@oh-my-pi/pi-coding-agent 16.3.4 → 16.3.6

package/src/modes/components/eval-execution.ts

@@ -61,6 +61,15 @@ export class EvalExecutionComponent extends Container {
 		this.#contentContainer.addChild(this.#loader);
 	}
 
+	/**
+	 * Transcript finalization contract (see `FinalizableBlock`): the collapsed
+	 * streaming preview rewrites its tail window every chunk, so the block must
+	 * stay out of native scrollback until the cell completes.
+	 */
+	isTranscriptBlockFinalized(): boolean {
+		return this.#status !== "running";
+	}
+
 	setExpanded(expanded: boolean): void {
 		this.#expanded = expanded;
 		this.#updateDisplay();

package/src/modes/components/login-dialog.ts

@@ -68,9 +68,17 @@ export class LoginDialogComponent extends Container {
 	}
 
 	/**
-	 * Called by onAuth callback - show URL and optional instructions
+	 * Called by the OAuth `onAuth` callback. Renders the full authorization URL
+	 * as the primary copy target — that works from any machine, including
+	 * SSH/WSL/headless sessions where the OMP-hosted `launchUrl` would resolve
+	 * against the user's local browser and fail. When `launchUrl` is present it
+	 * is offered as an additional local shortcut so narrow local terminals still
+	 * have a truncation-safe copy target (viewport clipping on a long authorize
+	 * URL silently drops trailing OAuth query parameters — e.g.
+	 * `code_challenge_method=S256`). The OSC 8 hyperlink carries the full URL
+	 * for terminals that support click-through.
 	 */
-	showAuth(url: string, instructions?: string): void {
+	showAuth(url: string, instructions?: string, launchUrl?: string): void {
 		this.#contentContainer.clear();
 		this.#contentContainer.addChild(new Spacer(1));
 		this.#contentContainer.addChild(new Text(theme.fg("accent", url), 1, 0));
@@ -79,6 +87,12 @@ export class LoginDialogComponent extends Container {
 		const hyperlink = `\x1b]8;;${url}\x07${clickHint}\x1b]8;;\x07`;
 		this.#contentContainer.addChild(new Text(theme.fg("dim", hyperlink), 1, 0));
 
+		if (launchUrl && launchUrl !== url) {
+			this.#contentContainer.addChild(
+				new Text(theme.fg("dim", `Local shortcut (this machine only): ${launchUrl}`), 1, 0),
+			);
+		}
+
 		if (instructions) {
 			this.#contentContainer.addChild(new Spacer(1));
 			this.#contentContainer.addChild(new Text(theme.fg("warning", instructions), 1, 0));

package/src/modes/components/mcp-add-wizard.ts

@@ -15,7 +15,7 @@ import {
 } from "@oh-my-pi/pi-tui";
 import { getMCPConfigPath, getProjectDir } from "@oh-my-pi/pi-utils";
 import { validateServerName } from "../../mcp/config-writer";
-import { analyzeAuthError, discoverOAuthEndpoints } from "../../mcp/oauth-discovery";
+import { analyzeAuthError, discoverOAuthEndpoints, fetchResourceMetadataScopes } from "../../mcp/oauth-discovery";
 import type { MCPHttpServerConfig, MCPServerConfig, MCPSseServerConfig, MCPStdioServerConfig } from "../../mcp/types";
 import { shortenPath } from "../../tools/render-utils";
 import { theme } from "../theme/theme";
@@ -1009,11 +1009,19 @@ export class MCPAddWizard extends Container {
 							this.#state.url,
 							authResult.authServerUrl,
 							authResult.resourceMetadataUrl,
+							{ protectedScopes: authResult.scopes },
 						);
 					} catch {
 						// Ignore discovery failures and fallback to manual auth.
 					}
 				}
+				if (oauth && !oauth.scopes && authResult.resourceMetadataUrl) {
+					// JSON-error-body path skips `discoverOAuthEndpoints` when the body
+					// already carries endpoints, so scopes advertised only in the
+					// protected-resource metadata document never reach the grant.
+					const scopes = await fetchResourceMetadataScopes(authResult.resourceMetadataUrl);
+					if (scopes) oauth = { ...oauth, scopes };
+				}
 
