v17.1.7

@oh-my-pi/pi-agent-core

Changed

• beforeToolCall now runs during arg-prep in a pre-dispatch prepare phase — on the streamed path before the assistant message's message_start/message_end are emitted, and always ahead of concurrency resolution, tool_execution_start, telemetry span start, and tool.execute — instead of inside the already-scheduled execution slot. It receives the resolved tool in its context and may return args to replace the call's arguments; a replacement is revalidated against the tool schema, written back to the assistant message's tool-call block, and re-resolves argument-dependent interruptibility, making it the single source of truth for history, persistence, provider replay, scheduling, execution events, and tool.execute. Argument validation moved into the same prepare phase, so functional concurrency resolvers now see validated (and possibly revised) arguments rather than raw pre-validation ones. The hook now receives the run's request abort signal rather than the per-tool signal.

@oh-my-pi/pi-ai

Changed

• Upstream 403 Forbidden responses (e.g. Anthropic permission_error plan/model denials, Copilot model-policy rejections) now rotate through sibling credentials like usage limits do, instead of failing the session on the first denied account. The denied credential is soft-blocked for 60s and re-validated — never removed — and the original 403 surfaces only once every sibling has been tried.
• Usage report filtering in the auth-broker remote store is memoized per (reports, snapshot) with a precomputed per-provider OAuth credential map, replacing an O(reports × credentials) scan on every credential-selection and status refresh
• Cursor and Devin Connect-frame readers no longer copy every stream chunk through Buffer.concat when the pending buffer is empty

@oh-my-pi/pi-catalog

Added

• Added support for moonshotai/Kimi-K3 and kimi-k3-fast models
• Added umans-kimi-k3 prerelease model configuration

Changed

• Updated pricing and token limits for selected models

@oh-my-pi/pi-coding-agent

Added

• Added the bundled ts-no-local-is-record TTSR rule, which catches local isRecord function and lambda definitions and directs agents to shared guards plus explicit shape validation.
• A tool_call handler (extension or hook) can now return input to revise the arguments a tool executes with, not just block it. The returned object is the raw execution input passed to the tool (ignored when block is set, and not applied to computer tool calls), enabling wrappers that normalize or rewrite a built-in's arguments without reimplementing the tool. For model-issued calls the event fires at arg-prep time in the agent loop, so a revision is revalidated against the tool schema and is what concurrency scheduling, tool_execution_start/transcripts, the persisted assistant message, and the approval gate all observe — the user approves exactly what runs, and a revision that changes a tool's functional concurrency (e.g. bash pty) schedules correctly. A revised nested write xd:// device dispatch forfeits the outer write gate's approval and faces the full prompt again (#6681 by @psyrendust).
• Added a parser for macOS sample(1) call-tree reports to the read tool: *.sample.txt reads now return a compact bottleneck summary — per-thread hot paths with on-CPU sample counts (blocked syscall time excluded), demangled Rust v0/legacy symbols, flattened direct recursion, merged call-site siblings, idle-thread classification, and a process-wide top-functions-by-self-samples table. :raw still reads the original report, and files that merely carry the extension fall back to plain text.
• Added V8 .cpuprofile support to the read tool (Node/Bun --cpu-prof, Chrome DevTools, CDP Profiler.stop output): reads now return a compact bottleneck summary — hot-path call tree with on-CPU milliseconds ((idle) time excluded), collapsed pass-through chains, flattened direct recursion, shortened file URLs, and a top-functions-by-self-time table. :raw still reads the original JSON, and files that merely carry the extension fall back to plain text.

Changed

• Direct and xd:// dispatch now share one canonical tool map: write xd://<tool> executes any enabled top-level or mounted tool, and read xd://<tool> returns its docs, instead of failing when the name was exposed through the other layer. Mounted names are presentation metadata only, so tool replacement and disconnection cannot leave stale device instances; disabled tools remain unreachable, and both xd:// and Cursor/top-level fallback execution retain the tool's approval and ACP permission gates.
• Session listing now caches parsed headers keyed on file stat identity (mtime + size), so repeated resume-picker opens and startup scans re-read only changed session files
• Reduced per-keystroke editor dispatch overhead: keybinding resolution happens once per input chunk and the per-action interception chain is gated behind a single canonical-key set probe
• xd:// device docs now render the parameter schema as a comment-annotated TypeScript type (via jsonSchemaToTypeScript, the same renderer the in-band tool inventory uses) instead of a raw JSON Schema dump, shrinking system-prompt device sections while keeping descriptions inline.
• Added a /vision [on|off|auto|status] slash command for session-scoped control of the inspect_image vision-delegation tool, modeled on /computer: on/off force the tool for the current session only, auto returns to the persisted setting, and status reports the effective mode, session override, tool state, and active-model image capability.
• Replaced the inspect_image.enabled boolean with the tri-state inspect_image.mode (auto|on|off, default auto). In auto the tool is registered only when the active model lacks native image input, so vision-capable models (e.g. kimi-code/k3) read images inline with their own capabilities instead of delegating to a separate vision model; the tool set is re-evaluated on every model switch with a status notice when it flips. The read tool now follows the effective state dynamically rather than the raw setting, so it returns decoded image blocks again whenever inspect_image is hidden. Existing inspect_image.enabled: true/false configs migrate to inspect_image.mode: on/off.

Fixed

• Restoring a prompt with image attachments via esc-esc branch or /tree now re-attaches the images to the composer draft: previously only the text (with its [Image #N] markers) was restored, so resubmitting sent the literal marker with no image.
• Fixed large bash/eval/ssh output citing two different artifact ids in one result — the truncation notice said Read artifact://N for full output while the footer said Artifact: N+1. The streaming sink's head and tail windows each had a full budget, so a middle-elided inline body could reach headBytes + spillThreshold and always re-tripped the final-defense inline byte cap, which truncated a second time (two elision markers), saved a duplicate already-truncated artifact, and left the notice's line ranges stale. The head and tail windows now share the spill-threshold budget (head clamped to half), the cap budget derives from the configured threshold plus notice slack, and when the cap does fire on a sink-spilled result it references the existing raw artifact instead of saving a copy.

@oh-my-pi/pi-tui

Added

• Added bulk-input fast path and iterative processing for bracketed paste in the editor
• Added windowed incremental lexing for large markdown documents

Changed

• Eliminated the dominant markdown streaming CPU cost (73% of a profiled interactive session): marked's GFM url tokenizer and lheading rule are now gated by O(1)/O(n) charCode pre-checks, the pathological hr/lheading/table/html block rules use sticky clones that fail at offset 0 instead of rescanning the source, and the inline math/autolink start() scans dropped their regex alternations
• Streaming markdown now freezes the stable prefix through provably closed lists instead of re-lexing everything after the last non-list block on every delta
• Raised the markdown render cache entry budget (32 KiB → 256 KiB) so large messages — exactly the expensive renders — are cacheable
• Deduplicated terminal cursor-visibility writes to skip redundant escape sequences

What's Changed

• feat(extensions): let tool_call handlers revise tool input by @psyrendust in #6681
• feat(coding-agent): capability-aware inspect_image with tri-state mode and /vision toggle by @epsilver in #6830

New Contributors

• @psyrendust made their first contribution in #6681
• @epsilver made their first contribution in #6830

Full Changelog: v17.1.6...v17.1.7