@oh-my-pi/pi-coding-agent 17.1.7 → 17.2.0

package/dist/types/session/foreign-session-store.d.ts

@@ -0,0 +1,23 @@
+import type { SessionManager } from "./session-manager.js";
+/** External coding-agent session source supported by OMP imports. */
+export type ForeignSessionSource = "claude" | "codex";
+/** Lightweight source metadata used to choose a foreign session before loading its transcript. */
+export interface ForeignSessionInfo {
+    readonly source: ForeignSessionSource;
+    readonly id: string;
+    readonly path: string;
+    readonly cwd: string;
+    readonly title?: string;
+    readonly created: Date;
+    readonly modified: Date;
+    readonly messageCount?: number;
+    readonly firstMessage?: string;
+}
+/** Lists and converts sessions owned by another coding agent. */
+export interface ForeignSessionStore {
+    readonly source: ForeignSessionSource;
+    /** Lists source sessions without parsing complete transcripts. */
+    list(): Promise<ForeignSessionInfo[]>;
+    /** Converts one source session into a non-persistent OMP session. */
+    load(session: ForeignSessionInfo): Promise<SessionManager>;
+}

package/dist/types/session/model-controls.d.ts

@@ -134,9 +134,9 @@ export declare class ModelControls {
     cycleThinkingLevel(): ConfiguredThinkingLevel | undefined;
     /**
      * Classify the current user turn and set the effective thinking level for it.
-     * Bounded by a timeout + abort; on any failure (no smol model, timeout, parse
-     * error) it falls back to the provisional concrete level and continues. Never
-     * throws into the turn, and never clears `#autoThinking` (auto stays active).
+     * Bounded by a timeout + abort; on failure it preserves the last classified
+     * level, or uses the provisional concrete level before the first resolution.
+     * Never throws into the turn, and never clears `#autoThinking`.
      */
     applyAutoThinkingLevel(promptText: string, generation: number): Promise<void>;
     /**

