand =
-		(await resolveWindowsCommandPath(config.command, options.cwd, options.env)) ?? config.command;
+	const resolved = await resolveWindowsCommandPath(config.command, options.cwd, options.env);
+	const resolvedCommand = resolved ?? config.command;
 	const npmShimCommand = await resolveWindowsNpmShimCommand(resolvedCommand, args, options.cwd);
 	if (npmShimCommand) return npmShimCommand;
-	if (!isWindowsBatchCommand(resolvedCommand)) return { cmd: [resolvedCommand, ...args] };
+
+	// Direct-spawn only when we resolved to a concrete file AND its extension
+	// is not a batch script. Everything else (resolved .cmd/.bat, or an
+	// unresolved extensionless command) goes through cmd.exe so PATHEXT runs.
+	const needsCmdExe = resolved === null || isWindowsBatchCommand(resolvedCommand);
+	if (!needsCmdExe) return { cmd: [resolvedCommand, ...args] };
 
 	return {
 		cmd: [resolveComSpec(options.env), "/d", "/s", "/c", buildCmdExeCommand(resolvedCommand, args)],

package/src/modes/components/custom-editor.test.ts

@@ -3,6 +3,7 @@ import { $ } from "bun";
 import { getEditorTheme, initTheme } from "../theme/theme";
 import {
 	CustomEditor,
+	extractBracketedImagePastePaths,
 	SPACE_HOLD_MECHANICAL_RUN,
 	SPACE_HOLD_RELEASE_MS,
 	SPACE_REPEAT_MAX_GAP_MS,
@@ -21,6 +22,12 @@ function makeEditor() {
 const REPEAT_GAP_MS = 30;
 /** A gap above the threshold — looks like a deliberate keypress. */
 const TAP_GAP_MS = SPACE_REPEAT_MAX_GAP_MS + 80;
+const BRACKETED_PASTE_START = "\x1b[200~";
+const BRACKETED_PASTE_END = "\x1b[201~";
+
+function bracketedPaste(text: string): string {
+	return `${BRACKETED_PASTE_START}${text}${BRACKETED_PASTE_END}`;
+}
 
 /** Feed `count` spaces `gapMs` apart on the fake clock. The first space of a run has no prior
  *  space, so its gap is effectively infinite and it always reads as a deliberate tap. */
@@ -66,6 +73,21 @@ describe("CustomEditor placeholder decoration", () => {
 	});
 });
 
+describe("CustomEditor bracketed image-path paste", () => {
+	it("leaves a pasted bare .png filename on the normal text path", () => {
+		expect(extractBracketedImagePastePaths(bracketedPaste("icon-photo-default.png"))).toBeUndefined();
+	});
+
+	it("extracts explicit local image paths for attachment", () => {
+		expect(extractBracketedImagePastePaths(bracketedPaste("/tmp/icon-photo-default.png"))).toEqual([
+			"/tmp/icon-photo-default.png",
+		]);
+		expect(extractBracketedImagePastePaths(bracketedPaste("C:\\Users\\me\\icon-photo-default.png"))).toEqual([
+			"C:\\Users\\me\\icon-photo-default.png",
+		]);
+	});
+});
+
 describe("CustomEditor space-hold push-to-talk", () => {
 	beforeAll(async () => {
 		await initTheme();

package/src/modes/components/custom-editor.ts

@@ -64,6 +64,9 @@ const BRACKETED_PASTE_END = "\x1b[201~";
 const BRACKETED_IMAGE_PATH_REGEX = /\.(?:png|jpe?g|gif|webp)$/i;
 const BRACKETED_IMAGE_PATH_BOUNDARY_REGEX = /\.(?:png|jpe?g|gif|webp)(?=$|["']?\s)/gi;
 const SHELL_ESCAPED_PATH_CHAR_REGEX = /\\([\\\s'"()[\]{}&;<>|?*!$`])/g;
+const URI_SCHEME_REGEX = /^[a-z][a-z0-9+.-]*:/i;
+const FILE_URI_REGEX = /^file:\/\//i;
+const WINDOWS_DRIVE_PATH_REGEX = /^[a-z]:[\\/]/i;
 
 /** Max gap (ms) between two spaces for the later one to count as OS key auto-repeat rather than a
  *  deliberate press. OS auto-repeat is fast; a deliberate tap (even a fast one) is slower. */
@@ -118,6 +121,12 @@ function normalizePastedImagePath(path: string): string {
 	return unquoted.replace(SHELL_ESCAPED_PATH_CHAR_REGEX, "$1");
 }
 
