t4code-17.0.5-appserver-7

@oh-my-pi/pi-agent-core

Added

• Added a per-message token estimation cache to optimize performance by reusing token counts for settled message history, with automatic cache invalidation on message mutation.

Changed

• Improved tool execution control by making tool interruptibility resolvable per call, allowing side-effecting operations to complete while passive waits can yield to queued steering.

@oh-my-pi/pi-ai

Changed

• Changed Anthropic API-key requests to default to a 1-hour prompt-cache retention (using the extended-cache-ttl-2025-04-11 beta) to prevent cold-misses during idle sessions, with support for PI_CACHE_RETENTION values "short" and "none" to override this behavior.

Fixed

• Fixed transient OpenAI stream truncations by retrying once before output becomes replay-unsafe, preventing recoverable transport errors from failing the turn.
• Fixed native Kimi Code K3 thinking being disabled during named function selection by utilizing generic required tool choice.
• Fixed /login moonshot validating China-platform API keys against the international host instead of honoring MOONSHOT_BASE_URL.
• Fixed Anthropic session stickiness suppressing usage-based re-ranking indefinitely by gating stickiness on a 1-hour cache warmth window (configurable via ANTHROPIC_SESSION_STICKY_CACHE_WARM_MS) to restore proactive multi-account load balancing after long idle periods.
• Fixed credential ranking where clockless Anthropic usage windows incorrectly outranked clocked sibling credentials.
• Fixed tool request failures (HTTP 400) on local grammar-constrained OpenAI-compatible backends (such as llama.cpp, LM Studio, and vLLM) by widening bare boolean subschemas into a value-accepting primitive union.
• Fixed custom OAuth Anthropic-compatible endpoints receiving generated Claude Code fingerprint headers even when explicit header overrides were provided.
• Fixed active sessions for plan-gated OpenAI Codex models (Sol/Luna) silently re-routing to sibling OAuth accounts when usage headroom changed, ensuring session stickiness is preserved as long as the preferred credential remains usable and eligible.

@oh-my-pi/app-wire

Added

• Add the local-only project.reveal desktop command without exposing absolute folder paths to clients.
• Add a bounded, ordered browser preview contract with backend-neutral authority metadata, capture chunking, tab controls, input actions, policy checks, cooperative leases, and human handoff.
• Add the negotiated transcript.search feature with strict, bounded host search and session context commands.
• Add the strict, bounded SessionRef.attention summary for cross-session pending questions, approvals, plan reviews, and latest root outcomes.

@oh-my-pi/pi-catalog

Added

• Added an Anthropic compatibility flag to allow non-official OAuth endpoints to opt into configured Claude Code fingerprint header overrides.

Fixed

• Fixed a security issue where sensitive provider-defined request headers (such as API keys or credentials) were serialized in plaintext within the model cache (models.db). The cache now omits these headers, securely invalidates older cached rows, and restores or refetches them dynamically.
• Fixed OpenAI Codex discovery to respect caller-supplied fetch configurations (such as proxies or custom CAs) and correctly replace stale bundled models with the authenticated account catalog.
• Fixed stream timeouts and retry loops during long prefills on local loopback or RFC1918 backends (such as litellm proxies fronting local servers) by applying the local stream-timeout floor to these backends.
• Fixed Kimi K3 models served through generic OpenAI-compatible routes exposing unsupported reasoning efforts instead of the mandatory low/high/max scale.

