@cydm/pie 2.7.14 → 2.7.15

package/dist/builtin/extensions/im-forward/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "@pie/extension-im-forward",
 	"version": "0.1.0",
-	"description": "Forward assistant body text to Feishu (Lark) via lark-cli, and inject IM replies (to a forwarded message) as user input for the originating session. CLI-only, dormant unless configured.",
+	"description": "Provider-aware IM forwarding with guided interactive setup, session-bound replies and atomic image input. Feishu is currently supported; headless hosts stay dormant.",
 	"main": "index.js",
 	"type": "module",
 	"pie": {

package/dist/builtin/extensions/pie-ipc/index.js

@@ -5,8 +5,8 @@ import {
 import "../../../chunks/chunk-LZQXQOPJ.js";
 
 // builtin/extensions/pie-ipc/index.ts
-import * as fs2 from "node:fs";
-import * as path2 from "node:path";
+import * as fs3 from "node:fs";
+import * as path4 from "node:path";
 
 // builtin/extensions/pie-ipc/pure.ts
 import { randomBytes } from "node:crypto";
@@ -321,22 +321,257 @@ function assistantBodyText(message) {
 }
 
 // builtin/extensions/pie-ipc/discovery.ts
+import * as fs2 from "node:fs";
+
+// builtin/extensions/pie-ipc/windows-security.ts
+import { createRequire } from "node:module";
+import * as path2 from "node:path";
 import * as fs from "node:fs";
-import * as path from "node:path";
 import { randomBytes as randomBytes2 } from "node:crypto";
+
+// builtin/extensions/pie-ipc/windows-path.ts
+import * as path from "node:path";
+function canonicalWindowsDirectory(input) {
+  const value = input.replace(/\//g, "\\");
+  if (!/^[A-Za-z]:\\/.test(value) || value.slice(2).includes(":")) throw new Error("Unsafe IPC directory path");
+  const trimmed = value.replace(/\\+$/, "");
+  const pieces = trimmed.slice(3).split("\\");
+  if (!pieces.length || pieces.some((p) => !p || /[. ]$/.test(p) || /[<>"|?*\x00-\x1f]/.test(p) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(p))) throw new Error("Unsafe IPC directory path");
+  return path.win32.normalize(trimmed);
+}
+
+// builtin/extensions/pie-ipc/windows-security.ts
+var cached;
+function initialize() {
+  const k = createRequire(import.meta.url)("koffi");
+  const kernel = k.load("kernel32.dll"), adv = k.load("advapi32.dll");
+  const fn = (lib, decl) => lib.func(decl);
+  const close = fn(kernel, "bool __stdcall CloseHandle(void *h)");
+  const open = fn(kernel, "void * __stdcall CreateFileW(str16 name, uint32 access, uint32 share, void *sa, uint32 disposition, uint32 flags, void *templateFile)");
+  const info = fn(kernel, "bool __stdcall GetFileInformationByHandle(void *h, void *info)");
+  const fileType = fn(kernel, "uint32 __stdcall GetFileType(void *h)");
+  const security = fn(adv, "uint32 __stdcall GetSecurityInfo(void *h, uint32 type, uint32 flags, _Out_ void **owner, void *group, _Out_ void **dacl, void *sacl, _Out_ void **sd)");
+  const sidString = fn(adv, "bool __stdcall ConvertSidToStringSidW(void *sid, _Out_ void **text)");
+  const free = fn(kernel, "void * __stdcall LocalFree(void *p)");
+  const ace = fn(adv, "bool __stdcall GetAce(void *acl, uint32 index, _Out_ void **ace)");
+  const sddl = fn(adv, "bool __stdcall ConvertStringSecurityDescriptorToSecurityDescriptorW(str16 text, uint32 revision, _Out_ void **sd, void *size)");
+  const mkdir = fn(kernel, "bool __stdcall CreateDirectoryW(str16 name, void *sa)");
+  const error = fn(kernel, "uint32 __stdcall GetLastError()");
+  const read = fn(kernel, "bool __stdcall ReadFile(void *h, void *buffer, uint32 size, _Out_ uint32 *count, void *overlapped)");
+  const write = fn(kernel, "bool __stdcall WriteFile(void *h, void *buffer, uint32 size, _Out_ uint32 *count, void *overlapped)");
+  const flush = fn(kernel, "bool __stdcall FlushFileBuffers(void *h)");
+  const move = fn(kernel, "bool __stdcall MoveFileExW(str16 from, str16 to, uint32 flags)");
+  const del = fn(kernel, "bool __stdcall SetFileInformationByHandle(void *h, uint32 cls, void *data, uint32 size)");
