@herbertgao/pi-extensions 2026.9.16 → 2026.9.18

package/node_modules/pi-lens/package.json

@@ -1,160 +1,160 @@
 {
-	"name": "pi-lens",
-	"version": "4.3.0",
-	"type": "module",
-	"description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
-	"repository": {
-		"type": "git",
-		"url": "git+https://github.com/apmantza/pi-lens.git"
-	},
-	"main": "./dist/index.js",
-	"bin": {
-		"pi-lens": "dist/mcp/cli.js",
-		"pi-lens-mcp": "dist/mcp/server.js",
-		"pi-lens-analyze": "dist/mcp/analyze-cli.js"
-	},
-	"scripts": {
-		"build": "tsc --project tsconfig.build.json",
-		"build:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && node scripts/build-dist-tsc.mjs tsconfig.dist.json && npm run bundle:dist",
-		"bundle:dist": "node scripts/bundle-dist.mjs",
-		"prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars && node scripts/setup-git-hooks.mjs && node scripts/warm-loader-cache.mjs",
-		"prepack": "node scripts/strip-dev-deps-for-pack.mjs --strip",
-		"postpack": "node scripts/strip-dev-deps-for-pack.mjs --restore",
-		"lint": "tsc --project tsconfig.json && npm run lint:js && npm run lint:js:tests",
-		"lint:js": "oxlint --deny-warnings --import-plugin --promise-plugin -D block-scoped-var -D import/default -D import/namespace -D import/no-absolute-path -D import/no-empty-named-blocks -D import/no-named-as-default -D import/no-self-import -D no-extend-native -D no-extra-bind -D no-implied-eval -D no-new -D no-unexpected-multiline -D no-useless-constructor -D oxc/approx-constant -D oxc/misrefactored-assign-op -D oxc/no-accumulating-spread -D oxc/no-async-endpoint-handlers -D oxc/no-this-in-exported-function -D promise/no-callback-in-promise -D promise/no-multiple-resolved -D promise/no-new-statics -D promise/valid-params -D typescript/no-confusing-non-null-assertion -D typescript/no-extraneous-class -D typescript/no-unnecessary-type-constraint -D typescript/no-unsafe-enum-comparison -D unicorn/no-accessor-recursion -D unicorn/no-array-fill-with-reference-type -D unicorn/no-confusing-array-with -D unicorn/no-instanceof-builtins -D unicorn/prefer-array-flat-map -D unicorn/require-module-specifiers --ignore-pattern \"tests/**/*.ts\" --ignore-pattern \"tests/**/*.tsx\" --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
-		"lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
-		"lint:js:tests": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix --type-aware -A correctness -A suspicious -A perf --ignore-pattern \"tests/fixtures/**\" tests",
-		"depcruise:check": "depcruise --validate --config .dependency-cruiser.cjs --ignore-known .dependency-cruiser-known-violations.json --output-type err index.ts \"clients/**/*.ts\"",
-		"fmt": "oxfmt",
-		"fmt:check": "oxfmt --check",
-		"taplo": "taplo check $(git ls-files '*.toml' ':!tests/fixtures/**') && taplo fmt --check $(git ls-files '*.toml' ':!tests/fixtures/**' ':!config/ruff/core.toml') # taplo 0.7.0 panics on this file's comments; lint it above",
-		"watch": "tsc --watch",
-		"test": "node scripts/with-test-lock.mjs -- vitest run",
-		"test:unit": "node scripts/with-test-lock.mjs -- vitest run",
-		"test:integration": "node scripts/with-test-lock.mjs -- vitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.ts",
-		"test:targeted": "node scripts/with-test-lock.mjs --shared -- vitest run",
-		"test:watch": "vitest",
-		"test:real-harness": "node scripts/with-test-lock.mjs --shared -- vitest run",
-		"mutation:diff": "node scripts/stryker-diff.mjs --base origin/master --max-files 6",
-		"hygiene": "node scripts/prune-agent-worktrees.mjs",
-		"check": "node scripts/check-extensions.mjs",
-		"selftest:install": "node scripts/install-selftest.mjs",
-		"check:lockfile": "node scripts/check-lockfile-sync.mjs",
-		"preflight": "node scripts/pr-preflight.mjs",
-		"knip": "node scripts/run-knip.mjs",
-		"check:grammars": "node scripts/check-grammar-provenance.mjs",
-		"check:grammar-load": "node scripts/check-grammar-load.mjs",
