@phi-code-admin/phi-code 0.76.16 → 0.77.0

package/dist/utils/sleep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAcrE","sourcesContent":["/**\n * Sleep helper that respects abort signal.\n */\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted) {\n\t\t\treject(new Error(\"Aborted\"));\n\t\t\treturn;\n\t\t}\n\n\t\tconst timeout = setTimeout(resolve, ms);\n\n\t\tsignal?.addEventListener(\"abort\", () => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(new Error(\"Aborted\"));\n\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"sleep.d.ts","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,wBAAgB,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAmBrE","sourcesContent":["/**\n * Sleep helper that respects abort signal.\n */\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted) {\n\t\t\treject(new Error(\"Aborted\"));\n\t\t\treturn;\n\t\t}\n\n\t\tconst onAbort = () => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(new Error(\"Aborted\"));\n\t\t};\n\n\t\tconst timeout = setTimeout(() => {\n\t\t\tsignal?.removeEventListener(\"abort\", onAbort);\n\t\t\tresolve();\n\t\t}, ms);\n\n\t\tsignal?.addEventListener(\"abort\", onAbort, { once: true });\n\t});\n}\n"]}

package/dist/utils/sleep.js

@@ -7,11 +7,15 @@ export function sleep(ms, signal) {
             reject(new Error("Aborted"));
             return;
         }
-        const timeout = setTimeout(resolve, ms);
-        signal?.addEventListener("abort", () => {
+        const onAbort = () => {
             clearTimeout(timeout);
             reject(new Error("Aborted"));
-        });
+        };
+        const timeout = setTimeout(() => {
+            signal?.removeEventListener("abort", onAbort);
+            resolve();
+        }, ms);
+        signal?.addEventListener("abort", onAbort, { once: true });
     });
 }
 //# sourceMappingURL=sleep.js.map

package/dist/utils/sleep.js.map

@@ -1 +1 @@
-{"version":3,"file":"sleep.js","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB,EAAiB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAExC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAAA,CAC7B,CAAC,CAAC;IAAA,CACH,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Sleep helper that respects abort signal.\n */\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted) {\n\t\t\treject(new Error(\"Aborted\"));\n\t\t\treturn;\n\t\t}\n\n\t\tconst timeout = setTimeout(resolve, ms);\n\n\t\tsignal?.addEventListener(\"abort\", () => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(new Error(\"Aborted\"));\n\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"sleep.js","sourceRoot":"","sources":["../../src/utils/sleep.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,UAAU,KAAK,CAAC,EAAU,EAAE,MAAoB,EAAiB;IACtE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC;QACvC,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;YACrB,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,MAAM,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QAAA,CAC7B,CAAC;QAEF,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;YAChC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC9C,OAAO,EAAE,CAAC;QAAA,CACV,EAAE,EAAE,CAAC,CAAC;QAEP,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAAA,CAC3D,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Sleep helper that respects abort signal.\n */\nexport function sleep(ms: number, signal?: AbortSignal): Promise<void> {\n\treturn new Promise((resolve, reject) => {\n\t\tif (signal?.aborted) {\n\t\t\treject(new Error(\"Aborted\"));\n\t\t\treturn;\n\t\t}\n\n\t\tconst onAbort = () => {\n\t\t\tclearTimeout(timeout);\n\t\t\treject(new Error(\"Aborted\"));\n\t\t};\n\n\t\tconst timeout = setTimeout(() => {\n\t\t\tsignal?.removeEventListener(\"abort\", onAbort);\n\t\t\tresolve();\n\t\t}, ms);\n\n\t\tsignal?.addEventListener(\"abort\", onAbort, { once: true });\n\t});\n}\n"]}

package/extensions/phi/benchmark.ts

@@ -711,9 +711,16 @@ Scoring: S (80+), A (65+), B (50+), C (35+), D (<35)`, "info");
 			}
 
