@diegopetrucci/pi-extensions 0.1.65 → 0.1.66

package/extensions/inline-bash/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/inline-bash/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-inline-bash",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "A pi extension that expands inline bash commands in user prompts.",
   "keywords": [
     "pi-package",

package/extensions/librarian/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/librarian/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-librarian",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "A pi GitHub research scout with a toggleable local repo checkout cache under the user's OS cache directory.",
   "keywords": [
     "pi-package",

package/extensions/minimal-footer/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/minimal-footer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-minimal-footer",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "description": "A minimal custom footer for pi.",
   "keywords": [
     "pi-package",

package/extensions/notify/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/notify/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-notify",
-  "version": "0.1.17",
+  "version": "0.1.18",
   "description": "A pi extension that sends a notification when the agent is ready for input.",
   "keywords": [
     "pi-package",

package/extensions/openai-fast/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/openai-fast/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-openai-fast",
-  "version": "0.1.16",
+  "version": "0.1.17",
   "description": "A pi extension that enables OpenAI Codex Fast mode for ChatGPT-auth GPT-5.5 and GPT-5.6 Codex variants by injecting the priority service tier.",
   "keywords": [
     "pi-package",

package/extensions/oracle/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/oracle/index.ts

@@ -115,6 +115,9 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"claude-opus-4-5",
 		"claude-opus-4-1",
 		"claude-opus-4",
+		"openai.gpt-5.6-sol",
+		"openai.gpt-5.6-terra",
+		"openai.gpt-5.6-luna",
 		"claude-sonnet-5",
 		"claude-sonnet-4-6",
 		"claude-sonnet-4-5",
@@ -125,6 +128,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"minimax-m2.5",
 		"minimax-m2.1",
 		"zai.glm-5",
+		"xai.grok-4.6",
 	],
 	anthropic: [
 		"claude-opus-5",
@@ -160,6 +164,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 	baseten: [
 		"moonshotai/Kimi-K3",
 		"moonshotai/Kimi-K2.7-Code",
+		"zai-org/GLM-5.3",
 		"deepseek-ai/DeepSeek-V4-Pro-0813",
 		"deepseek-ai/DeepSeek-V4-Pro",
 		"zai-org/GLM-5.2",
@@ -176,43 +181,49 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"zai-org/GLM-5.2-Fast",
 		"zai-org/GLM-4.7",
 	],
-	cerebras: ["gpt-oss-120b", "zai-glm-4.7", "gemma-4-31b"],
+	cerebras: ["gpt-oss-120b", "gemma-4-31b"],
 	"cloudflare-ai-gateway": [
 		"claude-fable-5",
-		"claude-opus-4-7",
-		"claude-opus-4-6",
-		"claude-opus-4-5",
+		"claude-opus-5",
