@oh-my-pi/pi-coding-agent 17.0.8 → 17.0.9

package/dist/types/task/types.d.ts

@@ -83,6 +83,7 @@ export declare const taskItemSchema: import("arktype/internal/variants/object.ts
     name?: string | undefined;
     agent: import("arktype/internal/attributes.ts").Default<string, "task">;
     task: string;
+    model?: string | string[] | undefined;
     outputSchema?: string | boolean | object | null | undefined;
     schemaMode?: "permissive" | "strict" | undefined;
 }, {}>;
@@ -94,6 +95,8 @@ export interface TaskItem {
     agent?: string;
     /** The work; required by the schema. */
     task?: string;
+    /** Explicit model selector or fallback chain for this spawn, including optional reasoning suffixes. */
+    model?: string | string[];
     /** Caller-provided output schema; its presence overrides the selected agent's schema. */
     outputSchema?: unknown;
     /** Validation behavior for a caller-provided or inherited output schema. */
@@ -105,6 +108,7 @@ export declare const taskSchema: import("arktype/internal/variants/object.ts").O
     name?: string | undefined;
     agent: import("arktype/internal/attributes.ts").Default<string, "task">;
     task: string;
+    model?: string | string[] | undefined;
     outputSchema?: string | boolean | object | null | undefined;
     schemaMode?: "permissive" | "strict" | undefined;
     isolated?: boolean | undefined;
@@ -113,6 +117,7 @@ declare const ALL_TASK_SCHEMAS: readonly [import("arktype/internal/variants/obje
     name?: string | undefined;
     agent: import("arktype/internal/attributes.ts").Default<string, "task">;
     task: string;
+    model?: string | string[] | undefined;
     outputSchema?: string | boolean | object | null | undefined;
     schemaMode?: "permissive" | "strict" | undefined;
     isolated?: boolean | undefined;
@@ -120,6 +125,7 @@ declare const ALL_TASK_SCHEMAS: readonly [import("arktype/internal/variants/obje
     name?: string | undefined;
     agent: import("arktype/internal/attributes.ts").Default<string, "task">;
     task: string;
+    model?: string | string[] | undefined;
     outputSchema?: string | boolean | object | null | undefined;
     schemaMode?: "permissive" | "strict" | undefined;
 }, {}>, import("arktype/internal/variants/object.ts").ObjectType<{
@@ -128,6 +134,7 @@ declare const ALL_TASK_SCHEMAS: readonly [import("arktype/internal/variants/obje
         name?: string | undefined;
         agent: import("arktype/internal/attributes.ts").Default<string, "task">;
         task: string;
+        model?: string | string[] | undefined;
         outputSchema?: string | boolean | object | null | undefined;
         schemaMode?: "permissive" | "strict" | undefined;
         isolated?: boolean | undefined;
@@ -138,6 +145,7 @@ declare const ALL_TASK_SCHEMAS: readonly [import("arktype/internal/variants/obje
         name?: string | undefined;
         agent: import("arktype/internal/attributes.ts").Default<string, "task">;
         task: string;
+        model?: string | string[] | undefined;
         outputSchema?: string | boolean | object | null | undefined;
         schemaMode?: "permissive" | "strict" | undefined;
     }[];
@@ -168,6 +176,8 @@ export interface TaskParams {
     agent?: string;
     /** The work (flat form). */
     task?: string;
+    /** Explicit model selector or fallback chain for the spawn, including optional reasoning suffixes. */
+    model?: string | string[];
     /** Caller-provided output schema; its presence overrides the selected agent's schema. */
     outputSchema?: unknown;
     /** Validation behavior for a caller-provided or inherited output schema. */
@@ -291,6 +301,8 @@ export interface AgentProgress {
     modelOverride?: string | string[];
     /** Resolved model display string in the form `<provider>/<id>`, optionally suffixed with `:<thinkingLevel>` when the level was set explicitly. Undefined when the model could not be resolved. */
     resolvedModel?: string;
+    /** True when {@link resolvedModel} is the target of an active retry fallback (not the originally configured model). Lets observer-only UIs (collab guests, Agent Hub rows with no live session) flag the fallback and keep the provider. */
+    resolvedModelIsFallback?: boolean;
     /** Data extracted by registered subprocess tool handlers (keyed by tool name) */
     extractedToolData?: Record<string, unknown[]>;
     /**
@@ -357,6 +369,8 @@ export interface SingleResult {
     modelOverride?: string | string[];
     /** Resolved model display string in the form `<provider>/<id>`, optionally suffixed with `:<thinkingLevel>` when the level was set explicitly. Omitted from tool-result JSON when undefined to keep wire payloads small. */
     resolvedModel?: string;
+    /** True when {@link resolvedModel} is the target of an active retry fallback. Mirrors {@link AgentProgress.resolvedModelIsFallback} onto the settled result. */
+    resolvedModelIsFallback?: boolean;
     error?: string;
     aborted?: boolean;
     abortReason?: string;

