@oh-my-pi/pi-coding-agent 17.1.3 → 17.1.4

package/src/thinking.ts

@@ -1,6 +1,7 @@
 import { type ResolvedThinkingLevel, ThinkingLevel } from "@oh-my-pi/pi-agent-core";
 import { Effort, type Model, THINKING_EFFORTS } from "@oh-my-pi/pi-ai";
 import { clampThinkingLevelForModel, getSupportedEfforts } from "@oh-my-pi/pi-catalog/model-thinking";
+import { modelsAreEqual } from "@oh-my-pi/pi-catalog/models";
 
 /**
  * Metadata used to render thinking selector values in the coding-agent UI.
@@ -142,6 +143,44 @@ export function concreteThinkingLevel(level: ConfiguredThinkingLevel | undefined
 	return level === AUTO_THINKING ? undefined : level;
 }
 
+/**
+ * True when a prewalk hand-off from `current`/`currentLevel` to
+ * `target`/`targetLevel` would change nothing observable: same model id, same
+ * auto/fixed mode, and the same model-clamped effective effort. Prewalk arms and
+ * switches only when this is false.
+ *
+ * An effort-only delta on the same model id is a legitimate cheapening hand-off
+ * — on a reasoning model the effort is the bulk of the cost — so it is NOT a
+ * no-op and must still switch. A `targetLevel` of `undefined` means the prewalk
+ * pattern carried no explicit `:level` suffix (no effort change requested),
+ * which on the same model is a no-op.
+ *
+ * `auto` mode is compared before efforts: `auto` and a fixed selector that both
+ * resolve to `undefined` effort (e.g. `:inherit`) are NOT interchangeable —
+ * applying the fixed selector clears per-turn classification, so switching
+ * auto↔fixed is always a real change even when the clamped efforts match.
+ *
+ * Efforts are otherwise compared AFTER model clamping, so a target the model
+ * cannot honor (e.g. `:xhigh` on a model capped at `high`) — which
+ * `setThinkingLevel` would clamp straight back to the active effort — is
+ * recognized as a no-op instead of triggering an ephemeral reset and the
+ * plan/checklist nudges for nothing.
+ */
+export function prewalkWouldBeNoop(
+	current: Model | undefined,
+	currentLevel: ConfiguredThinkingLevel | undefined,
+	target: Model,
+	targetLevel: ConfiguredThinkingLevel | undefined,
+): boolean {
+	if (!modelsAreEqual(current, target)) return false;
+	if (targetLevel === undefined) return true;
+	if ((targetLevel === AUTO_THINKING) !== (currentLevel === AUTO_THINKING)) return false;
+	return (
+		resolveThinkingLevelForModel(target, concreteThinkingLevel(targetLevel)) ===
+		resolveThinkingLevelForModel(target, concreteThinkingLevel(currentLevel))
+	);
+}
+
 /** Metadata used to render the `auto` selector value alongside concrete levels. */
 export interface ConfiguredThinkingLevelMetadata {
 	value: ConfiguredThinkingLevel;

package/src/tools/bash.ts

@@ -48,6 +48,7 @@ import {
 	previewWindowRows,
 	replaceTabs,
 } from "./render-utils";
+import { tokenizeShellSegments } from "./shell-tokenize";
 import { ToolAbortError, ToolError } from "./tool-errors";
 import { toolResult } from "./tool-result";
 import { clampTimeout, TOOL_TIMEOUTS } from "./tool-timeouts";
@@ -71,12 +72,13 @@ const BASH_PATTERN_APPROVAL_VALUES = new Set(["allow", "deny", "prompt"]);
  * containing a space, pipe, `&&`, redirect, or `$(...)`.
  *
  * The wrap reuses the same shell binary + args the local `bash-executor` would
- * pick via `settings.getShellConfig()` — Git Bash / `bash.exe` on Windows,
+ * pick via `settings.getShellConfig()` — Git Bash / `bash.exe` on Windows
+ * (`cmd.exe /c` as the last-resort fallback when no bash exists on the host),
  * `$SHELL` (bash/zsh) with the `sh` fallback on POSIX — so the ACP path
  * preserves `bash` tool semantics (`$VAR`, `$(...)`, `source`, POSIX quoting,
- * `-l`) instead of dropping to `cmd.exe` on Windows. The agent host's shell
- * path is used as a proxy for the client's, matching the near-universal
- * ACP deployment shape of an editor spawning omp as a co-hosted subprocess.
+ * `-l`) wherever a POSIX shell is available. The agent host's shell path is
+ * used as a proxy for the client's, matching the near-universal ACP
+ * deployment shape of an editor spawning omp as a co-hosted subprocess.
  */
 export function wrapShellLineForClientTerminal(
 	line: string,
@@ -189,16 +191,43 @@ function commandMatchesBashApprovalPattern(command: string, pattern: string): bo
 	return bashApprovalPatternToRegExp(pattern).test(normalizedCommand);
 }
 
