@oh-my-pi/pi-coding-agent 17.0.1 → 17.0.3

package/src/tools/read.ts

@@ -36,7 +36,7 @@ import {
 import { normalizeToLF } from "../edit/normalize";
 import { isNotebookPath, readEditableNotebookText } from "../edit/notebook";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
-import { InternalUrlRouter, resolveLocalUrlToFile } from "../internal-urls";
+import { InternalUrlRouter, resolveLocalUrlToFile, resolveLocalUrlToPath } from "../internal-urls";
 import { type ResolvedArtifactFile, resolveArtifactFile } from "../internal-urls/artifact-protocol";
 import { parseInternalUrl } from "../internal-urls/parse";
 import type { InternalUrl } from "../internal-urls/types";
@@ -62,7 +62,7 @@ import {
 	MAX_IMAGE_INPUT_BYTES,
 	webpExclusionForModel,
 } from "../utils/image-loading";
-import { convertFileWithMarkit } from "../utils/markit";
+import { CONVERTIBLE_EXTENSIONS, convertFileWithMarkit } from "../utils/markit";
 import { type ArchiveReader, formatArchiveEntryLines, openArchive, parseArchivePathCandidates } from "../utils/zip";
 import { buildDirectoryTree, type DirectoryTree } from "../workspace-tree";
 import {
@@ -78,7 +78,7 @@ import {
 } from "./conflict-detect";
 import {
 	executeReadUrl,
-	loadReadUrlCacheEntry,
+	fetchReadUrl,
 	parseReadUrlTarget,
 	type ReadUrlToolDetails,
 	renderReadUrlCall,
@@ -151,9 +151,6 @@ function getSummaryParseCache(session: object): LRUCache<string, SummaryResult |
 	return cache;
 }
 
-// Document types converted to markdown via markit.
-const CONVERTIBLE_EXTENSIONS = new Set([".pdf", ".doc", ".docx", ".ppt", ".pptx", ".xls", ".xlsx", ".rtf", ".epub"]);
-
 const MAX_SUMMARY_BYTES = 2 * 1024 * 1024;
 const MAX_SUMMARY_LINES = 20_000;
 const MAX_ARTIFACT_RAW_INLINE_BYTES = DEFAULT_MAX_BYTES;
@@ -920,6 +917,32 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 		});
 	}
 
