@oh-my-pi/pi-coding-agent 17.2.5 → 17.2.6

package/src/modes/controllers/input-controller.ts

@@ -250,7 +250,7 @@ export class InputController {
 			this.#btwBranchListenerInstalled = true;
 			this.ctx.ui.addInputListener(data => {
 				if (!matchesKey(data, "b")) return undefined;
-				if (!this.ctx.canBranchBtw()) return undefined;
+				if (!this.ctx.handlesBtwBranchKey()) return undefined;
 				if (this.ctx.ui.getFocused() !== this.ctx.editor) return undefined;
 				if (this.ctx.editor.getText().trim()) return undefined;
 				void this.ctx.handleBtwBranchKey();
@@ -801,6 +801,19 @@ export class InputController {
 				this.ctx.queueCompactionMessage(text, "steer", images);
 				return;
 			}
+			// Extension commands are local actions. Execute them before the normal
+			// submission path creates an optimistic user message; otherwise a
+			// consumed command remains rendered like a prompt sent to the model.
+			if (this.#isLocalExtensionCommand(text)) {
+				this.ctx.editor.clearDraft(text);
+				try {
+					await this.ctx.session.prompt(text, { images: inputImages });
+				} catch (error) {
+					this.ctx.editor.setText(text);
+					this.ctx.showError(error instanceof Error ? error.message : String(error));
+				}
+				return;
+			}
 
 			// If streaming, use prompt() with steer behavior
 			// This handles extension commands (execute immediately), prompt template expansion, and queueing
@@ -914,14 +927,18 @@ export class InputController {
 	 * Local extension commands are consumed before reaching the shared session
 	 * title gate and must not name the conversation.
 	 */
-	#maybeStartTitleGeneration(text: string): void {
-		const runner = this.ctx.session.extensionRunner;
+	#isLocalExtensionCommand(text: string): boolean {
 		const extensionCommandSpace = text.indexOf(" ");
-		const isLocalExtensionCommand =
+		return (
 			text.startsWith("/") &&
-			runner?.getCommand(extensionCommandSpace === -1 ? text.slice(1) : text.slice(1, extensionCommandSpace)) !==
-				undefined;
-		if (isLocalExtensionCommand) {
+			this.ctx.session.extensionRunner?.getCommand(
+				extensionCommandSpace === -1 ? text.slice(1) : text.slice(1, extensionCommandSpace),
+			) !== undefined
+		);
+	}
+
+	#maybeStartTitleGeneration(text: string): void {
+		if (this.#isLocalExtensionCommand(text)) {
 			return;
 		}
 		this.ctx.session.maybeStartTitleGeneration(text, () => {

package/src/modes/interactive-mode.ts

@@ -4513,6 +4513,10 @@ export class InteractiveMode implements InteractiveModeContext {
 		return this.#commandController.handleFreshCommand();
 	}
 
+	handleResetContextCommand(): Promise<void> {
+		return this.#commandController.handleResetContextCommand();
+	}
+
 	async handleDropCommand(): Promise<void> {
 		if (this.#vibeSessionTransitionBlocked()) return;
 		this.#prepareSessionSwitch();
@@ -4844,6 +4848,11 @@ export class InteractiveMode implements InteractiveModeContext {
 		return this.#btwController.canBranch();
 	}
 
+	/** Reserves plain `b` only after /btw has a completed branch action to handle. */
+	handlesBtwBranchKey(): boolean {
+		return this.#btwController.handlesBranchKey();
+	}
+
 	handleBtwBranchKey(): Promise<boolean> {
 		return this.#btwController.handleBranch();
 	}
@@ -4856,9 +4865,14 @@ export class InteractiveMode implements InteractiveModeContext {
 		return this.#btwController.handleCopy();
 	}
 