package/dist/types/session/session-advisors.d.ts

@@ -1,8 +1,9 @@
-import { Agent, type AgentMessage, type AgentTool, type StreamFn } from "@oh-my-pi/pi-agent-core";
+import { Agent, type AgentMessage, type AgentTool, type AgentToolContext, type StreamFn } from "@oh-my-pi/pi-agent-core";
 import type { CodexCompactionContext, Context, Message, Model, ProviderSessionState, ServiceTier, SimpleStreamOptions } from "@oh-my-pi/pi-ai";
 import { type AdvisorConfig, type AdvisorRuntimeStatus } from "../advisor/index.js";
 import type { ModelRegistry } from "../config/model-registry.js";
 import type { Settings } from "../config/settings.js";
+import { type CursorMcpResourceAdapter } from "../cursor.js";
 import type { PlanModeState } from "../plan-mode/state.js";
 import type { SecretObfuscator } from "../secrets/obfuscator.js";
 import type { AgentSessionEvent } from "./agent-session-events.js";
@@ -51,12 +52,47 @@ export interface PerAdvisorStat {
 export interface SessionAdvisorsOptions {
     enabled: boolean;
     tools?: AgentTool[];
+    /**
+     * Build a `grep` honoring a Cursor `pi_grep` frame's own context width and
+     * match cap. The advisor's tools are fixed instances carrying session
+     * defaults, so without this an advisor running against Cursor silently
+     * drops both fields — the same gap the primary bridge closes.
+     */
+    createGrepTool?(options: {
+        context?: number;
+        totalMatchLimit?: number;
+    }): AgentTool | undefined;
+    /**
+     * Build the `replace`-mode `edit` a Cursor `pi_edit` frame needs. The
+     * advisor's own instance follows the configured `edit.mode` (`hashline` by
+     * default), whose schema the frame's `old_text`/`new_text` pairs do not
+     * match, so without this every native advisor edit fails validation.
+     */
+    createEditTool?(): AgentTool | undefined;
+    /**
+     * The execute-time context the bridge's tools resolve approval from.
+     *
+     * `ExtensionToolWrapper` reads the approval mode, per-tool policies and
+     * `autoApprove` only from here; with none it falls back to `yolo` and empty
+     * policies, so a native frame would run past a configured `ask` or `deny`.
+     */
+    getToolContext?: () => AgentToolContext | undefined;
+    /**
+     * The live MCP connections Cursor's resource frames answer from.
+     *
+     * Advisors share the session's connections and may hold tools from those
+     * same servers, so without this their frames report that every server
+     * advertises nothing.
+     */
+    mcpResources?: CursorMcpResourceAdapter;
     watchdogPrompt?: string;
     sharedInstructions?: string;
     contextPrompt?: string;
     configs?: AdvisorConfig[];
     streamFn?: StreamFn;
     transformProviderContext?: (context: Context, model: Model) => Context | Promise<Context>;
+    /** Advisor spend already persisted for this session, restored on resume. */
+    initialCosts?: ReadonlyMap<string, number>;
 }
 /** Options accepted when an advisor injects a primary-session message. */
 export interface AdvisorMessageDeliveryOptions {
@@ -93,7 +129,7 @@ export interface SessionAdvisorsHost {
     hasPendingNextTurnMessages(): boolean;
     convertToLlmForSideRequest(messages: AgentMessage[]): Message[];
     effectiveServiceTier(model: Model): ServiceTier | undefined;
-    resolveContextPromotionTarget(currentModel: Model, contextWindow: number): Promise<Model | undefined>;
+    resolveContextPromotionTarget(currentModel: Model, contextWindow: number, signal: AbortSignal): Promise<Model | undefined>;
     resolveCompactionModelCandidates(preferredModel: Model | null | undefined, availableModels: Model[]): Model[];
     resolveRetryFallbackRole(currentSelector: string, currentModel?: Model | null): string | undefined;
     findRetryFallbackCandidates(role: string, currentSelector: string, currentModel?: Model | null): RetryFallbackSelector[];
@@ -118,14 +154,23 @@ export declare class SessionAdvisors {
     buildRuntime(seedToCurrent?: boolean): boolean;
     /** Stops every advisor runtime and starts recorder shutdown. */
     stopRuntime(): void;
+    /**
+     * Pause advisor work while old-session recorder feeds remain attached, then
+     * detach only after any active prompt has settled.
+     */
+    drainAndDetachRecorders(): Promise<void>;
     /** Detaches and drains recorder feeds before transcript artifacts are removed. */
     detachAndCloseRecorders(): Promise<void>;
+    /** Reattach recorder feeds and resume work after a rolled-back or preserving transition. */
+    reattachRecorderFeeds(): void;
     /** Re-primes advisor transcript views across a conversation boundary. */
     resetSessionState(options?: {
         preserveCost?: boolean;
     }): void;
     /** Drop the recorded spend once a conversation boundary has committed. */
     clearCost(): void;
+    /** Replace the ledger with the spend recorded for the session becoming active. */
+    restoreCost(costs: ReadonlyMap<string, number>): void;
     /**
      * Rebind every live advisor to the active primary conversation's provider
      * identity (session id, prompt-cache key, credential + metadata resolvers,

package/dist/types/session/session-entries.d.ts

@@ -134,6 +134,7 @@ export interface TitleChangeEntry extends SessionEntryBase {
 declare module "@oh-my-pi/pi-agent-core/compaction/entries" {
     interface CustomCompactionSessionEntries {
         titleChange: TitleChangeEntry;
+        credentialPin: CredentialPinEntry;
     }
 }
 /** TTSR injection entry - tracks which time-traveling rules have been injected this session. */
@@ -142,6 +143,23 @@ export interface TtsrInjectionEntry extends SessionEntryBase {
     /** Names of rules that were injected */
     injectedRules: string[];
 }
+/**
+ * Records which OAuth account served this session's requests for a provider.
+ *
+ * Provider prompt caches (Anthropic in particular) are account-scoped, and the
+ * auth store's session-sticky routing is process-local under a remote auth
+ * broker, so resume must re-pin the same account to reuse the warm cache
+ * prefix. Stores a sha-256 of the account + billing-scope tuple instead of
+ * the raw email/uuid/org; note an unsalted digest of a guessable email is
+ * still linkable, so exported sessions are pseudonymous, not anonymous.
+ */
+export interface CredentialPinEntry extends SessionEntryBase {
+    type: "credential_pin";
+    /** Provider id the pin applies to (e.g. "anthropic"). */
+    provider: string;
+    /** `credentialPinHash()` of the serving account's identity + scope tuple. */
+    hash: string;
+}
 /** Session init entry - captures initial context for subagent sessions (debugging/replay). */
 export interface SessionInitEntry extends SessionEntryBase {
     type: "session_init";
@@ -192,7 +210,7 @@ export interface CustomMessageEntry<T = unknown> extends SessionEntryBase {
     attribution?: MessageAttribution;
 }
 /** Session entry - has id/parentId for tree structure (returned by "read" methods in SessionManager) */
-export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TitleChangeEntry | TtsrInjectionEntry | SessionInitEntry | ModeChangeEntry;
+export type SessionEntry = SessionMessageEntry | ThinkingLevelChangeEntry | ModelChangeEntry | ServiceTierChangeEntry | CompactionEntry | BranchSummaryEntry | CustomEntry | CustomMessageEntry | LabelEntry | TitleChangeEntry | TtsrInjectionEntry | SessionInitEntry | ModeChangeEntry | CredentialPinEntry;
 /** Raw logical file entry after loaders strip any fixed-width title slot. */
 export type FileEntry = SessionHeader | SessionEntry;
 /** Physical JSONL entry before slot-aware loaders fold the title slot. */