+	/**
+	 * Recover the active approved plan when a model rewrites its `local://` URL
+	 * as a same-basename path in the working-directory root.
+	 *
+	 * Only missing cwd-root paths qualify, so a real working-tree file always
+	 * wins and unrelated paths cannot escape into the session artifact sandbox.
+	 */
+	#approvedPlanAlias(missingAbsolutePath: string): string | undefined {
+		const planReferencePath = this.session.getPlanReferencePath?.();
+		if (!planReferencePath?.startsWith("local:")) return undefined;
+
+		const requestedPath = path.resolve(missingAbsolutePath);
+		if (path.dirname(requestedPath) !== path.resolve(this.session.cwd)) return undefined;
+
+		const localProtocolOptions = this.session.localProtocolOptions ?? {
+			getArtifactsDir: () => this.session.getArtifactsDir?.() ?? null,
+			getSessionId: () => this.session.getSessionId?.() ?? null,
+		};
+		try {
+			const approvedPlanPath = resolveLocalUrlToPath(planReferencePath, localProtocolOptions);
+			return path.basename(requestedPath) === path.basename(approvedPlanPath) ? approvedPlanPath : undefined;
+		} catch {
+			return undefined;
+		}
+	}
+
 	async #tryReadDelimitedPaths(
 		readPath: string,
 		signal?: AbortSignal,
@@ -2141,15 +2164,12 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			const urlRaw = parsedUrlTarget.raw;
 			const urlRanges = parsedUrlTarget.ranges;
 			if (urlRanges !== undefined && urlRanges.length > 1) {
-				const cached = await loadReadUrlCacheEntry(
-					this.session,
-					{ path: parsedUrlTarget.path, raw: urlRaw },
-					signal,
-					{ ensureArtifact: true, preferCached: true },
-				);
-				return this.#buildInMemoryMultiRangeResult(cached.output, urlRanges, {
-					details: { ...cached.details },
-					sourceUrl: cached.details.finalUrl,
+				const entry = await fetchReadUrl(this.session, { path: parsedUrlTarget.path, raw: urlRaw }, signal, {
+					ensureArtifact: true,
+				});
+				return this.#buildInMemoryMultiRangeResult(entry.output, urlRanges, {
+					details: { ...entry.details },
+					sourceUrl: entry.details.finalUrl,
 					entityLabel: "URL output",
 					raw: urlRaw,
 					immutable: true,
@@ -2158,18 +2178,12 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			const urlOffset = parsedUrlTarget.offset;
 			const urlLimit = parsedUrlTarget.limit;
 			if (urlOffset !== undefined || urlLimit !== undefined) {
-				const cached = await loadReadUrlCacheEntry(
-					this.session,
-					{ path: parsedUrlTarget.path, raw: urlRaw },
-					signal,
-					{
-						ensureArtifact: true,
-						preferCached: true,
-					},
-				);
-				return this.#buildInMemoryTextResult(cached.output, urlOffset, urlLimit, {
-					details: { ...cached.details },
-					sourceUrl: cached.details.finalUrl,
+				const entry = await fetchReadUrl(this.session, { path: parsedUrlTarget.path, raw: urlRaw }, signal, {
+					ensureArtifact: true,
+				});
+				return this.#buildInMemoryTextResult(entry.output, urlOffset, urlLimit, {
+					details: { ...entry.details },
+					sourceUrl: entry.details.finalUrl,
 					entityLabel: "URL output",
 					raw: urlRaw,
 					immutable: true,
@@ -2292,7 +2306,8 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 			isDirectory = stat.isDirectory();
 		} catch (error) {
 			if (isNotFoundError(error)) {
-				// Attempt unique suffix resolution before falling back to fuzzy suggestions
+				// Attempt unique suffix resolution before falling back to the approved-plan
+				// alias or fuzzy suggestions. Existing workspace files retain precedence.
 				if (!isRemoteMountPath(absolutePath)) {
 					const suffixMatch = await this.#findSuffixMatchCached(suffixCache, localReadPath, signal);
 					if (suffixMatch) {
@@ -2303,12 +2318,30 @@ export class ReadTool implements AgentTool<typeof readSchema, ReadToolDetails> {
 							isDirectory = retryStat.isDirectory();
 							suffixResolution = { from: localReadPath, to: suffixMatch.displayPath };
 						} catch {
-							// Suffix match candidate no longer stats — fall through to error path
+							// Suffix match candidate no longer stats — continue through
+							// approved-plan recovery and the original not-found error.
 						}
 					}
 				}
 
+				let recoveredApprovedPlan = false;
 				if (!suffixResolution) {
+					const approvedPlanPath = this.#approvedPlanAlias(absolutePath);
+					if (approvedPlanPath) {
+						try {
+							const approvedPlanStat = await Bun.file(approvedPlanPath).stat();
+							absolutePath = approvedPlanPath;
+							fileSize = approvedPlanStat.size;
+							isDirectory = approvedPlanStat.isDirectory();
+							recoveredApprovedPlan = true;
+						} catch {
+							// The referenced plan disappeared after resolution; continue through
+							// the ordinary delimited-path fallback and not-found error.
+						}
+					}
+				}
+
+				if (!recoveredApprovedPlan && !suffixResolution) {
 					const delimitedResult = await this.#tryReadDelimitedPaths(readPath, signal);
 					if (delimitedResult) return delimitedResult;
 					throw new ToolError(`Path '${localReadPath}' not found`);

package/src/tools/todo.ts

@@ -12,7 +12,7 @@ import type { ToolSession } from "../sdk";
 import type { SessionEntry } from "../session/session-entries";
 import { framedBlock, renderStatusLine, renderTreeList } from "../tui";
 import { normalizePathLikeInput, resolveToCwd } from "./path-utils";
-import { formatErrorDetail, PREVIEW_LIMITS } from "./render-utils";
+import { formatErrorDetail, formatMoreItems, PREVIEW_LIMITS, pluralize } from "./render-utils";
 
 // =============================================================================
 // Types
@@ -214,6 +214,80 @@ export function todoMatchesAnyDescription(content: string, descriptions: readonl
 	return false;
 }
 
