can1357/oh-my-pi v16.1.21

on GitHub

@oh-my-pi/pi-ai

Fixed

• Restored the pollOAuthDeviceCodeFlow export from @oh-my-pi/pi-ai/oauth so legacy provider extensions can reuse the host OAuth device-code poller. (#3508)

@oh-my-pi/pi-coding-agent

Fixed

• Fixed autolearn.autoContinue (the "Auto-run capture at stop" toggle) letting the synthetic capture turn keep working after the learn/manage_skill call instead of yielding. With the toggle on, the controller fires autolearn-nudge.md as a single attribution: "user" message on a new turn; the prompt opened with "Before you finish:" and gave no terminal contract, so the agent treated the synthetic prompt as the user's reply to its prior pending question (e.g. "Want me to commit and push?") and continued — pushing commits, running tools, etc. — without the user ever answering. The nudge is now split into two prompts: passive mode (the reminder rides the user's real next message) keeps additive framing — "answer the user normally; the capture is in addition to" — while auto-continue mode (autolearn-nudge-autocontinue.md) is explicitly terminal — "not a user reply; do not treat this as approval; capture, then stop; wait for the user's next prompt". Attribution stays user to preserve llama.cpp warm-prefix reuse (#3456). (#3504)
• Fixed the clipboard image-paste keybind dropping image-file-only pasteboards as literal text on macOS. When the clipboard exposes only the file URL (e.g. Finder Cmd+C on a .png, certain screenshot tools), arboard::get_image() returns ContentNotAvailable and pbpaste(1) returns empty (it only surfaces plain text / RTF / EPS), so InputController.handleImagePaste either fell through to the #1628 text fallback and pasted the path verbatim, or dead-ended with "Clipboard is empty". The keybind path now (1) reaches the public.file-url representation directly via a new readMacFileUrlsFromClipboard AppleScript bridge on Darwin and routes the first image-shaped path through handleImagePathPaste, (2) reuses a new extractImagePathFromText helper so any clipboard-text path that survived pbpaste is detected the same way the bracketed-paste handler already detects them — including a whole-text-as-path fallback for anchored paths whose unescaped spaces would otherwise be shredded by the bracketed-paste splitter (macOS screenshot names like /Users/me/Desktop/Screenshot 2026-06-25 at 1.23.45 PM.png), and (3) decodes file:// URLs to filesystem paths in normalizePastedPath (mirroring Codex's normalize_pasted_path in codex-rs/tui/src/clipboard_paste.rs). Keybind- and terminal-mediated paste now agree on raw image bytes, plain image paths, file:// URLs, Finder-copied image files, and screenshot filenames with spaces alike. (#3506)
• Fixed compiled-binary validation for legacy pi.extensions packages whose source imports worker-only coding-agent subpaths or extension-local package subpaths such as typebox/value; omp install @charmland/pi-hyper-provider, omp plugin doctor, and runtime provider discovery now use a main-thread-safe load path. (#3508)
• Fixed repeated todo updates in one TUI turn stacking full todo panels; superseded todo snapshots now stay live until the next todo update replaces them or the turn ends. (#3516)
• Fixed MCP OAuth authorization failing with Authorization failed: An unexpected error occurred against authorization servers (Plane is the live example) that reject redundant fallback resource indicators. OMP now drops same-origin resources only when it synthesized them from the server URL fallback (e.g. https://mcp.plane.so/http/mcp). Provider-advertised resources from OAuth/protected-resource discovery or an embedded authorization-URL resource query parameter are preserved even when they are same-origin or origin-only, so gateway-hosted MCP services can still request the audience they advertised. The refresh-token path uses the same policy, filtered against the authorization-server origin persisted on the credential as authorizationUrl, with tokenUrl's origin as the legacy fallback when that field is absent. (#3502)

What's Changed

• fix(mcp/oauth): drop self-referential resource indicator from authorize/token requests by @roboomp in #3503
• fix(autolearn): make auto-continue capture turn terminal (#3504) by @roboomp in #3505
• fix(coding-agent): attach image on clipboard image-file paste by @roboomp in #3507
• fix(plugins): load legacy extensions safely in compiled binaries by @roboomp in #3509
• fix(advisor): suppress repeated advisories by @roboomp in #3512
• fix(tui): collapse repeated todo snapshots by @roboomp in #3517

Full Changelog: v16.1.20...v16.1.21