@oh-my-pi/pi-coding-agent 16.3.5 → 16.3.7

package/src/tools/read.ts

@@ -334,6 +334,24 @@ function contiguousLineNumbers(startLine: number, count: number): number[] {
 	return lines;
 }
 
+function lineNumbersFromSpans(spans: readonly { startLine: number; endLine: number }[]): number[] {
+	const lines: number[] = [];
+	for (const span of spans) {
+		for (let line = span.startLine; line <= span.endLine; line++) lines.push(line);
+	}
+	return lines;
+}
+
+function recordInMemorySeenLines(
+	session: ToolSession,
+	absolutePath: string | undefined,
+	fullText: string,
+	seenLines: readonly number[] | undefined,
+): void {
+	if (!absolutePath || !path.isAbsolute(absolutePath) || !seenLines || seenLines.length === 0) return;
+	getFileSnapshotStore(session).record(canonicalSnapshotKey(absolutePath), normalizeToLF(fullText), seenLines);
+}
+
 function lineNumbersFromEntries(entries: readonly LineEntry[]): number[] {
 	const lines: number[] = [];
 	for (const entry of entries) {
@@ -1319,6 +1337,7 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 				: undefined;
 		let emittedHashlineHeader = false;
 		let seenLines: number[] | undefined;
+		let rawSeenLines: number[] | undefined;
 		const formatText = (content: string, startNum: number): string => {
 			const lineCount = countTextLines(content);
 			details.displayContent = {
@@ -1382,10 +1401,12 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 		} else if (truncation.truncated) {
 			const outputLines = truncation.outputLines ?? countTextLines(truncation.content);
 			const endLineDisplay = startLineDisplay + Math.max(0, outputLines - 1);
-			outputText =
-				options.raw === true
-					? formatText(truncation.content, startLineDisplay)
-					: formatLineEntries(buildLineEntries(endLineDisplay), startLineDisplay);
+			if (options.raw === true) {
+				rawSeenLines = contiguousLineNumbers(startLineDisplay, outputLines);
+				outputText = formatText(truncation.content, startLineDisplay);
+			} else {
+				outputText = formatLineEntries(buildLineEntries(endLineDisplay), startLineDisplay);
+			}
 			details.truncation = truncation;
 			truncationInfo = {
 				result: truncation,
@@ -1395,21 +1416,28 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			const remaining = allLines.length - (startLine + userLimitedLines);
 			const nextOffset = startLine + userLimitedLines + 1;
 
-			outputText =
-				options.raw === true
-					? formatText(selectedContent, startLineDisplay)
-					: formatLineEntries(buildLineEntries(endLine), startLineDisplay);
+			if (options.raw === true) {
+				rawSeenLines = contiguousLineNumbers(startLineDisplay, userLimitedLines);
+				outputText = formatText(selectedContent, startLineDisplay);
+			} else {
+				outputText = formatLineEntries(buildLineEntries(endLine), startLineDisplay);
+			}
 			outputText += `\n\n[${remaining} more lines in ${options.entityLabel}. Use :${nextOffset} to continue]`;
 		} else {
-			outputText =
-				options.raw === true
-					? formatText(truncation.content, startLineDisplay)
-					: formatLineEntries(buildLineEntries(endLine), startLineDisplay);
+			if (options.raw === true) {
+				rawSeenLines = contiguousLineNumbers(startLineDisplay, endLine - startLine);
+				outputText = formatText(truncation.content, startLineDisplay);
+			} else {
+				outputText = formatLineEntries(buildLineEntries(endLine), startLineDisplay);
+			}
 		}
 