+		"claude-opus-4.8",
+		"claude-opus-4.7",
+		"claude-opus-4.6",
+		"claude-opus-4.5",
 		"gpt-5.5",
 		"gpt-5.4",
-		"gpt-5.3-codex",
+		"workers-ai/@cf/moonshotai/kimi-k2.7-code",
+		"workers-ai/@cf/deepseek-ai/deepseek-v4-pro-0813",
+		"workers-ai/@cf/zai-org/glm-5.3",
+		"workers-ai/@cf/zai-org/glm-5.2",
 		"workers-ai/@cf/moonshotai/kimi-k2.6",
 		"workers-ai/@cf/nvidia/nemotron-3-120b-a12b",
+		"workers-ai/@cf/openai/gpt-oss-120b",
 		"workers-ai/@cf/zai-org/glm-4.7-flash",
 	],
 	"cloudflare-workers-ai": [
 		"@cf/moonshotai/kimi-k2.7-code",
+		"@cf/deepseek-ai/deepseek-v4-pro-0813",
+		"@cf/zai-org/glm-5.3",
 		"@cf/zai-org/glm-5.2",
 		"@cf/moonshotai/kimi-k2.6",
 		"@cf/nvidia/nemotron-3-120b-a12b",
 		"@cf/openai/gpt-oss-120b",
+		"@cf/qwen/qwen3.8-27b",
 		"@cf/qwen/qwen3-30b-a3b-fp8",
 		"@cf/zai-org/glm-4.7-flash",
 	],
 	deepseek: ["deepseek-v4-pro", "deepseek-v4-flash"],
 	fireworks: [
+		"accounts/fireworks/models/kimi-k3",
+		"accounts/fireworks/routers/kimi-k3-fast",
 		"accounts/fireworks/models/deepseek-v4-pro",
 		"accounts/fireworks/models/kimi-k2p7-code",
-		"accounts/fireworks/routers/kimi-k2p7-code-fast",
 		"accounts/fireworks/models/glm-5p2",
 		"accounts/fireworks/routers/glm-5p2-fast",
 		"accounts/fireworks/models/minimax-m3",
 		"accounts/fireworks/models/kimi-k2p6",
-		"accounts/fireworks/routers/kimi-k2p6-turbo",
-		"accounts/fireworks/routers/kimi-k2p6-fast",
-		"accounts/fireworks/models/minimax-m2p7",
 		"accounts/fireworks/models/qwen3p7-plus",
 		"accounts/fireworks/models/gpt-oss-120b",
-		"accounts/fireworks/models/gpt-oss-20b",
 	],
 	"github-copilot": [
 		"claude-opus-5",
@@ -221,6 +232,9 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"claude-opus-4.7",
 		"claude-opus-4.6",
 		"claude-opus-4.5",
+		"gpt-5.6-sol",
+		"gpt-5.6-terra",
+		"gpt-5.6-luna",
 		"gpt-5.5",
 		"gpt-5.4",
 		"gpt-5.3-codex",
@@ -232,6 +246,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"claude-sonnet-4.6",
 		"claude-sonnet-4.5",
 		"gpt-5-mini",
+		"kimi-k3",
 		"kimi-k2.7-code",
 	],
 	google: [
@@ -260,7 +275,10 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"openai/gpt-oss-20b",
 	],
 	huggingface: [
+		"moonshotai/Kimi-K3",
 		"zai-org/GLM-5.1",
+		"zai-org/GLM-5.3-Flash",
+		"deepseek-ai/DeepSeek-V4-Pro-0813",
 		"deepseek-ai/DeepSeek-V4-Pro",
 		"moonshotai/Kimi-K2.6",
 		"MiniMaxAI/MiniMax-M2.7",
@@ -285,6 +303,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"mistral-medium-2508",
 		"mistral-small-2603",
 		"devstral-2512",
+		"zai-glm-5-2",
 	],
 	openai: [
 		"gpt-5.6-sol",
@@ -334,6 +353,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"glm-5.2",
 		"glm-5.1",
 		"glm-5",
+		"kimi-k3",
 		"kimi-k2.7-code",
 		"kimi-k2.6",
 		"kimi-k2.5",
@@ -344,6 +364,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 	],
 	"opencode-go": [
 		"deepseek-v4-pro",
+		"glm-5.3",
 		"glm-5.2",
 		"glm-5.1",
 		"qwen3.7-max",
