@oh-my-pi/pi-coding-agent 17.3.5 → 17.3.8

package/dist/types/task/render.d.ts

@@ -23,6 +23,8 @@ type TaskRenderOptions = RenderResultOptions & {
     renderContext?: TaskRenderContext;
 };
 export declare function formatTaskId(id: string): string;
+/** Dim `⟨agent⟩` badge for a non-default agent type; empty for the generic worker. */
+export declare function agentTypeBadge(agent: string | undefined, theme: Theme): string;
 /**
  * Render the tool call arguments.
  */

package/dist/types/tiny/completion-prompt.d.ts

@@ -0,0 +1,2 @@
+import type { TextGenerationPipeline } from "@huggingface/transformers";
+export declare function buildCompletionPrompt(tokenizer: TextGenerationPipeline["tokenizer"], promptText: string, systemPrompt?: string): string;

package/dist/types/tiny/title-client.d.ts

@@ -18,6 +18,11 @@ export interface TinyTitleGenerateOptions {
     signal?: AbortSignal;
     systemPrompt?: string;
 }
+export interface TinyModelCompletionOptions {
+    maxTokens?: number;
+    signal?: AbortSignal;
+    systemPrompt?: string;
+}
 /**
  * Hidden subcommand on the main CLI that boots the tiny-model worker in the
  * spawned subprocess. Kept in sync with the dispatch in `cli.ts`.
@@ -62,10 +67,7 @@ export declare class TinyTitleClient {
     prewarm(modelKey: string): void;
     generate(modelKey: string, message: string, signal?: AbortSignal): Promise<string | null>;
     generate(modelKey: string, message: string, options?: TinyTitleGenerateOptions): Promise<string | null>;
-    complete(modelKey: string, prompt: string, options?: {
-        maxTokens?: number;
-        signal?: AbortSignal;
-    }): Promise<string | null>;
+    complete(modelKey: string, prompt: string, options?: TinyModelCompletionOptions): Promise<string | null>;
     downloadModel(modelKey: string, options?: TinyTitleDownloadOptions): Promise<TinyTitleDownloadResult>;
     terminate(): Promise<void>;
 }

package/dist/types/tiny/title-protocol.d.ts

@@ -31,6 +31,7 @@ export type TinyTitleWorkerInbound = {
     modelKey: TinyLocalModelKey;
     prompt: string;
     maxTokens?: number;
+    systemPrompt?: string;
 } | {
     type: "download";
     id: string;

package/dist/types/tiny/worker.d.ts

@@ -1,2 +1,29 @@
+import type { ProgressInfo, TextGenerationPipeline, StoppingCriteria as TransformersStoppingCriteria } from "@huggingface/transformers";
+import { type TransformersRuntimeMetadata } from "../subprocess/worker-runtime.js";
+import { type TinyModelDevice } from "./device.js";
+import { type TinyModelDtype } from "./dtype.js";
 import type { TinyTitleTransport } from "./title-protocol.js";
+export interface TransformersRuntime extends TransformersRuntimeMetadata {
+    env: {
+        cacheDir?: string;
+        allowLocalModels?: boolean;
+        logLevel?: unknown;
+    };
+    LogLevel: {
+        ERROR: unknown;
+    };
+    StoppingCriteria: new () => TransformersStoppingCriteria;
+    pipeline: (task: "text-generation", model: string, options: {
+        device: TinyModelDevice;
+        dtype: TinyModelDtype;
+        progress_callback: (info: ProgressInfo) => void;
+    }) => Promise<TextGenerationPipeline>;
+}
+/** Stops generation at the first occurrence of `text` in the *generated* tokens.
+ *
+ *  The window must be anchored to the generation boundary, not to the end of the
+ *  whole sequence: a prompt that itself contains the stop string (chat-level
+ *  few-shot examples ending in `</title>`, for instance) would otherwise match on
+ *  prompt tokens and stop before the model emits anything. */
+export declare function createStopOnTextCriteria(transformers: TransformersRuntime, tokenizer: TextGenerationPipeline["tokenizer"], text: string): TransformersStoppingCriteria;
 export declare function startTinyTitleWorker(transport: TinyTitleTransport): void;

