@oh-my-pi/pi-coding-agent 16.2.11 → 16.2.13

package/src/eval/__tests__/agent-bridge.test.ts

@@ -196,15 +196,29 @@ describe("runEvalAgent", () => {
 		await expect(runEvalAgent({ prompt: "hello" }, { session: makeSession({ spawns: "" }) })).rejects.toThrow(
 			"spawns disabled",
 		);
-		await expect(runEvalAgent({ prompt: "hello" }, { session: makeSession({ spawns: "reviewer" }) })).rejects.toThrow(
-			"Allowed: reviewer",
-		);
+		await expect(
+			runEvalAgent({ prompt: "hello", agent: "task" }, { session: makeSession({ spawns: "reviewer" }) }),
+		).rejects.toThrow("Allowed: reviewer");
 		await expect(
 			runEvalAgent({ prompt: "hello" }, { session: makeSession({ depth: EVAL_AGENT_MAX_DEPTH }) }),
 		).rejects.toThrow("maximum depth");
 		expect(runSpy).not.toHaveBeenCalled();
 	});
 
+	it("defaults to the first allowed spawn under restricted eval policies", async () => {
+		mockAgents();
+		const runSpy = vi.spyOn(taskExecutor, "runSubprocess").mockImplementation(async options =>
+			singleResult(options, {
+				output: options.agent.name,
+			}),
+		);
+
+		const result = await runEvalAgent({ prompt: "hello" }, { session: makeSession({ spawns: "reviewer,task" }) });
+
+		expect(result.text).toBe("reviewer");
+		expect(runSpy.mock.calls[0]?.[0].agent.name).toBe("reviewer");
+	});
+
 	it("throws instead of spawning from plan mode", async () => {
 		mockAgents();
 		const runSpy = vi.spyOn(taskExecutor, "runSubprocess").mockImplementation(async options => singleResult(options));

package/src/eval/agent-bridge.ts

@@ -24,6 +24,7 @@ import {
 	runIsolatedSubprocess,
 } from "../task/isolation-runner";
 import { AgentOutputManager } from "../task/output-manager";
+import { resolveSpawnPolicy } from "../task/spawn-policy";
 import type { AgentDefinition, AgentProgress, SingleResult } from "../task/types";
 import { type NestedRepoPatch, parseIsolationMode } from "../task/worktree";
 import type { ToolSession } from "../tools";
@@ -39,7 +40,6 @@ export const EVAL_AGENT_BRIDGE_NAME = "__agent__";
 /** Hard recursion limit for eval-driven subagents. */
 export const EVAL_AGENT_MAX_DEPTH = 3;
 
-const DEFAULT_AGENT_TYPE = "task";
 const DEFAULT_AGENT_LABEL = "EvalAgent";
 
 const agentArgsSchema = type({
@@ -139,14 +139,12 @@ function assertDepthAllowed(session: ToolSession): void {
 }
 
 function assertSpawnAllowed(session: ToolSession, agentName: string): void {
-	const parentSpawns = session.getSessionSpawns() ?? "*";
-	if (parentSpawns === "*") return;
-	if (parentSpawns === "") {
-		throw new ToolError(`Cannot spawn '${agentName}'. Allowed: none (spawns disabled for this agent)`);
+	const spawnPolicy = resolveSpawnPolicy(session.getSessionSpawns());
+	if (!spawnPolicy.enabled) {
+		throw new ToolError(`Cannot spawn '${agentName}'. Allowed: ${spawnPolicy.allowedErrorText}`);
 	}
-	const allowedSpawns = parentSpawns.split(",").map(spawn => spawn.trim());
-	if (!allowedSpawns.includes(agentName)) {
-		throw new ToolError(`Cannot spawn '${agentName}'. Allowed: ${parentSpawns}`);
+	if (spawnPolicy.allowedAgents !== null && !spawnPolicy.allowedAgents.includes(agentName)) {
+		throw new ToolError(`Cannot spawn '${agentName}'. Allowed: ${spawnPolicy.allowedErrorText}`);
 	}
 }
 