+function isExplicitPastedImagePath(path: string): boolean {
+	if (WINDOWS_DRIVE_PATH_REGEX.test(path) || FILE_URI_REGEX.test(path)) return true;
+	if (URI_SCHEME_REGEX.test(path)) return false;
+	return path.includes("/") || path.includes("\\");
+}
+
 export function extractBracketedImagePastePaths(data: string): string[] | undefined {
 	if (!data.startsWith(BRACKETED_PASTE_START)) return undefined;
 	const endIndex = data.indexOf(BRACKETED_PASTE_END, BRACKETED_PASTE_START.length);
@@ -139,7 +148,7 @@ export function extractBracketedImagePastePaths(data: string): string[] | undefi
 		if (boundaryEnd === undefined) continue;
 
 		const path = normalizePastedImagePath(pasted.slice(segmentStart, boundaryEnd));
-		if (!path || !BRACKETED_IMAGE_PATH_REGEX.test(path)) return undefined;
+		if (!path || !BRACKETED_IMAGE_PATH_REGEX.test(path) || !isExplicitPastedImagePath(path)) return undefined;
 		paths.push(path);
 
 		segmentStart = boundaryEnd;

package/src/modes/components/footer.ts

@@ -142,7 +142,8 @@ export class FooterComponent implements Component {
 		// After compaction, tokens are unknown until the next LLM response.
 		const contextUsage = this.session.getContextUsage();
 		const contextWindow = contextUsage?.contextWindow ?? state.model?.contextWindow ?? 0;
-		const contextPercentValue = contextUsage?.percent ?? 0;
+		const contextTokens = contextUsage?.tokens ?? 0;
+		const contextPercentValue = contextWindow > 0 ? (contextUsage?.percent ?? 0) : null;
 
 		// Replace home directory with ~
 		let pwd = shortenPath(getProjectDir());
@@ -186,8 +187,8 @@ export class FooterComponent implements Component {
 		// Colorize context percentage based on usage
 		let contextPercentStr: string;
 		const autoIndicator = this.#autoCompactEnabled ? " (auto)" : "";
-		const contextPercentDisplay = `${formatContextUsage(contextPercentValue, contextWindow)}${autoIndicator}`;
-		if (contextUsage) {
+		const contextPercentDisplay = `${formatContextUsage(contextPercentValue, contextWindow, contextTokens)}${autoIndicator}`;
+		if (contextUsage && contextPercentValue !== null) {
 			const color = getContextUsageThemeColor(getContextUsageLevel(contextPercentValue, contextWindow));
 			contextPercentStr =
 				color === "statusLineContext" ? contextPercentDisplay : theme.fg(color, contextPercentDisplay);

package/src/modes/components/status-line/component.ts

@@ -727,10 +727,12 @@ export class StatusLineComponent implements Component {
 
 		let contextWindow = state.model?.contextWindow ?? this.session.model?.contextWindow ?? 0;
 		let contextPercent: number | null = 0;
+		let contextTokens = 0;
 		if (includeContext) {
 			const breakdown = this.getCachedContextBreakdown();
+			contextTokens = breakdown.usedTokens;
 			contextWindow = breakdown.contextWindow || contextWindow;
-			contextPercent = contextWindow > 0 ? (breakdown.usedTokens / contextWindow) * 100 : 0;
+			contextPercent = contextWindow > 0 ? (breakdown.usedTokens / contextWindow) * 100 : null;
 		}
 
 		// Collab guest: context comes from the host's state frames — the local
@@ -738,6 +740,7 @@ export class StatusLineComponent implements Component {
 		const collabState = this.#collabStatus?.stateOverride;
 		if (collabState?.contextUsage) {
 			contextWindow = collabState.contextUsage.contextWindow || contextWindow;
+			contextTokens = collabState.contextUsage.tokens ?? contextTokens;
 			contextPercent = collabState.contextUsage.percent ?? contextPercent;
 		}
 
@@ -756,6 +759,7 @@ export class StatusLineComponent implements Component {
 			collab: this.#collabStatus,
 			usageStats,
 			contextPercent,
+			contextTokens,
 			contextWindow,
 			autoCompactEnabled: this.#autoCompactEnabled,
 			subagentCount: this.#subagentCount,

package/src/modes/components/status-line/context-thresholds.ts

@@ -56,10 +56,18 @@ export function getContextUsageLevel(contextPercent: number, contextWindow: numb
 }
 
