@oh-my-pi/pi-coding-agent 17.1.7 → 17.2.0

package/dist/types/advisor/advise-tool.d.ts

@@ -36,13 +36,6 @@ export declare function formatAdvisorBatchContent(notes: readonly AdvisorNote[])
  * and `blocker` interrupt; a plain `nit` queues.
  */
 export declare function isInterruptingSeverity(severity: AdvisorSeverity | undefined): boolean;
-/**
- * Append a staleness caveat to an advisor note when newer primary turns arrived
- * after the reviewed transcript window (i.e. `hasFreshBacklog` is true on the
- * advisor runtime at delivery time). Pure function — no session coupling — so it
- * can be unit-tested in isolation and called from `AgentSession#routeAdvice`.
- */
-export declare function annotateForStaleness(note: string, hasFreshBacklog: boolean): string;
 /** How an advisor note is routed to the primary. */
 export type AdvisorDeliveryChannel = "aside" | "steer" | "preserve";
 /** Half-open turn-count fence for the post-interrupt cooldown. */

package/dist/types/advisor/runtime.d.ts

@@ -38,7 +38,7 @@ export interface AdvisorRuntimeHost {
      * recovery path must never replay the full primary transcript.
      * Optional: hosts that omit it get no proactive maintenance.
      */
-    maintainContext?(incomingTokens: number): Promise<boolean>;
+    maintainContext?(incomingTokens: number, signal: AbortSignal): Promise<boolean>;
     /**
      * Called immediately before each `agent.prompt(batch)` cycle. Lets the host
      * clear per-update advisor state — currently the one-advise-per-update gate
@@ -55,7 +55,7 @@ export interface AdvisorRuntimeHost {
      * failed prompt's appended turns before rollback. Errors thrown here are
      * logged and swallowed.
      */
-    onTurnError?(error: unknown, failedMessages: readonly AgentMessage[]): Promise<boolean | undefined> | boolean | undefined;
+    onTurnError?(error: unknown, failedMessages: readonly AgentMessage[], signal: AbortSignal): Promise<boolean | undefined> | boolean | undefined;
     /** Called after a successful advisor turn so the host can finish fallback lifecycle reporting. */
     onTurnSuccess?(): Promise<void> | void;
     /** Surface a non-recovering advisor failure to the host UI without adding model-visible context. */
@@ -64,6 +64,8 @@ export interface AdvisorRuntimeHost {
      *  recovery (credential switch, fallback chain) declined. Cleared only by
      *  an explicit reset (`/new`, config rebuild, session restart). */
     notifyQuotaExhausted?(): void;
+    /** Stable identity for the live advisor model. Used to restore full transcript rendering after a model switch. */
+    getModelIdentity?(): string;
 }
 /** Signals that an advisor response was discarded before it could become model-visible context. */
 export declare class AdvisorOutputQuarantinedError extends Error {
@@ -95,15 +97,6 @@ export declare class AdvisorRuntime {
     get failureNotified(): boolean;
     /** True after the runtime hard-stopped on repeated or permanent failures. */
     get halted(): boolean;
-    /**
-     * True when `#pending` is non-empty while the drain loop is busy — i.e., newer
-     * primary turns arrived after the current batch's transcript window was fixed
-     * but before the advisor model finished processing it. The delivery path uses
-     * this to annotate advice that was generated without seeing those newer turns.
-     * Can be true during `agent.prompt()`, a `maintainContext` await, or a retry
-     * sleep — any time `#drain` is busy and a concurrent `onTurnEnd` pushed.
-     */
-    get hasFreshBacklog(): boolean;
     /**
      * Called after each primary turn ends. Renders the incremental delta and
      * queues it for the advisor model.
@@ -125,6 +118,10 @@ export declare class AdvisorRuntime {
      */
     waitForCatchup(maxMs: number, threshold: number, signal?: AbortSignal): Promise<boolean>;
     dispose(): void;
+    /** Stop new advisor work and wait only for the active prompt's recorder-visible events. */
+    pauseForSessionTransition(): Promise<void>;
+    /** Continue queued work after a session transition rolls back or preserves the conversation. */
+    resumeAfterSessionTransition(): void;
     /**
      * Re-prime the advisor after a history rewrite (compaction, session
      * switch/resume, branch). Clears the advisor's own (non-persisted) context

