Review-pass findings:
1. python.md (P3) — "Put workflow explanations in assistant message or
cell title" lost its **MUST** weight during compression. Agents were
observed embedding explanations as in-cell comments, polluting the
kernel and wasting tokens. Restored as "You **MUST** put workflow
explanations in the assistant message or cell title — never inside
cell code."
2. ast-grep.md + ast-edit.md (P3) — The variadic-capture warning that
$$$NAME (three dollars) is correct and $$NAME (two dollars) is
invalid was dropped during compression. LLMs trained on shell/regex
conventions where $$ is common are prone to this mistake; ast-grep
emits a generic parse error rather than a "bad metavariable"
diagnostic, so the negative example has direct reproduction value.
Added "Use $$$NAME, **NOT** $$NAME" to both files.
All 6/6 template tests pass; bun check clean.
Further compresses packages/coding-agent/src/prompts/system/system-prompt.md
from 21,530 B to 16,545 B (−23% on top of the prior compression;
−9,060 B / ~−2,265 tok per turn vs origin/main) while restoring
RFC 2119 weight on every inviolable rule and reorganizing the
pre-yield discipline.
system-prompt.md
RFC 2119 keyword restoration
All rules under `# Contract`, Procedure §§2/6, and the tail `<critical>`
block use `**MUST**` / `**MUST NOT**` keywords that the file's preamble
pins to RFC 2119. The previous draft had downgraded 29 of these to
`Do **NOT**`, which reads as below-MUST-NOT against the same preamble.
Restored sites:
- `# Contract` — all 7 inviolable bullets
- `<critical>` tail block — all 4 safety rules
- `## 6. Verification` — mock ban and no-proof yield rule
- Procedure §2 — "search for existing examples" rule regains the
PROHIBITED parallel-convention clause it lost
- `<dir-context>` — AGENTS.md read requirement regains MUST
Structural dedup
- `<source-of-truth>` and `<instruction-priority>` were two priority
lists with overlapping scope. Merged into a single
`<instruction-priority>` covering all 5 conflict-resolution levels.
- `<self-check>` and `<scope-check>` were two pre-yield checklists;
`## 6. Verification` also had a third numbered "Before yielding,
verify..." list with overlapping checks. Collapsed all three into
one `<pre-yield-check>` section (incl. "output format matches the
ask" from the old verification list). `## 6. Verification` now
focuses on verification discipline (test rigor, mocks, run-scope).
Signal restoration
Added four anchors to `<design-checklist>` that were dropped from the
earlier `<code-integrity>` block and had no home in the new structure:
- Adversarial-caller / tired-maintainer self-questioning
- Cost-of-easy-path framing
- Inhabit-the-call-site self-review
- Persistence on hard problems (do not punt half-solved work)
Handlebars fix
The `### Tool priority` header was emitted unconditionally but its
body was wrapped in `{{#ifAny python|bash}}`, producing a bare heading
with no content when neither tool was available. Header now sits
inside the conditional.
SECTION_SEPARATOR helper relocation
The `SECTION_SEPARATOR` Handlebars helper is a generic section-header
formatter that was registered in coding-agent's
`config/prompt-templates.ts`. This coupled every template consumer to
a side-effect import of that module; a prior fix added
`import "./config/prompt-templates"` to `system-prompt.ts` so the
`/system-prompt` sub-path export would register the helper, but
sibling consumers (`task/executor.ts`, `task/template.ts`) worked only
by accident because the parent agent happened to load
`system-prompt.ts` first.
- Moved `sectionSeparator` function and helper registration to
`packages/utils/src/prompt.ts` next to the other generic helpers
(`xml`, `codeblock`, `ifAny`, `includes`, `not`, `jsonStringify`).
- `packages/coding-agent/src/config/prompt-templates.ts` now
re-exports `sectionSeparator` from `@oh-my-pi/pi-utils/prompt` for
the test that imports it via the coding-agent path.
- Removed the side-effect import from
`packages/coding-agent/src/system-prompt.ts`.
Template typo fix
Also fixes a latent `SECTION_SEPERATOR` spelling (→ `SECTION_SEPARATOR`)
in the two subagent templates (`subagent-system-prompt.md`,
`subagent-user-prompt.md`). Before the move the typo was masked
because every call site and the helper shared the wrong spelling.
