@oh-my-pi/pi-coding-agent 17.2.10 → 17.2.12

package/src/mcp/transports/header-policy.ts

@@ -0,0 +1,95 @@
+/**
+ * HTTP header precedence and redirect-origin policy for remote MCP transports.
+ *
+ * Two invariants, applied at every transport fetch:
+ *
+ * 1. Client-generated headers (protocol headers like `Content-Type`, `Accept`,
+ *    `Mcp-Session-Id`, and authorization) take precedence over configured
+ *    headers with the same case-insensitive name. Configured headers can never
+ *    corrupt the MCP wire protocol via casing tricks.
+ * 2. Origin-locked servers (Agent Plugins §7.2.1) never forward configured
+ *    headers to a different origin: redirects are followed manually and
+ *    configured headers are attached only when the hop targets the configured
+ *    origin. Method-changing redirects of non-GET requests are refused.
+ */
+
+/** Header buckets for one MCP HTTP request. */
+interface MCPHeaderSources {
+	/** Client-generated HTTP/MCP/authorization headers; win case-insensitively. */
+	generated: Record<string, string>;
+	/** Configured headers from the server entry (package or user config). */
+	configured?: Record<string, string>;
+}
+
+/**
+ * Merge configured headers under client-generated ones: a configured entry is
+ * dropped when a generated header with the same case-insensitive name exists.
+ */
+export function mergeMCPHeaders({ generated, configured }: MCPHeaderSources): Record<string, string> {
+	if (!configured) return { ...generated };
+	const generatedNames = new Set<string>();
+	for (const name in generated) generatedNames.add(name.toLowerCase());
+	const merged: Record<string, string> = {};
+	for (const name in configured) {
+		if (!generatedNames.has(name.toLowerCase())) merged[name] = configured[name];
+	}
+	return { ...merged, ...generated };
+}
+
+/**
+ * Set a client-generated header, removing any existing entry with the same
+ * case-insensitive name so the generated value is the only one sent.
+ */
+export function setGeneratedHeader(headers: Record<string, string>, name: string, value: string): void {
+	const lower = name.toLowerCase();
+	for (const existing in headers) {
+		if (existing.toLowerCase() === lower) delete headers[existing];
+	}
+	headers[name] = value;
+}
+
+const REDIRECT_STATUSES: Record<number, true> = { 301: true, 302: true, 303: true, 307: true, 308: true };
+const MAX_REDIRECT_HOPS = 5;
+
+export interface MCPFetchInit {
+	method: "GET" | "POST" | "DELETE";
+	body?: string;
+	signal?: AbortSignal;
+}
+
+/**
+ * Fetch an MCP endpoint with header precedence and, for origin-locked servers,
+ * manual redirect handling that strips configured headers on cross-origin hops.
+ *
+ * Non-locked servers keep the platform default redirect behavior. Locked
+ * non-GET requests only follow 307/308 (method-preserving); a 301/302/303
+ * redirect of a JSON-RPC POST is a connection error, never a silent GET.
+ */
+export async function mcpFetch(
+	url: string,
+	init: MCPFetchInit,
+	sources: MCPHeaderSources,
+	originLocked: boolean,
+): Promise<Response> {
+	if (!originLocked) {
+		return fetch(url, { ...init, headers: mergeMCPHeaders(sources) });
+	}
+
+	const configuredOrigin = new URL(url).origin;
+	let currentUrl = url;
+	for (let hop = 0; hop <= MAX_REDIRECT_HOPS; hop++) {
+		const attachConfigured = new URL(currentUrl).origin === configuredOrigin;
+		const headers = mergeMCPHeaders(attachConfigured ? sources : { generated: sources.generated });
+		const response = await fetch(currentUrl, { ...init, headers, redirect: "manual" });
+		if (!REDIRECT_STATUSES[response.status]) return response;
+
+		const location = response.headers.get("Location");
+		if (!location) return response;
+		await response.body?.cancel();
+		if (init.method !== "GET" && response.status !== 307 && response.status !== 308) {
+			throw new Error(`HTTP ${response.status}: server redirected a ${init.method} request; refusing to follow`);
+		}
+		currentUrl = new URL(location, currentUrl).href;
+	}
+	throw new Error(`Too many redirects (> ${MAX_REDIRECT_HOPS}) fetching ${url}`);
+}