+/**
+ * A todo the collapsed viewport treats as current work: the literal
+ * `in_progress` task or a pending task a live subagent is executing. Both
+ * collapsed views (transient tool result + sticky HUD) run this same policy so
+ * they can never disagree about what the agent is doing (#5873).
+ */
+function isActiveTodo<T extends { status: TodoStatus }>(task: T, isMatched: (task: T) => boolean): boolean {
+	return task.status === "in_progress" || (task.status === "pending" && isMatched(task));
+}
+
+/** Result of {@link selectCollapsedTodos}: the rows to render plus an optional
+ *  summary line (empty string ⇒ no summary row). */
+export interface CollapsedTodoSelection<T> {
+	items: T[];
+	summary: string;
+}
+
+/**
+ * Walking-viewport selection for a phase's collapsed todo preview (#5873).
+ *
+ * Policy, applied to `tasks` in todo order:
+ * 1. While the phase has open work, completed/abandoned tasks are omitted. A
+ *    phase with no open tasks left falls back to its closed tasks so the sticky
+ *    HUD's closed-todo persistence still has something to render.
+ * 2. Every active task (in-progress, or pending matched to a live subagent) is
+ *    placed at the head in stable todo order — never dropped for lying outside
+ *    an ordinary window.
+ * 3. Remaining rows up to `cap` are filled with the pending tasks that follow
+ *    the first active one, in todo order (falling back to leading pending tasks
+ *    when no active task exists), so a freshly-promoted task leads the preview.
+ * 4. When active tasks alone exceed `cap`, only the first `cap` active tasks are
+ *    shown and the summary counts the hidden *active* todos, never replacing
+ *    them with unrelated pending rows.
+ *
+ * The summary otherwise counts the remaining tasks in the display base. Returns
+ * the whole base with an empty summary when it already fits.
+ */
+export function selectCollapsedTodos<T extends { status: TodoStatus }>(
+	tasks: T[],
+	isMatched: (task: T) => boolean,
+	cap: number,
+): CollapsedTodoSelection<T> {
+	const open = tasks.filter(task => task.status === "pending" || task.status === "in_progress");
+	// No open work: fall back to the closed tasks so a settled phase still
+	// renders (HUD closed-todo persistence). Closed tasks are never active.
+	const base = open.length > 0 ? open : tasks;
+	if (base.length <= cap) return { items: base, summary: "" };
+
+	const active = base.filter(task => isActiveTodo(task, isMatched));
+	// Only when active work strictly exceeds the cap do we drop pending rows and
+	// count hidden *actives*. At exactly `cap` actives, fall through so the normal
+	// branch still surfaces any following pending work in the summary.
+	if (active.length > cap) {
+		const hiddenActive = active.length - cap;
+		return {
+			items: active.slice(0, cap),
+			summary: `… ${hiddenActive} more active ${pluralize("todo", hiddenActive)}`,
+		};
+	}
+
+	// Fill trailing rows with tasks following the first active one, so the
+	// promoted/current task leads and its successors follow in todo order.
+	const firstActiveIdx = active.length > 0 ? base.indexOf(active[0]) : 0;
+	const fill: T[] = [];
+	for (let i = firstActiveIdx; i < base.length && active.length + fill.length < cap; i++) {
+		const task = base[i];
+		if (isActiveTodo(task, isMatched)) continue;
+		fill.push(task);
+	}
+	const items = [...active, ...fill];
+	const hidden = base.length - items.length;
+	return { items, summary: hidden > 0 ? formatMoreItems(hidden, "todo") : "" };
+}
+
 function resolveTaskOrError(
 	phases: TodoPhase[],
 	content: string | undefined,
@@ -755,6 +829,7 @@ function formatTodoLine(
 	prefix: string,
 	completionKeys: Set<string>,
 	frame: number | undefined,
+	matched = false,
 ): string {
 	const checkbox = uiTheme.checkbox;
 	switch (item.status) {
@@ -771,7 +846,9 @@ function formatTodoLine(
 		case "abandoned":
 			return uiTheme.fg("error", `${prefix}${checkbox.unchecked} ${strikethroughText(item.content)}`);
 		default:
-			return uiTheme.fg("dim", `${prefix}${checkbox.unchecked} ${item.content}`);
+			// A pending todo lit by a live subagent match renders accent, matching
+			// the sticky HUD's convention (#5873).
+			return uiTheme.fg(matched ? "accent" : "dim", `${prefix}${checkbox.unchecked} ${item.content}`);
 	}
 }
 
