@oh-my-pi/pi-coding-agent 16.1.20 → 16.1.22

package/src/modes/controllers/mcp-command-controller.ts

@@ -496,6 +496,7 @@ export class MCPCommandController {
 
 						try {
 							const oauthResource = oauth.resource ?? finalConfig.url;
+							const oauthResourceIsFallback = !oauth.resource;
 							const oauthResult = await this.#handleOAuthFlow(
 								oauth.authorizationUrl,
 								oauth.tokenUrl,
@@ -509,11 +510,13 @@ export class MCPCommandController {
 									prompt: finalConfig.oauth?.prompt,
 									serverUrl: finalConfig.url,
 									resource: oauthResource,
+									stripSameOriginResource: oauthResourceIsFallback,
 								},
 							);
 							finalConfig = this.#persistOAuthResult(finalConfig, oauthResult, {
 								tokenUrl: oauth.tokenUrl,
 								resource: oauthResource,
+								stripSameOriginResource: oauthResourceIsFallback,
 								clientId: oauth.clientId,
 								userClientSecret: finalConfig.oauth?.clientSecret,
 							});
@@ -583,6 +586,7 @@ export class MCPCommandController {
 			prompt?: string;
 			serverUrl?: string;
 			resource?: string;
+			stripSameOriginResource?: boolean;
 		},
 	): Promise<OAuthFlowResult> {
 		const authStorage = this.ctx.session.modelRegistry.authStorage;
@@ -624,6 +628,7 @@ export class MCPCommandController {
 					callbackPort: opts?.callbackPort,
 					callbackPath: opts?.callbackPath,
 					resource: opts?.resource,
+					stripSameOriginResource: opts?.stripSameOriginResource,
 				},
 				{
 					onAuth: (info: { url: string; instructions?: string }) => {
@@ -711,6 +716,7 @@ export class MCPCommandController {
 				clientId: flow.resolvedClientId ?? resolvedClientId,
 				clientSecret: flow.registeredClientSecret ?? resolvedClientSecret,
 				resource: flow.resource,
+				authorizationUrl: flow.authorizationUrl,
 			};
 
 			await authStorage.set(credentialId, oauthCredential);
@@ -751,10 +757,17 @@ export class MCPCommandController {
 	#persistOAuthResult(
 		config: MCPServerConfig,
 		result: OAuthFlowResult,
-		opts: { tokenUrl: string; resource?: string; clientId?: string; userClientSecret?: string },
+		opts: {
+			tokenUrl: string;
+			resource?: string;
+			stripSameOriginResource?: boolean;
+			clientId?: string;
+			userClientSecret?: string;
+		},
 	): MCPServerConfig {
 		const clientId = result.clientId ?? opts.clientId ?? config.oauth?.clientId;
-		const resource = result.resource ?? opts.resource ?? config.auth?.resource;
+		const resource =
+			result.resource ?? (opts.stripSameOriginResource ? undefined : opts.resource) ?? config.auth?.resource;
 		return {
 			...config,
 			auth: {
@@ -1558,6 +1571,7 @@ export class MCPCommandController {
 			const currentAuthResource = currentAuth?.resource ? expandEnvVarsDeep(currentAuth.resource) : undefined;
 			const oauthResource =
 				oauth.resource ?? currentAuthResource ?? ("url" in runtimeBaseConfig ? runtimeBaseConfig.url : undefined);
+			const oauthResourceIsFallback = !oauth.resource && !currentAuthResource;
 
 			const oauthResult = await this.#handleOAuthFlow(
 				oauth.authorizationUrl,
@@ -1572,6 +1586,7 @@ export class MCPCommandController {
 					prompt: found.config.oauth?.prompt,
 					serverUrl,
 					resource: oauthResource,
+					stripSameOriginResource: oauthResourceIsFallback,
 				},
 			);
 