 /**
- * Format context usage as `<percent>%/<window>` (e.g. `5.1%/1M`), matching the
- * status line's context gauge so subagent and footer renderers stay in sync.
+ * Format context usage as `<percent>%/<window>` when the model window is known.
+ * Unknown windows render as `<tokens>/?`, because `0.0%/0` suggests a real
+ * empty context instead of missing provider metadata.
  */
-export function formatContextUsage(contextPercent: number | null | undefined, contextWindow: number): string {
+export function formatContextUsage(
+	contextPercent: number | null | undefined,
+	contextWindow: number,
+	usedTokens?: number,
+): string {
+	if (!Number.isFinite(contextWindow) || contextWindow <= 0) {
+		return `${formatNumber(usedTokens ?? 0)}/?`;
+	}
 	const pct = contextPercent === null || contextPercent === undefined ? "?" : `${contextPercent.toFixed(1)}%`;
 	return `${pct}/${formatNumber(contextWindow)}`;
 }

package/src/modes/components/status-line/segments.ts

@@ -375,7 +375,7 @@ const contextPctSegment: StatusLineSegment = {
 		const window = ctx.contextWindow;
 
 		const autoIcon = ctx.autoCompactEnabled && theme.icon.auto ? ` ${theme.icon.auto}` : "";
-		const text = `${formatContextUsage(pct, window)}${autoIcon}`;
+		const text = `${formatContextUsage(pct, window, ctx.contextTokens)}${autoIcon}`;
 
 		const color = getContextUsageThemeColor(getContextUsageLevel(pct ?? 0, window));
 		const content = withIcon(theme.icon.context, theme.fg(color, text));

package/src/modes/components/status-line/types.ts

@@ -73,6 +73,7 @@ export interface SegmentContext {
 	};
 	/** Context usage percent, or null when unknown (e.g. right after compaction). */
 	contextPercent: number | null;
+	contextTokens: number;
 	contextWindow: number;
 	autoCompactEnabled: boolean;
 	subagentCount: number;

package/src/modes/controllers/command-controller.ts

@@ -217,6 +217,7 @@ export class CommandController {
 		try {
 			const result = await shareSession(this.ctx.session.sessionManager, {
 				serverUrl: this.ctx.settings.get("share.serverUrl"),
+				store: this.ctx.settings.get("share.store"),
 				state: this.ctx.session.state,
 				obfuscator: this.ctx.settings.get("share.redactSecrets") ? this.ctx.session.obfuscator : undefined,
 			});

package/src/prompts/system/system-prompt.md

@@ -102,16 +102,16 @@ Use tools whenever they improve correctness, completeness, or grounding.
 {{#has tools "inspect_image"}}- Image tasks: prefer `{{toolRefs.inspect_image}}` over `{{toolRefs.read}}` to spare session context.{{/has}}
 
 # Specialized Tools
-Dedicated tools add gitignore semantics, structured output, and line anchors a raw shell command lacks — reach for them first when they fit:
+You MUST use the specialized tool over its shell equivalent:
 {{#has tools "read"}}- File or directory reads → `{{toolRefs.read}}` (a directory path lists entries).{{/has}}
 {{#has tools "edit"}}- Surgical edits → `{{toolRefs.edit}}`.{{/has}}
 {{#has tools "write"}}- Create or overwrite → `{{toolRefs.write}}`.{{/has}}
 {{#has tools "lsp"}}- Code intelligence → `{{toolRefs.lsp}}`.{{/has}}
-{{#has tools "search"}}- Regex search → `{{toolRefs.search}}`.{{/has}}
-{{#has tools "find"}}- Globbing → `{{toolRefs.find}}`.{{/has}}
+{{#has tools "search"}}- Regex search → `{{toolRefs.search}}`, not `grep`, `rg`, or `awk`.{{/has}}
+{{#has tools "find"}}- Globbing → `{{toolRefs.find}}`, not `ls **/*.ext` or `fd`.{{/has}}
 {{#has tools "eval"}}- Quick compute → `{{toolRefs.eval}}`; you SHOULD go step by step.{{/has}}
-{{#has tools "bash"}}- Use `{{toolRefs.bash}}` for terminal work—builds, tests, git, package managers—and pipelines that COMPUTE a fact: `wc -l`, `sort | uniq -c`, `comm`, `diff a b`, checksums.
-- Litmus: produces a count, frequency, set difference, or checksum no tool returns → bash. Otherwise a dedicated tool usually fits.{{/has}}
+{{#has tools "bash"}}- Use `{{toolRefs.bash}}` for terminal work—builds, tests, git, package managers—and pipelines that COMPUTE a fact: `wc -l`, `sort | uniq -c`, `comm`, `diff a b`, checksums. Commands shadowing the tools above are blocked.
+- Litmus: produces a count, frequency, set difference, or checksum no tool returns → bash. Merely moves, pages, or trims bytes a tool can fetch → use the tool.{{/has}}
 
