@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/dist/types/modes/interactive-mode.d.ts

@@ -14,11 +14,13 @@ import type { MCPManager } from "../mcp/index.js";
 import { type PlanApprovalDetails } from "../plan-mode/approved-plan.js";
 import { type AgentSession } from "../session/agent-session.js";
 import type { CompactMode } from "../session/compact-modes.js";
+import type { ForeignSessionSource } from "../session/foreign-session-store.js";
 import { HistoryStorage } from "../session/history-storage.js";
 import type { SessionContext } from "../session/session-context.js";
 import type { SessionManager } from "../session/session-manager.js";
 import type { ShakeMode } from "../session/shake-types.js";
 import type { LspStartupServerInfo } from "../tools/index.js";
+import { type StartupChangelogSelection } from "../utils/changelog.js";
 import type { EventBus } from "../utils/event-bus.js";
 import type { AssistantMessageComponent } from "./components/assistant-message.js";
 import type { BashExecutionComponent } from "./components/bash-execution.js";
@@ -174,7 +176,7 @@ export declare class InteractiveMode implements InteractiveModeContext {
     focusParentSession(): Promise<void>;
     unfocusSession(): Promise<void>;
     clearTransientSessionUi(): void;
-    constructor(session: AgentSession, version: string, changelogMarkdown?: string | undefined, setToolUIContext?: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers?: LspStartupServerInfo[] | undefined, mcpManager?: MCPManager, eventBus?: EventBus);
+    constructor(session: AgentSession, version: string, startupChangelog?: StartupChangelogSelection | undefined, setToolUIContext?: (uiContext: ExtensionUIContext, hasUI: boolean) => void, lspServers?: LspStartupServerInfo[] | undefined, mcpManager?: MCPManager, eventBus?: EventBus);
     playWelcomeIntro(): void;
     init(options?: InteractiveModeInitOptions): Promise<void>;
     /** Reload the title-generation system prompt override for the provided working
@@ -369,7 +371,7 @@ export declare class InteractiveMode implements InteractiveModeContext {
     showUserMessageSelector(): void;
     showCopySelector(): void;
     showTreeSelector(): void;
-    showSessionSelector(): void;
+    showSessionSelector(source?: ForeignSessionSource): void;
     handleResumeSession(sessionPath: string): Promise<void>;
     handleSessionDeleteCommand(): Promise<void>;
     showOAuthSelector(mode: "login" | "logout", providerId?: string): Promise<void>;

package/dist/types/modes/rpc/rpc-client.d.ts

@@ -135,6 +135,13 @@ export declare class RpcClient {
      * Get current session state.
      */
     getState(): Promise<RpcSessionState>;
+    /**
+     * Enable or disable fast mode for the active model family.
+     */
+    setFastMode(enabled: boolean): Promise<{
+        enabled: boolean;
+        active: boolean;
+    }>;
     /**
      * Configure subagent frames emitted by the RPC server. Servers default to "off".
      * "progress" emits lifecycle/progress frames; "events" additionally emits raw subagent session events.

package/dist/types/modes/rpc/rpc-types.d.ts

@@ -50,6 +50,10 @@ export type RpcCommand = {
 } | {
     id?: string;
     type: "get_state";
+} | {
+    id?: string;
+    type: "set_fast_mode";
+    enabled: boolean;
 } | {
     id?: string;
     type: "get_available_commands";
@@ -187,6 +191,9 @@ export interface RpcSessionState {
     sessionId: string;
     sessionName?: string;
     autoCompactionEnabled: boolean;
+    fastModeEnabled: boolean;
+    fastModeActive: boolean;
+    tokensPerSecond: number | null;
     messageCount: number;
     queuedMessageCount: number;
     todoPhases: TodoPhase[];
@@ -315,6 +322,15 @@ export type RpcResponse = {
     command: "get_state";
     success: true;
     data: RpcSessionState;
+} | {
+    id?: string;
+    type: "response";
+    command: "set_fast_mode";
+    success: true;
+    data: {
+        enabled: boolean;
+        active: boolean;
+    };
 } | {
     id?: string;
     type: "response";

