@oh-my-pi/pi-coding-agent 16.5.1 → 16.5.2

package/src/extensibility/plugins/bun-git-cache.ts

@@ -0,0 +1,91 @@
+import type { Dirent } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { isEnoent } from "@oh-my-pi/pi-utils";
+import type { GitSource } from "./git-url";
+
+interface CommandResult {
+	readonly exitCode: number;
+	readonly stdout: string;
+	readonly stderr: string;
+}
+
+async function runCommand(command: string[], cwd: string): Promise<CommandResult> {
+	const proc = Bun.spawn(command, {
+		cwd,
+		stdin: "ignore",
+		stdout: "pipe",
+		stderr: "pipe",
+		windowsHide: true,
+	});
+	const [exitCode, stdout, stderr] = await Promise.all([
+		proc.exited,
+		new Response(proc.stdout).text(),
+		new Response(proc.stderr).text(),
+	]);
+	return { exitCode, stdout, stderr };
+}
+
+function normalizeRepositoryUrl(repository: string): string {
+	const withoutFragment = repository.replace(/^git\+/i, "").replace(/#.*$/, "");
+	const scpLike = withoutFragment.match(/^(?:[^@]+@)?([^:]+):(.+)$/);
+	if (scpLike && !withoutFragment.includes("://")) {
+		const host = scpLike[1]?.toLowerCase() ?? "";
+		const repoPath = (scpLike[2] ?? "").replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+		return `ssh://${host}/${repoPath}`;
+	}
+
+	try {
+		const parsed = new URL(withoutFragment);
+		const repoPath = parsed.pathname.replace(/^\/+|\/+$/g, "").replace(/\.git$/i, "");
+		return `${parsed.protocol.toLowerCase()}//${parsed.host.toLowerCase()}/${repoPath}`;
+	} catch {
+		return withoutFragment.replace(/\/+$/g, "").replace(/\.git$/i, "");
+	}
+}
+
+/** Fetches current heads and tags into Bun's matching cached bare clone before a plugin update. */
+export async function refreshBunGitCache(source: GitSource, cwd: string): Promise<void> {
+	const cacheResult = await runCommand(["bun", "pm", "cache"], cwd);
+	if (cacheResult.exitCode !== 0) {
+		throw new Error(`bun pm cache failed: ${cacheResult.stderr}`);
+	}
+	const cacheDir = cacheResult.stdout.trim();
+	if (!cacheDir) {
+		throw new Error("bun pm cache returned an empty cache path");
+	}
+
+	let entries: Dirent[];
+	try {
+		entries = await fs.readdir(cacheDir, { withFileTypes: true });
+	} catch (err) {
+		if (isEnoent(err)) return;
+		throw err;
+	}
+
+	const repositoryUrl = normalizeRepositoryUrl(source.repo);
+	for (const entry of entries) {
+		if (!entry.isDirectory() || !entry.name.endsWith(".git")) continue;
+		const repositoryDir = path.join(cacheDir, entry.name);
+		const originResult = await runCommand(["git", "-C", repositoryDir, "config", "--get", "remote.origin.url"], cwd);
+		if (originResult.exitCode !== 0 || normalizeRepositoryUrl(originResult.stdout.trim()) !== repositoryUrl) continue;
+
+		const fetchResult = await runCommand(
+			[
+				"git",
+				"-C",
+				repositoryDir,
+				"fetch",
+				"--force",
+				"--prune",
+				"origin",
+				"+refs/heads/*:refs/heads/*",
+				"+refs/tags/*:refs/tags/*",
+			],
+			cwd,
+		);
+		if (fetchResult.exitCode !== 0) {
+			throw new Error(`Failed to refresh Bun's git cache for ${source.host}/${source.path}: ${fetchResult.stderr}`);
+		}
+	}
+}