 		if (hashContext?.tag && options.sourcePath && seenLines) {
 			recordSeenLines(this.session, options.sourcePath, hashContext.tag, seenLines);
 		}
+		if (options.raw === true && options.sourcePath && options.immutable !== true && rawSeenLines) {
+			recordInMemorySeenLines(this.session, options.sourcePath, text, rawSeenLines);
+		}
 		resultBuilder.text(outputText);
 		if (truncationInfo) {
 			resultBuilder.truncation(truncationInfo.result, truncationInfo.options);
@@ -1503,6 +1531,9 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 		if (hashContext?.tag && options.sourcePath && seenLines) {
 			recordSeenLines(this.session, options.sourcePath, hashContext.tag, seenLines);
 		}
+		if (options.raw === true && options.sourcePath && options.immutable !== true && visibleSpans.length > 0) {
+			recordInMemorySeenLines(this.session, options.sourcePath, text, lineNumbersFromSpans(visibleSpans));
+		}
 		resultBuilder.text(finalText);
 		return resultBuilder.done();
 	}
@@ -1615,14 +1646,16 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 				}
 				if (cloned) displayLines = cloned;
 			}
-			const endLine = range.startLine + Math.max(0, displayLines.length - 1);
-			visibleSpans.push({ startLine: range.startLine, endLine });
-			for (let i = 0; i < displayLines.length; i++) {
-				displayLineByNumber.set(range.startLine + i, displayLines[i] ?? "");
-			}
-			if (!fullLines || rawSelector) {
-				const blockText = displayLines.join("\n");
-				blocks.push(formatTextWithMode(blockText, range.startLine, shouldAddHashLines, shouldAddLineNumbers));
+			if (displayLines.length > 0) {
+				const endLine = range.startLine + displayLines.length - 1;
+				visibleSpans.push({ startLine: range.startLine, endLine });
+				for (let i = 0; i < displayLines.length; i++) {
+					displayLineByNumber.set(range.startLine + i, displayLines[i] ?? "");
+				}
+				if (!fullLines || rawSelector) {
+					const blockText = displayLines.join("\n");
+					blocks.push(formatTextWithMode(blockText, range.startLine, shouldAddHashLines, shouldAddLineNumbers));
+				}
 			}
 		}
 
@@ -1662,6 +1695,9 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 				recordSeenLinesFromBody(this.session, absolutePath, tag, outputText, clippedLines);
 				outputText = `${formatReadHashlineHeader(formatPathRelativeToCwd(absolutePath, this.session.cwd), tag)}\n${outputText}`;
 			}
+		} else if (rawSelector && visibleSpans.length > 0) {
+			const rawSeenLines = lineNumbersFromSpans(visibleSpans);
+			if (rawSeenLines.length > 0) await recordFileSnapshot(this.session, absolutePath, rawSeenLines);
 		}
 		if (notices.length > 0) {
 			outputText = outputText ? `${outputText}\n${notices.join("\n")}` : notices.join("\n");
@@ -2669,6 +2705,13 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 					if (hashContext?.tag) {
 						recordSeenLinesFromBody(this.session, absolutePath, hashContext.tag, outputText, clippedLines);
 					}
+					if (rawSelector && !firstLineExceedsLimit && collectedLines.length > 0) {
+						await recordFileSnapshot(
+							this.session,
+							absolutePath,
+							contiguousLineNumbers(startLineDisplay, collectedLines.length),
+						);
+					}
 
 					if (capturedDisplayContent) {
 						details.displayContent = capturedDisplayContent;
@@ -3211,8 +3254,8 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 // =============================================================================
 
 interface ReadRenderArgs {
-	path?: string;
-	file_path?: string;
+	path?: unknown;
+	file_path?: unknown;
 	sel?: string;
 	// Legacy fields from old schema — tolerated for in-flight tool calls during transition
 	offset?: number;
@@ -3277,11 +3320,12 @@ function formatReadPathLink(
 
 export const readToolRenderer = {
 	renderCall(args: ReadRenderArgs, _options: RenderResultOptions, uiTheme: Theme): Component {
-		if (isReadableUrlPath(args.file_path || args.path || "")) {
-			return renderReadUrlCall(args, _options, uiTheme);
+		const rawPath =
+			typeof args.file_path === "string" ? args.file_path : typeof args.path === "string" ? args.path : "";
+		if (isReadableUrlPath(rawPath)) {
+			return renderReadUrlCall({ path: rawPath, raw: args.raw }, _options, uiTheme);
 		}
 