Post-move, the helper is canonical `SECTION_SEPARATOR` in pi-utils
and all templates match.
Verification
- `bun check` clean (TS + Rust, all 9 packages)
- `bun test packages/coding-agent/test/system-prompt-templates.test.ts`
6/6 pass (was 4/6 failing pre-existing before the infrastructure fix)
- `bun test packages/coding-agent/test/tools/task-template.test.ts`
4/4 pass (exercises the `sectionSeparator` re-export)
- `bun run format-prompts` clean
- Added a Copilot-specific generated limits map for contextWindow and maxTokens and applied it during generated model normalization.
- Clamped OpenAI-compatible Copilot context windows to the minimum of advertised and catalog limits.
- Updated generated-model fixtures and tests to confirm normalized limits for Opus 4.6, GPT-5.4 mini, and Grok Code Fast 1.
- Standardized missing-file read errors and now return `File not found: <path>` for absent edit targets.
- Centralized AI provider, usage, and OAuth helpers into shared modules to remove duplicated logic.
- Migrated OAuth/API-key login flows to shared factory helpers and removed inline prompt/token-exchange code.
- Reused shared tools and formatter utilities for discovery, stream tails, LSP batching, and source formatting.
- Consolidated repeated test helpers and fixtures into shared modules, replacing inline helper duplicates.
- Updated path resolution to derive a file path from the first edit entry via filePathFromEditEntry when top-level fields are absent.
- Updated single-file result rendering to fall back to first-edit entry values for op and rename metadata before detail-level metadata.
- Added a new read.toolResultPreview boolean setting defaulting to false to control inline read result rendering.
- Updated read tool group rendering to show inline previews only when enabled and to hide duplicate summary rows for previewed entries.
- Passed the setting through event and UI helper constructors and added tests for default-off behavior and the duplicate-preview summary case.
The previous check only validated 'local:' prefix, which caused
'local:PLAN.md' to incorrectly resolve to 'LAN.md' (the colon was
interpreted as a Windows drive letter).
Now requires 'local:/' or 'local://' prefix to ensure proper URI parsing.
- Refactor path normalization to combine expandPath and normalizeLocalScheme
- Add validation in utils.ts to reject local:// paths as filesystem paths
- Fix bash-skill-urls regex to handle hyphen-prefixed local:/ patterns
- Add tests for hyphen-prefixed and @local: patterns
- Add negative lookbehind to regex in bash-skill-urls to prevent matching local:/
inside paths like /repo/local:/PLAN.md
- Normalize local scheme before expanding paths in path-utils
- Add test cases for both changes
Expands the regex pattern to match local:/ (single-slash) URLs in addition to local:// (triple-slash), preventing potential Linux path leaks.
- Add regex patterns for single-quoted, double-quoted, and unquoted local:/ URLs
- Add test coverage for all three quote styles
Extract duplicate normalizeLocalScheme regex pattern into a shared function in path-utils.ts. Updated interactive-mode.ts, approved-plan.ts, agent-session.ts, bash-skill-urls.ts, and plan-mode-guard.ts to use the shared utility. Also fixed error message formatting (removed extra backslashes).
On Linux, Node's path.normalize() collapses the double slash in
local://PLAN.md to local:/PLAN.md, creating a directory called local:
in the project root instead of routing through the local:// protocol handler.
Defense-in-depth fixes across 5 layers:
1. resolveToCwd() now throws if a path starts with any internal URL
scheme prefix (local:, agent:, skill:, etc.), preventing all 59
call sites from treating URIs as relative filesystem paths.
2. resolvePlanPath() now matches on local: prefix (not just local://)
and normalizes local:/ to local:// before resolution, catching
all slash variants.
3. Bash URL expansion regex and early-exit checks now also match
local:/ (single slash), and normalize before resolution.
4. Edit preview/diff functions now gracefully skip internal URL paths
instead of crashing via the resolveToCwd guard.
5. All startsWith('local://') checks updated to startsWith('local:')
with normalization in agent-session, interactive-mode, and
approved-plan modules.
Also adds local: to .gitignore to prevent accidental commits of the
leaked directory.
Removed unconditional topic:news coupling in buildRequestBody that scoped
Tavily index to news publications whenever recency was set. Technical queries
with --recency now search the general index filtered by time only.