package/dist/types/session/session-handoff.d.ts

@@ -44,7 +44,10 @@ export interface SessionHandoffHost {
     clearPendingNextTurnMessages(): void;
     resetTodoCycle(): void;
     buildDisplaySessionContext(): SessionContext;
-    resetAdvisorRuntimes(): void;
+    resetAdvisorSessionState(): void;
+    drainAndDetachAdvisorRecorders(): Promise<void>;
+    reattachAdvisorRecorderFeeds(): void;
+    clearAdvisorCost(): void;
     syncTodoPhasesFromBranch(): void;
 }
 /** Generates handoff documents and owns the handoff session transition. */

package/dist/types/session/session-loader.d.ts

@@ -8,6 +8,8 @@ export declare function parseSessionContent(content: string): {
     entries: FileEntry[];
     titleSlot: SessionTitleUpdate | undefined;
 };
+/** Parse session JSONL and visit each entry without retaining prior entries. */
+export declare function visitEntriesFromFileStream(filePath: string, visit: (entry: FileEntry) => void): Promise<SessionTitleUpdate | undefined>;
 /** Exported for testing — the ≥8MiB streaming path (works on any file size). */
 export declare function loadEntriesFromFileStream(filePath: string): Promise<{
     entries: FileEntry[];

package/dist/types/session/session-maintenance.d.ts

@@ -214,7 +214,7 @@ export declare class SessionMaintenance {
      *   is true.
      */
     checkCompaction(assistantMessage: AssistantMessage, skipAbortedCheck?: boolean, allowDefer?: boolean, autoContinue?: boolean): Promise<CompactionCheckResult>;
-    resolveContextPromotionTarget(currentModel: Model, contextWindow: number): Promise<Model | undefined>;
+    resolveContextPromotionTarget(currentModel: Model, contextWindow: number, signal?: AbortSignal): Promise<Model | undefined>;
     resolveCompactionModelCandidates(preferredModel: Model | null | undefined, availableModels: Model[], filter?: (model: Model) => boolean): Model[];
     /**
      * Internal: Run auto-compaction with events.

package/dist/types/session/session-manager.d.ts

@@ -92,6 +92,11 @@ export declare class SessionManager {
      * session/new must create a discoverable file immediately).
      */
     ensureOnDisk(): Promise<void>;
+    /** Persist this session's transcript as a newly identified OMP session. */
+    persistCopy(options?: {
+        sessionDir?: string;
+        suppressBreadcrumb?: boolean;
+    }, storage?: SessionStorage): Promise<SessionManager>;
     /**
      * Stage a synchronous group of entry appends and publish the resulting full
      * journal with one atomic replace. A failed publish removes only the staged
@@ -236,6 +241,22 @@ export declare class SessionManager {
     appendTtsrInjection(ruleNames: string[]): string;
     /** All unique TTSR rule names injected on the current branch (root → leaf). */
     getInjectedTtsrRules(): string[];
+    /** Append a credential pin recording which OAuth account served `provider`. */
+    appendCredentialPin(provider: string, hash: string): string;
+    /**
+     * Latest credential pin per provider on the current branch (root → leaf),
+     * with the effective last-use time of the pinned account.
+     *
+     * Pins are appended only when the serving account *changes*, so a long
+     * session on one account carries a single old pin entry. Any assistant turn
+     * for the same provider after that pin was necessarily served by the pinned
+     * account, so its timestamp advances `lastUsedAt` — a resume seconds after
+     * the last turn seeds a warm sticky instead of a stale one.
+     */
+    getCredentialPins(): Map<string, {
+        hash: string;
+        lastUsedAt: number;
+    }>;
     getLeafId(): string | null;
     getLeafEntry(): SessionEntry | undefined;
     /**