-		"audit:tree-sitter": "node scripts/audit-tree-sitter-rules.mjs",
-		"audit:rule-catalog": "node scripts/validate-rule-catalog.mjs",
-		"audit:astgrep-rule-pairs": "node scripts/audit-astgrep-rule-pairs.mjs",
-		"astgrep:self-scan": "node scripts/run-astgrep-pi-lens.mjs",
-		"astgrep:self-scan:update-baseline": "node scripts/run-astgrep-pi-lens.mjs --update-baseline",
-		"audit:playground": "node scripts/playground-verify-rule.mjs",
-		"bench:cascade-budget": "node scripts/bench-cascade-budget.mjs",
-		"bench:word-index-replacement": "node scripts/bench-word-index-replacement.mjs",
-		"logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
-		"complexity": "node scripts/complexity-report.mjs",
-		"changelog:check": "node scripts/rollup-changelog.mjs --check",
-		"test:regen": "node scripts/regen-test-baseline.mjs",
-		"changelog:release": "node scripts/changelog-release.mjs",
-		"changelog:extract": "node scripts/changelog-extract.mjs",
-		"release:backfill-notes": "node scripts/backfill-github-releases.mjs",
-		"release:backfill-thanks": "node scripts/backfill-release-thanks.mjs",
-		"docs:rule-catalogs": "node scripts/gen-rule-catalogs.mjs",
-		"banner": "npx -y sharp-cli --input banner.svg --output banner.png resize 2200 620",
-		"download-grammars": "node scripts/download-grammars.js",
-		"harness:poc": "node scripts/run-harness.mjs cases/ts/pipeline-dispatch-poc",
-		"harness:python-poc": "node scripts/run-harness.mjs cases/python/pipeline-dispatch-poc",
-		"harness:ts-format-poc": "node scripts/run-harness.mjs cases/ts/format-default-poc",
-		"harness:python-autofix-poc": "node scripts/run-harness.mjs cases/python/autofix-default-poc",
-		"harness:go-poc": "node scripts/run-harness.mjs cases/go/pipeline-dispatch-poc"
-	},
-	"keywords": [
-		"pi",
-		"pi-extension",
-		"pi-package",
-		"linter",
-		"biome",
-		"ast-grep",
-		"ruff",
-		"typescript",
-		"code-quality",
-		"feedback",
-		"type-coverage",
-		"jscpd",
-		"knip"
-	],
-	"author": "Apostolos Mantzaris",
-	"license": "MIT",
-	"engines": {
-		"node": ">=22.19.0"
-	},
-	"packageManager": "npm@11.18.0",
-	"files": [
-		"dist/",
-		"docs/",
-		"grammars/",
-		"vendor/grammars/",
-		"config/",
-		"rules/",
-		"skills/",
-		"scripts/download-grammars.js",
-		"scripts/grammars.lock.json",
-		"scripts/analyze-pi-lens-logs.mjs",
-		"scripts/install-selftest.mjs",
-		"scripts/lib/host-provided-deps.mjs",
-		"scripts/lib/skills-predicate.mjs",
-		"scripts/lib/web-tree-sitter-dir.mjs",
-		"scripts/lib/warm-loader-cache.mjs",
-		"scripts/warm-loader-cache.mjs",
-		"scripts/rpc-load-check.mjs",
-		"README.md",
-		"CHANGELOG.md",
-		"banner.svg",
-		"banner.png"
-	],
-	"dependencies": {
-		"@ast-grep/cli": "^0.45.0",
-		"@ast-grep/napi": "^0.45.0",
-		"js-yaml": "^5.2.2",
-		"minimatch": "^10.2.6",
-		"pidusage": "^4.0.1",
-		"vscode-jsonrpc": "^9.0.0"
-	},
-	"peerDependencies": {
-		"@earendil-works/pi-coding-agent": "*",
-		"@earendil-works/pi-tui": "^0.84.1 || ^0.85.0",
-		"typebox": "^1.0.0"
-	},
-	"peerDependenciesMeta": {
-		"@earendil-works/pi-coding-agent": {
-			"optional": true
-		},
-		"@earendil-works/pi-tui": {
-			"optional": true
-		},
-		"typebox": {
-			"optional": true
-		}
-	},
-	"optionalDependencies": {
-		"jiti": "^2.7.0",
-		"web-tree-sitter": "0.25.10"
-	},
-	"pi": {
-		"extensions": [
-			"./dist/index.js"
-		],
-		"skills": [
-			"./skills"
-		]
-	},
-	"allowScripts": {
-		"@ast-grep/cli@0.45.3": true,
-		"@google/genai@1.52.0": true,
-		"protobufjs@7.6.5": true
-	},
-	"overrides": {
-		"qs": "^6.15.4"
-	}
+  "name": "pi-lens",
+  "version": "4.3.0",
+  "type": "module",
+  "description": "Real-time code feedback for pi — LSP, linters, formatters, type-checking, structural analysis & booboo",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/apmantza/pi-lens.git"
+  },
+  "main": "./dist/index.js",
+  "bin": {
+    "pi-lens": "dist/mcp/cli.js",
+    "pi-lens-mcp": "dist/mcp/server.js",