Tightened SearchParams.recency contract in base.ts: providers MUST interpret
recency as a pure time filter and MUST NOT change topic scope as a side effect.
`streamAnthropic` runs for every `anthropic-messages` provider, not just
GitHub Copilot. The previous carve-out in `isProviderRetryableError`
checked only `status === 400 && code === "model_not_supported"`, which
means a genuinely-unsupported model on a non-Copilot Anthropic-compatible
backend would have been retried 3x with 2s/4s/8s backoff before failing.
Add `provider?: string` parameter and gate the carve-out on
`provider === "github-copilot"`. Callsite in `streamAnthropic` now
passes `model.provider`. Existing in-request retry wrappers in
`openai-responses.ts` / `openai-completions.ts` were already provider-
gated via `callWithCopilotModelRetry`, so no change there.
Add a regression test asserting the predicate returns true only when
`"github-copilot"` is passed.
Addresses Codex review feedback on #722.
GitHub Copilot intermittently returns `HTTP 400 model_not_supported`
for preview models (gpt-5.3-codex, gpt-5.4, gpt-5.4-mini, ...) on OAuth
clients other than VS Code, even when `/models` reports the model as
enabled. Root cause is a per-OAuth-client rollout gap across Copilot's
responses backend; repeating the identical request typically lands on
a backend that has the model. See opencode#13313.
- Add `isCopilotTransientModelError` and `callWithCopilotModelRetry`
in `utils/retry` (3 attempts, linear backoff, abort-aware, no-op
for non-Copilot providers).
- Wrap `client.responses.create` in `openai-responses` and the
initial completions stream in `openai-completions` with the retry.
- Extend Anthropic `isProviderRetryableError` to treat Copilot
transient model errors as provider-retryable.
- Rename `rewriteCopilotAuthError` to `rewriteCopilotError` and add
a 400 `model_not_supported` rewrite surfacing actionable guidance
(retry, switch to a GA model, or run from VS Code) after retries
exhaust.
- Rename test file accordingly and add a dedicated retry unit test.
Previously ReadToolGroupComponent completely ignored the expanded
state and discarded result content, making read tool output invisible
in the TUI (only showed a one-line path summary with no file content).
Changes:
- Store expanded state in #expanded field (was discarded with _ prefix)
- Store result content text in ReadEntry.contentText (was thrown away)
- Show a small code preview (3 lines) by default in collapsed mode
- Show full file content when expanded via Ctrl+O
- Uses renderCodeCell with PREVIEW_LIMITS.OUTPUT_COLLAPSED for
consistent truncation with "... N more lines (Ctrl+O for more)" hint
This brings read tool output in line with bash and grep tools which
already show previews when collapsed.
Commit afa4eb71f ("removed turbo-based workspace pipeline") dropped the
affected-script entries from package.json but left .github/workflows/ci.yml
still invoking them on the pull_request branch of the check/test jobs. Every
PR since that commit has failed both jobs with "Script not found".
The push-to-main branch (ci:check:full / ci:test:full) already works. Drop
the dead pull_request-conditional steps and remove the corresponding
'if: github.event_name != pull_request' guard on the :full steps so they
run in both contexts.
fixes#730
When persist writes race with test-level tempDir cleanup (e.g. in agent-session-auto-compaction-queue.test.ts), fs.rename can fail with ENOENT during the atomic swap inside #writeEntriesAtomically. The error is already routed through #persistChain so #persistError surfaces it to future persist calls, but the awaited rejection returned by #queuePersistTask was bubbling out of the fire-and-forget callers (#rewriteFile path and the incremental writer path) and Bun's test runner reported it as an 'Unhandled error between tests' even though the test itself passed. Attach a silent .catch on both void paths so the rejection is considered handled at the callsite while the persistChain retains the error state.
Three fixes to make CI green after the opus 4.7 and auto-bump landed:
1. github-copilot model mapper: prefer capabilities.limits.max_prompt_tokens
over the root-level context_length field (which mirrors max_context_window_tokens, i.e.
total window). Copilot's real /models response returns both for the gpt-5.x family, and
context_length inflates contextWindow with the output budget. Also restore the bundled
Copilot limits (claude-opus-4.6, gpt-5.2, gpt-5.4, gpt-5.4-mini, grok-code-fast-1) to
the values the fixed mapper produces so tests that depend on truthful offline fallbacks
pass. Update the two Copilot discovery tests whose payloads conflated context_length
with prompt capacity.
