@oh-my-pi/pi-coding-agent 17.1.0 → 17.1.1

package/dist/types/tools/computer.d.ts

@@ -0,0 +1,71 @@
+import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback, ToolApprovalDecision } from "@oh-my-pi/pi-agent-core";
+import type { ComputerAction } from "@oh-my-pi/pi-ai";
+import type { DesktopCapabilities, DesktopCapture, DesktopDisplay, DesktopSessionOptions } from "@oh-my-pi/pi-natives";
+import { type ComputerController } from "./computer/supervisor.js";
+import type { ToolSession } from "./index.js";
+declare const computerSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    actions?: {
+        type: "click" | "double_click" | "drag" | "keypress" | "move" | "screenshot" | "scroll" | "type" | "wait";
+        x?: number | undefined;
+        y?: number | undefined;
+        button?: "back" | "forward" | "left" | "right" | "wheel" | undefined;
+        path?: {
+            x: number;
+            y: number;
+        }[] | undefined;
+        keys?: string[] | null | undefined;
+        scroll_x?: number | undefined;
+        scroll_y?: number | undefined;
+        text?: string | undefined;
+    }[] | undefined;
+}, {}>;
+export type ComputerParams = typeof computerSchema.infer;
+export interface ComputerToolDetails {
+    width: number;
+    height: number;
+    backend: DesktopCapture["backend"];
+    displayServer?: string;
+    capturePermission: string;
+    inputPermission: string;
+    displays: DesktopDisplay[];
+    capabilities?: DesktopCapabilities;
+    actions: ComputerAction["type"][];
+}
+export type ComputerControllerFactory = (options: DesktopSessionOptions) => ComputerController;
+export declare function computerApproval(args: unknown): ToolApprovalDecision;
+export declare class ComputerTool implements AgentTool<typeof computerSchema, ComputerToolDetails> {
+    #private;
+    readonly session: ToolSession;
+    readonly name = "computer";
+    readonly native: {
+        readonly type: "computer";
+    };
+    readonly label = "Computer";
+    readonly loadMode: "essential";
+    readonly concurrency: "exclusive";
+    readonly summary = "Capture and control the host desktop through native OS APIs";
+    readonly parameters: import("arktype/internal/variants/object.ts").ObjectType<{
+        actions?: {
+            type: "click" | "double_click" | "drag" | "keypress" | "move" | "screenshot" | "scroll" | "type" | "wait";
+            x?: number | undefined;
+            y?: number | undefined;
+            button?: "back" | "forward" | "left" | "right" | "wheel" | undefined;
+            path?: {
+                x: number;
+                y: number;
+            }[] | undefined;
+            keys?: string[] | null | undefined;
+            scroll_x?: number | undefined;
+            scroll_y?: number | undefined;
+            text?: string | undefined;
+        }[] | undefined;
+    }, {}>;
+    readonly strict = false;
+    readonly approval: typeof computerApproval;
+    readonly formatApprovalDetails: (args: unknown) => string[];
+    constructor(session: ToolSession, createController?: ComputerControllerFactory);
+    get description(): string;
+    execute(_toolCallId: string, params: ComputerParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<ComputerToolDetails>, context?: AgentToolContext): Promise<AgentToolResult<ComputerToolDetails>>;
+    close(): Promise<void>;
+}
+export {};

package/dist/types/tools/context.d.ts

@@ -12,6 +12,8 @@ declare module "@oh-my-pi/pi-agent-core" {
          *  wrapper must not re-prompt for the same action (explicit per-tool
          *  policies and overrides still apply). */
         xdevApproved?: boolean;
+        /** Set only after an interactive prompt approves provider computer safety checks. */
+        providerSafetyApproved?: boolean;
     }
 }
 export declare class ToolContextStore {

package/dist/types/tools/default-renderer.d.ts

@@ -0,0 +1,21 @@
+import type { Component } from "@oh-my-pi/pi-tui";
+import type { RenderResultOptions } from "../extensibility/custom-tools/types.js";
+import type { Theme } from "../modes/theme/theme.js";
+/** Inputs rendered by the fallback card used when a tool has no bespoke renderer. */
+export interface DefaultToolRenderInput {
+    /** Human-readable tool label. */
+    label: string;
+    /** Tool arguments, shown inline when collapsed and as a tree when expanded. */
+    args: unknown;
+    /** Settled or streaming result; omitted while only the call is available. */
+    result?: {
+        output: string;
+        isError?: boolean;
+    };
+    /** Current expansion and lifecycle state. */
+    options: RenderResultOptions;
+}
+/** Format one generic tool call/result card at the available content width. */
+export declare function formatDefaultToolExecution(input: DefaultToolRenderInput, contentWidth: number, uiTheme: Theme): string;
+/** Render the generic fallback as the state-tinted card used by direct custom tools. */
+export declare function renderDefaultToolExecution(input: DefaultToolRenderInput, uiTheme: Theme): Component;

