GitHub: v17.2.0

@oh-my-pi/pi-agent-core

Fixed

• Provider-native compaction failures now surface their transport error instead of silently switching to generic summarization; streaming V2 still falls back to native V1 when available.

@oh-my-pi/pi-ai

Added

• Added first-class parentTurnId support for nested Codex requests, allowing stream options and metadata helpers to accept and safely propagate the initiating turn's ID.


• Added preservation of the Codex encrypted_function_args plaintext-collaboration marker on replayed function calls, keeping server-marked plaintext tool arguments from being reinterpreted as encrypted on subsequent turns.


• Added interactive Exa API-key login through /login exa, opening the official API-key dashboard and saving pasted keys to the credential store ().


• Added interactive xAI API-key login with key validation through the xAI models endpoint.


• Fixed Google Gemini and Vertex tool declarations carrying numeric, boolean, object-valued, or mixed enum arrays that the Google Schema wire type cannot represent. Unsupported enums are omitted while valid string enums remain constrained.


• Umans usage provider: fetches GET /v1/usage and surfaces the rolling 5h request window + concurrency limits in /usage, omp usage, and the TUI status bar.


• Fixed ranged legacy Cursor reads reporting the returned window byte length as the full file size.


• Updated the Cursor client build advertisement to activate the modern exec-frame protocol handled by this provider.


• Fixed a windowed Cursor read reporting the window's line count as the file's. total_lines and file_size were derived from the payload, which is the whole file only for an unranged read — a 20-line page of a 100-line file answered total_lines: 20, which a paginating server reads as the end of the file. The count now comes from the read's own record of the file (details.meta.truncation.totalLines), falling back to counting the payload when the read returned the file whole.


• Fixed a pi_grep that hit the native backend's internal match ceiling answering as an unqualified success. GrepTool folds that cap into the flat details.truncated alone, setting neither details.truncation nor perFileLimitReached — the two fields the Pi result was built from — so the one truncation a caller can neither detect nor page around was the one it was never told about. The flat flag is now translated into a PiTruncation, and only when no specific cap already reported itself.


• Fixed a pi_grep frame's context and limit vanishing from the transcript. The bridge honors both by building a scoped grep, but neither is expressible in the model-facing schema, so the synthesized block recorded a plain pattern/path search — replaying a context-widened or capped search as an ordinary grep sitting beside output no ordinary grep produces. Both are now recorded on the block.


• Fixed a Cursor MCP resource listing shrinking to a count in the transcript. The full URI/name/mime catalog goes out on the wire, but the paired local result recorded Listed N MCP resource(s) — and rebuilt history is serialized from that result, so one reload later the model knew it had seen N resources and could name none of them. The paired result now lists what the answer carried.


• Fixed the pi_read range translation padding the slice it asks for. piReadPath composed a plain :N+K selector, which the local read tool expands by one leading and three trailing context line — so a frame naming offset 5/limit 20 received lines 4-27. Ranged Pi reads now compose :raw:N+K; the wire result is an opaque output string, so the line-number gutter raw also drops carries nothing the contract needs.


• Fixed four Cursor exec frames answering with a result whose oneof was never set. In proto3 that is not an empty result — the server reads it as "the tool ran and produced nothing", indistinguishable from real success. listMcpResourcesExecResult, readMcpResourceExecResult, recordScreenResult and computerUseResult now send ListMcpResourcesSuccess{resources: []}, ReadMcpResourceNotFound{uri}, RecordScreenFailure and ComputerUseError respectively.


• The MCP resource frames now answer from the host instead of a fixed verdict. CursorExecHandlers gained listMcpResources/readMcpResource, so a host holding live MCP connections advertises them; the empty catalog and not_found above remain the answer when no handler is supplied. A handler that throws surfaces as ListMcpResourcesError/ReadMcpResourceError rather than collapsing into "none exist", which the model cannot retry. A read carrying download_path forwards it and answers with ReadMcpResourceSuccess.download_path and no content, which is what that mode means.


• Fixed Cursor connect_scm calls losing their repository and settling on a fabricated verdict. The target rides in the ConnectScmArgs.target oneof, so reading a flat github property always saw undefined; and the authoritative success/error/rejected result only arrives on the completion frame, so answering at the announcement persisted a fixed failure for every call — including the ones the server went on to accept. The block now opens on the start frame and settles from the completion's decoded result.


• Fixed interleaved Cursor tool calls corrupting each other. The stream decoder tracked a single "current" block and settled it on any toolCallCompleted, ignoring the envelope's call_id: a completion for one call closed whichever block happened to be open and paired it with the wrong result, and start A, start B orphaned A entirely so its own completion settled B while A was never paired — which strips the whole interaction from every rebuilt transcript. Open blocks are now retained per envelope call_id, and end-of-stream closes all of them rather than only the last.