+// `deny`/`prompt` rules are matched per segment so a dangerous command buried in
+// a compound line (`cd x && rm -rf /`, `sleep 1 & rm -rf /`) is still caught.
+// Reuse the shared shell tokenizer so segmentation stays in one place and honors
+// every command boundary (`;`, `&&`, `||`, `|`, `&`, subshells, newlines).
+function bashCommandSegments(command: string): string[] {
+	return tokenizeShellSegments(command)
+		.map(segment => segment.join(" "))
+		.filter(segment => segment.length > 0);
+}
+
+// `deny`/`prompt` matching: the rule fires when its glob matches the whole
+// command or any single segment of a compound command.
+function commandSegmentMatchesBashApprovalPattern(command: string, pattern: string): boolean {
+	const regex = bashApprovalPatternToRegExp(pattern);
+	const normalizedCommand = normalizeBashApprovalPattern(command);
+	if (normalizedCommand.length === 0) return false;
+	if (regex.test(normalizedCommand)) return true;
+	return bashCommandSegments(command).some(segment => regex.test(segment));
+}
+
+// A rule "applies" to a command under approval-specific semantics: `allow` must
+// vouch for the ENTIRE command and never rides a compound line (shell control
+// syntax could smuggle an unsafe segment past a narrow allow), while `deny` and
+// `prompt` fire on any matching segment so they mean what they appear to.
+function bashApprovalRuleMatches(command: string, rule: BashApprovalPatternRule): boolean {
+	if (rule.approval === "allow") {
+		if (BASH_APPROVAL_SHELL_CONTROL_RE.test(command)) return false;
+		return commandMatchesBashApprovalPattern(command, rule.match);
+	}
+	return commandSegmentMatchesBashApprovalPattern(command, rule.match);
+}
+
 function findBashApprovalPatternRule(
 	command: string,
 	rules: readonly BashApprovalPatternRule[],
 ): BashApprovalPatternRule | undefined {
-	return rules.find(rule => {
-		if (rule.approval === "allow" && BASH_APPROVAL_SHELL_CONTROL_RE.test(command)) {
-			return false;
-		}
-		return commandMatchesBashApprovalPattern(command, rule.match);
-	});
+	return rules.find(rule => bashApprovalRuleMatches(command, rule));
 }
 
 async function saveBashOriginalArtifact(session: ToolSession, originalText: string): Promise<string | undefined> {
@@ -459,7 +488,7 @@ export class BashTool implements AgentTool<typeof bashSchemaBase | typeof bashSc
 		const rawCommand = (args as Partial<BashToolInput>).command;
 		const command = typeof rawCommand === "string" ? rawCommand : "";
 		const patternRules = getBashApprovalPatternRules(this.session.settings.get("bash.patterns"));
-		const patternRule = patternRules.find(rule => commandMatchesBashApprovalPattern(command, rule.match));
+		const patternRule = findBashApprovalPatternRule(command, patternRules);
 		if (patternRule?.approval === "deny") {
 			return {
 				tier: "exec",
@@ -471,14 +500,13 @@ export class BashTool implements AgentTool<typeof bashSchemaBase | typeof bashSc
 		if (command !== "" && CRITICAL_BASH_PATTERNS.some(pattern => pattern.test(command))) {
 			return { tier: "exec", override: true, reason: "Critical pattern detected" };
 		}
-		const safePatternRule = findBashApprovalPatternRule(command, patternRules);
-		if (safePatternRule?.approval === "allow") return { tier: "write", policy: "allow" };
-		if (safePatternRule?.approval === "prompt") {
+		if (patternRule?.approval === "allow") return { tier: "write", policy: "allow" };
+		if (patternRule?.approval === "prompt") {
 			return {
 				tier: "exec",
 				override: true,
 				policy: "prompt",
-				reason: `Prompt required by bash pattern: ${safePatternRule.match}`,
+				reason: `Prompt required by bash pattern: ${patternRule.match}`,
 			};
 		}
 		return "exec";