package/dist/types/tools/bash.d.ts

@@ -40,7 +40,7 @@ export declare function wrapShellLineForClientTerminal(line: string, shellConfig
  * while false positives remain actionable through user policy control.
  * New patterns should target shapes that are virtually never legitimate in automation.
  */
-export declare const CRITICAL_BASH_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
+export declare const CRITICAL_BASH_PATTERNS: readonly [RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp, RegExp];
 declare const bashSchemaBase: import("@oh-my-pi/omptype").FluentType<{
     command: string;
     cwd?: string | undefined;

package/dist/types/tools/file-write-fallback.d.ts

@@ -0,0 +1,124 @@
+import type { BunFile } from "bun";
+import type { ExtensionContext } from "../extensibility/extensions/types.js";
+/** A denied write, captured for a registered fallback to retry through a privileged channel. */
+export interface FileWriteFallbackRequest {
+    /**
+     * Absolute, symlink-resolved path to write the bytes to.
+     *
+     * This is where the failed in-process write would itself have landed, which is
+     * not necessarily the path the tool was given: `open` follows every component,
+     * so a link anywhere in that path redirects the bytes. Resolving it here is
+     * what lets a handler's allowlist see the real destination instead of a
+     * lexically innocent path, so a handler MUST treat this as authoritative and
+     * MUST NOT re-derive the target from anything else.
+     */
+    dst: string;
+    /**
+     * Session the denied write was issued from, or `undefined` when the mutation
+     * did not happen inside a tool call (an external `applyPatch` caller, a test).
+     *
+     * The registry is process-wide, so a handler can be consulted for a write from
+     * a session other than the one whose extension registered it. Compare this with
+     * `ctx.sessionManager.getSessionId()` to tell the two apart — a handler that
+     * prompts through `ctx.ui` needs to, since that UI belongs to ITS session and
+     * not necessarily to the one being asked about.
+     */
+    sessionId: string | undefined;
+    /** The exact bytes the tool intended to write. */
+    content: string;
+    /**
+     * The error that proves the write hit a permission boundary. Usually the write's
+     * own `EPERM`/`EACCES`/`EROFS`; for a write into a directory the host may not
+     * create, the denial raised by creating that directory, in which case `dst`'s
+     * parent may not exist yet and the handler is responsible for creating it.
+     */
+    cause: unknown;
+}
+/** Extension-authored handler. Return `true` once `content` is durably on disk at `dst`. */
+export type FileWriteFallbackHandler = (req: FileWriteFallbackRequest, ctx: ExtensionContext) => Promise<boolean>;
+/** A handler already bound to its owning extension's live context. */
+type BoundFileWriteFallbackHandler = (req: FileWriteFallbackRequest) => Promise<boolean>;
+/** A denied unlink, captured for a registered fallback to perform through a privileged channel. */
+export interface FileDeleteFallbackRequest {
+    /**
+     * Absolute, symlink-resolved path the unlink was denied for.
+     *
+     * Every component ABOVE the last is resolved, so a handler cannot be walked
+     * outside its allowed roots through a link in the path. The last component is
+     * deliberately NOT resolved, because `unlink` removes a link itself rather
+     * than its target — which is also why this may still name a symlink.
+     */
+    dst: string;
+    /** The `EPERM`/`EACCES`/`EROFS` that proves the unlink hit a permission boundary. */
+    cause: unknown;
+    /**
+     * Whether `dst` was confirmed to be a plain regular file before diverting.
+     *
+     * `false` means the seam could not establish that, either because the target's
+     * own metadata is behind the same boundary that denied the unlink — the common