-	async handleBtwBranch(question: string, assistantMessage: AssistantMessage): Promise<void> {
+	async handleBtwBranch(
+		question: string,
+		assistantMessage: AssistantMessage,
+		leafId: string,
+		sessionId: string,
+	): Promise<void> {
 		try {
-			const result = await this.session.branchFromBtw(question, assistantMessage);
+			const result = await this.session.branchFromBtw(question, assistantMessage, leafId, sessionId);
 			if (result.cancelled) {
 				this.showStatus("/btw branch cancelled", { dim: true });
 				return;

package/src/modes/types.ts

@@ -350,6 +350,7 @@ export interface InteractiveModeContext {
 	handleDebugTranscriptCommand(): Promise<void>;
 	handleClearCommand(): Promise<void>;
 	handleFreshCommand(): Promise<void>;
+	handleResetContextCommand(): Promise<void>;
 	handleDropCommand(): Promise<void>;
 	handleForkCommand(): Promise<void>;
 	handleBashCommand(command: string, excludeFromContext?: boolean): Promise<void>;
@@ -418,9 +419,15 @@ export interface InteractiveModeContext {
 	handleBtwEscape(): boolean;
 	handleBtwBranchKey(): Promise<boolean>;
 	canBranchBtw(): boolean;
+	handlesBtwBranchKey(): boolean;
 	canCopyBtw(): boolean;
 	handleBtwCopyKey(): Promise<boolean>;
-	handleBtwBranch(question: string, assistantMessage: AssistantMessage): Promise<void>;
+	handleBtwBranch(
+		question: string,
+		assistantMessage: AssistantMessage,
+		leafId: string,
+		sessionId: string,
+	): Promise<void>;
 	handleOmfgCommand(complaint: string): Promise<void>;
 	hasActiveOmfg(): boolean;
 	handleOmfgEscape(): boolean;

package/src/prompts/session/launch-completion.md

@@ -0,0 +1 @@
+Supervised process {{name}} {{state}} {{#if hasExitCode}}with exit code {{exitCode}}{{else}}without an exit code{{/if}}.

package/src/sdk.ts

@@ -1686,6 +1686,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 		// entries capture it at fetch time and are dropped at injection if a newer
 		// mutation (any tool) bumped it in the meantime.
 		const fileMutationVersions = new Map<string, number>();
+		const disposeCallbacks = new Set<() => void>();
 		const activeToolNames = new Set<string>();
 		const toolRegistry = new Map<string, Tool>();
 		const setActiveToolNames = (names: Iterable<string>): void => {
@@ -1739,6 +1740,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			trackEvalExecution: (execution, abortController) =>
 				session ? session.trackEvalExecution(execution, abortController) : execution,
 			getSessionId: () => sessionManager.getSessionId?.() ?? null,
+			isDisposed: () => session?.isDisposed ?? false,
 			getHindsightSessionState: () => session?.getHindsightSessionState(),
 			getMnemopiSessionState: () => session?.getMnemopiSessionState(),
 			getAgentId: () => resolvedAgentId,
@@ -1765,6 +1767,14 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			recordEvalSubagentUsage: output => sessionManager.recordEvalSubagentOutput(output),
 			getClientBridge: () => session?.clientBridge,
 			queueDeferredDiagnostics: entry => session?.yieldQueue.enqueue(LSP_LATE_DIAGNOSTIC_MESSAGE_TYPE, entry),
+			queueLaunchCompletion: notification =>
+				session?.queueLaunchCompletion(notification) ??
+				Promise.reject(new Error("Session unavailable for launch completion delivery")),
+			registerDisposeCallback: callback => {
+				disposeCallbacks.add(callback);
+				return () => disposeCallbacks.delete(callback);
+			},
+			registerSessionChangeCallback: callback => session?.registerSessionChangeCallback(callback),
 			bumpFileMutationVersion: path => {
 				const next = (fileMutationVersions.get(path) ?? 0) + 1;
 				fileMutationVersions.set(path, next);
@@ -3307,6 +3317,9 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 				const id = sessionManager.getSessionId?.();
 				return id ? `${id}-advisor` : null;
 			},
+			queueLaunchCompletion: notification =>
+				session?.queueLaunchCompletion(notification) ??
+				Promise.reject(new Error("Session unavailable for launch completion delivery")),
 			getAgentId: () => "advisor",
 			// The primary's availability signals are wrong for advisors: their tool
 			// slate is filtered separately at runtime (default read/grep/glob, no
@@ -3522,6 +3535,8 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 					unsubscribeCredentialDisabled?.();
 					unsubscribeMcpNotifications?.();
 					unregisterMcpPostmortem?.();
+					for (const callback of disposeCallbacks) callback();
+					disposeCallbacks.clear();
 					// Drop refs so the process-global postmortem list doesn't retain
 					// the bridge closure past explicit dispose.
 					unsubscribeMcpNotifications = undefined;