@@ -353,6 +374,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"mimo-v2.5",
 		"minimax-m3",
 		"minimax-m2.7",
+		"kimi-k3",
 		"kimi-k2.7-code",
 		"kimi-k2.6",
 	],
@@ -381,6 +403,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"~google/gemini-pro-latest",
 		"google/gemini-3.5-flash",
 		"google/gemini-2.5-pro",
+		"moonshotai/kimi-k3",
 		"moonshotai/kimi-k2.7-code",
 		"~moonshotai/kimi-latest",
 		"moonshotai/kimi-k2.6",
@@ -393,6 +416,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"minimax/minimax-m3",
 		"minimax/minimax-m2.7",
 		"minimax/minimax-m2.1",
+		"z-ai/glm-5.3",
 		"z-ai/glm-5.2",
 		"z-ai/glm-5.1",
 	],
@@ -427,6 +451,8 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 	],
 	together: [
 		"deepseek-ai/DeepSeek-V4-Pro",
+		"moonshotai/Kimi-K3",
+		"zai-org/GLM-5.3-Flash",
 		"zai-org/GLM-5.2",
 		"moonshotai/Kimi-K2.7-Code",
 		"moonshotai/Kimi-K2.6",
@@ -459,6 +485,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"openai/gpt-5.2-codex",
 		"openai/gpt-5.1-codex",
 		"openai/gpt-5-codex",
+		"moonshotai/kimi-k3",
 		"moonshotai/kimi-k2.7-code",
 		"moonshotai/kimi-k2.7-code-highspeed",
 		"moonshotai/kimi-k2.6",
@@ -476,6 +503,7 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"xai/grok-4.5",
 		"xai/grok-4.20-reasoning",
 		"minimax/minimax-m3",
+		"zai/glm-5.3",
 		"zai/glm-5.2",
 		"zai/glm-5.1",
 	],
@@ -485,15 +513,16 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"grok-4.3",
 		"grok-build-0.1",
 	],
-	xiaomi: ["mimo-v2.5-pro", "mimo-v2.5", "mimo-v2-pro", "mimo-v2-omni", "mimo-v2-flash"],
-	"xiaomi-token-plan-ams": ["mimo-v2.5-pro", "mimo-v2.5", "mimo-v2-pro"],
-	"xiaomi-token-plan-cn": ["mimo-v2.5-pro", "mimo-v2.5", "mimo-v2-pro"],
-	"xiaomi-token-plan-sgp": ["mimo-v2.5-pro", "mimo-v2.5", "mimo-v2-pro"],
+	xiaomi: ["mimo-v2.5-pro-ultraspeed", "mimo-v2.5-pro", "mimo-v2.5"],
+	"xiaomi-token-plan-ams": ["mimo-v2.5-pro", "mimo-v2.5"],
+	"xiaomi-token-plan-cn": ["mimo-v2.5-pro", "mimo-v2.5"],
+	"xiaomi-token-plan-sgp": ["mimo-v2.5-pro", "mimo-v2.5"],
 	nvidia: [
 		"nvidia/nemotron-3-ultra-550b-a55b",
 		"nvidia/nemotron-3-super-120b-a12b",
+		"moonshotai/kimi-k3",
+		"deepseek-ai/deepseek-v4-pro-0813",
 		"moonshotai/kimi-k2.6",
-		"z-ai/glm-5.2",
 		"minimaxai/minimax-m3",
 		"openai/gpt-oss-120b",
 		"nvidia/nemotron-3-nano-omni-30b-a3b-reasoning",
@@ -512,8 +541,8 @@ const PROVIDER_MODEL_PREFERENCES: Record<string, string[]> = {
 		"glm-5",
 		"glm-4.7",
 	],
-	moonshotai: ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2-thinking-turbo", "kimi-k2-thinking", "kimi-k2.5"],
-	"moonshotai-cn": ["kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2-thinking-turbo", "kimi-k2-thinking", "kimi-k2.5"],
+	moonshotai: ["kimi-k3", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2-thinking-turbo", "kimi-k2-thinking", "kimi-k2.5"],
+	"moonshotai-cn": ["kimi-k3", "kimi-k2.7-code", "kimi-k2.7-code-highspeed", "kimi-k2.6", "kimi-k2-thinking-turbo", "kimi-k2-thinking", "kimi-k2.5"],
 };
 