package/src/tools/computer/exposure.ts

@@ -0,0 +1,38 @@
+import type { Model } from "@oh-my-pi/pi-ai";
+
+export type ComputerExposureMode = "native" | "function" | "unavailable";
+
+export interface ComputerExposureOptions {
+	azureBaseUrl?: string;
+	azureResourceName?: string;
+}
+
+function isFirstPartyAzureEndpoint(baseUrl: string): boolean {
+	try {
+		const url = new URL(baseUrl);
+		return (
+			url.protocol === "https:" &&
+			(url.hostname.endsWith(".openai.azure.com") || url.hostname === "models.inference.ai.azure.com")
+		);
+	} catch {
+		return false;
+	}
+}
+
+/** Match the provider transport's effective Computer Use tool representation. */
+export function computerExposureMode(
+	model: Model | undefined,
+	options?: ComputerExposureOptions,
+): ComputerExposureMode {
+	if (!model) return "unavailable";
+	if (model.supportsComputerUse !== true) return "function";
+	if (model.api !== "azure-openai-responses" || model.supportsComputerUseConfig !== undefined) return "native";
+	const baseUrl =
+		options?.azureBaseUrl?.trim() ||
+		process.env.AZURE_OPENAI_BASE_URL?.trim() ||
+		(options?.azureResourceName || process.env.AZURE_OPENAI_RESOURCE_NAME
+			? `https://${options?.azureResourceName || process.env.AZURE_OPENAI_RESOURCE_NAME}.openai.azure.com/openai/v1`
+			: undefined) ||
+		model.baseUrl;
+	return baseUrl && isFirstPartyAzureEndpoint(baseUrl) ? "native" : "function";
+}

package/src/tools/computer/supervisor.ts

@@ -1,5 +1,7 @@
 import type { DesktopAction, DesktopCapabilities, DesktopCapture, DesktopSessionOptions } from "@oh-my-pi/pi-natives";
-import { withTimeout, workerHostEntry } from "@oh-my-pi/pi-utils";
+import { withTimeout } from "@oh-my-pi/pi-utils/async";
+import * as logger from "@oh-my-pi/pi-utils/logger";
+import { workerHostEntry } from "@oh-my-pi/pi-utils/worker-host";
 import { ToolAbortError, ToolError } from "../tool-errors";
 import {
 	COMPUTER_WORKER_ARG,
@@ -138,11 +140,23 @@ export class ComputerSupervisor implements ComputerController {
 		if (this.#startPromise) return this.#startPromise;
 		const ready = Promise.withResolvers<void>();
 		try {
+			logger.debug("Starting native computer worker", {
+				backend: this.options.backend,
+				display: this.options.display,
+				maxWidth: this.options.maxWidth,
+				maxHeight: this.options.maxHeight,
+			});
 			const worker = this.createWorker();
 			this.#worker = worker;
 			this.#unsubscribeMessage = worker.onMessage(message => {
 				if (message.type === "ready") {
 					this.#capabilities = message.capabilities;
+					logger.debug("Native computer worker ready", {
+						backend: message.capabilities.backend,
+						capturePermission: message.capabilities.capturePermission,
+						inputPermission: message.capabilities.inputPermission,
+						displayCount: message.capabilities.displayCount,
+					});
 					ready.resolve();
 					return;
 				}
@@ -151,10 +165,22 @@ export class ComputerSupervisor implements ComputerController {
 					const pending = this.#pending.get(message.id);
 					this.#pending.delete(message.id);
 					pending?.resolve(message.capture);
+					logger.debug("Native computer capture completed", {
+						requestId: message.id,
+						backend: message.capture.backend,
+						capturePermission: message.capture.capturePermission,
+						inputPermission: message.capture.inputPermission,
+						width: message.capture.width,
+						height: message.capture.height,
+					});
 					return;
 				}
 				if (message.type === "error") {
 					const error = workerError(message.error);
+					logger.warn("Native computer worker request failed", {
+						requestId: message.id,
+						errorName: message.error.name,
+					});
 					if (message.id) {
 						const pending = this.#pending.get(message.id);
 						this.#pending.delete(message.id);
@@ -184,6 +210,9 @@ export class ComputerSupervisor implements ComputerController {
 	}
 