package/src/security/contracts/schemas.ts

@@ -1,201 +1,223 @@
-import { type } from "arktype";
+import { once } from "@oh-my-pi/pi-utils";
+import { scope } from "arktype";
 
-const stringRecordSchema = type({ "[string]": "string" });
-const unknownRecordSchema = type({ "[string]": "unknown" });
+export const getSecurityContractSchemas = once(() => {
+	// Security schemas validate only during security scans, so lazy construction
+	// with interpreted traversal avoids eager JIT startup tax without changing correctness.
+	const { type } = scope({}, { jitless: true });
 
-export const securityProducerSchema = type({
-	kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
-	name: "string > 0",
-	"version?": "string",
-	"vendor?": "string",
-	"revision?": "string",
-	"pluginVersion?": "string",
-});
+	const stringRecordSchema = type({ "[string]": "string" });
+	const unknownRecordSchema = type({ "[string]": "unknown" });
 
-export const securityProvenanceSchema = type({
-	producer: securityProducerSchema,
-	createdAt: "string > 0",
-	"importedAt?": "string",
-	"sourceIds?": stringRecordSchema,
-	"vendorFingerprints?": stringRecordSchema,
-	"upstream?": {
-		"repository?": "string",
+	const securityProducerSchema = type({
+		kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
+		name: "string > 0",
+		"version?": "string",
+		"vendor?": "string",
 		"revision?": "string",
-		"packageVersion?": "string",
 		"pluginVersion?": "string",
-		"archiveSha256?": "string",
-	},
-	"metadata?": unknownRecordSchema,
-});
+	});
 
-export const securityLocationSchema = type({
-	path: "string > 0",
-	startLine: "number.integer >= 1",
-	"endLine?": "number.integer >= 1",
-	"startColumn?": "number.integer >= 1",
-	"endColumn?": "number.integer >= 1",
-	"role?": "string",
-});
+	const securityProvenanceSchema = type({
+		producer: securityProducerSchema,
+		createdAt: "string > 0",
+		"importedAt?": "string",
+		"sourceIds?": stringRecordSchema,
+		"vendorFingerprints?": stringRecordSchema,
+		"upstream?": {
+			"repository?": "string",
+			"revision?": "string",
+			"packageVersion?": "string",
+			"pluginVersion?": "string",
+			"archiveSha256?": "string",
+		},
+		"metadata?": unknownRecordSchema,
+	});
 
-export const securityEvidenceSchema = type({
-	id: "string > 0",
-	kind: "'code' | 'trace' | 'validation' | 'note'",
-	label: "string > 0",
-	explanation: "string",
-	"location?": securityLocationSchema,
-	"excerpt?": "string",
-});
+	const securityLocationSchema = type({
+		path: "string > 0",
+		startLine: "number.integer >= 1",
+		"endLine?": "number.integer >= 1",
+		"startColumn?": "number.integer >= 1",
+		"endColumn?": "number.integer >= 1",
+		"role?": "string",
+	});
 
-export const securityOccurrenceSchema = type({
-	id: "string > 0",
-	locations: securityLocationSchema.array().atLeastLength(1),
-	evidenceIds: "string[]",
-});
+	const securityEvidenceSchema = type({
+		id: "string > 0",
+		kind: "'code' | 'trace' | 'validation' | 'note'",
+		label: "string > 0",
+		explanation: "string",
+		"location?": securityLocationSchema,
+		"excerpt?": "string",
+	});
 