+  const drive = fn(kernel, "uint32 __stdcall GetDriveTypeW(str16 root)");
+  const volume = fn(kernel, "bool __stdcall GetVolumeInformationW(str16 root, void *label, uint32 labelSize, void *serial, void *maxComponent, _Out_ uint32 *flags, void *fsName, uint32 fsSize)");
+  const processHandle = fn(kernel, "void * __stdcall GetCurrentProcess()");
+  const tokenOpen = fn(adv, "bool __stdcall OpenProcessToken(void *process, uint32 access, _Out_ void **token)");
+  const tokenInfo = fn(adv, "bool __stdcall GetTokenInformation(void *token, uint32 cls, void *buffer, uint32 size, _Out_ uint32 *needed)");
+  const fail = () => {
+    throw new Error("Windows IPC security validation failed");
+  };
+  const sid = (p) => {
+    const out = [null];
+    if (!sidString(p, out)) fail();
+    try {
+      let text = "";
+      for (let i = 0; i < 256; i++) {
+        const c = k.decode(out[0], i * 2, "uint16");
+        if (!c) return text;
+        text += String.fromCharCode(c);
+      }
+      return fail();
+    } finally {
+      free(out[0]);
+    }
+  };
+  const token = [null];
+  if (!tokenOpen(processHandle(), 8, token)) fail();
+  let current;
+  try {
+    const needed = [0];
+    tokenInfo(token[0], 1, null, 0, needed);
+    if (!needed[0] || needed[0] > 65536) fail();
+    const b = Buffer.alloc(needed[0]);
+    if (!tokenInfo(token[0], 1, b, b.length, needed)) fail();
+    current = sid(k.decode(b, "void *"));
+  } finally {
+    close(token[0]);
+  }
+  const trusted = /* @__PURE__ */ new Set([current, "S-1-5-18", "S-1-5-32-544"]);
+  const installer = "S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464";
+  function check(h, privateObject, directory, systemAncestor = false) {
+    const b = Buffer.alloc(52);
+    if (fileType(h) !== 1 || !info(h, b)) fail();
+    const attrs = b.readUInt32LE(0);
+    if (attrs & 1024 || !!(attrs & 16) !== directory) fail();
+    if (!directory && (b.readUInt32LE(40) !== 1 || b.readUInt32LE(32) !== 0)) fail();
+    const owner = [null], dacl = [null], sd = [null];
+    try {
+      if (security(h, 1, 5, owner, null, dacl, null, sd) !== 0 || !owner[0] || !dacl[0]) fail();
+      const ownerSid = sid(owner[0]);
+      if (!trusted.has(ownerSid) && !(!privateObject && systemAncestor && ownerSid === installer)) fail();
+      const header = Buffer.from(k.decode(dacl[0], "uint8", 8));
+      const count = header.readUInt16LE(4);
+      for (let i = 0; i < count; i++) {
+        const a = [null];
+        if (!ace(dacl[0], i, a)) fail();
+        const head = Buffer.from(k.decode(a[0], "uint8", 8));
+        if (head[1] & 8) continue;
+        if (head[0] === 1) continue;
+        if (head[0] !== 0 || head.readUInt16LE(2) < 12) fail();
+        const principal = sid(k.address(a[0]) + 8n);
+        const mask = head.readUInt32LE(4);
+        const dangerousAncestorRights = 1343029586;
+        if (!trusted.has(principal) && (privateObject ? mask !== 0 : !!(mask & dangerousAncestorRights))) fail();
+      }
+    } finally {
+      if (sd[0]) free(sd[0]);
+    }
+    return b.readUInt32LE(36);
+  }
+  function handle(name, directory, access = 131072, disposition = 3, sa = null) {
+    const h = open(name, directory ? access | 1 : access, directory ? 3 : 7, sa, disposition, 2097152 | (directory ? 33554432 : 0), null);
+    if (!h || k.address(h) === 0xffffffffffffffffn || k.address(h) === 0xffffffffn) fail();
+    return h;
+  }
+  function withPrivateSecurity(action) {
+    const sd = [null];
+    if (!sddl(`O:${current}D:P(A;OICI;FA;;;${current})(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)`, 1, sd, null)) fail();
+    try {
+      const size = k.sizeof("void *") === 8 ? 24 : 12;
+      const sa = Buffer.alloc(size);
+      sa.writeUInt32LE(size);
+      if (size === 24) sa.writeBigUInt64LE(k.address(sd[0]), 8);
+      else sa.writeUInt32LE(Number(k.address(sd[0])), 4);
+      return action(sa);
+    } finally {
+      free(sd[0]);
+    }
+  }