package/dist/types/tools/index.d.ts

@@ -42,6 +42,8 @@ export * from "./ast-grep.js";
 export * from "./bash.js";
 export * from "./browser.js";
 export * from "./checkpoint.js";
+export * from "./computer.js";
+export * from "./computer/supervisor.js";
 export * from "./debug.js";
 export * from "./essential-tools.js";
 export * from "./eval.js";

package/dist/types/tts/streaming-player.d.ts

@@ -1,54 +1,21 @@
-import { type PlayerCommand } from "./player.js";
-/** Output gain applied while ducked (the user is speaking over the assistant). */
+/** Output gain applied while the user speaks over assistant audio. */
 export declare const DUCK_GAIN = 0.25;
-/** Injection seam for {@link streamingPlayerCommandsFor} — defaults to real PATH/tools lookups. */
-export interface StreamingPlayerLookup {
-    which?: (bin: string) => string | null;
-    ffmpeg?: () => string | null;
-}
-/**
- * Ordered candidate commands for a persistent raw-PCM player on `platform`: each
- * reads 32-bit-float little-endian mono PCM at `sampleRate` from stdin (`pipe:0`)
- * and plays it to the default output device. An empty list means no streaming
- * backend is available and the caller should fall back to per-file playback.
- *
- * - darwin: `ffmpeg` (AudioToolbox output device) → sox's `play` (coreaudio).
- * - linux/other POSIX: `ffmpeg` (`-f pulse` then `-f alsa`) → `paplay`/`aplay`
- *   raw fallbacks.
- * - win32: none (PowerShell `SoundPlayer` is file-only).
- */
-export declare function streamingPlayerCommandsFor(platform: NodeJS.Platform, sampleRate: number, lookup?: StreamingPlayerLookup): PlayerCommand[];
-/**
- * Test seams for {@link StreamingAudioPlayer}: override backend discovery and
- * the per-file fallback so playback logic can be exercised without a real audio
- * device. Both default to the platform lookup and {@link playAudioFile}.
- */
-export interface StreamingPlayerOptions {
-    /** Ordered backend commands for a sample rate; defaults to {@link streamingPlayerCommandsFor}. */
-    commandsFor?: (sampleRate: number) => PlayerCommand[];
-    /** Per-file fallback playback; defaults to {@link playAudioFile}. */
-    playAudio?: (wavPath: string, signal: AbortSignal) => Promise<void>;
-    /** Max seconds of streamed PCM retained for the nonzero-exit replay; defaults to {@link REPLAY_RETENTION_SECONDS}. */
-    replayRetentionSeconds?: number;
-}
 /**
- * Single-session gapless player. Lifecycle: {@link start} once, {@link write}
- * chunks in order, then {@link end} to drain or {@link stop} to abort. Not
- * reusable after stop/end — create a new instance per utterance.
+ * One native gapless playback session. Call {@link start}, enqueue mono `f32`
+ * chunks with {@link write}, then {@link end} to drain or {@link stop} to abort.
  */
 export declare class StreamingAudioPlayer {
     #private;
-    constructor(options?: StreamingPlayerOptions);
-    /** Pick a backend and begin draining. Idempotent; the first call's rate wins. */
-    start(sampleRate: number): void;
-    /** Queue a mono float32 PCM chunk for playback in arrival order. */
+    /** Opens the default speaker at the stream's logical sample rate. */
+    start(sampleRate?: number): void;
+    /** Queues one mono `f32` PCM chunk without copying it in TypeScript. */
     write(pcm: Float32Array): void;
-    /** Scale subsequent output (1 = normal, <1 = ducked). Applies within {@link LEAD_SECONDS}. */
+    /** Applies gain at render time, including to samples already queued natively. */
     setGain(gain: number): void;
-    /** Close the input; resolves once all queued audio has finished playing. */
+    /** Closes input and resolves after every queued sample reaches the speaker. */
     end(): Promise<void>;
-    /** Stop immediately: kill the player, drop everything still queued. */
+    /** Stops immediately and discards queued audio. Safe to call repeatedly. */
     stop(): void;
 }
-/** Factory the vocalizer calls; a function so tests can stub it without spawning a player. */
+/** Creates the single-use player used by the speech vocalizer. */
 export declare function createStreamingPlayer(): StreamingAudioPlayer;

