@oh-my-pi/pi-coding-agent 16.1.9 → 16.1.11

package/src/utils/image-loading.ts

@@ -9,9 +9,10 @@ export const SUPPORTED_INPUT_IMAGE_MIME_TYPES = SUPPORTED_IMAGE_MIME_TYPES;
 
 /**
  * Ollama and its local-backend family decode image input through llama.cpp /
- * `stb_image`, which is compiled without WebP support, so a WebP upload fails
- * with an opaque HTTP 400. Detect those models so the resize pipeline encodes
- * to PNG/JPEG instead — the automatic equivalent of `OMP_NO_WEBP=1`.
+ * `stb_image`, which is compiled without WebP support. The first-party Codex
+ * Responses backend also rejects WebP `input_image.image_url` data URLs. Detect
+ * those models so the resize pipeline encodes to PNG/JPEG instead — the
+ * automatic equivalent of `OMP_NO_WEBP=1`.
  */
 export function modelLacksWebpSupport(
 	model: Pick<Model, "provider" | "api" | "imageInputDecoder"> | undefined,
@@ -19,6 +20,8 @@ export function modelLacksWebpSupport(
 	if (!model) return false;
 	return (
 		model.imageInputDecoder === "stb" ||
+		model.api === "openai-codex-responses" ||
+		model.provider === "openai-codex" ||
 		model.provider === "ollama" ||
 		model.provider === "ollama-cloud" ||
 		model.provider === "llama.cpp" ||

package/src/utils/jj.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { $which } from "@oh-my-pi/pi-utils";
 import { LRUCache } from "lru-cache/raw";
+import * as git from "./git";
 
 // ════════════════════════════════════════════════════════════════════════════
 // Types
@@ -246,3 +247,49 @@ export const repo = {
 		return (await repo.root(cwd)) !== null;
 	},
 };
+
+/**
+ * Detect a "pure" Jujutsu workspace — one where Git-mutating automation has
+ * no safe Git target. Invoking `git checkout -b`, `git worktree add`, or
+ * `git apply` against a pure jj workspace either fails outright (no `.git/`
+ * present) or mutates state that jj itself cannot reconcile.
+ *
+ * `cwd` is "pure jj" iff its nearest jj workspace ancestor is **closer than**
+ * its nearest Git checkout ancestor (or no Git checkout is present at all).
+ * Both lookups walk upward from `cwd`, so the deeper ancestor is the one the
+ * user is actually working inside.
+ *
+ * Returns:
+ * - `false` for plain Git checkouts (no jj metadata anywhere up the tree).
+ * - `false` for colocated jj-git workspaces — `jj git init --colocate` keeps
+ *   `.jj/` and `.git/` at the same root.
+ * - `false` when a nested Git checkout (e.g. a vendored repo or fixture)
+ *   lives **under** an outer jj workspace; Git automation targets the inner
+ *   repo and never touches the surrounding jj tree.
+ * - `true` when jj is the deeper ancestor — either a standalone pure jj
+ *   workspace, or a jj workspace nested under an unrelated outer Git
+ *   checkout, where Git automation against the outer root would silently
+ *   bypass jj.
+ * - `false` for directories backed by neither tool.
+ */
+export async function isPureJjRepo(cwd: string): Promise<boolean> {
+	const jjRoot = await repo.root(cwd);
+	if (jjRoot === null) return false;
+	const gitRoot = await git.repo.root(cwd);
+	if (gitRoot === null) return true;
+	return isStrictDescendant(path.resolve(jjRoot), path.resolve(gitRoot));
+}
+
+/**
+ * Return `true` when `child` is a strict descendant of `ancestor` (same path
+ * counts as `false`). Both arguments must already be resolved absolute paths.
+ */
+function isStrictDescendant(child: string, ancestor: string): boolean {
+	const rel = path.relative(ancestor, child);
+	if (rel === "" || rel === ".") return false;
+	if (rel.startsWith("..")) return false;
+	// `path.relative` returns an absolute path only when the two arguments
+	// live on different filesystem roots (Windows drives, UNC shares); not a
+	// real ancestor relationship.
+	return !path.isAbsolute(rel);
+}

package/src/utils/title-generator.ts

@@ -12,7 +12,7 @@ import type { Settings } from "../config/settings";
 import titleMarkerInstruction from "../prompts/system/title-marker-instruction.md" with { type: "text" };
 import titleSystemPrompt from "../prompts/system/title-system.md" with { type: "text" };
 import titleMarkerSystemPrompt from "../prompts/system/title-system-marker.md" with { type: "text" };
-import { ONLINE_TINY_TITLE_MODEL_KEY } from "../tiny/models";
+import { isTinyTitleLocalModelKey, ONLINE_TINY_TITLE_MODEL_KEY } from "../tiny/models";
 import { formatTitleUserMessage, isLowSignalTitleInput, normalizeGeneratedTitle } from "../tiny/text";
 import { tinyTitleClient } from "../tiny/title-client";
 
@@ -23,7 +23,6 @@ const TITLE_MARKER_INSTRUCTION = prompt.render(titleMarkerInstruction);
 const DEFAULT_TERMINAL_TITLE = "π";
 const TERMINAL_TITLE_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
 