package/src/extensibility/plugins/legacy-pi-compat.ts

@@ -1135,10 +1135,9 @@ async function realpathOrSelfUncached(p: string): Promise<string> {
  * Extension-local bare dependency entries are also included so their relative
  * children receive the reload mtime tag; bare imports inside those dependencies
  * remain native Bun resolutions to avoid taking over full third-party graphs.
- * CommonJS dependency entries stay native too, with one exception: napi-rs
- * style loaders whose bare requires resolve to `.node` addons are hooked so
- * their requires can be pinned to absolute paths (unresolvable by bare
- * specifier inside `bun build --compile` binaries).
+ * CommonJS modules reached through `require()` stay on Bun's native loader.
+ * The only exception is a module whose bare requires resolve to native addons:
+ * those require a synchronous hook that pins the addon to an absolute path.
  */
 async function collectExtensionModules(entryRealPath: string): Promise<Map<string, string>> {
 	const modules = new Map<string, string>();
@@ -1159,32 +1158,40 @@ async function collectExtensionModules(entryRealPath: string): Promise<Map<strin
 		let source: string;
 		try {
 			source = await Bun.file(file).text();
-			if (nativeAddonLoaderModulePaths.has(file)) {
-				// CJS requires cannot await an async onLoad hook. Resolve and
-				// rewrite native-addon paths before installing its sync hook.
-				source = await rewriteExtensionNativeAddonRequires(source, file);
-			}
 		} catch {
 			continue;
 		}
 		modules.set(file, source);
 		const dir = path.dirname(file);
 		const specifiers = new Set<string>();
+		const requiredSpecifiers = new Set<string>();
 		for (const match of source.matchAll(EXTENSION_GRAPH_SPECIFIER_REGEX)) {
 			if (match[2]) specifiers.add(match[2]);
 		}
 		for (const match of source.matchAll(NATIVE_ADDON_REQUIRE_SPECIFIER_REGEX)) {
-			if (match[2]) specifiers.add(match[2]);
+			if (match[2]) {
+				specifiers.add(match[2]);
+				requiredSpecifiers.add(match[2]);
+			}
 		}
 		for (const specifier of specifiers) {
 			try {
 				let resolved: string | null = null;
 				let nextFollowsBareDependencies = followBareDependencies;
+				const isRequired = requiredSpecifiers.has(specifier);
 				if (specifier.startsWith(".")) {
 					const candidate = Bun.resolveSync(specifier, dir);
-					resolved = hasSourceModuleExtension(candidate) ? await realpathOrSelf(candidate) : null;
+					if (
+						hasSourceModuleExtension(candidate) &&
+						(!isRequired || (await moduleRequiresNativeAddon(candidate)))
+					) {
+						resolved = await realpathOrSelf(candidate);
+					}
 				} else if (specifier.startsWith("#")) {
-					resolved = await resolvePackageImportSpecifier(specifier, file);
+					const candidate = await resolvePackageImportSpecifier(specifier, file);
+					if (candidate && (!isRequired || (await moduleRequiresNativeAddon(candidate)))) {
+						resolved = candidate;
+					}
 				} else if (
 					followBareDependencies &&
 					isBareExtensionDependencySpecifier(specifier) &&
@@ -1206,14 +1213,17 @@ async function collectExtensionModules(entryRealPath: string): Promise<Map<strin
 						isHookableEntry && isCommonJsEntry && dependencyEntry
 							? await moduleRequiresNativeAddon(dependencyEntry)
 							: false;
-					if (isHookableEntry && dependencyEntry && (!isCommonJsEntry || hookCommonJsEntry)) {
+					if (isHookableEntry && dependencyEntry && ((!isRequired && !isCommonJsEntry) || hookCommonJsEntry)) {
 						resolved = await realpathOrSelf(dependencyEntry);
-						if (hookCommonJsEntry) {
-							nativeAddonLoaderModulePaths.add(resolved);
-						}
+					}
+					if (resolved && hookCommonJsEntry) {
+						nativeAddonLoaderModulePaths.add(resolved);
 					}
 					nextFollowsBareDependencies = false;
 				}
+				if (resolved && isRequired) {
+					nativeAddonLoaderModulePaths.add(resolved);
+				}
 				if (resolved && !modules.has(resolved)) {
 					const queuedFollowsBareDependencies = queuedFollowBareDependencies.get(resolved) ?? false;
 					const mergedFollowsBareDependencies = queuedFollowsBareDependencies || nextFollowsBareDependencies;
@@ -1225,6 +1235,12 @@ async function collectExtensionModules(entryRealPath: string): Promise<Map<strin
 			}
 		}
 	}
+	for (const modulePath of nativeAddonLoaderModulePaths) {
+		const source = modules.get(modulePath);
+		if (source !== undefined) {
+			modules.set(modulePath, await rewriteExtensionNativeAddonRequires(source, modulePath));
+		}
+	}
 	return modules;
 }
 