 const ORACLE_SYSTEM_PROMPT = [

package/extensions/oracle/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@diegopetrucci/pi-oracle",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "description": "An Amp-style oracle extension for pi that consults the strongest reasoning model on your current provider.",
   "keywords": [
     "pi-package",

package/extensions/permission-gate/.pi-fleet-tested-version

@@ -1 +1 @@
-0.84.2
+0.84.4

package/extensions/permission-gate/README.md

@@ -1,12 +1,13 @@
 # permission-gate
 
-A small pi extension that prompts for confirmation before running potentially dangerous bash commands or writing to protected paths.
+A small pi extension that prompts for confirmation before running potentially dangerous bash or PowerShell commands or writing to protected paths.
 
-This is adapted from the original `permission-gate.ts` example in [`earendil-works/pi`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and kept basically the same.
+This started from the original `permission-gate.ts` example in [`earendil-works/pi`](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/examples/extensions/permission-gate.ts) and adds conservative shell and path hardening.
 
 ## What it checks
 
 - `rm -rf`
+- PowerShell `Remove-Item -Recurse -Force` and its standard aliases, including module-qualified, interpolated, splatted, and backtick-escaped forms
 - `sudo`
 - `chmod` / `chown` with `777`
 - direct `write` / `edit` calls touching normalized protected paths:
@@ -18,6 +19,12 @@ Safe `.env` templates/examples such as `.env.example` and `.env.production.templ
 
 If pi is running without an interactive UI, it blocks matching commands and protected path writes by default.
 
+For Pi's built-in local Windows PowerShell tool, commands that pass the fast lexical checks are also parsed with the same PowerShell installation's AST parser before execution. Malformed input, parser failures, `Remove-Item` parameter splatting, command-resolution changes (aliases/modules/providers/direct function or filter definitions), known script/process/job/member invocation wrappers, computed member calls, and analyzer inputs above 16,000 UTF-8 bytes are treated conservatively and require confirmation (or are blocked when no UI is available). Computed targets passed to provider-capable mutation commands also require confirmation because the target could resolve to `Alias:` or `Function:`. Literal quoted/commented examples, including literal here-strings, stay benign. Definitely enabled `-WhatIf` removals (`-WhatIf`, `-WhatIf:$true`, or `-WhatIf:1`) remain non-destructive and are allowed; computed switch values require confirmation.
+
+Non-Windows and custom/remote `powershell` tools receive the conservative lexical checks, but only Pi's built-in local Windows tool can be verified with its actual parser. Pi extensions are trusted code: tool overrides, remote operations, spawn hooks, and mutations made by handlers loaded after this gate are outside its boundary and must enforce their own final-input policy.
+
+This is a targeted confirmation guard for the command classes listed above, not a shell sandbox or a proof that every unlisted executable/API is harmless.
+
 ## Install
 
 ### Standalone npm package
@@ -47,6 +54,7 @@ Then reload pi:
 ## Notes
 
 - Hooks the `tool_call` event.
-- Inspects `bash`, `write`, and `edit` tool calls.
+- Inspects `bash`, `powershell`, `write`, and `edit` tool calls.
+- Validates shell timeouts as well as command strings and fails closed on malformed calls.
 - Normalizes relative/absolute paths before matching so traversal tricks do not bypass the guard.
 - Prompts with a simple `Yes` / `No` selector before allowing dangerous commands or protected path writes.

package/extensions/permission-gate/index.ts

@@ -1,8 +1,8 @@
 /**
  * Permission Gate Extension
  *
- * Prompts for confirmation before running potentially dangerous bash commands
- * or modifying protected paths via write/edit.
+ * Prompts for confirmation before running potentially dangerous bash or
+ * PowerShell commands, or modifying protected paths via write/edit.
  * Protected paths include exact .git and node_modules path segments plus
  * secret-bearing .env files (excluding example/template variants).
  */
@@ -11,10 +11,19 @@ import * as path from "node:path";
 
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 
+import {
+	analyzePowerShellLexically,
+	buildPowerShellAstCommand,
+	MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES,
+	parsePowerShellAstOutput,
+} from "./powershell-safety.ts";
+
 const dangerousPatterns = [/\bsudo\b/i, /\b(chmod|chown)\b.*777/i];
 const protectedPathSegments = new Set([".git", "node_modules"]);
 const shellCommandSeparators = new Set([";", "&", "&&", "||", "|", "\n", "(", ")", "{", "}"]);
 const safeEnvSuffixes = new Set(["example", "examples", "template", "templates"]);
+const MAX_SHELL_TIMEOUT_SECONDS = 2_147_483_647 / 1000;
+const POWERSHELL_ANALYSIS_TIMEOUT_MS = 5_000;
 
 type GuardDecision = { block: true; reason: string } | undefined;
 type NormalizedPath = {
@@ -30,6 +39,7 @@ type ShellToken = {
 
 type WriteInput = { path: string; content: string };
 type EditInput = { path: string; edits: Array<{ oldText: string; newText: string }> };
+type ShellInput = { command: string; timeout?: number };
 
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return !!value && typeof value === "object" && !Array.isArray(value);
@@ -524,6 +534,55 @@ function hasDangerousRecursiveRm(command: string): boolean {
 	return evaluateTokens(currentCommand);
 }
 
