@intutic/sync-daemon 2.2.0 → 2.3.0

package/dist/harness/openhandsHooks.js

@@ -7,7 +7,6 @@
  * The hooks file lives within the agent's sandbox working directory,
  * so we also register it with the drift watcher.
  *
- * LLD #14 — Phase 3 cross-harness defence
  * HLD §3.14 — Three-Tier Defense Cascade
  *
  * @module
@@ -18,10 +17,29 @@ import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
 import { keepOriginal, noteWritten } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
-import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
+import { emitShellGate, SHELL_EXTRACT, emitShellFailClosed } from './gateBody.js';
 import { parse as parseToml } from 'smol-toml';
-import { anthropicBaseUrl, openaiBaseUrl } from '@intutic/shared-types';
+import { anthropicBaseUrl, openaiBaseUrl, HOOK_TIMEOUT_SECONDS } from '@intutic/shared-types';
 const log = createLogger('sync-openhands-hooks');
+/**
+ * `.openhands/hooks.json` in the OpenHands SDK's schema (\`HookConfig\`): each
+ * event a list of matchers, each with its hook definitions. Earlier versions
+ * wrote a flat list of \`{type: 'PreToolUse', command, failClosed}\`, which the
+ * SDK cannot load, and had extra top-level keys beside \`hooks\`, which it
+ * drops with a warning; the marker that tells disconnect the file is ours is
+ * now each hook's \`name\`. OpenHands runs a call whose hook times out, and
+ * has no setting to refuse instead, so the gate refuses at its own deadline,
+ * inside the \`timeout\` set here (default 60 s).
+ */
+export function openHandsHooksConfig(hookScriptPath) {
+    const hook = (command) => ({ type: 'command', name: 'Intutic governance hook', command, timeout: HOOK_TIMEOUT_SECONDS });
+    return {
+        hooks: {
+            PreToolUse: [{ matcher: '*', hooks: [hook(hookScriptPath)] }],
+            Stop: [{ matcher: '*', hooks: [hook(`${hookScriptPath} --event stop`)] }],
+        },
+    };
+}
 /**
  * Write .openhands/hooks.json and the pre-tool-check shell script.
  * Also points `[llm] base_url` in ~/.openhands/config.toml at the proxy when
@@ -52,7 +70,7 @@ export async function writeOpenHandsHooks(workspaceRoot, proxyUrl, workspaceId =
 # Proxy: ${proxyUrl}
 # Generated: ${newIso()}
 set -euo pipefail
-${SHELL_FAIL_CLOSED}
+${emitShellFailClosed('openhands')}
 INPUT="$(cat)"
 ${SHELL_EXTRACT}
 
@@ -92,7 +110,11 @@ log_event() {
   ws="\${ws//\\\\/\\\\\\\\}"; ws="\${ws//\\"/\\\\\\"}"; ws="\${ws//[\$'\\x01'-\$'\\x1f']/ }"
   local ts; ts="\$(date -u +%Y-%m-%dT%H:%M:%SZ)"
   local incident_id; incident_id="\$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo \"\$(date +%s)\")"
-  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"openhands\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\"}"
+  # The event's id: random, made once here, and resent with the line it is
+  # written into, so the control plane processes the event once.
+  local event_id; event_id="\$(od -An -N16 -tx1 /dev/urandom 2>/dev/null | tr -d ' \\n' || true)"
+  [ -n "\$event_id" ] || event_id="\$(date +%s)\$\$\${RANDOM}\${RANDOM}\${RANDOM}"
+  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"openhands\\",\\"timestamp\\":\\"\${ts}\\",\\"incidentId\\":\\"\${incident_id}\\",\\"eventId\\":\\"\${event_id}\\"}"
   # Path B: reliable file append
   printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
   # Path A: fire-and-forget HTTP (non-blocking, near-real-time)
@@ -114,23 +136,7 @@ exit 0
     await fs.rename(tmpScript, hookScriptPath);
     await fs.chmod(hookScriptPath, 0o755);
     // ── .openhands/hooks.json ──────────────────────────────────────────
-    const hooksConfig = {
-        _comment: 'Intutic governance hooks — auto-generated. DO NOT EDIT.',
-        _lastSync: newIso(),
-        hooks: [
-            {
-                type: 'PreToolUse',
-                command: hookScriptPath,
-                failClosed: true,
-            },
-            {
-                type: 'Stop',
-                command: `${hookScriptPath} --event stop`,
-                failClosed: false,
-            },
-        ],
-    };
-    const hooksJson = JSON.stringify(hooksConfig, null, 2) + '\n';
+    const hooksJson = JSON.stringify(openHandsHooksConfig(hookScriptPath), null, 2) + '\n';
     const tmpHooks = hooksPath + '.intutic-tmp';
     await fs.writeFile(tmpHooks, hooksJson, 'utf-8');
     await fs.rename(tmpHooks, hooksPath);
@@ -138,7 +144,7 @@ exit 0
     log.info({ action: 'openhands_hooks_written', path: hooksPath }, 'OpenHands hooks written');
     // ── user-level config.toml llm.base_url ───────────────────────────
     // The workspace config.toml is the adapter's: it merges `[llm] base_url`
-    // and the `[intutic]` table there (`mergeOpenHandsToml`).