package/dist/types/utils/tools-manager.d.ts

@@ -1,5 +1,4 @@
-export declare function ffmpegAssetName(_version: string, plat: string, architecture: string): string | null;
-export type ToolName = "sd" | "sg" | "yt-dlp" | "trafilatura" | "ffmpeg";
+export type ToolName = "sd" | "sg" | "yt-dlp" | "trafilatura";
 export declare function getToolPath(tool: ToolName): string | null;
 /** Download a tool asset without handing the streaming Response to Bun.write. */
 export declare function downloadFile(url: string, dest: string, signal?: AbortSignal): Promise<void>;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.1.0",
+	"version": "17.1.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -53,17 +53,17 @@
 		"@babel/parser": "^7.29.7",
 		"@babel/traverse": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.1.0",
-		"@oh-my-pi/omp-stats": "17.1.0",
-		"@oh-my-pi/pi-agent-core": "17.1.0",
-		"@oh-my-pi/pi-ai": "17.1.0",
-		"@oh-my-pi/pi-catalog": "17.1.0",
-		"@oh-my-pi/pi-mnemopi": "17.1.0",
-		"@oh-my-pi/pi-natives": "17.1.0",
-		"@oh-my-pi/pi-tui": "17.1.0",
-		"@oh-my-pi/pi-utils": "17.1.0",
-		"@oh-my-pi/pi-wire": "17.1.0",
-		"@oh-my-pi/snapcompact": "17.1.0",
+		"@oh-my-pi/hashline": "17.1.1",
+		"@oh-my-pi/omp-stats": "17.1.1",
+		"@oh-my-pi/pi-agent-core": "17.1.1",
+		"@oh-my-pi/pi-ai": "17.1.1",
+		"@oh-my-pi/pi-catalog": "17.1.1",
+		"@oh-my-pi/pi-mnemopi": "17.1.1",
+		"@oh-my-pi/pi-natives": "17.1.1",
+		"@oh-my-pi/pi-tui": "17.1.1",
+		"@oh-my-pi/pi-utils": "17.1.1",
+		"@oh-my-pi/pi-wire": "17.1.1",
+		"@oh-my-pi/snapcompact": "17.1.1",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/src/cli/args.ts

@@ -396,6 +396,7 @@ ${chalk.bold("Available Tools (default-enabled unless noted):")}
   notebook      - Edit Jupyter notebooks
   inspect_image - Analyze images with a vision model
   browser       - Browser automation (Puppeteer)
+  computer      - Native host desktop capture and input (disabled by default)
   task          - Launch sub-agents for parallel tasks
   todo          - Manage todo/task lists
   web_search    - Search the web

package/src/cli/setup-cli.ts

@@ -11,7 +11,6 @@ import { Settings, settings } from "../config/settings";
 import { theme } from "../modes/theme/theme";
 import { downloadSttModel, isSttModelCached } from "../stt/downloader";
 import { isSttModelKey, STT_MODEL_OPTIONS } from "../stt/models";
-import { detectRecorder, ensureRecorder } from "../stt/recorder";
 import { downloadTtsModel, isTtsLocalModelKey, isTtsModelCached, TTS_LOCAL_MODEL_OPTIONS } from "../tts";
 import { selectSetupModel } from "./setup-model-picker";
 
@@ -170,17 +169,6 @@ interface SpeechComponent {
 
 function buildSpeechComponents(): SpeechComponent[] {
 	return [
-		{
-			name: "Recorder",
-			isReady: async () => detectRecorder() !== null,
-			status: async () => {
-				const recorder = detectRecorder();
-				return recorder ? `${recorder.tool} (${recorder.bin})` : "none — ffmpeg will be downloaded";
-			},
-			ensure: async onProgress => {
-				await ensureRecorder(onProgress);
-			},
-		},
 		{
 			name: "Speech-to-Text model",
 			isReady: () => isSttModelCached(settings.get("stt.modelName")),
@@ -316,7 +304,7 @@ ${chalk.bold("Usage:")}
 