2. coding-agent task schema: make the per-task assignment description context-mode-aware.
The previous description unconditionally told agents that 'shared background belongs
in context', which is wrong for independent mode where shared context is disabled.
3. coding-agent model-registry test: update the anthropic-latest canonical collapse case
to claude-opus-4-7 since opus 4.7 is now the newest official opus in models.json.
- Mapped Anthropic XHigh effort to the new "xhigh" level for opus 4.7+ Messages API models while falling back to "max" for older or Bedrock models.
- Updated Anthropic effort typing and request building to accept "xhigh" even though the SDK output_config typing has not yet been widened.
- Added tests asserting xhigh maps to opus 4.7 messages models only, with Opus 4.6 and Bedrock Converse still using "max" for XHigh.
- Added a model-capability check to detect Claude Opus versions that support adaptive `thinking.display`.
- Updated adaptive mode parameter construction to set `thinking.display` to summarized on supported models.
- Kept adaptive calls compatible with older models by omitting `display` when unsupported.
- Updated todo start handling to set the requested task to in_progress while demoting all other in_progress tasks to pending.
- Added task note rendering in summary output by prefixing each note line with "Note:".
- Set GIT_OPTIONAL_LOCKS to 0 in git execution options and added tests for out-of-order start jumps and note summaries.
- Replaced todo_write's `ops` payload with top-level mutation fields (`phases`, `complete`, `start`, `add_notes`, etc.).
- Removed in-place task content and note updates; moved note writes to append-only `add_notes` calls.
- Matched `add_tasks.phase` by phase ID or name and appended new note text to existing notes.
- Changed execution to drop strict in-progress update sequencing, support `start`, and auto-promote next pending task.
- Updated tests and prompt docs to use direct payloads (`phases`, `complete`, `add_tasks`) instead of `ops`.
- Reworked `idle-iterator` to replace the first-event watchdog wrapper with a shared timeout handle passed through stream iteration.
- Updated Anthropic and OpenAI/Azure response-completion streams to pass the watchdog into `iterateWithIdleTimeout` and rely on unified first-event timeout logic.
- Raised the default first-stream-event timeout from 60 seconds to 100 seconds.
- Added task.simple to settings and schema with default, schema-free, and independent modes.
- Added mode-aware task schema and validation to enforce context/schema rules per simple mode.
- Updated prompts and template rendering to tailor headers and guidance for each simple mode.
- Added simple-mode capabilities and updated TaskTool execution for mode-aware context behavior.
- Added tests for independent rendering and mode-specific rejection of invalid context or schema inputs.
- Replaced Snowflake session IDs with UUIDv7 for created, forked, branched, and resumed sessions.
- Derived cache session IDs from OpenAI request options and passed them into Responses client creation.
- Used derived session IDs for OpenAI `session_id`/`x-client-request-id` headers and `prompt_cache_key`; omitted headers when retention was none.
- Added tests for UUIDv7 session creation/branching and OpenAI cache-affinity default, override, and disabled-header modes.
- Documented UUIDv7 session handling and OpenAI cache-routing fixes in package Unreleased changelogs.
- Updated root package.json @oh-my-pi entries from workspace:* to pinned 14.1.1 versioned dependencies.
- Modified the release script to automatically rewrite @oh-my-pi/* catalog versions in package.json using the release version.
- Kept the update operation before Rust workspace version bump in the release workflow.
The tests were using the old { sel, op, content } format which is no longer
recognized after the edit tool consolidation. Updated to use the new
{ path: 'file:selector', write/insert } format.
The #emitSessionEvent refactoring changed the order: #emit was called before
#emitExtensionEvent, but for non-message_update events this introduced
microtask timing issues that broke auto-compaction and handoff tests.
Fix: keep the original order (extension first, then emit) for non-message_update
events. Only message_update events use fire-and-forget extension queueing with
emit-first ordering.
The #emitSessionEvent refactoring introduced a microtask gap between session
event emission and the compaction check in #handleAgentEvent. This allowed
#waitForPostPromptRecovery to run before #postPromptTasksPromise was created,
causing deferred handoff tasks to be missed.
Fix: track the handler's agent_end work as a post-prompt task synchronously
before the await, ensuring #waitForPostPromptRecovery always blocks until the
compaction check completes.