package/src/extensibility/plugins/manager.ts

@@ -12,6 +12,7 @@ import {
 	logger,
 } from "@oh-my-pi/pi-utils";
 import { withExitGuard } from "../utils";
+import { refreshBunGitCache } from "./bun-git-cache";
 import { type GitSource, parseGitUrl } from "./git-url";
 import { installLegacyPiSpecifierShim, loadLegacyPiModule } from "./legacy-pi-compat";
 import { resolvePluginManifestEntries } from "./loader";
@@ -521,14 +522,13 @@ export class PluginManager {
 
 			// Step 2: refresh the git lockfile pin when re-installing an existing
 			// git plugin. `bun install <spec>` is a no-op when the spec matches the
-			// lockfile entry — it never re-resolves the remote ref — so re-running
-			// `omp plugin install github:owner/repo` would silently keep the user on
-			// the original resolved commit even after upstream moved (#3063).
-			// `bun update <name>` re-resolves the ref against the remote and
-			// rewrites the pin; SHA-pinned refs stay put because the commit can't
-			// move. First-time installs skip this — the initial `bun install` already
-			// fetched HEAD. Rollback is handled by the outer catch.
+			// lockfile entry, while `bun update <name>` resolves through Bun's bare
+			// clone cache. Fetch the matching cache clone first so a stale cached
+			// ref cannot silently preserve the old pin (#3063, #5401). First-time
+			// installs skip this because the initial `bun install` populated the
+			// cache from the remote. Rollback is handled by the outer catch.
 			if (gitSource && existingActualName) {
+				await refreshBunGitCache(gitSource, getPluginsDir());
 				const updateProc = Bun.spawn(["bun", "update", actualName], {
 					cwd: getPluginsDir(),
 					stdin: "ignore",

package/src/goals/guided-setup.ts

@@ -1,6 +1,6 @@
 import { instrumentedCompleteSimple, resolveTelemetry } from "@oh-my-pi/pi-agent-core";
 import type { Tool } from "@oh-my-pi/pi-ai";
-import { prompt } from "@oh-my-pi/pi-utils";
+import { prompt, Snowflake } from "@oh-my-pi/pi-utils";
 import { extractTextContent, extractToolCall, parseJsonPayload } from "../commit/utils";
 import guidedGoalInterviewPrompt from "../prompts/goals/guided-goal-interview.md" with { type: "text" };
 import guidedGoalSystemPrompt from "../prompts/goals/guided-goal-system.md" with { type: "text" };
@@ -37,6 +37,21 @@ export type GuidedGoalTurnResult =
 export interface GuidedGoalTurnOptions {
 	messages: readonly GuidedGoalMessage[];
 	signal?: AbortSignal;
+	/**
+	 * Stable Codex transport session id reused across every turn of one
+	 * interview. `handleGuidedGoalCommand` runs up to six turns; minting a fresh
+	 * id per turn opens a new websocket-only Codex socket each time (kept in
+	 * `providerSessionState` until session dispose), which can trip
+	 * `websocket_connection_limit_reached` and drop back to the SSE path this
+	 * fix avoids. Callers pass one id for the whole interview; omitted for
+	 * one-shot callers, which mint a unique id per call.
+	 */
+	sideSessionId?: string;
+}
+
+/** Mint a guided-goal Codex side-session id keyed off the main session id. */
+export function newGuidedGoalSessionId(session: AgentSession): string {
+	return `${session.sessionId}:guided-goal:${Snowflake.next()}`;
 }
 