 	async #terminate(reason: unknown): Promise<void> {
+		logger.debug("Terminating native computer worker", {
+			reason: reason instanceof Error ? reason.name : typeof reason,
+		});
 		const worker = this.#worker;
 		this.#worker = undefined;
 		this.#startPromise = undefined;
@@ -239,20 +268,39 @@ export async function releaseComputerSessionsForOwner(ownerId: string | undefine
 	await Promise.allSettled(Array.from(controllers, controller => controller.close()));
 }
 
-export async function smokeTestComputerWorker(timeoutMs = SMOKE_TIMEOUT_MS): Promise<void> {
-	const worker = spawnComputerWorker();
-	const id = "computer-smoke";
-	const pong = Promise.withResolvers<void>();
-	const unsubscribeMessage = worker.onMessage(message => {
-		if (message.type === "pong" && message.id === id) pong.resolve();
-	});
-	const unsubscribeError = worker.onError(error => pong.reject(error));
+export async function smokeTestComputerWorker(
+	timeoutMs = SMOKE_TIMEOUT_MS,
+	createWorker: ComputerWorkerFactory = spawnComputerWorker,
+): Promise<void> {
+	const worker = createWorker();
+	const exchange = async (
+		message: ComputerWorkerInbound,
+		expected: ComputerWorkerOutbound["type"],
+		failureMessage: string,
+	): Promise<void> => {
+		const response = Promise.withResolvers<void>();
+		const unsubscribeMessage = worker.onMessage(received => {
+			if (received.type === expected) response.resolve();
+			else if (received.type === "error") response.reject(workerError(received.error));
+		});
+		const unsubscribeError = worker.onError(error => response.reject(error));
+		try {
+			worker.send(message);
+			await withTimeout(response.promise, timeoutMs, failureMessage);
+		} finally {
+			unsubscribeMessage();
+			unsubscribeError();
+		}
+	};
+
 	try {
-		worker.send({ type: "ping", id });
-		await withTimeout(pong.promise, timeoutMs, "Computer worker smoke ping timed out");
+		await exchange(
+			{ type: "init", options: { backend: "auto", display: "all", maxWidth: 1920, maxHeight: 1200 } },
+			"ready",
+			"Computer worker smoke initialization timed out",
+		);
+		await exchange({ type: "close" }, "closed", "Computer worker smoke close timed out");
 	} finally {
-		unsubscribeMessage();
-		unsubscribeError();
 		await worker.terminate();
 	}
 }

package/src/tools/computer/worker-entry.ts

@@ -1,25 +1,34 @@
 import { parentPort } from "node:worker_threads";
-import { consumeWorkerInbox } from "@oh-my-pi/pi-utils/worker-host";
+import { consumeWorkerInbox, isWorkerHostSelector } from "@oh-my-pi/pi-utils/worker-host";
 import type { ComputerWorkerInbound, ComputerWorkerTransport } from "./protocol";
 import { ComputerWorkerCore } from "./worker";
 
-if (!parentPort) throw new Error("computer-worker-entry: missing parentPort");
+export function startComputerWorker(): void {
+	if (!parentPort) throw new Error("computer-worker-entry: missing parentPort");
 
-const port = parentPort;
-const inbox = consumeWorkerInbox();
-const transport: ComputerWorkerTransport = {
-	send(message, transfer) {
-		port.postMessage(message, transfer ?? []);
-	},
-	onMessage(handler) {
-		if (inbox) return inbox.bind(message => handler(message as ComputerWorkerInbound));
-		const listener = (message: unknown): void => handler(message as ComputerWorkerInbound);
-		port.on("message", listener);
-		return () => port.off("message", listener);
-	},
-	close() {
-		port.close();
-	},
-};
+	const port = parentPort;
+	const inbox = consumeWorkerInbox();
+	const transport: ComputerWorkerTransport = {
+		send(message, transfer) {
+			port.postMessage(message, transfer ?? []);
+		},
+		onMessage(handler) {
+			if (inbox) return inbox.bind(message => handler(message as ComputerWorkerInbound));
+			const listener = (message: unknown): void => handler(message as ComputerWorkerInbound);
+			port.on("message", listener);
+			return () => port.off("message", listener);
+		},
+		close() {
+			port.close();
+		},
+	};
 