+function validateShellInput(input: unknown): ShellInput | undefined {
+	if (!isRecord(input) || typeof input.command !== "string" || input.command.trim() === "") return undefined;
+	if (
+		input.timeout !== undefined &&
+		(typeof input.timeout !== "number" ||
+			!Number.isFinite(input.timeout) ||
+			input.timeout <= 0 ||
+			input.timeout > MAX_SHELL_TIMEOUT_SECONDS)
+	) {
+		return undefined;
+	}
+	return input.timeout === undefined
+		? { command: input.command }
+		: { command: input.command, timeout: input.timeout };
+}
+
+async function hasDangerousPowerShellCommand(
+	pi: ExtensionAPI,
+	command: string,
+	signal?: AbortSignal,
+): Promise<boolean> {
+	// Keep both lexical work and Windows' base64-expanded -Command transport
+	// bounded below the platform command-line limit. Oversized input is
+	// deliberately treated as requiring confirmation rather than failing open.
+	if (Buffer.byteLength(command, "utf8") > MAX_POWERSHELL_ANALYSIS_SOURCE_BYTES) return true;
+
+	const lexicalAnalysis = analyzePowerShellLexically(command);
+	if (lexicalAnalysis.risky) return true;
+
+	// Pi only exposes its built-in PowerShell tool on Windows. On that platform,
+	// ask PowerShell's own parser for the final word so ordinary syntax features
+	// (module qualification, interpolation, splatting, and backtick escapes) cannot
+	// bypass the fallback lexer. Parser failures and malformed output fail closed.
+	if (process.platform !== "win32") return false;
+
+	try {
+		const { getPowerShellConfig } = await import("@earendil-works/pi-coding-agent");
+		const config = getPowerShellConfig();
+		const result = await pi.exec(config.shell, [...config.args, buildPowerShellAstCommand(command)], {
+			timeout: POWERSHELL_ANALYSIS_TIMEOUT_MS,
+			signal,
+		});
+		if (result.code !== 0 || result.killed) return true;
+		return parsePowerShellAstOutput(result.stdout).risky;
+	} catch {
+		return true;
+	}
+}
+
 function validateWriteInput(input: unknown): WriteInput | undefined {
 	if (!isRecord(input)) return undefined;
 	if (typeof input.path !== "string" || typeof input.content !== "string") return undefined;
@@ -576,13 +635,17 @@ async function confirmProtectedPathAction(
 
 export default function (pi: ExtensionAPI) {
 	pi.on("tool_call", async (event, ctx) => {
-		if (event.toolName === "bash") {
-			const command = event.input?.command;
-			if (typeof command !== "string" || command.trim() === "") {
-				return { block: true, reason: "Malformed bash command blocked" };
+		if (event.toolName === "bash" || event.toolName === "powershell") {
+			const shellToolName = event.toolName;
+			const input = validateShellInput(event.input);
+			if (!input) {
+				return { block: true, reason: `Malformed ${shellToolName} command blocked` };
 			}
+			const { command } = input;
 
-			const isDangerous = hasDangerousRecursiveRm(command) || dangerousPatterns.some((p) => p.test(command));
+				const isDangerous = shellToolName === "powershell"
+					? await hasDangerousPowerShellCommand(pi, command, ctx.signal)
+				: hasDangerousRecursiveRm(command) || dangerousPatterns.some((pattern) => pattern.test(command));
 
 			if (isDangerous) {
 				if (!ctx.hasUI) {

package/extensions/permission-gate/package.json

@@ -1,12 +1,13 @@
 {
   "name": "@diegopetrucci/pi-permission-gate",
-  "version": "0.1.13",
-  "description": "A pi extension that prompts before dangerous bash commands and protected file writes.",
+  "version": "0.1.14",
+  "description": "A pi extension that prompts before dangerous shell commands and protected file writes.",
   "keywords": [
     "pi-package",
     "pi",
     "security",
     "bash",
+    "powershell",
     "permissions",
     "file-safety"
   ],
@@ -18,6 +19,7 @@
   },
   "files": [
     "index.ts",
+    "powershell-safety.ts",
     "README.md",
     ".pi-fleet-tested-version"
   ],