@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/src/utils/git.ts

@@ -197,12 +197,14 @@ const GIT_NON_INTERACTIVE_ENV = {
 	GIT_ASKPASS: "true",
 	GIT_EDITOR: "true",
 	GIT_TERMINAL_PROMPT: "0",
+	LC_ALL: undefined,
+	LC_MESSAGES: "C",
 	SSH_ASKPASS: "/usr/bin/false",
-} satisfies Record<string, string>;
+} satisfies Record<string, string | undefined>;
 const GH_NON_INTERACTIVE_ENV = {
 	...GIT_NON_INTERACTIVE_ENV,
 	GH_PROMPT_DISABLED: "1",
-} satisfies Record<string, string>;
+} satisfies Record<string, string | undefined>;
 
 /** Default deadline for git and gh subprocesses spawned by the coding agent. */
 export const GIT_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
@@ -215,6 +217,14 @@ export const GIT_COMMAND_TIMEOUT_MS = 5 * 60 * 1000;
 export const GIT_NETWORK_TIMEOUT_MS = 30 * 60 * 1000;
 /** Maximum captured stdout or stderr bytes retained from git and gh subprocesses. */
 export const GIT_COMMAND_OUTPUT_LIMIT_BYTES = 8 * 1024 * 1024;
+/**
+ * Deadline for synchronous git plumbing commands launched via
+ * {@link gitSpawnSyncText}. These run on the render path (e.g. reftable HEAD
+ * resolution), so the deadline is short: a command that has not exited by then
+ * is killed and reported as {@link GIT_COMMAND_TIMEOUT_EXIT_CODE} so the caller
+ * degrades instead of freezing the UI indefinitely.
+ */
+export const GIT_SPAWN_SYNC_TIMEOUT_MS = 5_000;
 
 const GIT_COMMAND_TIMEOUT_EXIT_CODE = 124;
 // Exit code returned when the `git` binary cannot be launched at all (spawn
@@ -378,16 +388,35 @@ function normalizeStdin(input: CommandOptions["stdin"]): "ignore" | Uint8Array {
 	return new Uint8Array(input);
 }
 
-function buildGitEnv(overrides?: Record<string, string | undefined>): Record<string, string | undefined> {
+function buildNonInteractiveEnv(
+	env: Record<string, string | undefined>,
+	pinnedEnv: Record<string, string | undefined>,
+): Record<string, string | undefined> {
+	const preservedCharacterLocale =
+		env.LC_ALL !== undefined && /(?:^|[._-])utf-?8(?:$|[.@_-])/i.test(env.LC_ALL) ? env.LC_ALL : undefined;
 	return {
-		...process.env,
-		GIT_OPTIONAL_LOCKS: "0",
-		...AMBIENT_GIT_ENV,
-		...overrides,
-		...GIT_NON_INTERACTIVE_ENV,
+		...env,
+		...(preservedCharacterLocale === undefined ? {} : { LC_CTYPE: preservedCharacterLocale }),
+		...pinnedEnv,
 	};
 }
 