-		const rawPath = args.file_path || args.path || "";
 		const offset = args.offset;
 		const limit = args.limit;
 
@@ -3303,7 +3347,9 @@ export const readToolRenderer = {
 		args?: ReadRenderArgs,
 	): Component {
 		const urlDetails = result.details as ReadUrlToolDetails | undefined;
-		if (urlDetails?.kind === "url" || isReadableUrlPath(args?.file_path || args?.path || "")) {
+		const rawPathForKind =
+			typeof args?.file_path === "string" ? args.file_path : typeof args?.path === "string" ? args.path : "";
+		if (urlDetails?.kind === "url" || isReadableUrlPath(rawPathForKind)) {
 			return renderReadUrlResult(
 				result as {
 					content: Array<{ type: string; text?: string }>;
@@ -3318,7 +3364,8 @@ export const readToolRenderer = {
 		if (result.isError) {
 			const rawErrorText = result.content?.find(c => c.type === "text")?.text ?? "";
 			const errorText = (rawErrorText || "Unknown error").replace(/^Error:\s*/, "");
-			const rawPath = args?.file_path || args?.path || "";
+			const rawPath =
+				typeof args?.file_path === "string" ? args.file_path : typeof args?.path === "string" ? args.path : "";
 			const filePath =
 				formatReadPathLink(rawPath, { offset: args?.offset, sourcePath: readSourceFsPath(result.details) }) ||
 				shortenPath(rawPath);
@@ -3345,7 +3392,8 @@ export const readToolRenderer = {
 		// echo next to the styled warning line below.
 		const contentText = details?.displayContent?.text ?? stripOutputNotice(rawText, details?.meta);
 		const imageContent = result.content?.find(c => c.type === "image");
-		const rawPath = args?.file_path || args?.path || "";
+		const rawPath =
+			typeof args?.file_path === "string" ? args.file_path : typeof args?.path === "string" ? args.path : "";
 		const renderPath = splitReadRenderPath(rawPath);
 		const lang = getLanguageFromPath(renderPath.path);
 

package/src/tools/render-utils.ts

@@ -669,7 +669,10 @@ export function truncateDiffByHunk(
 // Path Utilities
 // =============================================================================
 
-export function shortenPath(filePath: string, homeDir?: string): string {
+export function shortenPath(filePath: unknown, homeDir?: string): string {
+	if (typeof filePath !== "string") {
+		return "";
+	}
 	const home = homeDir ?? os.homedir();
 	if (home && filePath.startsWith(home)) {
 		const suffix = filePath.slice(home.length);

package/src/tools/renderers.ts

@@ -43,26 +43,6 @@ export type ToolRenderer = {
 	mergeCallAndResult?: boolean;
 	/** Render without background box, inline in the response flow */
 	inline?: boolean;
-	/**
-	 * Whether pending-call rows are provisional: useful on screen while a tool is
-	 * streaming, but not durable transcript history. `true` means every pending
-	 * shape is provisional. `"collapsed"` means only the collapsed pending shape
-	 * is provisional; expanded rendering is top-anchored/append-shaped enough to
-	 * let the transcript commit its settled prefix. Absent = the pending preview
-	 * streams rows the result render preserves.
-	 */
-	provisionalPendingPreview?: boolean | "collapsed";
-	/**
-	 * Whether the partial-result render is provisional: chrome rows (header
-	 * glyph, frame state) that change between `options.isPartial === true` and
-	 * the final result render. When `true`, the block is treated as
-	 * commit-unstable while a partial result is in flight, so the
-	 * stable-prefix ratchet in `deriveLiveCommitState` cannot promote the
-	 * partial chrome to native scrollback only to have the final render strand
-	 * it above the settled frame. Absent = the partial render is byte-stable
-	 * with the final render and may commit like any settled stream.
-	 */
-	provisionalPartialResult?: boolean;
 	/**
 	 * Whether the renderer's pending-call path visibly consumes
 	 * `options.spinnerFrame`. Used to avoid scheduling repaint ticks for live

