@intutic/sync-daemon 2.2.0 → 2.3.0

package/dist/harness/piHooks.js

@@ -1,19 +1,45 @@
 /**
- * piHooks.ts — Pi (earendil-works/pi) coding agent governance hook injection.
+ * piHooks.ts — Pi (earendil-works/pi) extension gate and provider routing.
  *
- * Pi uses:
- * - `~/.pi/hooks.json` for PreToolUse hook matchers (stdin JSON, exit 2 = block)
- * - `~/.pi/models.json` for per-provider base URL routing
+ * Pi has no hook file. Its hooks are extensions: TypeScript or JavaScript
+ * modules it loads into its own process from `~/.pi/agent/extensions/` (and a
+ * trusted project's `.pi/extensions/`), each a default-exported factory that
+ * receives the `ExtensionAPI`. Earlier versions of this writer registered a
+ * Claude-Code-style `PreToolUse` hook in `~/.pi/hooks.json`, a file Pi never
+ * reads, and pointed providers at the proxy in `~/.pi/models.json`, where Pi
+ * does not look either: both live in the agent directory, `~/.pi/agent`.
+ * Sources, at earendil-works/pi 6fb2e7815167e6b19006fc526d1a5d0f5f998787:
  *
- * This module:
- * 1. Writes/merges `~/.pi/hooks.json` with intutic-governance hook entries.
- * 2. Writes/merges `~/.pi/models.json` to redirect LLM providers via proxyUrl.
- * 3. Writes `~/.intutic/hooks/pi-check.sh` — dual-path bash governance hook.
- * 4. Writes `.intutic/env/pi.env` — env snippet for IDE/shell integration.
+ * - discovery: `packages/coding-agent/src/core/extensions/loader.ts`
+ *   (`discoverExtensionsInDir`: direct `*.ts`/`*.js` files, or `<dir>/index.*`;
+ *   loaded with jiti, `{ default: true }`, and the default export must be a
+ *   function), `packages/coding-agent/docs/configuration.md` (the agent
+ *   directory and `models.json`);
+ * - the hook: `pi.on("tool_call", handler)`, with
+ *   `event = { type: "tool_call", toolName, toolCallId, input }`, refused by
+ *   returning `{ block: true, reason }` (`core/extensions/types.ts`,
+ *   `ToolCallEventResult`). The agent loop turns the reason into the error
+ *   result the model reads (`packages/agent/src/agent-loop.ts`).
+ * - failure: "A `tool_call` handler failure blocks the tool as a fail-safe"
+ *   (`docs/extensions.md`); `ExtensionRunner.emitToolCall` awaits each
+ *   handler with no timeout (`core/extensions/runner.ts`), so a handler that
+ *   hangs hangs Pi. The gate body therefore runs under its own deadline
+ *   (`gateDeadlineMs('pi')`), from the start of each call, and refuses past it.
  *
- * WS-C3 — Pi harness (Phase 3 cross-harness defence)
- * LLD #14 — Phase 3 cross-harness defence (Gap 3)
- * HLD §3.14 — Three-Tier Defense Cascade (Tier 1 Native Gating)
+ * The extension embeds the shared `emitJsGate` body (`'throw'` contract) and
+ * returns Pi's block result for the refusal it throws; any other fault is a
+ * block too. Pi names MCP tools `mcp__<server>__<tool>` already
+ * (`docs/mcp.md`), and calls a tool makes through `ctx.executeTool()` pass
+ * through `tool_call` handlers like the model's own (`docs/extensions.md`).
+ *
+ * The file is ESM with `createRequire`, the shape the OpenCode plugin uses:
+ * Node (Pi needs 22.19 or later) detects the module syntax, and jiti
+ * transforms the file where native loading fails and in Pi's compiled binary