package/dist/types/tools/hub/jobs.d.ts

@@ -55,7 +55,7 @@ export declare function noMatchingJobsResult(session: ToolSession, ids: string[]
 /** Bare `wait` with no running jobs and nobody who could message: nothing to block on. */
 export declare function nothingToWaitForResult(session: ToolSession): AgentToolResult<CoordinationDetails>;
 /** `cancel`: kill the named jobs; returns immediately with outcomes + snapshots. */
-export declare function executeCancel(session: ToolSession, manager: AsyncJobManager, ownerId: string | undefined, ids: string[]): AgentToolResult<CoordinationDetails>;
+export declare function executeCancel(session: ToolSession, manager: AsyncJobManager, ownerId: string | undefined, ids: string[]): Promise<AgentToolResult<CoordinationDetails>>;
 /** `jobs`: read-only snapshot of every job plus the jobless running-agent roster. */
 export declare function executeJobsSnapshot(session: ToolSession, manager: AsyncJobManager, ownerId: string | undefined): AgentToolResult<CoordinationDetails>;
 /** Pending-call frame for job ops (wait/cancel/jobs). */

package/dist/types/tools/index.d.ts

@@ -13,6 +13,7 @@ import type { LocalProtocolOptions } from "../internal-urls/index.js";
 import type { MCPManager } from "../mcp/index.js";
 import type { MnemopiSessionState } from "../mnemopi/state.js";
 import type { PlanModeState } from "../plan-mode/state.js";
+import type { AgentLifecycleManager } from "../registry/agent-lifecycle.js";
 import type { AgentRegistry } from "../registry/agent-registry.js";
 import type { ArtifactManager } from "../session/artifacts.js";
 import type { ClientBridge } from "../session/client-bridge.js";
@@ -200,6 +201,8 @@ export interface ToolSession {
     xdevRegistry?: XdevRegistry;
     /** Agent registry for IRC routing across live sessions. */
     agentRegistry?: AgentRegistry;
+    /** Idle→parked→revive lifecycle owner; lets the hub kill a non-job-backed agent registration. Default: AgentLifecycleManager.global(). */
+    agentLifecycle?: () => AgentLifecycleManager;
     /** Get artifacts directory for artifact:// URLs */
     getArtifactsDir?: () => string | null;
     /** Get the ArtifactManager backing this session (shared across parent + subagents). */

