@oh-my-pi/pi-coding-agent 17.2.10 → 17.2.12

package/dist/types/tools/read-format.d.ts

@@ -0,0 +1,104 @@
+import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
+import type { ToolSession } from "../sdk.js";
+import { type LineEntry } from "../utils/block-context.js";
+import { type LineRange } from "./path-utils.js";
+import type { ReadToolDetails } from "./read.js";
+export interface HashlineHeaderContext {
+    header: string;
+    tag: string;
+    fullText?: string;
+}
+export declare function formatReadHashlineHeader(displayPath: string, tag: string): string;
+export declare function readHashlineHeaderContext(session: ToolSession, absolutePath: string, cwd: string): Promise<HashlineHeaderContext>;
+export declare function hashlineHeaderContext(displayPath: string, tag: string): HashlineHeaderContext;
+export declare function prependHashlineHeader(text: string, context: HashlineHeaderContext | undefined): string;
+export declare function formatTextWithMode(text: string, startNum: number, shouldAddHashLines: boolean, shouldAddLineNumbers: boolean): string;
+export declare const BRACKET_CONTEXT_ELLIPSIS = "\u2026";
+export declare function formatLineEntriesWithMode(entries: readonly LineEntry[], shouldAddHashLines: boolean, shouldAddLineNumbers: boolean): string;
+/**
+ * Decide whether the kept lines surrounding an elided range collapse to a
+ * single brace-pair line in the rendered summary. Returns true when the head
+ * line ends with `{` / `(` / `[` and the tail line is the matching closer
+ * (optionally followed by terminating punctuation like `;`, `,`, or further
+ * closers — e.g. `};`, `})`, `]);`).
+ */
+export declare function canMergeBracePair(headLine: string, tailLine: string): boolean;
+export declare function formatSingleLine(line: number, text: string, shouldAddHashLines: boolean, shouldAddLineNumbers: boolean): string;
+export declare function formatMergedBraceLine(startLine: number, endLine: number, headText: string, tailText: string, shouldAddHashLines: boolean, shouldAddLineNumbers: boolean): {
+    model: string;
+    display: string;
+};
+export declare function countTextLines(text: string): number;
+export declare function contiguousLineNumbers(startLine: number, count: number): number[];
+export declare function lineNumbersFromSpans(spans: readonly {
+    startLine: number;
+    endLine: number;
+}[]): number[];
+/** Inclusive line range describing one elided span in a structural summary. */
+export interface ElidedRange {
+    start: number;
+    end: number;
+}
+/**
+ * Footer appended to summarized reads telling the model how to recover the
+ * elided body. Without this hint, agents either ignore the `…`/`{ … }`
+ * markers or burn a turn guessing the right selector (see issue #1046). The
+ * footer demonstrates the multi-range selector syntax with concrete sample
+ * ranges drawn from the actual elision so the model re-reads only what it
+ * needs instead of falling back to `:raw` or whole-file reads.
+ */
+export declare function formatSummaryElisionFooter(readPath: string, elidedRanges: ReadonlyArray<ElidedRange>, elidedLines: number): string;
+export declare const READ_CHUNK_SIZE: number;
+/**
+ * Context lines added around an explicit range read. Anchor-stale failures
+ * cluster on edits whose anchors land just outside the most recent read
+ * window, but the data (`scripts/session-stats/analyze_selector_reads.py`)
+ * shows most follow-up reads are disjoint hops, not adjacent extensions —
+ * so symmetric padding rarely pays for itself.
+ *
+ * Leading=1 catches accidental single-line reads where the anchor is the
+ * line immediately above the requested start. Trailing=3 buffers the
+ * common case where the agent asks for a narrow range and then needs the
+ * next few lines to disambiguate an anchor.
+ */
+export declare const RANGE_LEADING_CONTEXT_LINES = 1;
+export declare const RANGE_TRAILING_CONTEXT_LINES = 3;
+export declare function buildInMemoryTextResult(session: ToolSession, text: string, offset: number | undefined, limit: number | undefined, options: {
+    details?: ReadToolDetails;
+    sourcePath?: string;
+    sourceUrl?: string;
+    sourceInternal?: string;
+    entityLabel: string;
+    ignoreResultLimits?: boolean;
+    raw?: boolean;
+    immutable?: boolean;
+}): AgentToolResult<ReadToolDetails>;
+/**
+ * Render a multi-range read against in-memory text. Each range emits a
+ * formatted block with its own anchors / line numbers, blocks are joined
+ * with an elision separator, and ranges past EOF surface as `[…]` notices
+ * so the model can correct the next call. No leading/trailing context is
+ * added — multi-range callers always specify exact bounds.
+ */
+export declare function buildInMemoryMultiRangeResult(session: ToolSession, text: string, ranges: readonly LineRange[], options: {
+    details?: ReadToolDetails;
+    sourcePath?: string;
+    sourceUrl?: string;
+    sourceInternal?: string;
+    entityLabel: string;
+    raw?: boolean;
+    immutable?: boolean;
+}): AgentToolResult<ReadToolDetails>;
+export declare function decodeUtf8Text(bytes: Uint8Array): string | null;
+export declare function prependSuffixResolutionNotice(text: string, suffixResolution?: {
+    from: string;
+    to: string;
+}): string;
+/**
+ * Tag Markdown reads for the TUI's formatted preview, gated on the opt-in
+ * `read.renderMarkdown` setting. Off by default; when disabled, no local
+ * read is tagged `text/markdown`, so the renderer output is identical to
+ * the pre-setting behavior. Internal-URL reads keep their protocol-supplied
+ * `contentType` and render as Markdown regardless of the setting.
+ */
+export declare function markMarkdownContentType(session: ToolSession, details: ReadToolDetails, filePath: string): ReadToolDetails;