@@ -822,6 +899,21 @@ function formatPhaseSummary(phase: TodoPhase, oneBasedIndex: number, uiTheme: Th
 	return `${name}${uiTheme.fg("dim", `  ${done}/${total}`)}`;
 }
 
+/**
+ * Live subagent descriptions the transient tool result uses to detect
+ * pending todos being executed by an in-flight subagent, so its collapsed
+ * viewport surfaces the same active work the sticky HUD does (#5873). Wired
+ * once by interactive mode from its observer registry; returns `[]` outside an
+ * interactive session (tests, SDK, transcript rebuilds), where only literal
+ * `in_progress` counts as active.
+ */
+let activeTodoDescriptionsProvider: () => readonly string[] = () => [];
+
+/** Wire the live-subagent description source for {@link todoToolRenderer}. */
+export function setActiveTodoDescriptionsProvider(provider: () => readonly string[]): void {
+	activeTodoDescriptionsProvider = provider;
+}
+
 export const todoToolRenderer = {
 	renderCall(args: TodoRenderArgs, options: RenderResultOptions, uiTheme: Theme): Component {
 		// `args` is the raw partially-parsed JSON from the streaming tool-call
@@ -903,6 +995,12 @@ export const todoToolRenderer = {
 			// a single task flip doesn't redraw every phase's full task list. The
 			// manual expand toggle (and the no-signal fallback) still shows all.
 			const touched = expanded || !multiPhase ? null : computeTouchedPhases(args, phases, completedTasks);
+			// A pending todo counts as active work when an in-flight subagent is
+			// executing it — the transient result surfaces the same active set the
+			// sticky HUD does (#5873). Empty outside an interactive session.
+			const activeDescs = expanded ? [] : activeTodoDescriptionsProvider();
+			const isMatched = (task: TodoItem): boolean =>
+				activeDescs.length > 0 && todoMatchesAnyDescription(task.content, activeDescs);
 			const bodyLines: string[] = [];
 			for (let p = 0; p < phases.length; p++) {
 				const phase = phases[p];
@@ -914,17 +1012,32 @@ export const todoToolRenderer = {
 					bodyLines.push(uiTheme.fg("accent", chalk.bold(formatPhaseDisplayName(phase.name, p + 1))));
 				}
 				const completionKeys = completionKeysByPhase.get(phase.name) ?? EMPTY_COMPLETION_KEYS;
-				const treeLines = renderTreeList(
-					{
-						items: phase.tasks,
-						expanded,
-						maxCollapsed: PREVIEW_LIMITS.COLLAPSED_ITEMS,
-						itemType: "todo",
-						truncateFrom: "start",
-						renderItem: todo => formatTodoLine(todo, uiTheme, "", completionKeys, spinnerFrame),
-					},
-					uiTheme,
-				);
+				// Collapsed: walking viewport — completed/abandoned omitted, active
+				// work (in-progress / subagent-matched) pulled to the head, then
+				// following pending tasks (#5873). Expanded: every task in order.
+				const treeLines = expanded
+					? renderTreeList(
+							{
+								items: phase.tasks,
+								expanded,
+								itemType: "todo",
+								renderItem: todo => formatTodoLine(todo, uiTheme, "", completionKeys, spinnerFrame),
+							},
+							uiTheme,
+						)
+					: (() => {
+							const selection = selectCollapsedTodos(phase.tasks, isMatched, PREVIEW_LIMITS.COLLAPSED_ITEMS);
+							return renderTreeList(
+								{
+									items: selection.items,
+									itemType: "todo",
+									trailingSummary: selection.summary,
+									renderItem: todo =>
+										formatTodoLine(todo, uiTheme, "", completionKeys, spinnerFrame, isMatched(todo)),
+								},
+								uiTheme,
+							);
+						})();
 				for (const line of treeLines) {
 					bodyLines.push(`${indent}${line}`);
 				}