package/dist/types/advisor/transcript-recorder.d.ts

@@ -14,6 +14,21 @@ export declare const ADVISOR_TRANSCRIPT_FILENAME = "__advisor.jsonl";
 export declare function advisorTranscriptFilename(slug: string): string;
 /** Whether a filename is any advisor transcript (`__advisor.jsonl` or `__advisor.<slug>.jsonl`). */
 export declare function isAdvisorTranscriptName(name: string): boolean;
+/**
+ * Sum the advisor spend already persisted next to a primary session transcript,
+ * keyed by advisor slug.
+ *
+ * The ledger a session keeps in memory only covers the current process, so a
+ * resumed session would report zero until the next advisor turn. The recorded
+ * transcripts are the durable copy of exactly the same finalized messages, so
+ * they are read back through the shared loader - no lock, no writer, and no
+ * second parser to keep in step with the session format.
+ *
+ * Only the session's own advisors count: subagent advisors write to
+ * `<session>/<SubId>/__advisor.jsonl`, and their spend belongs to the subagent,
+ * not to this roster. Hence the scan stays at the top level of the directory.
+ */
+export declare function loadAdvisorTranscriptCosts(sessionFile: string | undefined): Promise<Map<string, number>>;
 /**
  * Append-only persister for an advisor agent's transcript.
  *

package/dist/types/async/job-manager.d.ts

@@ -129,6 +129,17 @@ export declare class AsyncJobManager {
      * (used by `dispose()` to nuke the manager's state).
      */
     cancelAll(filter?: AsyncJobFilter): void;
+    /**
+     * Immediately evict completed and failed jobs matching the filter instead of
+     * waiting for retention expiry, dropping every queued delivery so a prior
+     * session's result can never be injected into a later transcript. Returns the
+     * number of jobs evicted.
+     *
+     * A delivery whose sink call is already in flight (or drained onto a caller's
+     * yield queue) is guarded by the owner's delivery generation, not the per-id
+     * suppression marker — that marker is cleared when the id is reused.
+     */
+    evictCompletedJobs(filter?: AsyncJobFilter): number;
     waitForAll(): Promise<void>;
     /**
      * Route completions for jobs owned by `ownerId` to `sink`. Sessions register

package/dist/types/auto-thinking/classifier.d.ts

@@ -5,7 +5,8 @@
  * {@link Effort}, clamped into the active model's supported range (never below
  * {@link Effort.Low}). Two backends, selected by `providers.autoThinkingModel`:
  *
- * - `online` (default): a smol model classifies into `low|medium|high|xhigh`.
+ * - `online` (default): a smol model classifies into `low|medium|high|xhigh`,
+ *   plus `max` when the target model exposes that tier.
  * - a local key: an on-device memory model classifies into the coarser
  *   `trivial|moderate|hard` scheme (3-class is more reliable than 4-way ordinal
  *   on sub-2B models), mapped to `low|high|xhigh`.
@@ -31,7 +32,13 @@ export interface ClassifyDifficultyDeps {
  * @throws when the backend cannot produce a usable classification.
  */
 export declare function classifyDifficulty(promptText: string, deps: ClassifyDifficultyDeps): Promise<Effort | undefined>;
-/** Map the online 4-way level keyword to an {@link Effort}; earliest match wins. */
+/**
+ * Map an online level keyword to an {@link Effort}; earliest match wins.
+ *
+ * `max` is only offered to the classifier when the target model exposes that
+ * tier, but it is always parsed: an unsupported `max` is snapped back down by
+ * {@link clampAutoThinkingEffort} rather than failing the turn.
+ */
 export declare function parseDifficultyLevel(text: string): Effort | undefined;
 /** Map the local 3-way bucket keyword to an {@link Effort}; earliest match wins. */
 export declare function parseDifficultyBucket(text: string): Effort | undefined;

