@underactive/pi-topping-moa-fusion 0.4.2 → 0.4.3

package/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 ## [Unreleased]
 
+## [0.4.3]
+
+### Changed
+
+- Verified compatibility with pi 1.0.3: no pi export this extension imports was removed or changed, and typecheck and the full test suite pass against 1.0.3.
+- Updated all four pi development dependencies from 1.0.0 to 1.0.3.
+
+### Fixed
+
+- `/mf-plan` no longer aborts the whole run when a proposer's reply contains a NUL or other control character. Retry tasks now strip control characters (keeping newlines, tabs, and carriage returns) before quoting a previous reply, and accepted proposals are cleaned the same way before synthesis. If a subagent task still cannot be passed as a process argument, only that agent fails, with the reason shown in its progress row, and the remaining proposers continue.
+- On pi 1.0.3, Home and End jump to the top and bottom of the verification findings popup again. pi 1.0.3 moved its `tui.altScreen.top`/`bottom` bindings to Ctrl+Home/Ctrl+End. The popup now accepts those bindings and plain Home/End, which matches the plan review, observer, and menu views. Its hint row shows the configured binding.
+
 ## [0.4.2]
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@underactive/pi-topping-moa-fusion",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "description": "Pi extension implementing /mf-plan — Claude Code-style 5-phase plan mode with a Mixture-of-Agents proposer/synthesizer pipeline.",
   "keywords": [
     "pi-package",
@@ -50,10 +50,10 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-agent-core": "1.0.0",
-    "@earendil-works/pi-ai": "1.0.0",
-    "@earendil-works/pi-coding-agent": "1.0.0",
-    "@earendil-works/pi-tui": "1.0.0",
+    "@earendil-works/pi-agent-core": "1.0.3",
+    "@earendil-works/pi-ai": "1.0.3",
+    "@earendil-works/pi-coding-agent": "1.0.3",
+    "@earendil-works/pi-tui": "1.0.3",
     "@types/node": "^24.0.0",
     "typebox": "^1.3.3",
     "typescript": "^5.8.0"

package/src/moa/fanout.ts

@@ -5,6 +5,7 @@ import type { CancelSession } from "../runtime/cancelRun.ts";
 import { CancelRun } from "../runtime/cancelRun.ts";
 import { getFinalOutput, isFailedResult } from "../runtime/results.ts";
 import type { ModelParallelAgentTask } from "../runtime/runner.ts";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { modelRefLabel, TRIGGER_TURN, type ModelRef, type ThinkingLevel } from "../shared/modelRefs.ts";
 import { activityLoopCount } from "../ui/agentStatus.ts";
 import { showModelThinkingPicker } from "../ui/moaModelPicker.ts";
@@ -251,7 +252,7 @@ export async function runFanoutPhase(options: FanoutPhaseOptions): Promise<Fanou
 	const succeeded: SucceededProposal[] = [];
 	for (let index = 0; index < results.length; index++) {
 		const result = results[index];
-		if (!isFailedResult(result)) succeeded.push({ ref: proposers[index], plan: getFinalOutput(result.messages), originalIndex: index });
+		if (!isFailedResult(result)) succeeded.push({ ref: proposers[index], plan: stripControlCharacters(getFinalOutput(result.messages)), originalIndex: index });
 	}
 	if (succeeded.length === 0) {
 		widget.stopWidget();

package/src/moa/planlessRetry.ts

@@ -1,3 +1,5 @@
+import { stripControlCharacters } from "../shared/controlChars.ts";
+
 /**
  * Recovery for planning agents that exit cleanly without delivering a plan.
  *
@@ -37,8 +39,11 @@ export function looksLikePlan(output: string): boolean {
 export const PROPOSER_RETRY_HEADER =
 	"IMPORTANT: You already attempted this planning task once and stopped without emitting the required plan — your previous output (quoted below) ended in clarifying questions or was otherwise incomplete. You are running headless: there is no user and no way to receive answers. Do not ask questions and do not wait. Answer any open questions yourself with best-judgment assumptions, record them under \"## Open Questions / Assumptions\", and emit the COMPLETE plan in the required output format now.";
 