package/src/mcp/transports/http.ts

@@ -19,6 +19,7 @@ import type {
 import { toJsonRpcError } from "../../mcp/types";
 import { RequestIdAllocator } from "../request-id";
 import { createMCPTimeout, getNeverAbortSignal, isMCPTimeoutEnabled, resolveMCPTimeoutMs } from "../timeout";
+import { type MCPFetchInit, mcpFetch } from "./header-policy";
 
 const HTTP_SSE_CONNECT_TIMEOUT_MS = 1_000;
 /**
@@ -54,6 +55,16 @@ export class HttpTransport implements MCPTransport {
 
 	constructor(private config: MCPHttpServerConfig | MCPSseServerConfig) {}
 
+	/** Fetch the configured endpoint with header precedence and origin policy. */
+	#fetch(init: MCPFetchInit, generated: Record<string, string>): Promise<Response> {
+		return mcpFetch(
+			this.config.url,
+			init,
+			{ generated, configured: this.config.headers },
+			this.config.headerPolicy === "origin-locked",
+		);
+	}
+
 	get connected(): boolean {
 		return this.#connected;
 	}
@@ -81,13 +92,12 @@ export class HttpTransport implements MCPTransport {
 		if (this.#sseConnection) return;
 
 		this.#sseConnection = new AbortController();
-		const headers: Record<string, string> = {
+		const generated: Record<string, string> = {
 			Accept: "text/event-stream",
-			...this.config.headers,
 		};
 
 		if (this.#sessionId) {
-			headers["Mcp-Session-Id"] = this.#sessionId;
+			generated["Mcp-Session-Id"] = this.#sessionId;
 		}
 
 		let response: Response | null;
@@ -95,11 +105,7 @@ export class HttpTransport implements MCPTransport {
 		let startupFinished = false;
 		const connection = this.#sseConnection;
 		const startupTimeoutMs = resolveSSEConnectTimeoutMs(this.config.timeout);
-		const fetchPromise = fetch(this.config.url, {
-			method: "GET",
-			headers,
-			signal: connection.signal,
-		});
+		const fetchPromise = this.#fetch({ method: "GET", signal: connection.signal }, generated);
 		const timeoutPromise =
 			startupTimeoutMs > 0
 				? new Promise<null>(resolve => {
@@ -219,26 +225,23 @@ export class HttpTransport implements MCPTransport {
 			params: params ?? {},
 		};
 
-		const headers: Record<string, string> = {
+		const generated: Record<string, string> = {
 			"Content-Type": "application/json",
 			Accept: "application/json, text/event-stream",
-			...this.config.headers,
 		};
 
 		if (this.#sessionId) {
-			headers["Mcp-Session-Id"] = this.#sessionId;
+			generated["Mcp-Session-Id"] = this.#sessionId;
 		}
 
 		const timeout = resolveMCPTimeoutMs(this.config.timeout);
 		const operation = createMCPTimeout(timeout, options?.signal);
 
 		try {
-			const response = await fetch(this.config.url, {
-				method: "POST",
-				headers,
-				body: JSON.stringify(body),
-				signal: operation.signal,
-			});
+			const response = await this.#fetch(
+				{ method: "POST", body: JSON.stringify(body), signal: operation.signal },
+				generated,
+			);
 
 			// Check for session ID in response
 			const newSessionId = response.headers.get("Mcp-Session-Id");
@@ -365,23 +368,18 @@ export class HttpTransport implements MCPTransport {
 		const body = error
 			? { jsonrpc: "2.0" as const, id, error }
 			: { jsonrpc: "2.0" as const, id, result: result ?? {} };
-		const headers: Record<string, string> = {
+		const generated: Record<string, string> = {
 			"Content-Type": "application/json",
 			Accept: "application/json, text/event-stream",
-			...this.config.headers,
 		};
 		if (this.#sessionId) {
-			headers["Mcp-Session-Id"] = this.#sessionId;
+			generated["Mcp-Session-Id"] = this.#sessionId;
 		}
+		const payload = JSON.stringify(body);
 		const timeout = resolveMCPTimeoutMs(this.config.timeout);
 		const operation = createMCPTimeout(timeout);
 		try {
-			const resp = await fetch(this.config.url, {
-				method: "POST",
-				headers,
-				body: JSON.stringify(body),
-				signal: operation.signal,
-			});
+			const resp = await this.#fetch({ method: "POST", body: payload, signal: operation.signal }, generated);
 			// Retry once on auth failure if onAuthError is wired
 			if (this.onAuthError && (resp.status === 401 || resp.status === 403)) {
 				await resp.body?.cancel();
@@ -389,16 +387,13 @@ export class HttpTransport implements MCPTransport {
 				if (newHeaders) {
 					this.config.headers ??= {};
 					Object.assign(this.config.headers, newHeaders);
-					Object.assign(headers, newHeaders);
 					operation.clear();
 					const retryOperation = createMCPTimeout(timeout);
 					try {
-						const retry = await fetch(this.config.url, {
-							method: "POST",
-							headers,
-							body: JSON.stringify(body),
-							signal: retryOperation.signal,
-						});
+						const retry = await this.#fetch(
+							{ method: "POST", body: payload, signal: retryOperation.signal },
+							generated,
+						);
 						await retry.body?.cancel();
 					} finally {
 						retryOperation.clear();
@@ -425,26 +420,23 @@ export class HttpTransport implements MCPTransport {
 			params: params ?? {},
 		};
 