package/dist/types/tools/read-path-resolution.d.ts

@@ -0,0 +1,19 @@
+import type { ToolSession } from "../sdk.js";
+export declare function isRemoteMountPath(absolutePath: string): boolean;
+export declare function isNotFoundError(error: unknown): boolean;
+/** Per-execute memo of suffix-glob lookups; `null` records a confirmed miss. */
+export type SuffixMatchCache = Map<string, {
+    absolutePath: string;
+    displayPath: string;
+} | null>;
+/**
+ * Memoized {@link findUniqueWorkspaceSuffix} for a single read call. A missing
+ * path with archive/sqlite extensions probes the workspace once per stage
+ * (archive candidates, sqlite candidates, plain path) — each glob carries a
+ * 5s timeout, so repeated lookups of the same string stack into a long
+ * stall before erroring. The cache collapses repeats within one execute().
+ */
+export declare function findSuffixMatchCached(session: ToolSession, cache: SuffixMatchCache, rawPath: string, signal?: AbortSignal): Promise<{
+    absolutePath: string;
+    displayPath: string;
+} | null>;

package/dist/types/tools/read-pdf-images.d.ts

@@ -0,0 +1,12 @@
+import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
+import type { ToolSession } from "../sdk.js";
+import type { ReadToolDetails } from "./read.js";
+export declare function rewritePdfImagePlaceholders(markdown: string, pdfPath: string): string;
+export declare function splitPdfImageMemberReadPath(readPath: string): {
+    pdfPath: string;
+    member: string;
+} | null;
+export declare function readPdfImageMember(session: ToolSession, autoResizeImages: boolean, absolutePdfPath: string, pdfDisplayPath: string, member: string, suffixResolution: {
+    from: string;
+    to: string;
+} | undefined, signal?: AbortSignal): Promise<AgentToolResult<ReadToolDetails>>;

package/dist/types/tools/read-renderer.d.ts

@@ -0,0 +1,24 @@
+import type { Component } from "@oh-my-pi/pi-tui";
+import type { RenderResultOptions } from "../extensibility/custom-tools/types.js";
+import { type Theme } from "../modes/theme/theme.js";
+import type { ReadToolDetails } from "./read.js";
+interface ReadRenderArgs {
+    path?: unknown;
+    file_path?: unknown;
+    offset?: number;
+    limit?: number;
+    raw?: boolean;
+}
+export declare const readToolRenderer: {
+    renderCall(args: ReadRenderArgs, _options: RenderResultOptions, uiTheme: Theme): Component;
+    renderResult(result: {
+        content: Array<{
+            type: string;
+            text?: string;
+        }>;
+        details?: ReadToolDetails;
+        isError?: boolean;
+    }, options: RenderResultOptions, uiTheme: Theme, args?: ReadRenderArgs): Component;
+    mergeCallAndResult: boolean;
+};
+export {};