package/src/tools/ssh.ts

@@ -386,22 +386,6 @@ export const sshToolRenderer = {
 		});
 	},
 	mergeCallAndResult: true,
-	// Pending call preview can re-anchor wholesale when the final result inserts
-	// the `Output` section, so no pending SSH rows may commit to native
-	// scrollback — even when expanded. The expanded pending shape was previously
-	// allowed to commit, which left two visible shapes in native scrollback once
-	// the result settled: a stale `⏳ SSH: [host]` header above the final frame,
-	// and the pending `╰──╯` footer reused in-place as the new `├── Output ──┤`
-	// separator with a fresh footer pushed below it.
-	provisionalPendingPreview: true,
-	// Partial-result chrome (pending icon and frame state) differs from the
-	// final SSH glyph/state, so the block stays commit-unstable while
-	// `options.isPartial` holds. Without this, a long-running SSH command's
-	// stable pending header would be promoted by the stable-prefix ratchet and
-	// committed to native scrollback, then the final render's SSH glyph would
-	// land below and strand a duplicate pending header above the final frame
-	// ([#3177](https://github.com/can1357/oh-my-pi/issues/3177)).
-	provisionalPartialResult: true,
 	// Streamed args can initially render the SSH placeholder (`⏳ SSH: […]` /
 	// `$ …`), then the first partial result inserts the `Output` section and
 	// re-anchors the frame. Force a full repaint at that seam so placeholder rows

package/src/tools/write.ts

@@ -914,7 +914,7 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 
 			// Try ACP bridge first for editor-visible filesystem paths. Internal
 			// artifacts such as local:// plans are owned by OMP, not the editor.
-			if (await routeWriteThroughBridge(this.session, path, absolutePath, cleanContent)) {
+			if (await routeWriteThroughBridge(this.session, path, absolutePath, cleanContent, signal)) {
 				const madeExecutable = await maybeMarkExecutableForShebang(absolutePath, cleanContent);
 				const header = maybeWriteSnapshotHeader(this.session, absolutePath, cleanContent);
 				const writeLine = `Successfully wrote ${cleanContent.length} bytes to ${displayPath}`;
@@ -972,9 +972,9 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 // =============================================================================
 
 interface WriteRenderArgs {
-	path?: string;
-	file_path?: string;
-	content?: string;
+	path?: unknown;
+	file_path?: unknown;
+	content?: unknown;
 }
 
 const WRITE_PREVIEW_LINES = 6;
@@ -990,8 +990,14 @@ function formatLineCountSuffix(lineCount: number, uiTheme: Theme): string {
 	return uiTheme.fg("dim", ` · ${lineCount} line${lineCount === 1 ? "" : "s"}`);
 }
 
-function normalizeDisplayText(text: string): string {
-	return text.replace(/\r/g, "");
+function normalizeDisplayText(text: unknown): string {
+	let displayText = "";
+	if (typeof text === "string") {
+		displayText = text;
+	} else if (text !== undefined && text !== null) {
+		displayText = String(text);
+	}
+	return displayText.replace(/\r/g, "");
 }
 