 			if (arg) {
-				// Benchmark specific model
-				const model = available.find(m => m.id.toLowerCase() === arg || m.id.toLowerCase().includes(arg));
+				// Benchmark specific model: prefer exact id match, then require an
+				// unambiguous substring match to avoid benchmarking the wrong model.
+				const exact = available.find(m => m.id.toLowerCase() === arg);
+				const matches = available.filter(m => m.id.toLowerCase().includes(arg));
+				const model = exact ?? (matches.length === 1 ? matches[0] : undefined);
 				if (!model) {
+					if (!exact && matches.length > 1) {
+						ctx.ui.notify(`Model "${arg}" is ambiguous. Did you mean:\n${matches.map(m => `  - ${m.id} (${m.provider})`).join("\n")}`, "warning");
+						return;
+					}
 					ctx.ui.notify(`Model "${arg}" not found or no API key. Available:\n${available.map(m => `  - ${m.id} (${m.provider})`).join("\n")}`, "warning");
 					return;
 				}

package/extensions/phi/init.ts

@@ -502,7 +502,10 @@ _Edit this file to customize Phi Code's behavior for your project._
 		// not cause the user to lose what they just typed.
 		try {
 			await persistProviderKey(provider, trimmed);
-			process.env[provider.envVar] = trimmed;
+			// Do not mirror the key into process.env: getKey() reads models.json
+			// first, so the store is already the source of truth. Setting the env
+			// var would leak the plaintext key to every child process (bash tool,
+			// pi.exec, npm postinstall, etc.).
 		} catch (err) {
 			ctx.ui.notify(
 				`Failed to write ${modelsJsonPath}: ${err instanceof Error ? err.message : String(err)}`,

package/extensions/phi/keys.ts

@@ -76,6 +76,19 @@ export default function keysExtension(pi: ExtensionAPI) {
 						ctx.ui.notify("Usage: `/keys set <provider-id> <api-key>`", "warning");
 						return;
 					}
+					// A bare `set` only updates the key; it cannot supply baseUrl/api/models.
+					// For a never-configured id this would persist an unusable provider
+					// (apiKey but no endpoint), so require an existing entry with a baseUrl.
+					const existing = store.getProvider(id);
+					if (!existing?.baseUrl) {
+						ctx.ui.notify(
+							`\`${id}\` is not a configured provider (no baseUrl on file). ` +
+								`Run \`/setup\` to add it with an endpoint and models first; ` +
+								`\`/keys set\` only updates the key of an already-configured provider.`,
+							"warning",
+						);
+						return;
+					}
 					watcher.muteForWrite("models_json_changed");
 					store.setKey(id, key);
 					ctx.ui.notify(

package/extensions/phi/memory.ts

@@ -436,9 +436,12 @@ export default function memoryExtension(pi: ExtensionAPI) {
 			return {};
 		}
 		const truncated = userPrompt.length > 200 ? `${userPrompt.slice(0, 200)}...` : userPrompt;
+		// Neutralize angle brackets so user content cannot close the
+		// <system-reminder> block early and inject trusted instructions.
+		const safe = truncated.replace(/[<>]/g, (c) => (c === "<" ? "&lt;" : "&gt;")).replace(/"/g, '\\"');
 		const reminder = `<system-reminder>
 You are about to respond to a new user message:
-"${truncated.replace(/"/g, '\\"')}"
+"${safe}"
 
 REMINDER (project rule, applies every turn):
 1. Call \`memory_search\` FIRST with keywords from the user's intent. Recent

package/extensions/phi/orchestrator.ts

@@ -229,6 +229,11 @@ export default function orchestratorExtension(pi: ExtensionAPI) {
 	const MAX_PHASE_DURATION_MS = 10 * 60 * 1000; // 10 minutes per phase
 	const MAX_TOOL_CALLS_PER_PHASE = 60; // Safety limit
 	let phaseStartTime: number | null = null;
+	// User's model before /plan started, restored once orchestration ends
+	let originalModel: any | null = null;
+	// Real phase counters for the final summary
+	let completedPhases = 0;
+	let skippedPhases = 0;
 
 	/**
 	 * Parse agent .md file with YAML frontmatter
@@ -582,27 +587,48 @@ Tag the note with relevant keywords for vector search.
 