• Fixed a Cursor search_conversations call leaving no transcript block. The frame is answered from a fixed verdict, so nothing downstream pairs a result for it, and an unpaired call takes its whole interaction out of every rebuilt transcript.


• Fixed a Cursor read_mcp_resource call leaving no transcript block. The frame runs locally — and in download mode writes a workspace file — but synthesized no tool call and paired no result, so the read was invisible in the UI and absent from every rebuilt history; a resource download could mutate the workspace with nothing on record. The frame now synthesizes a read_mcp_resource block (not read: it is a remote MCP operation, and the name drives rendering and prune semantics) and pairs a result on success, not-found and error alike. Frames answered without a handler still synthesize nothing, since nothing ran.


• Fixed a Cursor list_mcp_resources call leaving no transcript block. The model consumed the catalog, but the frame synthesized no tool call and paired no result — its streamed ListMcpResourcesToolCall announcement was equally unrecognized — so the listing was invisible in the UI and absent from every rebuilt history. Frames a handler answered now synthesize a list_mcp_resources block and pair a result derived from the same answer that went on the wire; frames answered from the fixed no-handler catalog still synthesize nothing, since nothing ran.


• Fixed an unavailable pi_edit/pi_write answering with the error variant. Both results model refusal and failure as separate oneof cases, and a denial reported as error reads as "the tool ran and broke" — inviting a retry of an operation that was never permitted. A frame whose tool is not granted, or whose handler produced nothing, now answers with PiEditExecRejected/PiWriteExecRejected; execution failures keep the error variant.


• Fixed a Cursor MCP approval probe actually running the tool. A modern mcpArgs frame carrying smart_mode_approval_only asks only whether a call would be permitted, not for the call itself. The decoder dropped the flag, so the frame ran a side-effecting MCP tool the user had not been asked about, then ran it again when the real call followed. The flag is now carried through and the probe is answered from the host's policy without executing: approved only for a definite allow, refused for a deny, for a mode that demands a prompt the frame cannot raise, and for a tool the session does not have. No transcript block is synthesized either, since nothing ran.


• Fixed the Cursor stream's end-of-transport cleanup erasing the arguments of every block still open. Blocks whose args arrive whole (todo, connect-SCM, MCP) never feed the streamed partial-JSON buffer, and reparsing an absent buffer yields {}, so a truncated or disconnected turn rebuilt those calls with no arguments at all. Only blocks that actually streamed their args are reparsed now.


• Fixed a Cursor stream dying mid-turn stranding the call it left open. connect_scm and native todo blocks are stamped resolved the moment they open, so the agent loop synthesizes no placeholder and only their completion frame pairs a result — a transport that closed first left the card animating and the call unpaired, which takes the whole interaction out of every rebuilt transcript. The terminal-error path now closes open blocks and pairs those server-owned calls with an interrupted result; the flush ran only on clean completion before, which is not the path a dying stream takes. Exec-settled MCP blocks are left alone, since the dispatch that ran them owns their result.


• Fixed the Pi exec frames displaying a different operation than the one they run. The provider synthesized its transcript block from a second, hand-rolled translation of the frame args, so pi_read's offset/limit were shown as a whole-file read, pi_grep's literal pattern as an unescaped regex, and pi_find's path/glob join differed from the executed one. Both sides now share a single translation.


• Fixed the streamed pi_*_tool_call announcements that modern builds send alongside each exec frame being unrecognized. The exec channel already synthesizes those blocks when it runs the tool; the duplicate was avoided only because the decoder recognized none of the variants, which would have started double-rendering as soon as any one was added.


• Fixed pi_bash results reaching Cursor clipped with no truncation notice. Two truncation records exist locally: read/grep set details.truncation, which carries an explicit truncated flag, while bash sets details.meta.truncation, whose record has no such flag — its presence is the signal. piTruncation read only the first shape and required the flag, so every real Bash truncation was dropped and the server was told the clipped output was complete. Both shapes now translate, and an explicit truncated: false still suppresses the field.

@oh-my-pi/pi-catalog

Added

• Regenerated the Cursor agent protobufs (discovery/cursor-gen/agent_pb.ts) against the modern agent.proto, adding the message and enum families current Cursor CLI builds emit: Pi tool exec frames, hook queries and responses, subagents, allowlist prechecks, MCP state, smart-mode classification, canvas diagnostics, conversation search, agent-store conflicts and git diff. Purely additive — no existing exported symbol changed shape.

Fixed

• Fixed an issue where LM Studio first turns failed with a 400 Invalid tool_choice error when a named tool was forced, by using the supported tool_choice: "required" string selector.

@oh-my-pi/pi-coding-agent

Breaking Changes

• Removed the DEL, DEL.BLK, COPY, and COPY.BLK hashline edit operations. Use CUT / CUT.BLK for deletion; removed content remains available to PASTE.