+  function createDirectory(name, exclusive = false) {
+    withPrivateSecurity((sa) => {
+      if (!mkdir(name, sa) && (exclusive || error() !== 183)) fail();
+    });
+  }
+  function pinned(dir, create, action, exclusiveFinal = false) {
+    dir = canonicalWindowsDirectory(dir);
+    const pieces = dir.slice(3).split("\\");
+    const root = dir.slice(0, 3), flags = [0];
+    if (drive(root) !== 3 || !volume(root, null, 0, null, null, flags, null, 0) || !(flags[0] & 8)) fail();
+    const handles = [];
+    try {
+      const r = handle(root, true);
+      handles.push(r);
+      check(r, false, true, true);
+      let name = root;
+      for (let i = 0; i < pieces.length; i++) {
+        name = path2.win32.join(name, pieces[i]);
+        if (create) createDirectory(name, exclusiveFinal && i === pieces.length - 1);
+        const h = handle(name, true);
+        handles.push(h);
+        check(h, i === pieces.length - 1, true);
+      }
+      return action();
+    } finally {
+      for (const h of handles.reverse()) close(h);
+    }
+  }
+  const fileName = (dir, name) => {
+    if (!/^[a-zA-Z0-9._-]+$/.test(name) || /[.]$/.test(name) || /^(con|prn|aux|nul|com[1-9]|lpt[1-9])(\.|$)/i.test(name)) fail();
+    return path2.win32.join(dir, name);
+  };
+  function remove(dir, name) {
+    const h = handle(fileName(dir, name), false, 196608);
+    try {
+      check(h, true, false);
+      if (!del(h, 4, Buffer.from([1]), 1)) fail();
+    } finally {
+      close(h);
+    }
+  }
+  return {
+    ensure: (dir) => pinned(dir, true, () => {
+    }),
+    createPrivateRoot: (dir) => pinned(dir, true, () => {
+    }, true),
+    pin: pinned,
+    read: (dir, name, max) => pinned(dir, false, () => {
+      const h = handle(fileName(dir, name), false, 2147614720);
+      try {
+        if (check(h, true, false) > max) fail();
+        const b = Buffer.alloc(max + 1), count = [0];
+        if (!read(h, b, b.length, count, null) || count[0] > max) fail();
+        return b.subarray(0, count[0]).toString("utf8");
+      } finally {
+        close(h);
+      }
+    }),
+    remove: (dir, name) => pinned(dir, false, () => remove(dir, name)),
+    write: (dir, name, raw) => pinned(dir, true, () => {
+      const target = fileName(dir, name), tempName = `.${randomBytes2(16).toString("hex")}.tmp`, temp = fileName(dir, tempName);
+      let created = false;
+      try {
+        const h = withPrivateSecurity((sa) => handle(temp, false, 1073872896, 1, sa));
+        created = true;
+        try {
+          check(h, true, false);
+          const b = Buffer.from(raw), count = [0];
+          if (!write(h, b, b.length, count, null) || count[0] !== b.length || !flush(h)) fail();
+        } finally {
+          close(h);
+        }
+        try {
+          const st = fs.lstatSync(target);
+          if (st) {
+            const h2 = handle(target, false);
+            try {
+              check(h2, true, false);
+            } finally {
+              close(h2);
+            }
+          }
+        } catch (e) {
+          if (e.code !== "ENOENT") throw e;
+        }
+        if (!move(temp, target, 9)) fail();
+        created = false;
+      } finally {
+        if (created) {
+          try {
+            remove(dir, tempName);
+          } catch {
+          }
+        }
+      }
+    })
+  };
+}
+function windowsSecurity() {
+  if (process.platform !== "win32") throw new Error("Windows IPC backend requested off Windows");
+  try {
+    return cached ??= initialize();
+  } catch {
+    throw new Error("Windows IPC security backend unavailable");
+  }
+}
+
+// builtin/extensions/pie-ipc/discovery.ts
+import * as path3 from "node:path";
+import { randomBytes as randomBytes3 } from "node:crypto";
 function ipcDiscoveryDir(configDir) {
-  return path.join(configDir, "run", "ipc");
+  return process.platform === "win32" ? `${canonicalWindowsDirectory(configDir)}\\run\\ipc` : path3.join(configDir, "run", "ipc");
 }
 function statusFilePath(discoveryDir, instanceId) {