package/dist/types/modes/theme/theme.d.ts

@@ -1,6 +1,6 @@
 import type { ThinkingLevel } from "@oh-my-pi/pi-agent-core";
 import type { Effort } from "@oh-my-pi/pi-ai";
-import type { EditorTheme, MarkdownTheme, SelectListTheme, SettingsListTheme, SymbolTheme } from "@oh-my-pi/pi-tui";
+import type { EditorTheme, MarkdownTheme, SelectListTheme, SettingsListTheme, SymbolTheme, Terminal } from "@oh-my-pi/pi-tui";
 export { getLanguageFromPath, isMarkdownPath } from "../../utils/lang-from-path.js";
 export type SymbolPreset = "unicode" | "nerd" | "ascii";
 /**
@@ -328,6 +328,17 @@ export declare function getAvailableSymbolPresets(): SymbolPreset[];
  * Check if a string is a valid symbol preset.
  */
 export declare function isValidSymbolPreset(preset: string): preset is SymbolPreset;
+type MacOSAppearanceReprobeTerminal = Pick<Terminal, "appearance" | "onAppearanceChange" | "onAppearanceReport" | "onPrivateModeReport" | "refreshAppearance">;
+/**
+ * Fall back to native macOS appearance notifications when the terminal
+ * explicitly confirms that Mode 2031 notifications are unsupported.
+ *
+ * Native notifications provisionally repaint from the host appearance and
+ * synchronously trigger an OSC 11 probe, followed by a bounded burst of six
+ * retries. A changed terminal classification cancels the sequence; otherwise
+ * a confirmed terminal classification is restored at the validation deadline.
+ */
+export declare function startMacOSAppearanceReprobeFallback(terminal: MacOSAppearanceReprobeTerminal): () => void;
 export declare function stopThemeWatcher(): void;
 /**
  * Get resolved theme colors as CSS-compatible hex strings.

package/dist/types/modes/types.d.ts

@@ -13,6 +13,7 @@ import type { MCPManager } from "../mcp/index.js";
 import type { PlanApprovalDetails } from "../plan-mode/approved-plan.js";
 import type { AgentSession } from "../session/agent-session.js";
 import type { CompactMode } from "../session/compact-modes.js";
+import type { ForeignSessionSource } from "../session/foreign-session-store.js";
 import type { HistoryStorage } from "../session/history-storage.js";
 import type { SessionContext } from "../session/session-context.js";
 import type { SessionManager } from "../session/session-manager.js";
@@ -357,7 +358,7 @@ export interface InteractiveModeContext {
     showUserMessageSelector(): void;
     showCopySelector(): void;
     showTreeSelector(): void;
-    showSessionSelector(): void;
+    showSessionSelector(source?: ForeignSessionSource): void;
     handleResumeSession(sessionPath: string): Promise<void>;
     handleSessionDeleteCommand(): Promise<void>;
     showOAuthSelector(mode: "login" | "logout", providerId?: string): Promise<void>;

package/dist/types/sdk.d.ts

@@ -39,6 +39,13 @@ export interface CreateAgentSessionOptions {
     authStorage?: AuthStorage;
     /** Model registry. Default: discoverModels(authStorage, agentDir) */
     modelRegistry?: ModelRegistry;
+    /**
+     * Request credential resolver. Defaults to the model registry's normal
+     * session-affine resolver. Security scans use this narrow seam to keep one
+     * durable OAuth row pinned for the operation without changing ordinary
+     * provider routing.
+     */
+    getApiKey?: AgentOptions["getApiKey"];
     /** Model to use. Default: from settings, else first available */
     model?: Model;
     /** Raw model pattern(s) (e.g. from --model CLI flag) to resolve after extensions load.
@@ -158,6 +165,8 @@ export interface CreateAgentSessionOptions {
     mcpManager?: MCPManager;
     /** Enable LSP integration (tool, formatting, diagnostics, warmup). Default: true */
     enableLsp?: boolean;
+    /** Restrict LSP to navigation and diagnostics even when enabled. Defaults to true for restricted sessions. */
+    lspReadOnly?: boolean;
     /** Whether this invocation may expose IRC. `false` removes it even for subagents. */
     enableIrc?: boolean;
     /** Skip subprocess-kernel availability checks and prelude warmup */
@@ -166,6 +175,12 @@ export interface CreateAgentSessionOptions {
     toolNames?: string[];
     /** Limit the session to explicitly supplied tool names, without discovered extras. */
     restrictToolNames?: boolean;
+    /**
+     * Permit only caller-supplied SDK custom tools inside a restricted session.
+     * They must still be named in {@link toolNames}; discovered extensions, MCP,
+     * and ambient custom tools remain disabled. Default: false.
+     */
+    allowRestrictedCustomTools?: boolean;
     /** Output schema for structured completion (subagents). */
     outputSchema?: unknown;
     /** Enforcement policy for {@link outputSchema}; defaults to legacy permissive behavior. */
@@ -270,6 +285,7 @@ export type * from "./extensibility/extensions/index.js";
 export type { Skill } from "./extensibility/skills.js";
 export type { FileSlashCommand } from "./extensibility/slash-commands.js";
 export type { MCPManager, MCPServerConfig, MCPServerConnection, MCPToolsLoadResult } from "./mcp/index.js";
+export { type AgentRef, AgentRegistry, MAIN_AGENT_ID } from "./registry/agent-registry.js";
 export type { Tool } from "./tools/index.js";
 export { buildDirectoryTree, buildWorkspaceTree, type DirectoryTree, type WorkspaceTree } from "./workspace-tree.js";
 export { BashTool, BUILTIN_TOOLS, createTools, EditTool, EvalTool, GlobTool, GrepTool, HIDDEN_TOOLS, ReadTool, type ToolSession, WebSearchTool, WriteTool, };
@@ -367,6 +383,8 @@ export interface BuildSystemPromptOptions {
     appendPrompt?: string;
     inlineToolDescriptors?: boolean;
     includeWorkspaceTree?: boolean;
+    /** Include the read-only security:// resource inventory entry. Default: false. */
+    securityEnabled?: boolean;
 }
 /**
  * Build the default provider-facing system prompt blocks.

