t4code-17.0.4-appserver-4

@oh-my-pi/pi-ai

Fixed

• Fixed Kimi Code usage reports dropping the 5h window reset time (omp usage showed no "resets in …" for the 5h limit): the API returns resetTime on the limit detail, not on window, so the parsed row-level reset is now carried onto the window when the window itself has none.
• Made Kimi device-id persistence best-effort: a missing or unwritable ~/.omp/agent directory no longer throws during Kimi header construction, which silently nulled every kimi-code usage probe on fresh installs.
• Coerced boolean tool-schema subschemas to MFJS object forms for native Moonshot/Kimi endpoints, preventing the task tool's outputSchema field from causing HTTP 400 responses (#5952).

@oh-my-pi/app-wire

Added

• Add a frozen Agent View lifecycle corpus covering started, running, completed, parked, resumed, and cancelled worker states for cross-client compatibility verification.

@oh-my-pi/pi-catalog

Changed

• Kimi-family models now use MFJS tool schema on all hosts, including proxies like OpenRouter that forward schemas to Moonshot

@oh-my-pi/pi-coding-agent

Added

• Added an owner-socket appserver drain-if-idle maintenance fence that atomically refuses new client work only after the exact appserver identity is confirmed idle.
• Added desktop appserver controls for session model, thinking level, and fast mode, with live settings, model-role, and task-agent catalog metadata.
• Added desktop session archive, restore, and delete backed by private profile metadata and crash-recoverable same-filesystem tombstones.
• Added the /continue-in-t4 slash command, which persists the current TUI session and exits through the normal clean teardown so the session can be continued in T4; nothing is taken over while the TUI is still running.
• Added lock-aware appserver observation of sessions owned by another OMP process, such as an external TUI. The session is followed read-only from complete transcript records on disk; the appserver takes writable control only when the owner's lock is freshly missing — live, suspect, stale, or malformed locks are never seized — and the session stays read-only in a reconciling state until the promoted child reports it loaded the exact transcript the observer last saw.

Changed

• Bounded incremental subagent transcript RPC reads to complete 384 KiB JSONL chunks, with byte cursors and an option to omit the redundant message view.
• Appserver now admits one unresolved session.prompt per session and returns session_busy before a second prompt reaches the RPC child; active clients can use session.steer or session.followUp to add work to the running agent.
• Bounded completed appserver command outcomes to a five-minute replay window and a 1,024-entry least-recently-used cache. Replays do not extend expiry, and pending commands are never evicted.
• Reused content-addressed native addons from prior successful branch builds and split Rust checks from native packaging, shortening appserver-only release runs without weakening the release gates.
• Appserver remote listener mode, bind address, port, and browser origins now persist in host-local agent/local/config.yml instead of synchronized profile config.
• Session-scoped Bash and Python execution now read output limits from the active session settings instead of process-global defaults.