+    "pi-lens-analyze": "dist/mcp/analyze-cli.js"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json",
+    "build:dist": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && node scripts/build-dist-tsc.mjs tsconfig.dist.json && npm run bundle:dist",
+    "bundle:dist": "node scripts/bundle-dist.mjs",
+    "prepare": "npm run build:dist && node scripts/download-grammars.js --core --dest grammars && node scripts/setup-git-hooks.mjs && node scripts/warm-loader-cache.mjs",
+    "prepack": "node scripts/strip-dev-deps-for-pack.mjs --strip",
+    "postpack": "node scripts/strip-dev-deps-for-pack.mjs --restore",
+    "lint": "tsc --project tsconfig.json && npm run lint:js && npm run lint:js:tests",
+    "lint:js": "oxlint --deny-warnings --import-plugin --promise-plugin -D block-scoped-var -D import/default -D import/namespace -D import/no-absolute-path -D import/no-empty-named-blocks -D import/no-named-as-default -D import/no-self-import -D no-extend-native -D no-extra-bind -D no-implied-eval -D no-new -D no-unexpected-multiline -D no-useless-constructor -D oxc/approx-constant -D oxc/misrefactored-assign-op -D oxc/no-accumulating-spread -D oxc/no-async-endpoint-handlers -D oxc/no-this-in-exported-function -D promise/no-callback-in-promise -D promise/no-multiple-resolved -D promise/no-new-statics -D promise/valid-params -D typescript/no-confusing-non-null-assertion -D typescript/no-extraneous-class -D typescript/no-unnecessary-type-constraint -D typescript/no-unsafe-enum-comparison -D unicorn/no-accessor-recursion -D unicorn/no-array-fill-with-reference-type -D unicorn/no-confusing-array-with -D unicorn/no-instanceof-builtins -D unicorn/prefer-array-flat-map -D unicorn/require-module-specifiers --ignore-pattern \"tests/**/*.ts\" --ignore-pattern \"tests/**/*.tsx\" --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+    "lint:js:advisory": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix -D correctness -D suspicious -D perf --import-plugin --promise-plugin --type-aware -A no-underscore-dangle -A no-await-in-loop -A unicorn/no-array-sort -A unicorn/consistent-function-scoping -A promise/no-promise-in-callback -A no-useless-call -A import/no-unassigned-import -A no-unmodified-loop-condition --ignore-pattern \"**/*.d.mts\" --ignore-pattern \"tests/fixtures/autofix-smoke/**\" --ignore-pattern \"tests/fixtures/format-smoke/**\" --ignore-pattern \"tests/fixtures/tool-smoke/**\" --ignore-pattern \"tests/fixtures/call-graph/javascript/**\" --ignore-pattern \"tests/fixtures/function-facts/javascript-parameter.js\" .",
+    "lint:js:tests": "node scripts/lint-js-advisory.mjs --deny-warnings --format unix --type-aware -A correctness -A suspicious -A perf --ignore-pattern \"tests/fixtures/**\" tests",
+    "depcruise:check": "depcruise --validate --config .dependency-cruiser.cjs --ignore-known .dependency-cruiser-known-violations.json --output-type err index.ts \"clients/**/*.ts\"",
+    "fmt": "oxfmt",
+    "fmt:check": "oxfmt --check",
+    "taplo": "taplo check $(git ls-files '*.toml' ':!tests/fixtures/**') && taplo fmt --check $(git ls-files '*.toml' ':!tests/fixtures/**' ':!config/ruff/core.toml') # taplo 0.7.0 panics on this file's comments; lint it above",
+    "watch": "tsc --watch",
+    "test": "node scripts/with-test-lock.mjs -- vitest run",
+    "test:unit": "node scripts/with-test-lock.mjs -- vitest run",
+    "test:integration": "node scripts/with-test-lock.mjs -- vitest run tests/index-integration.test.ts tests/clients/lsp/integration.test.ts",
+    "test:targeted": "node scripts/with-test-lock.mjs --shared -- vitest run",
+    "test:watch": "vitest",
+    "test:real-harness": "node scripts/with-test-lock.mjs --shared -- vitest run",
+    "mutation:diff": "node scripts/stryker-diff.mjs --base origin/master --max-files 6",
+    "hygiene": "node scripts/prune-agent-worktrees.mjs",
+    "check": "node scripts/check-extensions.mjs",
+    "selftest:install": "node scripts/install-selftest.mjs",