package/dist/types/tools/read-selector.d.ts

@@ -0,0 +1,27 @@
+import type { LineRange } from "./path-utils.js";
+/** Parsed representation of a path-embedded selector. */
+export type ParsedSelector = {
+    kind: "none";
+} | {
+    kind: "raw";
+} | {
+    kind: "conflicts";
+} | {
+    kind: "lines";
+    ranges: [LineRange, ...LineRange[]];
+    raw?: boolean;
+};
+/** Returns true when the selector requested verbatim/raw output (alone or combined with a range). */
+export declare function isRawSelector(parsed: ParsedSelector): boolean;
+/** Returns true when the selector requested multiple line ranges. */
+export declare function isMultiRange(parsed: ParsedSelector): boolean;
+export declare function parseSel(sel: string | undefined): ParsedSelector;
+/**
+ * Convert a single-range selector to the offset/limit pair used by internal pagination.
+ * Returns the FIRST range only — multi-range callers MUST branch on `isMultiRange` before
+ * calling this helper.
+ */
+export declare function selToOffsetLimit(parsed: ParsedSelector): {
+    offset?: number;
+    limit?: number;
+};

package/dist/types/tools/read-sqlite.d.ts

@@ -0,0 +1,16 @@
+import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
+import type { ToolSession } from "../sdk.js";
+import type { ReadToolDetails } from "./read.js";
+import { type SuffixMatchCache } from "./read-path-resolution.js";
+interface ResolvedSqliteReadPath {
+    absolutePath: string;
+    sqliteSubPath: string;
+    queryString: string;
+    suffixResolution?: {
+        from: string;
+        to: string;
+    };
+}
+export declare function resolveSqliteReadPath(session: ToolSession, readPath: string, suffixCache: SuffixMatchCache, signal?: AbortSignal): Promise<ResolvedSqliteReadPath | null>;
+export declare function readSqlite(resolvedSqlitePath: ResolvedSqliteReadPath, signal?: AbortSignal): Promise<AgentToolResult<ReadToolDetails>>;
+export {};

package/dist/types/tools/read-summary.d.ts

@@ -0,0 +1,19 @@
+import { type SummaryResult } from "@oh-my-pi/pi-natives";
+import type { ToolSession } from "../sdk.js";
+import { type ElidedRange } from "./read-format.js";
+/**
+ * Prose files (Markdown flavors and plain text) skip code-block summarization
+ * unless `read.summarize.prose` opts them in.
+ */
+export declare function isProseSummaryPath(filePath: string): boolean;
+export declare function routeReadThroughBridge(session: ToolSession, absolutePath: string, options?: {
+    line?: number;
+    limit?: number;
+}): Promise<string> | undefined;
+export declare function trySummarize(session: ToolSession, absolutePath: string, fileSize: number, signal?: AbortSignal): Promise<SummaryResult | null>;
+export declare function renderSummary(session: ToolSession, summary: SummaryResult): {
+    text: string;
+    displayText: string;
+    elidedRanges: ElidedRange[];
+    elidedLines: number;
+};