   if (!isValidInstanceId(instanceId)) throw new Error("Invalid instance id");
-  return path.join(discoveryDir, `${instanceId}.json`);
+  return path3.join(discoveryDir, `${instanceId}.json`);
 }
 function ensurePrivateDir(discoveryDir) {
-  if (process.platform === "win32") throw new Error("pie-ipc requires POSIX private-file permissions; Windows is not supported yet");
-  fs.mkdirSync(discoveryDir, { recursive: true, mode: 448 });
-  const stat = fs.lstatSync(discoveryDir);
+  if (process.platform === "win32") return windowsSecurity().ensure(discoveryDir);
+  fs2.mkdirSync(discoveryDir, { recursive: true, mode: 448 });
+  const stat = fs2.lstatSync(discoveryDir);
   if (!stat.isDirectory() || stat.isSymbolicLink() || process.getuid && stat.uid !== process.getuid()) throw new Error("Unsafe IPC directory");
-  fs.chmodSync(discoveryDir, 448);
+  fs2.chmodSync(discoveryDir, 448);
 }
 function writeStatusFile(discoveryDir, file, log) {
   let temp;
@@ -345,14 +580,18 @@ function writeStatusFile(discoveryDir, file, log) {
     const target = statusFilePath(discoveryDir, file.instanceId);
     const raw = JSON.stringify(file);
     if (Buffer.byteLength(raw) > MAX_STATUS_FILE_BYTES || !parseStatusFile(raw)) throw new Error("Invalid status payload");
-    temp = path.join(discoveryDir, `.${randomBytes2(16).toString("hex")}.tmp`);
-    const handle = fs.openSync(temp, "wx", 384);
+    if (process.platform === "win32") {
+      windowsSecurity().write(discoveryDir, `${file.instanceId}.json`, raw);
+      return true;
+    }
+    temp = path3.join(discoveryDir, `.${randomBytes3(16).toString("hex")}.tmp`);
+    const handle = fs2.openSync(temp, "wx", 384);
     try {
-      fs.writeFileSync(handle, raw);
+      fs2.writeFileSync(handle, raw);
     } finally {
-      fs.closeSync(handle);
+      fs2.closeSync(handle);
     }
-    fs.renameSync(temp, target);
+    fs2.renameSync(temp, target);
     return true;
   } catch (error) {
     try {
@@ -363,7 +602,7 @@ function writeStatusFile(discoveryDir, file, log) {
   } finally {
     if (temp) {
       try {
-        fs.unlinkSync(temp);
+        fs2.unlinkSync(temp);
       } catch {
       }
     }
@@ -374,26 +613,32 @@ function readStatusFile(discoveryDir, instanceId) {
   const target = statusFilePath(discoveryDir, instanceId);
   let fd;
   try {
-    if (process.platform === "win32") return null;
-    const dir = fs.lstatSync(discoveryDir);
+    if (process.platform === "win32") {
+      const file2 = parseStatusFile(windowsSecurity().read(discoveryDir, `${instanceId}.json`, MAX_STATUS_FILE_BYTES));
+      return file2?.instanceId === instanceId ? file2 : null;
+    }
+    const dir = fs2.lstatSync(discoveryDir);
     if (!dir.isDirectory() || dir.isSymbolicLink() || process.getuid && (dir.uid !== process.getuid() || (dir.mode & 63) !== 0)) return null;
-    fd = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0) | (fs.constants.O_NONBLOCK ?? 0));
-    const stats = fs.fstatSync(fd);
+    fd = fs2.openSync(target, fs2.constants.O_RDONLY | (fs2.constants.O_NOFOLLOW ?? 0) | (fs2.constants.O_NONBLOCK ?? 0));
+    const stats = fs2.fstatSync(fd);
     if (!stats.isFile() || stats.size > MAX_STATUS_FILE_BYTES || process.getuid && (stats.uid !== process.getuid() || (stats.mode & 63) !== 0)) return null;
     const bytes = Buffer.alloc(MAX_STATUS_FILE_BYTES + 1);
-    const count = fs.readSync(fd, bytes, 0, bytes.length, 0);
+    const count = fs2.readSync(fd, bytes, 0, bytes.length, 0);
     if (count > MAX_STATUS_FILE_BYTES) return null;
     const file = parseStatusFile(bytes.subarray(0, count).toString("utf8"));
     return file?.instanceId === instanceId ? file : null;
   } catch {
     return null;
   } finally {
-    if (fd !== void 0) fs.closeSync(fd);
+    if (fd !== void 0) fs2.closeSync(fd);
   }
 }
 function removeStatusFile(discoveryDir, instanceId) {
   try {
-    fs.rmSync(statusFilePath(discoveryDir, instanceId), { force: true });