@oh-my-pi/pi-coding-agent

Added

• Add native Finder reveal support for local appserver projects without exposing their absolute paths.
• Added profile-local cross-session transcript search with redacted snippets, bounded historical context, and filters for project, role, archive state, and time.
• Added redacted OpenAI Codex transport state to RPC session diagnostics, including actual transport, fallback, context-shape, and request-size counters without credentials or provider payloads.
• Added an owner-socket appserver drain-if-idle maintenance fence that atomically refuses new client work only after the exact appserver identity is confirmed idle.
• Added desktop appserver controls for session model, thinking level, and fast mode, with live settings, model-role, and task-agent catalog metadata.
• Added desktop session archive, restore, and delete backed by private profile metadata and crash-recoverable same-filesystem tombstones.
• Added the /continue-in-t4 slash command, which persists the current TUI session and exits through the normal clean teardown so the session can be continued in T4; nothing is taken over while the TUI is still running.
• Added lock-aware appserver observation of sessions owned by another OMP process, such as an external TUI. The session is followed read-only from complete transcript records on disk; the appserver takes writable control only when the owner's lock is freshly missing — live, suspect, stale, or malformed locks are never seized — and the session stays read-only in a reconciling state until the promoted child reports it loaded the exact transcript the observer last saw.
• Added support for Codex (ChatGPT subscription) in generate_image via the providers.image: "openai-codex" option, including automatic subscription detection and fallback logic.
• Added an optional provider parameter to generate_image to override the global image provider setting for a single request.
• Added OpenTelemetry log and metric export capabilities alongside existing trace exports, supporting standard OTLP environment variables.
• Added support for id-prefixed targets and keys in retry.fallbackChains wildcards (e.g., "openrouter/google/*").
• Added support for Shift+Enter in the session tree selector (/tree, /branch) to summarize and switch branches in a single step.
• Added the PI_CONFIG_FILES environment variable to load settings overlays before --config overlays.

Changed

• Bounded incremental subagent transcript RPC reads to complete 384 KiB JSONL chunks, with byte cursors and an option to omit the redundant message view.
• Appserver now admits one unresolved session.prompt per session and returns session_busy before a second prompt reaches the RPC child; active clients can use session.steer or session.followUp to add work to the running agent.
• Bounded completed appserver command outcomes to a five-minute replay window and a 1,024-entry least-recently-used cache. Replays do not extend expiry, and pending commands are never evicted.
• Reused content-addressed native addons from prior successful branch builds and split Rust checks from native packaging, shortening appserver-only release runs without weakening the release gates.
• Appserver remote listener mode, bind address, port, and browser origins now persist in host-local agent/local/config.yml instead of synchronized profile config.
• Session-scoped Bash and Python execution now read output limits from the active session settings instead of process-global defaults.
• Changed bundled TTSR rules to warn instead of interrupting generation.
• Renamed the system prompt's project-context section wrapper from <context> to <repo-rules> to prevent XML tag collisions with in-band tool dialects.
• Renamed the /extensions dashboard tab "Agents (standard)" to "Agent Dirs (.agent/.agents)" to clarify its purpose.
• Optimized performance by reducing concurrent subagent update CPU usage, skipping unnecessary title generation in non-interactive hosts, and memoizing convertToLlm conversions over settled history.
• Improved the display of read xd:// calls by rendering them in a compact grouped view instead of full tool-execution cards.
• Made the hashline seen-line guard opt-in and off by default via edit.enforceSeenLines.

