@oh-my-pi/pi-coding-agent 16.3.6 → 16.3.7

package/src/utils/title-generator.ts

@@ -23,8 +23,15 @@ const TITLE_MARKER_INSTRUCTION = prompt.render(titleMarkerInstruction);
 const DEFAULT_TERMINAL_TITLE = "π";
 const TERMINAL_TITLE_CONTROL_CHARS = /[\u0000-\u001f\u007f-\u009f]/g;
 
-const TITLE_MAX_TOKENS = 30;
-const REASONING_SAFE_MAX_TOKENS = 1024;
+// Cover the "backend ignores `disableReasoning`" case unconditionally: the
+// static `model.reasoning` catalog flag can't distinguish a thinking model that
+// was declared with `reasoning: false` (e.g. Qwen3 served locally via llama.cpp,
+// whose bundled jinja chat template forces `enable_thinking: true`) from one
+// that never emits thinking. `maxTokens` is a hard cap, not a target — the
+// happy-path completion still returns in a handful of tokens, so raising the
+// ceiling costs nothing when thinking is genuinely suppressed and keeps the
+// forced `set_title` tool call reachable when it isn't (issue #4355).
+const TITLE_MAX_TOKENS = 1024;
 const SET_TITLE_TOOL_NAME = "set_title";
 
 const setTitleTool: Tool = {
@@ -212,11 +219,9 @@ export async function generateTitleOnline(
 		// account_uuid rather than the snapshot-at-call-site value.
 		const metadata = metadataResolver?.(model.provider);
 
-		// Title generation is a 3-7 word task, but some reasoning backends ignore
-		// disableReasoning. Keep the normal cheap budget for non-reasoning models
-		// while reserving enough output room for reasoning models to still emit
-		// the forced tool call after any unavoidable thinking tokens.
-		const maxTokens = model.reasoning ? Math.max(TITLE_MAX_TOKENS, REASONING_SAFE_MAX_TOKENS) : TITLE_MAX_TOKENS;
+		// Title generation is a 3-7 word task, but the ceiling has to survive
+		// backends that ignore `disableReasoning` (see TITLE_MAX_TOKENS above).
+		const maxTokens = TITLE_MAX_TOKENS;
 		logger.debug("title-generator: request", { ...modelContext, maxTokens });
 
 		const response = await completeSimple(

package/src/web/scrapers/docs-rs.ts

@@ -278,6 +278,17 @@ function findItemInModule(mod_: RustdocItem, name: string, index: Record<string,
 
 const DOCS_RS_CACHE_FILENAME = "rustdoc.json";
 
+/** Hard ceiling for decompressed rustdoc JSON: a 50 MB compressed payload can
+ *  expand far enough to block the event loop or OOM without a cap. Exceeding it
+ *  throws (RangeError), which the fetch path converts to a `null` result. */
+export const MAX_RUSTDOC_GUNZIP_BYTES = 256 * 1024 * 1024;
+
+/** Decompress a docs.rs rustdoc gzip payload with the output-size cap applied.
+ *  `maxOutputLength` is overridable only for tests exercising the cap contract. */
+export function gunzipRustdocJson(compressed: Buffer, maxOutputLength: number = MAX_RUSTDOC_GUNZIP_BYTES): string {
+	return gunzipSync(compressed, { maxOutputLength }).toString("utf-8");
+}
+
 function sanitizeCacheSegment(value: string): string {
 	return value.replace(/[^A-Za-z0-9._-]+/g, "_");
 }
@@ -399,7 +410,7 @@ export const handleDocsRs: SpecialHandler = async (
 		}
 
 		const compressed = Buffer.concat(chunks);
-		const jsonStr = gunzipSync(compressed).toString("utf-8");
+		const jsonStr = gunzipRustdocJson(compressed);
 		crate_ = tryParseJson<RustdocCrate>(jsonStr);
 		if (crate_?.index) {
 			await writeCachedRustdocCrate(target, jsonStr);