package/dist/types/cleanse/agent.d.ts

@@ -0,0 +1,19 @@
+import type { CleanseAgentOutcome, CleanseAssignment, CleanseDiagnosticReport, CleanseLoopResult } from "./types.js";
+/** Hooks used by the standalone command to render subagent lifecycle progress. */
+export interface CleanseAgentHooks {
+    onStart?(name: string, assignment: CleanseAssignment): void;
+    onFinish?(outcome: CleanseAgentOutcome, assignment: CleanseAssignment): void;
+}
+/** Persisted parent session that dispatches file-disjoint cleanse workers. */
+export interface CleanseAgentRuntime {
+    readonly model: string;
+    readonly sessionFile: string;
+    dispatch(assignments: CleanseAssignment[], wave: number, report: CleanseDiagnosticReport, signal?: AbortSignal): Promise<CleanseAgentOutcome[]>;
+    close(result?: CleanseLoopResult): Promise<void>;
+}
+/** Resolve the requested model and create a fresh persisted cleanse session. */
+export declare function createCleanseAgentRuntime(options: {
+    cwd?: string;
+    model: string;
+    hooks?: CleanseAgentHooks;
+}): Promise<CleanseAgentRuntime>;

package/dist/types/cleanse/balance.d.ts

@@ -0,0 +1,7 @@
+import type { CleanseAssignment, CleanseDiagnostic, CleanseFileIssues } from "./types.js";
+/** Estimate repair burden from severity and available location/fix evidence. */
+export declare function diagnosticWeight(diagnostic: CleanseDiagnostic): number;
+/** Group diagnostics by file while keeping project-level failures together. */
+export declare function groupDiagnosticsByFile(diagnostics: readonly CleanseDiagnostic[]): CleanseFileIssues[];
+/** Balance whole-file workloads with longest-processing-time bin packing. */
+export declare function balanceDiagnostics(diagnostics: readonly CleanseDiagnostic[], maxAgents: number): CleanseAssignment[];

package/dist/types/cleanse/checkers.d.ts

@@ -0,0 +1,13 @@
+import type { CleanseDiagnosticReport, SkippedCleanseCheck } from "./types.js";
+/** Optional checker families enabled for a cleanse run. */
+export interface CleanseDiagnosticSuiteOptions {
+    includeTests?: boolean;
+}
+/** Re-runnable checker set discovered from one project snapshot. */
+export interface CleanseDiagnosticSuite {
+    readonly checkCount: number;
+    readonly skipped: readonly SkippedCleanseCheck[];
+    run(signal?: AbortSignal): Promise<CleanseDiagnosticReport>;
+}
+/** Discover configured language checkers without installing missing tools. */
+export declare function discoverCleanseDiagnosticSuite(projectCwd: string, options?: CleanseDiagnosticSuiteOptions): Promise<CleanseDiagnosticSuite>;

package/dist/types/cleanse/index.d.ts

@@ -0,0 +1,16 @@
+import type { CleanseDiagnosticReport } from "./types.js";
+/** User-facing options for `omp cleanse`. */
+export interface CleanseCommandOptions {
+    maxAgents?: number;
+    model?: string;
+    includeTests?: boolean;
+}
+/** Observable completion state returned to the CLI adapter. */
+export interface CleanseCommandResult {
+    exitCode: number;
+    status: "clean" | "unresolved" | "unsupported" | "cancelled";
+    report: CleanseDiagnosticReport;
+    sessionFile?: string;
+}
+/** Detect project diagnostics, dispatch one bounded repair batch, and verify it. */
+export declare function runCleanseCommand(options?: CleanseCommandOptions): Promise<CleanseCommandResult>;

package/dist/types/cleanse/loop.d.ts

@@ -0,0 +1,16 @@
+import type { CleanseAgentOutcome, CleanseAssignment, CleanseDiagnosticReport, CleanseLoopResult } from "./types.js";
+/** Runtime seams for one bounded diagnose, dispatch, and verify pass. */
+export interface CleanseLoopDependencies {
+    collect(signal?: AbortSignal): Promise<CleanseDiagnosticReport>;
+    dispatch(assignments: CleanseAssignment[], wave: number, report: CleanseDiagnosticReport, signal?: AbortSignal): Promise<CleanseAgentOutcome[]>;
+    onWave?(wave: number, assignments: readonly CleanseAssignment[]): void;
+    onReport?(wave: number, report: CleanseDiagnosticReport): void;
+}
+/** Inputs controlling one complete cleanse loop. */
+export interface CleanseLoopOptions {
+    maxAgents: number;
+    initialReport: CleanseDiagnosticReport;
+    signal?: AbortSignal;
+}
+/** Dispatch at most `maxAgents` workers once, then verify their combined edits. */
+export declare function runCleanseLoop(options: CleanseLoopOptions, dependencies: CleanseLoopDependencies): Promise<CleanseLoopResult>;