-export const securityFindingSchema = type({
-	id: "string > 0",
-	scanId: "string > 0",
-	fingerprint: "string > 0",
-	ruleId: "string > 0",
-	"anchor?": "string",
-	title: "string > 0",
-	summary: "string",
-	severity: {
-		level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
-		"score?": "number",
-		"scoringSystem?": "string",
-		"vector?": "string",
-		"rationale?": "string",
-	},
-	confidence: {
-		level: "'high' | 'medium' | 'low'",
-		"rationale?": "string",
-	},
-	taxonomy: {
-		category: "string > 0",
-		cwe: "string[]",
-		"tags?": "string[]",
-	},
-	occurrences: securityOccurrenceSchema.array().atLeastLength(1),
-	evidence: securityEvidenceSchema.array(),
-	"remediation?": "string",
-	validation: {
-		status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
-		"summary?": "string",
+	const securityOccurrenceSchema = type({
+		id: "string > 0",
+		locations: securityLocationSchema.array().atLeastLength(1),
 		evidenceIds: "string[]",
-		"validatedAt?": "string",
-	},
-	disposition: {
-		status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
-		"rationale?": "string",
-		"updatedAt?": "string",
-		"actor?": "string",
-	},
-	provenance: securityProvenanceSchema,
-	"extensions?": unknownRecordSchema,
-});
+	});
 
-export const securityCoverageSchema = type({
-	mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
-	completeness: "'complete' | 'partial' | 'unknown'",
-	inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	surfaces: type({
-		id: "string > 0",
-		label: "string > 0",
-		disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
-		receiptRefs: "string[]",
-		"riskArea?": "string",
-		"notes?": "string",
-	}).array(),
-	explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
-	deferred: type({
+	const securityFindingSchema = type({
 		id: "string > 0",
-		reason: "string > 0",
-		"paths?": "string[]",
-		"surfaceIds?": "string[]",
-	}).array(),
-	"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
-});
+		scanId: "string > 0",
+		fingerprint: "string > 0",
+		ruleId: "string > 0",
+		"anchor?": "string",
+		title: "string > 0",
+		summary: "string",
+		severity: {
+			level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
+			"score?": "number",
+			"scoringSystem?": "string",
+			"vector?": "string",
+			"rationale?": "string",
+		},
+		confidence: {
+			level: "'high' | 'medium' | 'low'",
+			"rationale?": "string",
+		},
+		taxonomy: {
+			category: "string > 0",
+			cwe: "string[]",
+			"tags?": "string[]",
+		},
+		occurrences: securityOccurrenceSchema.array().atLeastLength(1),
+		evidence: securityEvidenceSchema.array(),
+		"remediation?": "string",
+		validation: {
+			status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
+			"summary?": "string",
+			evidenceIds: "string[]",
+			"validatedAt?": "string",
+		},
+		disposition: {
+			status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
+			"rationale?": "string",
+			"updatedAt?": "string",
+			"actor?": "string",
+		},
+		provenance: securityProvenanceSchema,
+		"extensions?": unknownRecordSchema,
+	});
 
-export const securityTargetSchema = type({
-	kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
-	repositoryRoot: "string > 0",
-	displayName: "string > 0",
-	"revision?": "string",
-	"baseRevision?": "string",
-	"headRevision?": "string",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	treeDigest: "string > 0",
-});
+	const securityCoverageSchema = type({
+		mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
+		completeness: "'complete' | 'partial' | 'unknown'",
+		inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		surfaces: type({
+			id: "string > 0",
+			label: "string > 0",
+			disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
+			receiptRefs: "string[]",
+			"riskArea?": "string",
+			"notes?": "string",
+		}).array(),
+		explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
+		deferred: type({
+			id: "string > 0",
+			reason: "string > 0",
+			"paths?": "string[]",
+			"surfaceIds?": "string[]",
+		}).array(),
+		"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
+	});
 