+     * sandbox case, since `unlink` on a directory also reports `EPERM` on Darwin —
+     * or because `dst` is a symlink.
+     *
+     * A handler MUST remove `dst` with a plain unlink. It MUST NOT remove it
+     * recursively, and MUST NOT resolve the path first: when this is `false` the
+     * target may be a directory, and resolving a symlink would delete whatever it
+     * points at instead of the link.
+     */
+    confirmedFile: boolean;
+    /** See {@link FileWriteFallbackRequest.sessionId}. */
+    sessionId: string | undefined;
+}
+/** Extension-authored handler. Return `true` once `dst` is gone from disk. */
+export type FileDeleteFallbackHandler = (req: FileDeleteFallbackRequest, ctx: ExtensionContext) => Promise<boolean>;
+/** A handler already bound to its owning extension's live context. */
+type BoundFileDeleteFallbackHandler = (req: FileDeleteFallbackRequest) => Promise<boolean>;
+/** True for `EPERM`, `EACCES`, and `EROFS` — the sandbox-boundary write failures this seam exists for. */
+export declare function isPermissionDeniedError(error: unknown): boolean;
+/** Whether any fallback is registered. Lets a caller skip work that only this seam needs. */
+export declare function hasFileWriteFallback(): boolean;
+/**
+ * Append a fallback writer, consulted in registration order when a direct write is
+ * permission-denied. Returns a disposer that removes this exact registration; the
+ * runner calls it on session shutdown so no handler outlives its session.
+ */
+export declare function addFileWriteFallback(handler: BoundFileWriteFallbackHandler): () => void;
+/** Whether any delete fallback is registered. */
+export declare function hasFileDeleteFallback(): boolean;
+/**
+ * Append a fallback deleter, consulted in registration order when a direct unlink is
+ * permission-denied. Deliberately a separate registry from
+ * {@link addFileWriteFallback}: a write handler brokers `content` to `dst`, and
+ * handing it a request with no content would let it "broker" an empty write and
+ * truncate the file it was asked to remove. Opting in is explicit for that reason.
+ */
+export declare function addFileDeleteFallback(handler: BoundFileDeleteFallbackHandler): () => void;
+/**
+ * Name the session whose tool call is about to run, so a denied mutation inside it
+ * can tell a handler where the request came from.
+ *
+ * Entered once per tool call by `ExtensionToolWrapper` (`extensibility/extensions/
+ * wrapper.ts`), which `sdk.ts` puts around the whole tool registry whenever an
+ * `ExtensionRunner` exists — so the component that owns the handlers is the one
+ * naming its own session, and no caller has to thread an `AgentToolContext`
+ * through for attribution to work.
+ *
+ * That covers the deferred LSP write batch too: a batch id belongs to one
+ * assistant turn of one session, and its flush is awaited inside a tool call of
+ * that same session, so a write performed during a later call of the group is
+ * still attributed to the session that issued it.
+ *
+ * Deliberately NOT a general "current session" accessor: nothing else enters this
+ * scope, so outside a tool call it is empty by design — an external `applyPatch`
+ * caller reports `undefined` rather than borrowing someone else's identity.
+ */
+export declare function withFileMutationSession<T>(sessionId: string | undefined, fn: () => T): T;
+/**
+ * Remove a file, consulting registered delete fallbacks when the unlink is denied.
+ *
+ * Unlike the write path there is no masked-`ENOENT` case to see through: nothing is
+ * created on the way, so an `ENOENT` here means the file genuinely is not there and
+ * must propagate — `edit`'s `REM` turns it into a `NotFoundError`.
+ */
+export declare function deleteFileWithFallback(dst: string, file?: BunFile): Promise<void>;
+export declare function writeFileWithFallback(dst: string, content: string, file?: BunFile): Promise<void>;
+export {};