 /**
@@ -1082,9 +1088,10 @@ function renderContentPreview(
 
 export const writeToolRenderer = {
 	renderCall(args: WriteRenderArgs, options: RenderResultOptions, uiTheme: Theme): Component {
-		const rawPath = args.file_path || args.path || "";
+		const rawPath =
+			typeof args.file_path === "string" ? args.file_path : typeof args.path === "string" ? args.path : "";
 		const filePath = shortenPath(rawPath);
-		const lang = getLanguageFromPath(rawPath) ?? "text";
+		const lang = rawPath ? (getLanguageFromPath(rawPath) ?? "text") : "text";
 		const langIcon = uiTheme.fg("muted", uiTheme.getLangIcon(lang));
 		const pathDisplay = filePath ? uiTheme.fg("accent", filePath) : uiTheme.fg("toolOutput", "…");
 		// No status icon on the head row: it's the head of the framed block, and
@@ -1098,11 +1105,12 @@ export const writeToolRenderer = {
 			},
 			uiTheme,
 		);
+		const content = normalizeDisplayText(args.content);
 		const streamingCache = createRenderedStringCache();
 		return framedBlock(uiTheme, width => {
-			const body = args.content
+			const body = content
 				? formatStreamingContent(
-						args.content,
+						content,
 						Boolean(options?.expanded),
 						lang,
 						uiTheme,
@@ -1128,10 +1136,11 @@ export const writeToolRenderer = {
 		uiTheme: Theme,
 		args?: WriteRenderArgs,
 	): Component {
-		const rawPath = args?.file_path || args?.path || "";
+		const rawPath =
+			typeof args?.file_path === "string" ? args.file_path : typeof args?.path === "string" ? args.path : "";
 		const filePath = shortenPath(rawPath);
-		const fileContent = args?.content || "";
-		const lang = getLanguageFromPath(rawPath);
+		const fileContent = normalizeDisplayText(args?.content);
+		const lang = rawPath ? getLanguageFromPath(rawPath) : undefined;
 		const langIcon = uiTheme.fg("muted", uiTheme.getLangIcon(lang));
 		// The header shows the cwd-relative path but links to the absolute path the
 		// write resolved to (args.path may be relative, which would yield a broken

package/src/tts/speech-enhancer.ts

@@ -23,10 +23,12 @@ import type { Settings } from "../config/settings";
 import speechRewritePrompt from "../prompts/system/speech-rewrite.md" with { type: "text" };
 
 const SYSTEM_PROMPT = prompt.render(speechRewritePrompt);
-/** Rewrite budget: a paragraph in, a spoken paragraph (usually shorter) out. */
-const ANSWER_MAX_TOKENS = 512;
-/** Reasoning backends may burn tokens before the answer despite `disableReasoning`. */
-const REASONING_SAFE_MAX_TOKENS = 1536;
+// Rewrite budget: a paragraph in, a spoken paragraph (usually shorter) out.
+// Always reserve enough room to survive backends that ignore `disableReasoning`
+// (e.g. Qwen3 via llama.cpp catalogued `reasoning: false` but still emitting
+// thinking). `maxTokens` is a hard cap — non-thinking completions still return
+// in a normal spoken-paragraph budget (issue #4355).
+const ANSWER_MAX_TOKENS = 1536;
 /** Per-block completion deadline before falling back to mechanical cleanup. */
 const REWRITE_TIMEOUT_MS = 6000;
 /** Bound block characters sent to the model (huge diffs/code dumps get elided). */
@@ -89,7 +91,7 @@ export class SpeechEnhancer {
 				},
 				{
 					apiKey: registry.resolver(model, sessionId),
-					maxTokens: model.reasoning ? REASONING_SAFE_MAX_TOKENS : ANSWER_MAX_TOKENS,
+					maxTokens: ANSWER_MAX_TOKENS,
 					disableReasoning: true,
 					metadata,
 					signal: signal ? AbortSignal.any([signal, timeout]) : timeout,

package/src/tts/vocalizer.ts

@@ -195,6 +195,15 @@ export class Vocalizer {
 		this.#livePlayers.clear();
 	}
 
+	/**
+	 * True while any utterance is still audible or synthesizing — a live
+	 * player, an unfinished stream handle, or an in-flight rewrite is enough.
+	 * Callers (Esc handler) treat this as the "silence me" signal.
+	 */
+	isSpeaking(): boolean {
+		return this.#livePlayers.size > 0 || this.#liveAborts.size > 0 || this.#handle !== null;
+	}
+
 	/** Lower the volume while the user is speaking (push-to-talk), so speech doesn't drown them out. */
 	duck(): void {
 		this.#ducked = true;