Fixed

• Fixed large session histories blocking appserver socket startup and repeatedly parsing every transcript body. Startup now publishes the transport before discovery, sends a complete initial inventory after bounded previews finish, and loads a transcript body only when that session is opened. Oversized non-header records are skipped without hiding the whole session.
• Fixed appserver Agent View cancellation aborting the parent RPC process instead of the selected live subagent. Cancellation now targets only validated worker subagents, survives the requesting client disconnecting after dispatch, publishes a non-resumable terminal cancelled lifecycle state before hard release, and cannot revive or park an agent after that release begins.
• Fixed macOS appserver startup rejecting Node's /var/folders temporary paths because /var is a system symlink, while retaining rejection of nested user-controlled symlinks.
• Fixed appserver durable tool results dropping structured content, renderer details, and error state. Bounded, redacted canonical fields now survive transcript projection without embedding image bytes, while legacy text output remains available.
• Fixed image-bearing appserver sessions losing their RPC child when inline image payloads made a lifecycle or durable-entry notification exceed the one MiB line ceiling. Managed children now omit only redundant image bytes from their internal stdout notifications and mark the frame, while the full images remain unchanged in OMP's session and model context; even tiny canonical image payloads are externalized for transcript reads.
• Fixed large appserver turns losing their terminal event when the redundant aggregate agent_end exceeded the RPC child's line or bounded-JSON structural limits. RPC now keeps a valid newest-message suffix with the original count and terminal status after durable entries; reader failures reap their child; crashes remain closed until child exit, then become restartable without a state probe; confirmed close settles transient state, waits for child exit, and is idempotent; and the desktop catalog exposes that close command.
• Fixed the desktop catalog omitting implemented session creation and lifecycle commands, which caused catalog-driven clients to hide working create, rename, archive, restore, and delete controls.
• Fixed RPC mode exiting on process termination, extension shutdown, or stdin EOF without disposing its session, which left a fresh writer lock behind and caused appserver lifecycle operations to report session_locked after quiescing an idle child.
• Fixed appserver sessions briefly returning to idle at intermediate turn boundaries during tool-driven runs; the active prompt now remains owned until final agent.end, a correlated local-only result or failure, successful cancellation, closure, or child termination.
• Fixed RPC prompt failures emitting a second response with an already-settled request id, which caused strict child supervisors to terminate otherwise healthy sessions. Late failures now use an exact-ID asynchronous prompt_result frame, which appserver surfaces as a sanitized turn.error without allowing stale results to settle newer work.
• Fixed accepted prompts disappearing from desktop and mobile clients while compaction or reconnect recovery was in progress. Prompt, steer, and follow-up text now enters a bounded ordered projection immediately, survives the sending client disconnecting, and retires through an exact durable-entry settlement or explicit discard event.
• Fixed one slow appserver client delaying transcript and pending-prompt delivery to other attached clients.
• Fixed session.attach acknowledgement and replay races by preparing output before success, catching up from its baseline, rebuilding cached delivery after revalidating session existence, and bounding large snapshots and replays so desktop and remote clients remain connected.
• Fixed compiled appserver welcome frames reporting placeholder local identities instead of the owning OMP and appserver versions and build kinds.
• Fixed active or locked sessions disappearing from observational session lists while keeping writable resume selection lock-safe.
• Fixed one malformed or crash-truncated transcript entry hiding an otherwise valid session from appserver discovery.
• Fixed concurrent Time-Traveling Stream Rules attaching AST reminders to the wrong tool result when multiple tool calls completed together.
• Fixed explicit session rewrites and stale-lock takeover failures retaining lock ownership after the write or cleanup failed.
• Fixed detached and clone session managers releasing another manager's live writer lock after restoring shared session state; the source keeps ownership until normal disposal, and the clone acquires the lock only if it becomes the late result writer.
• Included dependency patch files in Bun CI cache keys so a changed patch cannot reuse stale unpatched packages.
• Fixed appserver discovery counting nested advisor and subagent transcripts as main sessions.
• Fixed remote fast-mode changes bypassing the controller-lease checks used by other session mutations.
• Fixed desktop session lifecycle races by fencing mutations before asynchronous work, refusing active or queued sessions, closing owned terminals and RPC children before removal, and keeping host-wide session indexes in sync with external transcript changes.
• Fixed remote frame transforms reordering lifecycle deltas and responses; each connection now preserves send order and fails closed when a transform stalls.
• Fixed isolated task subagents mutating the parent git checkout and stacking parallel task branches by detaching the git directory.
• Fixed Windows compatibility issues, including launch start daemons opening visible console windows, startup crashes when running from a drive root, and command errors in the hub tool with non-POSIX shells.
• Fixed Windows stdio MCP servers launched through .cmd/.bat shims failing with Transport closed by escaping arguments properly.
• Fixed browser tool selectors (tab.click, tab.select, etc.) to accept bare snapshot refs (e.g., tab.click("e501"), @e501) and resolved crashes when handed ElementHandle objects.
• Fixed classifier refusals (e.g., Anthropic stop_reason: "refusal") ending turns with no visible error or exiting 0 in print mode.
• Fixed transcript blocks being duplicated during streaming and tmux pane growth blanking finalized chat history.
• Fixed JS/TS debugging by launching vscode-js-debug over TCP and synchronizing breakpoints across the session tree.
• Fixed legacy pi extensions failing validation or loading when importing path helpers or package managers.
• Fixed /login and /logout failing to refresh model discovery with fresh credentials due to stale cached data.
• Fixed Cursor models and advisors failing to receive or execute mounted xd:// devices and MCP tools.
• Fixed MCP tools repeatedly unmounting/remounting with overlapping sanitized prefixes, and stale tools remaining after disconnecting.
• Fixed custom LSP servers crashing when requesting unconfigured workspace/configuration sections.
• Fixed keyboard input dying after the first keypress when custom tools or modules hijack stdin at import time.
• Fixed auto-compaction dead-ending in a warning loop when the most recent turn is over budget.
• Fixed GitHub-hosted repository file reads falling back to curl by adding a dedicated github file-read operation.
• Fixed active session markers and TUI usage panels truncating organization suffixes from same-email account labels.
• Fixed write approval gates misclassifying xd:// device writes as exec.
• Fixed bash command timeouts rendering with an incorrect error border, and resolved Windows bash crashes when piped commands time out.
• Migrated legacy nested/quoted-dotted config keys (e.g., dev.autoqa.consent -> dev.autoqaConsent) on settings load.
• Added managed ctx.setInterval / ctx.setTimeout / ctx.clearTimer helpers on extension contexts to prevent uncaught exceptions from crashing sessions.