 				if (oauth) {
 					this.#state.oauthAuthUrl = oauth.authorizationUrl;

package/src/modes/components/tool-execution.ts

@@ -697,12 +697,12 @@ export class ToolExecutionComponent extends Container implements NativeScrollbac
 	/**
 	 * Standalone harnesses may mount a tool component directly under `TUI`
 	 * instead of inside `TranscriptContainer`. In that shape the component must
-	 * report its own live-region seam for provisional previews, or the core
-	 * renderer treats it like shell output and commits tail-window edit/eval/bash
-	 * previews to immutable native scrollback before the result replaces them.
+	 * report its own live-region seam while unfinalized, or the core renderer
+	 * treats it like shell output and commits still-mutating preview rows to
+	 * immutable native scrollback before the result replaces them.
 	 */
 	getNativeScrollbackLiveRegionStart(): number | undefined {
-		return !this.isTranscriptBlockFinalized() && !this.isTranscriptBlockCommitStable() ? 0 : undefined;
+		return this.isTranscriptBlockFinalized() ? undefined : 0;
 	}
 
 	/**
@@ -726,52 +726,6 @@ export class ToolExecutionComponent extends Container implements NativeScrollbac
 		return (this.#result.details as { async?: { state?: string } } | undefined)?.async?.state === "running";
 	}
 
-	/**
-	 * Whether this still-live block's settled rows may enter native scrollback
-	 * (see `FinalizableBlock.isTranscriptBlockCommitStable`). Renderers classify
-	 * pending views by durability instead of by tool name: a provisional view is
-	 * allowed to be useful on screen, but finalization may replace or re-anchor
-	 * it wholesale, so committing any of its rows would strand stale preview
-	 * bytes in immutable scrollback. Non-provisional views stream rows whose
-	 * committed prefix survives the remaining transitions.
-	 */
-	isTranscriptBlockCommitStable(): boolean {
-		if (this.#displaceableByToolName) return false;
-		if (this.isTranscriptBlockFinalized()) return true;
-		// `provisionalPendingPreview` describes only the PENDING call preview
-		// (`renderCall`, before any result): the result render may re-anchor it
-		// wholesale, so its rows must never commit. Once a (streaming partial)
-		// result exists the result renderer is usually the live shape — its body
-		// is top-anchored and grows append-only, and `deriveLiveCommitState`
-		// gates per-row durability — so the block is commit-stable like any
-		// settled stream. Gating the flag on the pending phase is what keeps a
-		// collapsed streaming eval/bash/ssh whose box outgrows the viewport from
-		// stranding its head: while commit-unstable its scrolled-off top
-		// committed nowhere and repainted nowhere, so it read as truncated until
-		// ctrl+o (expanded) flipped it stable.
-		//
-		// Renderers whose partial-result chrome (header glyph, frame state)
-		// differs from the final result render set `provisionalPartialResult`
-		// to opt out of stream-commit while `isPartial` holds: the ratchet
-		// would otherwise promote the stable partial chrome to native scrollback
-		// after `STABLE_PREFIX_COMMIT_FRAMES` and leave it stranded above the
-		// final frame once the chrome flips. Once the result settles
-		// (`isPartial === false`) the block is commit-stable again.
-		if (this.#result !== undefined) {
-			if (this.#isPartial) {
-				const tool = this.#tool as { provisionalPartialResult?: boolean } | undefined;
-				const provisionalPartialResult =
-					tool?.provisionalPartialResult ?? toolRenderers[this.#toolName]?.provisionalPartialResult;
-				if (provisionalPartialResult) return false;
-			}
-			return true;
-		}
-		const tool = this.#tool as { provisionalPendingPreview?: boolean | "collapsed" } | undefined;
-		const provisionalPendingPreview =
-			tool?.provisionalPendingPreview ?? toolRenderers[this.#toolName]?.provisionalPendingPreview;
-		return provisionalPendingPreview !== true && (provisionalPendingPreview !== "collapsed" || this.#expanded);
-	}
-
 	/**
 	 * Mark the tool terminal even though no result arrived (the turn aborted or
 	 * abandoned it) and stop animating, so it can freeze and stops pinning the