@@ -283,7 +281,7 @@ function buildSubagentFailureMessage(agentName: string, result: SingleResult): s
  */
 export async function runEvalAgent(args: unknown, options: EvalAgentBridgeOptions): Promise<EvalAgentResult> {
 	const parsed = parseAgentArgs(args);
-	const agentName = parsed.agent ?? DEFAULT_AGENT_TYPE;
+	const agentName = parsed.agent ?? resolveSpawnPolicy(options.session.getSessionSpawns()).defaultAgent;
 	const structured = Object.hasOwn(parsed, "schema");
 
 	assertNotPlanMode(options.session);

package/src/eval/completion-bridge.ts

@@ -75,7 +75,7 @@ function resolveTierModel(tier: CompletionTier, session: ToolSession): Model<Api
 	const resolve = (pattern: string | undefined): Model<Api> | undefined => {
 		if (!pattern) return undefined;
 		const expanded = expandRoleAlias(pattern, session.settings);
-		return resolveModelFromString(expanded, available, matchPreferences, modelRegistry);
+		return resolveModelFromString(expanded, available, matchPreferences);
 	};
 
 	if (tier === "default") {

package/src/eval/py/__tests__/runner-shell-output.test.ts

@@ -0,0 +1,157 @@
+import { describe, expect, it } from "bun:test";
+import * as path from "node:path";
+
+interface RunnerFrame {
+	type?: string;
+	id?: string;
+	data?: string;
+	status?: string;
+}
+
+const pythonPath = Bun.env.PYTHON ?? "python3";
+const runnerPath = path.resolve(import.meta.dir, "..", "runner.py");
+const repoRoot = path.resolve(import.meta.dir, "../../../../../..");
+const encoder = new TextEncoder();
+
+function shellQuote(value: string): string {
+	return `'${value.replaceAll("'", `'"'"'`)}'`;
+}
+
+async function runCell(code: string): Promise<RunnerFrame[]> {
+	const proc = Bun.spawn([pythonPath, "-u", runnerPath], {
+		cwd: repoRoot,
+		stdin: "pipe",
+		stdout: "pipe",
+		stderr: "pipe",
+		env: {
+			...process.env,
+			PYTHONUNBUFFERED: "1",
+			PYTHONIOENCODING: "utf-8",
+		},
+	});
+	const stderr = new Response(proc.stderr).text();
+	const reader = proc.stdout.getReader();
+	const decoder = new TextDecoder();
+	let pending = "";
+	const frames: RunnerFrame[] = [];
+
+	async function readFrame(): Promise<RunnerFrame> {
+		while (true) {
+			const newline = pending.indexOf("\n");
+			if (newline >= 0) {
+				const line = pending.slice(0, newline);
+				pending = pending.slice(newline + 1);
+				return JSON.parse(line) as RunnerFrame;
+			}
+			const { value, done } = await reader.read();
+			if (done) {
+				throw new Error(`Python runner exited before done frame: ${await stderr}`);
+			}
+			pending += decoder.decode(value, { stream: true });
+		}
+	}
+
+	try {
+		proc.stdin.write(encoder.encode(`${JSON.stringify({ id: "r1", code })}\n`));
+		proc.stdin.flush();
+		while (true) {
+			const frame = await readFrame();
+			frames.push(frame);
+			if (frame.type === "done") break;
+		}
+		proc.stdin.write(encoder.encode(`${JSON.stringify({ type: "exit" })}\n`));
+		proc.stdin.end();
+		const exitCode = await proc.exited;
+		if (exitCode !== 0) {
+			throw new Error(`Python runner exited ${exitCode}: ${await stderr}`);
