gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.538325aea

package/packages/pi-coding-agent/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gsd/pi-coding-agent",
-  "version": "2.76.0",
+  "version": "2.77.0",
   "description": "Coding agent CLI (vendored from pi-mono)",
   "type": "module",
   "piConfig": {

package/packages/pi-coding-agent/src/core/agent-session-abort-order.test.ts

@@ -14,8 +14,9 @@ describe("#4243 — abort() must be called before _disconnectFromAgent()", () =>
 		const newSessionStart = source.indexOf("async newSession(options?:");
 		assert.ok(newSessionStart >= 0, "should find newSession method");
 
-		// Get a window that includes the abort/disconnect section
-		const window = source.slice(newSessionStart, newSessionStart + 1200);
+		// Get a window that includes the abort/disconnect section.
+		// Use 2000 chars to accommodate guard checks inserted between the two calls.
+		const window = source.slice(newSessionStart, newSessionStart + 2000);
 
 		// Find the abort and _disconnectFromAgent calls
 		const abortIdx = window.indexOf("await this.abort();");

package/packages/pi-coding-agent/src/core/agent-session.ts

@@ -1568,6 +1568,8 @@ export class AgentSession {
 	async newSession(options?: {
 		parentSession?: string;
 		setup?: (sessionManager: SessionManager) => Promise<void>;
+		/** See ExtensionCommandContext.newSession for docs (#3731). */
+		abortSignal?: AbortSignal;
 	}): Promise<boolean> {
 		const previousSessionFile = this.sessionFile;
 
@@ -1587,6 +1589,15 @@ export class AgentSession {
 	// message_end/agent_end events fire and the #4216 finalization code
 	// can run before we unsubscribe from the event bus.
 	await this.abort();
+
+		// #3731: If the caller aborted (e.g. runUnit() timed out and restored cwd to
+		// project root), discard this session before capturing process.cwd() and
+		// rebuilding the tool runtime. Without this check, the late newSession()
+		// would rebuild tools with root cwd, breaking worktree isolation.
+		if (options?.abortSignal?.aborted) {
+			return false;
+		}
+
 	this._disconnectFromAgent();
 	this.agent.reset();
 		// Update cwd to current process directory — auto-mode may have chdir'd

package/packages/pi-coding-agent/src/core/extensions/runner.ts

@@ -164,6 +164,8 @@ export type ExtensionErrorListener = (error: ExtensionError) => void;
 export type NewSessionHandler = (options?: {
 	parentSession?: string;
 	setup?: (sessionManager: SessionManager) => Promise<void>;
+	/** See ExtensionCommandContext.newSession for docs (#3731). */
+	abortSignal?: AbortSignal;
 }) => Promise<{ cancelled: boolean }>;
 
 export type ForkHandler = (entryId: string) => Promise<{ cancelled: boolean }>;

package/packages/pi-coding-agent/src/core/extensions/types.ts

@@ -303,6 +303,11 @@ export interface ExtensionCommandContext extends ExtensionContext {
 	newSession(options?: {
 		parentSession?: string;
 		setup?: (sessionManager: SessionManager) => Promise<void>;
+		/** When aborted before the session is fully configured, newSession() returns
+		 *  early without rebuilding the tool runtime. Used by runUnit() to discard
+		 *  a late-resolving newSession() after the session-creation timeout fires,
+		 *  preventing the tool runtime from being rebuilt with the wrong cwd (#3731). */
+		abortSignal?: AbortSignal;
 	}): Promise<{ cancelled: boolean }>;
 
 	/** Fork from a specific entry, creating a new session file. */
@@ -1747,6 +1752,8 @@ export interface ExtensionCommandContextActions {
 	newSession: (options?: {
 		parentSession?: string;
 		setup?: (sessionManager: SessionManager) => Promise<void>;
+		/** See ExtensionCommandContext.newSession for docs (#3731). */
+		abortSignal?: AbortSignal;
 	}) => Promise<{ cancelled: boolean }>;
 	fork: (entryId: string) => Promise<{ cancelled: boolean }>;
 	navigateTree: (