 ${chalk.bold("Components:")}
   python    Verify a Python 3 interpreter is reachable for code execution
-  speech    Pick + download the speech-to-text and text-to-speech models and an audio recorder
+  speech    Pick and download speech-to-text and text-to-speech models
 
 ${chalk.bold("Options:")}
   -c, --check   Check if dependencies are installed without installing
@@ -325,7 +313,7 @@ ${chalk.bold("Options:")}
 ${chalk.bold("Examples:")}
   ${APP_NAME} setup                  Run the onboarding wizard
   ${APP_NAME} setup python           Check Python execution dependencies
-  ${APP_NAME} setup speech           Set up speech (pick STT + TTS models, install a recorder)
+  ${APP_NAME} setup speech           Pick and download the STT and TTS models
   ${APP_NAME} setup speech --check   Check if speech dependencies are available
   ${APP_NAME} setup python --check   Check if Python execution is available
 `);

package/src/cli.ts

@@ -79,6 +79,7 @@ async function runSmokeTest(): Promise<void> {
 	const { smokeTestTtsWorker } = await import("./tts/tts-client");
 	const { smokeTestMnemopiEmbedWorker } = await import("./mnemopi/embed-client");
 	const { smokeTestJsEvalWorker } = await import("./eval/js/context-manager");
+	const { smokeTestComputerWorker } = await import("./tools/computer/supervisor");
 	// Smoke dependencies stay lazy so normal CLI startup does not load worker clients.
 	const { smokeTestDaemonBroker } = await import("./launch/client");
 	await smokeTestSyncWorker();
@@ -98,6 +99,7 @@ async function runSmokeTest(): Promise<void> {
 	await smokeTestTinyTitleWorker();
 	await smokeTestSttWorker();
 	await smokeTestJsEvalWorker();
+	await smokeTestComputerWorker();
 	await smokeTestTtsWorker();
 	await smokeTestMnemopiEmbedWorker();
 	await smokeTestDaemonBroker();
@@ -107,6 +109,7 @@ async function runSmokeTest(): Promise<void> {
 const TINY_WORKER_ARG = "__omp_worker_tiny_inference";
 const STATS_SYNC_WORKER_ARG = "__omp_worker_stats_sync";
 const TAB_WORKER_ARG = "__omp_worker_tab";
+const COMPUTER_WORKER_ARG = "__omp_worker_computer";
 const JS_EVAL_WORKER_ARG = "__omp_worker_js_eval";
 const JS_EVAL_PROCESS_ARG = "__omp_worker_js_eval_process";
 const STT_WORKER_ARG = "__omp_worker_stt";
@@ -152,6 +155,11 @@ async function runWorkerEntrypoint(arg: string | undefined): Promise<boolean> {
 		await import("./tools/browser/tab-worker-entry");
 		return true;
 	}
+	if (arg === COMPUTER_WORKER_ARG) {
+		if (parentPort) installWorkerInbox(parentPort);
+		await import("./tools/computer/worker-entry");
+		return true;
+	}
 	if (arg === JS_EVAL_WORKER_ARG) {
 		if (parentPort) installWorkerInbox(parentPort);
 		await import("./eval/js/worker-entry");

package/src/config/model-registry.ts

@@ -65,6 +65,7 @@ const BUILT_IN_DISCOVERY_NON_AUTHORITATIVE_RETRY_MS = 5 * 60 * 1000;
 import type { ApiKeyResolver, FetchImpl } from "@oh-my-pi/pi-ai";
 import { registerOAuthProvider, unregisterOAuthProviders } from "@oh-my-pi/pi-ai/oauth";
 import type { OAuthCredentials, OAuthLoginCallbacks } from "@oh-my-pi/pi-ai/oauth/types";
+import { setCodexAttestationProvider } from "@oh-my-pi/pi-ai/providers/openai-codex-responses";
 import {
 	getBundledModelReferenceIndex,
 	inheritReferenceThinking,
@@ -72,6 +73,7 @@ import {
 } from "@oh-my-pi/pi-catalog/identity";
 import { isBunTestRuntime, isRecord, logger, wrapFetchForExtraCa } from "@oh-my-pi/pi-utils";
 import { parseModelString, resolveProviderModelReference } from "../config/model-resolver";
+import { generateCodexAttestation } from "../live/attestation";
 import type { AuthStorage, OAuthCredential } from "../session/auth-storage";
 import { type ApiKeyResolverModel, type ApiKeyResolverOptions, createApiKeyResolver } from "./api-key-resolver";
 import type { ConfigError, ConfigFile } from "./config-file";
@@ -90,6 +92,10 @@ import { ModelsConfigFile, type ProviderValidationModel, validateProviderConfigu
 import type { ModelOverride, ModelsConfig, ProviderAuthMode } from "./models-config-schema";
 import { settings } from "./settings";
 