+		}
+		return frames;
+	} finally {
+		try {
+			reader.releaseLock();
+		} catch {
+			// Reader may already be released by stream closure.
+		}
+		try {
+			proc.kill("SIGKILL");
+		} catch {
+			// Process already exited.
+		}
+	}
+}
+
+describe("Python runner shell output streaming", () => {
+	it("streams !cmd output chunks before the child process exits", async () => {
+		const child = [
+			"import sys,time",
+			"sys.stdout.write('first\\n')",
+			"sys.stdout.flush()",
+			"time.sleep(0.2)",
+			"sys.stdout.write('second\\n')",
+			"sys.stdout.flush()",
+		].join(";");
+		const frames = await runCell(
+			[
+				`result = !${pythonPath} -c ${shellQuote(child)}`,
+				"print('return=' + str(result.returncode) + ' lines=' + repr(list(result)))",
+			].join("\n"),
+		);
+		const stdout = frames.filter(frame => frame.type === "stdout").map(frame => frame.data);
+
+		expect(stdout[0]).toBe("first\n");
+		expect(stdout.join("")).toContain("second\n");
+		expect(stdout.join("")).toContain("return=0 lines=['first', 'second']");
+	});
+
+	it("caps !cmd output and captured result by line count with a truncation notice", async () => {
+		const child = ["import sys", "sys.stdout.write(('x' + chr(10)) * 3100)", "sys.stdout.flush()"].join(";");
+		const frames = await runCell(
+			[
+				`result = !${pythonPath} -c ${shellQuote(child)}`,
+				"print('captured=' + str(len(result)) + ' return=' + str(result.returncode))",
+			].join("\n"),
+		);
+		const stdout = frames
+			.filter(frame => frame.type === "stdout")
+			.map(frame => frame.data)
+			.join("");
+
+		expect(stdout).toContain("[output truncated: shell helper exceeded");
+		expect(stdout).toContain("captured=3000 return=0");
+		expect(stdout).not.toContain("captured=3100");
+	});
+
+	it("caps newline-free !cmd output by bytes with a truncation notice", async () => {
+		const child = ["import sys", "sys.stdout.write('z' * (1024 * 1024 + 17))", "sys.stdout.flush()"].join(";");
+		const frames = await runCell(
+			[
+				`result = !${pythonPath} -c ${shellQuote(child)}`,
+				"print('capturedChars=' + str(len(result.n)) + ' return=' + str(result.returncode))",
+			].join("\n"),
+		);
+		const stdout = frames
+			.filter(frame => frame.type === "stdout")
+			.map(frame => frame.data)
+			.join("");
+
+		expect(stdout).toContain("[output truncated: shell helper exceeded");
+		expect(stdout).toContain("capturedChars=1048576 return=0");
+		expect(stdout).not.toContain("capturedChars=1048593");
+	});
+
+	it("streams newline-free %%bash output without waiting for EOF", async () => {
+		const child = [
+			"import sys,time",
+			"sys.stdout.write('first')",
+			"sys.stdout.flush()",
+			"time.sleep(0.2)",
+			"sys.stdout.write('second')",
+			"sys.stdout.flush()",
+		].join(";");
+		const frames = await runCell(`%%bash\n${pythonPath} -c ${shellQuote(child)}`);
+		const stdout = frames.filter(frame => frame.type === "stdout").map(frame => frame.data);
+
+		expect(stdout[0]).toBe("first");
+		expect(stdout.join("")).toBe("firstsecond");
+	});
+});