package/packages/pi-coding-agent/src/core/model-registry-custom-caps.test.ts

@@ -0,0 +1,245 @@
+/**
+ * Regression tests for #4563:
+ *   Bug 1 — custom/Anthropic-compatible models were hard-capped to 32 k output tokens
+ *   Bug 2 — custom models in models.json could not declare capabilities.supportsXhigh
+ */
+import assert from "node:assert/strict";
+import { mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, it } from "node:test";
+import { AuthStorage } from "./auth-storage.js";
+import { ModelRegistry } from "./model-registry.js";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+let testDir: string;
+
+beforeEach(() => {
+	testDir = join(
+		tmpdir(),
+		`model-registry-custom-caps-${Date.now()}-${Math.random().toString(36).slice(2)}`,
+	);
+	mkdirSync(testDir, { recursive: true });
+});
+
+afterEach(() => {
+	try {
+		rmSync(testDir, { recursive: true, force: true });
+	} catch {
+		// best-effort cleanup
+	}
+});
+
+function createRegistry(modelsJson: object): ModelRegistry {
+	const path = join(testDir, "models.json");
+	writeFileSync(path, JSON.stringify(modelsJson));
+	return new ModelRegistry(AuthStorage.inMemory(), path);
+}
+
+function writeModelsJson(obj: object): string {
+	const path = join(testDir, "models.json");
+	writeFileSync(path, JSON.stringify(obj));
+	return path;
+}
+
+// ─── Bug 1: 32 k cap must not apply to custom/OpenAI-compatible models ────────
+
+describe("Bug 1 — maxTokens cap (#4563)", () => {
+	it("custom openai-completions model with maxTokens > 32 k is not capped", () => {
+		const registry = createRegistry({
+			providers: {
+				"kimi-custom": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [
+						{
+							id: "kimi-k2.6-code-preview",
+							name: "Kimi K2.6 Code Preview",
+							maxTokens: 131072,
+							contextWindow: 262144,
+						},
+					],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "kimi-k2.6-code-preview");
+		assert.ok(model, "model should be registered");
+		assert.equal(
+			model.maxTokens,
+			131072,
+			"maxTokens must be preserved as declared — not capped to 32 000",
+		);
+	});
+
+	it("custom model with maxTokens exactly 32 k is not affected", () => {
+		const registry = createRegistry({
+			providers: {
+				"custom-provider": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [{ id: "model-32k", maxTokens: 32000, contextWindow: 128000 }],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "model-32k");
+		assert.ok(model);
+		assert.equal(model.maxTokens, 32000);
+	});
+
+	it("custom model with maxTokens 65 k is stored at full value", () => {
+		const registry = createRegistry({
+			providers: {
+				"dashscope-custom": {
+					baseUrl: "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [
+						{
+							id: "qwen3.5-plus",
+							name: "Qwen3.5 Plus",
+							maxTokens: 65536,
+							contextWindow: 1000000,
+						},
+					],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "qwen3.5-plus" && m.provider === "dashscope-custom");
+		assert.ok(model);
+		assert.equal(model.maxTokens, 65536);
+	});
+});
+
+// ─── Bug 2: capabilities.supportsXhigh must be declarable in models.json ──────
+
+describe("Bug 2 — capabilities.supportsXhigh in models.json (#4563)", () => {
+	it("model with capabilities.supportsXhigh: true surfaces the flag", () => {
+		const registry = createRegistry({
+			providers: {
+				"kimi-custom": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "anthropic-messages",
+					models: [
+						{
+							id: "kimi-k2.6-code-preview",
+							name: "Kimi K2.6 Code Preview",
+							maxTokens: 131072,
+							contextWindow: 262144,
+							capabilities: { supportsXhigh: true },
+						},
+					],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "kimi-k2.6-code-preview");
+		assert.ok(model, "model should be registered");
+		assert.equal(
+			model.capabilities?.supportsXhigh,
+			true,
+			"supportsXhigh must be true as declared in models.json",
+		);
+	});
+
+	it("model without capabilities declaration has no supportsXhigh", () => {
+		const registry = createRegistry({
+			providers: {
+				"plain-provider": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [{ id: "plain-model", maxTokens: 16384, contextWindow: 128000 }],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "plain-model");
+		assert.ok(model);
+		// supportsXhigh should be absent or explicitly false — never implicitly true
+		assert.ok(
+			!model.capabilities?.supportsXhigh,
+			"supportsXhigh must not be set for models that don't declare it",
+		);
+	});
+
+	it("capabilities.supportsXhigh: false is respected", () => {
+		const registry = createRegistry({
+			providers: {
+				"explicit-provider": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [
+						{
+							id: "no-xhigh-model",
+							capabilities: { supportsXhigh: false },
+						},
+					],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "no-xhigh-model");
+		assert.ok(model);
+		assert.equal(model.capabilities?.supportsXhigh, false);
+	});
+
+	it("supportsXhigh declared in models.json is not overwritten by capability patches", () => {
+		// The capability-patches system must not overwrite an explicit declaration in models.json.
+		// applyCapabilityPatches uses spread: { ...patch.caps, ...model.capabilities }
+		// so model.capabilities wins. This test verifies the precedence end-to-end.
+		const registry = createRegistry({
+			providers: {
+				"compat-provider": {
+					baseUrl: "https://api.example.com/v1",
+					apiKey: "sk-test",
+					api: "openai-completions",
+					models: [
+						{
+							id: "custom-xhigh-model",
+							capabilities: { supportsXhigh: true },
+						},
+					],
+				},
+			},
+		});
+
+		const model = registry.getAll().find((m) => m.id === "custom-xhigh-model");
+		assert.ok(model);
+		assert.equal(model.capabilities?.supportsXhigh, true);
+	});
+
+	it("modelOverrides can set capabilities.supportsXhigh on built-in models", () => {
+		// A user-facing override in models.json should be able to add supportsXhigh
+		// to a built-in model that doesn't declare it.
+		const path = writeModelsJson({
+			providers: {
+				anthropic: {
+					modelOverrides: {
+						"claude-3-5-haiku-20241022": {
+							capabilities: { supportsXhigh: true },
+						},
+					},
+				},
+			},
+		});
+
+		const registry = new ModelRegistry(AuthStorage.inMemory(), path);
+		const model = registry.getAll().find(
+			(m) => m.provider === "anthropic" && m.id === "claude-3-5-haiku-20241022",
+		);
+		assert.ok(model, "built-in model must still be present");
+		assert.equal(
+			model.capabilities?.supportsXhigh,
+			true,
+			"modelOverrides must be able to set capabilities.supportsXhigh",
+		);
+	});
+});