Added

• Added server-name autocomplete for /mcp commands (enable, disable, test, remove, reconnect, reauth, unauth) using configured and runtime-discovered MCP servers.


• Added CUT and PASTE ops to the hashline edit tool for moving code without retyping it: CUT N.=M (and .BLK block forms) capture lines into a clipboard register, and PASTE operations insert them. The register flows across sections within a patch (cross-file moves) and persists across edit calls per session.


• Added --from-claude and --from-codex session imports (including compaction state for Codex), also available from /resume @claude and /resume @codex.


• Added interactive Exa API-key onboarding through /login exa, opening the official key dashboard and saving pasted keys for authenticated web search while preserving EXA_API_KEY and explicit-selection public MCP fallback behavior ( by ).

Fixed

• Fixed Anthropic prompt-cache cold misses on session resume with multiple OAuth accounts: the account that served a session is now recorded in the session file (as a credential_pin sha-256 of the account + org/project scope, so exports carry no plaintext identity) and re-pinned on resume with the session's effective last-use time, so a fresh process no longer re-ranks accounts by usage headroom — which systematically routed away from the just-used account and cold-missed the entire account-scoped cache prefix. Sticky routing was previously stored only in the auth store's KV cache, which is in-memory when a remote auth broker is configured.


• Fixed Anthropic prompt-cache cold misses on session resume with multiple OAuth accounts: the account that served a session is now recorded in the session file (as a PII-free credential_pin hash) and re-pinned on resume, so a fresh process no longer re-ranks accounts by usage headroom — which systematically routed away from the just-used account and cold-missed the entire account-scoped cache prefix. Sticky routing was previously stored only in the auth store's KV cache, which is in-memory when a remote auth broker is configured.


• Fixed concurrent createAgentSession calls with the default agent id failing initialization with Agent "Main" was replaced during session initialization — each in-process embedder (e.g. the edit benchmark runner) can now pass a private registry via the newly exported AgentRegistry, keeping every top-level session's "Main" out of the process-global roster race.


• Fixed task tool blocks duplicating their per-agent progress rows into terminal scrollback on every update: live task frames now pin the transcript live region so mid-run rows are never recorded as frozen snapshots, and a detached background task freezes its progress the moment any of its rows commit to scrollback instead of mutating committed history.


• Fixed Codex reset fireworks comparing different quota tiers or plans, preventing false celebrations when usage reports switch between Spark and base weekly limits.


• Fixed Cursor ranged-read results losing the full file byte size after applying the requested window.


• Fixed empty Codex final-stop recovery discarding an earlier commentary message when both messages shared response metadata.


• Fixed Advisor availability with providers that refuse echoed reasoning by retrying once with primary thinking stripped and surfacing persistent refusals immediately.


• Fixed /tan agents being unable to read parent-session local:// attachments by correctly resolving local protocol options against the parent session's artifacts.


• Fixed Codex web search silently returning plain completions when the hosted web search tool was skipped.


• Fixed TUI collaboration guest loader not starting when joining or reconnecting mid-turn.


• Fixed multi-second TUI freezes in reftable-format repositories by moving branch resolution off the render path and adding a timeout to synchronous git spawns.


• Fixed xd:// device summaries containing control characters and exceeding size budgets by stripping control characters and bounding summaries by UTF-8 bytes.


• Fixed task.softRequestBudget configuration having no effect on bundled scout and sonic subagents.


• Fixed quick LSP server exits being misreported as reader failures and resolved an issue where explicit reloads were blocked by initialization backoff.


• Forced Git subprocesses to use the stable C locale to ensure predictable, non-interactive command output.


• Fixed compatibility replay issues for pre-upgrade launch brokers evaluating xterm inside the client process.


• Fixed Advisor cost tracking in the status line across conversation boundaries, ensuring session transitions, forks, and resumes correctly restore or isolate conversation spend.


• Fixed validation failures for legacy extensions importing from the package root, which previously blocked installations.


• Fixed ACP clients (such as Zed), TUI status lines, and collaboration guests not updating when model changes occur dynamically within the agent loop.


• Fixed assistant-facing resource summaries omitting parameterized MCP resource templates, ensuring failed reads list templates alongside concrete resources.


• Fixed redundant xd:// mount notices and prompt-cache invalidation when resuming sessions or reconnecting devices.


• Fixed the model picker displaying placeholder model lists instead of the actual credential-aware catalog resolved at registration.


• Fixed file corruption and snapshot mismatches when writing files through the ACP client bridge by verifying the final on-disk content after client-side post-save formatting.


• Fixed omp ttsr test silently evaluating source files as prose when their extensions were missing from the allowlist, and expanded the allowlist to support .NET, Shell, SQL, Zig, Dart, Scala, Elixir, and Protobuf files.