+    "check:lockfile": "node scripts/check-lockfile-sync.mjs",
+    "preflight": "node scripts/pr-preflight.mjs",
+    "knip": "node scripts/run-knip.mjs",
+    "check:grammars": "node scripts/check-grammar-provenance.mjs",
+    "check:grammar-load": "node scripts/check-grammar-load.mjs",
+    "audit:tree-sitter": "node scripts/audit-tree-sitter-rules.mjs",
+    "audit:rule-catalog": "node scripts/validate-rule-catalog.mjs",
+    "audit:astgrep-rule-pairs": "node scripts/audit-astgrep-rule-pairs.mjs",
+    "astgrep:self-scan": "node scripts/run-astgrep-pi-lens.mjs",
+    "astgrep:self-scan:update-baseline": "node scripts/run-astgrep-pi-lens.mjs --update-baseline",
+    "audit:playground": "node scripts/playground-verify-rule.mjs",
+    "bench:cascade-budget": "node scripts/bench-cascade-budget.mjs",
+    "bench:word-index-replacement": "node scripts/bench-word-index-replacement.mjs",
+    "logs:smells": "node scripts/analyze-pi-lens-logs.mjs",
+    "complexity": "node scripts/complexity-report.mjs",
+    "changelog:check": "node scripts/rollup-changelog.mjs --check",
+    "test:regen": "node scripts/regen-test-baseline.mjs",
+    "changelog:release": "node scripts/changelog-release.mjs",
+    "changelog:extract": "node scripts/changelog-extract.mjs",
+    "release:backfill-notes": "node scripts/backfill-github-releases.mjs",
+    "release:backfill-thanks": "node scripts/backfill-release-thanks.mjs",
+    "docs:rule-catalogs": "node scripts/gen-rule-catalogs.mjs",
+    "banner": "npx -y sharp-cli --input banner.svg --output banner.png resize 2200 620",
+    "download-grammars": "node scripts/download-grammars.js",
+    "harness:poc": "node scripts/run-harness.mjs cases/ts/pipeline-dispatch-poc",
+    "harness:python-poc": "node scripts/run-harness.mjs cases/python/pipeline-dispatch-poc",
+    "harness:ts-format-poc": "node scripts/run-harness.mjs cases/ts/format-default-poc",
+    "harness:python-autofix-poc": "node scripts/run-harness.mjs cases/python/autofix-default-poc",
+    "harness:go-poc": "node scripts/run-harness.mjs cases/go/pipeline-dispatch-poc"
+  },
+  "keywords": [
+    "pi",
+    "pi-extension",
+    "pi-package",
+    "linter",
+    "biome",
+    "ast-grep",
+    "ruff",
+    "typescript",
+    "code-quality",
+    "feedback",
+    "type-coverage",
+    "jscpd",
+    "knip"
+  ],
+  "author": "Apostolos Mantzaris",
+  "license": "MIT",
+  "engines": {
+    "node": ">=22.19.0"
+  },
+  "packageManager": "npm@11.18.0",
+  "files": [
+    "dist/",
+    "docs/",
+    "grammars/",
+    "vendor/grammars/",
+    "config/",
+    "rules/",
+    "skills/",
+    "scripts/download-grammars.js",
+    "scripts/grammars.lock.json",
+    "scripts/analyze-pi-lens-logs.mjs",
+    "scripts/install-selftest.mjs",
+    "scripts/lib/host-provided-deps.mjs",
+    "scripts/lib/skills-predicate.mjs",
+    "scripts/lib/web-tree-sitter-dir.mjs",
+    "scripts/lib/warm-loader-cache.mjs",
+    "scripts/warm-loader-cache.mjs",
+    "scripts/rpc-load-check.mjs",
+    "README.md",
+    "CHANGELOG.md",
+    "banner.svg",
+    "banner.png"
+  ],
+  "dependencies": {
+    "@ast-grep/cli": "^0.45.0",
+    "@ast-grep/napi": "^0.45.0",
+    "js-yaml": "^5.2.2",
+    "minimatch": "^10.2.6",
+    "pidusage": "^4.0.1",
+    "vscode-jsonrpc": "^9.0.0"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
+  },
+  "peerDependenciesMeta": {
+    "@earendil-works/pi-coding-agent": {
+      "optional": true
+    },
+    "@earendil-works/pi-tui": {
+      "optional": true
+    },
+    "typebox": {
+      "optional": true
+    }
+  },
+  "optionalDependencies": {
+    "jiti": "^2.7.0",
+    "web-tree-sitter": "0.25.10"
+  },
+  "pi": {
+    "extensions": [
+      "./dist/index.js"
+    ],
+    "skills": [
+      "./skills"
+    ]
+  },
+  "allowScripts": {
+    "@ast-grep/cli@0.45.3": true,
+    "@google/genai@1.52.0": true,
+    "protobufjs@7.6.5": true
+  },
+  "overrides": {
+    "qs": "^6.15.4"
+  }
 }