package/dist/types/tools/report-tool-issue.d.ts

@@ -5,16 +5,21 @@
  * `xd://report_issue`, and the system prompt tells the model to write
  * `<tool>: <concise description>` there when auto-QA is enabled.
  *
- * Enabled by default; gated behind PI_AUTO_QA=1 / `dev.autoqa` so a user who
- * flips the setting off short-circuits injection entirely.
+ * Enabled by default (`dev.autoqa` defaults to true); `PI_AUTO_QA=0` or an
+ * explicit `dev.autoqa: false` short-circuits injection entirely. When the
+ * user is only enabled by default (never configured `dev.autoqa` themselves),
+ * a persisted `dev.autoqaConsent: "denied"` also disables injection so a "No"
+ * in the consent dialog fully turns the feature off.
  * Records grievances to a local SQLite database; never throws from the device
  * dispatch path.
  *
- * Before the first record lands, the user's consent is checked. If they've
- * never been asked (`dev.autoqaConsent === "unset"`) the process-global
- * consent handler — wired by `InteractiveMode` to a Yes/No popup — is invoked
- * exactly once and the decision is persisted. Subsequent calls (including from
- * subagents) read the cached decision without prompting.
+ * Nothing is written until consent resolves. If the user has never been asked
+ * (`dev.autoqaConsent === "unset"`) the process-global consent handler —
+ * wired by `InteractiveMode` to a Yes/No popup — is invoked exactly once and
+ * the decision is persisted; a denial (or dismissal) drops the pending report
+ * without touching the database. Subsequent calls (including from subagents)
+ * read the cached decision without prompting. `PI_AUTO_QA_PUSH=1` bypasses
+ * the dialog for headless environments.
  *
  * When the user grants consent, push is automatically active against the
  * bundled endpoint (`dev.autoqaPush.endpoint`, default `qa.omp.sh`). Each
@@ -42,6 +47,14 @@ export declare function isReportIssueToolCall(toolCall: {
 }): boolean;
 /** Call preview for an `xd://report_issue` write. */
 export declare function renderReportIssueDeviceCall(content: unknown, uiTheme: Theme): Component;
+/**
+ * Whether Auto-QA is active for this session.
+ *
+ * Precedence: `PI_AUTO_QA` env flag > explicit `dev.autoqa` setting >
+ * default-on unless the user previously denied consent. The denial veto only
+ * applies to the default: explicitly configuring `dev.autoqa: true` re-enables
+ * injection (recording still no-ops until consent is granted).
+ */
 export declare function isAutoQaEnabled(settings?: Settings): boolean;
 /**
  * Resolver for the user's "share grievances?" consent.
@@ -82,8 +95,8 @@ export declare function __resetAutoQaConsentForTests(): void;
 export declare function resolveAutoQaConsent(settings: Settings | undefined): Promise<boolean>;
 /**
  * Open (or return the cached handle for) the auto-QA SQLite database at
- * `~/.omp/agent/autoqa.db`, creating the schema lazily. Returns `null` when
- * the agent data dir cannot be resolved.
+ * `~/.omp/autoqa.db` (XDG: `$XDG_DATA_HOME/omp/autoqa.db`), creating the
+ * schema lazily. Returns `null` when the path cannot be resolved or opened.
  */
 export declare function openAutoQaDb(): Database | null;
 export interface FlushResult {
@@ -127,6 +140,8 @@ export declare function __resetAutoQaFlushStateForTests(): void;
  * Flush queued grievances to the configured backend.
  */
 export declare function flushGrievances(db?: Database, settings?: Settings, options?: FlushOptions): Promise<FlushResult>;
+/** Test-only: await the last consent → insert → flush pipeline. */
+export declare function __awaitAutoQaRecordPipelineForTests(): Promise<void>;
 /**
  * Execute `write xd://report_issue`. `text` must be either:
  * - `<tool>: <concise description>` on one line, or

package/dist/types/web/search/providers/firecrawl.d.ts

@@ -23,6 +23,15 @@ export declare function searchFirecrawl(params: SearchParams): Promise<SearchRes
 export declare class FirecrawlProvider extends SearchProvider {
     readonly id = "firecrawl";
     readonly label = "Firecrawl";
+    /**
+     * Auto-chain admission: requires a credential so an unconfigured Firecrawl
+     * doesn't displace other providers that the user has set up with API keys.
+     */
     isAvailable(authStorage: AuthStorage): boolean;
+    /**
+     * Firecrawl supports keyless mode, so an explicit user selection
+     * (`webSearch: firecrawl`) works without any credential configured.
+     */
+    isExplicitlyAvailable(_authStorage: AuthStorage): boolean;
     search(params: SearchParams): Promise<SearchResponse>;
 }