package/dist/types/tools/index.d.ts

@@ -50,6 +50,7 @@ export * from "./debug.js";
 export * from "./essential-tools.js";
 export * from "./eval.js";
 export * from "./eval-backends.js";
+export * from "./file-write-fallback.js";
 export * from "./gh.js";
 export * from "./glob.js";
 export * from "./grep.js";

package/dist/types/tools/path-utils.d.ts

@@ -155,6 +155,29 @@ export declare function resolveToCwd(filePath: string, cwd: string): string;
  * The cwd itself is rejected: a download names a file, never the directory.
  */
 export declare function confineToWorkspace(filePath: string, cwd: string): string | null;
+/**
+ * Resolve the path a syscall on `filePath` would really act on, or `null` when
+ * that cannot be established.
+ *
+ * A lexical path is not a destination. The kernel follows every component above
+ * the last, so `ws/link/file` under a `ws/link -> /elsewhere` link lands outside
+ * `ws` while still looking relative and `..`-free. Handing such a path to a
+ * privileged helper defeats the defence a helper author reaches for first — a
+ * prefix allowlist passes, because the link sits inside the allowed root while
+ * its target does not. Callers that hand a path to something more privileged
+ * than the syscall that just failed resolve it here first.
+ *
+ * Rejecting symlinked components outright is not an option: `/var` and `/tmp`
+ * are links on macOS, so every path under `os.tmpdir()` traverses one. They are
+ * resolved instead, and only a path whose real destination cannot be established
+ * is refused, because "where would this land" then has no answer to hand over.
+ * {@link confineToWorkspace} refuses an unresolvable link for the same reason.
+ *
+ * @param followFinal `true` for a syscall that follows a link at the final
+ *   component (`open`, so every write), `false` for one that acts on the link
+ *   itself (`unlink`) and therefore needs it left alone.
+ */
+export declare function resolveSyscallTarget(filePath: string, followFinal: boolean): Promise<string | null>;
 export declare function formatPathRelativeToCwd(filePath: string, cwd: string, options?: {
     trailingSlash?: boolean;
 }): string;

package/dist/types/tools/read-format.d.ts

@@ -10,6 +10,12 @@ export interface HashlineHeaderContext {
 }
 export declare function formatReadHashlineHeader(displayPath: string, tag: string): string;
 export declare function readHashlineHeaderContext(session: ToolSession, absolutePath: string, cwd: string): Promise<HashlineHeaderContext>;
+/**
+ * {@link readHashlineHeaderContext} for a caller that already holds the file's
+ * full text, so the file is not reopened just to hash it. Line endings are
+ * normalized here, exactly as the reading variant does.
+ */
+export declare function hashlineHeaderContextForText(session: ToolSession, absolutePath: string, cwd: string, fullText: string): HashlineHeaderContext;
 export declare function hashlineHeaderContext(displayPath: string, tag: string): HashlineHeaderContext;
 export declare function prependHashlineHeader(text: string, context: HashlineHeaderContext | undefined): string;
 export declare function formatTextWithMode(text: string, startNum: number, shouldAddHashLines: boolean, shouldAddLineNumbers: boolean): string;

package/dist/types/tools/read-summary.d.ts

@@ -10,7 +10,13 @@ export declare function routeReadThroughBridge(session: ToolSession, absolutePat
     line?: number;
     limit?: number;
 }): Promise<string> | undefined;
-export declare function trySummarize(session: ToolSession, absolutePath: string, fileSize: number, signal?: AbortSignal): Promise<SummaryResult | null>;
+/**
+ * Structural summary of `absolutePath`, or `null` when the file is too large,
+ * too short, or unparseable. `diskText` lets a caller that already read the file
+ * hand those bytes over instead of forcing a second read; an ACP bridge still
+ * wins, since the editor's buffer is the source of truth.
+ */
+export declare function trySummarize(session: ToolSession, absolutePath: string, fileSize: number, signal?: AbortSignal, diskText?: string): Promise<SummaryResult | null>;
 export declare function renderSummary(session: ToolSession, summary: SummaryResult): {
     text: string;
     displayText: string;

package/dist/types/utils/block-context.d.ts

@@ -6,6 +6,20 @@ export interface LineSpan {
 export interface BlockContextSource {
     path?: string;
     lang?: string;
+    /**
+     * The whole source `fullLines` was split from, when the caller still holds it.
+     * Supplying it skips re-joining every line into a fresh whole-file string on
+     * the way to the parser. It MUST be the same content as `fullLines`; a
+     * differing trailing newline is the only tolerated variation, since it moves
+     * no node's line number.
+     *
+     * Every current supplier derives both from one buffer in the same breath, so
+     * the two cannot drift. Do NOT set it on a source object that is reused
+     * across two different line arrays — a before/after diff pair, say — because
+     * the boundary lines tree-sitter reports would then be indexed into the wrong
+     * array and surface off-by-N context rows.
+     */
+    text?: string;
 }
 export type LineEntry = {
     kind: "line";