package/node_modules/pi-multi-account/package.json

@@ -78,7 +78,8 @@
     "access": "public"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": ">=0.85.1 <0.88.0"
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-ai": "*"
   },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "0.85.1",
@@ -93,7 +94,6 @@
   },
   "dependencies": {
     "@bufbuild/protobuf": "^2.14.0",
-    "@earendil-works/pi-ai": ">=0.85.1 <0.88.0",
     "proper-lockfile": "4.1.2"
   },
   "overrides": {

package/node_modules/pi-typesafe/README.md

@@ -140,7 +140,7 @@ if (!answer.ok) return { skipped: answer.errorCode === "budget" };  // never thr
 
 Your extension owns its own user consent and budget; `/typesafe enable` applies only to this package's tool. Check `authState()` rather than your own consent flag before you report that judgments are on.
 
-Judgments can also go through OpenRouter: `createTypeSafe({ backend: "openrouter" })` sends them to `openrouter.ai` with the key from `OPENROUTER_API_KEY`. That backend has no login store, so `/typesafe login` does not apply to it. Pass the same `backend` to `authState`, `keySituation`, and `ensureApiKey`, or the status you report describes the TypeSafe key while the requests use another one. The `/typesafe` commands and the `typesafe_evaluate` tool always use the TypeSafe backend. Every export — the client, `ask`, batching, the usage ledger, auth state, and the `pi-typesafe/calibrate` and `pi-typesafe/ui` entry points — is in [docs/api.md](docs/api.md).
+Judgments can also go through OpenRouter: `createTypeSafe({ backend: "openrouter" })` sends them to `openrouter.ai` with the key from `OPENROUTER_API_KEY`. Command Code serves the same protocol: `createTypeSafe({ backend: "commandcode" })` sends them to `api.commandcode.ai` with the key from `COMMANDCODE_API_KEY` and the model `typesafe/jev`. Or pass a `BackendEndpoint` object as `backend` to name any host that serves the protocol: it brings its own key variable, never reads `TYPESAFE_API_KEY`, and `backendHost()` reports its destination host for your consent text. These backends have no login store, so `/typesafe login` does not apply to them. Pass the same `backend` to `authState`, `keySituation`, and `ensureApiKey`, or the status you report describes the TypeSafe key while the requests use another one. The `/typesafe` commands and the `typesafe_evaluate` tool always use the TypeSafe backend. Every export — the client, `ask`, batching, the usage ledger, auth state, and the `pi-typesafe/calibrate` and `pi-typesafe/ui` entry points — is in [docs/api.md](docs/api.md).
 
 ## Development
 

package/node_modules/pi-typesafe/dist/auth.d.ts

@@ -1,4 +1,4 @@
-import type { TypeSafeBackend } from "./backends.js";
+import type { BackendSpec } from "./backends.js";
 import type { KeySource } from "./credentials.js";
 import { TypeSafeIntegrationError } from "./errors.js";
 import type { IntegrationErrorCode } from "./errors.js";
@@ -15,8 +15,8 @@ export interface AuthFailure {
  * that judgments will happen — an enabled extension with no key used to look identical to a working one.
  */
 export interface AuthState {
-    /** The judgment backend this state describes; each backend has its own key. */
-    readonly backend: TypeSafeBackend;
+    /** The judgment backend this state describes; each backend has its own key. Holds the value the caller passed. */
+    readonly backend: BackendSpec;
     /** Same kinds as KeySituation: where the key in effect comes from. */
     readonly kind: "environment" | "stored" | "missing" | "unusable";
     readonly source?: KeySource;
@@ -39,10 +39,14 @@ export interface AuthState {
 }
 /** The auth-state file: one small, owner-only record that outlives the process that wrote it. */
 export declare function authStatePath(): string;
-/** What the key situation, the last outcome, and the clock add up to for one backend. Never throws. */
+/**
+ * What the key situation, the last outcome, and the clock add up to for a valid backend; it never throws for one. An
+ * invalid backend throws the same `configuration` error as resolveBackend(), so validate a user-supplied endpoint
+ * with resolveBackend() first.
+ */
 export declare function authState(options?: {
     path?: string;
-    backend?: TypeSafeBackend;
+    backend?: BackendSpec;
 }): AuthState;
 /** Record that the key was accepted: login verification, or any successful request. Clears the last failure. */
 export declare function recordAuthVerified(at?: Date): void;