+    // there (`mergeOpenHandsToml`).
     await mergeUserOpenHandsConfig(proxyUrl);
 }
 /**
@@ -256,37 +262,32 @@ export function mergeOpenHandsBaseUrl(raw, proxyUrl) {
     return next;
 }
 /**
- * Merge Intutic's keys into an OpenHands `config.toml`:
- * - `[llm] base_url` — the proxy, in the form the configured model's SDK
- *   expects (LiteLLM appends `/v1/messages` to an Anthropic base and
- *   `/chat/completions` to an OpenAI-style one);
- * - an `[intutic]` table carrying the SOP text, replaced whole each sync.
+ * Point `[llm] base_url` in the workspace's OpenHands `config.toml` at the
+ * proxy, in the form the configured model's SDK expects (LiteLLM appends
+ * `/v1/messages` to an Anthropic base and `/chat/completions` to an
+ * OpenAI-style one), and keep the rest of the file.
+ *
+ * Earlier versions also wrote the rule sets into an `[intutic]` table, which
+ * OpenHands never reads (the rules now go into a microagent, see the
+ * adapter); that table is dropped. Earlier still, versions replaced the
+ * whole file, so a file starting with their header holds nothing of the
+ * user's and is regenerated.
  *
  * Edited line by line so the user's own settings and comments survive; the
- * result is parsed before it is returned. Earlier versions replaced the whole
- * file, so a file starting with their header holds nothing of the user's and
- * is regenerated. Returns `null` when the existing file is not valid TOML.
+ * result is parsed before it is returned. Returns `null` when the existing
+ * file is not valid TOML.
  */
-export function mergeOpenHandsToml(raw, proxyUrl, instructions) {
+export function mergeOpenHandsToml(raw, proxyUrl) {
     const source = raw.startsWith(LEGACY_HEADER) ? '' : raw;
-    const parsed = parsesAsToml(source);
-    if (parsed === null)
+    if (parsesAsToml(source) === null)
         return null;
-    const baseUrl = llmBaseUrl(parsed, proxyUrl);
-    let lines = source.split('\n');
-    // Drop the previous [intutic] table; it is rewritten whole below.
+    const lines = source.split('\n');
     const oldIntutic = tableStart(lines, 'intutic');
-    if (oldIntutic !== -1)
+    if (oldIntutic !== -1) {
         lines.splice(oldIntutic, tableEnd(lines, oldIntutic) - oldIntutic);
-    setLlmBaseUrl(lines, baseUrl);
-    while (lines.length > 0 && lines[lines.length - 1].trim() === '')
-        lines.pop();
-    const escaped = instructions.replace(/\\/g, '\\\\').replace(/"""/g, '\\"\\"\\"');
-    lines = [...lines, '', '[intutic]', `proxy_url = ${JSON.stringify(proxyUrl)}`, `instructions = """\n${escaped}\n"""`, ''];
-    const next = (lines[0] === '' ? lines.slice(1) : lines).join('\n');
-    const check = parsesAsToml(next);
-    if (check === null || check['llm']?.['base_url'] !== baseUrl)
-        return null;
-    return next;
+        while (lines.length > 1 && lines[lines.length - 1].trim() === '' && lines[lines.length - 2].trim() === '')
+            lines.pop();
+    }
+    return mergeOpenHandsBaseUrl(lines.join('\n'), proxyUrl);
 }
 //# sourceMappingURL=openhandsHooks.js.map

package/dist/harness/openhandsHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"openhandsHooks.js","sourceRoot":"","sources":["../../src/harness/openhandsHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACvD,8EAA8E;IAC9E,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IAErE,0CAA0C;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,sEAAsE;IACtE,gEAAgE;IAChE,gCAAgC;IAChC,MAAM,UAAU,GAAG;;;WAGV,QAAQ;eACJ,MAAM,EAAE;;EAErB,iBAAiB;;EAEjB,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuChD,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;;;CAGxC,CAAA;IAEC,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,sEAAsE;IACtE,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,yDAAyD;QACnE,SAAS,EAAE,MAAM,EAAE;QACnB,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,YAAY;gBAClB,OAAO,EAAE,cAAc;gBACvB,UAAU,EAAE,IAAI;aACjB;YACD;gBACE,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,GAAG,cAAc,eAAe;gBACzC,UAAU,EAAE,KAAK;aAClB;SACF;KACF,CAAA;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IAC7D,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACpC,MAAM,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;IAEtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,CAAC,CAAA;IAE3F,qEAAqE;IACrE,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,QAAgB;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;IACvE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,qCAAqC,CAAC,CAAA;QAC5H,OAAM;IACR,CAAC;IACD,IAAI,IAAI,KAAK,GAAG;QAAE,OAAM;IACxB,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;IAC7C,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,mDAAmD,CAAC,CAAA;AACzH,CAAC;AAED,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,aAAa,GAAG,6CAA6C,CAAA;AAEnE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAA4B,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACvH,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAe,EAAE,KAAa;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,MAA+B,EAAE,QAAgB;IACnE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC5D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAe,EAAE,OAAe;IACrD,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,GAAG,EAAE,CAAA;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACjG,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;;QAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,KAAK,IAAI,IAAK,KAAK,CAAC,KAAK,CAAyC,EAAE,CAAC,UAAU,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAClH,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB,EAAE,YAAoB;IACpF,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAA;IACnC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAEhC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5C,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAE9B,kEAAkE;IAClE,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,CAAA;IAEzF,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAE7B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IAC7E,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAChF,KAAK,GAAG,CAAC,GAAG,KAAK,EAAE,EAAE,EAAE,WAAW,EAAE,eAAe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,EAAE,uBAAuB,OAAO,OAAO,EAAE,EAAE,CAAC,CAAA;IACzH,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAElE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,KAAK,IAAI,IAAK,KAAK,CAAC,KAAK,CAAyC,EAAE,CAAC,UAAU,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAClH,OAAO,IAAI,CAAA;AACb,CAAC"}
+{"version":3,"file":"openhandsHooks.js","sourceRoot":"","sources":["../../src/harness/openhandsHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACjF,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAA;AAC9C,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAA;AAE7F,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAA;AAEhD;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,cAAsB;IACzD,MAAM,IAAI,GAAG,CAAC,OAAe,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAA;IAChI,OAAO;QACL,KAAK,EAAE;YACL,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,cAAc,eAAe,CAAC,CAAC,EAAE,CAAC;SAC1E;KACF,CAAA;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,YAAY,CAAC,CAAA;IAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,CAAC,CAAA;IACvD,8EAA8E;IAC9E,MAAM,YAAY,CAAC,SAAS,EAAE,aAAa,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEjD,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,oBAAoB,CAAC,CAAA;IAErE,0CAA0C;IAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,sEAAsE;IACtE,gEAAgE;IAChE,gCAAgC;IAChC,MAAM,UAAU,GAAG;;;WAGV,QAAQ;eACJ,MAAM,EAAE;;EAErB,mBAAmB,CAAC,WAAW,CAAC;;EAEhC,aAAa;;kBAEG,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;uBAUxB,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2ChD,aAAa,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,CAAC;;;CAGxC,CAAA;IAEC,MAAM,SAAS,GAAG,cAAc,GAAG,SAAS,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClD,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,sEAAsE;IACtE,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAA;IACtF,MAAM,QAAQ,GAAG,SAAS,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;IACpC,MAAM,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;IAEtD,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,yBAAyB,CAAC,CAAA;IAE3F,qEAAqE;IACrE,yEAAyE;IACzE,gCAAgC;IAChC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,CAAA;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,wBAAwB,CAAC,QAAgB;IACtD,IAAI,CAAC,QAAQ;QAAE,OAAM;IACrB,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;IACvE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACjD,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,gCAAgC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,GAAG,UAAU,qCAAqC,CAAC,CAAA;QAC5H,OAAM;IACR,CAAC;IACD,IAAI,IAAI,KAAK,GAAG;QAAE,OAAM;IACxB,MAAM,SAAS,GAAG,UAAU,GAAG,cAAc,CAAA;IAC7C,MAAM,YAAY,CAAC,UAAU,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