-export const securityScanPlanSchema = type({
-	documentType: "'omp-security.scan-plan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	createdAt: "string > 0",
-	repositoryRoot: "string > 0",
-	target: securityTargetSchema,
-	knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
-	output: {
-		root: "string > 0",
-		archiveExisting: "boolean",
-		existingState: "'absent' | 'empty' | 'archivable'",
-	},
-	model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
-	account: {
-		provider: "string > 0",
-		credentialId: "number.integer >= 1",
-		"accountId?": "string",
-		"email?": "string",
-		"organizationId?": "string",
-		"organizationName?": "string",
-	},
-	configFingerprint: "string > 0",
-	workflowFingerprint: "string > 0",
-	fingerprint: "string > 0",
-});
+	const securityTargetSchema = type({
+		kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
+		repositoryRoot: "string > 0",
+		displayName: "string > 0",
+		"revision?": "string",
+		"baseRevision?": "string",
+		"headRevision?": "string",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		treeDigest: "string > 0",
+	});
 
-export const securityScanMetricsSchema = type({
-	"runtimeMs?": "number >= 0",
-	"tokenUsage?": {
-		input: "number >= 0",
-		output: "number >= 0",
-		reasoning: "number >= 0",
-		cacheRead: "number >= 0",
-		cacheWrite: "number >= 0",
-		total: "number >= 0",
-	},
-	"cost?": "number >= 0",
-	"premiumRequests?": "number >= 0",
-});
+	const securityScanPlanSchema = type({
+		documentType: "'omp-security.scan-plan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		createdAt: "string > 0",
+		repositoryRoot: "string > 0",
+		target: securityTargetSchema,
+		knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
+		output: {
+			root: "string > 0",
+			archiveExisting: "boolean",
+			existingState: "'absent' | 'empty' | 'archivable'",
+		},
+		model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
+		account: {
+			provider: "string > 0",
+			credentialId: "number.integer >= 1",
+			"accountId?": "string",
+			"email?": "string",
+			"organizationId?": "string",
+			"organizationName?": "string",
+		},
+		configFingerprint: "string > 0",
+		workflowFingerprint: "string > 0",
+		fingerprint: "string > 0",
+	});
 
-export const securityScanSchema = type({
-	documentType: "'omp-security.scan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	projectKey: "string > 0",
-	status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
-	createdAt: "string > 0",
-	"startedAt?": "string",
-	"completedAt?": "string",
-	"plan?": securityScanPlanSchema,
-	target: securityTargetSchema,
-	producer: securityProducerSchema,
-	provenance: securityProvenanceSchema,
-	findingIds: "string[]",
-	coverage: securityCoverageSchema,
-	"reportRef?": "string",
-	"sarifRef?": "string",
-	"error?": "string",
-	"metrics?": securityScanMetricsSchema,
-});
+	const securityScanMetricsSchema = type({
+		"runtimeMs?": "number >= 0",
+		"tokenUsage?": {
+			input: "number >= 0",
+			output: "number >= 0",
+			reasoning: "number >= 0",
+			cacheRead: "number >= 0",
+			cacheWrite: "number >= 0",
+			total: "number >= 0",
+		},
+		"cost?": "number >= 0",
+		"premiumRequests?": "number >= 0",
+	});
+
+	const securityScanSchema = type({
+		documentType: "'omp-security.scan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		projectKey: "string > 0",
+		status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
+		createdAt: "string > 0",
+		"startedAt?": "string",
+		"completedAt?": "string",
+		"plan?": securityScanPlanSchema,
+		target: securityTargetSchema,
+		producer: securityProducerSchema,
+		provenance: securityProvenanceSchema,
+		findingIds: "string[]",
+		coverage: securityCoverageSchema,
+		"reportRef?": "string",
+		"sarifRef?": "string",
+		"error?": "string",
+		"metrics?": securityScanMetricsSchema,
+	});
+
+	const securityScanBundleSchema = type({
+		scan: securityScanSchema,
+		findings: securityFindingSchema.array(),
+		"report?": "string",
+		"sarif?": unknownRecordSchema,
+	});
 