@@ -1592,6 +1607,7 @@ export class MCPCommandController {
 					clientId: oauth.clientId,
 					userClientSecret,
 					resource: oauthResource,
+					stripSameOriginResource: oauthResourceIsFallback,
 				});
 				await updateMCPServer(found.filePath, name, updated);
 			}

package/src/modes/utils/ui-helpers.ts

@@ -317,6 +317,24 @@ export class UiHelpers {
 			// updateResult armed.
 			previous.seal();
 		};
+		let todoSnapshot: ToolExecutionComponent | null = null;
+		const resolveTodoSnapshot = (nextToolName?: string) => {
+			const previous = todoSnapshot;
+			if (!previous) return;
+			if (!previous.isDisplaceableBlock()) {
+				todoSnapshot = null;
+				return;
+			}
+			if (previous.canBeDisplacedBy(nextToolName)) {
+				todoSnapshot = null;
+				this.ctx.chatContainer.removeChild(previous);
+				previous.seal();
+				return;
+			}
+			if (nextToolName !== undefined) return;
+			todoSnapshot = null;
+			previous.seal();
+		};
 		const messages = sessionContext.messages;
 		const count = messages.length;
 		for (let i = 0; i < count; i++) {
@@ -477,11 +495,22 @@ export class UiHelpers {
 						component.isDisplaceableBlock()
 					) {
 						waitingPoll = component;
+					} else if (
+						message.toolName === "todo" &&
+						component instanceof ToolExecutionComponent &&
+						component.canBeDisplacedBy("todo")
+					) {
+						// A successful todo result supersedes the prior live snapshot. Failed
+						// follow-ups return false from canBeDisplacedBy("todo"), so the
+						// last-good panel stays on screen.
+						resolveTodoSnapshot("todo");
+						todoSnapshot = component;
 					}
 				}
 			} else {
 				// A user prompt closes the displacement window, same as the live path.
 				if (message.role === "user") resolveWaitingPoll();
+				if (message.role === "user") resolveTodoSnapshot();
 				// All other messages use standard rendering
 				this.ctx.addMessageToChat(message, options);
 			}
@@ -495,6 +524,17 @@ export class UiHelpers {
 		// A trailing waiting poll is final history on rebuild; seal it so it
 		// freezes (and its spinner timer stops) like every other block.
 		resolveWaitingPoll();
+		// A trailing todo snapshot is live state, not history: when the rebuild
+		// runs mid-turn (settings overlay close, focus attach during streaming),
+		// hand it back to the controller so a follow-up `todo` update keeps
+		// displacing instead of stacking. Idle rebuilds (resume / compaction)
+		// fall through to the seal path so the snapshot freezes as history.
+		if (todoSnapshot && this.ctx.session?.isStreaming) {
+			this.ctx.eventController?.inheritDisplaceableTodo(todoSnapshot);
+			todoSnapshot = null;
+		} else {
+			resolveTodoSnapshot();
+		}
 
 		this.ctx.pendingTools.clear();
 		this.ctx.ui.requestRender();

package/src/prompts/system/autolearn-nudge-autocontinue.md

@@ -0,0 +1,5 @@
+Automated capture turn — not a user reply. The user has not yet responded to your previous turn. Do not treat this prompt as their answer, as approval to continue, or as acceptance of any pending action; only the user can do that.
+
+If your previous turn produced anything reusable, capture it now: a repeatable procedure becomes a managed skill (`manage_skill`); a durable fact, convention, or user preference is worth remembering (`learn`, when memory is enabled). Only capture what will genuinely help next time. If nothing is worth keeping, do nothing.
+
+Then stop. Do not run any other tools, do not resume prior work, do not answer your own pending questions, and do not produce a continuation reply. Yield and wait for the user's next prompt.

package/src/prompts/system/autolearn-nudge.md

@@ -1,3 +1,5 @@
-Before you finish: if this turn produced anything reusable, capture it now with your learning tools — a repeatable procedure becomes a managed skill (`manage_skill`), and a durable fact or convention is worth remembering (`learn`, when memory is enabled).
+Hidden auto-learn reminder (not a user request). If your previous turn produced anything reusable, capture it now with your learning tools — a repeatable procedure becomes a managed skill (`manage_skill`), and a durable fact, convention, or user preference is worth remembering (`learn`, when memory is enabled).
 