package/src/web/search/providers/xai.ts

@@ -1,4 +1,5 @@
-import { type ApiKey, type AuthStorage, withAuth } from "@oh-my-pi/pi-ai";
+import { type ApiKey, type ApiKeyResolver, type AuthStorage, withAuth } from "@oh-my-pi/pi-ai";
+import { $env } from "@oh-my-pi/pi-utils";
 import type { SearchCitation, SearchResponse, SearchSource, SearchUsage } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import { clampNumResults } from "../utils";
@@ -10,32 +11,6 @@ const XAI_RESPONSES_URL = "https://api.x.ai/v1/responses";
 const XAI_WEB_SEARCH_MODEL = "grok-4.3";
 const DEFAULT_NUM_RESULTS = 10;
 const MAX_NUM_RESULTS = 30;
-const RECENCY_DAYS: Record<NonNullable<SearchParams["recency"]>, number> = {
-	day: 1,
-	week: 7,
-	month: 30,
-	year: 365,
-};
-
-function formatUtcDate(date: Date): string {
-	return date.toISOString().slice(0, 10);
-}
-
-function buildRecencyDateBounds(
-	recency: NonNullable<SearchParams["recency"]>,
-	now = new Date(),
-): {
-	from_date: string;
-	to_date: string;
-} {
-	const toDate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate()));
-	const fromDate = new Date(toDate);
-	fromDate.setUTCDate(fromDate.getUTCDate() - RECENCY_DAYS[recency]);
-	return {
-		from_date: formatUtcDate(fromDate),
-		to_date: formatUtcDate(toDate),
-	};
-}
 
 interface XAIUrlCitationAnnotation {
 	type?: string;
@@ -86,22 +61,6 @@ function buildRequestBody(params: SearchParams): Record<string, unknown> {
 		tools: [{ type: "web_search" }],
 	};
 
-	const requestedSearchResults = params.numSearchResults ?? params.limit;
-	const searchParameters: Record<string, unknown> = {};
-	if (requestedSearchResults !== undefined) {
-		searchParameters.max_search_results = clampNumResults(
-			requestedSearchResults,
-			DEFAULT_NUM_RESULTS,
-			MAX_NUM_RESULTS,
-		);
-	}
-	if (params.recency) {
-		Object.assign(searchParameters, buildRecencyDateBounds(params.recency));
-	}
-	if (Object.keys(searchParameters).length > 0) {
-		body.search_parameters = searchParameters;
-	}
-
 	if (params.maxOutputTokens !== undefined) {
 		body.max_output_tokens = params.maxOutputTokens;
 	}
@@ -263,11 +222,48 @@ function parseResponse(response: XAIResponsesResponse, resultCap: number): Searc
 	};
 }
 
-/** Execute xAI Responses API web search. */
-export async function searchXAI(params: SearchParams): Promise<SearchResponse> {
-	const keyOrResolver: ApiKey = params.authStorage.resolver("xai", {
+/**
+ * Prefer `xai-oauth` only when its resolver cannot be shadowed by the shared
+ * `XAI_API_KEY` fallback before reaching a lower-priority dedicated source.
+ */
+function shouldPreferXAIOAuth(authStorage: AuthStorage): boolean {
+	if ($env.XAI_OAUTH_TOKEN) return true;
+
+	const origin = authStorage.getCredentialOrigin("xai-oauth");
+	if (!origin || origin.kind === "env") return false;
+	if ((origin.kind === "api_key" || origin.kind === "fallback") && $env.XAI_API_KEY) return false;
+	return true;
+}
+
+function resolveXAIWebSearchApiKey(params: SearchParams): ApiKeyResolver {
+	const xaiResolver = params.authStorage.resolver("xai", {
+		sessionId: params.sessionId,
+	});
+	const xaiOAuthOrigin = params.authStorage.getCredentialOrigin("xai-oauth");
+	if (!shouldPreferXAIOAuth(params.authStorage)) {
+		return xaiResolver;
+	}
+
+	const xaiOAuthResolver = params.authStorage.resolver("xai-oauth", {
 		sessionId: params.sessionId,
 	});
+	return async ctx => {
+		const xaiOAuthKey = await xaiOAuthResolver(ctx);
+		if (xaiOAuthKey) {
+			const borrowedSharedEnvKey =
+				xaiOAuthOrigin?.kind === "oauth" &&
+				Boolean($env.XAI_API_KEY) &&
+				xaiOAuthKey === $env.XAI_API_KEY &&
+				xaiOAuthKey !== $env.XAI_OAUTH_TOKEN;
+			if (!borrowedSharedEnvKey) return xaiOAuthKey;
+		}
+		return xaiResolver(ctx);
+	};
+}
+
+/** Execute xAI Responses API web search. */
+export async function searchXAI(params: SearchParams): Promise<SearchResponse> {
+	const keyOrResolver: ApiKey = resolveXAIWebSearchApiKey(params);
 
 	const resultCap = clampNumResults(params.numSearchResults ?? params.limit, DEFAULT_NUM_RESULTS, MAX_NUM_RESULTS);
 	const response = await withAuth(keyOrResolver, (key: string) => callXAIResponses(key, params), {
@@ -283,7 +279,7 @@ export class XAIProvider extends SearchProvider {
 	readonly label = "xAI";
 
 	isAvailable(authStorage: AuthStorage): boolean {
-		return authStorage.hasAuth("xai");
+		return shouldPreferXAIOAuth(authStorage) || authStorage.hasAuth("xai");
 	}
 
 	search(params: SearchParams): Promise<SearchResponse> {