package/packages/pi-coding-agent/src/core/model-registry.ts

@@ -48,6 +48,14 @@ const VercelGatewayRoutingSchema = Type.Object({
 	order: Type.Optional(Type.Array(Type.String())),
 });
 
+// Schema for model capability declarations (mirrors ModelCapabilities in pi-ai types)
+const ModelCapabilitiesSchema = Type.Object({
+	supportsXhigh: Type.Optional(Type.Boolean()),
+	requiresToolCallId: Type.Optional(Type.Boolean()),
+	supportsServiceTier: Type.Optional(Type.Boolean()),
+	charsPerToken: Type.Optional(Type.Number()),
+});
+
 // Schema for OpenAI compatibility settings
 const OpenAICompletionsCompatSchema = Type.Object({
 	supportsStore: Type.Optional(Type.Boolean()),
@@ -91,6 +99,7 @@ const ModelDefinitionSchema = Type.Object({
 	maxTokens: Type.Optional(Type.Number()),
 	headers: Type.Optional(Type.Record(Type.String(), Type.String())),
 	compat: Type.Optional(OpenAICompatSchema),
+	capabilities: Type.Optional(ModelCapabilitiesSchema),
 });
 
 // Schema for per-model overrides (all fields optional, merged with built-in model)
@@ -110,6 +119,7 @@ const ModelOverrideSchema = Type.Object({
 	maxTokens: Type.Optional(Type.Number()),
 	headers: Type.Optional(Type.Record(Type.String(), Type.String())),
 	compat: Type.Optional(OpenAICompatSchema),
+	capabilities: Type.Optional(ModelCapabilitiesSchema),
 });
 
 type ModelOverride = Static<typeof ModelOverrideSchema>;
@@ -219,6 +229,11 @@ function applyModelOverride(model: Model<Api>, override: ModelOverride): Model<A
 	// Deep merge compat
 	result.compat = mergeCompat(model.compat, override.compat);
 
+	// Merge capabilities (override wins per-field)
+	if (override.capabilities) {
+		result.capabilities = { ...model.capabilities, ...override.capabilities };
+	}
+
 	return result;
 }
 