package/dist/types/web/search/types.d.ts

@@ -54,7 +54,7 @@ export declare const SEARCH_PROVIDER_OPTIONS: readonly [{
 }, {
     readonly value: "firecrawl";
     readonly label: "Firecrawl";
-    readonly description: "Requires FIRECRAWL_API_KEY";
+    readonly description: "Uses Firecrawl API when FIRECRAWL_API_KEY is set; falls back to keyless mode";
 }, {
     readonly value: "brave";
     readonly label: "Brave";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.0.8",
+	"version": "17.0.9",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -51,18 +51,19 @@
 	"dependencies": {
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.7",
+		"@babel/traverse": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.0.8",
-		"@oh-my-pi/omp-stats": "17.0.8",
-		"@oh-my-pi/pi-agent-core": "17.0.8",
-		"@oh-my-pi/pi-ai": "17.0.8",
-		"@oh-my-pi/pi-catalog": "17.0.8",
-		"@oh-my-pi/pi-mnemopi": "17.0.8",
-		"@oh-my-pi/pi-natives": "17.0.8",
-		"@oh-my-pi/pi-tui": "17.0.8",
-		"@oh-my-pi/pi-utils": "17.0.8",
-		"@oh-my-pi/pi-wire": "17.0.8",
-		"@oh-my-pi/snapcompact": "17.0.8",
+		"@oh-my-pi/hashline": "17.0.9",
+		"@oh-my-pi/omp-stats": "17.0.9",
+		"@oh-my-pi/pi-agent-core": "17.0.9",
+		"@oh-my-pi/pi-ai": "17.0.9",
+		"@oh-my-pi/pi-catalog": "17.0.9",
+		"@oh-my-pi/pi-mnemopi": "17.0.9",
+		"@oh-my-pi/pi-natives": "17.0.9",
+		"@oh-my-pi/pi-tui": "17.0.9",
+		"@oh-my-pi/pi-utils": "17.0.9",
+		"@oh-my-pi/pi-wire": "17.0.9",
+		"@oh-my-pi/snapcompact": "17.0.9",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/scripts/legacy-pi-virtual-module.ts

@@ -19,7 +19,7 @@ const BUNDLED_PACKAGES: readonly BundledPackage[] = [
 	{ dir: "ai", identifier: "PiAi", rootShim: "legacy-pi-ai-shim.ts" },
 	{ dir: "coding-agent", identifier: "PiCodingAgent", rootShim: "legacy-pi-coding-agent-shim.ts" },
 	{ dir: "natives", identifier: "PiNatives", rootShim: null },
-	{ dir: "tui", identifier: "PiTui", rootShim: null },
+	{ dir: "tui", identifier: "PiTui", rootShim: "legacy-pi-tui-shim.ts" },
 	{ dir: "utils", identifier: "PiUtils", rootShim: null },
 ];
 

package/src/cli/grievances-cli.ts

@@ -41,7 +41,7 @@ export async function listGrievances(options: ListGrievancesOptions): Promise<vo
 			console.log("[]");
 		} else {
 			console.log(
-				chalk.dim("No grievances database found. Enable auto-QA with PI_AUTO_QA=1 or the dev.autoqa setting."),
+				chalk.dim("No grievances database found. Auto-QA has not recorded any reports yet (or was disabled)."),
 			);
 		}
 		return;
@@ -110,7 +110,7 @@ export async function cleanGrievances(options: CleanGrievancesOptions): Promise<
 			console.log(JSON.stringify({ deleted: 0 }));
 		} else {
 			console.log(
-				chalk.dim("No grievances database found. Enable auto-QA with PI_AUTO_QA=1 or the dev.autoqa setting."),
+				chalk.dim("No grievances database found. Auto-QA has not recorded any reports yet (or was disabled)."),
 			);
 		}
 		return;

package/src/cli/usage-cli.ts

@@ -409,7 +409,7 @@ function formatLimitLine(limit: UsageLimit, labelWidth: number, nowMs: number):
 	const details: string[] = [describeAmount(limit)];
 	const resetsAt = limit.window?.resetsAt;
 	if (resetsAt !== undefined && resetsAt > nowMs) {
-		details.push(`resets in ${formatDuration(resetsAt - nowMs)}`);
+		details.push(`${limit.window?.resetLabel ?? "resets"} in ${formatDuration(resetsAt - nowMs)}`);
 	}
 	const lines = [
 		`      ${STATUS_COLOR[status]("●")} ${padded}  ${renderBar(limit)}  ${chalk.dim(details.join(" · "))}`,