package/src/utils/commit-message-generator.ts

@@ -16,8 +16,12 @@ import { concreteThinkingLevel, toReasoningEffort } from "../thinking";
 
 const COMMIT_SYSTEM_PROMPT = prompt.render(commitSystemPrompt);
 const MAX_DIFF_CHARS = 4000;
-const COMMIT_MAX_TOKENS = 60;
-const REASONING_SAFE_MAX_TOKENS = 1024;
+// Cover the "backend ignores `disableReasoning`" case unconditionally: the
+// static `model.reasoning` catalog flag can't distinguish a thinking model
+// declared `reasoning: false` (e.g. Qwen3 served locally via llama.cpp) from
+// one that never emits thinking. `maxTokens` is a hard cap — non-thinking
+// completions still return in a handful of tokens (issue #4355).
+const COMMIT_MAX_TOKENS = 1024;
 
 /** File patterns that should be excluded from commit message generation diffs. */
 const NOISE_SUFFIXES = [".lock", ".lockb", "-lock.json", "-lock.yaml"];
@@ -101,9 +105,7 @@ export async function generateCommitMessage(
 		if (!apiKey) continue;
 
 		try {
-			const maxTokens = candidate.model.reasoning
-				? Math.max(COMMIT_MAX_TOKENS, REASONING_SAFE_MAX_TOKENS)
-				: COMMIT_MAX_TOKENS;
+			const maxTokens = COMMIT_MAX_TOKENS;
 			const response = await completeSimple(
 				candidate.model,
 				{

package/src/utils/shell-snapshot.ts

@@ -260,6 +260,7 @@ export async function getOrCreateSnapshot(
 	// Generate and execute snapshot script
 	const script = generateSnapshotScript(shell, snapshotPath, rcFile);
 
+	let succeeded = false;
 	try {
 		const snapshotEnv = sanitizeSnapshotEnv(env);
 		const spawnEnv: Record<string, string> = {};
@@ -289,10 +290,19 @@ export async function getOrCreateSnapshot(
 			}
 			scrubSnapshotInPlace(snapshotPath);
 			cachedSnapshotPaths.set(cacheKey, snapshotPath);
+			succeeded = true;
 			return snapshotPath;
 		}
 	} catch {
 		// Snapshot creation failed, proceed without it
+	} finally {
+		if (!succeeded) {
+			try {
+				fs.rmSync(snapshotPath, { force: true });
+			} catch {
+				// best-effort cleanup; force: true ignores ENOENT
+			}
+		}
 	}
 
 	return null;

package/src/utils/title-generator.ts

@@ -23,8 +23,15 @@ const TITLE_MARKER_INSTRUCTION = prompt.render(titleMarkerInstruction);
 const DEFAULT_TERMINAL_TITLE = "π";
 const TERMINAL_TITLE_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
 
-const TITLE_MAX_TOKENS = 30;
-const REASONING_SAFE_MAX_TOKENS = 1024;
+// Cover the "backend ignores `disableReasoning`" case unconditionally: the
+// static `model.reasoning` catalog flag can't distinguish a thinking model that
+// was declared with `reasoning: false` (e.g. Qwen3 served locally via llama.cpp,
+// whose bundled jinja chat template forces `enable_thinking: true`) from one
+// that never emits thinking. `maxTokens` is a hard cap, not a target — the
+// happy-path completion still returns in a handful of tokens, so raising the
+// ceiling costs nothing when thinking is genuinely suppressed and keeps the
+// forced `set_title` tool call reachable when it isn't (issue #4355).
+const TITLE_MAX_TOKENS = 1024;
 const SET_TITLE_TOOL_NAME = "set_title";
 
 const setTitleTool: Tool = {
@@ -212,11 +219,9 @@ export async function generateTitleOnline(
 		// account_uuid rather than the snapshot-at-call-site value.
 		const metadata = metadataResolver?.(model.provider);
 