 function parseGuidedGoalPayload(value: unknown): GuidedGoalTurnResult {
@@ -106,6 +121,19 @@ export async function runGuidedGoalTurn(
 			reasoning: toReasoningEffort(thinkingLevel),
 			disableReasoning: shouldDisableReasoning(thinkingLevel),
 			toolChoice: { type: "tool", name: RESPOND_TOOL_NAME },
+			// Route through the session's provider transport so websocket-only Codex
+			// models (gpt-5.6-luna/sol/terra) get a websocket session instead of
+			// falling back to SSE — the Codex SSE /responses endpoint does not serve
+			// those ids and rejects the turn with "Model not found" (#5304, same class
+			// as the /btw regression in #5213). The side session id is minted once per
+			// interview and reused across turns so a multi-question interview shares one
+			// Codex socket instead of opening a fresh one each turn; it stays distinct
+			// from the main session id so the oneshot's append-only turn state never
+			// pollutes the main conversation.
+			sessionId: options.sideSessionId ?? newGuidedGoalSessionId(session),
+			promptCacheKey: session.sessionId,
+			preferWebsockets: session.preferWebsockets,
+			providerSessionState: session.providerSessionState,
 		},
 		{ telemetry: resolveTelemetry(session.agent.telemetry, session.sessionId), oneshotKind: "guided_goal_setup" },
 	);

package/src/internal-urls/history-protocol.ts

@@ -5,14 +5,22 @@
  * in-memory message array; parked refs (session disposed, sessionFile
  * retained) load read-only from the JSONL session file — no writer, no lock.
  *
+ * Agents that are no longer in the `AgentRegistry` — one-shot helpers
+ * unregistered after `finalizeSubagentLifecycle` (`keepAlive: false`, e.g. the
+ * `eval` `agent()` bridge), agents released via the Agent Hub / vibe kill, or
+ * any agent after a session resume — remain reachable: `resolve`, `complete`,
+ * and the index all fall back to scanning artifacts dirs for `<id>.jsonl`,
+ * mirroring how `agent://` reads `.md` outputs straight off disk.
+ *
  * URL forms:
- * - history:// - Index of all registry agents (id, status, kind, last activity)
+ * - history:// - Index of all registry + on-disk agents (id, status, kind, last activity)
  * - history://<agentId> - Concise markdown transcript of that agent
  */
 import type { AgentRef } from "../registry/agent-registry";
 import { AgentRegistry } from "../registry/agent-registry";
 import { formatSessionHistoryMarkdown } from "../session/session-history-format";
 import { loadSessionMessagesReadOnly } from "../session/session-loader";
+import { sessionFilesFromDisk } from "./registry-helpers";
 import type { InternalResource, InternalUrl, ProtocolHandler, UrlCompletion } from "./types";
 
 /** Humanize a last-activity timestamp as `Ns/Nm/Nh/Nd ago`. */
@@ -27,11 +35,21 @@ function formatAgo(timestamp: number): string {
 	return `${Math.floor(hours / 24)}d ago`;
 }
 