package/src/eval/py/runner.py

@@ -26,14 +26,16 @@ when installed.
 
 from __future__ import annotations
 
-import asyncio
 import ast
-import contextvars
+import asyncio
 import base64
 import builtins
+import codecs
+import contextvars
 import inspect
 import io
 import json
+import locale
 import os
 import re
 import runpy
@@ -45,7 +47,7 @@ import threading
 import time
 import traceback
 from pathlib import Path
-from typing import Any
+from typing import Any, Callable
 
 # ---------------------------------------------------------------------------
 # Frame writer
@@ -396,6 +398,158 @@ def _emit_status(op: str, **data: Any) -> None:
         return
     _emit({"type": "display", "id": rid, "bundle": bundle})
 
+_SHELL_READ_CHUNK_BYTES = 8192
+_SHELL_OUTPUT_MAX_BYTES = 1024 * 1024
+_SHELL_OUTPUT_MAX_LINES = 3000
+_SHELL_RESULT_CAPTURE_BYTES = _SHELL_OUTPUT_MAX_BYTES
+_PIP_LINE_SCAN_CHARS = 64 * 1024
+_SHELL_TRUNCATION_NOTICE = (
+    f"[output truncated: shell helper exceeded {_SHELL_OUTPUT_MAX_BYTES} bytes "
+    f"or {_SHELL_OUTPUT_MAX_LINES} lines; remaining output discarded]\n"
+)
+
+
+def _process_output_encoding() -> str:
+    return locale.getpreferredencoding(False) or "utf-8"
+
+
+def _process_output_decoder(encoding: str) -> codecs.IncrementalDecoder:
+    return codecs.getincrementaldecoder(encoding)(errors="strict")
+
+
+def _take_prefix_by_lines(text: str, max_lines: int) -> str:
+    if max_lines <= 0:
+        return ""
+    cursor = 0
+    for _ in range(max_lines):
+        newline = text.find("\n", cursor)
+        if newline < 0:
+            return text
+        cursor = newline + 1
+    return text[:cursor]
+
+
+def _take_prefix_by_encoded_bytes(text: str, max_bytes: int, encoding: str) -> str:
+    if max_bytes <= 0:
+        return ""
+    if len(text.encode(encoding, errors="strict")) <= max_bytes:
+        return text
+    lo = 0
+    hi = len(text)
+    while lo < hi:
+        mid = (lo + hi + 1) // 2
+        if len(text[:mid].encode(encoding, errors="strict")) <= max_bytes:
+            lo = mid
+        else:
+            hi = mid - 1
+    return text[:lo]
+
+
+class _ShellOutputLimiter:
+    def __init__(self, *, max_bytes: int, max_lines: int, encoding: str) -> None:
+        self._remaining_bytes = max_bytes
+        self._remaining_lines = max_lines
+        self._encoding = encoding
+        self._truncated = False
+        self._at_line_start = True
+
+    def write(self, text: str) -> None:
+        if not text or self._truncated:
+            return
+        limited = _take_prefix_by_lines(text, self._remaining_lines)
+        truncated = limited != text
+        byte_limited = _take_prefix_by_encoded_bytes(limited, self._remaining_bytes, self._encoding)
+        truncated = truncated or byte_limited != limited
+        if byte_limited:
+            sys.stdout.write(byte_limited)
+            sys.stdout.flush()
+            self._remaining_bytes -= len(byte_limited.encode(self._encoding, errors="strict"))
+            self._remaining_lines -= byte_limited.count("\n")
+            self._at_line_start = byte_limited.endswith("\n")
+        if truncated:
+            self._emit_truncation_notice()
+
+    def _emit_truncation_notice(self) -> None:
+        if self._truncated:
+            return
+        prefix = "" if self._at_line_start else "\n"
+        sys.stdout.write(prefix + _SHELL_TRUNCATION_NOTICE)
+        sys.stdout.flush()
+        self._truncated = True
+
+
+def _stream_process_output(proc: subprocess.Popen, on_text: Callable[[str], None] | None = None) -> None:
+    assert proc.stdout is not None
+    encoding = _process_output_encoding()
+    decoder = _process_output_decoder(encoding)
+    limiter = _ShellOutputLimiter(
+        max_bytes=_SHELL_OUTPUT_MAX_BYTES,
+        max_lines=_SHELL_OUTPUT_MAX_LINES,
+        encoding=encoding,
+    )
+    while True:
+        chunk = os.read(proc.stdout.fileno(), _SHELL_READ_CHUNK_BYTES)
+        if not chunk:
+            break
+        text = decoder.decode(chunk)
+        if text:
+            limiter.write(text)
+            if on_text is not None:
+                on_text(text)
+    tail = decoder.decode(b"", final=True)
+    if tail:
+        limiter.write(tail)
+        if on_text is not None:
+            on_text(tail)
+
+
+class _BoundedTextCapture:
+    def __init__(self, max_bytes: int, max_lines: int, encoding: str) -> None:
+        self._remaining_bytes = max_bytes
+        self._remaining_lines = max_lines
+        self._encoding = encoding
+        self._parts: list[str] = []
+
+    def add(self, text: str) -> None:
+        if self._remaining_bytes <= 0 or self._remaining_lines <= 0:
+            return
+        line_limited = _take_prefix_by_lines(text, self._remaining_lines)
+        part = _take_prefix_by_encoded_bytes(line_limited, self._remaining_bytes, self._encoding)
+        if not part:
+            return
+        self._parts.append(part)
+        self._remaining_bytes -= len(part.encode(self._encoding, errors="strict"))
+        self._remaining_lines -= part.count("\n")
+
+    def text(self) -> str:
+        return "".join(self._parts)
+
+
+class _BoundedLineScanner:
+    def __init__(self, max_chars: int, on_line: Callable[[str], None]) -> None:
+        self._max_chars = max_chars
+        self._on_line = on_line
+        self._partial = ""
+
+    def add(self, text: str) -> None:
+        data = self._partial + text
+        lines = data.splitlines(keepends=True)
+        if not lines:
+            return
+        if lines[-1].endswith(("\n", "\r")):
+            self._partial = ""
+        else:
+            self._partial = lines.pop()
+        for line in lines:
+            self._on_line(line)
+        if len(self._partial) > self._max_chars:
+            self._partial = self._partial[-self._max_chars :]
+
+    def finish(self) -> None:
+        if self._partial:
+            self._on_line(self._partial)
+            self._partial = ""
+
 