-		const headers: Record<string, string> = {
+		const generated: Record<string, string> = {
 			"Content-Type": "application/json",
 			Accept: "application/json, text/event-stream",
-			...this.config.headers,
 		};
 
 		if (this.#sessionId) {
-			headers["Mcp-Session-Id"] = this.#sessionId;
+			generated["Mcp-Session-Id"] = this.#sessionId;
 		}
 
 		const timeout = resolveMCPTimeoutMs(this.config.timeout);
 		const operation = createMCPTimeout(timeout);
 
 		try {
-			const response = await fetch(this.config.url, {
-				method: "POST",
-				headers,
-				body: JSON.stringify(body),
-				signal: operation.signal,
-			});
+			const response = await this.#fetch(
+				{ method: "POST", body: JSON.stringify(body), signal: operation.signal },
+				generated,
+			);
 
 			// 202 Accepted is success for notifications
 			if (!response.ok && response.status !== 202) {
@@ -492,16 +484,7 @@ export class HttpTransport implements MCPTransport {
 			const timeout = resolveMCPTimeoutMs(this.config.timeout);
 			const operation = createMCPTimeout(timeout);
 			try {
-				const headers: Record<string, string> = {
-					...this.config.headers,
-					"Mcp-Session-Id": this.#sessionId,
-				};
-
-				await fetch(this.config.url, {
-					method: "DELETE",
-					headers,
-					signal: operation.signal,
-				});
+				await this.#fetch({ method: "DELETE", signal: operation.signal }, { "Mcp-Session-Id": this.#sessionId });
 				operation.clear();
 			} catch {
 				operation.clear();

package/src/mcp/transports/sse.ts

@@ -12,6 +12,7 @@ import type {
 import { toJsonRpcError } from "../../mcp/types";
 import { RequestIdAllocator } from "../request-id";
 import { createMCPTimeout, getNeverAbortSignal, resolveMCPTimeoutMs } from "../timeout";
+import { type MCPFetchInit, mcpFetch } from "./header-policy";
 
 interface MCPTimeoutOperation {
 	signal?: AbortSignal;
@@ -46,6 +47,16 @@ export class LegacySseTransport implements MCPTransport {
 		this.#config = config;
 	}
 
+	/** Fetch an endpoint with header precedence and origin policy. */
+	#fetch(url: string, init: MCPFetchInit, generated: Record<string, string>): Promise<Response> {
+		return mcpFetch(
+			url,
+			init,
+			{ generated, configured: this.#config.headers },
+			this.#config.headerPolicy === "origin-locked",
+		);
+	}
+
 	get connected(): boolean {
 		return this.#connected;
 	}
@@ -65,14 +76,11 @@ export class LegacySseTransport implements MCPTransport {
 		this.#sseConnection = connection;
 
 		try {
-			const response = await fetch(this.#config.url, {
-				method: "GET",
-				headers: {
-					Accept: "text/event-stream",
-					...this.#config.headers,
-				},
-				signal: operation.signal,
-			});
+			const response = await this.#fetch(
+				this.#config.url,
+				{ method: "GET", signal: operation.signal },
+				{ Accept: "text/event-stream" },
+			);
 