+/** One row of the history index — either a registered ref or a disk-only transcript. */
+interface IndexEntry {
+	id: string;
+	status: string;
+	kind: string;
+	parent: string;
+	lastActivity: string;
+}
+
 /**
  * Handler for history:// URLs.
  *
- * Resolves agent ids against the global AgentRegistry, serving transcripts
- * for both live and parked agents.
+ * Resolves agent ids against the global AgentRegistry, then falls back to
+ * on-disk `.jsonl` transcripts, serving read-only history for live, parked,
+ * and unregistered agents alike.
  */
 export class HistoryProtocolHandler implements ProtocolHandler {
 	readonly scheme = "history";
@@ -45,7 +63,7 @@ export class HistoryProtocolHandler implements ProtocolHandler {
 		const visible = registry.list().filter(ref => ref.kind !== "advisor");
 
 		if (!agentId) {
-			const content = this.#renderIndex(visible);
+			const content = await this.#renderIndex(visible);
 			return {
 				url: url.href,
 				content,
@@ -61,7 +79,13 @@ export class HistoryProtocolHandler implements ProtocolHandler {
 			const lower = agentId.toLowerCase();
 			ref = visible.find(candidate => candidate.id.toLowerCase() === lower);
 		}
+
 		if (!ref) {
+			// Registry miss — the agent may have been unregistered or lost on resume.
+			// Serve its transcript straight from disk if the session file persists.
+			const disk = await this.#resolveFromDisk(agentId);
+			if (disk) return { ...disk, url: url.href };
+
 			const known = visible.map(candidate => candidate.id);
 			const knownStr = known.length > 0 ? known.join(", ") : "none";
 			throw new Error(`Unknown agent: ${agentId}\nKnown agents: ${knownStr}\nList all with history://`);
@@ -76,6 +100,10 @@ export class HistoryProtocolHandler implements ProtocolHandler {
 			messages = await loadSessionMessagesReadOnly(ref.sessionFile);
 			notes.push(`Source: session file (read-only, ${ref.status})`);
 		} else {
+			// No live session and no retained sessionFile — try the disk scan before
+			// giving up, in case the transcript lingers under an artifacts dir.
+			const disk = await this.#resolveFromDisk(ref.id);
+			if (disk) return { ...disk, url: url.href };
 			throw new Error(`Agent ${ref.id} has no transcript: session is gone and no session file was retained`);
 		}
 
@@ -90,29 +118,81 @@ export class HistoryProtocolHandler implements ProtocolHandler {
 		};
 	}
 
-	#renderIndex(refs: AgentRef[]): string {
+	/**
+	 * Load a transcript for `agentId` from an on-disk `.jsonl` session file,
+	 * matched case-insensitively. Returns `undefined` when no file is found.
+	 */
+	async #resolveFromDisk(agentId: string): Promise<InternalResource | undefined> {
+		const files = await sessionFilesFromDisk();
+		const lower = agentId.toLowerCase();
+		let matchedId: string | undefined;
+		let sessionFile: string | undefined;
+		for (const [id, file] of files) {
+			if (id === agentId || id.toLowerCase() === lower) {
+				matchedId = id;
+				sessionFile = file;
+				if (id === agentId) break;
+			}
+		}
+		if (!matchedId || !sessionFile) return undefined;
+		const messages = await loadSessionMessagesReadOnly(sessionFile);
+		const content = formatSessionHistoryMarkdown(messages, { title: `${matchedId} (on disk)` });
+		return {
+			url: "",
+			content,
+			contentType: "text/markdown",
+			size: Buffer.byteLength(content, "utf-8"),
+			sourcePath: sessionFile,
+			notes: ["Source: session file (read-only, unregistered)"],
+		};
+	}
+
+	async #renderIndex(refs: AgentRef[]): Promise<string> {
+		const entries: IndexEntry[] = refs.map(ref => ({
+			id: ref.id,
+			status: ref.status,
+			kind: ref.kind,
+			parent: ref.parentId ?? "—",
+			lastActivity: formatAgo(ref.lastActivity),
+		}));
+		// Merge on-disk transcripts for agents absent from the registry.
+		const registered = new Set(refs.map(ref => ref.id));
+		const disk = await sessionFilesFromDisk();
+		for (const id of disk.keys()) {
+			if (registered.has(id)) continue;
+			entries.push({ id, status: "on disk", kind: "—", parent: "—", lastActivity: "—" });
+		}
+
 		const lines: string[] = ["# Agents", ""];
-		if (refs.length === 0) {
+		if (entries.length === 0) {
 			lines.push("No agents registered.");
 			return `${lines.join("\n")}\n`;
 		}
 		lines.push("| id | status | kind | parent | last activity |", "|---|---|---|---|---|");
-		for (const ref of refs) {
-			lines.push(
-				`| ${ref.id} | ${ref.status} | ${ref.kind} | ${ref.parentId ?? "—"} | ${formatAgo(ref.lastActivity)} |`,
-			);
+		for (const entry of entries) {
+			lines.push(`| ${entry.id} | ${entry.status} | ${entry.kind} | ${entry.parent} | ${entry.lastActivity} |`);
 		}
 		lines.push("", "Read a transcript with `read history://<id>`.");
 		return `${lines.join("\n")}\n`;
 	}
 