+    if (process.platform === "win32") {
+      statusFilePath(discoveryDir, instanceId);
+      windowsSecurity().remove(discoveryDir, `${instanceId}.json`);
+    } else fs2.rmSync(statusFilePath(discoveryDir, instanceId), { force: true });
   } catch {
   }
 }
@@ -410,12 +655,21 @@ function listPeers(discoveryDir, options = {}) {
   const entries = [];
   let directory;
   try {
-    directory = fs.opendirSync(discoveryDir);
-    for (let n = 0; n < 1024; n++) {
-      const entry = directory.readSync();
-      if (!entry) break;
-      entries.push(entry);
-    }
+    const enumerate = () => {
+      directory = fs2.opendirSync(discoveryDir);
+      try {
+        for (let n = 0; n < 1024; n++) {
+          const entry = directory.readSync();
+          if (!entry) break;
+          entries.push(entry);
+        }
+      } finally {
+        directory.closeSync();
+        directory = void 0;
+      }
+    };
+    if (process.platform === "win32") windowsSecurity().pin(discoveryDir, false, enumerate);
+    else enumerate();
   } catch {
     return [];
   } finally {
@@ -435,7 +689,7 @@ function listPeers(discoveryDir, options = {}) {
     const health = peerHealth(file, now, aliveCheck);
     if (health === "dead" && options.pruneDead !== false) {
       try {
-        fs.rmSync(path.join(discoveryDir, entry.name), { force: true });
+        removeStatusFile(discoveryDir, instanceId);
       } catch {
       }
       continue;
@@ -468,35 +722,69 @@ function startHeartbeat(discoveryDir, file, intervalMs, write = (next) => writeS
 function watchDiscoveryDir(discoveryDir, onChange) {
   let watcher = null;
   let closed = false;
-  let lastEventAt = 0;
+  const lastEvents = /* @__PURE__ */ new Map();
+  let identity = "";
+  const directoryIdentity = () => {
+    const stats = fs2.lstatSync(discoveryDir);
+    return `${stats.dev}:${stats.ino}`;
+  };
   const attach = () => {
     if (closed) return;
     try {
-      watcher = fs.watch(discoveryDir, (_event, filename) => {
+      const attachWatch = () => fs2.watch(discoveryDir, (_event, filename) => {
         const name = String(filename ?? "");
         if (!name.endsWith(".json")) return;
         const now = Date.now();
-        if (now - lastEventAt < 50) return;
-        lastEventAt = now;
+        const id = name.slice(0, -".json".length);
+        if (!isValidInstanceId(id) || now - (lastEvents.get(name) ?? 0) < 50) return;
+        if (lastEvents.size >= 1024) lastEvents.clear();
+        lastEvents.set(name, now);
+        if (!readStatusFile(discoveryDir, id)) return;
         try {
-          onChange(name.slice(0, -".json".length));
+          onChange(id);
         } catch {
         }
       });
+      const verifiedAttach = () => {
+        identity = directoryIdentity();
+        return attachWatch();
+      };
+      watcher = process.platform === "win32" ? windowsSecurity().pin(discoveryDir, false, verifiedAttach) : verifiedAttach();
+      for (const { file } of listPeers(discoveryDir, { pruneDead: false })) {
+        try {
+          onChange(file.instanceId);
+        } catch {
+        }
+      }
     } catch {
-      watcher = null;
-    }
-    watcher?.on("error", () => {
       watcher?.close();
       watcher = null;
+    }
+    const attached = watcher;
+    const detached = () => {
+      if (watcher === attached) watcher = null;
+    };
+    attached?.on("error", () => {
+      attached.close();
+      detached();
     });
+    attached?.on("close", detached);
     watcher?.unref?.();
   };
   attach();
   const retry = setInterval(() => {
-    if (closed || watcher) return;
+    if (closed) return;
+    if (watcher) {
+      try {
+        if (directoryIdentity() === identity) return;
+      } catch {
+      }
+      const stale = watcher;
+      watcher = null;
+      stale.close();
+    }
     attach();
-  }, 5e3);
+  }, 500);
   retry.unref?.();
   return () => {
     closed = true;
@@ -525,7 +813,7 @@ function buildStatusFile(input) {
 