package/src/config/__tests__/model-registry.test.ts

@@ -0,0 +1,147 @@
+import { afterEach, beforeEach, describe, expect, test, vi } from "bun:test";
+import { mkdtempSync, rmSync } from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import type { AuthStorage } from "@oh-my-pi/pi-ai";
+import { ModelRegistry } from "../model-registry";
+
+/**
+ * Stub AuthStorage that satisfies the surface used by ModelRegistry's
+ * constructor (#loadModels → clearConfigApiKeys, constructor →
+ * setFallbackResolver). The awaiter under test never reaches auth-gated code
+ * paths, so no real credential store is required.
+ */
+function createStubAuthStorage(): AuthStorage {
+	const stub = {
+		setFallbackResolver: () => {},
+		clearConfigApiKeys: () => {},
+		hasAuth: () => false,
+	};
+	return stub as unknown as AuthStorage;
+}
+
+describe("ModelRegistry.awaitBackgroundRefresh", () => {
+	let tmpDir: string;
+	let registry: ModelRegistry;
+
+	beforeEach(() => {
+		tmpDir = mkdtempSync(path.join(os.tmpdir(), "omp-reg-"));
+		// Construct with an explicit modelsPath inside the temp dir so the
+		// constructor's #loadModels read returns "not-found" rather than
+		// touching the host's ~/.omp/agent/models.yaml. isBunTestRuntime()
+		// auto-stubs #fetch in the constructor.
+		registry = new ModelRegistry(createStubAuthStorage(), path.join(tmpDir, "models.yaml"));
+	});
+
+	afterEach(() => {
+		vi.restoreAllMocks();
+		rmSync(tmpDir, { recursive: true, force: true });
+	});
+
+	test("resolves immediately when no background refresh is in flight", async () => {
+		// No refreshInBackground() called → #backgroundRefresh is undefined.
+		// The awaiter must settle within a single microtask, never hanging.
+		let settled = false;
+		const p = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+		await Promise.resolve();
+		await p;
+		expect(settled).toBe(true);
+	});
+
+	test("blocks until the in-flight background refresh resolves, then resolves", async () => {
+		// Drive refreshInBackground with a controlled refresh() return value so
+		// #backgroundRefresh is captured but not yet settled.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		const refreshSpy = vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		expect(refreshSpy).toHaveBeenCalledTimes(1);
+
+		let settled = false;
+		const awaitPromise = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+
+		// Yield to the microtask queue: the awaiter must still be pending.
+		for (let i = 0; i < 5; i++) await Promise.resolve();
+		expect(settled).toBe(false);
+
+		resolve();
+
+		await awaitPromise;
+		expect(settled).toBe(true);
+	});
+
+	test("resolves even when the underlying refresh rejects (refreshInBackground swallows)", async () => {
+		// refreshInBackground wraps refresh() in .catch(...) so discovery errors
+		// never reach awaitBackgroundRefresh callers. The awaiter must resolve,
+		// not propagate the rejection.
+		const { promise, reject } = Promise.withResolvers<void>();
+		vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+
+		let settled = false;
+		const awaitPromise = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+
+		reject(new Error("synthetic discovery failure"));
+
+		await awaitPromise;
+		expect(settled).toBe(true);
+	});
+
+	test("awaiter is a no-op after the in-flight refresh settles and clears #backgroundRefresh", async () => {
+		// Once refreshInBackground's promise resolves, #backgroundRefresh is
+		// cleared in the .finally. A subsequent awaitBackgroundRefresh must be
+		// an immediate no-op (microtask), not hang waiting for a stale promise
+		// or a second refresh that was never started.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		resolve();
+		await registry.awaitBackgroundRefresh();
+
+		// Now #backgroundRefresh is cleared. A fresh await must resolve in a
+		// single microtask — measure by asserting it settles before a second
+		// microtask tick.
+		let settled = false;
+		const p = registry.awaitBackgroundRefresh().then(() => {
+			settled = true;
+		});
+		await Promise.resolve();
+		expect(settled).toBe(true);
+		await p;
+	});
+
+	test("refreshInBackground deduplicates: a second call while in-flight starts no new refresh", async () => {
+		// The guard `if (this.#backgroundRefresh) return` at the top of
+		// refreshInBackground prevents concurrent refreshes. A second call
+		// while the first is still pending must not invoke refresh() again.
+		const { promise, resolve } = Promise.withResolvers<void>();
+		const refreshSpy = vi.spyOn(registry, "refresh").mockReturnValue(promise);
+
+		registry.refreshInBackground();
+		registry.refreshInBackground();
+		registry.refreshInBackground();
+
+		expect(refreshSpy).toHaveBeenCalledTimes(1);
+
+		resolve();
+		await registry.awaitBackgroundRefresh();
+
+		// After settle, #backgroundRefresh is cleared — a new call DOES start
+		// a fresh refresh.
+		const { promise: secondPromise, resolve: secondResolve } = Promise.withResolvers<void>();
+		refreshSpy.mockReturnValue(secondPromise);
+		registry.refreshInBackground();
+		expect(refreshSpy).toHaveBeenCalledTimes(2);
+
+		secondResolve();
+		await registry.awaitBackgroundRefresh();
+	});
+});