package/src/tools/write.ts

@@ -36,7 +36,7 @@ import {
 	writeArchive,
 } from "../utils/zip";
 import { routeWriteThroughBridge } from "./acp-bridge";
-import { truncateForPrompt } from "./approval";
+import { resolveToolTier, truncateForPrompt } from "./approval";
 import { assertEditableFile } from "./auto-generated-guard";
 import {
 	type ConflictEntry,
@@ -398,9 +398,27 @@ export class WriteTool implements AgentTool<typeof writeSchema, WriteToolDetails
 			if (xdevTarget.name === REPORT_ISSUE_DEVICE_NAME) return "write";
 			if (xdevTarget.name && isResolutionDeviceName(xdevTarget.name)) return "read";
 			const inst = xdevTarget.name ? this.session.xdevRegistry?.get(xdevTarget.name) : undefined;
-			const decision = typeof inst?.approval === "function" ? undefined : inst?.approval;
-			const tier = typeof decision === "object" ? decision?.tier : decision;
-			return tier ?? "exec";
+			if (!inst) return "exec";
+			// Decode the device JSON payload and evaluate the mounted tool's own
+			// approval (which may be argument-dependent, e.g. ast_edit is read-tier
+			// for internal-URL paths, debug is read-tier for inspection actions).
+			// Malformed JSON, non-object payloads, missing content, and approval
+			// functions that reject schema-invalid objects stay exec so the gate
+			// fails closed — the dispatch itself rejects invalid arguments too.
+			const rawContent = (args as Partial<WriteParams>).content;
+			if (typeof rawContent !== "string") return "exec";
+			let parsed: unknown;
+			try {
+				parsed = JSON.parse(rawContent);
+			} catch {
+				return "exec";
+			}
+			if (!isRecord(parsed)) return "exec";
+			try {
+				return resolveToolTier(inst, parsed);
+			} catch {
+				return "exec";
+			}
 		}
 		// Remote SSH writes open an outbound connection and run a remote shell —
 		// gate them like the exec-tier `ssh` tool, ahead of the handler-write

package/src/tools/xdev.ts

@@ -44,15 +44,26 @@ import { ToolError } from "./tool-errors";
  */
 export const XDEV_KEEP_TOP_LEVEL: Record<string, true> = { todo: true, ask: true, grep: true };
 
+/**
+ * Tools that carry the `xd://` transport itself and therefore can never be
+ * mounted as devices: `read xd://` lists/documents devices and
+ * `write xd://<tool>` executes them. Demoting either leaves every mounted
+ * device unreachable (issue #5764), so they stay top-level regardless of a
+ * declared `loadMode`.
+ */
+export const XDEV_TRANSPORT_TOOLS: Record<string, true> = { read: true, write: true };
+
 /**
  * Whether an enabled tool is presented under `xd://` (rather than top-level)
  * while the `xd://` transport is active. Discoverable tools mount unless they
- * are pinned top-level by {@link XDEV_KEEP_TOP_LEVEL}; essential tools never do.
- * The caller gates this on the transport being active (a session-owned
+ * are pinned top-level by {@link XDEV_KEEP_TOP_LEVEL} or carry the transport
+ * itself ({@link XDEV_TRANSPORT_TOOLS}); essential tools never do. The caller
+ * gates this on the transport being active (a session-owned
  * {@link XdevRegistry} existing).
  */
 export function isMountableUnderXdev(tool: { name: string; loadMode?: ToolLoadMode }): boolean {
-	return tool.loadMode === "discoverable" && !(tool.name in XDEV_KEEP_TOP_LEVEL);
+	if (tool.name in XDEV_TRANSPORT_TOOLS || tool.name in XDEV_KEEP_TOP_LEVEL) return false;
+	return tool.loadMode === "discoverable";
 }
 
 /** Dispatch metadata carried on write-tool details for renderer delegation. */

package/src/tui/tree-list.ts

@@ -18,6 +18,13 @@ export interface TreeListOptions<T> {
 	maxCollapsedLines?: number;
 	itemType?: string;
 	truncateFrom?: "start" | "end";
+	/** Caller-supplied trailing summary line. When set (and not expanded),
+	 *  `renderTreeList` renders exactly the provided `items` (the caller has
+	 *  already applied its own selection/cap) and appends this text as the
+	 *  final `└` row, with the last item using `├`. Empty string renders the
+	 *  items with no summary. Bypasses the built-in truncation/`maxCollapsed`
+	 *  path. */
+	trailingSummary?: string;
 	/** Called once per item with `isLast: false` during budget calculation;
 	 *  line count MUST NOT vary based on `isLast`. */
 	renderItem: (item: T, context: TreeContext) => string | string[];
@@ -36,6 +43,38 @@ export function renderTreeList<T>(options: TreeListOptions<T>, theme: Theme): st
 	const maxItems = expanded ? items.length : Math.min(items.length, maxCollapsed);
 	const linesBudget = !expanded && maxCollapsedLines !== undefined ? maxCollapsedLines : Infinity;
 