@@ -514,6 +529,7 @@ export class ModelRegistry {
 					maxTokens: modelDef.maxTokens ?? 16384,
 					headers,
 					compat: modelDef.compat,
+					capabilities: modelDef.capabilities,
 				} as Model<Api>);
 			}
 		}

package/packages/pi-coding-agent/src/core/session-manager.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { describe, it, afterEach } from "node:test";
-import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 
@@ -97,4 +97,33 @@ describe("SessionManager secret redaction on persistence", () => {
 			"redaction placeholder must appear in persisted JSONL",
 		);
 	});
+
+	it("scrubs secrets from JSONL rewritten by _rewriteFile() during migration", () => {
+		// Write a v1 session file (no id/parentId on entries) containing a secret.
+		// setSessionFile() will detect version < 3, run migration, and call _rewriteFile()
+		// which previously serialised entries without passing them through redaction.
+		dir = mkdtempSync(join(tmpdir(), "gsd-session-rewrite-redact-test-"));
+		const leakedKey = "sk-ant-api03-abcDEF1234567890abcDEF1234567890xYz";
+		const v1Header = JSON.stringify({ type: "session", version: 1, id: "test-session-id", timestamp: new Date().toISOString(), cwd: dir });
+		const v1UserMsg = JSON.stringify({ type: "message", message: { role: "user", content: [{ type: "text", text: `secret: ${leakedKey}` }] } });
+		const v1AssistantMsg = JSON.stringify({ type: "message", message: { role: "assistant", content: [{ type: "text", text: "ok" }], usage: { input: 1, output: 1, cacheRead: 0, cacheWrite: 0, total: 2, cost: { total: 0 } } } });
+		const sessionFile = join(dir, "test-session.jsonl");
+		writeFileSync(sessionFile, [v1Header, v1UserMsg, v1AssistantMsg].join("\n") + "\n", "utf8");
+
+		// Loading this file triggers migrateToCurrentVersion() which returns true (v1 → v3),
+		// causing _rewriteFile() to rewrite the file. The bug: _rewriteFile() called
+		// JSON.stringify(e) without redaction, so the secret would survive on disk.
+		const manager = SessionManager.create(dir, dir);
+		manager.setSessionFile(sessionFile);
+
+		const contents = readFileSync(sessionFile, "utf8");
+		assert.ok(
+			!contents.includes(leakedKey),
+			"raw secret must not appear in JSONL rewritten by _rewriteFile()",
+		);
+		assert.ok(
+			contents.includes("[REDACTED:anthropic]"),
+			"redaction placeholder must appear in JSONL rewritten by _rewriteFile()",
+		);
+	});
 });

package/packages/pi-coding-agent/src/core/session-manager.ts

@@ -959,7 +959,7 @@ export class SessionManager {
 
 	private _rewriteFile(): void {
 		if (!this.persist || !this.sessionFile) return;
-		const content = `${this.fileEntries.map((e) => JSON.stringify(e)).join("\n")}\n`;
+		const content = `${this.fileEntries.map((e) => JSON.stringify(prepareForPersistence(e, this.blobStore))).join("\n")}\n`;
 		let release: (() => void) | undefined;
 		try {
 			release = tryAcquireLockSync(this.sessionFile);

package/packages/pi-coding-agent/src/modes/interactive/interactive-mode.ts

@@ -3585,7 +3585,19 @@ export class InteractiveMode {
 					this.ui.requestRender();
 				},
 				async (provider: string) => {
-					// Enter key → auth setup for selected provider (#3579)
+					// Enter key → auth setup for selected provider (#3579).
+					// Only OAuth providers support the login dialog flow.
+					// externalCli providers (e.g. claude-code) authenticate through
+					// their own CLI — sending them to the OAuth dialog produces
+					// "Unknown OAuth provider: claude-code" (#4548).
+					const isOAuthProvider = this.session.modelRegistry.authStorage
+						.getOAuthProviders()
+						.some((p) => p.id === provider);
+					if (!isOAuthProvider) {
+						done();
+						this.showStatus(`${provider} uses external CLI auth — use /model to select a model or run the provider's own auth command.`);
+						return;
+					}
 					done();
 					await this.showLoginDialog(provider);
 				},