+// DeviceCheck attestation (`x-oai-attestation`) for ChatGPT-OAuth Codex
+// requests; the pi-ai provider resolves it just-in-time per request.
+setCodexAttestationProvider(generateCodexAttestation);
+
 export const kNoAuth = "N/A";
 
 export function isAuthenticated(apiKey: string | undefined | null): apiKey is string {

package/src/config/settings-schema.ts

@@ -141,6 +141,7 @@ export const TAB_GROUPS: Record<SettingTab, readonly string[]> = {
 		"Available Tools",
 		"Todos",
 		"Grep & Browser",
+		"Computer",
 		"GitHub",
 		"Output Limits",
 		"Execution",
@@ -3830,6 +3831,66 @@ export const SETTINGS_SCHEMA = {
 		},
 	},
 
+	"computer.enabled": {
+		type: "boolean",
+		default: false,
+		ui: {
+			tab: "tools",
+			group: "Available Tools",
+			label: "Computer",
+			description: "Enable native host-desktop screenshots and input for OpenAI computer use",
+		},
+	},
+
+	"computer.backend": {
+		type: "enum",
+		values: ["auto", "native"] as const,
+		default: "auto",
+		ui: {
+			tab: "tools",
+			group: "Computer",
+			label: "Computer Backend",
+			description: "Select automatic or explicit platform-native desktop capture and input",
+			options: [
+				{ value: "auto", label: "Auto" },
+				{ value: "native", label: "Native" },
+			],
+		},
+	},
+
+	"computer.display": {
+		type: "string",
+		default: "all",
+		ui: {
+			tab: "tools",
+			group: "Computer",
+			label: "Computer Display",
+			description: "Composite all displays or select a native display id",
+		},
+	},
+
+	"computer.maxWidth": {
+		type: "number",
+		default: 1920,
+		ui: {
+			tab: "tools",
+			group: "Computer",
+			label: "Computer Screenshot Width",
+			description: "Maximum composite screenshot width in pixels",
+		},
+	},
+
+	"computer.maxHeight": {
+		type: "number",
+		default: 1200,
+		ui: {
+			tab: "tools",
+			group: "Computer",
+			label: "Computer Screenshot Height",
+			description: "Maximum composite screenshot height in pixels",
+		},
+	},
+
 	"checkpoint.enabled": {
 		type: "boolean",
 		default: false,

package/src/eval/executor-base.ts

@@ -497,6 +497,7 @@ export async function executeWithKernelBase<
 		logger.error(`${errorLogLabel} execution failed`, { error: error.message });
 		throw error;
 	} finally {
+		await sink.dispose();
 		unregisterBridge?.();
 		abortShield.dispose?.();
 	}

package/src/eval/js/executor.ts

@@ -169,5 +169,7 @@ export async function executeJs(code: string, options: JsExecutorOptions): Promi
 			outputBytes: summary.outputBytes,
 			displayOutputs,
 		};
+	} finally {
+		await outputSink.dispose();
 	}
 }

package/src/exec/bash-executor.ts

@@ -581,6 +581,7 @@ export async function executeBash(command: string, options?: BashExecutorOptions
 		resetSession = true;
 		throw err;
 	} finally {
+		await sink.dispose();
 		if (timeoutTimer) {
 			clearTimeout(timeoutTimer);
 		}