package/dist/types/security/auth.d.ts

@@ -0,0 +1,30 @@
+import type { AgentOptions } from "@oh-my-pi/pi-agent-core";
+import type { OAuthAccessResolution } from "@oh-my-pi/pi-ai";
+import type { AuthStorage } from "../session/auth-storage.js";
+import type { SecurityAccountRef } from "./contracts/index.js";
+export interface ExactSecurityOAuthOptions {
+    authStorage: AuthStorage;
+    account: SecurityAccountRef;
+}
+export declare function assertSecurityIdentityMatches(account: SecurityAccountRef, resolution: {
+    credentialId?: number;
+    accountId?: string;
+    email?: string;
+    orgId?: string;
+    orgName?: string;
+}): void;
+export declare function selectSecurityAccount(authStorage: AuthStorage, provider: string, requestedCredentialId?: number, sessionId?: string): SecurityAccountRef;
+export declare function resolveExactSecurityOAuthAccess(authStorage: AuthStorage, account: SecurityAccountRef, options: {
+    forceRefresh: boolean;
+    signal?: AbortSignal;
+}): Promise<Extract<OAuthAccessResolution, {
+    ok: true;
+}>>;
+/**
+ * Build a request credential resolver pinned to one durable OAuth row.
+ *
+ * Initial resolution and refresh both target the same row. The auth driver's
+ * final sibling-rotation step returns `undefined`, so an unavailable account
+ * fails the scan rather than crossing an account/workspace boundary.
+ */
+export declare function createExactSecurityOAuthResolver(options: ExactSecurityOAuthOptions): NonNullable<AgentOptions["getApiKey"]>;

package/dist/types/security/cloud.d.ts

@@ -0,0 +1,79 @@
+import type { AuthStorage } from "../session/auth-storage.js";
+import { type SecurityAccountRef, type SecurityScanBundle, type SecuritySeverityLevel } from "./contracts/index.js";
+import type { SecurityStore } from "./store.js";
+type JsonObject = Record<string, unknown>;
+export type CodexSecurityCloudFetch = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
+export interface CodexSecurityCloudClientOptions {
+    authStorage: AuthStorage;
+    account: SecurityAccountRef;
+    baseUrl?: string;
+    fetch?: CodexSecurityCloudFetch;
+}
+export interface CodexSecurityCloudConfiguration {
+    id: string;
+    sourceId?: string;
+    repositoryId: string;
+    repositoryUrl: string;
+    environmentId: string;
+    state?: string;
+    currentStep?: string;
+    scanType?: string;
+    remainingScans?: number;
+    totalScans?: number;
+    createdAt?: string;
+    updatedAt?: string;
+}
+export interface CodexSecurityCloudConfigurationPage {
+    items: CodexSecurityCloudConfiguration[];
+    nextCursor?: string;
+    totalInAccount?: number;
+}
+export interface StartCodexSecurityCloudScanInput {
+    repositoryId: string;
+    repositoryUrl: string;
+    environmentId: string;
+    lookbackDays?: number | "all";
+    maintainerAttackConcerns?: string;
+    maintainerFocusAreas?: string;
+    maintainerAdditionalContext?: string;
+    signal?: AbortSignal;
+}
+export interface CodexSecurityCloudStats {
+    configurationId: string;
+    sourceConfigurationId?: string;
+    currentStep?: string;
+    pendingCommits: number;
+    finishedCommits: number;
+    failedCommits: number;
+    findingCounts: Record<SecuritySeverityLevel, number>;
+    lastScannedCommit?: string;
+    lastScannedAt?: string;
+    updatedAt?: string;
+}
+export interface PullCodexSecurityCloudResultsInput {
+    client: CodexSecurityCloudClient;
+    configurationId: string;
+    store: SecurityStore;
+    signal?: AbortSignal;
+}
+export declare class CodexSecurityCloudHttpError extends Error {
+    readonly status: number;
+    readonly endpoint: string;
+    constructor(status: number, endpoint: string);
+}
+export declare class CodexSecurityCloudClient {
+    #private;
+    constructor(options: CodexSecurityCloudClientOptions);
+    listConfigurations(options?: {
+        limit?: number;
+        cursor?: string;
+        signal?: AbortSignal;
+    }): Promise<CodexSecurityCloudConfigurationPage>;
+    listAllConfigurations(signal?: AbortSignal): Promise<CodexSecurityCloudConfiguration[]>;
+    getConfiguration(configurationId: string, signal?: AbortSignal): Promise<CodexSecurityCloudConfiguration>;
+    startScan(input: StartCodexSecurityCloudScanInput): Promise<CodexSecurityCloudConfiguration>;
+    getStats(configurationId: string, signal?: AbortSignal): Promise<CodexSecurityCloudStats>;
+    listFindingDetails(repositoryUrl: string, configuration: CodexSecurityCloudConfiguration, signal?: AbortSignal): Promise<JsonObject[]>;
+}
+export declare function pullCodexSecurityCloudResults(input: PullCodexSecurityCloudResultsInput): Promise<SecurityScanBundle>;
+export {};

