v2026.10.12

@code-yeongyu/senpi

Breaking Changes

Added

• The interactive editor paints OmO's reserved prompt keywords (ulw/ultrawork, mass ulw and its aliases, ulw plan, ulw loop, ulw research) with the same per-character rainbow as the OmO desktop composer, only where the OmO engine would arm them (not inside identifiers, paths, URLs, quotes, relayed headers or "do not load ..." sentences): truecolor gradient, 256-colour fallback, and no decoration under NO_COLOR. Cursor, selection and wide-glyph widths are unchanged. findReservedKeywordSpans and findReservedKeywordRuns are exported (#3160, requested by @code-yeongyu).

• Session-scoped eval_cells.list, eval_cells.peek, and eval_cells.stop RPC commands and typed client methods expose live/recent eval cells, bounded UTF-8 output tails, and confirmed stop outcomes without model tool calls or history entries. Detached stops preserve the existing completion notification; RPC clients can consume the already-forwarded wake_source_state event (#3072).

• Extensions can use ctx.getCompactionModel() to resolve a usable summary model without changing the active session selection. Healthy builtin compaction retains the current model; a spent account can use the held target, configured summary override, or an authenticated alternate with sufficient context capacity (#3131).

Changed

• ChatGPT subscription GPT-6.1 Sol, Fast and Ultrafast now default to a 500,000-token context budget, with compaction and context-usage accounting following that window (#3150, requested by @code-yeongyu).

• Web search uses the active model's in-turn server tool first on enabled routes. Existing direct Anthropic/Claude OAuth and OpenAI/Azure defaults are preserved; ChatGPT subscription search is enabled, and newly supported xAI Responses, Google Vertex and AI Studio, OpenRouter and compatible Anthropic gateways require explicit opt-in. Search-specific failures enable one standalone fallback and record its reason; cheaper auxiliary models remain defaults only on routes without an enabled server tool (#3122, requested by @code-yeongyu).

• Server search remains default-on for direct Anthropic/Claude OAuth and OpenAI/Azure, unchanged from main, and is default-on for the live-verified first-party ChatGPT/Codex subscription route (except Spark). Gateways including ccapi and GLM coding plan on z.ai's Anthropic endpoint require compat.supportsWebSearch: true; xAI Responses, Google Vertex and AI Studio, OpenRouter, Moonshot PAYG, Z.AI PAYG and Sonar native-bypass routing also require explicit compatibility opt-in. Kimi for Coding and DeepSeek are not live-verified and do not gain default-on search. A different nativeModel setting is ignored on enabled server-search routes: main search and fallback use the session model (#3122, requested by @code-yeongyu).

Fixed

• A finished bash session no longer keeps its headless terminal screen (10,000 lines of scrollback plus replay history, about 20 MB for a 4,000-line output) until the 32-session limit evicts it; it keeps its final visible screen and its bounded output, so long sessions and task hosts no longer grow with every shell command (#3171).

• A turn no longer fails when the session is replaced, reloaded, or disposed while its first turn_end or agent_before_settle boundary preview is being built: the retired extension runner now stands down on that step like every other boundary step, discarding drafts and continuation without reporting a stale-context error (#3101). Thanks to @MoerAI (#3145).

• Prompts and timeout retries after accepted compaction no longer stop with "Context remains above the compaction threshold because compaction did not complete" because of pre-compaction usage, including when an extension message follows the checkpoint. Failed compaction preserves previous usage, and the existing first-response stale-usage exemption remains in place (#3137).

• Internal control sockets keep their short-path fallback inside the configured temporary directory when it fits the Unix socket path limit (#3103).

• Prompt-cache prewarm is now opt-in through promptCache.keepAlive.enabled, which defaults to false: prewarm is off by default. When enabled, it starts only on the first composer edit, never on session start, resume, fork, reload, restored drafts, or extension UI text insertion. Submitting the first prompt uses that real request to warm the cache without an extra call. Restored Anthropic history also waits for first activity before scheduling keep-alive; completed turns, including extension-driven turns, retain their existing idle keep-alive behavior. Clipboard images dropped during compaction do not count as edits (#3140).

• Shared RPC hosts advertise stopping as soon as shutdown or draining begins and return a typed host_stopping refusal to racing session opens. On supervised hosts this replaces host_draining for opens during a drain; RPC clients matching the old code must handle host_stopping. Bare hosts retain host_draining. Launch-owning callers wait for the stopping generation to exit before starting a successor. senpi host status --json and each status --all row add lifecycle: "ready" | "stopping" | null; an unserved socket keeps the same field set with lifecycle: null (#3059).

• Resuming after accepted compaction uses the compacted summary and retained messages instead of pre-compaction provider usage, so a session that now fits is not refused or compacted again. Fresh provider usage supersedes the estimate on the next response (#3062).