 @line_magic("pip")
 def _magic_pip(args: str) -> None:
@@ -405,19 +559,20 @@ def _magic_pip(args: str) -> None:
         cmd,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
-        text=True,
-        bufsize=1,
     )
     installed_packages: list[str] = []
-    assert proc.stdout is not None
-    for raw_line in proc.stdout:
-        sys.stdout.write(raw_line)
+
+    def scan_pip_line(raw_line: str) -> None:
         m = re.search(r"Successfully installed\s+(.+)$", raw_line)
         if m:
             for token in m.group(1).split():
                 # Token is name-version; drop the version suffix.
                 pkg = token.rsplit("-", 1)[0]
                 installed_packages.append(pkg.replace("_", "-"))
+
+    scanner = _BoundedLineScanner(_PIP_LINE_SCAN_CHARS, scan_pip_line)
+    _stream_process_output(proc, scanner.add)
+    scanner.finish()
     proc.wait()
     if installed_packages:
         import importlib
@@ -599,12 +754,8 @@ def _run_shell_body(body: str, *, shell_arg: str) -> int:
         [shell_arg, "-c", body],
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
-        text=True,
-        bufsize=1,
     )
-    assert proc.stdout is not None
-    for raw_line in proc.stdout:
-        sys.stdout.write(raw_line)
+    _stream_process_output(proc)
     proc.wait()
     return proc.returncode
 
@@ -640,16 +791,16 @@ class _ShellResult(list):
 
 
 def __omp_shell(cmd: str) -> _ShellResult:
-    proc = subprocess.run(
+    proc = subprocess.Popen(
         cmd,
         shell=True,
         stdout=subprocess.PIPE,
         stderr=subprocess.STDOUT,
-        text=True,
     )
-    if proc.stdout:
-        sys.stdout.write(proc.stdout)
-    lines = [line for line in (proc.stdout or "").splitlines()]
+    capture = _BoundedTextCapture(_SHELL_RESULT_CAPTURE_BYTES, _SHELL_OUTPUT_MAX_LINES, _process_output_encoding())
+    _stream_process_output(proc, capture.add)
+    proc.wait()
+    lines = [line for line in capture.text().splitlines()]
     return _ShellResult(lines, proc.returncode)
 
 

package/src/extensibility/extensions/model-api.ts

@@ -33,9 +33,7 @@ export function createExtensionModelQuery(
 			resolveModelRoleValue(spec, modelRegistry.getAvailable(), {
 				settings,
 				matchPreferences: getModelMatchPreferences(settings),
-				modelRegistry,
 			}).model,
-		family: (model: Model<Api>): string =>
-			modelFamilyToken(modelRegistry.getCanonicalId(model) ?? model.id) || model.provider.toLowerCase(),
+		family: (model: Model<Api>): string => modelFamilyToken(model.id) || model.provider.toLowerCase(),
 	};
 }

package/src/extensibility/extensions/runner.ts

@@ -98,6 +98,32 @@ function handlerTimeoutForEvent(eventType: string): number {
 
 const EXTENSION_HANDLER_TIMEOUT = Symbol("extensionHandlerTimeout");
 