+ * (`core/extensions/jiti-loader.ts`, `loader.ts`).
+ *
+ * Only the default agent directory is written. A user who moves it with
+ * `PI_CODING_AGENT_DIR` copies the extension there (the Pi integration page
+ * says so).
  *
  * @module
  */
@@ -21,127 +47,149 @@ import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
 import * as os from 'node:os';
 import { createLogger } from '@intutic/logger';
-import { keepOriginal } from '../disconnect/originals.js';
+import { keepOriginal, writeOwnedFile } from '../disconnect/originals.js';
 import { newIso } from '@intutic/id';
-import { emitShellGate, SHELL_EXTRACT, SHELL_FAIL_CLOSED } from './gateBody.js';
+import { emitJsGate, REVIEW_REQUESTS_BASENAME } from './gateBody.js';
 import { readJsonObjectForMerge } from './jsonMergeTarget.js';
 import { anthropicBaseUrl, openaiBaseUrl } from '@intutic/shared-types';
 const log = createLogger('sync-pi-hooks');
-/** Path to the Pi hooks config. */
-const PI_HOOKS_CONFIG = path.join(os.homedir(), '.pi', 'hooks.json');
-/** Path to the Pi models config. */
-const PI_MODELS_CONFIG = path.join(os.homedir(), '.pi', 'models.json');
-// ─── Bash hook script template ────────────────────────────────────────────────
-function buildPiCheckScript(proxyUrl, workspaceRoot, workspaceId) {
+/** Pi's default agent directory, relative to the home directory. */
+export const PI_AGENT_DIR = path.join('.pi', 'agent');
+/** The extension file, relative to the home directory. */
+export const PI_EXTENSION_FILE = path.join(PI_AGENT_DIR, 'extensions', 'intutic-governance.js');
+/** The first line of the extension's header, which disconnect recognises it by. */
+export const PI_EXTENSION_MARKER = 'Intutic Pi governance extension.';
+// ─── The extension ───────────────────────────────────────────────────────────
+export function buildPiExtension(proxyUrl, workspaceRoot, workspaceId) {
     const hookEventsLog = path.join(workspaceRoot, '.intutic', 'events', 'hook-events.jsonl');
-    const runtimeEnv = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
-    return `#!/usr/bin/env bash
-# Intutic Pi (earendil-works/pi) PreToolUse governance gate.
-# Auto-generated by intutic sync-daemon. DO NOT EDIT.
-# Proxy: ${proxyUrl}
-# Generated: ${newIso()}
-# Workspace: ${workspaceId}
-set -euo pipefail
-${SHELL_FAIL_CLOSED}
-# Source runtime credentials (never embedded in this file)
-if [ -f "${runtimeEnv}" ]; then
-  # shellcheck disable=SC1090
-  source "${runtimeEnv}"
-fi
-
-INTUTIC_HOST="\${INTUTIC_HOST:-https://api.intutic.ai}"
-INTUTIC_API_KEY="\${INTUTIC_API_KEY:-}"
-INTUTIC_WORKSPACE_ID="\${INTUTIC_WORKSPACE_ID:-${workspaceId}}"
+    return `/**
+ * ${PI_EXTENSION_MARKER}
+ * Auto-generated by intutic sync-daemon. DO NOT EDIT.
+ * Proxy: ${proxyUrl}
+ * Generated: ${newIso()}
+ *
+ * A tool_call handler Pi loads from its extensions directory. Refuses a tool
+ * call by returning { block: true, reason }. See
+ * services/sync-daemon/src/harness/piHooks.ts.
+ */
+import { createRequire } from 'node:module';
+const require = createRequire(import.meta.url);
+const path = require('path');
+const os = require('os');
+const fs = require('fs');
+const crypto = require('crypto');
+const https = require('https');
 