package/dist/types/session/session-tools.d.ts

@@ -86,6 +86,17 @@ export declare function collectMountedMCPToolRoutes(tools: Iterable<MountedMCPTo
  * rendered by the static MCP guidance prompt.
  */
 export declare function projectMountedMCPXdevGuidance(routes: Iterable<MountedMCPToolRoute>): MCPXdevGuidanceProjection;
+/**
+ * Structured payload persisted on each {@link XDEV_MOUNT_NOTICE_MESSAGE_TYPE}
+ * custom message. Lets a resumed session reconstruct which dynamic devices the
+ * model has already been told about, so reconnecting hosts do not re-announce
+ * (and re-splice a redundant developer message that busts the provider
+ * prompt-cache prefix).
+ */
+interface XdevMountNoticeDetails {
+    added: string[];
+    removed: string[];
+}
 /** Owns tool registration, presentation, prompt rebuilding, skills, and permissions. */
 export declare class SessionTools {
     #private;
@@ -134,8 +145,21 @@ export declare class SessionTools {
     getSelectedMCPToolNames(): string[];
     /** Applies an enabled tool set and reconciles its `xd://` partition. */
     applyActiveToolsByName(toolNames: string[]): Promise<void>;
+    /**
+     * Forget the announced-mount baseline for a replaced transcript. Called when
+     * session history is swapped wholesale (`/new`, `switchSession`, `branch`): the
+     * previous transcript's persisted notices no longer apply, so the next notice
+     * re-seeds from the new history and a device reconnecting into it announces
+     * again.
+     *
+     * The pending delta is deliberately preserved: it holds mounts that are still
+     * live but not yet delivered to the model, and `branch()` does not rebuild the
+     * base system prompt, so dropping it would leave the branched transcript
+     * unaware of a still-mounted device that no later refresh would re-queue.
+     */
+    resetAnnouncedMounts(): void;
     /** Consumes the hidden notice for unannounced `xd://` mount changes. */
-    takePendingXdevMountNotice(): CustomMessage | undefined;
+    takePendingXdevMountNotice(): CustomMessage<XdevMountNoticeDetails> | undefined;
     /** Rediscovers reloadable skills and refreshes prompt metadata. */
     refreshSkills(): Promise<void>;
     /** Selects enabled tools, ignoring names absent from the registry. */

package/dist/types/session/turn-recovery.d.ts

@@ -42,6 +42,7 @@ export interface TurnRecoveryHost {
     }): void;
     waitForSessionMessagePersistence(message: AssistantMessage): Promise<void>;
     appendSessionMessage(message: AssistantMessage): void;
+    persistedAssistantEntryId(message: AssistantMessage): string | undefined;
     sessionMessageAlreadyPersisted(message: AssistantMessage): boolean;
     setModelWithProviderSessionReset(model: Model): Promise<void>;
     resetCurrentResponsesProviderSession(reason: string): void;
@@ -100,6 +101,12 @@ export declare class TurnRecovery {
         hardErrorFallback?: boolean;
         preserveFailedTurn?: boolean;
     }): Promise<boolean>;
+    /**
+     * Records a usage-limit failure before replay eligibility decides whether the
+     * failed turn may be discarded. Returns whether credential recovery switched
+     * the active account.
+     */
+    recordUsageLimitOutcome(message: AssistantMessage): Promise<boolean>;
     /** Prompts after transient overlap with a prior agent run. */
     promptAgentWithIdleRetry(messages: AgentMessage[], options?: {
         toolChoice?: ToolChoice;
@@ -176,8 +183,8 @@ export declare class TurnRecovery {
      * transient overload/5xx or a hard "router/model not found / unsupported" —
      * is worth retrying on the base id. Skips failures the base model shares:
      * context overflow (compaction's job), usage limits and auth errors (same
-     * account/key), and turns that already emitted a tool call (replaying would
-     * duplicate work). Requires the base model to exist in the registry.
+     * account/key), and turns that already emitted any replay-unsafe output.
+     * Requires the base model to exist in the registry.
      */
     isFireworksFastFallbackEligible(message: AssistantMessage): boolean;
     /**
@@ -188,8 +195,7 @@ export declare class TurnRecovery {
      * model switch cannot fix or must not replay: cancellations (abort-flavored
      * errors are not model faults), context overflow (compaction's job),
      * classifier refusals (chain consult is handled on the retryable path with
-     * `pinFallback`), and turns that already emitted a tool call (replaying
-     * could duplicate work).
+     * `pinFallback`), and turns that already emitted replay-unsafe output.
      */
     isHardErrorFallbackEligible(message: AssistantMessage): boolean;
     /**