+function buildGitEnv(overrides?: Record<string, string | undefined>): Record<string, string | undefined> {
+	return buildNonInteractiveEnv(
+		{
+			...process.env,
+			GIT_OPTIONAL_LOCKS: "0",
+			...AMBIENT_GIT_ENV,
+			...overrides,
+		},
+		GIT_NON_INTERACTIVE_ENV,
+	);
+}
+
+function buildGhEnv(): Record<string, string | undefined> {
+	return buildNonInteractiveEnv({ ...process.env }, GH_NON_INTERACTIVE_ENV);
+}
+
 function ensureAvailable(): void {
 	if (!$which("git")) {
 		throw new Error("git is not installed.");
@@ -399,8 +428,17 @@ function ensureAvailable(): void {
  * exit code plus trimmed stdout; a missing `git` binary (spawn ENOENT) is
  * reported as {@link GIT_SPAWN_ENOENT_EXIT_CODE} so sync read-only callers
  * degrade to `null` instead of throwing an uncaught error during rendering.
+ *
+ * A deadline ({@link GIT_SPAWN_SYNC_TIMEOUT_MS}) is enforced so a pathological
+ * git invocation (lock contention, NFS stall, …) cannot hang the render path
+ * indefinitely: a child killed by the deadline is reported as
+ * {@link GIT_COMMAND_TIMEOUT_EXIT_CODE} rather than a successful exit.
  */
-function gitSpawnSyncText(cwd: string, args: readonly string[]): { exitCode: number; stdout: string } {
+function gitSpawnSyncText(
+	cwd: string,
+	args: readonly string[],
+	timeoutMs: number = GIT_SPAWN_SYNC_TIMEOUT_MS,
+): { exitCode: number; stdout: string } {
 	const commandArgs = withShortLivedGitConfig(withNoOptionalLocks(args));
 	try {
 		const result = Bun.spawnSync(["git", ...commandArgs], {
@@ -409,8 +447,14 @@ function gitSpawnSyncText(cwd: string, args: readonly string[]): { exitCode: num
 			stdout: "pipe",
 			stderr: "pipe",
 			windowsHide: true,
+			timeout: timeoutMs,
 		});
-		return { exitCode: result.exitCode ?? 0, stdout: new TextDecoder().decode(result.stdout).trim() };
+		// Bun's timeout marker is authoritative even when process cleanup reports
+		// exit code zero, so render-path callers never trust partial output.
+		const exitCode = result.exitedDueToTimeout
+			? GIT_COMMAND_TIMEOUT_EXIT_CODE
+			: (result.exitCode ?? GIT_COMMAND_TIMEOUT_EXIT_CODE);
+		return { exitCode, stdout: new TextDecoder().decode(result.stdout).trim() };
 	} catch (err) {
 		if (isEnoent(err)) return { exitCode: GIT_SPAWN_ENOENT_EXIT_CODE, stdout: "" };
 		throw err;
@@ -1683,6 +1727,12 @@ export const revList = {
 	async range(cwd: string, base: string, head: string, signal?: AbortSignal): Promise<string[]> {
 		return splitLines(await runText(cwd, ["rev-list", "--reverse", `${base}..${head}`], { readOnly: true, signal }));
 	},
+	/** Commits reachable from `ref` that touched `file`, newest first, capped at `limit`. */
+	async touching(cwd: string, ref: string, file: string, limit: number, signal?: AbortSignal): Promise<string[]> {
+		return splitLines(
+			await runText(cwd, ["rev-list", `--max-count=${limit}`, ref, "--", file], { readOnly: true, signal }),
+		);
+	},
 };
 
 // ════════════════════════════════════════════════════════════════════════════
@@ -2374,10 +2424,7 @@ export const github = {
 		try {
 			const child = Bun.spawn(["gh", ...args], {
 				cwd,
-				env: {
-					...process.env,
-					...GH_NON_INTERACTIVE_ENV,
-				},
+				env: buildGhEnv(),
 				stdin: "ignore",
 				stdout: "pipe",
 				stderr: "pipe",

package/src/utils/jj.ts

@@ -2,6 +2,7 @@ import * as fs from "node:fs";
 import * as path from "node:path";
 import { $which } from "@oh-my-pi/pi-utils";
 import { LRUCache } from "lru-cache/raw";
+import { withTimeoutSignal } from "./fetch-timeout";
 import * as git from "./git";
 
 // ════════════════════════════════════════════════════════════════════════════
@@ -27,19 +28,24 @@ export interface JjRepository {
 }
 
 /** Options for `jj diff` invocations. */
-export interface DiffOptions {
+export interface DiffOptions extends JjCommandOptions {
 	/** Optional file paths to restrict the diff with `-- <files>`. */
 	readonly files?: readonly string[];
 	/** Return only changed file names instead of Git-format diff text. */
 	readonly nameOnly?: boolean;
-	/** Optional abort signal passed to the spawned `jj` process. */
-	readonly signal?: AbortSignal;
 }
 