 			if (!response.ok) {
 				const text = await response.text();
@@ -286,17 +294,12 @@ export class LegacySseTransport implements MCPTransport {
 	): Promise<Response> {
 		const endpointUrl = this.#endpointUrl;
 		if (!endpointUrl) throw new Error("Transport not connected");
-		let headers: Record<string, string> = {
+		const generated: Record<string, string> = {
 			"Content-Type": "application/json",
 			Accept: "application/json, text/event-stream",
-			...this.#config.headers,
 		};
-		let response = await fetch(endpointUrl, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(body),
-			signal,
-		});
+		const payload = JSON.stringify(body);
+		let response = await this.#fetch(endpointUrl, { method: "POST", body: payload, signal }, generated);
 		const status = AIError.status(response);
 		if (!this.onAuthError || (status !== 401 && status !== 403)) return response;
 
@@ -304,17 +307,7 @@ export class LegacySseTransport implements MCPTransport {
 		if (!refreshedHeaders) return response;
 		await response.body?.cancel();
 		this.#config.headers = refreshedHeaders;
-		headers = {
-			"Content-Type": "application/json",
-			Accept: "application/json, text/event-stream",
-			...this.#config.headers,
-		};
-		response = await fetch(endpointUrl, {
-			method: "POST",
-			headers,
-			body: JSON.stringify(body),
-			signal,
-		});
+		response = await this.#fetch(endpointUrl, { method: "POST", body: payload, signal }, generated);
 		return response;
 	}
 

package/src/mcp/types.ts

@@ -100,6 +100,13 @@ export interface MCPStdioServerConfig extends MCPServerConfigBase {
 	command: string;
 	args?: string[];
 	env?: Record<string, string>;
+	/**
+	 * `literal`: env values are opaque plugin package data (Agent Plugins
+	 * §§4.1/9.2) — no env-name lookup, no `!command` execution, no dropping of
+	 * empty values. The provider already applied the only permitted expansion
+	 * (`${PLUGIN_ROOT}`/`${PLUGIN_DATA}`).
+	 */
+	envPolicy?: "literal";
 	cwd?: string;
 }
 
@@ -108,6 +115,12 @@ export interface MCPHttpServerConfig extends MCPServerConfigBase {
 	type: "http";
 	url: string;
 	headers?: Record<string, string>;
+	/**
+	 * `origin-locked`: configured headers are literal package data pinned to the
+	 * configured URL's origin (Agent Plugins §7.2.1) — never expanded, never
+	 * forwarded cross-origin, and client-generated headers win case-insensitively.
+	 */
+	headerPolicy?: "origin-locked";
 }
 
 /** SSE server configuration (deprecated, use HTTP) */
@@ -115,6 +128,8 @@ export interface MCPSseServerConfig extends MCPServerConfigBase {
 	type: "sse";
 	url: string;
 	headers?: Record<string, string>;
+	/** See {@link MCPHttpServerConfig.headerPolicy}. */
+	headerPolicy?: "origin-locked";
 }
 
 export type MCPServerConfig = MCPStdioServerConfig | MCPHttpServerConfig | MCPSseServerConfig;

package/src/modes/acp/acp-agent.ts

@@ -70,6 +70,7 @@ import { SessionManager } from "../../session/session-manager";
 import { executeAcpBuiltinSlashCommand } from "../../slash-commands/acp-builtins";
 import { buildAvailableSlashCommands, toAcpAvailableCommands } from "../../slash-commands/available-commands";
 import { DEFAULT_STT_MODEL_KEY, STT_MODEL_OPTIONS } from "../../stt/models";
+import { refreshAgentDiscovery } from "../../task";
 import { AUTO_THINKING, parseConfiguredThinkingLevel } from "../../thinking";
 import { normalizeLocalScheme } from "../../tools/path-utils";
 import { ToolError } from "../../tools/tool-errors";
@@ -1930,14 +1931,15 @@ export class AcpAgent implements Agent {
 	/**
 	 * Reload plugin/registry state for an ACP session. Mirrors the interactive
 	 * `/reload-plugins` and `/move` flows: invalidates the plugin-roots cache,
-	 * resets the capability cache, refreshes the session's slash-command state,
-	 * then re-advertises commands so the client sees newly installed/disabled
-	 * plugins.
+	 * refreshes task agents, resets the capability cache, refreshes the
+	 * session's slash-command state, then re-advertises commands so the client
+	 * sees newly installed/disabled plugins.
 	 */
 	async #reloadPluginState(record: ManagedSessionRecord): Promise<void> {
 		const cwd = record.session.sessionManager.getCwd();
 		const projectPath = await resolveActiveProjectRegistryPath(cwd);
 		clearPluginRootsAndCaches(projectPath ? [projectPath] : undefined);
+		await refreshAgentDiscovery(cwd);
 		resetCapabilities();
 		await record.session.refreshSkills();
 		const fileCommands = await loadSlashCommands({ cwd });
@@ -2019,7 +2021,16 @@ export class AcpAgent implements Agent {
 