 	async complete(): Promise<UrlCompletion[]> {
-		return AgentRegistry.global()
-			.list()
-			.filter(ref => ref.kind !== "advisor")
-			.map(ref => ({
+		const completions: UrlCompletion[] = [];
+		const seen = new Set<string>();
+		for (const ref of AgentRegistry.global().list()) {
+			if (ref.kind === "advisor") continue;
+			seen.add(ref.id);
+			completions.push({
 				value: ref.id,
 				description: `${ref.status} · ${ref.kind}${ref.parentId ? ` · parent ${ref.parentId}` : ""}`,
-			}));
+			});
+		}
+		const disk = await sessionFilesFromDisk();
+		for (const id of disk.keys()) {
+			if (seen.has(id)) continue;
+			seen.add(id);
+			completions.push({ value: id, description: "on disk" });
+		}
+		return completions;
 	}
 }

package/src/internal-urls/registry-helpers.ts

@@ -2,6 +2,11 @@
  * Shared helpers for internal-url protocol handlers that resolve IDs against
  * registered agent sessions.
  */
+
+import type { Dirent } from "node:fs";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { isEnoent } from "@oh-my-pi/pi-utils";
 import { AgentRegistry } from "../registry/agent-registry";
 
 const extraArtifactsDirs = new Set<string>();
@@ -35,9 +40,53 @@ export function artifactsDirsFromRegistry(): string[] {
 		if (!dirs.includes(dir)) dirs.push(dir);
 	};
 	for (const ref of AgentRegistry.global().list()) {
-		addDir(ref.session?.sessionManager.getArtifactsDir());
+		addDir(ref.session?.sessionManager?.getArtifactsDir());
 		if (ref.sessionFile) addDir(ref.sessionFile.slice(0, -6));
 	}
 	for (const dir of extraArtifactsDirs) addDir(dir);
 	return dirs;
 }
+
+/**
+ * Recursively scan artifacts dirs for agent session transcripts, keyed by
+ * agent id (the `.jsonl` basename). Used by `history://` so transcripts of
+ * agents no longer in the registry (unregistered one-shot helpers, released
+ * agents, or any agent after session resume) remain reachable — mirroring how
+ * `agent://` reads `.md` outputs straight off disk.
+ *
+ * Layout follows `task/index.ts`: a subagent's transcript is
+ * `<artifactsDir>/<AgentId>.jsonl`, and its own children nest one level deeper
+ * under `<artifactsDir>/<AgentId>/<AgentId>.<ChildId>.jsonl`. Advisor
+ * transcripts (`__advisor*.jsonl`) are observability-only and excluded;
+ * EPERM-rewrite backups (`.bak`) are skipped. When the same id appears in
+ * multiple dirs, the first hit wins (registry dirs are scanned first).
+ */
+export async function sessionFilesFromDisk(): Promise<Map<string, string>> {
+	const found = new Map<string, string>();
+	const seenDirs = new Set<string>();
+	const scan = async (dir: string, depth: number): Promise<void> => {
+		if (depth > 8 || seenDirs.has(dir)) return;
+		seenDirs.add(dir);
+		let entries: Dirent[];
+		try {
+			entries = await fs.readdir(dir, { withFileTypes: true });
+		} catch (err) {
+			if (isEnoent(err) || (err as NodeJS.ErrnoException).code === "ENOTDIR") return;
+			throw err;
+		}
+		for (const entry of entries) {
+			if (entry.isDirectory()) {
+				await scan(path.join(dir, entry.name), depth + 1);
+				continue;
+			}
+			if (!entry.isFile()) continue;
+			const name = entry.name;
+			if (!name.endsWith(".jsonl")) continue;
+			if (name.startsWith("__advisor")) continue;
+			const id = name.slice(0, -".jsonl".length);
+			if (!found.has(id)) found.set(id, path.join(dir, name));
+		}
+	};
+	for (const dir of artifactsDirsFromRegistry()) await scan(dir, 0);
+	return found;
+}