package/dist/types/tools/read.d.ts

@@ -1,10 +1,8 @@
 import type { AgentTool, AgentToolContext, AgentToolResult, AgentToolUpdateCallback, ToolTier } from "@oh-my-pi/pi-agent-core";
-import type { Component } from "@oh-my-pi/pi-tui";
-import type { RenderResultOptions } from "../extensibility/custom-tools/types.js";
-import { type Theme } from "../modes/theme/theme.js";
 import type { ToolSession } from "../sdk.js";
 import { type TruncationResult } from "../session/streaming-output.js";
 import { type OutputMeta } from "./output-meta.js";
+export { readToolRenderer } from "./read-renderer.js";
 declare const readSchema: import("@oh-my-pi/omptype").FluentType<{
     path: string;
 }, {
@@ -76,23 +74,3 @@ export declare class ReadTool implements AgentTool<typeof readSchema, ReadToolDe
     syncInspectImageState(availableOverride?: boolean): boolean;
     execute(_toolCallId: string, params: ReadParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<ReadToolDetails>, _toolContext?: AgentToolContext): Promise<AgentToolResult<ReadToolDetails>>;
 }
-interface ReadRenderArgs {
-    path?: unknown;
-    file_path?: unknown;
-    offset?: number;
-    limit?: number;
-    raw?: boolean;
-}
-export declare const readToolRenderer: {
-    renderCall(args: ReadRenderArgs, _options: RenderResultOptions, uiTheme: Theme): Component;
-    renderResult(result: {
-        content: Array<{
-            type: string;
-            text?: string;
-        }>;
-        details?: ReadToolDetails;
-        isError?: boolean;
-    }, options: RenderResultOptions, uiTheme: Theme, args?: ReadRenderArgs): Component;
-    mergeCallAndResult: boolean;
-};
-export {};

package/dist/types/tools/shell-tokenize.d.ts

@@ -17,7 +17,7 @@ export declare function tokenizeShellSegments(command: string): string[][];
  *
  * @see extractFlatShellCommandSegments
  */
-export interface FlatShellCommandSegment {
+interface FlatShellCommandSegment {
     /** Original segment text with quoting and escaping preserved. */
     text: string;
     /**
@@ -41,3 +41,20 @@ export interface FlatShellCommandSegment {
  * complete input in that case.
  */
 export declare function extractFlatShellCommandSegments(command: string): FlatShellCommandSegment[];
+/**
+ * Parses a leading `cd <path> && ...` prefix so the bash tool can route the
+ * target through its structured `cwd` parameter when the model omits it.
+ *
+ * Returns the single path token (quotes and backslash escapes resolved to their
+ * literal value) and the command remainder after the top-level `&&`, or `null`
+ * when the command does not begin with exactly `cd`, one path token, and a
+ * top-level `&&`. The scanner deliberately bails on anything else in the prefix
+ * — redirects (`cd /tmp 2>/dev/null && ...`), extra arguments, or paths needing
+ * shell expansion (`$`, backticks, `(`) — leaving the whole command for the
+ * shell instead of absorbing shell syntax into `cwd`.
+ */
+export declare function extractLeadingCdTarget(command: string): {
+    path: string;
+    rest: string;
+} | null;
+export {};

package/dist/types/utils/changelog.d.ts

@@ -38,11 +38,6 @@ export declare function formatStartupChangelogSummary(selection: StartupChangelo
  */
 export declare function resolveBundledChangelogPath(assetPath: string, moduleUrl: string | URL): string | URL;
 export declare function parseChangelog(changelogPath: string | undefined): Promise<ChangelogEntry[]>;
-/**
- * Compare changelog entries by their parsed version parts.
- * Returns: -1 if v1 < v2, 0 if v1 === v2, 1 if v1 > v2
- */
-export declare function compareChangelogEntries(v1: ChangelogEntry, v2: ChangelogEntry): number;
 /**
  * Parse an omp changelog marker version into comparable parts.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.2.10",
+	"version": "17.2.12",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -50,18 +50,18 @@
 	},
 	"dependencies": {
 		"@babel/parser": "^7.29.7",
-		"@oh-my-pi/hashline": "17.2.10",
-		"@oh-my-pi/omp-stats": "17.2.10",
-		"@oh-my-pi/omptype": "17.2.10",
-		"@oh-my-pi/pi-agent-core": "17.2.10",
-		"@oh-my-pi/pi-ai": "17.2.10",
-		"@oh-my-pi/pi-catalog": "17.2.10",
-		"@oh-my-pi/pi-mnemopi": "17.2.10",
-		"@oh-my-pi/pi-natives": "17.2.10",
-		"@oh-my-pi/pi-tui": "17.2.10",
-		"@oh-my-pi/pi-utils": "17.2.10",
-		"@oh-my-pi/pi-wire": "17.2.10",
-		"@oh-my-pi/snapcompact": "17.2.10",
+		"@oh-my-pi/hashline": "17.2.12",
+		"@oh-my-pi/omp-stats": "17.2.12",
+		"@oh-my-pi/omptype": "17.2.12",
+		"@oh-my-pi/pi-agent-core": "17.2.12",
+		"@oh-my-pi/pi-ai": "17.2.12",
+		"@oh-my-pi/pi-catalog": "17.2.12",
+		"@oh-my-pi/pi-mnemopi": "17.2.12",
+		"@oh-my-pi/pi-natives": "17.2.12",
+		"@oh-my-pi/pi-tui": "17.2.12",
+		"@oh-my-pi/pi-utils": "17.2.12",
+		"@oh-my-pi/pi-wire": "17.2.12",
+		"@oh-my-pi/snapcompact": "17.2.12",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/scripts/legacy-pi-virtual-module.ts