-new ComputerWorkerCore(transport);
+	new ComputerWorkerCore(transport);
+}
+
+// Bun workers report `import.meta.main === false`. The source fallback still
+// enters this file directly, while packaged CLI workers carry the selector and
+// start the named entry only after installing its inbox.
+if (!Bun.isMainThread && !process.argv.some(isWorkerHostSelector) && import.meta.path === Bun.main) {
+	startComputerWorker();
+}

package/src/tools/computer/worker.ts

@@ -1,9 +1,5 @@
-import {
-	type DesktopAction,
-	type DesktopCapture,
-	DesktopSession,
-	type DesktopSessionOptions,
-} from "@oh-my-pi/pi-natives";
+import type { DesktopAction, DesktopCapture, DesktopSession, DesktopSessionOptions } from "@oh-my-pi/pi-natives";
+import { createDesktopSession } from "@oh-my-pi/pi-natives/desktop";
 import type { ComputerWorkerError, ComputerWorkerInbound, ComputerWorkerTransport } from "./protocol";
 
 export interface NativeDesktopSession {
@@ -44,7 +40,7 @@ export class ComputerWorkerCore {
 
 	constructor(
 		private readonly transport: ComputerWorkerTransport,
-		private readonly createSession: NativeDesktopSessionFactory = options => new DesktopSession(options),
+		private readonly createSession: NativeDesktopSessionFactory = createDesktopSession,
 	) {
 		this.#unsubscribe = transport.onMessage(message => this.#onMessage(message));
 	}

package/src/tools/computer.ts

@@ -5,7 +5,8 @@ import type {
 	AgentToolUpdateCallback,
 	ToolApprovalDecision,
 } from "@oh-my-pi/pi-agent-core";
-import type { ComputerAction, ComputerSafetyCheck, ComputerToolCallMetadata } from "@oh-my-pi/pi-ai";
+import type { ComputerAction, ComputerSafetyCheck, ComputerToolCallMetadata, Model } from "@oh-my-pi/pi-ai";
+import { isClaudeModelId } from "@oh-my-pi/pi-catalog/identity";
 import type {
 	DesktopAction,
 	DesktopCapabilities,
@@ -21,6 +22,36 @@ import { type ComputerController, ComputerSupervisor, registerComputerController
 import type { ToolSession } from "./index";
 import { ToolError, throwIfAborted } from "./tool-errors";
 