package/node_modules/pi-typesafe/dist/auth.js

@@ -1,6 +1,6 @@
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { DEFAULT_BACKEND, TYPESAFE_KEY_ENV, backendConfig, usesTypesafeKey } from "./backends.js";
+import { DEFAULT_BACKEND, TYPESAFE_KEY_ENV, resolveBackend, usesTypesafeKey } from "./backends.js";
 import { credentialsPath, keySituation, keySourceLabel, piTypesafeDir } from "./credentials.js";
 import { TypeSafeIntegrationError } from "./errors.js";
 const AUTH_VERSION = 1;
@@ -50,7 +50,11 @@ function writeState(path, state) {
         catch { /* best-effort cleanup only */ }
     }
 }
-/** What the key situation, the last outcome, and the clock add up to for one backend. Never throws. */
+/**
+ * What the key situation, the last outcome, and the clock add up to for a valid backend; it never throws for one. An
+ * invalid backend throws the same `configuration` error as resolveBackend(), so validate a user-supplied endpoint
+ * with resolveBackend() first.
+ */
 export function authState(options = {}) {
     const path = options.path ?? authStatePath();
     const backend = options.backend ?? DEFAULT_BACKEND;
@@ -99,7 +103,7 @@ export function clearAuthState() {
  * state instead of reporting "enabled".
  */
 export function describeAuth(state = authState()) {
-    const config = backendConfig(state.backend ?? DEFAULT_BACKEND);
+    const config = resolveBackend(state.backend);
     const label = `${config.label} key`;
     const since = state.lastFailure ? ` Last failure: ${state.lastFailure.message}${state.lastFailure.at ? ` (${state.lastFailure.at})` : ""}` : "";
     if (state.kind === "missing") {

package/node_modules/pi-typesafe/dist/backends.d.ts

@@ -1,6 +1,6 @@
-export type TypeSafeBackend = "typesafe" | "openrouter";
+export type TypeSafeBackend = "typesafe" | "openrouter" | "commandcode";
 export interface BackendConfig {
-    /** Human name for status lines: "TypeSafe", "OpenRouter". */
+    /** Human name for status lines: "TypeSafe", "OpenRouter", "Command Code". */
     label: string;
     host: string;
     /** The environment variable that carries this backend's key. Absent means the TypeSafe key resolution applies. */
@@ -16,11 +16,32 @@ export interface BackendConfig {
     /** Whether the model list checks the key. A public list accepts any key, so it proves nothing. Absent means it does. */
     modelsVerifyKey?: boolean;
 }
+/** A caller-supplied endpoint that serves the Jev decisions protocol. Passed per call; never added to the registry. */
+export interface BackendEndpoint extends BackendConfig {
+    /** Required. The environment variable with this endpoint's key. Must not be TYPESAFE_API_KEY. */
+    readonly keyEnv: string;
+    /** Model sent when the caller names none. Without it, `model` must be passed to createTypeSafe. */
+    readonly defaultModel?: string;
+}
+/** A registry name or a caller-supplied endpoint. */
+export type BackendSpec = TypeSafeBackend | BackendEndpoint;
+/** A backend resolved and validated: what the client will actually use. */
+export interface ResolvedBackend extends BackendConfig {
+    /** Registry name, absent for a caller-supplied endpoint. */
+    readonly name?: TypeSafeBackend;
+    /** Origin only: scheme, host, and port. */
+    readonly host: string;
+    readonly keyEnv: string;
+    /** The model id sent when the caller names none, already in the backend's form. Absent when the endpoint names none. */
+    readonly defaultModel?: string;
+    /** Always explicit after resolution. */
+    readonly modelsVerifyKey: boolean;
+}
 /** The backend every key and auth function assumes when none is named. */
 export declare const DEFAULT_BACKEND: TypeSafeBackend;
 /** The environment variable and login store that the default backend reads. */
 export declare const TYPESAFE_KEY_ENV = "TYPESAFE_API_KEY";
-/** Registry of known judgment backends. Extendable by callers. */
+/** Registry of known judgment backends. Callers pass a `BackendEndpoint` for a host this registry does not name. */
 export declare const DECISIONS_BACKENDS: Record<TypeSafeBackend, BackendConfig>;
 /** The registry entry for a backend name; a `configuration` error for a name the registry does not know. */
 export declare function backendConfig(name: TypeSafeBackend): BackendConfig;
@@ -39,3 +60,12 @@ export declare function defaultModelId(backend: TypeSafeBackend): string;
  * its own environment variable. Only the TypeSafe backend has a login store; every other backend is environment-only.
  */
 export declare function usesTypesafeKey(backend: BackendConfig): boolean;
+/**
+ * Resolve a registry name or a caller-supplied endpoint into the validated form the client uses. A name resolves to
+ * its registry entry unchanged; an endpoint is validated field by field and returned as a fresh object whose `host`
+ * is origin-only. Messages never quote a caller value — a host can carry credentials in its user info — except the
+ * label, and only after it is validated. Validation runs on every call; nothing is cached.
+ */
+export declare function resolveBackend(backend?: BackendSpec): ResolvedBackend;
+/** The destination host only — scheme, host, and port, e.g. `api.commandcode.ai` — for consent text. */
+export declare function backendHost(backend?: BackendSpec): string;