package/src/launch/broker.ts

@@ -84,9 +84,6 @@ interface DaemonLogRead {
 function quoteShellArg(value: string): string {
 	return `'${value.replaceAll("'", `'\\''`)}'`;
 }
-function quoteCmdArg(value: string): string {
-	return `"${value.replaceAll('"', '""')}"`;
-}
 
 function terminalState(state: DaemonSnapshot["state"]): boolean {
 	return state === "exited" || state === "failed";
@@ -434,6 +431,13 @@ class DaemonBroker {
 		if (spec.detached && spec.pty) {
 			throw new Error("A detached daemon cannot allocate a PTY");
 		}
+		if (
+			spec.pty &&
+			process.platform === "win32" &&
+			[".bat", ".cmd"].includes(path.extname(spec.application).toLowerCase())
+		) {
+			throw new Error('Windows batch files require application "cmd.exe" with the batch path after "/c"');
+		}
 		const existing = this.#records.get(spec.name);
 		if (existing) await this.#refreshDetached(existing);
 		if (existing && !terminalState(existing.snapshot.state)) {
@@ -520,38 +524,47 @@ class DaemonBroker {
 	}
 
 	async #launchPty(record: ManagedDaemon, generation: number): Promise<void> {
-		const pidPath = path.join(record.dir, "process.pid");
-		await fs.rm(pidPath, { force: true });
-		const argv = [record.spec.application, ...record.spec.args];
-		const command =
-			process.platform === "win32"
-				? argv.map(quoteCmdArg).join(" ")
-				: [`printf '%s' "$$" > ${quoteShellArg(pidPath)}`, `exec ${argv.map(quoteShellArg).join(" ")}`].join("; ");
 		const session = new PtySession();
 		record.pty = session;
-		const shell = process.platform === "win32" ? process.env.COMSPEC : process.env.SHELL;
-		void session
-			.start(
+		const options = {
+			cwd: record.spec.cwd,
+			env: workerEnvFromParent({ TERM: "xterm-256color", ...record.spec.env }),
+			cols: DAEMON_PTY_COLUMNS,
+			rows: DAEMON_PTY_ROWS,
+		};
+		const onChunk = (error: Error | null, chunk: string): void => {
+			if (generation !== record.generation) return;
+			if (error) record.log?.append(`PTY output error: ${error.message}\n`);
+			if (chunk) this.#onOutput(record, generation, chunk);
+		};
+		let run: Promise<PtyRunResult>;
+		if (process.platform === "win32") {
+			run = session.startArgv(
 				{
-					command,
-					cwd: record.spec.cwd,
-					env: workerEnvFromParent({ TERM: "xterm-256color", ...record.spec.env }),
-					cols: DAEMON_PTY_COLUMNS,
-					rows: DAEMON_PTY_ROWS,
-					shell,
+					application: record.spec.application,
+					args: record.spec.args,
+					...options,
 				},
-				(error, chunk) => {
-					if (generation !== record.generation) return;
-					if (error) record.log?.append(`PTY output error: ${error.message}\n`);
-					if (chunk) this.#onOutput(record, generation, chunk);
-				},
-			)
+				onChunk,
+			);
+		} else {
+			const pidPath = path.join(record.dir, "process.pid");
+			await fs.rm(pidPath, { force: true });
+			const argv = [record.spec.application, ...record.spec.args];
+			const command = [
+				`printf '%s' "$$" > ${quoteShellArg(pidPath)}`,
+				`exec ${argv.map(quoteShellArg).join(" ")}`,
+			].join("; ");
+			run = session.start({ command, shell: process.env.SHELL, ...options }, onChunk);
+		}
+		void run
 			.then(result => this.#onPtyExit(record, generation, result))
 			.catch(error =>
 				this.#settle(record, generation, undefined, error instanceof Error ? error.message : String(error)),
 			);
 