 	/**
 	 * Switch model for the current phase.
+	 * Returns the model id actually in use plus an optional warning when the
+	 * requested routing.json model could not be applied (not in registry or no
+	 * API key), so the caller can surface the degraded routing to the user.
 	 */
-	async function switchModelForPhase(phase: OrchestratorPhase, ctx: any): Promise<string> {
+	async function switchModelForPhase(
+		phase: OrchestratorPhase,
+		ctx: any,
+	): Promise<{ modelId: string; warning?: string }> {
 		const available = ctx.modelRegistry?.getAvailable?.() || [];
 		const target = resolveModelRef(available, phase.model) || resolveModelRef(available, phase.fallback);
+		const currentId = ctx.model?.id || phase.model;
 
-		if (target && (target.id !== ctx.model?.id || target.provider !== ctx.model?.provider)) {
+		if (!target) {
+			// Neither the preferred nor the fallback ref resolved to a registered model.
+			return {
+				modelId: currentId,
+				warning: `Phase ${phase.label} model '${phase.model}' unavailable (not in registry); running on '${currentId}'`,
+			};
+		}
+
+		if (target.id !== ctx.model?.id || target.provider !== ctx.model?.provider) {
 			const switched = await pi.setModel(target);
-			if (switched) return target.id;
+			if (switched) return { modelId: target.id };
+			// setModel returns false when the target has no configured auth.
+			return {
+				modelId: currentId,
+				warning: `Phase ${phase.label} model '${phase.model}' unavailable (no API key); running on '${currentId}'`,
+			};
 		}
-		return ctx.model?.id || phase.model;
+		return { modelId: target.id };
 	}
 
 	/**
 	 * Activate agent for a phase: set system prompt + restrict tools.
 	 */
 	function activateAgent(phase: OrchestratorPhase, ctx: any) {
+		// Fallback capture: savedTools is normally taken in the /plan handler at
+		// orchestration start, but capture it here too so restoration is always defined.
+		if (!savedTools) {
+			savedTools = pi.getActiveTools();
+		}
 		if (phase.agent) {
-			// Save current tools for restoration
-			if (!savedTools) {
-				savedTools = pi.getActiveTools();
-			}
 			// Set agent's system prompt (will be injected via before_agent_start)
 			activeAgentPrompt = phase.agent.systemPrompt;
 			// Restrict tools to agent's allowed tools
@@ -612,10 +638,20 @@ Tag the note with relevant keywords for vector search.
 				const agentTools = [...phase.agent.tools, ...memoryTools.filter(t => !phase.agent.tools.includes(t))];
 				activeAgentTools = agentTools;
 				pi.setActiveTools(agentTools);
+			} else if (savedTools) {
+				// Agent with no tool restriction: reset to the full toolset so the
+				// previous phase's narrower restriction does not leak into this one.
+				activeAgentTools = null;
+				pi.setActiveTools(savedTools);
 			}
 		} else {
+			// No agent for this phase: restore the full toolset, otherwise the prior
+			// phase's restriction would persist.
 			activeAgentPrompt = null;
 			activeAgentTools = null;
+			if (savedTools) {
+				pi.setActiveTools(savedTools);
+			}
 		}
 	}
 
@@ -639,27 +675,54 @@ Tag the note with relevant keywords for vector search.
 		(globalThis as any).__phiOrchestrationActive = active;
 	}
 
+	/**
+	 * Tear down orchestration state without chaining to the next phase.
+	 * Used by the user-abort and auth-error paths so they restore the user's
+	 * model and tools exactly like the normal completion branch.
+	 */
+	function stopOrchestration() {
+		setOrchestrationActive(false);
+		phasePending = false;
+		deactivateAgent();
+		if (phaseTimeoutId) { clearTimeout(phaseTimeoutId); phaseTimeoutId = null; }
+		if (originalModel) {
+			const toRestore = originalModel;
+			originalModel = null;
+			Promise.resolve(pi.setModel(toRestore)).catch(() => { /* best effort */ });
+		}
+	}
+
 	function sendNextPhase(ctx: any) {
 		if (phaseQueue.length === 0) {
 			// All phases done — clean up and notify
 			setOrchestrationActive(false);
 			phasePending = false;
 			deactivateAgent();
+			// Restore the user's model so /plan does not overwrite their /model choice.
+			if (originalModel) {
+				const toRestore = originalModel;
+				originalModel = null;
+				Promise.resolve(pi.setModel(toRestore)).catch(() => { /* best effort */ });
+			}
 			if (phaseTimeoutId) { clearTimeout(phaseTimeoutId); phaseTimeoutId = null; }
-			// Generate global final summary
-			const totalPhases = 5; // always 5
+			// Generate global final summary using the real phase counters
 			const elapsed = phaseStartTime ? Math.round((Date.now() - phaseStartTime) / 1000) : 0;
 			const minutes = Math.floor(elapsed / 60);
 			const seconds = elapsed % 60;
+			const skippedNote = skippedPhases ? ` (${skippedPhases} skipped on timeout)` : "";
 			ctx.ui.notify(`\n📊 **Orchestration Summary**\n` +
-				`  Phases: ${totalPhases}/5 completed\n` +
+				`  Phases: ${completedPhases}/5 completed${skippedNote}\n` +
 				`  Duration: ${minutes}m ${seconds}s\n` +
 				`  Check \`.phi/plans/\` for all reports`, "info");
+			const allDone = completedPhases >= 5 && skippedPhases === 0;
+			const doneMsg = allDone
+				? `\n✅ **All 5 phases complete!**`
+				: `\n⚠️ **Orchestration finished:** ${completedPhases}/5 phases completed${skippedNote}.`;
 			try {
-				ctx.ui.notify(`\n✅ **All 5 phases complete!**`, "info");
+				ctx.ui.notify(doneMsg, "info");
 			} catch {
 				// Fallback: inject completion message into conversation stream
-				try { pi.sendUserMessage(`✅ All 5 phases complete! The project is ready for review.`); } catch { /* best effort */ }
+				try { pi.sendUserMessage(`Orchestration finished: ${completedPhases}/5 phases completed${skippedNote}.`); } catch { /* best effort */ }
 			}
 			return;
 		}
@@ -667,18 +730,25 @@ Tag the note with relevant keywords for vector search.
 		const phase = phaseQueue.shift()!;
 		phasePending = true;
 