• Fixed automatic light/dark theme switching in direct WezTerm sessions on macOS when DEC Mode 2031 is unsupported, and improved theme-change color responsiveness.


• Fixed configured retry.maxDelayMs not being forwarded into Anthropic retry handling, so over-budget server retry delays fail fast.


• Added tokens-per-second throughput to RPC get_state responses for non-TUI clients.


• Added the RPC set_fast_mode command and typed TypeScript/Python client methods for live fast-mode control.


• Added fastModeEnabled and fastModeActive to RPC get_state responses.


• Fixed RPC fast-mode state reporting after direct Anthropic rejects speed: "fast", while allowing explicit re-enable requests to retry priority service.


• Added opt-in subagent access to checkpoint, rewind, learn, and manage_skill when explicitly listed in an agent definition's tools: frontmatter. Listing one of checkpoint/rewind auto-includes the other. Settings (checkpoint.enabled, autolearn.enabled) remain master toggles.


• Added a browser.cdpUrl setting that points browser automation at an already-running CDP endpoint by default, so app.cdp_url no longer has to be repeated on every call. Explicit app options still take precedence.


• Native compaction preserves provider-native success and non-authentication failure semantics while retaining authenticated cross-provider fallback when the native provider rejects credentials.


• Fixed the Cursor Pi exec bridge silently dropping frame arguments. pi_read's offset/limit were ignored, so a ranged read returned the whole file; pi_grep's literal was ignored, so a fixed-string search ran as a regex and matched the wrong lines; and the path/glob join produced a ./-prefixed spec. Ranges are now composed onto read's :N+K inline selector, literal patterns are escaped, and the join uses node:path. These are optional int32 fields, so a present 0 is honored rather than folded into a default: pi_read with limit: 0 answers with empty output instead of the entire file, and pi_find with limit: 0 clamps to 1 the way the reference client does.


• pi_grep's context and limit are honored. Neither is expressible in the model-facing grep schema — context width comes from grep.contextBefore/grep.contextAfter fixed at tool construction — so the bridge builds a per-call grep for frames that supply them. GrepTool accepts these as constructor options; the model-facing schema is unchanged, and a frame that supplies neither keeps the shared instance and the session's defaults.


• pi_ls's limit is still not mapped, now deliberately: it caps directory entries, while the local read tool renders a depth-2 tree with per-directory caps and elision rows and applies a selector as a rendered line slice. Mapping it to :1+K would cap a different unit while appearing honored.


• The legacy pi shim's regex-literal escaper and path/glob join were verbatim copies of the modern bridge's. Both paths now call the shared helpers, so the two Pi translations cannot drift.


• Fixed every Cursor pi_edit frame failing instead of editing. Two independent causes: the session drops edit from the tool registry for Cursor so the model uses full-file write, but that registry is also the exec bridge's tool source, so the native frame — which the server sends regardless of the advertised catalog — found no tool; and the retained instance followed the session's configured edit mode, while PiEditExecArgs carries old_text/new_text pairs that only replace accepts (the default hashline takes a single input string). The bridge now resolves a replace-mode instance through its fallback resolver, still wrapped for approval.


• Fixed a pi_grep frame carrying context or limit escaping the approval gate. Honoring those fields needs a per-call grep, and the per-call instance was built raw while every registry tool is wrapped, so such calls bypassed tools.approval.grep and the exec-tier check for SSH-targeted paths. Both bridge callsites now build it through one shared factory that applies the same wrapper.


• Fixed Cursor advisors ignoring pi_grep's context and limit. Only the primary session supplied the per-call grep factory, so advisor frames silently fell back to session defaults. Advisors now receive the same factory, gated on the advisor actually having been granted grep.


• Fixed Cursor advisors failing every pi_edit. The advisor roster handed the bridge the edit instance built for the advisor's own loop, which follows the configured edit.mode (hashline by default) and rejects the frame's old_text/new_text pairs — the same mode mismatch the primary bridge already fixed, on the path it missed. The exec map now substitutes a replace-mode instance, gated on the advisor actually having been granted edit, while the advisor's own loop keeps the tool it was given.


• Fixed pi_bash killing commands that explicitly asked for no deadline. timeout is optional int32 and bash documents 0 as "disables the command deadline", but a truthiness check folded a supplied 0 into unset, applying the 300s default instead. A present 0 now passes through; negatives, which have no local meaning and would otherwise clamp to the 1s floor, still fall back to the default.


• Fixed the Cursor exec bridge granting edit and grep to sessions that withheld them. Both bridge-only tools are constructed rather than looked up, and executeTool prefers a constructed override over the registry, so a restricted tool set (toolNames without them, or restrictToolNames) still got a working pi_edit/pi_grep — native frames arrive regardless of the advertised catalog. Both are now gated on the session having actually granted the tool, matching the delete frame's existing check (issue in in in in in in in in in in in in in in in in in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in made their first contribution in