@@ -151,7 +151,10 @@ export async function collectBundledPiEntries(): Promise<BundledPiEntry[]> {
 				const glob = new Bun.Glob(`**/*${pattern.sourceSuffix}`);
 				const matches: string[] = [];
 				for await (const match of glob.scan({ cwd: sourceDir, onlyFiles: true })) {
-					matches.push(match);
+					// Bun.Glob yields host separators; the export keys and generated
+					// identifiers below are `/`-shaped. Same normalization as
+					// `generate-docs-index.ts`.
+					matches.push(match.split(path.sep).join("/"));
 				}
 				matches.sort();
 				for (const match of matches) {

package/src/advisor/runtime.ts

@@ -5,7 +5,8 @@ import * as AIError from "@oh-my-pi/pi-ai/error";
 import { raceWithSignal } from "@oh-my-pi/pi-ai/utils/abort";
 import { type CursorExecResolvedCarrier, kCursorExecResolved } from "@oh-my-pi/pi-ai/utils/block-symbols";
 import { logger } from "@oh-my-pi/pi-utils";
-import { obfuscateToolArguments, type SecretObfuscator } from "../secrets/obfuscator";
+import { obfuscateToolArguments } from "../secrets/message-transform";
+import type { SecretObfuscator } from "../secrets/obfuscator";
 import {
 	formatExecutionSourcePreview,
 	formatSessionHistoryMarkdown,
@@ -970,14 +971,16 @@ export class AdvisorRuntime {
 					this.#wakeAllWaiters();
 					const failedMessages = this.agent.state.messages.slice(messageSnapshot);
 					const terminalFailure = this.#terminalAssistantFailure(messageSnapshot);
-					const classifierRefusal =
-						(terminalFailure !== undefined && isClassifierRefusal(terminalFailure)) ||
-						AIError.is(AIError.classify(err), AIError.Flag.ContentBlocked);
+					const rawErrorId = AIError.classify(err);
 					const terminalFailureId =
 						terminalFailure === undefined ? undefined : AIError.classifyMessage(terminalFailure);
+					const classifierRefusal =
+						(terminalFailure !== undefined && isClassifierRefusal(terminalFailure)) ||
+						(!AIError.is(rawErrorId, AIError.Flag.AccountPolicy) &&
+							AIError.is(rawErrorId, AIError.Flag.ContentBlocked));
 					const contextOverflow =
 						(terminalFailureId !== undefined && AIError.is(terminalFailureId, AIError.Flag.ContextOverflow)) ||
-						AIError.is(AIError.classify(err), AIError.Flag.ContextOverflow);
+						AIError.is(rawErrorId, AIError.Flag.ContextOverflow);
 					// A terminal provider failure that is neither retriable nor an
 					// overflow (e.g. a blocked prompt) will fail identically on every
 					// retry — classify it before rollback so the batch is dropped after
@@ -1208,12 +1211,14 @@ export class AdvisorRuntime {
 	}
 }
 