+	// Caller-driven collapse: render exactly the provided items (the caller
+	// already picked/capped them) plus an optional trailing summary row. The
+	// walking-viewport todo policy uses this so item selection lives in the
+	// todo domain, not here.
+	if (!expanded && options.trailingSummary !== undefined) {
+		const summary = options.trailingSummary;
+		const lines: string[] = [];
+		for (let i = 0; i < items.length; i++) {
+			const rendered = renderItem(items[i], {
+				index: i,
+				isLast: false,
+				depth: 0,
+				theme,
+				prefix: "",
+				continuePrefix: "",
+			});
+			const itemLines = Array.isArray(rendered) ? rendered : rendered ? [rendered] : [];
+			if (itemLines.length === 0) continue;
+			const isLast = summary === "" && i === items.length - 1;
+			const prefix = `${theme.fg("dim", getTreeBranch(isLast, theme))} `;
+			const continuePrefix = `${theme.fg("dim", getTreeContinuePrefix(isLast, theme))}`;
+			lines.push(`${prefix}${replaceTabs(itemLines[0]!)}`);
+			for (let j = 1; j < itemLines.length; j++) {
+				lines.push(`${continuePrefix}${replaceTabs(itemLines[j]!)}`);
+			}
+		}
+		if (summary !== "") {
+			lines.push(`${theme.fg("dim", theme.tree.last)} ${theme.fg("muted", summary)}`);
+		}
+		return lines;
+	}
+
 	const candidateIndices: number[] = [];
 	if (truncateFrom === "start") {
 		const startCandidateIdx = Math.max(0, items.length - maxItems);

package/src/utils/markit.ts

@@ -10,6 +10,18 @@ import {
 } from "./markit-cache";
 import { loadEmbeddedMupdfWasm } from "./mupdf-wasm-embed";
 
+/**
+ * File extensions markit can actually convert to markdown — one per registered
+ * converter in `src/markit/registry.ts` (pdf, docx, pptx, xlsx, epub). This is
+ * the single source of truth shared by the read, fetch, and CLI file tools so
+ * the advertised set never drifts from the converters that back it. Legacy
+ * binary formats (`.doc`, `.ppt`, `.xls`, `.rtf`) are intentionally absent:
+ * markit has no converter for them, so routing them here only produced an
+ * `Unsupported format` error instead of letting them fall through to the
+ * binary-file handling.
+ */
+export const CONVERTIBLE_EXTENSIONS: ReadonlySet<string> = new Set([".pdf", ".docx", ".pptx", ".xlsx", ".epub"]);
+
 export interface MarkitConversionResult {
 	content: string;
 	ok: boolean;