-		// Title generation is a 3-7 word task, but some reasoning backends ignore
-		// disableReasoning. Keep the normal cheap budget for non-reasoning models
-		// while reserving enough output room for reasoning models to still emit
-		// the forced tool call after any unavoidable thinking tokens.
-		const maxTokens = model.reasoning ? Math.max(TITLE_MAX_TOKENS, REASONING_SAFE_MAX_TOKENS) : TITLE_MAX_TOKENS;
+		// Title generation is a 3-7 word task, but the ceiling has to survive
+		// backends that ignore `disableReasoning` (see TITLE_MAX_TOKENS above).
+		const maxTokens = TITLE_MAX_TOKENS;
 		logger.debug("title-generator: request", { ...modelContext, maxTokens });
 
 		const response = await completeSimple(

package/src/web/scrapers/docs-rs.ts

@@ -278,6 +278,17 @@ function findItemInModule(mod_: RustdocItem, name: string, index: Record<string,
 
 const DOCS_RS_CACHE_FILENAME = "rustdoc.json";
 
+/** Hard ceiling for decompressed rustdoc JSON: a 50 MB compressed payload can
+ *  expand far enough to block the event loop or OOM without a cap. Exceeding it
+ *  throws (RangeError), which the fetch path converts to a `null` result. */
+export const MAX_RUSTDOC_GUNZIP_BYTES = 256 * 1024 * 1024;
+
+/** Decompress a docs.rs rustdoc gzip payload with the output-size cap applied.
+ *  `maxOutputLength` is overridable only for tests exercising the cap contract. */
+export function gunzipRustdocJson(compressed: Buffer, maxOutputLength: number = MAX_RUSTDOC_GUNZIP_BYTES): string {
+	return gunzipSync(compressed, { maxOutputLength }).toString("utf-8");
+}
+
 function sanitizeCacheSegment(value: string): string {
 	return value.replace(/[^A-Za-z0-9._-]+/g, "_");
 }
@@ -399,7 +410,7 @@ export const handleDocsRs: SpecialHandler = async (
 		}
 
 		const compressed = Buffer.concat(chunks);
-		const jsonStr = gunzipSync(compressed).toString("utf-8");
+		const jsonStr = gunzipRustdocJson(compressed);
 		crate_ = tryParseJson<RustdocCrate>(jsonStr);
 		if (crate_?.index) {
 			await writeCachedRustdocCrate(target, jsonStr);

package/src/web/search/providers/xai.ts

@@ -1,4 +1,5 @@
-import { type ApiKey, type AuthStorage, withAuth } from "@oh-my-pi/pi-ai";
+import { type ApiKey, type ApiKeyResolver, type AuthStorage, withAuth } from "@oh-my-pi/pi-ai";
+import { $env } from "@oh-my-pi/pi-utils";
 import type { SearchCitation, SearchResponse, SearchSource, SearchUsage } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import { clampNumResults } from "../utils";
@@ -10,32 +11,6 @@ const XAI_RESPONSES_URL = "https://api.x.ai/v1/responses";
 const XAI_WEB_SEARCH_MODEL = "grok-4.3";
 const DEFAULT_NUM_RESULTS = 10;
 const MAX_NUM_RESULTS = 30;
-const RECENCY_DAYS: Record<NonNullable<SearchParams["recency"]>, number> = {
-	day: 1,
-	week: 7,
-	month: 30,
-	year: 365,
-};
-
-function formatUtcDate(date: Date): string {
-	return date.toISOString().slice(0, 10);
-}
-
-function buildRecencyDateBounds(
-	recency: NonNullable<SearchParams["recency"]>,
-	now = new Date(),
-): {
-	from_date: string;
-	to_date: string;
-} {
-	const toDate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
-	const fromDate = new Date(toDate);
-	fromDate.setUTCDate(fromDate.getUTCDate() - RECENCY_DAYS[recency]);
-	return {
-		from_date: formatUtcDate(fromDate),
-		to_date: formatUtcDate(toDate),
-	};
-}
 
 interface XAIUrlCitationAnnotation {
 	type?: string;
@@ -86,22 +61,6 @@ function buildRequestBody(params: SearchParams): Record<string, unknown> {
 		tools: [{ type: "web_search" }],
 	};
 