-interface CommandOptions {
+/** Options for a bounded `jj` subprocess query. */
+export interface JjCommandOptions {
+	/** Optional cancellation signal for the subprocess. */
 	readonly signal?: AbortSignal;
+	/** Deadline in milliseconds. Defaults to {@link JJ_COMMAND_TIMEOUT_MS}. */
+	readonly timeoutMs?: number;
 }
 
+/** Default finite deadline for local jj subprocesses. */
+export const JJ_COMMAND_TIMEOUT_MS = 5_000;
+
 // ════════════════════════════════════════════════════════════════════════════
 // Error
 // ════════════════════════════════════════════════════════════════════════════
@@ -83,10 +89,10 @@ function formatCommandFailure(
 	return `jj ${args.join(" ")} failed with exit code ${result.exitCode}`;
 }
 
-async function jj(cwd: string, args: readonly string[], options: CommandOptions = {}): Promise<JjCommandResult> {
+async function jj(cwd: string, args: readonly string[], options: JjCommandOptions = {}): Promise<JjCommandResult> {
 	const child = Bun.spawn(["jj", "--no-pager", "--color=never", ...args], {
 		cwd,
-		signal: options.signal,
+		signal: withTimeoutSignal(options.timeoutMs ?? JJ_COMMAND_TIMEOUT_MS, options.signal),
 		stdin: "ignore",
 		stdout: "pipe",
 		stderr: "pipe",
@@ -109,7 +115,7 @@ async function jj(cwd: string, args: readonly string[], options: CommandOptions
 async function runChecked(
 	cwd: string,
 	args: readonly string[],
-	options: CommandOptions = {},
+	options: JjCommandOptions = {},
 ): Promise<JjCommandResult> {
 	ensureAvailable();
 	const result = await jj(cwd, args, options);
@@ -119,14 +125,14 @@ async function runChecked(
 	return result;
 }
 
-async function runText(cwd: string, args: readonly string[], options: CommandOptions = {}): Promise<string> {
+async function runText(cwd: string, args: readonly string[], options: JjCommandOptions = {}): Promise<string> {
 	return (await runChecked(cwd, args, options)).stdout;
 }
 
 async function runOptionalText(
 	cwd: string,
 	args: readonly string[],
-	options: CommandOptions = {},
+	options: JjCommandOptions = {},
 ): Promise<string | null> {
 	try {
 		const result = await jj(cwd, args, options);
@@ -294,7 +300,7 @@ export const workingCopy = {
 	 * Label `@` with its nearest bookmark, falling back to its short change ID.
 	 * Returns `null` when `jj` is unavailable or the query fails.
 	 */
-	async label(cwd: string, signal?: AbortSignal): Promise<string | null> {
+	async label(cwd: string, options?: JjCommandOptions): Promise<string | null> {
 		const raw = await runOptionalText(
 			cwd,
 			[
@@ -306,7 +312,7 @@ export const workingCopy = {
 				"-T",
 				WORKING_COPY_LABEL_TEMPLATE,
 			],
-			{ signal },
+			options,
 		);
 		return raw === null ? null : parseWorkingCopyLabel(raw);
 	},
@@ -325,8 +331,8 @@ export const status = {
 	 * Count changes in `@` relative to its parent using the Git status shape.
 	 * Jujutsu has no index, so `staged` is always zero.
 	 */
-	async summary(cwd: string, signal?: AbortSignal): Promise<git.GitStatusSummary | null> {
-		const raw = await runOptionalText(cwd, ["diff", "-r", "@", "--summary", "--ignore-working-copy"], { signal });
+	async summary(cwd: string, options?: JjCommandOptions): Promise<git.GitStatusSummary | null> {
+		const raw = await runOptionalText(cwd, ["diff", "-r", "@", "--summary", "--ignore-working-copy"], options);
 		return raw === null ? null : parseStatusSummary(raw);
 	},
 

package/src/web/search/providers/codex.ts

@@ -114,7 +114,28 @@ function getDefaultModelCandidates(): CodexModelCandidate[] {
 	return fallbackModel ? [{ modelId: fallbackModel.id, catalogModel: fallbackModel }] : [{ modelId: FALLBACK_MODEL }];
 }
 