+// Image transports that cannot preserve native screenshot detail resize frames
+// without returning transformed dimensions. Keep their native coordinate frames
+// below the empirically verified threshold so pointer actions match what the
+// model sees. Claude paths predate the resolved transport capability and retain
+// their established model-family fallback.
+const COORDINATE_SAFE_MAX_CAPTURE_WIDTH = 1280;
+const COORDINATE_SAFE_MAX_CAPTURE_HEIGHT = 896;
+
+function usesCoordinateSafeImageSizing(model: Model | undefined): boolean {
+	if (!model) return false;
+	const compat = model.compat;
+	return (
+		(!!compat && "supportsImageDetailOriginal" in compat && compat.supportsImageDetailOriginal === false) ||
+		isClaudeModelId(model.id) ||
+		(model.requestModelId !== undefined && isClaudeModelId(model.requestModelId)) ||
+		(typeof model.name === "string" && /^claude(?:\s|$)/i.test(model.name))
+	);
+}
+
+function captureOptions(session: ToolSession, coordinateSafeImageSizing: boolean): DesktopSessionOptions {
+	const maxWidth = session.settings.get("computer.maxWidth");
+	const maxHeight = session.settings.get("computer.maxHeight");
+	return {
+		backend: session.settings.get("computer.backend"),
+		display: session.settings.get("computer.display"),
+		maxWidth: coordinateSafeImageSizing ? Math.min(maxWidth, COORDINATE_SAFE_MAX_CAPTURE_WIDTH) : maxWidth,
+		maxHeight: coordinateSafeImageSizing ? Math.min(maxHeight, COORDINATE_SAFE_MAX_CAPTURE_HEIGHT) : maxHeight,
+	};
+}
+
 // Desktop actions cross the N-API boundary as i32; out-of-range JS numbers
 // must fail closed here instead of truncating in the napi conversion.
 const INT32_MIN = -2_147_483_648;
@@ -230,7 +261,7 @@ function isComputerAction(value: unknown): value is ComputerAction {
 function parseActions(value: unknown): ComputerAction[] {
 	// Missing or empty action batches degrade to a plain screenshot so a
 	// function-calling model can observe the screen before acting.
-	if (value === undefined) return [{ type: "screenshot" }];
+	if (value == null) return [{ type: "screenshot" }];
 	if (!Array.isArray(value)) throw new ToolError("Computer call requires an array of actions");
 	if (value.length === 0) return [{ type: "screenshot" }];
 	if (!value.every(isComputerAction)) throw new ToolError("Computer call contains an invalid action");
@@ -286,6 +317,7 @@ function callMetadata(context: AgentToolContext | undefined): ComputerToolCallMe
 export function computerApproval(args: unknown): ToolApprovalDecision {
 	const actions =
 		args && typeof args === "object" && "actions" in args ? (args as { actions?: unknown }).actions : undefined;
+	if (actions == null) return "read";
 	if (!Array.isArray(actions)) return "exec";
 	return actions.every(action => {
 		if (!action || typeof action !== "object") return false;
@@ -356,8 +388,16 @@ export class ComputerTool implements AgentTool<typeof computerSchema, ComputerTo
 		const actions = args && typeof args === "object" ? (args as { actions?: unknown }).actions : undefined;
 		return approvalActionSummary(actions);
 	};
-	readonly #controller: ComputerController;
-	readonly #unregisterOwner: () => void;
+	/**
+	 * Settings snapshot used to create the tool's current controller; refreshed
+	 * when a model switch crosses the coordinate-safe sizing boundary. Surfaced
+	 * by `/computer status`.
+	 */
+	effectiveConfiguration: Readonly<DesktopSessionOptions>;
+	readonly #createController: ComputerControllerFactory;
+	#controller: ComputerController;
+	#unregisterOwner: () => void;
+	#usesCoordinateSafeImageSizing: boolean;
 	#closed = false;
 	#description?: string;
 
@@ -365,12 +405,10 @@ export class ComputerTool implements AgentTool<typeof computerSchema, ComputerTo
 		readonly session: ToolSession,
 		createController: ComputerControllerFactory = options => new ComputerSupervisor(options),
 	) {
-		this.#controller = createController({
-			backend: session.settings.get("computer.backend"),
-			display: session.settings.get("computer.display"),
-			maxWidth: session.settings.get("computer.maxWidth"),
-			maxHeight: session.settings.get("computer.maxHeight"),
-		});
+		this.#createController = createController;
+		this.#usesCoordinateSafeImageSizing = usesCoordinateSafeImageSizing(session.getActiveModel?.());
+		this.effectiveConfiguration = Object.freeze(captureOptions(session, this.#usesCoordinateSafeImageSizing));
+		this.#controller = createController(this.effectiveConfiguration);
 		this.#unregisterOwner = registerComputerController(
 			session.getEvalKernelOwnerId?.() ?? undefined,
 			this.#controller,
@@ -381,6 +419,21 @@ export class ComputerTool implements AgentTool<typeof computerSchema, ComputerTo
 		return this.#description;
 	}
 
+	async #refreshControllerForModel(): Promise<void> {
+		const nextUsesCoordinateSafeImageSizing = usesCoordinateSafeImageSizing(this.session.getActiveModel?.());
+		if (nextUsesCoordinateSafeImageSizing === this.#usesCoordinateSafeImageSizing) return;
+
+		const previous = this.#controller;
+		const nextOptions = Object.freeze(captureOptions(this.session, nextUsesCoordinateSafeImageSizing));
+		const next = this.#createController(nextOptions);
+		this.#unregisterOwner();
+		this.#controller = next;
+		this.#unregisterOwner = registerComputerController(this.session.getEvalKernelOwnerId?.() ?? undefined, next);
+		this.#usesCoordinateSafeImageSizing = nextUsesCoordinateSafeImageSizing;
+		this.effectiveConfiguration = nextOptions;
+		await previous.close();
+	}
+
 	async execute(
 		_toolCallId: string,
 		params: ComputerParams,
@@ -396,6 +449,8 @@ export class ComputerTool implements AgentTool<typeof computerSchema, ComputerTo
 		if (pendingSafetyChecks.length > 0 && context?.providerSafetyApproved !== true) {
 			throw new ToolError("Provider safety checks require interactive approval before computer input");
 		}
+		await this.#refreshControllerForModel();
+		throwIfAborted(signal);
 		const capture = await this.#controller.execute(actions.map(toDesktopAction), signal);
 		throwIfAborted(signal);
 		const data = Buffer.from(capture.data).toBase64();