package/dist/types/utils/fetch-timeout.d.ts

@@ -2,3 +2,18 @@
 export declare function withTimeoutSignal(timeoutMs: number, signal?: AbortSignal): AbortSignal;
 /** Detect a timeout raised by an abortable fetch. */
 export declare function isTimeoutError(error: unknown): boolean;
+/**
+ * Detect Bun's `UnsupportedProxyProtocol` fetch rejection, raised when a proxy
+ * env var (`HTTPS_PROXY`, `ALL_PROXY`, …) points at a scheme it cannot drive —
+ * most commonly a SOCKS proxy (`socks5://`, `socks5h://`). The raw error tells
+ * the caller to "pass `verbose: true` in the second argument to fetch()", which
+ * is meaningless from a CLI, so callers translate it into
+ * {@link unsupportedProxyMessage}.
+ */
+export declare function isUnsupportedProxyError(error: unknown): boolean;
+/**
+ * Build an actionable CLI message for an {@link isUnsupportedProxyError} failure,
+ * naming any set proxy env var whose scheme is not `http(s)://` so the user can
+ * see exactly which variable to change.
+ */
+export declare function unsupportedProxyMessage(env?: Record<string, string | undefined>): string;

package/dist/types/utils/git.d.ts

@@ -3,6 +3,8 @@ export interface GitCommandResult {
     exitCode: number;
     stdout: string;
     stderr: string;
+    /** True when stdout or stderr hit {@link GIT_COMMAND_OUTPUT_LIMIT_BYTES} and the captured text is incomplete. */
+    truncated: boolean;
 }
 export interface GitRepository {
     commonDir: string;
@@ -55,6 +57,7 @@ export interface DiffOptions {
     readonly numstat?: boolean;
     readonly signal?: AbortSignal;
     readonly stat?: boolean;
+    readonly requireComplete?: boolean;
 }
 export interface StatusOptions {
     readonly pathspecs?: readonly string[];
@@ -136,6 +139,19 @@ export declare class GitCommandError extends Error {
     readonly result: GitCommandResult;
     constructor(args: readonly string[], result: GitCommandResult);
 }
+/**
+ * A git subprocess produced more output than {@link GIT_COMMAND_OUTPUT_LIMIT_BYTES}
+ * and its captured stdout was truncated. Thrown only for callers that opt into
+ * completeness via `diff({ requireComplete: true })`, where operating on a partial
+ * diff would silently corrupt downstream parsing — e.g. the split-commit builder,
+ * which would otherwise throw a misleading "No diff found" for files sorting after
+ * a large binary blob whose base85 payload pushed the diff past the cap.
+ */
+export declare class GitOutputTruncatedError extends Error {
+    readonly args: readonly string[];
+    readonly result: GitCommandResult;
+    constructor(args: readonly string[], result: GitCommandResult);
+}
 /** Default deadline for git and gh subprocesses spawned by the coding agent. */
 export declare const GIT_COMMAND_TIMEOUT_MS: number;
 /**
@@ -367,7 +383,15 @@ export declare const patch: {
     canApply(cwd: string, patchPath: string, options?: Omit<PatchOptions, "check">): Promise<boolean>;
     /** Check if a patch string can be applied cleanly. */
     canApplyText(cwd: string, patchText: string, options?: Omit<PatchOptions, "check">): Promise<boolean>;
-    /** Join patch parts into a single patch string. */
+    /**
+     * Join patch parts into a single patch string.
+     *
+     * Each part is terminated with a single `\n` if it lacks one, then parts are
+     * concatenated verbatim — matching git's native multi-file diff layout. Parts
+     * are NOT separated by an extra blank line and trailing newlines are NOT
+     * stripped: a `GIT binary patch` block ends in a blank line that
+     * `git apply --binary` requires, and stripping it corrupts the patch (#8899).
+     */
     join(parts: string[]): string;
 };
 export declare const cherryPick: ((cwd: string, revision: string, signal?: AbortSignal) => Promise<void>) & {

package/dist/types/web/search/providers/tinyfish.d.ts

@@ -15,6 +15,10 @@ export interface TinyFishSearchParams {
     page?: number;
     include_domains?: string[];
     exclude_domains?: string[];
+    /** ISO 3166-1 alpha-2 region, e.g. `IT`. Geolocates results. */
+    location?: string;
+    /** ISO 639-1 language, e.g. `it`. */
+    language?: string;
     signal?: AbortSignal;
     timeoutMs?: number;
     fetch?: FetchImpl;