+/**
+ * Raised when Codex produced an answer without invoking the hosted `web_search`
+ * tool. GPT-5.6 Responses-Lite models receive `tool_choice: "auto"` (the forced
+ * hosted choice is invalid under the lite shape — see #5771 / #5772), so the
+ * model may skip searching and return a plain completion. A search command must
+ * not present that as a successful, search-backed result (#6988); this advances
+ * the candidate chain to a model that will search, or surfaces a clear failure
+ * when the model was explicitly configured.
+ */
+class CodexNoWebSearchError extends SearchProviderError {
+	constructor() {
+		super(
+			"codex",
+			"Codex returned a completion without running web search (no web_search_call event); refusing to treat a non-search answer as a search result",
+			502,
+		);
+		this.name = "CodexNoWebSearchError";
+	}
+}
+
 function shouldRetryWithNextDefaultModel(error: unknown): boolean {
+	if (error instanceof CodexNoWebSearchError) return true;
 	if (!(error instanceof SearchProviderError)) return false;
 	if (error.provider !== "codex" || error.status !== 400) return false;
 	return /model is not supported|requested model is not supported|not supported when using codex with a chatgpt account/i.test(
@@ -472,11 +493,19 @@ async function callCodexSearch(
 	let model = requestedModel;
 	let requestId = "";
 	let usage: { inputTokens: number; outputTokens: number; totalTokens: number } | undefined;
+	// Evidence that the hosted web_search tool actually ran. Lite models get
+	// `tool_choice: "auto"` and may answer without searching (#6988); a search
+	// command must reject that rather than return a non-search completion.
+	let webSearchInvoked = false;
 
 	for await (const rawEvent of readSseJson<Record<string, unknown>>(response.body, options.signal)) {
 		const eventType = typeof rawEvent.type === "string" ? rawEvent.type : "";
 		if (!eventType) continue;
 
+		if (eventType.startsWith("response.web_search_call")) {
+			webSearchInvoked = true;
+		}
+
 		if (eventType === "response.output_text.delta") {
 			const delta = typeof rawEvent.delta === "string" ? rawEvent.delta : "";
 			if (delta) {
@@ -485,6 +514,7 @@ async function callCodexSearch(
 		} else if (eventType === "response.output_item.done") {
 			const item = rawEvent.item as CodexResponseItem | undefined;
 			if (!item) continue;
+			if (item.type === "web_search_call") webSearchInvoked = true;
 
 			// Handle text message content and extract sources from annotations
 			if (item.type === "message" && item.content) {
@@ -538,6 +568,10 @@ async function callCodexSearch(
 		}
 	}
 
+	if (!webSearchInvoked) {
+		throw new CodexNoWebSearchError();
+	}
+
 	const finalAnswer = answerParts.join("\n\n").trim();
 	const streamedAnswer = streamedAnswerParts.join("").trim();
 	// Throw to advance the chain whenever Codex emitted nothing but image

package/src/web/search/types.ts

@@ -32,7 +32,7 @@ export const SEARCH_PROVIDER_OPTIONS = [
 	},
 	{ value: "xai", label: "xAI", description: "Grok web search via xAI Responses API (requires XAI_API_KEY)" },
 	{ value: "zai", label: "Z.AI", description: "Calls Z.AI webSearchPrime MCP" },
-	{ value: "exa", label: "Exa", description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP" },
+	{ value: "exa", label: "Exa", description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP" },
 	{ value: "tinyfish", label: "TinyFish", description: "Requires TINYFISH_API_KEY" },
 	{ value: "jina", label: "Jina", description: "Requires JINA_API_KEY" },
 	{ value: "kagi", label: "Kagi", description: "Requires KAGI_API_KEY and Kagi Search API beta access" },