-		switchModelForPhase(phase, ctx).then((modelId) => {
+		switchModelForPhase(phase, ctx).then(({ modelId, warning }) => {
 			activateAgent(phase, ctx);
 			const agentName = phase.agent?.name || phase.key;
 			ctx.ui.notify(`\n${phase.label} → \`${modelId}\` (agent: ${agentName})`, "info");
-			// Small delay to let the model switch settle, then send instruction
-			setTimeout(() => pi.sendUserMessage(phase.instruction), 500);
+			if (warning) ctx.ui.notify(`\n⚠️ ${warning}`, "warning");
+			// Small delay to let the model switch settle, then send instruction.
+			// deliverAs:"followUp" queues the message instead of throwing when the
+			// agent is still streaming (e.g. on the timeout path).
+			setTimeout(() => pi.sendUserMessage(phase.instruction, { deliverAs: "followUp" }), 500);
 			// Set phase timeout — abort if phase takes too long
 			if (phaseTimeoutId) clearTimeout(phaseTimeoutId);
 			phaseTimeoutId = setTimeout(() => {
 				if (orchestrationActive && phasePending) {
 					ctx.ui.notify(`\n⏰ **Phase timed out** (${MAX_PHASE_DURATION_MS / 60000} min limit). Skipping to next phase.`, "warning");
 					phasePending = false;
+					skippedPhases++;
+					// Abort the stuck phase first so the next instruction does not
+					// race a still-streaming phase.
+					try { ctx.abort(); } catch { /* best effort */ }
 					sendNextPhase(ctx);
 				}
 			}, MAX_PHASE_DURATION_MS);
@@ -705,6 +775,19 @@ Tag the note with relevant keywords for vector search.
 
 	pi.on("agent_end", async (event, ctx) => {
 		if (!orchestrationActive) return;
+
+		// User abort (Ctrl+C / ESC): the aborted run still emits agent_end, but it
+		// must NOT be treated as phase completion. Detect the aborted assistant
+		// message and stop the whole workflow instead of chaining the next phase.
+		const userAborted = (event.messages || []).some(
+			(m: any) => m.role === 'assistant' && m.stopReason === 'aborted',
+		);
+		if (userAborted) {
+			ctx.ui.notify(`\n🛑 **Orchestration cancelled** by user. Remaining phases skipped.`, "warning");
+			stopOrchestration();
+			return;
+		}
+
 		// Allow completion even if phasePending was cleared by a duplicate event
 		if (!phasePending) {
 			// If queue is empty and orchestration is active, force completion
@@ -740,9 +823,10 @@ Tag the note with relevant keywords for vector search.
 					const match = content.match(/wrote \d+ bytes to (.+)/);
 					if (match) filesWritten.push(match[1]);
 				}
-				// Track edits
-				if (name === 'edit' && !content.includes('ERR')) {
-					const match = content.match(/edited (.+)/) || content.match(/in (.+)/);
+				// Track edits — the edit tool returns "Successfully replaced N block(s) in <path>."
+				// Anchor the path capture so it does not over-capture unrelated text.
+				if (name === 'edit' && !content.includes('ERR') && !(msg as any).isError) {
+					const match = content.match(/replaced \d+ block\(s\) in (.+?)\.?$/m);
 					if (match) filesEdited.push(match[1]);
 				}
 				// Track errors — but filter out edit retries (old_text mismatch = normal retry, not error)
@@ -770,10 +854,7 @@ Tag the note with relevant keywords for vector search.
 		// Only a genuine auth failure (401) is fatal — abort the whole workflow.
 		if (hasAuthError) {
 			ctx.ui.notify(`\n❌ **Orchestrator aborted:** API authentication error (401)\nCheck your API key and model configuration.`, "error");
-			setOrchestrationActive(false);
-			phasePending = false;
-			deactivateAgent();
-			if (phaseTimeoutId) { clearTimeout(phaseTimeoutId); phaseTimeoutId = null; }
+			stopOrchestration();
 			return;
 		}
 