package/dist/types/cleanse/parsers.d.ts

@@ -0,0 +1,13 @@
+import type { CleanseDiagnostic } from "./types.js";
+/** Machine and fallback output formats understood by cleanse. */
+export type CleanseParserKind = "rust" | "rust-test" | "go" | "go-test" | "ruff" | "pyright" | "eslint" | "biome" | "rubocop" | "phpstan" | "psalm" | "swiftlint" | "dart" | "credo" | "shellcheck" | "hlint" | "terraform" | "tflint" | "generic";
+/** Captured checker process output passed to a format parser. */
+export interface CleanseParserInput {
+    checker: string;
+    projectCwd: string;
+    checkerCwd: string;
+    stdout: string;
+    stderr: string;
+}
+/** Parse one checker invocation into normalized, project-relative diagnostics. */
+export declare function parseCleanseDiagnostics(kind: CleanseParserKind, input: CleanseParserInput): CleanseDiagnostic[];

package/dist/types/cleanse/progress.d.ts

@@ -0,0 +1,14 @@
+/** Minimal output contract used by the interactive cleanse progress reporter. */
+export interface CleanseProgressOutput {
+    isTTY?: boolean;
+    write(text: string): boolean;
+}
+/** Renders completed repair workers on one transient terminal line. */
+export interface CleanseProgressReporter {
+    readonly interactive: boolean;
+    start(total: number): void;
+    complete(): void;
+    finish(): void;
+}
+/** Create the TTY-only worker completion reporter used by `omp cleanse`. */
+export declare function createCleanseProgressReporter(output?: CleanseProgressOutput): CleanseProgressReporter;

package/dist/types/cleanse/types.d.ts

@@ -0,0 +1,64 @@
+/** Severity normalized across checker-specific output formats. */
+export type CleanseSeverity = "error" | "warning" | "info";
+/** One actionable problem reported by a project checker. */
+export interface CleanseDiagnostic {
+    checker: string;
+    file?: string;
+    line?: number;
+    column?: number;
+    endLine?: number;
+    endColumn?: number;
+    code?: string;
+    severity: CleanseSeverity;
+    message: string;
+    suggestion?: string;
+}
+/** Result metadata for one checker invocation. */
+export interface CleanseCheckResult {
+    id: string;
+    label: string;
+    language: string;
+    cwd: string;
+    command: string;
+    exitCode: number | null;
+    diagnostics: CleanseDiagnostic[];
+}
+/** Checker discovery result omitted because its required executable was unavailable. */
+export interface SkippedCleanseCheck {
+    label: string;
+    language: string;
+    reason: string;
+}
+/** Aggregate diagnostics from every checker selected for a project. */
+export interface CleanseDiagnosticReport {
+    checks: CleanseCheckResult[];
+    diagnostics: CleanseDiagnostic[];
+    skipped: SkippedCleanseCheck[];
+}
+/** All diagnostics attached to one file, which scheduling never splits across agents. */
+export interface CleanseFileIssues {
+    file?: string;
+    diagnostics: CleanseDiagnostic[];
+    weight: number;
+}
+/** One weighted, file-disjoint workload handed to a subagent. */
+export interface CleanseAssignment {
+    index: number;
+    groups: CleanseFileIssues[];
+    weight: number;
+}
+/** Settled result from one cleanse subagent. */
+export interface CleanseAgentOutcome {
+    name: string;
+    success: boolean;
+    output: string;
+    error?: string;
+    resolvedModel?: string;
+}
+/** Final state after one bounded repair wave and verification pass. */
+export interface CleanseLoopResult {
+    status: "clean" | "stalled" | "cancelled";
+    waves: number;
+    report: CleanseDiagnosticReport;
+    outcomes: CleanseAgentOutcome[];
+}

package/dist/types/cli/args.d.ts

@@ -27,6 +27,8 @@ export interface Args {
     advisor?: boolean;
     continue?: boolean;
     resume?: string | true;
+    fromClaude?: boolean;
+    fromCodex?: boolean;
     help?: boolean;
     version?: boolean;
     mode?: Mode;