5C,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IACtC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,mDAAmD,CAAC,CAAA;AACzH,CAAC;AAED,gFAAgF;AAEhF,8EAA8E;AAC9E,MAAM,aAAa,GAAG,6CAA6C,CAAA;AAEnE,SAAS,YAAY,CAAC,IAAY;IAChC,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,CAA4B,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,CAAC,CAAA;AAE7E;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IACjC,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACvH,CAAC;AAED,yDAAyD;AACzD,SAAS,UAAU,CAAC,KAAe,EAAE,IAAY;IAC/C,OAAO,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,GAAG,CAAC,CAAA;AACzD,CAAC;AAED,sEAAsE;AACtE,SAAS,QAAQ,CAAC,KAAe,EAAE,KAAa;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED,oEAAoE;AACpE,SAAS,UAAU,CAAC,MAA+B,EAAE,QAAgB;IACnE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAA4B,CAAA;IAC5D,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClE,OAAO,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAe,EAAE,OAAe;IACrD,MAAM,QAAQ,GAAG,cAAc,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAA;IACxD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IACzC,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,GAAG,EAAE,CAAA;QAC7E,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QACrC,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,QAAQ,IAAI,CAAC,GAAG,GAAG,IAAI,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;IACjG,IAAI,QAAQ,KAAK,CAAC,CAAC;QAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;;QAC1C,KAAK,CAAC,MAAM,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW,EAAE,QAAgB;IACjE,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7B,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;IAC7B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAClE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAChC,IAAI,KAAK,KAAK,IAAI,IAAK,KAAK,CAAC,KAAK,CAAyC,EAAE,CAAC,UAAU,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAA;IAClH,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW,EAAE,QAAgB;IAC9D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAA;IACvD,IAAI,YAAY,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAChC,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAA;IAC/C,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,UAAU,CAAC,CAAA;QAClE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IACxH,CAAC;IACD,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC1D,CAAC"}

package/dist/harness/piHooks.d.ts

@@ -1,22 +1,54 @@
 /**
- * piHooks.ts — Pi (earendil-works/pi) coding agent governance hook injection.
+ * piHooks.ts — Pi (earendil-works/pi) extension gate and provider routing.
  *
- * Pi uses:
- * - `~/.pi/hooks.json` for PreToolUse hook matchers (stdin JSON, exit 2 = block)
- * - `~/.pi/models.json` for per-provider base URL routing
+ * Pi has no hook file. Its hooks are extensions: TypeScript or JavaScript
+ * modules it loads into its own process from `~/.pi/agent/extensions/` (and a
+ * trusted project's `.pi/extensions/`), each a default-exported factory that
+ * receives the `ExtensionAPI`. Earlier versions of this writer registered a
+ * Claude-Code-style `PreToolUse` hook in `~/.pi/hooks.json`, a file Pi never
+ * reads, and pointed providers at the proxy in `~/.pi/models.json`, where Pi
+ * does not look either: both live in the agent directory, `~/.pi/agent`.
+ * Sources, at earendil-works/pi 6fb2e7815167e6b19006fc526d1a5d0f5f998787:
  *
- * This module:
- * 1. Writes/merges `~/.pi/hooks.json` with intutic-governance hook entries.
- * 2. Writes/merges `~/.pi/models.json` to redirect LLM providers via proxyUrl.
- * 3. Writes `~/.intutic/hooks/pi-check.sh` — dual-path bash governance hook.
- * 4. Writes `.intutic/env/pi.env` — env snippet for IDE/shell integration.
+ * - discovery: `packages/coding-agent/src/core/extensions/loader.ts`
+ *   (`discoverExtensionsInDir`: direct `*.ts`/`*.js` files, or `<dir>/index.*`;
+ *   loaded with jiti, `{ default: true }`, and the default export must be a
+ *   function), `packages/coding-agent/docs/configuration.md` (the agent
+ *   directory and `models.json`);
+ * - the hook: `pi.on("tool_call", handler)`, with
+ *   `event = { type: "tool_call", toolName, toolCallId, input }`, refused by
+ *   returning `{ block: true, reason }` (`core/extensions/types.ts`,
+ *   `ToolCallEventResult`). The agent loop turns the reason into the error
+ *   result the model reads (`packages/agent/src/agent-loop.ts`).