package/node_modules/pi-typesafe/dist/backends.js

@@ -3,7 +3,7 @@ import { TypeSafeIntegrationError } from "./errors.js";
 export const DEFAULT_BACKEND = "typesafe";
 /** The environment variable and login store that the default backend reads. */
 export const TYPESAFE_KEY_ENV = "TYPESAFE_API_KEY";
-/** Registry of known judgment backends. Extendable by callers. */
+/** Registry of known judgment backends. Callers pass a `BackendEndpoint` for a host this registry does not name. */
 export const DECISIONS_BACKENDS = {
     typesafe: { label: "TypeSafe", host: "https://api.typesafe.ai", keyEnv: TYPESAFE_KEY_ENV },
     openrouter: {
@@ -16,6 +16,16 @@ export const DECISIONS_BACKENDS = {
         modelsIdField: "id",
         modelsVerifyKey: false,
     },
+    commandcode: {
+        label: "Command Code",
+        host: "https://api.commandcode.ai",
+        keyEnv: "COMMANDCODE_API_KEY",
+        path: "/provider/v1/systemone",
+        modelsPath: "/provider/v1/models",
+        modelsField: "data",
+        modelsIdField: "id",
+        modelsVerifyKey: false,
+    },
 };
 /** The registry entry for a backend name; a `configuration` error for a name the registry does not know. */
 export function backendConfig(name) {
@@ -28,6 +38,7 @@ export function backendConfig(name) {
 const DEFAULT_MODEL = {
     typesafe: "jev-latest",
     openrouter: "typesafe/jev-1.13",
+    commandcode: "typesafe/jev",
 };
 /**
  * The model id to send for a caller's `model` on this backend. OpenRouter routes a bare Jev id under the `typesafe`
@@ -57,3 +68,86 @@ export function defaultModelId(backend) {
 export function usesTypesafeKey(backend) {
     return (backend.keyEnv ?? TYPESAFE_KEY_ENV) === TYPESAFE_KEY_ENV;
 }
+const KEY_ENV_MESSAGE = "Backend keyEnv must name an environment variable: letters, digits, and underscores, not starting with a digit.";
+const HOST_MESSAGE = "Backend host must be an absolute https: URL with no user info, path, query, or fragment (http: is allowed only for localhost, 127.0.0.0/8, and [::1]).";
+function refuse(message) {
+    throw new TypeSafeIntegrationError("configuration", message);
+}
+/** `https://gw.example.com?` and `https://gw.example.com#` parse clean, so the raw string itself must carry neither. */
+function hasRawQueryOrFragment(value) {
+    return value.includes("?") || value.includes("#");
+}
+/**
+ * Resolve a registry name or a caller-supplied endpoint into the validated form the client uses. A name resolves to
+ * its registry entry unchanged; an endpoint is validated field by field and returned as a fresh object whose `host`
+ * is origin-only. Messages never quote a caller value — a host can carry credentials in its user info — except the
+ * label, and only after it is validated. Validation runs on every call; nothing is cached.
+ */
+export function resolveBackend(backend) {
+    const spec = backend === undefined ? DEFAULT_BACKEND : backend;
+    if (typeof spec === "string") {
+        const entry = backendConfig(spec);
+        return {
+            ...entry,
+            name: spec,
+            host: entry.host,
+            keyEnv: entry.keyEnv ?? TYPESAFE_KEY_ENV,
+            defaultModel: defaultModelId(spec),
+            modelsVerifyKey: entry.modelsVerifyKey !== false,
+        };
+    }
+    if (spec === null || typeof spec !== "object") {
+        refuse("backend must be a registry name or a backend object.");
+    }
+    const label = typeof spec.label === "string" ? spec.label.trim() : "";
+    if (!label || label.length > 60)
+        refuse("Backend label must be a nonempty string of at most 60 characters.");
+    let host;
+    if (typeof spec.host !== "string" || hasRawQueryOrFragment(spec.host))
+        refuse(HOST_MESSAGE);
+    try {
+        host = new URL(spec.host);
+    }
+    catch {
+        refuse(HOST_MESSAGE);
+    }
+    const loopback = host.hostname === "localhost" || host.hostname === "[::1]" || /^127(?:\.\d{1,3}){3}$/.test(host.hostname);
+    if (host.protocol !== "https:" && !(host.protocol === "http:" && loopback))
+        refuse(HOST_MESSAGE);
+    if (host.username !== "" || host.password !== "" || host.pathname !== "/" || host.search !== "" || host.hash !== "")
+        refuse(HOST_MESSAGE);
+    for (const [field, message] of [["path", 'Backend path must be a string that starts with "/".'], ["modelsPath", 'Backend modelsPath must be a string that starts with "/".']]) {
+        const value = spec[field];
+        if (value !== undefined && (typeof value !== "string" || !value.startsWith("/") || hasRawQueryOrFragment(value)))
+            refuse(message);
+    }
+    if (spec.modelsField !== undefined && (typeof spec.modelsField !== "string" || !spec.modelsField))
+        refuse("Backend modelsField must be a nonempty string.");
+    if (spec.modelsIdField !== undefined && (typeof spec.modelsIdField !== "string" || !spec.modelsIdField))
+        refuse("Backend modelsIdField must be a nonempty string.");
+    if (spec.modelsVerifyKey !== undefined && typeof spec.modelsVerifyKey !== "boolean")
+        refuse("Backend modelsVerifyKey must be a boolean.");
+    if (typeof spec.keyEnv !== "string" || !/^[A-Za-z_][A-Za-z0-9_]*$/.test(spec.keyEnv))
+        refuse(KEY_ENV_MESSAGE);
+    if (spec.keyEnv.toUpperCase() === TYPESAFE_KEY_ENV) {
+        refuse("Backend keyEnv must not be TYPESAFE_API_KEY: the TypeSafe key is only sent to the typesafe backend. Give this endpoint its own variable.");
+    }
+    if (spec.defaultModel !== undefined && (typeof spec.defaultModel !== "string" || !spec.defaultModel.trim() || spec.defaultModel.length > 100)) {
+        refuse("Backend defaultModel must be a nonempty string of at most 100 characters.");
+    }
+    return {
+        label,
+        host: host.origin,
+        keyEnv: spec.keyEnv,
+        modelsVerifyKey: spec.modelsVerifyKey === true,
+        ...(spec.path === undefined ? {} : { path: spec.path }),
+        ...(spec.modelsPath === undefined ? {} : { modelsPath: spec.modelsPath }),
+        ...(spec.modelsField === undefined ? {} : { modelsField: spec.modelsField }),
+        ...(spec.modelsIdField === undefined ? {} : { modelsIdField: spec.modelsIdField }),
+        ...(spec.defaultModel === undefined ? {} : { defaultModel: spec.defaultModel }),
+    };
+}
+/** The destination host only — scheme, host, and port, e.g. `api.commandcode.ai` — for consent text. */
+export function backendHost(backend) {
+    return new URL(resolveBackend(backend).host).host;
+}