package/src/utils/title-generator.ts

@@ -68,6 +68,7 @@ function getTitleModel(registry: ModelRegistry, settings: Settings, currentModel
  *   resolver instead of a pre-evaluated value ensures the metadata's account_uuid
  *   reflects the credential actually selected for this request.
  * @param customSystemPrompt Optional title-specific system prompt override
+ * @param signal Session-lifecycle cancellation for background title requests
  */
 export async function generateSessionTitle(
 	firstMessage: string,
@@ -77,6 +78,7 @@ export async function generateSessionTitle(
 	currentModel?: Model<Api>,
 	metadataResolver?: (provider: string) => Record<string, unknown> | undefined,
 	customSystemPrompt?: string,
+	signal?: AbortSignal,
 ): Promise<string | null> {
 	// Defer titling for greetings / acknowledgements / empty input. The default
 	// tiny title model can't reliably decline trivial input, so this happens
@@ -97,7 +99,7 @@ export async function generateSessionTitle(
 			sessionId,
 			currentModel,
 			metadataResolver,
-			undefined,
+			signal,
 			titleSystemPrompt,
 		);
 	}
@@ -117,9 +119,18 @@ export async function generateSessionTitle(
 		return null;
 	}
 	try {
-		const localTitle = titleSystemPrompt
-			? await tinyTitleClient.generate(tinyModel, firstMessage, { systemPrompt: titleSystemPrompt })
-			: await tinyTitleClient.generate(tinyModel, firstMessage);
+		let localTitle: string | null;
+		if (signal) {
+			localTitle = await tinyTitleClient.generate(
+				tinyModel,
+				firstMessage,
+				titleSystemPrompt ? { signal, systemPrompt: titleSystemPrompt } : { signal },
+			);
+		} else if (titleSystemPrompt) {
+			localTitle = await tinyTitleClient.generate(tinyModel, firstMessage, { systemPrompt: titleSystemPrompt });
+		} else {
+			localTitle = await tinyTitleClient.generate(tinyModel, firstMessage);
+		}
 		if (!localTitle) {
 			logger.warn("title-generator: local tiny model produced no title; skipping (no online fallback)", {
 				sessionId,

package/src/utils/zip.ts

@@ -233,12 +233,27 @@ function ensureParentDirectories(map: Map<string, ArchiveIndexEntry>): void {
 	}
 }
 
+/**
+ * Extensions that are ZIP containers under a different name — JVM (`.jar`,
+ * `.war`, `.ear`) and Android (`.apk`) packages are all ZIP archives. Treated
+ * as `zip` for member read/list and whole-archive rewrite.
+ */
+const ZIP_ALIAS_EXTENSIONS = ["jar", "war", "ear", "apk"] as const;
+
+/**
+ * Regex alternation of every recognized archive extension, longest first so
+ * `.tar.gz` wins over `.tar`. Shared with `parseArchivePathCandidates` as its
+ * split pattern so extension recognition and path splitting never drift.
+ */
+const ARCHIVE_EXTENSION_ALTERNATION = ["tar\\.gz", "tgz", "zip", "tar", ...ZIP_ALIAS_EXTENSIONS].join("|");
+
 /** Infer an archive format from a filesystem path's extension. */
 export function archiveFormatFromPath(filePath: string): ArchiveFormat | undefined {
 	const normalized = filePath.toLowerCase();
 	if (normalized.endsWith(".tar.gz") || normalized.endsWith(".tgz")) return "tar.gz";
 	if (normalized.endsWith(".tar")) return "tar";
 	if (normalized.endsWith(".zip")) return "zip";
+	if (ZIP_ALIAS_EXTENSIONS.some(ext => normalized.endsWith(`.${ext}`))) return "zip";
 	return undefined;
 }
 
@@ -635,7 +650,7 @@ async function readZipEntries(source: ByteSource): Promise<ArchiveIndexEntry[]>
  */
 export function parseArchivePathCandidates(filePath: string): ArchivePathCandidate[] {
 	const normalized = filePath.replace(/\\/g, "/");
-	const pattern = /\.(?:tar\.gz|tgz|zip|tar)(?=(?::|$))/gi;
+	const pattern = new RegExp(`\\.(?:${ARCHIVE_EXTENSION_ALTERNATION})(?=(?::|$))`, "gi");
 	const seen = new Set<string>();
 	const candidates: ArchivePathCandidate[] = [];
 

package/src/web/search/providers/kimi.ts

@@ -1,7 +1,10 @@
 /**
  * Kimi Web Search Provider
  *
- * Uses Moonshot Kimi Code search API to retrieve web results.
+ * Uses the Kimi Code search API to retrieve web results. This is the Kimi Code
+ * membership service, distinct from the Moonshot Open Platform — it requires a
+ * Kimi Code Console credential (`omp /login kimi-code` or an explicit
+ * `MOONSHOT_SEARCH_API_KEY` / `KIMI_SEARCH_API_KEY`), not `MOONSHOT_API_KEY`.
  * Endpoint: POST https://api.kimi.com/coding/v1/search
  */
 import { type ApiKey, type AuthStorage, type FetchImpl, withAuth } from "@oh-my-pi/pi-ai";
@@ -58,11 +61,17 @@ function resolveBaseUrl(): string {
 }
 