package/dist/types/system-prompt.d.ts

@@ -131,10 +131,11 @@ export interface BuildSystemPromptOptions {
     renderMermaid?: boolean;
     /** Pre-resolved nested active repo context. Undefined resolves from cwd. */
     activeRepoContext?: ActiveRepoContext | null;
-    /** Tools mounted under `xd://`; renders the protocol section when non-empty. */
+    /** Tools mounted under `xd://`; renders the protocol section when non-empty. `dynamic` marks external devices whose summary is third-party metadata. */
     xdevTools?: Array<{
         name: string;
         summary: string;
+        dynamic?: boolean;
     }>;
     /** Full docs + JSON schema for every `xd://`-mounted tool, inlined into the protocol section so no discovery `read` is needed. */
     xdevDocs?: string;

package/dist/types/task/executor.d.ts

@@ -34,10 +34,19 @@ export type { YieldItem } from "./types.js";
  * agent is driven to one forced final `yield` so partial findings come back
  * as a real report; only if it still refuses to yield within
  * {@link BUDGET_STOP_GRACE_REQUESTS} more requests is the run hard-aborted.
- * The `default` key applies to agents without an explicit entry and can be
- * overridden via the `task.softRequestBudget` setting (0 disables the guard).
+ * Entries are ceilings, not fixed values: the `default` key applies to agents
+ * without an explicit entry, and the `task.softRequestBudget` setting can only
+ * lower an agent's budget, never raise it above its bundled entry (0 disables
+ * the guard entirely).
  */
 export declare const SOFT_REQUEST_BUDGET: Record<string, number>;
+/**
+ * Resolves the effective soft request budget for an agent. The configured
+ * `task.softRequestBudget` and the agent's bundled entry are both upper
+ * bounds, so the tighter one wins; a configured budget of 0 disables the
+ * guard regardless of the bundled entry.
+ */
+export declare function resolveSoftRequestBudget(agentName: string, configuredBudget: number): number;
 /** Extra requests allowed after a budget stop for the forced yield to land before the run is hard-aborted. */
 export declare const BUDGET_STOP_GRACE_REQUESTS = 5;
 /** Steering notice injected when a subagent crosses its soft request budget. */

package/dist/types/task/isolation-ownership.d.ts

@@ -0,0 +1,34 @@
+/** Marker file written into a task-isolation base dir identifying its owner. */
+export declare const ISOLATION_OWNER_FILE = ".omp-isolation-owner.json";
+/** Recorded owner of a task-isolation sandbox. */
+export interface IsolationOwner {
+    /** PID of the omp process that created and owns the sandbox. */
+    pid: number;
+    /** Task id the sandbox was materialised for. */
+    id: string;
+    /**
+     * Process-instance start-time token for {@link pid}, when the OS can report
+     * it. Distinguishes the owning process from an unrelated process that later
+     * inherits a recycled pid, so a crashed sandbox is never pinned live.
+     */
+    startToken?: string;
+}
+/**
+ * Record the current process as owner of the sandbox rooted at `baseDir`.
+ *
+ * Written before the isolation backend materialises `m` so a concurrent
+ * `omp worktree clear` never sees an owner-less sandbox mid-creation.
+ */
+export declare function writeIsolationOwner(baseDir: string, id: string): Promise<void>;
+/**
+ * Whether a live omp process still owns the sandbox at `baseDir`.
+ *
+ * A missing or malformed marker means no verifiable owner — a crashed run or a
+ * sandbox from before markers existed, both safe to reclaim. `process.kill(pid,
+ * 0)` can fail with `EPERM` even when the process is alive, so only an explicit
+ * `ESRCH` ("no such process") counts as dead; any other error is treated as
+ * alive to avoid deleting a sandbox that is actually in use. When the marker
+ * carries a {@link IsolationOwner.startToken}, a live pid whose current token no
+ * longer matches is a recycled pid — a different process — and counts as dead.
+ */
+export declare function hasLiveIsolationOwner(baseDir: string): Promise<boolean>;

package/dist/types/task/render.d.ts

@@ -11,6 +11,13 @@ interface TaskRenderContext {
      * commit-eligible rows do not repaint after entering native scrollback.
      */
     frozen?: boolean;
+    /**
+     * Wall clock for time-derived rows (current-tool elapsed, retry countdown).
+     * The component freezes it once the block settles or any of its rows enter
+     * native scrollback, so identical-input rebuilds stay byte-identical with
+     * committed history. Absent: render with the live clock.
+     */
+    nowMs?: number;
 }
 type TaskRenderOptions = RenderResultOptions & {
     renderContext?: TaskRenderContext;