 	async #findStoredSession(sessionId: string, cwd: string): Promise<StoredSessionInfo | undefined> {
 		const sessions = await this.#listStoredSessions(cwd);
-		return sessions.find(session => session.id === sessionId);
+		const scoped = sessions.find(session => session.id === sessionId);
+		if (scoped) {
+			return scoped;
+		}
+		// The cwd-derived directory only covers sessions stored under the current
+		// naming scheme. Sessions written under a legacy/hashed project directory
+		// (the 17.2.5+ scheme reverted in #7656) live elsewhere, so fall back to a
+		// global by-id scan: the session id is globally unique, and
+		// #openStoredSession reopens the file with the request cwd. See #7779.
+		return this.#findStoredSessionById(sessionId);
 	}
 
 	async #findStoredSessionById(sessionId: string): Promise<StoredSessionInfo | undefined> {

package/src/modes/components/agent-dashboard.ts

@@ -48,6 +48,7 @@ import { Settings } from "../../config/settings";
 import agentCreationArchitectPrompt from "../../prompts/system/agent-creation-architect.md" with { type: "text" };
 import agentCreationUserPrompt from "../../prompts/system/agent-creation-user.md" with { type: "text" };
 import { createAgentSession } from "../../sdk";
+import { refreshAgentDiscovery } from "../../task";
 import { discoverAgents } from "../../task/discovery";
 import { resolveAgentPrewalkDefault } from "../../task/prewalk";
 import type { AgentDefinition, AgentSource } from "../../task/types";
@@ -824,6 +825,7 @@ export class AgentDashboard extends Container {
 		).trimEnd();
 		const content = `---\n${frontmatter}\n---\n\n${spec.systemPrompt.trim()}\n`;
 		await Bun.write(filePath, content);
+		await refreshAgentDiscovery(this.cwd);
 		await this.#reloadData();
 		this.#clearCreateFlow();
 		this.#notice = `Created agent ${spec.identifier} at ${shortenPath(filePath)}`;

package/src/modes/components/agent-hub-projection.ts

@@ -10,7 +10,7 @@ export interface AggregateMetrics extends AgentMetrics {
 	activeDurationAgents: number;
 }
 
-export interface AgentTreeProjection {
+interface AgentTreeProjection {
 	rows: AgentRef[];
 	depthById: Map<string, number>;
 	parentById: Map<string, string>;
@@ -65,7 +65,7 @@ export function progressMetrics(observed: ObservableSession | undefined): AgentM
  * usage embedded in completed `task` tool results, so using it for a parent
  * row would double-count child rows in the aggregate.
  */
-export function readSessionMetrics(session: NonNullable<AgentRef["session"]>): AgentMetrics | undefined {
+function readSessionMetrics(session: NonNullable<AgentRef["session"]>): AgentMetrics | undefined {
 	try {
 		const stats = session.getSessionStats();
 		const messages = session.agent?.state?.messages;

package/src/modes/components/agent-hub-renderer.ts

@@ -16,7 +16,7 @@ export interface RosterRender {
 }
 
 /** Legacy progress snapshots may omit counters; snapshot absence remains distinct. */
-export function metricNumber(value: number | undefined): number {
+function metricNumber(value: number | undefined): number {
 	return typeof value === "number" && Number.isFinite(value) ? value : 0;
 }
 
@@ -67,7 +67,7 @@ export function statusText(status: AgentRef["status"], text: string): string {
 }
 
 /** Model id + thinking level (`sonnet-4-6 ◒ high`), level colored per theme. */
-export function formatModelBadge(modelId: string, level: ThinkingLevel | undefined): string {
+function formatModelBadge(modelId: string, level: ThinkingLevel | undefined): string {
 	const model = theme.fg("muted", sanitizeDisplayText(modelId));
 	if (!level || level === ThinkingLevel.Off || level === ThinkingLevel.Inherit) return model;
 	const display = theme.thinking[level as keyof typeof theme.thinking] ?? level;
@@ -81,11 +81,7 @@ export function formatRoleBadge(role: string, settings: Settings): string {
 }
 