package/src/tools/gh-cache-invalidation.ts

@@ -18,6 +18,7 @@
  * dwarfs the cost of one cache miss.
  */
 import { invalidateAllForNumber, invalidateAllForRepo } from "./github-cache";
+import { tokenizeShellSegments } from "./shell-tokenize";
 
 const PR_URL_PATTERN = /^https:\/\/github\.com\/([^/\s]+\/[^/\s]+)\/pull\/(\d+)(?:[/?#].*)?$/i;
 const ISSUE_URL_PATTERN = /^https:\/\/github\.com\/([^/\s]+\/[^/\s]+)\/issues\/(\d+)(?:[/?#].*)?$/i;
@@ -154,87 +155,6 @@ function detectGhMutation(tokens: readonly string[]): { number?: number; repo?:
 	return repo !== undefined ? { repo } : {};
 }
 
-/**
- * Conservative tokenizer that splits a bash command into individual word
- * tokens. Handles single/double-quoted strings, backslash escapes, and
- * standard operators (`;`, `&&`, `||`, `|`, `&`, newlines) as token
- * boundaries that emit a sentinel `";"` so the caller treats the segments
- * as independent command sequences. We do not attempt full POSIX shell
- * parsing — heredocs, command substitution, and arithmetic expansion are
- * out of scope; the detector simply falls through when it cannot find a
- * clean `gh issue|pr <subcmd>` triple.
- */
-function tokenize(command: string): string[][] {
-	const segments: string[][] = [];
-	let current: string[] = [];
-	let buffer = "";
-	let inSingle = false;
-	let inDouble = false;
-	const pushBuffer = () => {
-		if (buffer.length > 0) {
-			current.push(buffer);
-			buffer = "";
-		}
-	};
-	const pushSegment = () => {
-		pushBuffer();
-		if (current.length > 0) segments.push(current);
-		current = [];
-	};
-	for (let i = 0; i < command.length; i++) {
-		const ch = command[i];
-		if (inSingle) {
-			if (ch === "'") {
-				inSingle = false;
-				continue;
-			}
-			buffer += ch;
-			continue;
-		}
-		if (inDouble) {
-			if (ch === "\\" && i + 1 < command.length) {
-				const next = command[i + 1];
-				if (next === '"' || next === "\\" || next === "$" || next === "`") {
-					buffer += next;
-					i++;
-					continue;
-				}
-			}
-			if (ch === '"') {
-				inDouble = false;
-				continue;
-			}
-			buffer += ch;
-			continue;
-		}
-		if (ch === "'") {
-			inSingle = true;
-			continue;
-		}
-		if (ch === '"') {
-			inDouble = true;
-			continue;
-		}
-		if (ch === "\\" && i + 1 < command.length) {
-			buffer += command[i + 1];
-			i++;
-			continue;
-		}
-		if (ch === " " || ch === "\t") {
-			pushBuffer();
-			continue;
-		}
-		if (ch === "\n" || ch === ";" || ch === "&" || ch === "|" || ch === "(" || ch === ")") {
-			pushSegment();
-			// `&&`, `||` already collapsed by the segment break above.
-			continue;
-		}
-		buffer += ch;
-	}
-	pushSegment();
-	return segments;
-}
-
 /**
  * Drop `github-cache` rows for any `gh issue|pr <mutating-subcmd>` call
  * embedded in `command`. Safe to invoke unconditionally; no-op when the
@@ -242,7 +162,7 @@ function tokenize(command: string): string[][] {
  */
 export function invalidateGithubCacheForBashCommand(command: string): void {
 	if (!command?.includes("gh")) return;
-	const segments = tokenize(command);
+	const segments = tokenizeShellSegments(command);
 	for (const segment of segments) {
 		const hit = detectGhMutation(segment);
 		if (!hit) continue;