@@ -816,6 +897,7 @@ Tag the note with relevant keywords for vector search.
 		}
 
 		// Phase complete — chain to next
+		completedPhases++;
 		phasePending = false;
 		sendNextPhase(ctx);
 	});
@@ -851,6 +933,13 @@ Tag the note with relevant keywords for vector search.
 			phaseQueue = phases.slice(1); // Queue phases 2-5
 			setOrchestrationActive(true);
 			phasePending = true;
+			// Capture the user's model + full toolset so they can be restored when
+			// orchestration ends (otherwise /plan permanently overwrites /model and
+			// per-phase tool restrictions can leak).
+			originalModel = ctx.model || null;
+			savedTools = pi.getActiveTools();
+			completedPhases = 0;
+			skippedPhases = 0;
 			const firstPhase = phases[0];
 
 			ctx.ui.notify(`📋 **Orchestrator started** — 5 phases with model routing + agent roles\n`, "info");
@@ -866,11 +955,12 @@ Tag the note with relevant keywords for vector search.
 			// Record orchestration start time for final summary
 			phaseStartTime = Date.now();
 			// Switch model and activate agent for first phase
-			const modelId = await switchModelForPhase(firstPhase, ctx);
+			const { modelId, warning } = await switchModelForPhase(firstPhase, ctx);
 			activateAgent(firstPhase, ctx);
 			const agentName = firstPhase.agent?.name || firstPhase.key;
 			ctx.ui.notify(`${firstPhase.label} → \`${modelId}\` (agent: ${agentName})`, "info");
-			setTimeout(() => pi.sendUserMessage(firstPhase.instruction), 200);
+			if (warning) ctx.ui.notify(`\n⚠️ ${warning}`, "warning");
+			setTimeout(() => pi.sendUserMessage(firstPhase.instruction, { deliverAs: "followUp" }), 200);
 		},
 	});
 

package/extensions/phi/providers/opencode-go.ts

@@ -77,7 +77,9 @@ interface CacheEntry {
 
 const CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
 let cache: CacheEntry | null = null;
-let inflightFetch: Promise<OpenCodeGoModel[]> | null = null;
+// Inflight fetches keyed by apiKey so a keyless probe never leaks its
+// (possibly 401/reduced) result to a caller that passed a real key.
+const inflightFetch = new Map<string, Promise<OpenCodeGoModel[]>>();
 
 function isCacheValid(now: number): boolean {
 	return cache !== null && now - cache.fetchedAt < CACHE_TTL_MS;
@@ -125,19 +127,25 @@ export async function getOpenCodeGoModels(options?: {
 		return { models: cache!.models, source: "cache" };
 	}
 
-	if (inflightFetch) {
-		try {
-			const models = await inflightFetch;
-			return { models, source: "live" };
-		} catch {
-			// fall through to fresh attempt
+	const inflightKey = options?.apiKey ?? "";
+
+	if (!force) {
+		const existing = inflightFetch.get(inflightKey);
+		if (existing) {
+			try {
+				const models = await existing;
+				return { models, source: "live" };
+			} catch {
+				// fall through to fresh attempt
+			}
 		}
 	}
 