 {{#has tools "report_tool_issue"}}
 <critical>

package/src/prompts/tools/bash.md

@@ -14,8 +14,8 @@ Runs bash in a shell session — terminal ops: git, bun, cargo, python.
 </instruction>
 
 <critical>
-- NEVER trim or silence output: no `| head -n N`, `| tail -n N`, `| less`, `2>&1`, `2>/dev/null`. stderr already merged; long output auto-truncated, FULL capture kept at `artifact://<id>`.
-- Pipelines that COMPUTE a new fact are correct bash: `wc -l`, `sort | uniq -c`, `comm`, `cut`, `diff a b`, `shasum`. Litmus: produces a count, frequency table, set difference, or checksum no tool returns → bash. Merely moves or trims bytes a tool can fetch → use the tool.
+- NEVER shell out to search content or files: `grep/rg` → `search`.
+- Avoid head/tail/redirections: stderr already merged; long output auto-truncated, FULL capture kept at `artifact://<id>`.
 </critical>
 
 <output>

package/src/prompts/tools/search.md

@@ -17,5 +17,6 @@ Searches files using regex.
 </output>
 
 <critical>
+- MUST use built-in `search` for any content search. NEVER shell out to `grep`, `rg`, `ripgrep`, `ag`, `ack`, `git grep`, `awk`, `sed`-for-search, or any CLI search via Bash — not even for one match or a quick check.
 - Open-ended search needing multiple rounds? MUST use the Task tool with the explore subagent, NOT chained `search` calls.
 </critical>

package/src/secrets/obfuscator.ts

@@ -259,9 +259,9 @@ export function deobfuscateAgentMessages(obfuscator: SecretObfuscator, messages:
 }
 
 /**
- * Restore placeholders in assistant content: visible text, thinking text, and
- * tool-call arguments/intent/rawBlock. Signatures and redacted-thinking bytes
- * are opaque provider-replay data and pass through byte-identical.
+ * Restore placeholders in assistant content: visible text and tool-call
+ * arguments/intent/rawBlock. Thinking and signatures are opaque
+ * provider-replay/hidden-reasoning data and pass through byte-identical.
  */
 export function deobfuscateAssistantContent(
 	obfuscator: SecretObfuscator,
@@ -276,12 +276,6 @@ export function deobfuscateAssistantContent(
 			changed = true;
 			return { ...block, text };
 		}
-		if (block.type === "thinking") {
-			const thinking = obfuscator.deobfuscate(block.thinking);
-			if (thinking === block.thinking) return block;
-			changed = true;
-			return { ...block, thinking };
-		}
 		if (block.type === "toolCall") {
 			const args = deobfuscateToolArguments(obfuscator, block.arguments);
 			const intent = block.intent === undefined ? undefined : obfuscator.deobfuscate(block.intent);

package/src/session/agent-session.ts

@@ -1936,6 +1936,7 @@ export class AgentSession {
 			snapshotMessages: () => this.agent.state.messages,
 			enqueueAdvice,
 			maintainContext: incomingTokens => this.#maintainAdvisorContext(incomingTokens),
+			obfuscator: this.#obfuscator,
 		});
 		if (seedToCurrent) {
 			this.#advisorRuntime.seedTo(this.agent.state.messages.length);
@@ -9026,6 +9027,21 @@ export class AgentSession {
 			providerKeys.add(`openai-responses:${nextModel.provider}`);
 		}
 