-	const requestedSearchResults = params.numSearchResults ?? params.limit;
-	const searchParameters: Record<string, unknown> = {};
-	if (requestedSearchResults !== undefined) {
-		searchParameters.max_search_results = clampNumResults(
-			requestedSearchResults,
-			DEFAULT_NUM_RESULTS,
-			MAX_NUM_RESULTS,
-		);
-	}
-	if (params.recency) {
-		Object.assign(searchParameters, buildRecencyDateBounds(params.recency));
-	}
-	if (Object.keys(searchParameters).length > 0) {
-		body.search_parameters = searchParameters;
-	}
-
 	if (params.maxOutputTokens !== undefined) {
 		body.max_output_tokens = params.maxOutputTokens;
 	}
@@ -263,11 +222,48 @@ function parseResponse(response: XAIResponsesResponse, resultCap: number): Searc
 	};
 }
 
-/** Execute xAI Responses API web search. */
-export async function searchXAI(params: SearchParams): Promise<SearchResponse> {
-	const keyOrResolver: ApiKey = params.authStorage.resolver("xai", {
+/**
+ * Prefer `xai-oauth` only when its resolver cannot be shadowed by the shared
+ * `XAI_API_KEY` fallback before reaching a lower-priority dedicated source.
+ */
+function shouldPreferXAIOAuth(authStorage: AuthStorage): boolean {
+	if ($env.XAI_OAUTH_TOKEN) return true;
+
+	const origin = authStorage.getCredentialOrigin("xai-oauth");
+	if (!origin || origin.kind === "env") return false;
+	if ((origin.kind === "api_key" || origin.kind === "fallback") && $env.XAI_API_KEY) return false;
+	return true;
+}
+
+function resolveXAIWebSearchApiKey(params: SearchParams): ApiKeyResolver {
+	const xaiResolver = params.authStorage.resolver("xai", {
+		sessionId: params.sessionId,
+	});
+	const xaiOAuthOrigin = params.authStorage.getCredentialOrigin("xai-oauth");
+	if (!shouldPreferXAIOAuth(params.authStorage)) {
+		return xaiResolver;
+	}
+
+	const xaiOAuthResolver = params.authStorage.resolver("xai-oauth", {
 		sessionId: params.sessionId,
 	});
+	return async ctx => {
+		const xaiOAuthKey = await xaiOAuthResolver(ctx);
+		if (xaiOAuthKey) {
+			const borrowedSharedEnvKey =
+				xaiOAuthOrigin?.kind === "oauth" &&
+				Boolean($env.XAI_API_KEY) &&
+				xaiOAuthKey === $env.XAI_API_KEY &&
+				xaiOAuthKey !== $env.XAI_OAUTH_TOKEN;
+			if (!borrowedSharedEnvKey) return xaiOAuthKey;
+		}
+		return xaiResolver(ctx);
+	};
+}
+
+/** Execute xAI Responses API web search. */
+export async function searchXAI(params: SearchParams): Promise<SearchResponse> {
+	const keyOrResolver: ApiKey = resolveXAIWebSearchApiKey(params);
 
 	const resultCap = clampNumResults(params.numSearchResults ?? params.limit, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
 	const response = await withAuth(keyOrResolver, (key: string) => callXAIResponses(key, params), {
@@ -283,7 +279,7 @@ export class XAIProvider extends SearchProvider {
 	readonly label = "xAI";
 
 	isAvailable(authStorage: AuthStorage): boolean {
-		return authStorage.hasAuth("xai");
+		return shouldPreferXAIOAuth(authStorage) || authStorage.hasAuth("xai");
 	}
 
 	search(params: SearchParams): Promise<SearchResponse> {