Fixed

• Fixed appserver Agent View cancellation aborting the parent RPC process instead of the selected live subagent. Cancellation now targets only validated worker subagents, survives the requesting client disconnecting after dispatch, publishes a non-resumable terminal cancelled lifecycle state before hard release, and cannot revive or park an agent after that release begins.
• Fixed macOS appserver startup rejecting Node's /var/folders temporary paths because /var is a system symlink, while retaining rejection of nested user-controlled symlinks.
• Fixed appserver durable tool results dropping structured content, renderer details, and error state. Bounded, redacted canonical fields now survive transcript projection without embedding image bytes, while legacy text output remains available.
• Fixed image-bearing appserver sessions losing their RPC child when inline image payloads made a lifecycle or durable-entry notification exceed the one MiB line ceiling. Managed children now omit only redundant image bytes from their internal stdout notifications and mark the frame, while the full images remain unchanged in OMP's session and model context; even tiny canonical image payloads are externalized for transcript reads.
• Fixed large appserver turns losing their terminal event when the redundant aggregate agent_end exceeded the RPC child's line or bounded-JSON structural limits. RPC now keeps a valid newest-message suffix with the original count and terminal status after durable entries; reader failures reap their child; crashes remain closed until child exit, then become restartable without a state probe; confirmed close settles transient state, waits for child exit, and is idempotent; and the desktop catalog exposes that close command.
• Fixed the desktop catalog omitting implemented session creation and lifecycle commands, which caused catalog-driven clients to hide working create, rename, archive, restore, and delete controls.
• Fixed RPC mode exiting on process termination, extension shutdown, or stdin EOF without disposing its session, which left a fresh writer lock behind and caused appserver lifecycle operations to report session_locked after quiescing an idle child.
• Fixed appserver sessions briefly returning to idle at intermediate turn boundaries during tool-driven runs; the active prompt now remains owned until final agent.end, a correlated local-only result or failure, successful cancellation, closure, or child termination.
• Fixed RPC prompt failures emitting a second response with an already-settled request id, which caused strict child supervisors to terminate otherwise healthy sessions. Late failures now use an exact-ID asynchronous prompt_result frame, which appserver surfaces as a sanitized turn.error without allowing stale results to settle newer work.
• Fixed accepted prompts disappearing from desktop and mobile clients while compaction or reconnect recovery was in progress. Prompt, steer, and follow-up text now enters a bounded ordered projection immediately, survives the sending client disconnecting, and retires through an exact durable-entry settlement or explicit discard event.
• Fixed one slow appserver client delaying transcript and pending-prompt delivery to other attached clients.
• Fixed session.attach acknowledgement and replay races by preparing output before success, catching up from its baseline, rebuilding cached delivery after revalidating session existence, and bounding large snapshots and replays so desktop and remote clients remain connected.
• Fixed compiled appserver welcome frames reporting placeholder local identities instead of the owning OMP and appserver versions and build kinds.
• Fixed active or locked sessions disappearing from observational session lists while keeping writable resume selection lock-safe.
• Fixed one malformed or crash-truncated transcript entry hiding an otherwise valid session from appserver discovery.
• Fixed concurrent Time-Traveling Stream Rules attaching AST reminders to the wrong tool result when multiple tool calls completed together.
• Fixed explicit session rewrites and stale-lock takeover failures retaining lock ownership after the write or cleanup failed.
• Fixed detached and clone session managers releasing another manager's live writer lock after restoring shared session state; the source keeps ownership until normal disposal, and the clone acquires the lock only if it becomes the late result writer.
• Included dependency patch files in Bun CI cache keys so a changed patch cannot reuse stale unpatched packages.
• Fixed appserver discovery counting nested advisor and subagent transcripts as main sessions.
• Fixed remote fast-mode changes bypassing the controller-lease checks used by other session mutations.
• Fixed desktop session lifecycle races by fencing mutations before asynchronous work, refusing active or queued sessions, closing owned terminals and RPC children before removal, and keeping host-wide session indexes in sync with external transcript changes.
• Fixed remote frame transforms reordering lifecycle deltas and responses; each connection now preserves send order and fails closed when a transform stalls.
• Fixed bundled Linux ffmpeg recording by selecting its available ALSA input when PulseAudio support is absent, and surfaced recorder stderr when capture fails (#5907).
• Session load now skips the recursive async blob-ref resolver for entries with no blob:sha256: references. A cheap synchronous precheck gates the walk per entry (preserving the previous per-entry initiation order under synchronous store mutation), so text-heavy histories no longer pay the Promise.all tree descent for every non-session entry (#5922).
• Fixed task tool schemas emitting boolean subschemas that llama.cpp grammar generation cannot parse (#5957).
• Fixed the transcript keeping finalized assistant blocks in the live compose walk after their rows entered native terminal scrollback, making each stream tick's TranscriptContainer.render depth-linear in session length. Fully committed finalized blocks are now compacted out of the local frame regardless of post-finalize version tracking; a later mutation no longer recommits on ordinary frames (no duplication) and rehydrates on the next destructive full replay (no loss). Compose cost for a live tail tick is now flat as depth grows (bench/transcript-compose.bench.ts: ratio(N5000/N500) 2.30 → 0.90) (#5930).
• Fixed /quit and /exit hanging during interactive shutdown by making the mnemopi dispose path retain the current session and flush in-flight extractions without sleeping the bank; the /memory enqueue path and end-of-session backend enqueue still perform full cross-session consolidation. (#3641)

@oh-my-pi/hashline

Fixed

• Rejected DEL N: headers with a trailing colon instead of silently tolerating the colon, so delete-with-body mistakes surface the corrective "has no colon" guidance.

@oh-my-pi/omp-home

Added

• Added the first @oh-my-pi/omp-home package with a loopback-only web server, embedded React client bundle, shared API types, and static SPA fallback.
• Added the OMP Home client shell with profile switching, role/cycle editing, schema-driven general settings editing, provider credential management, companion tool launchers, and a full-frame canvas routing graph.
• Added a profile-aware Home hub that launches or stops stats, collab, and robomp with exact loopback URLs and process state.
• Added a zero-dependency canvas routing graph with pan/zoom/fit/reset, minimap, search, filter counts, legend, keyboard controls, DOM node list, and role/agent edit-through inspector.

@oh-my-pi/omp-mechanism

Added

• Added model-family silhouettes for agent orbs, including Anthropic, OpenAI, Google, GLM, Kimi, and neutral unclassified forms.
• Added spawn umbilical transients and a HUD token total alongside session cost.
• Added clamped OrbitControls, raycaster hover picking, hover-gated lineage/model-lane tethers, and a concealed legend explaining the visual language.

@oh-my-pi/pi-mnemopi

Fixed

• Fixed a corrupt cached embedding model (truncated model_optimized.onnx, Protobuf parsing failed on load) permanently disabling local embeddings: init now quarantines the broken cache file (rename to *.corrupt-<ts>, only when the path resolves inside the fastembed cache directory) and retries once so the model re-downloads.

@oh-my-pi/omp-stats

Fixed

• Fixed session sync visiting session files in filesystem-dependent order. Files now sync in deterministic name order, so a forked session's copied entries always land after the filename-timestamped original and stay attributed to the parent session instead of whichever file happened to sync first.

What's Changed

• fix(appserver): route Agent View cancellation to session RPC children by @wolfiesch in #8

Full Changelog: t4code-17.0.4-appserver-2...t4code-17.0.4-appserver-4