-	inflightFetch = fetchModelsRaw(options?.apiKey, timeoutMs);
+	const promise = fetchModelsRaw(options?.apiKey, timeoutMs);
+	inflightFetch.set(inflightKey, promise);
 	try {
-		const models = await inflightFetch;
-		cache = { models, fetchedAt: now };
+		const models = await promise;
+		cache = { models, fetchedAt: Date.now() };
 		return { models, source: "live" };
 	} catch {
 		if (cache) {
@@ -145,7 +153,9 @@ export async function getOpenCodeGoModels(options?: {
 		}
 		return { models: [...OPENCODE_GO_FALLBACK_MODELS], source: "fallback" };
 	} finally {
-		inflightFetch = null;
+		// Only clear the slot we created; a concurrent fetch for the same key
+		// may have replaced it (e.g. force=true overwriting a pending entry).
+		if (inflightFetch.get(inflightKey) === promise) inflightFetch.delete(inflightKey);
 	}
 }
 
@@ -240,5 +250,5 @@ export function buildOpenCodeGoAnthropicProviderConfig(apiKey: string, models: O
  */
 export function _resetOpenCodeGoCache(): void {
 	cache = null;
-	inflightFetch = null;
+	inflightFetch.clear();
 }

package/extensions/phi/setup.ts

@@ -19,7 +19,7 @@
  *  - Storage chmod 0600 garantit la sécurité au repos
  */
 
-import { ApiKeyStore, type ExtensionAPI, type ExtensionUIContext, getApiKeyStore } from "phi-code";
+import { ApiKeyStore, type ExtensionAPI, type ExtensionUIContext, getApiKeyStore, getConfigWatcher } from "phi-code";
 import { writeFile, mkdir } from "node:fs/promises";
 import { join } from "node:path";
 import { homedir } from "node:os";
@@ -443,7 +443,13 @@ async function configureGenericCloud(
 		if (!proceed) return undefined;
 	}
 
+	// Mute the config watcher so these programmatic writes are not echoed back as
+	// models_json_changed events. Mute per-write because the ping/fetch below can
+	// exceed the ignore window between the two setKey calls (cf. models.ts).
+	const watcher = getConfigWatcher();
+
 	// Persist the key immediately so a downstream fetch failure cannot lose user input.
+	watcher.muteForWrite("models_json_changed");
 	store.setKey(provider.id, trimmed, {
 		baseUrl: provider.baseUrl,
 		api: provider.api,
@@ -479,6 +485,7 @@ async function configureGenericCloud(
 		: provider.staticModels.map((id) => ({ id, name: id, reasoning: true }))
 	).map(toPersistedModel);
 
+	watcher.muteForWrite("models_json_changed");
 	store.setKey(provider.id, trimmed, {
 		baseUrl: provider.baseUrl,
 		api: provider.api,

package/extensions/phi/web-search.ts

@@ -50,8 +50,20 @@ function decodeEntities(text: string): string {
 	return text
 		.replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">")
 		.replace(/&quot;/g, '"').replace(/&#39;/g, "'").replace(/&#x27;/g, "'")
-		.replace(/&#(\d+);/g, (_, n) => String.fromCharCode(parseInt(n, 10)))
-		.replace(/&#x([0-9a-fA-F]+);/g, (_, n) => String.fromCharCode(parseInt(n, 16)));
+		.replace(/&#(\d+);/g, (m, n) => {
+			try {
+				return String.fromCodePoint(parseInt(n, 10));
+			} catch {
+				return m;
+			}
+		})
+		.replace(/&#x([0-9a-fA-F]+);/g, (m, n) => {
+			try {
+				return String.fromCodePoint(parseInt(n, 16));
+			} catch {
+				return m;
+			}
+		});
 }
 
 function stripTags(html: string): string {
@@ -434,7 +446,7 @@ export default function webSearchExtension(pi: ExtensionAPI) {
 		const hasReadability = await tryLoadReadability();
 		if (hasReadability && _JSDOM && _Readability) {
 			try {
-				const dom = new _JSDOM(text, { url });
+				const dom = new _JSDOM(text, { url: currentUrl });
 				const reader = new _Readability(dom.window.document);
 				const article = reader.parse();
 				if (article?.textContent) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@phi-code-admin/phi-code",
-	"version": "0.76.16",
+	"version": "0.77.0",
 	"description": "Coding agent CLI with persistent memory, sub-agents, intelligent routing, and orchestration",
 	"type": "module",
 	"piConfig": {