+		// `openai-completions` sessions are keyed `openai-completions:<provider>:<resolvedBaseUrl>:<modelId>`
+		// and cache backend-specific decisions (strict-tools disable scopes, reasoning-effort
+		// fallbacks). The resolved request base URL can differ from the catalog `model.baseUrl`
+		// (Moonshot env override, Alibaba Coding Plan enterprise URL, Azure deployment URL),
+		// so evict by provider prefix when the user moves away from that completions backend.
+		let completionsPrefixToEvict: string | undefined;
+		if (currentModel.api === "openai-completions") {
+			const currentScope = `${currentModel.provider}:${currentModel.baseUrl ?? ""}`;
+			const nextScope =
+				nextModel.api === "openai-completions" ? `${nextModel.provider}:${nextModel.baseUrl ?? ""}` : undefined;
+			if (currentScope !== nextScope) {
+				completionsPrefixToEvict = `openai-completions:${currentModel.provider}:`;
+			}
+		}
+
 		for (const providerKey of providerKeys) {
 			const state = this.#providerSessionState.get(providerKey);
 			if (!state) continue;
@@ -9041,6 +9057,21 @@ export class AgentSession {
 
 			this.#providerSessionState.delete(providerKey);
 		}
+
+		if (completionsPrefixToEvict !== undefined) {
+			for (const [key, state] of this.#providerSessionState) {
+				if (!key.startsWith(completionsPrefixToEvict)) continue;
+				try {
+					state.close();
+				} catch (error) {
+					logger.warn("Failed to close provider session state during model switch", {
+						providerKey: key,
+						error: String(error),
+					});
+				}
+				this.#providerSessionState.delete(key);
+			}
+		}
 	}
 
 	#normalizeProviderReplayValue(value: unknown): unknown {
@@ -12168,8 +12199,8 @@ export class AgentSession {
 		pendingMessages?: AgentMessage[];
 	}): ContextUsageBreakdown | undefined {
 		const model = this.model;
-		const contextWindow = options?.contextWindow ?? model?.contextWindow ?? 0;
-		if (!Number.isFinite(contextWindow) || contextWindow <= 0) return undefined;
+		const rawContextWindow = options?.contextWindow ?? model?.contextWindow ?? 0;
+		const contextWindow = Number.isFinite(rawContextWindow) && rawContextWindow > 0 ? rawContextWindow : 0;
 
 		const { skillsTokens, toolsTokens, systemContextTokens, systemPromptTokens } = computeNonMessageBreakdown(this);
 		const categoryNonMessageTokens = skillsTokens + toolsTokens + systemContextTokens + systemPromptTokens;

package/src/slash-commands/builtin-registry.ts

@@ -602,11 +602,12 @@ const BUILTIN_SLASH_COMMAND_REGISTRY: ReadonlyArray<SlashCommandSpec> = [
 	},
 	{
 		name: "share",
-		description: "Share session via an encrypted link (secret gist or share server)",
+		description: "Share session via an encrypted link (share server or secret gist)",
 		handle: async (_command, runtime) => {
 			try {
 				const result = await shareSession(runtime.sessionManager, {
 					serverUrl: runtime.settings.get("share.serverUrl"),
+					store: runtime.settings.get("share.store"),
 					state: runtime.session.state,
 					obfuscator: runtime.settings.get("share.redactSecrets") ? runtime.session.obfuscator : undefined,
 				});

package/src/utils/shell-snapshot.ts

@@ -8,11 +8,72 @@
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
-import { postmortem } from "@oh-my-pi/pi-utils";
+import { logger, postmortem } from "@oh-my-pi/pi-utils";
 
 const cachedSnapshotPaths = new Map<string, string>();
 const SNAPSHOT_TIMEOUT_MS = 2_000;
 