package/dist/types/thinking.d.ts

@@ -103,6 +103,12 @@ export declare function parseCliThinkingLevel(value: string | null | undefined):
  * above Low (falling back to the full supported set only when the model maxes
  * out below Low). Within that pool the request snaps to the highest level not
  * exceeding it, or the pool minimum when the request is below the pool.
+ * `ceiling` bounds the pool from above, so a policy ceiling survives the model
+ * clamp: a sparse ladder such as `["max"]` must not snap an `xhigh` request up
+ * to `max`. The Low floor is resolved against the model's own ladder *before*
+ * the ceiling applies — a ceiling that hides every tier at or above Low means
+ * there is nothing legal to pick (`undefined`), not a licence to fall through
+ * to a sub-Low tier the model happens to expose.
  *
  * Returns `undefined` for reasoning-capable models without a controllable
  * effort surface (`thinking.efforts` empty — e.g. devin-agent models, where
@@ -111,7 +117,7 @@ export declare function parseCliThinkingLevel(value: string | null | undefined):
  * forward a concrete effort that would then trip {@link requireSupportedEffort}
  * downstream.
  */
-export declare function clampAutoThinkingEffort(model: Model | undefined, effort: Effort): Effort | undefined;
+export declare function clampAutoThinkingEffort(model: Model | undefined, effort: Effort, ceiling?: Effort): Effort | undefined;
 /** Coarse per-spawn effort selectors accepted by the task tool. */
 export declare const TASK_EFFORTS: readonly ["lo", "med", "hi"];
 /** Coarse task-spawn effort: the lowest, middle, or highest thinking level the target model supports. */
@@ -146,10 +152,16 @@ export declare function clampThinkingLevelToCeiling(model: Model | undefined, le
 export declare function modelSupportsEffortCeiling(model: Model, ceiling: Effort): boolean;
 /**
  * The provisional concrete level shown while `auto` is configured but before a
- * turn has been classified. Prefers the model's `defaultLevel`, otherwise High,
- * clamped into the auto range. Auto never provisions {@link Effort.Max} (the
- * classifier ceiling is XHigh; only an explicit user request reaches Max), so a
- * `defaultLevel` of `max` is capped at XHigh before clamping. Returns
- * `undefined` for non-reasoning models.
+ * turn has been classified, and the fallback when classification fails. Prefers
+ * the model's `defaultLevel`, otherwise High, clamped into the auto range.
+ *
+ * Deliberately stays below {@link Effort.Max}: the placeholder must not bill the
+ * top tier for a turn nobody classified, so XHigh is passed as a hard ceiling
+ * rather than only capping the preferred level — otherwise a sparse `["max"]`
+ * ladder would snap straight back up. A model whose ladder offers nothing at or
+ * below XHigh therefore has no provisional level, and `auto` leaves the current
+ * one in place. Classification itself may still resolve Max on models that
+ * expose the tier when the user opts in. Returns `undefined` for non-reasoning
+ * models.
  */
 export declare function resolveProvisionalAutoLevel(model: Model | undefined): Effort | undefined;