 /** Format a resolved selector, preserving provider identity when requested. */
-export function formatResolvedModelBadge(
-	resolved: string,
-	preserveProvider = false,
-	fallbackLevel?: ThinkingLevel,
-): string {
+function formatResolvedModelBadge(resolved: string, preserveProvider = false, fallbackLevel?: ThinkingLevel): string {
 	const cleanResolved = sanitizeDisplayText(resolved);
 	// Model ids may themselves contain colons (`qwen3:14b`), so only treat the
 	// suffix as a thinking level when it parses as one.

package/src/modes/components/agent-hub.ts

@@ -123,6 +123,8 @@ export interface AgentHubDeps {
 	ui?: TUI;
 	/** Tool lookup for transcript renderers (labels, custom render functions). */
 	getTool?: (name: string) => AgentTool | undefined;
+	/** Whether the active registry entry came from a built-in factory. */
+	isBuiltInTool?: (name: string) => boolean;
 	/** Extension message renderers for custom messages in the transcript. */
 	getMessageRenderer?: (customType: string) => MessageRenderer | undefined;
 	/** Cwd used by tool renderers for path shortening; defaults to the project dir. */
@@ -206,6 +208,7 @@ export class AgentHubOverlayComponent extends Container implements SelectListMou
 	// Transcript-viewer launch deps (passed through to AgentTranscriptViewer).
 	#ui: TUI;
 	#getTool: ((name: string) => AgentTool | undefined) | undefined;
+	#isBuiltInTool: ((name: string) => boolean) | undefined;
 	#getMessageRenderer: ((customType: string) => MessageRenderer | undefined) | undefined;
 	#cwd: string;
 	#hideThinkingBlock: (() => boolean) | undefined;
@@ -238,6 +241,7 @@ export class AgentHubOverlayComponent extends Container implements SelectListMou
 				requestComponentRender: () => deps.requestRender(),
 			} as unknown as TUI);
 		this.#getTool = deps.getTool;
+		this.#isBuiltInTool = deps.isBuiltInTool;
 		this.#getMessageRenderer = deps.getMessageRenderer;
 		this.#cwd = deps.cwd ?? getProjectDir();
 		this.#hideThinkingBlock = deps.hideThinkingBlock;
@@ -364,6 +368,7 @@ export class AgentHubOverlayComponent extends Container implements SelectListMou
 			lifecycle: this.#remote ? undefined : this.#lifecycle,
 			ui: this.#ui,
 			getTool: this.#getTool,
+			isBuiltInTool: this.#isBuiltInTool,
 			getMessageRenderer: this.#getMessageRenderer,
 			cwd: this.#cwd,
 			hideThinkingBlock: this.#hideThinkingBlock,

package/src/modes/components/agent-transcript-viewer.ts

@@ -43,6 +43,8 @@ export interface AgentTranscriptViewerDeps {
 	lifecycle?: () => AgentLifecycleManager;
 	ui: TUI;
 	getTool?: (name: string) => AgentTool | undefined;
+	/** Whether the active registry entry came from a built-in factory. */
+	isBuiltInTool?: (name: string) => boolean;
 	getMessageRenderer?: (customType: string) => MessageRenderer | undefined;
 	cwd: string;
 	hideThinkingBlock?: () => boolean;
@@ -161,6 +163,7 @@ export class AgentTranscriptViewer implements Component {
 		this.#builder = new ChatTranscriptBuilder({
 			ui: deps.ui,
 			getTool: deps.getTool,
+			isBuiltInTool: deps.isBuiltInTool,
 			getMessageRenderer: deps.getMessageRenderer,
 			cwd: deps.cwd,
 			hideThinkingBlock: deps.hideThinkingBlock,