package/src/config/model-registry.ts

@@ -869,6 +869,28 @@ export class ModelRegistry {
 		this.#backgroundRefresh = refreshPromise;
 	}
 
+	/**
+	 * Wait for any in-flight background model discovery to settle.
+	 *
+	 * Background discovery started by {@link refreshInBackground} is
+	 * fire-and-forget; RPC consumers (e.g. `get_available_models`,
+	 * `set_model`) and deferred `--model` resolution that read the registry
+	 * immediately after session creation can otherwise observe a partial
+	 * catalog before discovery-backed providers have populated `#models`.
+	 * Awaiting the tracked promise ensures the response reflects every
+	 * configured provider once the initial background refresh resolves.
+	 *
+	 * No-op when no refresh is in flight (`#backgroundRefresh` cleared in the
+	 * `finally` of `refreshInBackground` on completion). Resolves immediately
+	 * in that case so already-warm sessions are unaffected. Discovery errors
+	 * remain swallowed by `refreshInBackground`'s existing `.catch`.
+	 */
+	async awaitBackgroundRefresh(): Promise<void> {
+		if (this.#backgroundRefresh) {
+			await this.#backgroundRefresh;
+		}
+	}
+
 	async refreshProvider(providerId: string, strategy: ModelRefreshStrategy = "online"): Promise<void> {
 		this.#reloadStaticModels();
 		for (const selector of this.#suppressedSelectors.keys()) {
@@ -2101,6 +2123,24 @@ export class ModelRegistry {
 			.map(provider => provider.provider);
 	}
 
+	/**
+	 * Whether `providerId` is known to the registry: it has at least one live
+	 * model, or it is configured for dynamic discovery (models.yml `discovery:`
+	 * or a runtime extension provider) and is not disabled. Discovery-only
+	 * providers can hold zero models at startup — cached rows never persist
+	 * live auth headers (#5780), so a provider whose discovered models all
+	 * carry config headers (`authHeader: true`) only materializes models after
+	 * the online refresh completes.
+	 */
+	hasProvider(providerId: string): boolean {
+		if (this.#models.some(model => model.provider === providerId)) return true;
+		if (getDisabledProviderIdsFromSettings().has(providerId)) return false;
+		return (
+			this.#discoverableProviders.some(provider => provider.provider === providerId) ||
+			this.#runtimeModelManagers.has(providerId)
+		);
+	}
+
 	getProviderDiscoveryState(provider: string): ProviderDiscoveryState | undefined {
 		return this.#providerDiscoveryStates.get(provider);
 	}