package/dist/types/security/comparison.d.ts

@@ -0,0 +1,49 @@
+import type { SecurityComparisonReport, SecurityFinding, SecurityScanBundle } from "./contracts/index.js";
+export interface SecurityDifferentialFindingMatch {
+    referenceFindingId: string;
+    candidateFindingId: string;
+    basis: "fingerprint" | "rule_location" | "taxonomy_location";
+}
+export interface SecurityDifferentialFindingSummary {
+    findingId: string;
+    ruleId: string;
+    title: string;
+    severity: SecurityFinding["severity"]["level"];
+    confidence: SecurityFinding["confidence"]["level"];
+    validationStatus: SecurityFinding["validation"]["status"];
+    dispositionStatus: SecurityFinding["disposition"]["status"];
+    primaryLocation?: {
+        path: string;
+        startLine: number;
+    };
+}
+export interface SecurityDifferentialScanSummary {
+    scanId: string;
+    producer: SecurityScanBundle["scan"]["producer"];
+    status: SecurityScanBundle["scan"]["status"];
+    findingCount: number;
+    actionableFindingCount: number;
+    validatedFindingCount: number;
+    rejectedFindingCount: number;
+    coverage: SecurityScanBundle["scan"]["coverage"];
+    metrics?: SecurityScanBundle["scan"]["metrics"];
+}
+export interface SecurityDifferentialReport {
+    referenceScanId: string;
+    candidateScanId: string;
+    matches: SecurityDifferentialFindingMatch[];
+    referenceOnlyFindingIds: string[];
+    candidateOnlyFindingIds: string[];
+    reference: SecurityDifferentialScanSummary;
+    candidate: SecurityDifferentialScanSummary;
+    referenceOnlyFindings: SecurityDifferentialFindingSummary[];
+    candidateOnlyFindings: SecurityDifferentialFindingSummary[];
+    referenceFindingCount: number;
+    candidateFindingCount: number;
+    matchedFindingCount: number;
+    recallAgainstReference: number;
+    precisionAgainstReference: number;
+    jaccardOverlap: number;
+}
+export declare function compareSecurityProducers(reference: SecurityScanBundle, candidate: SecurityScanBundle): SecurityDifferentialReport;
+export declare function compareSecurityLineage(before: SecurityScanBundle, after: SecurityScanBundle): SecurityComparisonReport;

package/dist/types/security/contracts/ids.d.ts

@@ -0,0 +1,15 @@
+import type { SecurityLocation } from "./types.js";
+export declare function canonicalSecurityJson(value: unknown): string;
+export interface SecurityFindingFingerprintInput {
+    ruleId: string;
+    category: string;
+    anchor?: string;
+    locations: readonly SecurityLocation[];
+}
+export declare function createSecurityFindingFingerprint(input: SecurityFindingFingerprintInput): string;
+export declare function createSecurityFindingId(fingerprint: string): string;
+export declare function createSecurityOccurrenceId(fingerprint: string, locations: readonly SecurityLocation[]): string;
+export declare function createSecurityEvidenceId(fingerprint: string, label: string, ordinal: number): string;
+export declare function createSecurityScanId(randomUuid?: () => string): string;
+export declare function createSecurityPlanId(fingerprint: string): string;
+export declare function encodeSecurityProjectKey(repositoryRoot: string): string;

package/dist/types/security/contracts/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./ids.js";
+export * from "./schemas.js";
+export * from "./types.js";
+export * from "./validation.js";