 // builtin/extensions/pie-ipc/transport.ts
 import * as net from "node:net";
-import { createHmac, randomBytes as randomBytes3, randomUUID, timingSafeEqual } from "node:crypto";
+import { createHmac, randomBytes as randomBytes4, randomUUID, timingSafeEqual } from "node:crypto";
 import { StringDecoder } from "node:string_decoder";
 function signEnvelope(e, secret) {
   const payload = [e.v, e.id, e.from, e.to, e.kind, e.createdAt, e.sessionId ?? null, e.text ?? null, e.replyTo ?? null, e.waitMs ?? null];
@@ -539,7 +827,7 @@ var IpcTransport = class {
   constructor(host) {
     this.host = host;
     this.instanceId = host.instanceId;
-    this.secret = host.secret ?? randomBytes3(32).toString("hex");
+    this.secret = host.secret ?? randomBytes4(32).toString("hex");
     this.server = net.createServer((socket) => this.accept(socket));
     this.server.on("error", () => {
     });
@@ -1462,29 +1750,39 @@ ${message.text}`).join("\n---\n");
 };
 function loadConfig(ctx, configDir) {
   const layers = [
-    { file: path2.join(configDir, "ipc.json"), content: safeRead(path2.join(configDir, "ipc.json")) },
-    { file: path2.join(ctx.cwd, ".pie", "ipc.json"), content: safeRead(path2.join(ctx.cwd, ".pie", "ipc.json")) }
+    { file: path4.join(configDir, "ipc.json"), content: safeRead(path4.join(configDir, "ipc.json")) },
+    { file: path4.join(ctx.cwd, ".pie", "ipc.json"), content: safeRead(path4.join(ctx.cwd, ".pie", "ipc.json")) }
   ];
   return resolveIpcConfig(layers);
 }
 function safeRead(file) {
   try {
-    return fs2.readFileSync(file, "utf8");
+    return fs3.readFileSync(file, "utf8");
   } catch {
     return void 0;
   }
 }
 function pieIpcExtension(ctx) {
   const configDir = process.env.PIE_IPC_CONFIG_DIR ?? getConfigDirSafe(ctx);
-  const discoveryDir = ipcDiscoveryDir(configDir);
+  let discoveryDir;
+  try {
+    discoveryDir = ipcDiscoveryDir(configDir);
+  } catch {
+    ctx.log("pie-ipc: disabled: Windows discovery security validation failed");
+    return;
+  }
   const { config, problems } = loadConfig(ctx, configDir);
   for (const problem of problems) ctx.log(`pie-ipc: ${problem}`);
   if (!config) {
     return;
   }
   if (process.platform === "win32") {
-    ctx.log("pie-ipc: disabled: Windows ACL isolation is not implemented");
-    return;
+    try {
+      ensurePrivateDir(discoveryDir);
+    } catch {
+      ctx.log("pie-ipc: disabled: Windows discovery security validation failed");
+      return;
+    }
   }
   const runtime = new Runtime(ctx, config, discoveryDir);
   ctx.log(`pie-ipc: enabled as ${runtime.instanceId} (${ctx.hasUI ? "server+client" : "client-only"})`);
@@ -1658,10 +1956,10 @@ function getConfigDirSafe(_ctx) {
   const envDir = process.env.PIE_CODING_AGENT_DIR;
   if (envDir) {
     if (envDir === "~") return homeDir();
-    if (envDir.startsWith("~/")) return path2.join(homeDir(), envDir.slice(2));
+    if (envDir.startsWith("~/")) return path4.join(homeDir(), envDir.slice(2));
     return envDir;
   }
-  return path2.join(homeDir(), ".pie");
+  return path4.join(homeDir(), ".pie");
 }
 function homeDir() {
   return process.env.HOME ?? process.env.USERPROFILE ?? "/tmp";