 		if (process.platform === "win32") return;
+		const pidPath = path.join(record.dir, "process.pid");
 		const deadline = Date.now() + 5_000;
 		const pidFile = Bun.file(pidPath);
 		while (Date.now() < deadline && generation === record.generation) {

package/src/mcp/oauth-discovery.ts

@@ -11,10 +11,23 @@ export interface OAuthEndpoints {
 	authorizationUrl: string;
 	tokenUrl: string;
 	clientId?: string;
+	/** Dynamic client registration endpoint advertised by the authorization server. */
+	registrationUrl?: string;
 	scopes?: string;
 	resource?: string;
 }
 
+function readRegistrationUrl(metadata: Record<string, unknown>): string | undefined {
+	const value =
+		metadata.registration_endpoint ??
+		metadata.registrationEndpoint ??
+		metadata.registration_url ??
+		metadata.registrationUrl ??
+		metadata.registration_uri ??
+		metadata.registrationUri;
+	return typeof value === "string" && value.trim() !== "" ? value : undefined;
+}
+
 export interface AuthDetectionResult {
 	requiresAuth: boolean;
 	authType?: "oauth" | "apikey" | "unknown";
@@ -102,7 +115,7 @@ export function extractOAuthEndpoints(error: Error): OAuthEndpoints | null {
 			(obj.resource_uri as string | undefined) ||
 			(obj.resourceUri as string | undefined);
 
-		return { authorizationUrl, tokenUrl, clientId, scopes, resource };
+		return { authorizationUrl, tokenUrl, registrationUrl: readRegistrationUrl(obj), clientId, scopes, resource };
 	};
 
 	const clientIdFromAuthUrl = (authorizationUrl: string): string | undefined => {
@@ -175,6 +188,10 @@ export function extractOAuthEndpoints(error: Error): OAuthEndpoints | null {
 			return {
 				authorizationUrl,
 				tokenUrl,
+				registrationUrl:
+					challengeValues.get("registration_endpoint") ||
+					challengeValues.get("registration_url") ||
+					challengeValues.get("registration_uri"),
 				clientId: challengeValues.get("client_id") || clientIdFromAuthUrl(authorizationUrl),
 				scopes: challengeValues.get("scope") || challengeValues.get("scopes") || scopeFromAuthUrl(authorizationUrl),
 				resource,
@@ -415,6 +432,7 @@ export async function discoverOAuthEndpoints(
 			return {
 				authorizationUrl: String(metadata.authorization_endpoint),
 				tokenUrl: String(metadata.token_endpoint),
+				registrationUrl: readRegistrationUrl(metadata),
 				clientId:
 					typeof metadata.client_id === "string"
 						? metadata.client_id
@@ -438,6 +456,7 @@ export async function discoverOAuthEndpoints(
 				return {
 					authorizationUrl: oauthData.authorization_url || String(oauthData.authorizationUrl),
 					tokenUrl: oauthData.token_url || String(oauthData.tokenUrl),
+					registrationUrl: readRegistrationUrl(oauthData),
 					clientId:
 						typeof oauthData.client_id === "string"
 							? oauthData.client_id