-Only capture what will genuinely help next time. If nothing this turn is worth keeping, do nothing.
+Only capture what will genuinely help next time. If nothing is worth keeping, do nothing.
+
+This reminder is appended to the user's real message; answer that message normally — the capture is in addition to, not a replacement for, the work the user just asked for.

package/src/prompts/tools/todo.md

@@ -1,6 +1,6 @@
 **Tasks referenced by verbatim content string, NEVER an auto-generated ID — no "task-1"/"task-N" exists. Pass the content text in the `task` field.**
 
-Next pending task auto-promotes to `in_progress` on each completion.
+On each completion the earliest still-open task (in phase order) auto-promotes to `in_progress`. Completing tasks out of phase order can move this pointer **back** to an earlier phase — that is expected; completed tasks are never reverted.
 
 ## Operations
 

package/src/session/agent-session.ts

@@ -1164,6 +1164,7 @@ export class AgentSession {
 	#advisorEnabled = false;
 	/** The advisor's own agent, retained so `/dump advisor` can serialize its transcript. Undefined when no advisor is active. */
 	#advisorAgent?: Agent;
+	#advisorAdviseTool?: AdviseTool;
 	#advisorReadOnlyTools?: AgentTool[];
 	#advisorWatchdogPrompt?: string;
 	#advisorYieldQueueUnsubscribe?: () => void;
@@ -1798,6 +1799,7 @@ export class AgentSession {
 		this.#advisorAgentUnsubscribe?.();
 		this.#advisorAgentUnsubscribe = undefined;
 		this.#advisorRuntime?.reset();
+		this.#advisorAdviseTool?.resetDeliveredNotes();
 		this.#attachAdvisorRecorderFeed();
 		this.#advisorPrimaryTurnsCompleted = 0;
 		this.#advisorInterruptImmuneTurnStart = undefined;
@@ -1878,6 +1880,7 @@ export class AgentSession {
 		};
 
 		const adviseTool = new AdviseTool(enqueueAdvice);
+		this.#advisorAdviseTool = adviseTool;
 		const advisorReadOnlyTools = this.#advisorReadOnlyTools ?? [];
 
 		const appendOnlyContext = new AppendOnlyContextManager();
@@ -2004,6 +2007,7 @@ export class AgentSession {
 		if (this.#advisorAgent) {
 			this.#advisorAgent = undefined;
 		}
+		this.#advisorAdviseTool = undefined;
 		this.#advisorYieldQueueUnsubscribe?.();
 		this.#advisorYieldQueueUnsubscribe = undefined;
 	}