 /**
- * Resolve the Kimi search credential. Highest precedence is the static env key;
- * otherwise an AuthStorage-backed resolver for whichever stored provider id
- * holds a key (`moonshot` first, then `kimi-code`), so a stale token triggers
- * the central force-refresh / sibling-rotate retry. Returns `undefined` when
- * neither is configured.
+ * Resolve the Kimi Code search credential. Highest precedence is the explicit
+ * search-key env override; otherwise an AuthStorage-backed resolver for a
+ * stored `kimi-code` credential (from `omp /login kimi-code`), so a stale token
+ * triggers the central force-refresh / sibling-rotate retry. Returns
+ * `undefined` when neither is configured.
+ *
+ * The endpoint (`https://api.kimi.com/coding/v1/search`) is the Kimi Code
+ * membership service, which has a different credential system from the Moonshot
+ * Open Platform (`https://api.moonshot.ai`). A stored `moonshot` credential
+ * (or `MOONSHOT_API_KEY`) is NOT accepted here — it 401s against Kimi Code
+ * (issue #5762).
  */
 async function resolveKey(
 	authStorage: AuthStorage,
@@ -72,10 +81,8 @@ async function resolveKey(
 	const envKey = asTrimmed($env.MOONSHOT_SEARCH_API_KEY) ?? asTrimmed($env.KIMI_SEARCH_API_KEY);
 	if (envKey) return envKey;
 
-	for (const provider of ["moonshot", "kimi-code"] as const) {
-		const stored = await authStorage.getApiKey(provider, sessionId, { signal });
-		if (stored) return authStorage.resolver(provider, { sessionId });
-	}
+	const stored = await authStorage.getApiKey("kimi-code", sessionId, { signal });
+	if (stored) return authStorage.resolver("kimi-code", { sessionId });
 	return undefined;
 }
 
@@ -127,7 +134,7 @@ export async function searchKimi(params: KimiSearchParams): Promise<SearchRespon
 	const keyOrResolver = await resolveKey(params.authStorage, params.sessionId, params.signal);
 	if (!keyOrResolver) {
 		throw new Error(
-			"Kimi search credentials not found. Set MOONSHOT_SEARCH_API_KEY, KIMI_SEARCH_API_KEY, MOONSHOT_API_KEY, or login with 'omp /login moonshot'.",
+			"Kimi search credentials not found. Kimi web search uses the Kimi Code service (api.kimi.com); set MOONSHOT_SEARCH_API_KEY / KIMI_SEARCH_API_KEY to a Kimi Code Console key, or login with 'omp /login kimi-code'. A Moonshot Open Platform key (MOONSHOT_API_KEY) is not accepted here.",
 		);
 	}
 
@@ -176,7 +183,6 @@ export class KimiProvider extends SearchProvider {
 		return (
 			!!asTrimmed($env.MOONSHOT_SEARCH_API_KEY) ||
 			!!asTrimmed($env.KIMI_SEARCH_API_KEY) ||
-			authStorage.hasAuth("moonshot") ||
 			authStorage.hasAuth("kimi-code")
 		);
 	}

package/src/web/search/types.ts

@@ -39,7 +39,12 @@ export const SEARCH_PROVIDER_OPTIONS = [
 	{ value: "tavily", label: "Tavily", description: "Requires TAVILY_API_KEY" },
 	{ value: "firecrawl", label: "Firecrawl", description: "Requires FIRECRAWL_API_KEY" },
 	{ value: "brave", label: "Brave", description: "Requires BRAVE_API_KEY" },
-	{ value: "kimi", label: "Kimi", description: "Requires MOONSHOT_SEARCH_API_KEY or MOONSHOT_API_KEY" },
+	{
+		value: "kimi",
+		label: "Kimi",
+		description:
+			"Kimi Code search (requires a Kimi Code Console key via KIMI_SEARCH_API_KEY/MOONSHOT_SEARCH_API_KEY or /login kimi-code; not MOONSHOT_API_KEY)",
+	},
 	{ value: "parallel", label: "Parallel", description: "Requires PARALLEL_API_KEY" },
 	{ value: "synthetic", label: "Synthetic", description: "Requires SYNTHETIC_API_KEY" },
 	{ value: "searxng", label: "SearXNG", description: "Requires SEARXNG_ENDPOINT or searxng.endpoint" },