package/src/extensibility/extensions/wrapper.ts

@@ -8,10 +8,11 @@ import type {
 	AgentToolUpdateCallback,
 	ToolLoadMode,
 } from "@oh-my-pi/pi-agent-core";
-import type { ImageContent, Static, TextContent, TSchema } from "@oh-my-pi/pi-ai";
+import type { ComputerSafetyCheck, ImageContent, Static, TextContent, TSchema } from "@oh-my-pi/pi-ai";
+import { sanitizeText } from "@oh-my-pi/pi-utils";
 import type { Settings } from "../../config/settings";
 import type { Theme } from "../../modes/theme/theme";
-import { type ApprovalMode, formatApprovalPrompt, resolveApproval } from "../../tools/approval";
+import { type ApprovalMode, formatApprovalPrompt, resolveApproval, truncateForPrompt } from "../../tools/approval";
 import { defaultLoadModeForToolName } from "../../tools/essential-tools";
 import { normalizeToolEventInput, resolveToolEventInput } from "../tool-event-input";
 import { applyToolProxy } from "../tool-proxy";
@@ -83,6 +84,42 @@ export function wrapRegisteredTools(registeredTools: RegisteredTool[], runner: E
 	return registeredTools.map(rt => wrapRegisteredTool(rt, runner));
 }
 
+function computerSafetyChecks(context: AgentToolContext | undefined): ComputerSafetyCheck[] {
+	const metadata = context?.toolCall?.providerMetadata;
+	return metadata?.type === "computer" ? metadata.pendingSafetyChecks : [];
+}
+
+function approvalArgs(params: unknown, context: AgentToolContext | undefined): unknown {
+	const metadata = context?.toolCall?.providerMetadata;
+	return metadata?.type === "computer" ? { actions: metadata.actions } : params;
+}
+
+function toolEventArgs(params: unknown, context: AgentToolContext | undefined): Record<string, unknown> {
+	const metadata = context?.toolCall?.providerMetadata;
+	if (metadata?.type === "computer") {
+		return {
+			actions: metadata.actions,
+			pendingSafetyChecks: metadata.pendingSafetyChecks,
+		};
+	}
+	return params as Record<string, unknown>;
+}
+
+function approvalData(value: string): string {
+	const sanitized = sanitizeText(value)
+		.replace(/[\r\n\t]+/g, " ")
+		.trim();
+	const truncated = truncateForPrompt(sanitized, 500);
+	return truncated.replace(/([\\`*_{}[\]()<>#+\-.!|])/g, "\\$1");
+}
+
+function safetyCheckLines(checks: readonly ComputerSafetyCheck[]): string[] {
+	return checks.map((check, index) => {
+		const value = check.message || check.code || check.id;
+		return `${index + 1}. ${approvalData(value)}`;
+	});
+}
+
 /**
  * Wraps a tool with extension callbacks for interception.
  * - Emits tool_call event before execution (can block)
@@ -128,19 +165,25 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		const configuredMode = (settings?.get("tools.approvalMode") ?? "yolo") as ApprovalMode;
 		const approvalMode: ApprovalMode = cliAutoApprove ? "yolo" : configuredMode;
 		const userPolicies = (settings?.get("tools.approval") ?? {}) as Record<string, unknown>;
-		const resolved = resolveApproval(this.tool, params, approvalMode, userPolicies);
+		const resolvedArgs = approvalArgs(params, context);
+		const resolved = resolveApproval(this.tool, resolvedArgs, approvalMode, userPolicies);
 		if (resolved.policy === "deny") {
 			throw new Error(
 				`Tool "${this.tool.name}" is blocked by user policy.\n` +
 					`To allow: remove "tools.approval.${this.tool.name}: deny" from config.`,
 			);
 		}
+		const pendingSafetyChecks = computerSafetyChecks(context);
 		// An xd:// device dispatch already cleared the write tool's outer gate at
 		// this tool's tier — re-prompting would double-ask for one action. Explicit
 		// per-tool "prompt" policies and tool-demanded overrides still prompt.
+		// Provider safety checks are stronger: yolo, per-tool allow, and xdev approval
+		// never acknowledge them on the user's behalf.
 		const explicitPrompt = resolved.override || Object.hasOwn(userPolicies, this.tool.name);
 		const approvalCheck = {
-			required: resolved.policy === "prompt" && (explicitPrompt || context?.xdevApproved !== true),
+			required:
+				pendingSafetyChecks.length > 0 ||
+				(resolved.policy === "prompt" && (explicitPrompt || context?.xdevApproved !== true)),
 			reason: resolved.reason,
 		};
 
@@ -171,10 +214,16 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				});
 			};
 