-export const TITLE_LOCAL_FALLBACK_DELAY_MS = 10_000;
 const TITLE_MAX_TOKENS = 30;
 const REASONING_SAFE_MAX_TOKENS = 1024;
 const SET_TITLE_TOOL_NAME = "set_title";
@@ -81,78 +80,6 @@ function getTitleModel(registry: ModelRegistry, settings: Settings, currentModel
 	return undefined;
 }
 
-export async function raceFirstNonNull<T>(
-	primary: Promise<T | null>,
-	startFallback: () => Promise<T | null>,
-	delayMs: number = TITLE_LOCAL_FALLBACK_DELAY_MS,
-	onPrimaryWinAfterFallback?: () => void,
-): Promise<T | null> {
-	const { promise, resolve } = Promise.withResolvers<T | null>();
-	let resolved = false;
-	let primarySettled = false;
-	let fallbackStarted = false;
-	let fallbackSettled = false;
-
-	const resolveOnce = (value: T | null): void => {
-		if (resolved) return;
-		resolved = true;
-		resolve(value);
-	};
-	const maybeResolveNull = (): void => {
-		if (primarySettled && fallbackStarted && fallbackSettled) resolveOnce(null);
-	};
-	const startFallbackOnce = (): void => {
-		if (fallbackStarted || resolved) return;
-		fallbackStarted = true;
-		let fallback: Promise<T | null>;
-		try {
-			fallback = startFallback();
-		} catch {
-			fallbackSettled = true;
-			maybeResolveNull();
-			return;
-		}
-		void fallback.then(
-			value => {
-				fallbackSettled = true;
-				if (value !== null) resolveOnce(value);
-				else maybeResolveNull();
-			},
-			() => {
-				fallbackSettled = true;
-				maybeResolveNull();
-			},
-		);
-	};
-
-	const timer = setTimeout(startFallbackOnce, delayMs);
-	void primary.then(
-		value => {
-			primarySettled = true;
-			clearTimeout(timer);
-			if (value !== null) {
-				if (fallbackStarted) onPrimaryWinAfterFallback?.();
-				resolveOnce(value);
-				return;
-			}
-			startFallbackOnce();
-			maybeResolveNull();
-		},
-		() => {
-			primarySettled = true;
-			clearTimeout(timer);
-			startFallbackOnce();
-			maybeResolveNull();
-		},
-	);
-
-	try {
-		return await promise;
-	} finally {
-		clearTimeout(timer);
-	}
-}
-
 /**
  * Generate a title for a session based on the first user message.
  *
@@ -200,36 +127,41 @@ export async function generateSessionTitle(
 		);
 	}
 
-	const onlineAbortController = new AbortController();
-	const localTitlePromise = titleSystemPrompt
-		? tinyTitleClient.generate(tinyModel, firstMessage, { systemPrompt: titleSystemPrompt })
-		: tinyTitleClient.generate(tinyModel, firstMessage);
-	const localTitle = localTitlePromise.then(
-		title => title || null,
-		err => {
-			logger.warn("title-generator: local model error", {
+	// User explicitly picked a local tiny model. NEVER fall back to the online
+	// smol path (issue #3187): the smol role resolves through priority.json and
+	// silently bills whatever provider holds the resolved API key — OpenRouter
+	// in the reporter's case, leaking real credits without consent. If the
+	// local worker fails (unknown key, download missing, transformers.js
+	// crash, abort), leave the session untitled; the next user turn retries.
+	if (!isTinyTitleLocalModelKey(tinyModel)) {
+		logger.warn("title-generator: unknown local tiny model; skipping title (will not fall back to online)", {
+			sessionId,
+			model: tinyModel,
+			reason: "unknown-local-model",
+		});
+		return null;
+	}
+	try {
+		const localTitle = titleSystemPrompt
+			? await tinyTitleClient.generate(tinyModel, firstMessage, { systemPrompt: titleSystemPrompt })
+			: await tinyTitleClient.generate(tinyModel, firstMessage);
+		if (!localTitle) {
+			logger.warn("title-generator: local tiny model produced no title; skipping (no online fallback)", {
 				sessionId,
 				model: tinyModel,
-				error: err instanceof Error ? err.message : String(err),
+				reason: "local-no-output",
 			});
 			return null;
-		},
-	);
-	const startOnline = (): Promise<string | null> =>
-		generateTitleOnline(
-			firstMessage,
-			registry,
-			settings,
+		}
+		return localTitle;
+	} catch (err) {
+		logger.warn("title-generator: local tiny model errored; skipping (no online fallback)", {
 			sessionId,
-			currentModel,
-			metadataResolver,
-			onlineAbortController.signal,
-			titleSystemPrompt,
-		);
-
-	return raceFirstNonNull(localTitle, startOnline, TITLE_LOCAL_FALLBACK_DELAY_MS, () => {
-		onlineAbortController.abort();
-	});
+			model: tinyModel,
+			error: err instanceof Error ? err.message : String(err),
+		});
+		return null;
+	}
 }
 
 export async function generateTitleOnline(