• Zero-attempt terminal failures still explain provider-requested long waits and retry-delay caps; only an initial account-usage failure omits a redundant retry-end event. RPC entry events, entry history, and trees now carry the same structured account-limit advice as message history, and reset parsing uses injected clocks (#3131).

• Account-wide usage limits skip all fallback models on the spent provider and fail immediately when no other provider can serve. Manual and held-switch compaction use a usable model, and limit errors name the provider, reset hint, and /model or fallback configuration instead of raw 429 JSON (#3131).

• Locally refused prompts no longer extend a spent account's suppression window. Provider reset hints and retry-after delays bound that window, and an explicit /model selection clears it for a deliberate probe (#3131).

• Account-limit advice and its structured scope remain consistent between live messages, restored transcripts, and RPC get_messages; the TUI no longer reports zero failed retry attempts when a turn failed without retrying (#3131).

• Cross-route Moonshot sanitization preserves intentional empty tool arrays on main requests with tool history when no declaration was removed, retaining compatibility with LiteLLM-style proxies (#3122).

• Server-search failures are remembered for the actual failed request model across prompts and model switches. Cache-friendly compaction retains the original payload hook and exact main-turn tools/include prefix. Standalone summaries, titles and default projections exclude only server-search tools, preserve client web_search, and do not add empty tool arrays. Fallback preserves provider-built function schemas and Google's single function-declaration entry. Moonshot's opt-in echo tool cannot be discovered or lazily activated through tool_search, and its declaration is stripped from non-Moonshot requests (#3122).

Removed

@code-yeongyu/senpi-ai

Breaking Changes

Added

• Assistant messages can carry a redaction-safe errorCause for usage limits, preserving account or model scope when the session replaces provider text with recovery advice (#3131).

Changed

• The bundled model catalog is refreshed from models.dev and the providers' model listings (openrouter, vercel-ai-gateway).

• ChatGPT subscription GPT-6.1 Sol, Fast and Ultrafast now default to a 500,000-token context budget, with compaction and context-usage accounting following that window (#3150, requested by @code-yeongyu).

• xAI catalogs select the documented Responses web_search shape without enabling search by default; routes require explicit compat.supportsWebSearchPreview: true. Google Vertex and AI Studio models now support typed compat.supportsWebSearch opt-in (#3122).

Fixed

• An Anthropic session no longer wedges once a replayed native web search result expires. A request rejected with 400 Invalid \encrypted_content` in `search_result` block` is retried with the expired search turned into text (query, result titles and URLs), newer search results keep replaying unchanged, and the session remembers the demotion (#3201).

• The shared provider-failure formatter explains account-wide usage limits with the provider, reset hint, and model-switch recovery instead of raw 429 JSON (#3131).

• Responses search declarations honor endpoint compatibility, and completed/failed web_search_call items replay only on the same provider/API/model. Opted-in GLM coding-plan Anthropic requests now preserve paired native tool_result blocks during replay as well as displaying them in the response; a zero server-search usage counter does not hide those blocks (#3122).

• Fixed Gemini 3+ (Vertex and AI Studio) rejecting replayed tool-call history with 400 "Function call is missing a thought_signature in functionCall parts". When an assistant step in the current turn lacks a usable thought signature on its first tool call, calls and paired results replay as text with inline image support; earlier turns and steps with a valid first signature retain structured replay. The current turn ends at the last user message carrying content, an image-only user turn included (#3055). Thanks to @Bearmancer.

Removed

@code-yeongyu/senpi-agent-core

Breaking Changes

Added

Changed

Fixed

Removed

@code-yeongyu/senpi-codemode

Breaking Changes

Added

• Session-owned eval cell RPC handlers share the eval tool's manager, bound output tails, return typed unknown-cell failures and confirmed stop snapshots, and preserve ordinary detached completion notifications (#3072).

Changed

• The eval tool's stop action also cancels listed running foreground cells, returning their terminal outcome. Concurrent stops await the same interrupt and confirm whether kernel state survived (#3072).

Fixed

• Pip installs preserve successful results, typed install errors and cancellation when scratch cleanup fails. Cleanup retries before reporting exhausted retries as a warning (#3103).

Removed

@code-yeongyu/senpi-tui

Breaking Changes

Added

• EditorTheme.keywordHighlight (EditorKeywordHighlight) decorates keyword runs per character with the offset inside the run, so a gradient stays continuous across wrapped rows; a mention or the cursor grapheme takes precedence, and row widths never change (#3160, requested by @code-yeongyu).

Changed

Fixed

• PI_TUI_DEBUG render dumps honor the configured OS temporary directory instead of writing to a hard-coded /tmp/tui path (#3103).

Removed

@code-yeongyu/senpi-pty

Fixed

• A terminal screen's replay history (up to 1,000,000 chars per terminal) is kept as flat strings: sanitizeString no longer builds its result one character at a time, which cost about 31 bytes per char, and an oversized chunk trimmed to the cap no longer keeps the whole chunk alive (#3170).