-/** Mirrors turn recovery's refusal classification and retains AIError's provider-neutral content-block fallback. */
+/** Mirrors turn recovery's refusal classification without treating account eligibility as a model refusal. */
 function isClassifierRefusal(message: AssistantMessage): boolean {
 	if (message.stopReason !== "error") return false;
+	const id = AIError.classifyMessage(message);
+	if (AIError.is(id, AIError.Flag.AccountPolicy)) return false;
 	const stopType = message.stopDetails?.type;
 	if (stopType === "refusal" || stopType === "sensitive") return true;
-	return AIError.is(AIError.classifyMessage(message), AIError.Flag.ContentBlocked);
+	return AIError.is(id, AIError.Flag.ContentBlocked);
 }
 
 /**

package/src/capability/mcp.ts

@@ -27,12 +27,23 @@ export interface MCPServer {
 	args?: string[];
 	/** Environment variables */
 	env?: Record<string, string>;
+	/**
+	 * `literal`: env values are opaque plugin package data (Agent Plugins
+	 * §§4.1/9.2) — exempt from env-name lookup and `!command` resolution.
+	 */
+	envPolicy?: "literal";
 	/** Working directory for stdio transport */
 	cwd?: string;
 	/** URL (for HTTP/SSE transport) */
 	url?: string;
 	/** HTTP headers (for HTTP transport) */
 	headers?: Record<string, string>;
+	/**
+	 * `origin-locked`: configured headers are literal package data pinned to the
+	 * configured URL's origin (Agent Plugins §7.2.1) — never expanded, never
+	 * forwarded cross-origin, and client-generated headers win case-insensitively.
+	 */
+	headerPolicy?: "origin-locked";
 	/** Authentication configuration */
 	auth?: {
 		type: "oauth" | "apikey";

package/src/capability/skill.ts

@@ -43,6 +43,12 @@ export interface Skill {
 	content: string;
 	/** Parsed frontmatter */
 	frontmatter?: SkillFrontmatter;
+	/**
+	 * Filesystem-resolved plugin root this skill was packaged in (Agent Plugins
+	 * §4.1). When set, every `skill://` resource access must realpath-resolve
+	 * within this directory; symlinks may target other files inside it.
+	 */
+	containRoot?: string;
 	/** Source level */
 	level: "user" | "project";
 	/** Source metadata */

package/src/cli/command-help.ts

@@ -72,6 +72,10 @@ export const sayHelp = {
 
 export const searchHelp = { description: "Test web search providers" } satisfies CommandMetadata;
 
+export const shareHelp = {
+	description: "Share a saved session via an encrypted link (same as /share)",
+} satisfies CommandMetadata;
+
 export const setupHelp = {
 	description: "Run onboarding setup or install dependencies for optional features",
 } satisfies CommandMetadata;

package/src/cli/gallery-cli.ts

@@ -153,7 +153,7 @@ export async function renderGalleryState(
 	const component = new ToolExecutionComponent(
 		componentName,
 		streamingArgs,
-		{ showImages: false },
+		{ showImages: false, useBuiltInRenderer: !fixture.customRendered },
 		tool,
 		ui,
 		getProjectDir(),

package/src/cli-commands.ts

@@ -120,6 +120,11 @@ export const commands: CommandEntry[] = [
 		load: () => import("./commands/say").then(m => m.default),
 		help: commandHelp.sayHelp,
 	},
+	{
+		name: "share",
+		load: () => import("./commands/share").then(m => m.default),
+		help: commandHelp.shareHelp,
+	},
 	{
 		name: "setup",
 		load: () => import("./commands/setup").then(m => m.default),

package/src/commands/commit.ts

@@ -5,7 +5,7 @@
 import { postmortem } from "@oh-my-pi/pi-utils";
 import { Command, Flags } from "@oh-my-pi/pi-utils/cli";
 import { commitHelp as commandHelp } from "../cli/command-help";
-import { runCommitCommand } from "../commit";
+import { CommitAbortedError, runCommitCommand } from "../commit";
 import type { CommitCommandArgs } from "../commit/types";
 import { initTheme } from "../modes/theme/theme";
 