package/src/tools/todo.ts

@@ -534,21 +534,31 @@ function formatSummary(phases: TodoPhase[], errors: string[], readOnly = false):
 			lines.push(`  - ${task.content} [${task.status}] (${task.phase})`);
 		}
 	}
+	// Closed = completed + abandoned, mirroring the per-phase `done` count.
+	const closedAll = tasks.filter(task => task.status === "completed" || task.status === "abandoned").length;
+	// The active phase is the EARLIEST one still holding open work, so the
+	// in-progress pointer can sit in a phase whose successors already have
+	// completed tasks. Detect that "worked ahead" case to explain the
+	// otherwise-surprising backward pointer instead of letting it read as a
+	// completed task reverting to pending.
+	const workedAhead = phases.some(
+		(phase, idx) =>
+			idx > currentIdx && phase.tasks.some(task => task.status === "completed" || task.status === "abandoned"),
+	);
+	lines.push(`Overall: ${closedAll}/${tasks.length} done, ${remainingTasks.length} open.`);
 	lines.push(
-		`Phase ${currentIdx + 1}/${phases.length} "${current.name}" — ${done}/${current.tasks.length} tasks complete`,
+		`Active phase ${currentIdx + 1}/${phases.length} "${current.name}" (${done}/${current.tasks.length})${
+			workedAhead
+				? " — earliest phase with open tasks; the in-progress pointer auto-advances to the earliest open task on each completion, so it can sit behind out-of-order work (nothing was un-completed)."
+				: "."
+		}`,
 	);
 	for (const phase of phases) {
 		lines.push(`  ${phase.name}:`);
 		for (const task of phase.tasks) {
-			const sym =
-				task.status === "completed"
-					? "✓"
-					: task.status === "in_progress"
-						? "→"
-						: task.status === "abandoned"
-							? "✗"
-							: "○";
-			lines.push(`    ${sym} ${task.content}`);
+			const checkbox = task.status === "completed" ? "[X]" : "[ ]";
+			const tag = task.status === "in_progress" ? " (in progress)" : task.status === "abandoned" ? " (dropped)" : "";
+			lines.push(`    - ${checkbox} ${task.content}${tag}`);
 		}
 	}
 	return lines.join("\n");

package/src/utils/clipboard.ts

@@ -11,6 +11,63 @@ function isWsl(): boolean {
 	return process.platform === "linux" && Boolean(process.env.WSL_DISTRO_NAME || process.env.WSL_INTEROP);
 }
 
+// AppleScript that returns the POSIX paths of every file URL currently on the
+// macOS pasteboard, one path per line. `pbpaste(1)` only surfaces plain text,
+// EPS, or RTF, so a Finder `Cmd+C` (which puts only a `public.file-url`
+// representation on the pasteboard) makes `pbpaste` empty. AppleScript's
+// `«class furl»` coercion reaches the file-URL representation directly and
+// works for both single-file and multi-file selections. The `try` blocks
+// suppress the `-1700` "can't make … into type" error AppleScript raises when
+// the clipboard holds no file URLs, so the script's exit status only reflects
+// `osascript` itself.
+const MAC_FILE_URL_SCRIPT = [
+	"on run",
+	'\tset output to ""',
+	"\ttry",
+	"\t\tset theClip to the clipboard as «class furl»",
+	"\t\tif class of theClip is list then",
+	"\t\t\trepeat with anItem in theClip",
+	"\t\t\t\ttry",
+	"\t\t\t\t\tset output to output & POSIX path of anItem & linefeed",
+	"\t\t\t\tend try",
+	"\t\t\tend repeat",
+	"\t\telse",
+	"\t\t\ttry",
+	"\t\t\t\tset output to POSIX path of theClip & linefeed",
+	"\t\t\tend try",
+	"\t\tend if",
+	"\tend try",
+	"\treturn output",
+	"end run",
+].join("\n");
+
+/**
+ * Read file paths from the macOS pasteboard's `public.file-url` representation.
+ *
+ * Used to reach the Finder `Cmd+C` pasteboard (which exposes only file URLs,
+ * no plain text or raw image bytes) so an image-file clipboard can be attached
+ * via {@link handleImagePathPaste} instead of falling through to "Clipboard is
+ * empty". Returns an empty array on non-darwin platforms, when AppleScript is
+ * unavailable, or when the pasteboard holds no file URLs.
+ */
+export async function readMacFileUrlsFromClipboard(): Promise<string[]> {
+	if (process.platform !== "darwin") return [];
+	try {
+		const stdout = execSync("osascript -", {
+			input: MAC_FILE_URL_SCRIPT,
+			encoding: "utf8",
+			timeout: 2000,
+		}).toString();
+		return stdout
+			.split(/\r?\n/)
+			.map(line => line.trim())
+			.filter(line => line.length > 0);
+	} catch (error) {
+		logger.warn("clipboard: failed to read macOS file URLs", { error: String(error) });
+		return [];
+	}
+}
+
 /**
  * Copy text to the system clipboard.
  *