package/node_modules/pi-typesafe/dist/client.d.ts

@@ -1,14 +1,14 @@
 import type { Fetch, Questions, SystemOneRequest, SystemOneResult } from "@typesafe-ai/sdk";
-import type { TypeSafeBackend } from "./backends.js";
+import type { BackendSpec } from "./backends.js";
 import type { BatchEvaluation, BatchOptions } from "./batch.js";
 import type { BlockedCap, SpendCaps, UsageLedger, UsageReport } from "./usage.js";
-export { DECISIONS_BACKENDS, DEFAULT_BACKEND } from "./backends.js";
-export type { BackendConfig, TypeSafeBackend } from "./backends.js";
+export { backendHost, resolveBackend, DECISIONS_BACKENDS, DEFAULT_BACKEND } from "./backends.js";
+export type { BackendConfig, BackendEndpoint, BackendSpec, ResolvedBackend, TypeSafeBackend } from "./backends.js";
 export interface TypeSafeOptions {
     /** Defaults to TYPESAFE_API_KEY, then the key saved by `/typesafe login`; never returned. */
     apiKey?: string;
-    /** Judgment backend. When omitted, routes to the default TypeSafe host. */
-    backend?: TypeSafeBackend;
+    /** Judgment backend: a registry name or a caller-supplied endpoint. When omitted, routes to the default TypeSafe host. */
+    backend?: BackendSpec;
     /** Defaults to the backend's own default (`jev-latest`, `typesafe/jev-1.13` on OpenRouter); a bare Jev id is mapped to the backend's id form before sending. No model is inferred from submitted content. */
     model?: string;
     /** Per request. Default: 15 seconds. No automatic retries. */