@@ -41,7 +41,20 @@ export default class Commit extends Command {
 		// is already written. Mirror the `runPrintMode` exit pattern from
 		// `main.ts` so the CLI returns to the shell instead of stranding the user
 		// on Ctrl+C (issue #1041).
-		await runCommitCommand(cmd);
-		await postmortem.quit(0);
+		let exitCode = 0;
+		try {
+			const { usedFallback } = await runCommitCommand(cmd);
+			// A commit written by the mechanical fallback is a degraded outcome:
+			// the agent did not do the work it was asked to do, so the command
+			// reports non-zero so callers can distinguish it from a real
+			// single-commit decision (issue #7835).
+			if (usedFallback) exitCode = 1;
+		} catch (error) {
+			if (!(error instanceof CommitAbortedError)) throw error;
+			// Failure already reported with a readable message; exit non-zero
+			// without letting the runtime dump a stack/minified-source blob.
+			exitCode = 1;
+		}
+		await postmortem.quit(exitCode);
 	}
 }

package/src/commands/share.ts

@@ -0,0 +1,71 @@
+/**
+ * Share a saved session as an encrypted link without launching the agent.
+ *
+ * `omp share <session>` accepts a session id (prefix) or a path to a session
+ * `.jsonl` and uploads the sealed snapshot exactly like the `/share` slash
+ * command, honoring `share.serverUrl`, `share.store`, and
+ * `share.redactSecrets`.
+ */
+
+import { getAgentDir } from "@oh-my-pi/pi-utils";
+import { Args, Command, Flags } from "@oh-my-pi/pi-utils/cli";
+import { shareHelp as commandHelp } from "../cli/command-help";
+import { Settings } from "../config/settings";
+import { shareSession } from "../export/share";
+import { buildSecretObfuscator } from "../secrets";
+import { resolveResumableSession } from "../session/session-listing";
+import { SessionManager } from "../session/session-manager";
+
+export default class Share extends Command {
+	static description = commandHelp.description;
+	static args = {
+		session: Args.string({
+			description: "Session id (prefix) or path to a session .jsonl",
+			required: true,
+		}),
+	};
+	static flags = {
+		gist: Flags.boolean({
+			description: "Upload to a secret GitHub gist instead of the share server",
+			default: false,
+		}),
+	};
+
+	async run(): Promise<void> {
+		const { args, flags } = await this.parse(Share);
+
+		const sessionArg = args.session ?? "";
+		let sessionPath = sessionArg;
+		if (!sessionArg.includes("/") && !sessionArg.includes("\\") && !sessionArg.endsWith(".jsonl")) {
+			const match = await resolveResumableSession(sessionArg, process.cwd());
+			if (!match) {
+				process.stderr.write(`Session "${sessionArg}" not found.\n`);
+				process.exitCode = 1;
+				return;
+			}
+			sessionPath = match.session.path;
+		}
+
+		const sm = await SessionManager.open(sessionPath);
+		// Settings resolve against the session's own project so its
+		// share.redactSecrets/secrets.enabled policy governs, not the invoking cwd's.
+		const settings = await Settings.loadReadOnly({ cwd: sm.getCwd() });
+		// Same leak boundary as /share: a share blob leaves the machine, so honor
+		// share.redactSecrets with the full obfuscator built against the session's
+		// own project directory (its secrets.yml, not the invoking cwd's).
+		const obfuscator =
+			settings.get("share.redactSecrets") && settings.get("secrets.enabled")
+				? await buildSecretObfuscator(sm.getCwd(), getAgentDir())
+				: undefined;
+
+		const result = await shareSession(sm, {
+			serverUrl: settings.get("share.serverUrl"),
+			store: flags.gist ? "gist" : settings.get("share.store"),
+			obfuscator,
+		});
+		const lines = [`Share URL: ${result.url}`];
+		if (result.gistUrl) lines.push(`Gist: ${result.gistUrl}`);
+		if (result.truncated) lines.push("Note: large content was trimmed to fit the share size limit.");
+		console.log(lines.join("\n"));
+	}
+}