+/**
+ * Characters that force brush's primitive alias expander down a path it does
+ * not implement. brush-core resolves aliases via `value.split_ascii_whitespace()`
+ * (`crates/brush-core-vendored/src/interp.rs:1500`, tracking
+ * https://github.com/reubeno/brush/issues/57): the resulting pieces are dropped
+ * into argv verbatim instead of going through the shell parser. Any alias body
+ * containing subshells `(...)`, pipes `|`, redirections `<` `>`, separators
+ * `;` `&`, or command substitutions `` ` `` turns the first whitespace-split
+ * piece into the command name and produces `command not found: (alias;` style
+ * failures (issue #3234, Fedora's default `which` alias is the canonical case).
+ *
+ * Until brush implements proper alias parsing we drop these from the snapshot;
+ * brush then falls through to whatever lives on `PATH`, which is what the user
+ * actually expected when they invoked `which` / `ls` / etc.
+ */
+const BRUSH_INCOMPATIBLE_ALIAS_BODY = /[()|&;<>`]/;
+
+/** Matches `alias -- NAME='VALUE'` lines emitted by `generateSnapshotScript`. */
+const SNAPSHOT_ALIAS_LINE = /^alias -- ([^\s=]+)='(.*)'\s*$/;
+
+/**
+ * Strip alias definitions brush's whitespace-only expander cannot execute.
+ *
+ * Returns the rewritten snapshot plus the list of dropped alias names so the
+ * caller can surface them in the debug log.
+ */
+export function sanitizeSnapshotForBrush(content: string): { content: string; dropped: string[] } {
+	const dropped: string[] = [];
+	const lines = content.split("\n");
+	const out: string[] = [];
+	for (const line of lines) {
+		const m = line.match(SNAPSHOT_ALIAS_LINE);
+		if (m) {
+			// Decode the bash-quoting escape `'\''` → `'` so we test the real value.
+			const value = m[2].replace(/'\\''/g, "'");
+			if (BRUSH_INCOMPATIBLE_ALIAS_BODY.test(value)) {
+				dropped.push(m[1]);
+				continue;
+			}
+		}
+		out.push(line);
+	}
+	return { content: out.join("\n"), dropped };
+}
+
+/**
+ * Apply {@link sanitizeSnapshotForBrush} to the freshly generated snapshot
+ * file. Best-effort: I/O failures here must not poison `getOrCreateSnapshot`.
+ */
+function scrubSnapshotInPlace(snapshotPath: string): void {
+	try {
+		const raw = fs.readFileSync(snapshotPath, "utf8");
+		const { content, dropped } = sanitizeSnapshotForBrush(raw);
+		if (dropped.length === 0) return;
+		fs.writeFileSync(snapshotPath, content);
+		logger.debug("shell-snapshot: dropped brush-incompatible aliases", { dropped });
+	} catch (err) {
+		logger.debug("shell-snapshot: scrub failed", { err: String(err) });
+	}
+}
+
 function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<string, string | undefined> {
 	const sanitized = { ...env };
 	delete sanitized.BASH_ENV;
@@ -169,6 +230,7 @@ export async function getOrCreateSnapshot(
 
 		await child.exited;
 		if (child.exitCode === 0 && fs.existsSync(snapshotPath)) {
+			scrubSnapshotInPlace(snapshotPath);
 			cachedSnapshotPaths.set(cacheKey, snapshotPath);
 			return snapshotPath;
 		}

package/src/web/search/providers/perplexity.ts

@@ -833,16 +833,28 @@ export class PerplexityProvider extends SearchProvider {
 	readonly id = "perplexity";
 	readonly label = "Perplexity";
 
+	/**
+	 * Auto-chain admission. Requires a direct Perplexity credential
+	 * (`PERPLEXITY_COOKIES`, OAuth session, or `PERPLEXITY_API_KEY`).
+	 *
+	 * OpenRouter auth is intentionally NOT accepted here: silently using
+	 * OpenRouter's `perplexity/sonar-pro` whenever any OpenRouter key is
+	 * configured surprises users (and bills them) for a path they never
+	 * asked for. The auto chain skips Perplexity in that case and falls
+	 * through to the next configured provider. Users who DO want the
+	 * OpenRouter-backed Perplexity path can still opt in by setting
+	 * `webSearch: perplexity` explicitly — see {@link isExplicitlyAvailable}.
+	 */
 	isAvailable(authStorage: AuthStorage): boolean {
-		return (
-			!!$env.PERPLEXITY_COOKIES?.trim() || authStorage.hasAuth("perplexity") || authStorage.hasAuth("openrouter")
-		);
+		return !!$env.PERPLEXITY_COOKIES?.trim() || authStorage.hasAuth("perplexity");
 	}
 
 	/**
-	 * Perplexity accepts anonymous browser-style ask requests, but keep auto
-	 * provider selection credential-gated so a configured provider keeps priority
-	 * over the anonymous fallback.
+	 * Perplexity accepts anonymous browser-style ask requests, and the
+	 * OpenRouter-backed `perplexity/sonar-pro` path is opt-in through
+	 * explicit selection. Keep auto-chain admission credential-gated so a
+	 * configured provider keeps priority over the anonymous/OpenRouter
+	 * fallbacks.
 	 */
 	isExplicitlyAvailable(_authStorage: AuthStorage): boolean {
 		return true;