package/src/config/model-resolver.ts

@@ -782,7 +782,6 @@ function parseModelPatternWithContext(
 	options?: { allowInvalidThinkingSelectorFallback?: boolean },
 ): ParsedModelResult {
 	// Exact match on the full pattern first (no fuzzy): a literal id that
-	// contains a colon (`coding-router:max`) wins over any suffix split.
 	const exactMatch = matchModel(pattern, availableModels, context, { exactOnly: true });
 	if (exactMatch) {
 		return { model: exactMatch, thinkingLevel: undefined, warning: undefined, explicitThinkingLevel: false };

package/src/config/settings-schema.ts

@@ -207,6 +207,8 @@ interface UiNumber extends UiBase {
 }
 
 interface UiString extends UiBase {
+	/** Mask the value in both the settings row and text editor. */
+	secret?: boolean;
 	/**
 	 * Submenu options.
 	 *  - Array  → submenu with these choices.
@@ -219,6 +221,7 @@ interface UiString extends UiBase {
 /** Wide ui shape exposed to consumers that walk the schema generically. */
 export type AnyUiMetadata = UiBase & {
 	options?: ReadonlyArray<SubmenuOption> | "runtime";
+	secret?: boolean;
 };
 
 interface BooleanDef {
@@ -2753,7 +2756,18 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
-	"hindsight.apiToken": { type: "string", default: undefined },
+	"hindsight.apiToken": {
+		type: "string",
+		default: undefined,
+		ui: {
+			tab: "memory",
+			group: "Hindsight",
+			label: "Hindsight API Token",
+			description: "Bearer token for authenticated Hindsight servers",
+			condition: "hindsightActive",
+			secret: true,
+		},
+	},
 
 	"hindsight.bankId": {
 		type: "string",
@@ -3945,6 +3959,17 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"mcp.renderMarkdownResults": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "tools",
+			group: "Discovery & MCP",
+			label: "MCP Markdown Results",
+			description: "Render non-JSON MCP text results as Markdown in the transcript",
+		},
+	},
+
 	"mcp.notifications": {
 		type: "boolean",
 		default: false,
@@ -4089,6 +4114,18 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"task.isolation.apply": {
+		type: "boolean",
+		default: true,
+		ui: {
+			tab: "tasks",
+			group: "Isolation",
+			label: "Apply Isolated Changes",
+			description:
+				"Automatically apply successful isolated task changes to the parent checkout; disable to retain patch or branch artifacts",
+		},
+	},
+
 	"task.isolation.merge": {
 		type: "enum",
 		values: ["patch", "branch"] as const,
@@ -5032,12 +5069,13 @@ export const SETTINGS_SCHEMA = {
 
 	"dev.autoqa": {
 		type: "boolean",
-		default: false,
+		default: true,
 		ui: {
 			tab: "tools",
 			group: "Developer",
 			label: "Auto QA",
-			description: "Enable automated tool issue reporting (report_tool_issue) for all agents",
+			description:
+				"Automated tool issue reporting (xd://report_issue). On by default; the first report asks for consent, and denying it disables reporting until re-enabled explicitly",
 		},
 	},
 

package/src/extensibility/legacy-pi-coding-agent-shim.ts

@@ -1362,4 +1362,5 @@ export function getPackageDir(): string {
 
 export * from "../index";
 export { formatBytes as formatSize } from "../tools/render-utils";
+export { copyToClipboard } from "../utils/clipboard";
 export { Type } from "./typebox";

package/src/extensibility/legacy-pi-tui-shim.ts

@@ -0,0 +1,10 @@
+/**
+ * Compatibility shim for legacy extensions importing the package root of
+ * `@earendil-works/pi-tui` or `@mariozechner/pi-tui`.
+ *
+ * The historical root exported `decodeKittyPrintable`; the canonical TUI now
+ * exposes the equivalent, broader `decodePrintableKey` helper. Keep the legacy
+ * name available without reintroducing it into the canonical package surface.
+ */
+export * from "@oh-my-pi/pi-tui";
+export { decodePrintableKey as decodeKittyPrintable } from "@oh-my-pi/pi-tui";