package/dist/types/cli/session-picker.d.ts

@@ -1,11 +1,18 @@
 import type { SessionInfo } from "../session/session-listing.js";
+/** Presentation and capability controls for the standalone session picker. */
+export interface SessionPickerOptions {
+    allSessions?: SessionInfo[];
+    title?: string;
+    scopeLabel?: string | false;
+    showCwd?: boolean;
+    allowDelete?: boolean;
+    allowGlobalScope?: boolean;
+    historySearch?: boolean;
+}
 /**
  * Show the TUI session selector and return the selected session, or null if
- * cancelled. Rendered as a fullscreen overlay on the terminal's alternate
- * screen, so the list scrolls and rows are clickable with the mouse. Tab
- * toggles between current-folder and all-projects scope; the all-projects list
- * is loaded lazily via `SessionManager.listAll`.
+ * cancelled. The default OMP picker supports deletion, transcript-history
+ * search, and an all-projects scope; foreign import pickers disable those
+ * source-owned capabilities.
  */
-export declare function selectSession(sessions: SessionInfo[], options?: {
-    allSessions?: SessionInfo[];
-}): Promise<SessionInfo | null>;
+export declare function selectSession(sessions: SessionInfo[], options?: SessionPickerOptions): Promise<SessionInfo | null>;

package/dist/types/collab/guest.d.ts

@@ -10,6 +10,7 @@ export interface GuestIdleReconcilerCtx {
     statusLine: {
         markActivityEnd: () => void;
     };
+    statusContainer: Pick<InteractiveModeContext["statusContainer"], "disposeChildren">;
     loadingAnimation: {
         stop: () => void;
     } | undefined;
@@ -17,8 +18,8 @@ export interface GuestIdleReconcilerCtx {
 /**
  * Close the guest UI state held open by an earlier `agent_start` whose
  * matching `agent_end` never reached us — most often because a reconnect
- * dropped the event mid-stream. Triggered from {@link CollabGuestLink}'s
- * `state` reconciler when the host reports `isStreaming === false`:
+ * dropped the event mid-stream. Reached via {@link reconcileGuestSnapshotHostState}
+ * (the live `state`-frame and welcome/resync reconciler) when the host reports `isStreaming === false`:
  * folds the in-flight active-time window into the per-session meter (so
  * `time_spent` stops ticking) and stops the `Working…` loader if one is
  * still animating. No-op when the host is still streaming.
@@ -32,7 +33,25 @@ export interface GuestSnapshotActivityReconcilerCtx extends GuestIdleReconcilerC
     statusLine: GuestIdleReconcilerCtx["statusLine"] & {
         markActivityStart: () => void;
     };
+    /**
+     * Start (or re-attach) the live "Working…" loader. Mirrors
+     * `InteractiveModeContext.ensureLoadingAnimation`, which is what
+     * `EventController` calls on `agent_start`. Required so a guest that
+     * missed an earlier `agent_start` (a reconnect dropped it mid-stream)
+     * starts its spinner when the host later reports it is streaming.
+     */
+    ensureLoadingAnimation: InteractiveModeContext["ensureLoadingAnimation"];
+    autoCompactionLoader: InteractiveModeContext["autoCompactionLoader"];
+    retryLoader: InteractiveModeContext["retryLoader"];
 }
+/** Status-area state which cannot outlive removal of its child components. */
+export interface GuestTransientStatusCtx {
+    statusContainer: Pick<InteractiveModeContext["statusContainer"], "clear">;
+    autoCompactionLoader: InteractiveModeContext["autoCompactionLoader"];
+    retryLoader: InteractiveModeContext["retryLoader"];
+}
+/** Stop and forget status-area loaders before detaching their components. */
+export declare function clearGuestTransientStatus(ctx: GuestTransientStatusCtx): void;
 export declare function reconcileGuestSnapshotHostState(ctx: GuestSnapshotActivityReconcilerCtx, isStreaming: boolean): void;
 export declare class CollabGuestLink {
     #private;

package/dist/types/commands/cleanse.d.ts

@@ -0,0 +1,23 @@
+import { Command } from "@oh-my-pi/pi-utils/cli";
+export default class Cleanse extends Command {
+    static description: string;
+    static flags: {
+        agents: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"integer"> & {
+            char: string;
+            description: string;
+            default: number;
+        };
+        model: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"string"> & {
+            char: string;
+            description: string;
+            default: string;
+        };
+        tests: import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"boolean"> & {
+            char: string;
+            description: string;
+            default: boolean;
+        };
+    };
+    static examples: string[];
+    run(): Promise<void>;
+}