package/src/modes/components/chat-transcript-builder.ts

@@ -61,6 +61,8 @@ import { CollapsedSyntheticMessageComponent, UserMessageComponent } from "./user
 export interface ChatTranscriptBuilderDeps {
 	ui: TUI;
 	getTool?: (name: string) => AgentTool | undefined;
+	/** Whether the active registry entry came from a built-in factory. */
+	isBuiltInTool?: (name: string) => boolean;
 	getMessageRenderer?: (customType: string) => MessageRenderer | undefined;
 	cwd: string;
 	hideThinkingBlock?: () => boolean;
@@ -392,6 +394,7 @@ export class ChatTranscriptBuilder {
 				content.name,
 				content.arguments,
 				{
+					useBuiltInRenderer: this.deps.isBuiltInTool?.(content.name) ?? true,
 					// Stable ids and Kitty placeholder cells keep images anchored
 					// while the transcript viewport scrolls and reflows.
 					showImages: settings.get("terminal.showImages"),

package/src/modes/components/custom-editor.ts

@@ -30,7 +30,6 @@ type ConfigurableEditorAction = Extract<
 	| "app.model.cycleBackward"
 	| "app.model.select"
 	| "app.model.selectTemporary"
-	| "app.tools.expand"
 	| "app.tools.toggleVisibility"
 	| "app.thinking.toggle"
 	| "app.editor.external"
@@ -53,7 +52,6 @@ const DEFAULT_ACTION_KEYS: Record<ConfigurableEditorAction, KeyId[]> = {
 	"app.model.cycleBackward": ["shift+ctrl+p"],
 	"app.model.select": ["alt+m"],
 	"app.model.selectTemporary": ["alt+p"],
-	"app.tools.expand": ["ctrl+o"],
 	"app.tools.toggleVisibility": ["ctrl+shift+o"],
 	"app.thinking.toggle": ["ctrl+t"],
 	"app.editor.external": ["ctrl+g"],
@@ -551,7 +549,6 @@ export class CustomEditor extends Editor {
 	onCycleModelForward?: () => void;
 	onCycleModelBackward?: () => void;
 	onSelectModel?: () => void;
-	onExpandTools?: () => void;
 	onToggleToolActivity?: () => void;
 	onToggleThinking?: () => void;
 	onExternalEditor?: () => void;
@@ -907,12 +904,6 @@ export class CustomEditor extends Editor {
 				return;
 			}
 
-			// Intercept configured tool output expansion shortcut
-			if (this.#matchesAction(canonical, "app.tools.expand") && this.onExpandTools) {
-				this.onExpandTools();
-				return;
-			}
-
 			// Intercept configured tool activity visibility toggle
 			if (this.#matchesAction(canonical, "app.tools.toggleVisibility") && this.onToggleToolActivity) {
 				this.onToggleToolActivity();

package/src/modes/components/status-line/component.ts

@@ -1556,6 +1556,7 @@ export class StatusLineComponent implements Component {
 		return {
 			session: this.session,
 			focusedAgentId: this.#focusedAgentId,
+			sessionAccent: this.#resolveSettings().sessionAccent !== false,
 			activeRepo: activeRepoCache.activeRepo,
 			width,
 			options: segmentOptions ?? {},

package/src/modes/components/status-line/segments.ts

@@ -592,10 +592,12 @@ const sessionNameSegment: StatusLineSegment = {
 		const name = sessionManager?.getSessionName();
 		if (!name) return { content: "", visible: false };
 
-		const ansi =
-			getSessionAccentAnsi(
-				getSessionAccentHex(name, theme.getMajorThemeColorHexes(), theme.accentSurfaceLuminance),
-			) ?? theme.getFgAnsi("accent");
+		const accentEnabled = ctx.sessionAccent !== false;
+		const ansi = accentEnabled
+			? (getSessionAccentAnsi(
+					getSessionAccentHex(name, theme.getMajorThemeColorHexes(), theme.accentSurfaceLuminance),
+				) ?? theme.getFgAnsi("accent"))
+			: theme.getFgAnsi("accent");
 		return { content: `${ansi}${sanitizeStatusText(name)}\x1b[39m`, visible: true };
 	},
 };

package/src/modes/components/status-line/types.ts

@@ -52,6 +52,8 @@ export interface SegmentContext {
 	session: AgentSession;
 	/** Focused subagent id while the view is proxied at its session, undefined otherwise. */
 	focusedAgentId?: string | undefined;
+	/** Effective `statusLine.sessionAccent`; `false` disables hash-derived accent colors, while `true` or omission enables them. */
+	sessionAccent?: boolean;
 	activeRepo: ActiveRepoContext | null;
 	width: number;
 	options: StatusLineSegmentOptions;