package/dist/types/tools/acp-bridge.d.ts

@@ -16,14 +16,37 @@ import type { ToolSession } from "./index.js";
  * that must stay off the editor's buffer.
  */
 export declare function shouldRouteWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string): boolean;
+/**
+ * Result of a bridge-routed write: the content actually verified on disk
+ * after the client processed the write, plus whether that content diverges
+ * from what the tool asked to persist.
+ *
+ * ACP's `fs/write_text_file` has no "verbatim, no side effects" guarantee —
+ * a client (e.g. Zed with `format_on_save: on`) may reformat the buffer as
+ * part of handling the write before it settles on disk. Silently trusting
+ * the requested `content` as "what's now on disk" lets that drift poison
+ * every snapshot/tag/hash a caller derives from the write, which then reads
+ * back as unrelated whole-file corruption on the *next* edit. Reading the
+ * file back and reporting what's actually there keeps callers honest.
+ */
+export interface BridgeWriteResult {
+    /** Content actually present on disk immediately after the bridge write. */
+    text: string;
+    /** `true` when `text` differs from the content the tool asked to write. */
+    driftedFromRequest: boolean;
+}
 /**
  * Try to route a file write through the ACP client bridge.
  *
  * Performs the full guard check, bridge call (wrapped in {@link ToolError}),
- * FS-scan cache invalidation, and session mutation-version bump.
+ * a post-write read-back to detect client-side transformation (e.g.
+ * format-on-save), FS-scan cache invalidation, and session mutation-version
+ * bump.
  *
- * Returns `true` when the bridge was used and the caller must skip the
- * writethrough path. Returns `false` when the bridge is unavailable or the
- * path should not be routed through it.
+ * Returns `undefined` when the bridge is unavailable or the path should not
+ * be routed through it — the caller must fall back to the writethrough path.
+ * Returns a {@link BridgeWriteResult} when the bridge was used; callers MUST
+ * use `result.text` (not the content they requested) for any snapshot, hash,
+ * or tag derived from this write.
  */
-export declare function routeWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string, content: string, signal?: AbortSignal): Promise<boolean>;
+export declare function routeWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string, content: string, signal?: AbortSignal): Promise<BridgeWriteResult | undefined>;

package/dist/types/tools/browser/cmux/cmux-tab.d.ts

@@ -8,7 +8,6 @@ import type { CmuxSocketClient } from "./socket-client.js";
 interface ScreenshotOptions {
     selector?: string;
     fullPage?: boolean;
-    save?: string;
     silent?: boolean;
     encoding?: "base64" | "binary";
 }
@@ -101,7 +100,7 @@ export declare class CmuxTab {
     scrollIntoView(selector: string): Promise<void>;
     select(selector: string, ...values: string[]): Promise<string[]>;
     extract(format?: ReadableFormat): Promise<string>;
-    screenshot(opts?: ScreenshotOptions): Promise<ScreenshotResult>;
+    screenshot(opts?: ScreenshotOptions): Promise<string>;
     waitForUrl(pattern: string | RegExp, opts?: {
         timeout?: number;
     }): Promise<string>;

package/dist/types/tools/browser/tab-worker.d.ts

@@ -1,5 +1,5 @@
 import type { HTMLElement } from "linkedom";
-import type { ElementHandle, ImageFormat } from "puppeteer-core";
+import type { ElementHandle } from "puppeteer-core";
 import type { Transport } from "./tab-protocol.js";
 declare module "puppeteer-core" {
     interface Frame {
@@ -41,7 +41,6 @@ export declare function resolveWaitTimeout(cellTimeoutMs: number, explicit?: num
 interface ScreenshotOptions {
     selector?: string;
     fullPage?: boolean;
-    save?: string;
     silent?: boolean;
 }
 export declare function normalizeSelector(selector: string): string;
@@ -67,8 +66,6 @@ export interface InflightOp {
 }
 /** Human-readable label for a screenshot op, used in op tracking + timeout errors. */
 export declare function describeScreenshot(opts?: ScreenshotOptions): string;
-/** Map an explicit save path's extension to a puppeteer capture format (default png). */
-export declare function imageFormatForPath(filePath: string): ImageFormat;
 /** Summarize still-running helpers (oldest first) so a cell timeout names what stalled. */
 export declare function describeInflight(inflight: Map<number, InflightOp>): string;
 export declare class WorkerCore {

package/dist/types/tools/grep.d.ts

@@ -55,7 +55,23 @@ export interface GrepToolDetails {
     missingPaths?: string[];
 }
 type SearchParams = typeof searchSchema.infer;
+/**
+ * Construction-time overrides for callers that are not the model.
+ *
+ * The model-facing schema deliberately does not grow these: they exist for
+ * wire bridges (the Cursor `pi_grep` frame) whose protocol carries an explicit
+ * context width and total match cap, and which would otherwise have to drop
+ * them. Unset means "use the session settings / built-in caps" — the behavior
+ * every model-issued call keeps.
+ */
+export interface GrepToolOptions {
+    /** Overrides `grep.contextBefore`/`grep.contextAfter` for every call on this instance. */
+    context?: number;
+    /** Caps total surfaced matches. Applied on top of the built-in per-file and file-window caps, never above them. */
+    totalMatchLimit?: number;
+}
 export declare class GrepTool implements AgentTool<typeof searchSchema, GrepToolDetails> {
+    #private;
     private readonly session;
     readonly name = "grep";
     readonly approval: (args: unknown) => ToolTier;
@@ -71,7 +87,7 @@ export declare class GrepTool implements AgentTool<typeof searchSchema, GrepTool
         skip?: number | null | undefined;
     }, {}>;
     readonly strict = true;
-    constructor(session: ToolSession);
+    constructor(session: ToolSession, options?: GrepToolOptions);
     execute(_toolCallId: string, params: SearchParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<GrepToolDetails>, _toolContext?: AgentToolContext): Promise<AgentToolResult<GrepToolDetails>>;
 }
 interface GrepRenderArgs {