package/dist/types/commands/launch.d.ts

@@ -88,6 +88,12 @@ export default class Index extends Command {
             char: string;
             description: string;
         };
+        "from-claude": import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
+        "from-codex": import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"boolean"> & {
+            description: string;
+        };
         "session-dir": import("@oh-my-pi/pi-utils/cli").FlagDescriptor<"string"> & {
             description: string;
         };

package/dist/types/config/settings-schema.d.ts

@@ -839,6 +839,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Render Mermaid fenced code blocks as ASCII diagrams";
         };
     };
+    readonly "tui.codexResetFireworks": {
+        readonly type: "boolean";
+        readonly default: false;
+        readonly ui: {
+            readonly tab: "appearance";
+            readonly group: "Display";
+            readonly label: "Codex Reset Fireworks";
+            readonly description: "Celebrate unscheduled Codex weekly usage resets and newly banked saved resets with a top-third fireworks overlay that remains until Escape";
+        };
+    };
     readonly "tui.titleState": {
         readonly type: "boolean";
         readonly default: true;
@@ -1796,14 +1806,28 @@ export declare const SETTINGS_SCHEMA: {
             }];
         };
     };
-    readonly collapseChangelog: {
-        readonly type: "boolean";
-        readonly default: false;
+    readonly "startup.changelogMode": {
+        readonly type: "enum";
+        readonly values: readonly ["summary", "expanded", "hidden"];
+        readonly default: "summary";
         readonly ui: {
             readonly tab: "interaction";
             readonly group: "Startup & Updates";
-            readonly label: "Collapse Changelog";
-            readonly description: "Show condensed changelog after updates";
+            readonly label: "Startup Changelog";
+            readonly description: "Choose whether update notes start as a summary, full details, or stay hidden";
+            readonly options: readonly [{
+                readonly value: "summary";
+                readonly label: "Summary";
+                readonly description: "Show release and change counts with a /changelog hint";
+            }, {
+                readonly value: "expanded";
+                readonly label: "Expanded";
+                readonly description: "Show the recent release notes in full";
+            }, {
+                readonly value: "hidden";
+                readonly label: "Hidden";
+                readonly description: "Do not show release notes on startup";
+            }];
         };
     };
     readonly "magicKeywords.enabled": {
@@ -4147,6 +4171,16 @@ export declare const SETTINGS_SCHEMA: {
             readonly description: "Enable the browser tool for scripted Chromium automation (puppeteer)";
         };
     };
+    readonly "browser.cdpUrl": {
+        readonly type: "string";
+        readonly default: undefined;
+        readonly ui: {
+            readonly tab: "tools";
+            readonly group: "Grep & Browser";
+            readonly label: "Browser CDP URL";
+            readonly description: "Default HTTP CDP discovery endpoint (for example http://127.0.0.1:9222) to attach to instead of launching a browser. Explicit app.cdp_url or app.path on the tool call take precedence.";
+        };
+    };
     readonly "browser.headless": {
         readonly type: "boolean";
         readonly default: true;
@@ -4717,7 +4751,7 @@ export declare const SETTINGS_SCHEMA: {
             readonly tab: "tasks";
             readonly group: "Subagents";
             readonly label: "Soft Subagent Request Budget";
-            readonly description: "Soft per-subagent request budget (assistant requests per run). Crossing it injects a wrap-up steering notice (see task.softRequestBudgetNotice); at 1.5x the budget the run is force-stopped and the agent must yield its partial findings. 0 disables the guard. Bundled scout/sonic agents use a lower built-in budget.";
+            readonly description: "Soft per-subagent request budget (assistant requests per run). Crossing it injects a wrap-up steering notice (see task.softRequestBudgetNotice); at 1.5x the budget the run is force-stopped and the agent must yield its partial findings. 0 disables the guard. Bundled scout/sonic agents cap out at a lower built-in budget, so a value below that cap still applies to them.";
             readonly options: readonly [{
                 readonly value: "0";
                 readonly label: "Disabled";
@@ -4970,7 +5004,7 @@ export declare const SETTINGS_SCHEMA: {
             } | {
                 readonly value: "exa";
                 readonly label: "Exa";
-                readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+                readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
             } | {
                 readonly value: "tinyfish";
                 readonly label: "TinyFish";
@@ -5074,7 +5108,7 @@ export declare const SETTINGS_SCHEMA: {
             } | {
                 readonly value: "exa";
                 readonly label: "Exa";
-                readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+                readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
             } | {
                 readonly value: "tinyfish";
                 readonly label: "TinyFish";
@@ -5580,6 +5614,27 @@ export declare const SETTINGS_SCHEMA: {
             })[];
         };
     };
+    readonly "providers.autoThinkingMaxEffort": {
+        readonly type: "enum";
+        readonly values: readonly ["xhigh", "max"];
+        readonly default: "xhigh";
+        readonly ui: {
+            readonly tab: "model";
+            readonly group: "Thinking";
+            readonly label: "Auto Thinking Ceiling";
+            readonly description: "Highest effort the `auto` classifier may resolve. `xhigh` keeps the classifier one tier below the top, so only an explicit `ultrathink` reaches `max`; `max` lets a turn the classifier judges exceptional bill the top tier on models that expose it.";
+            readonly condition: "autoThinkingActive";
+            readonly options: readonly [{
+                readonly value: "xhigh";
+                readonly label: "xhigh";
+                readonly description: "Classifier stops at xhigh (default)";
+            }, {
+                readonly value: "max";
+                readonly label: "max";
+                readonly description: "Classifier may resolve max where the model supports it";
+            }];
+        };
+    };
     readonly "features.unexpectedStopDetection": {
         readonly type: "boolean";
         readonly default: false;