-			// Check if UI is available
+			// Provider safety checks fail closed without an interactive prompt. Unlike
+			// ordinary tier approval, no setting or yolo mode may bypass this gate.
 			if (!this.runner.hasUI()) {
 				const reason = "no interactive UI available";
 				await resolveApproval(false, reason);
+				if (pendingSafetyChecks.length > 0) {
+					throw new Error(
+						`Tool "${this.tool.name}" has pending provider safety checks but no interactive UI is available.`,
+					);
+				}
 				throw new Error(
 					`Tool "${this.tool.name}" requires approval but no interactive UI available.\n` +
 						`Options:\n` +
@@ -185,12 +234,14 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 			}
 
 			const uiContext = this.runner.getUIContext();
+			const basePrompt = formatApprovalPrompt(this.tool, resolvedArgs, approvalCheck.reason);
+			const safetyPrompt =
+				pendingSafetyChecks.length > 0
+					? `${basePrompt}\nProvider safety checks:\n${safetyCheckLines(pendingSafetyChecks).join("\n")}`
+					: basePrompt;
 			let choice: string | undefined;
 			try {
-				choice = await uiContext.select(formatApprovalPrompt(this.tool, params, approvalCheck.reason), [
-					"Approve",
-					"Deny",
-				]);
+				choice = await uiContext.select(safetyPrompt, ["Approve", "Deny"]);
 			} catch (err) {
 				await resolveApproval(false, err instanceof Error ? err.message : "approval aborted");
 				throw err;
@@ -200,6 +251,10 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 			if (!approved) {
 				throw new Error(`Tool call denied by user: ${this.tool.name}`);
 			}
+			if (pendingSafetyChecks.length > 0) {
+				if (!context) throw new Error("Provider safety approval context is unavailable");
+				context.providerSafetyApproved = true;
+			}
 		}
 
 		// 2. Emit tool_call event - extensions can block execution
@@ -211,7 +266,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 					toolCallId,
 					input: normalizeToolEventInput(
 						this.tool.name,
-						resolveToolEventInput(this.tool, params as Record<string, unknown>),
+						resolveToolEventInput(this.tool, toolEventArgs(params, context)),
 					),
 				})) as ToolCallEventResult | undefined;
 
@@ -228,7 +283,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 		}
 
 		// Execute the actual tool
-		let result: { content: any; details?: TDetails };
+		let result: AgentToolResult<TDetails, TParameters>;
 		let executionError: Error | undefined;
 
 		try {
@@ -249,7 +304,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				toolCallId,
 				input: normalizeToolEventInput(
 					this.tool.name,
-					resolveToolEventInput(this.tool, params as Record<string, unknown>),
+					resolveToolEventInput(this.tool, toolEventArgs(params, context)),
 				),
 				content: result.content,
 				details: result.details,
@@ -275,6 +330,7 @@ export class ExtensionToolWrapper<TParameters extends TSchema = TSchema, TDetail
 				return {
 					content: modifiedContent,
 					details: modifiedDetails,
+					providerMetadata: result.providerMetadata,
 					...(effectiveError ? { isError: true } : {}),
 				};
 			}

package/src/extensibility/legacy-pi-coding-agent-shim.ts

@@ -17,7 +17,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import type { AgentToolResult, AgentToolUpdateCallback } from "@oh-my-pi/pi-agent-core";
 import { type AuthCredential, SqliteAuthCredentialStore, type TSchema } from "@oh-my-pi/pi-ai";
-import { Text } from "@oh-my-pi/pi-tui";
+import { getKeybindings, type Keybinding, Text } from "@oh-my-pi/pi-tui";
 import {
 	getAgentDbPath,
 	getAgentDir,
@@ -26,6 +26,7 @@ import {
 	parseFrontmatter as parseOmpFrontmatter,
 } from "@oh-my-pi/pi-utils";
 import { getPackageDir as getOmpPackageDir } from "../config";
+import { formatKeyHints } from "../config/keybindings";
 import type { PromptTemplate } from "../config/prompt-templates";
 import { type SettingPath, Settings } from "../config/settings";
 import { EditTool } from "../edit";
@@ -373,6 +374,11 @@ async function executeLegacyBashOperations(
 	}
 }
 
+/** Format the active shortcut for legacy extensions that render keybinding hints. */
+export function keyText(action: Keybinding): string {
+	return formatKeyHints(getKeybindings().getKeys(action));
+}
+
 /** Parse frontmatter using the historical Pi package-root helper. */
 export interface ParsedFrontmatter<T extends Record<string, unknown> = Record<string, unknown>> {
 	frontmatter: T;