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.3.5",
+	"version": "17.3.8",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -48,18 +48,18 @@
 	},
 	"dependencies": {
 		"@babel/parser": "^7.29.7",
-		"@oh-my-pi/hashline": "17.3.5",
-		"@oh-my-pi/omp-stats": "17.3.5",
-		"@oh-my-pi/omptype": "17.3.5",
-		"@oh-my-pi/pi-agent-core": "17.3.5",
-		"@oh-my-pi/pi-ai": "17.3.5",
-		"@oh-my-pi/pi-catalog": "17.3.5",
-		"@oh-my-pi/pi-mnemopi": "17.3.5",
-		"@oh-my-pi/pi-natives": "17.3.5",
-		"@oh-my-pi/pi-tui": "17.3.5",
-		"@oh-my-pi/pi-utils": "17.3.5",
-		"@oh-my-pi/pi-wire": "17.3.5",
-		"@oh-my-pi/snapcompact": "17.3.5",
+		"@oh-my-pi/hashline": "17.3.8",
+		"@oh-my-pi/omp-stats": "17.3.8",
+		"@oh-my-pi/omptype": "17.3.8",
+		"@oh-my-pi/pi-agent-core": "17.3.8",
+		"@oh-my-pi/pi-ai": "17.3.8",
+		"@oh-my-pi/pi-catalog": "17.3.8",
+		"@oh-my-pi/pi-mnemopi": "17.3.8",
+		"@oh-my-pi/pi-natives": "17.3.8",
+		"@oh-my-pi/pi-tui": "17.3.8",
+		"@oh-my-pi/pi-utils": "17.3.8",
+		"@oh-my-pi/pi-wire": "17.3.8",
+		"@oh-my-pi/snapcompact": "17.3.8",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/src/advisor/advise-tool.ts

@@ -110,8 +110,10 @@ export function isAdvisorInterruptImmuneTurnActive(opts: {
  *   auto-resume anything, so it is delivered live. Parking it during an active
  *   run instead strands it (it never reaches the running agent) and the withheld
  *   notes dump as one burst at the next user prompt — the bug this guards.
- * - During the post-interrupt immune-turn window, further `concern`/`blocker`
- *   notes are downgraded to asides; preservation still wins.
+ * - During the post-interrupt immune-turn window, further `concern` notes are
+ *   downgraded to asides; preservation still wins. A `blocker` is exempt: it
+ *   means the agent handed off broken or unexercised work, so it still steers a
+ *   triggered turn even right after a prior interrupt (#5628).
  */
 export function resolveAdvisorDeliveryChannel(opts: {
 	severity: AdvisorSeverity | undefined;
@@ -127,7 +129,7 @@ export function resolveAdvisorDeliveryChannel(opts: {
 	if (opts.autoResumeSuppressed && (opts.aborting || !opts.streaming)) return "preserve";
 	if (opts.terminalAnswerNoQueuedWork && opts.severity !== "blocker" && !opts.streaming && !opts.aborting)
 		return "preserve";
-	if (opts.interruptImmuneTurnActive) return "aside";
+	if (opts.interruptImmuneTurnActive && opts.severity !== "blocker") return "aside";
 	return "steer";
 }
 

package/src/cli/auth-broker-cli.ts

@@ -33,10 +33,14 @@ import {
 	SqliteAuthCredentialStore,
 } from "@oh-my-pi/pi-ai";
 import { AuthBrokerClient, DEFAULT_AUTH_BROKER_BIND, startAuthBroker } from "@oh-my-pi/pi-ai/auth-broker";
+import { refreshOAuthToken } from "@oh-my-pi/pi-ai/oauth";
+import type { OAuthCredentials } from "@oh-my-pi/pi-ai/oauth/types";
 import { $which, APP_NAME, getAgentDbPath, getConfigRootDir, isEnoent, logger, VERSION } from "@oh-my-pi/pi-utils";
 import chalk from "@oh-my-pi/pi-utils/chalk";
 import { setTransports as setLoggerTransports } from "@oh-my-pi/pi-utils/logger";
 import { $ } from "bun";
+import { refreshManagedMcpOAuthCredential } from "../mcp/oauth-credentials";
+import { isManagedMCPOAuthCredentialId, mcpOAuthServerUrlFromCredentialId } from "../mcp/oauth-flow";
 import { resolveAuthBrokerConfig } from "../session/auth-broker-config";
 
 export type AuthBrokerAction = "serve" | "token" | "login" | "logout" | "status" | "import" | "migrate" | "list";
@@ -119,6 +123,34 @@ async function ensureToken(): Promise<string> {
 	return token;
 }
 