package/dist/types/cursor-bridge-tools.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Per-call tools the Cursor exec bridge needs but the model-facing registry
+ * cannot supply.
+ *
+ * Both bridge callsites — the primary session and the advisor roster — build
+ * the same instances, and both must apply the session's approval wrapper. A
+ * raw tool here silently escapes the gate every registry call goes through, so
+ * the construction lives in one place rather than being repeated per callsite.
+ */
+import type { AgentTool } from "@oh-my-pi/pi-agent-core";
+import type { ExtensionRunner } from "./extensibility/extensions/index.js";
+import type { GrepToolOptions, ToolSession } from "./tools/index.js";
+/**
+ * Build the bridge's `createGrepTool` factory for one tool session.
+ *
+ * A `pi_grep` frame carries its own context width and total match cap. Neither
+ * is expressible in the model-facing `grep` schema — context comes from
+ * `grep.contextBefore`/`grep.contextAfter`, fixed when the shared instance is
+ * constructed — so honoring them needs a fresh tool per call.
+ *
+ * The result is wrapped exactly like a registry tool: the approval gate runs on
+ * every call site, and a per-call instance is no exception.
+ */
+export declare function createBridgeGrepFactory(session: ToolSession, extensionRunner: ExtensionRunner): (options: GrepToolOptions) => AgentTool;
+/**
+ * Build the `replace`-mode `edit` the bridge answers `pi_edit` with.
+ *
+ * `PiEditExecArgs` carries `old_text`/`new_text` pairs, which is exactly
+ * `replace`'s schema and nothing else's. The session's own instance follows the
+ * configured `edit.mode` — `hashline` by default, whose schema is a single
+ * `input` string — so a frame handed that instance fails validation instead of
+ * editing the file.
+ *
+ * Callers MUST gate this on the session having actually granted `edit`: the
+ * tool is constructed rather than looked up, so building one unconditionally
+ * hands a restricted agent a mutating tool it was denied (issue #5680).
+ */
+export declare function createBridgeEditTool(session: ToolSession, extensionRunner: ExtensionRunner): AgentTool;
+/**
+ * The tool map the exec bridge should run, given the map a caller granted.
+ *
+ * `pi_edit` needs a `replace`-mode instance, but only when `edit` was granted:
+ * the tool is constructed rather than looked up, so substituting
+ * unconditionally would hand a restricted roster a mutating tool it was denied
+ * (issue #5680). The granted map is never mutated: an unsubstituted result is a
+ * copy, so a caller without an `edit` grant cannot accidentally gain one.
+ *
+ * The advisor roster passes its granted map here; the primary session keeps its
+ * instance out of the registry entirely (Cursor does not advertise `edit`) and
+ * serves it through the bridge's `getEditReplaceTool` accessor instead — not
+ * the `getTool` fallback, which doubles as the agent loop's resolver for
+ * unadvertised calls and must stay device-only.
+ */
+export declare function bridgeToolMap(granted: ReadonlyMap<string, AgentTool>, createEditTool: (() => AgentTool | undefined) | undefined): Map<string, AgentTool>;