@oh-my-pi/omp-home

Added

• Added the first @oh-my-pi/omp-home package with a loopback-only web server, embedded React client bundle, shared API types, and static SPA fallback.
• Added the OMP Home client shell with profile switching, role/cycle editing, schema-driven general settings editing, provider credential management, companion tool launchers, and a full-frame canvas routing graph.
• Added a profile-aware Home hub that launches or stops stats, collab, and robomp with exact loopback URLs and process state.
• Added a zero-dependency canvas routing graph with pan/zoom/fit/reset, minimap, search, filter counts, legend, keyboard controls, DOM node list, and role/agent edit-through inspector.

@oh-my-pi/omp-mechanism

Added

• Added model-family silhouettes for agent orbs, including Anthropic, OpenAI, Google, GLM, Kimi, and neutral unclassified forms.
• Added spawn umbilical transients and a HUD token total alongside session cost.
• Added clamped OrbitControls, raycaster hover picking, hover-gated lineage/model-lane tethers, and a concealed legend explaining the visual language.

@oh-my-pi/pi-natives

Added

• Added optional PTY start callbacks that report the spawned child PID before command completion.

@oh-my-pi/omp-stats

Fixed

• Fixed session sync visiting session files in filesystem-dependent order. Files now sync in deterministic name order, so a forked session's copied entries always land after the filename-timestamped original and stay attributed to the parent session instead of whichever file happened to sync first.
• Fixed an EADDRINUSE error by properly reusing the live stats dashboard on the requested port and reclaiming stale listeners (can1357#5970).

@oh-my-pi/pi-tui

Changed

• Improved rendering performance across text, box, editor, and frame layouts by caching validated line widths and avoiding redundant Unicode width measurements.

Fixed

• Fixed a performance issue where typing in the editor triggered a full UI re-render, significantly improving keystroke responsiveness.
• Restored text wrapping for long descriptions in the slash-command autocomplete picker to ensure readability at standard terminal widths.
• Prevented temporary dashboard frame updates from cluttering the terminal's native scrollback history.
• Added support for cleaning up tracked Kitty graphics, allowing inline images to be properly deleted before falling back to text.
• Fixed an issue where resizing or growing a multiplexer pane would incorrectly overwrite newly exposed rows with blank padding.

@oh-my-pi/pi-utils

Changed

• Updated installRuntimeModuleResolver to return an uninstaller function that restores the stock node:module resolver once all runtime roots are unregistered.
• Added documentation regarding a known limitation with Bun 1.3.14's createRequire behavior when the module resolver patch is active.

What's Changed

• feat(appserver): reveal local projects without exposing paths by @wolfiesch in #15

Full Changelog: t4code-17.0.5-appserver-6...t4code-17.0.5-appserver-7