+/**
+ * Race `work` against a `timeoutMs` budget, clearing the pending timer the
+ * instant the work settles.
+ *
+ * We deliberately avoid `Bun.sleep(timeoutMs).then(...)` here: that leaves an
+ * uncancellable timer registered with the event loop, so every successful
+ * handler race leaks a timer that keeps the process alive until the deadline
+ * fires — up to the default 30s cap, which stalls non-interactive CLI exit
+ * after any subscribed `tool_call`/`tool_result` handler runs (issue #3948
+ * review, `chatgpt-codex-connector[bot]`). `setTimeout` returns a handle we
+ * can `clearTimeout` on the winning branch.
+ */
+async function raceHandlerWithTimeout<T>(
+	work: Promise<T>,
+	timeoutMs: number,
+): Promise<T | typeof EXTENSION_HANDLER_TIMEOUT> {
+	const { promise: timeoutPromise, resolve: resolveTimeout } =
+		Promise.withResolvers<typeof EXTENSION_HANDLER_TIMEOUT>();
+	const timer = setTimeout(() => resolveTimeout(EXTENSION_HANDLER_TIMEOUT), timeoutMs);
+	try {
+		return await Promise.race([work, timeoutPromise]);
+	} finally {
+		clearTimeout(timer);
+	}
+}
+
 const MAX_PENDING_CREDENTIAL_DISABLED = 32;
 
 /**
@@ -555,10 +581,7 @@ export class ExtensionRunner {
 		timeoutMs: number,
 	): Promise<TResult | undefined> {
 		try {
-			const handlerResult = await Promise.race([
-				Promise.resolve(handler(event, ctx)),
-				Bun.sleep(timeoutMs).then(() => EXTENSION_HANDLER_TIMEOUT),
-			]);
+			const handlerResult = await raceHandlerWithTimeout(Promise.resolve(handler(event, ctx)), timeoutMs);
 			if (handlerResult === EXTENSION_HANDLER_TIMEOUT) {
 				const error = `handler timed out after ${timeoutMs}ms`;
 				logger.warn("Extension handler timed out", {
@@ -693,8 +716,24 @@ export class ExtensionRunner {
 		};
 	}
 
+	/**
+	 * Emit a `tool_call` event to every subscribed extension before the tool executes.
+	 *
+	 * Each handler is bounded by `extensionHandlerTimeoutMs` (default 30s). This
+	 * matches the timeout policy already applied to `emitToolResult` and every
+	 * other handler routed through `#runHandlerWithTimeout`; without it a single
+	 * hung extension (unresolved `await`, network call with no timeout) would
+	 * park `ExtensionToolWrapper.execute` indefinitely and freeze tool
+	 * dispatch — see issue #3948.
+	 *
+	 * On-timeout policy: **fail-closed** (return `{ block: true }`). This is
+	 * symmetric with the existing error path below and safer for a
+	 * pre-execution gate — an unresponsive extension MUST NOT be treated as
+	 * silent consent to run the tool.
+	 */
 	async emitToolCall(event: ToolCallEvent): Promise<ToolCallEventResult | undefined> {
 		const ctx = this.createContext();
+		const timeoutMs = extensionHandlerTimeoutMs;
 		let result: ToolCallEventResult | undefined;
 
 		for (const ext of this.extensions) {
@@ -703,7 +742,25 @@ export class ExtensionRunner {
 
 			for (const handler of handlers) {
 				try {
-					const handlerResult = await handler(event, ctx);
+					const handlerResult = await raceHandlerWithTimeout(Promise.resolve(handler(event, ctx)), timeoutMs);
+
+					if (handlerResult === EXTENSION_HANDLER_TIMEOUT) {
+						const error = `handler timed out after ${timeoutMs}ms`;
+						logger.warn("Extension handler timed out", {
+							extensionPath: ext.path,
+							event: "tool_call",
+							timeoutMs,
+						});
+						this.emitError({
+							extensionPath: ext.path,
+							event: "tool_call",
+							error,
+						});
+						return {
+							block: true,
+							reason: `Extension ${ext.path} timed out after ${timeoutMs}ms`,
+						};
+					}
 
 					if (handlerResult) {
 						result = handlerResult as ToolCallEventResult;