+// Control characters are stripped before quoting: model replies can carry a
+// NUL (pi's JSON wire format round-trips \u0000), and a NUL cannot cross the
+// argv boundary the retry task is passed through.
 export function buildRetryCorrection(header: string, previousOutput: string): string {
-	const previous = previousOutput.trim().replaceAll('"""', "''") || "(no output)";
+	const previous = stripControlCharacters(previousOutput).trim().replaceAll('"""', "''") || "(no output)";
 	return [header, "", "Your previous output:", '"""', previous, '"""'].join("\n");
 }
 

package/src/runtime/runner.ts

@@ -3,7 +3,8 @@
  * Ported from pi's subagent example.
  */
 
-import { spawn } from "node:child_process";
+import { spawn, type ChildProcessByStdio } from "node:child_process";
+import type { Readable } from "node:stream";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
@@ -47,6 +48,13 @@ export const READ_ONLY_SUBAGENT_ENV = Object.freeze({
 /** Opts provider extensions into the stderr usage-beacon protocol. */
 const USAGE_BEACON_SUBAGENT_ENV = Object.freeze({ PI_USAGE_BEACON: "1" });
 
+function spawnFailureMessage(error: unknown): string {
+	const errorCode =
+		error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : undefined;
+	const message = error instanceof Error ? error.message : String(error);
+	return `Failed to spawn subprocess${errorCode ? ` (${errorCode})` : ""}: ${message}`;
+}
+
 async function writePromptToTempFile(agentName: string, prompt: string): Promise<{ dir: string; filePath: string }> {
 	const tmpDir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "pi-topping-moa-fusion-"));
 	const safeName = agentName.replace(/[^\w.-]+/g, "_");
@@ -175,6 +183,18 @@ export async function runSingleAgent(
 		currentResult.stderr = `Task argument size: ${taskBytes} bytes (exceeds 128 KiB).\n`;
 	}
 
+	// argv entries are C strings: a NUL makes spawn throw before execve.
+	// Follow-up (out of scope): pass the task via temp file or stdin instead of
+	// argv, which would also remove the E2BIG class of failures.
+	if (task.includes("\0")) {
+		const message = "Task contains a NUL byte and cannot be passed as a process argument";
+		currentResult.exitCode = 1;
+		currentResult.stopReason = "error";
+		currentResult.errorMessage = message;
+		currentResult.stderr += `${message}\n`;
+		return currentResult;
+	}
+
 	const outputActivity = new OutputActivityTracker();
 	const partialMessage = new PartialAssistantAssembler();
 
@@ -202,15 +222,32 @@ export async function runSingleAgent(
 
 		const exitCode = await new Promise<number>((resolve) => {
 			const invocation = getPiInvocation(args);
-			const proc = spawn(invocation.command, invocation.args, {
-				cwd: cwd ?? defaultCwd,
-				shell: false,
-				stdio: ["ignore", "pipe", "pipe"],
-				// Read-only handshake for agentic provider bridges (see
-				// READ_ONLY_SUBAGENT_ENV). The pi --tools allowlist above cannot
-				// restrain a bridged agent's own tools.
-				env: { ...process.env, ...READ_ONLY_SUBAGENT_ENV, ...USAGE_BEACON_SUBAGENT_ENV },
-			});
+
+			const appendDiagnostics = (diagnostics: string) => {
+				currentResult.stderr = (currentResult.stderr + diagnostics).slice(-MAX_DIAGNOSTIC_CHARS);
+			};
+
+			let proc: ChildProcessByStdio<null, Readable, Readable>;
+			try {
+				proc = spawn(invocation.command, invocation.args, {
+					cwd: cwd ?? defaultCwd,
+					shell: false,
+					stdio: ["ignore", "pipe", "pipe"],
+					// Read-only handshake for agentic provider bridges (see
+					// READ_ONLY_SUBAGENT_ENV). The pi --tools allowlist above cannot
+					// restrain a bridged agent's own tools.
+					env: { ...process.env, ...READ_ONLY_SUBAGENT_ENV, ...USAGE_BEACON_SUBAGENT_ENV },
+				});
+			} catch (error) {
+				// Argument validation (NUL bytes, bad cwd) and errors such as E2BIG throw
+				// synchronously; only ENOENT/EACCES-class failures reach proc.on("error").
+				const spawnError = spawnFailureMessage(error);
+				currentResult.stopReason = "error";
+				currentResult.errorMessage = spawnError;
+				appendDiagnostics(`${spawnError}\n`);
+				resolve(1);
+				return;
+			}
 			trackedProcesses.add(proc);
 