-export const securityScanBundleSchema = type({
-	scan: securityScanSchema,
-	findings: securityFindingSchema.array(),
-	"report?": "string",
-	"sarif?": unknownRecordSchema,
+	return {
+		securityProducerSchema,
+		securityProvenanceSchema,
+		securityLocationSchema,
+		securityEvidenceSchema,
+		securityOccurrenceSchema,
+		securityFindingSchema,
+		securityCoverageSchema,
+		securityTargetSchema,
+		securityScanPlanSchema,
+		securityScanMetricsSchema,
+		securityScanSchema,
+		securityScanBundleSchema,
+	};
 });

package/src/security/contracts/validation.ts

@@ -1,5 +1,5 @@
 import { type } from "arktype";
-import { securityFindingSchema, securityScanBundleSchema, securityScanPlanSchema, securityScanSchema } from "./schemas";
+import { getSecurityContractSchemas } from "./schemas";
 import type { SecurityFinding, SecurityScan, SecurityScanBundle, SecurityScanPlan } from "./types";
 
 function schemaError(label: string, errors: type.errors): Error {
@@ -7,24 +7,28 @@ function schemaError(label: string, errors: type.errors): Error {
 }
 
 export function parseSecurityFinding(value: unknown): SecurityFinding {
+	const { securityFindingSchema } = getSecurityContractSchemas();
 	const result = securityFindingSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security finding", result);
 	return result as SecurityFinding;
 }
 
 export function parseSecurityScan(value: unknown): SecurityScan {
+	const { securityScanSchema } = getSecurityContractSchemas();
 	const result = securityScanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan", result);
 	return result as SecurityScan;
 }
 
 export function parseSecurityScanPlan(value: unknown): SecurityScanPlan {
+	const { securityScanPlanSchema } = getSecurityContractSchemas();
 	const result = securityScanPlanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan plan", result);
 	return result as SecurityScanPlan;
 }
 
 export function parseSecurityScanBundle(value: unknown): SecurityScanBundle {
+	const { securityScanBundleSchema } = getSecurityContractSchemas();
 	const result = securityScanBundleSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan bundle", result);
 	const bundle = result as SecurityScanBundle;

package/src/security/store.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getSecurityProjectDir, isEnoent } from "@oh-my-pi/pi-utils";
-import { withFileLock } from "../config/file-lock";
+import { withFileLock } from "@oh-my-pi/pi-utils/file-lock";
 import * as git from "../utils/git";
 import { compareSecurityLineage } from "./comparison";
 import type {
@@ -34,7 +34,7 @@ const SECURITY_STORE_WRITE_CHAINS = new Map<string, Promise<unknown>>();
 async function withSecurityStoreWrite<T>(key: string, operation: () => Promise<T>): Promise<T> {
 	const lockTarget = path.join(key, "index.json");
 	const run = (SECURITY_STORE_WRITE_CHAINS.get(key) ?? Promise.resolve()).then(() =>
-		withFileLock(lockTarget, operation, { staleMs: 60_000, retries: 200, retryDelayMs: 50 }),
+		withFileLock(lockTarget, operation, { retries: 200, retryDelayMs: 50 }),
 	);
 	const guarded = run.catch(() => undefined);
 	SECURITY_STORE_WRITE_CHAINS.set(key, guarded);

package/src/session/agent-session-types.ts

@@ -389,5 +389,11 @@ export interface FreshSessionResult {
 	closedProviderSessions: number;
 }
 
+/** Outcome of an in-place `/reset` conversation-context reset. */
+export interface ResetSessionContextResult {
+	/** Number of live messages dropped from the model's context. */
+	droppedCount: number;
+}
+
 /** Queued user content restored to the editor. */
 export type RestoredQueuedMessage = { text: string; images?: ImageContent[] };