@oh-my-pi/pi-coding-agent 16.4.0 → 16.4.1

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "16.4.0",
+	"version": "16.4.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -56,17 +56,17 @@
 		"@agentclientprotocol/sdk": "0.25.0",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "16.4.0",
-		"@oh-my-pi/omp-stats": "16.4.0",
-		"@oh-my-pi/pi-agent-core": "16.4.0",
-		"@oh-my-pi/pi-ai": "16.4.0",
-		"@oh-my-pi/pi-catalog": "16.4.0",
-		"@oh-my-pi/pi-mnemopi": "16.4.0",
-		"@oh-my-pi/pi-natives": "16.4.0",
-		"@oh-my-pi/pi-tui": "16.4.0",
-		"@oh-my-pi/pi-utils": "16.4.0",
-		"@oh-my-pi/pi-wire": "16.4.0",
-		"@oh-my-pi/snapcompact": "16.4.0",
+		"@oh-my-pi/hashline": "16.4.1",
+		"@oh-my-pi/omp-stats": "16.4.1",
+		"@oh-my-pi/pi-agent-core": "16.4.1",
+		"@oh-my-pi/pi-ai": "16.4.1",
+		"@oh-my-pi/pi-catalog": "16.4.1",
+		"@oh-my-pi/pi-mnemopi": "16.4.1",
+		"@oh-my-pi/pi-natives": "16.4.1",
+		"@oh-my-pi/pi-tui": "16.4.1",
+		"@oh-my-pi/pi-utils": "16.4.1",
+		"@oh-my-pi/pi-wire": "16.4.1",
+		"@oh-my-pi/snapcompact": "16.4.1",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/context-async-hooks": "^2.7.1",
 		"@opentelemetry/exporter-trace-otlp-proto": "^0.218.0",

package/src/mcp/oauth-flow.ts

@@ -555,12 +555,28 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 	 * "Only clients listed in the Figma MCP Catalog can connect"), the fallback
 	 * probe surfaces a message that names the endpoint and status instead of
 	 * the historical opaque "OAuth provider requires client_id".
+	 *
+	 * Includes {@link MCPOAuthConfig.scopes} as RFC 7591 `scope` when set so
+	 * providers that bind DCR clients to registered scopes only (e.g. Clerk)
+	 * accept the later authorize request for the same scope set.
 	 */
 	async #tryRegisterClient(redirectUri: string): Promise<void> {
 		const registrationEndpoint = await this.#resolveRegistrationEndpoint();
 		if (!registrationEndpoint) return;
 
 		try {
+			const registrationBody: Record<string, unknown> = {
+				client_name: "oh-my-pi",
+				redirect_uris: [redirectUri],
+				grant_types: ["authorization_code", "refresh_token"],
+				response_types: ["code"],
+				token_endpoint_auth_method: "none",
+				application_type: "native",
+			};
+			const scope = this.config.scopes?.trim();
+			if (scope) {
+				registrationBody.scope = scope;
+			}
 			const response = await this.#fetch(registrationEndpoint, {
 				method: "POST",
 				headers: {
@@ -568,14 +584,7 @@ export class MCPOAuthFlow extends OAuthCallbackFlow {
 					Accept: "application/json",
 				},
 				signal: this.ctrl.signal,
-				body: JSON.stringify({
-					client_name: "oh-my-pi",
-					redirect_uris: [redirectUri],
-					grant_types: ["authorization_code", "refresh_token"],
-					response_types: ["code"],
-					token_endpoint_auth_method: "none",
-					application_type: "native",
-				}),
+				body: JSON.stringify(registrationBody),
 			});
 
 			if (!response.ok) {

package/src/prompts/advisor/system.md

@@ -44,6 +44,14 @@ NEVER advise on intent or process:
 - Intent is the agent's domain; it defaults to informed action.
 - Your lane: correctness, edge cases, design, process.
 
+NEVER police scope or ambition:
+- A large diff, wholesale rewrite, or expanding plan is NOT a problem by itself — often it is exactly what the user wants.
+- Object to the size or reach of a change ONLY when it contradicts an explicit user instruction in the transcript (e.g. "minimal change", "don't touch X") — and cite that instruction.
+
+NEVER raise backwards compatibility unless the user or a standing project rule explicitly requires it:
+- No unsolicited concerns or blockers about breaking changes, deprecation shims, migration paths, legacy fallbacks, or API stability.
+- Absent such a requirement, clean cutover — delete the old path, update every caller — is the correct default; treat it as such.
+
 Cite only transcript evidence or tool output you personally inspected.
 Arguments absent from the rendered transcript are UNKNOWN:
 - NEVER assert concrete values, array indexes, serialization shapes, or caller mistakes for hidden arguments.
@@ -76,7 +84,7 @@ Cite the exact instruction or risk.
 **`blocker`**
 - Stop and reconsider.
 - Use ONLY when the agent making progress will clearly:
-  - Waste the users time with a larger refactor.
+  - Contradict an explicit user instruction in the transcript — cite it; size, rewrite breadth, or an evolving plan alone is NEVER the trigger.
   - Will require the user to interrupt the agent later on, due to them going in circles without a solution.
   - Be fundamentally unsound.
   - Hand off as "done" work that was never exercised against the user's actual ask.