 			// Auto-remove from tracking when the process exits (normal or otherwise).
@@ -228,10 +265,6 @@ export async function runSingleAgent(
 			};
 			resetIdleTimer();
 
-			const appendDiagnostics = (diagnostics: string) => {
-				currentResult.stderr = (currentResult.stderr + diagnostics).slice(-MAX_DIAGNOSTIC_CHARS);
-			};
-
 			const processLine = (line: string) => {
 				if (!line.trim()) return;
 				try {
@@ -359,8 +392,7 @@ export async function runSingleAgent(
 
 			proc.on("error", (error) => {
 				if (idleTimer) clearTimeout(idleTimer);
-				const errorCode = "code" in error && typeof error.code === "string" ? error.code : undefined;
-				const spawnError = `Failed to spawn subprocess${errorCode ? ` (${errorCode})` : ""}: ${error.message}`;
+				const spawnError = spawnFailureMessage(error);
 				if (!currentResult.errorMessage) currentResult.errorMessage = spawnError;
 				if (!currentResult.stderr.includes(spawnError)) appendDiagnostics(`${spawnError}\n`);
 				resolve(1);

package/src/shared/controlChars.ts

@@ -0,0 +1,10 @@
+/**
+ * C0 control characters except \t, \n, and \r, plus DEL. Same class the
+ * transcript renderer strips for display; also unsafe to quote into a
+ * subprocess argv entry (a NUL makes spawn throw before execve).
+ */
+const CONTROL_CHARACTERS = /[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g;
+
+export function stripControlCharacters(text: string): string {
+	return text.replace(CONTROL_CHARACTERS, "");
+}

package/src/ui/agentTranscript.ts

@@ -1,4 +1,5 @@
 import type { Message } from "@earendil-works/pi-ai";
+import { stripControlCharacters } from "../shared/controlChars.ts";
 import { wrapWords } from "./chrome.ts";
 
 export const CONTENT_SEPARATOR = "\n\n---\n\n";
@@ -87,10 +88,11 @@ export function transcriptBody(
 }
 
 function stripTerminalControls(text: string): string {
-	return text
-		.replace(/\x1b\][^\x07]*(?:\x07|$)/g, "")
-		.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, "")
-		.replace(/[\x00-\x08\x0b\x0c\x0e-\x1f\x7f]/g, "");
+	return stripControlCharacters(
+		text
+			.replace(/\x1b\][^\x07]*(?:\x07|$)/g, "")
+			.replace(/\x1b\[[0-?]*[ -/]*[@-~]/g, ""),
+	);
 }
 
 export function formatAgentPreview(

package/src/ui/verificationFindingsOverlay.ts

@@ -1,6 +1,6 @@
 import type { ExtensionContext, KeybindingsManager, Theme } from "@earendil-works/pi-coding-agent";
 import { getMarkdownTheme, keyHint } from "@earendil-works/pi-coding-agent";
-import { Markdown, type Component, type TUI } from "@earendil-works/pi-tui";
+import { Key, Markdown, matchesKey, type Component, type TUI } from "@earendil-works/pi-tui";
 import { ROUNDED_SINGLE_BOX, createFrame, ratioViewport, safeRenderWidth } from "./chrome.ts";
 
 const OVERLAY_HEIGHT_RATIO = 0.9;
@@ -78,6 +78,9 @@ class VerificationFindingsOverlay implements Component {
 		else if (keys.matches(data, "tui.select.pageUp")) delta = -(this.viewportLines() - 2);
 		else if (keys.matches(data, "tui.altScreen.top")) this.scrollOffset = 0;
 		else if (keys.matches(data, "tui.altScreen.bottom")) this.scrollOffset = Number.MAX_SAFE_INTEGER;
+		// Plain Home/End too, like the sibling views; pi 1.0.3 binds top/bottom to Ctrl+Home/Ctrl+End.
+		else if (matchesKey(data, Key.home)) this.scrollOffset = 0;
+		else if (matchesKey(data, Key.end)) this.scrollOffset = Number.MAX_SAFE_INTEGER;
 		else return;
 
 		this.scrollOffset += delta;