+ * - failure: "A `tool_call` handler failure blocks the tool as a fail-safe"
+ *   (`docs/extensions.md`); `ExtensionRunner.emitToolCall` awaits each
+ *   handler with no timeout (`core/extensions/runner.ts`), so a handler that
+ *   hangs hangs Pi. The gate body therefore runs under its own deadline
+ *   (`gateDeadlineMs('pi')`), from the start of each call, and refuses past it.
  *
- * WS-C3 — Pi harness (Phase 3 cross-harness defence)
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
- * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ * The extension embeds the shared `emitJsGate` body (`'throw'` contract) and
+ * returns Pi's block result for the refusal it throws; any other fault is a
+ * block too. Pi names MCP tools `mcp__<server>__<tool>` already
+ * (`docs/mcp.md`), and calls a tool makes through `ctx.executeTool()` pass
+ * through `tool_call` handlers like the model's own (`docs/extensions.md`).
+ *
+ * The file is ESM with `createRequire`, the shape the OpenCode plugin uses:
+ * Node (Pi needs 22.19 or later) detects the module syntax, and jiti
+ * transforms the file where native loading fails and in Pi's compiled binary
+ * (`core/extensions/jiti-loader.ts`, `loader.ts`).
+ *
+ * Only the default agent directory is written. A user who moves it with
+ * `PI_CODING_AGENT_DIR` copies the extension there (the Pi integration page
+ * says so).
  *
  * @module
  */
+/** Pi's default agent directory, relative to the home directory. */
+export declare const PI_AGENT_DIR: string;
+/** The extension file, relative to the home directory. */
+export declare const PI_EXTENSION_FILE: string;
+/** The first line of the extension's header, which disconnect recognises it by. */
+export declare const PI_EXTENSION_MARKER = "Intutic Pi governance extension.";
 interface PiProvider {
     baseUrl?: string;
     [key: string]: unknown;
@@ -25,20 +57,23 @@ interface PiModelsConfig {
     providers?: Record<string, PiProvider>;
     [key: string]: unknown;
 }
+export declare function buildPiExtension(proxyUrl: string, workspaceRoot: string, workspaceId: string): string;
 /**
  * Merge Pi models.json — point the anthropic and openai providers at the
  * proxy, each with the base URL its SDK expects (the Anthropic SDK appends
  * `/v1/messages`, the OpenAI one `/chat/completions`). Google is left alone:
  * the proxy does not serve the Gemini API, so routing it there would break it.
- * Every other provider and key is kept.
+ * Every other provider and key is kept. A provider entry may carry `baseUrl`
+ * alone (`ProviderConfigSchema` in `packages/coding-agent/src/core/model-config.ts`).
  */
 export declare function mergePiModels(existing: PiModelsConfig, proxyUrl: string): PiModelsConfig;
 /**
- * Write the Pi governance hook script, merge hooks.json and models.json,
- * and write the env snippet.
+ * Write the Pi governance extension into `~/.pi/agent/extensions/` and merge
+ * the proxy routing into `~/.pi/agent/models.json`.
  *
- * Safe to call repeatedly — uses atomic rename so partial writes never
- * leave a corrupt state.
+ * Safe to call repeatedly: atomic renames and a fixed file name, so repeated
+ * syncs replace rather than stack. Pi discovers the extension by scanning the
+ * directory; nothing registers it.
  *
  * @param workspaceRoot - Absolute workspace root path.
  * @param proxyUrl      - Intutic proxy URL for LLM provider routing.

package/dist/harness/piHooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"piHooks.d.ts","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAyCH,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAyHD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAmBxF;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CA+Ef"}
+{"version":3,"file":"piHooks.d.ts","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAcH,oEAAoE;AACpE,eAAO,MAAM,YAAY,QAA4B,CAAA;AAErD,0DAA0D;AAC1D,eAAO,MAAM,iBAAiB,QAAiE,CAAA;AAE/F,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,qCAAqC,CAAA;AAErE,UAAU,UAAU;IAClB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,UAAU,cAAc;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACtC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAID,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAyHrG;AAID;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAmBxF;AAID;;;;;;;;;;;GAWG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,WAAW,SAAK,GACf,OAAO,CAAC,IAAI,CAAC,CAmBf"}