+/**
+ * OAuth refresh handler for `omp auth-broker serve`'s {@link AuthStorage}.
+ *
+ * The vault holds provider OAuth rows AND OMP-managed `mcp_oauth:*` rows.
+ * Provider rows refresh through the per-provider registry. MCP rows are
+ * self-describing — the embedded token endpoint and client credentials are the
+ * only refresh material — so they refresh with a generic `refresh_token` grant.
+ * The serve process never loads the MCP manager, so this is the only place that
+ * teaches the broker to refresh MCP tokens; without it
+ * `POST /v1/credential/:id/refresh` fails with "Unknown OAuth provider" and the
+ * background refresher lets MCP access tokens expire (issue #8933).
+ */
+export function refreshBrokerOAuthCredential(
+	provider: string,
+	credential: OAuthCredential,
+	signal?: AbortSignal,
+): Promise<OAuthCredentials> {
+	if (isManagedMCPOAuthCredentialId(provider)) {
+		return refreshManagedMcpOAuthCredential(credential, {
+			serverUrl: mcpOAuthServerUrlFromCredentialId(provider),
+			signal,
+		});
+	}
+	// Non-MCP rows: same per-provider path AuthStorage would take by default
+	// (the serve process registers no custom OAuth providers).
+	return refreshOAuthToken(provider as OAuthProvider, credential);
+}
+
 async function runServe(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 	// The broker is a long-running headless service: route structured logs to
 	// stdout so a process supervisor (pm2, journald, k8s) captures them, and
@@ -129,7 +161,10 @@ async function runServe(flags: AuthBrokerCommandArgs["flags"]): Promise<void> {
 	const token = await ensureToken();
 	const dbPath = getAgentDbPath();
 	const store = await SqliteAuthCredentialStore.open(dbPath);
-	const storage = new AuthStorage(store);
+	const storage = new AuthStorage(store, {
+		refreshOAuthCredential: (provider, _credentialId, credential, signal) =>
+			refreshBrokerOAuthCredential(provider, credential, signal),
+	});
 	await storage.reload();
 	const handle = startAuthBroker({
 		storage,

package/src/cli/profile-bootstrap.ts

@@ -33,7 +33,7 @@
  * them also activates (`omp --print --profile work`).
  */
 
-import { isSubcommand } from "../cli-commands";
+import { isSubcommand, LAUNCH_FLAG_COMMANDS } from "../cli-commands";
 import {
 	EXTENSION_SHADOWABLE_STRING_FLAGS,
 	isUnknownLongValueCandidate,
@@ -43,10 +43,6 @@ import {
 	STRING_VALUE_FLAGS,
 } from "./flag-tables";
 
-function isProfileBootstrapSubcommand(arg: string): boolean {
-	return arg === "launch" || arg === "acp";
-}
-
 function needsBoundaryAfterGlobalStrip(stripped: readonly string[]): boolean {
 	const previous = stripped[stripped.length - 1];
 	return (
@@ -222,7 +218,7 @@ export function extractProfileFlags(argv: readonly string[]): ProfileBootstrapRe
 		// any other token has been forwarded, later subcommand names are launch text.
 		// `launch` and `acp` are explicit spellings of launch-shaped commands, so
 		// global launch flags that follow them must still be extracted.
-		if (canDispatchSubcommand && isSubcommand(arg) && !isProfileBootstrapSubcommand(arg)) {
+		if (canDispatchSubcommand && isSubcommand(arg) && LAUNCH_FLAG_COMMANDS[arg] !== true) {
 			sawSubcommand = true;
 		}
 		canDispatchSubcommand = false;