package/dist/builtin/extensions/plan-mode/index.js

@@ -6,9 +6,9 @@ import {
   extractPlanTodoItems,
   markCompletedPlanSteps,
   restoreExecutionState
-} from "../../../chunks/chunk-VPTLDLI6.js";
-import "../../../chunks/chunk-5YU6MU2N.js";
-import "../../../chunks/chunk-N4252GH3.js";
+} from "../../../chunks/chunk-C5UTDL3S.js";
+import "../../../chunks/chunk-TDHVB2FH.js";
+import "../../../chunks/chunk-NM2JLPJ6.js";
 import {
   Type
 } from "../../../chunks/chunk-XXGYUYXI.js";

package/dist/builtin/extensions/subagent/index.js

@@ -6,15 +6,15 @@ import {
   formatTransportLifecycle,
   getConfigDir,
   logTransportLifecycle
-} from "../../../chunks/chunk-FOE2AW4L.js";
+} from "../../../chunks/chunk-CLEPSTWH.js";
 import {
   SUBAGENT_SESSION_RECORD_VERSION,
   createPolicyEnforcedTools,
   createSharedFileSystemTools,
   createSubagentCapability
-} from "../../../chunks/chunk-VPTLDLI6.js";
-import "../../../chunks/chunk-5YU6MU2N.js";
-import "../../../chunks/chunk-N4252GH3.js";
+} from "../../../chunks/chunk-C5UTDL3S.js";
+import "../../../chunks/chunk-TDHVB2FH.js";
+import "../../../chunks/chunk-NM2JLPJ6.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";
 

package/dist/builtin/extensions/todo/index.js

@@ -8,9 +8,9 @@ import {
   executeManageTodoList,
   executionStateToTodos,
   restoreExecutionState
-} from "../../../chunks/chunk-VPTLDLI6.js";
-import "../../../chunks/chunk-5YU6MU2N.js";
-import "../../../chunks/chunk-N4252GH3.js";
+} from "../../../chunks/chunk-C5UTDL3S.js";
+import "../../../chunks/chunk-TDHVB2FH.js";
+import "../../../chunks/chunk-NM2JLPJ6.js";
 import "../../../chunks/chunk-XXGYUYXI.js";
 import "../../../chunks/chunk-LZQXQOPJ.js";