package/dist/types/tools/hub/launch.d.ts

@@ -7,7 +7,7 @@
 import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
 import type { Component } from "@oh-my-pi/pi-tui";
 import type { RenderResultOptions } from "../../extensibility/custom-tools/types.js";
-import type { DaemonSnapshot, DaemonSpec, DaemonState } from "../../launch/protocol.js";
+import type { DaemonRpcResult, DaemonSnapshot, DaemonSpec, DaemonState } from "../../launch/protocol.js";
 import type { Theme } from "../../modes/theme/theme.js";
 import type { ToolSession } from "../index.js";
 /** Broker-facing launch parameters; the hub adapts its `ps` op to `list` before calling in. */
@@ -57,6 +57,10 @@ export interface LaunchToolDetails {
     /** describe: immutable launch spec backing the command/cwd detail lines. */
     spec?: DaemonSpec;
 }
+/** Resolve display rows while keeping legacy raw replay outside the client process. */
+export declare function renderLaunchLogTerminalRows(result: Extract<DaemonRpcResult, {
+    op: "logs";
+}>, params: Pick<LaunchParams, "head" | "lines">): Promise<string[] | undefined>;
 /** Run one broker operation for the calling session's project. */
 export declare function executeLaunch(session: ToolSession, params: LaunchParams, signal?: AbortSignal): Promise<AgentToolResult<LaunchToolDetails>>;
 /** Args shape visible to the renderer, possibly mid-stream (every field optional). */

package/dist/types/tools/index.d.ts

@@ -1,4 +1,4 @@
-import type { InMemorySnapshotStore } from "@oh-my-pi/hashline";
+import type { Clipboard, InMemorySnapshotStore } from "@oh-my-pi/hashline";
 import type { AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
 import type { FetchImpl, ImageContent, Model, ServiceTierByFamily, ToolChoice } from "@oh-my-pi/pi-ai";
 import type { AsyncJobManager } from "../async/job-manager.js";
@@ -321,6 +321,9 @@ export interface ToolSession {
      *  reconstruct the version the model authored anchors against when the
      *  file changed out-of-band. Lazily initialized by `getFileSnapshotStore`. */
     fileSnapshotStore?: InMemorySnapshotStore;
+    /** Per-session `CUT`/`PASTE` clipboard register shared across edit
+     *  calls. Lazily initialized by `getEditClipboard`. */
+    editClipboard?: Clipboard;
     /** Per-session log of unresolved git merge conflict regions surfaced by
      *  `read`. Each entry gets a stable id N referenced by `write conflict://N`
      *  to splice the recorded region with replacement content. Lazily initialized

package/dist/types/tools/path-utils.d.ts

@@ -129,6 +129,25 @@ export declare function isReadableUrlPath(value: string): boolean;
  * filesystem root is almost never what they intended.
  */
 export declare function resolveToCwd(filePath: string, cwd: string): string;
+/**
+ * Resolve a path that MUST stay inside `cwd`, or `null` when it would escape.
+ *
+ * {@link resolveToCwd} deliberately honors absolute paths, `~`, and `..` —
+ * correct for a path a user typed, wrong for one a remote peer supplied.
+ * Callers handling untrusted input (Cursor's `download_path`) use this instead:
+ * only a non-empty relative path landing under the live cwd is accepted, so
+ * neither `/etc/passwd` nor `../../escape` can be written through.
+ *
+ * The lexical check alone is not containment: a symlink inside the workspace
+ * can point anywhere, so `out/config` under a `ws/out -> /elsewhere` link is
+ * relative, `..`-free, and still writes outside. Both the target and its
+ * deepest existing ancestor are therefore realpath-resolved — the ancestor
+ * because a download names a file that does not exist yet, so the link in its
+ * path is the only thing that can be resolved before the write.
+ *
+ * The cwd itself is rejected: a download names a file, never the directory.
+ */
+export declare function confineToWorkspace(filePath: string, cwd: string): string | null;
 export declare function formatPathRelativeToCwd(filePath: string, cwd: string, options?: {
     trailingSlash?: boolean;
 }): string;