-INPUT="$(cat)"
-${SHELL_EXTRACT}
+// Runtime credentials, read when Pi loads the extension.
+const _runtimeEnvPath = path.join(os.homedir(), '.intutic', 'env', 'runtime.env');
+let _intuticHost = 'https://api.intutic.ai', _intuticKey = '', _intuticWsId = ${JSON.stringify(workspaceId)};
+try {
+  fs.readFileSync(_runtimeEnvPath, 'utf-8').split('\\n').forEach(line => {
+    const eq = line.indexOf('='); if (eq < 0) return;
+    const k = line.slice(0, eq).trim(), v = line.slice(eq + 1).trim();
+    if (k === 'INTUTIC_HOST' && v) _intuticHost = v;
+    if (k === 'INTUTIC_API_KEY' && v) _intuticKey = v;
+    if (k === 'INTUTIC_WORKSPACE_ID' && v) _intuticWsId = v;
+  });
+} catch {}
 
-HOOK_EVENTS_LOG="${hookEventsLog}"
+${emitJsGate({ harness: 'pi', contract: 'throw', reviewRequestFile: path.join(workspaceRoot, '.intutic', 'events', REVIEW_REQUESTS_BASENAME) })}
 
-log_event() {
-  local verdict="$1" tool="$2" reason="$3"
-  # \`tool\`, \`reason\` and \`SESSION_ID\` carry agent-controlled text — the tool
-  # name, the target path quoted into the block reason, and a field lifted
-  # straight out of the hook's stdin — and all three are spliced into the JSON
-  # string below. Escape first: one unescaped quote yields a line JSON.parse
-  # rejects, and drainHookEvents drops malformed lines then wipes the log on a
-  # successful drain, so the record of a block is destroyed rather than delayed.
-  # A crafted path could otherwise close the string and forge fields.
-  tool="\${tool//\\\\/\\\\\\\\}";     tool="\${tool//\\"/\\\\\\"}"
-  reason="\${reason//\\\\/\\\\\\\\}"; reason="\${reason//\\"/\\\\\\"}"
-  # Every C0 control character, not just newline and carriage return. JSON
-  # forbids all of U+0000-U+001F unescaped, so a plain TAB in a filename — no
-  # adversary required — was still enough to produce a line JSON.parse rejects.
-  # (NUL cannot appear in a bash variable, so the range starts at \\x01.)
-  tool="\${tool//[\$'\\x01'-\$'\\x1f']/ }"; reason="\${reason//[\$'\\x01'-\$'\\x1f']/ }"
-  # The workspace id is spliced into the same JSON string. It comes from
-  # runtime.env on disk rather than from the agent, so it is lower risk — but a
-  # value with a quote in it breaks every audit line the same way, and "lower
-  # risk" is not "cannot happen" for a file the operator edits by hand.
-  local ws="\${INTUTIC_WORKSPACE_ID}"
-  ws="\${ws//\\\\/\\\\\\\\}"; ws="\${ws//\\"/\\\\\\"}"; ws="\${ws//[\$'\\x01'-\$'\\x1f']/ }"
-  local sid="\$SESSION_ID"
-  sid="\${sid//\\\\/\\\\\\\\}"; sid="\${sid//\\"/\\\\\\"}"
-  sid="\${sid//\$'\\n'/ }";     sid="\${sid//\$'\\r'/ }"
-  local ts; ts="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
-  # incidentId = sha1(timestamp + toolName + workspaceId).slice(0,16)
-  local incident_id; incident_id="$(printf '%s' "\${ts}\${tool}\${INTUTIC_WORKSPACE_ID}" | sha1sum 2>/dev/null | cut -c1-16 || echo "$(date +%s)")"
-  local entry="{\\"event\\":\\"\${verdict}\\",\\"toolName\\":\\"\${tool}\\",\\"reason\\":\\"\${reason}\\",\\"workspaceId\\":\\"\${ws}\\",\\"harnessType\\":\\"pi\\",\\"incidentId\\":\\"\${incident_id}\\",\\"timestamp\\":\\"\${ts}\\"\${sid:+,\\"sessionId\\":\\"\${sid}\\"}}"
-  # Path B: reliable file append (sync-daemon drains on FSEvents change)
-  printf '%s\\n' "\$entry" >> "\$HOOK_EVENTS_LOG" 2>/dev/null || true
-  # Path A: fire-and-forget HTTP POST (near-real-time dashboard, non-blocking)
-  if [ -n "\$INTUTIC_API_KEY" ]; then
-    curl -s -o /dev/null --max-time 3 -X POST \\
-      -H "Content-Type: application/json" \\
-      -H "Authorization: Bearer \$INTUTIC_API_KEY" \\
-      -d "{\\"events\\":[\$entry]}" \\
-      "\${INTUTIC_HOST}/api/v1/hook-events" & disown 2>/dev/null || true
-  fi
+let _intuticSessionId = '';
+function logEvent(verdict, toolName, reason) {
+  try {
+    const ts = new Date().toISOString();
+    const incidentId = crypto.createHash('sha1').update(ts + toolName + _intuticWsId).digest('hex').slice(0, 16);
+    // The event's id: random, made once here, and resent with the line it is
+    // written into, so the control plane processes the event once.
+    const eventId = crypto.randomBytes(16).toString('hex');
+    const entry = JSON.stringify({
+      event: verdict,
+      toolName, reason: reason || '',
+      workspaceId: _intuticWsId,
+      harnessType: 'pi',
+      timestamp: ts,
+      incidentId,
+      eventId,
+      ...(_intuticSessionId ? { sessionId: _intuticSessionId } : {}),
+    }) + '\\n';
+    const logPath = ${JSON.stringify(hookEventsLog)};
+    try { fs.mkdirSync(path.dirname(logPath), { recursive: true }); } catch {}
+    fs.appendFileSync(logPath, entry, { flag: 'a' });
+    if (_intuticKey) {
+      try {
+        const body = JSON.stringify({ events: [JSON.parse(entry)] });
+        const urlObj = new URL('/api/v1/hook-events', _intuticHost);
+        const isHttps = urlObj.protocol === 'https:';
+        const mod = isHttps ? https : require('http');
+        const req = mod.request({ hostname: urlObj.hostname, port: urlObj.port || (isHttps ? 443 : 80), path: urlObj.pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(body), 'Authorization': 'Bearer ' + _intuticKey } });
+        req.on('error', () => { /* fire-and-forget */ });
+        req.write(body); req.end();
+      } catch { /* never crash the hook */ }
+    }
+  } catch { /* never crash the hook */ }
 }
 
-${emitShellGate({ harness: "pi" })}
-log_event "tool_allowed" "$TOOL_NAME" ""
-exit 0
-`;
-}
-// ─── Pi hooks.json merge ──────────────────────────────────────────────────────
 /**
- * Build the 4 canonical Pi PreToolUse hook matchers pointing at the given
- * hook script path. The wildcard `.*` matcher catches all tools not matched
- * by the more specific matchers above it.
+ * One tool call. Returns to allow; throws '[Intutic Governance] …' to refuse.
+ * Input that is not an object is refused outright: the gate reads paths and
+ * commands out of it, and a shape it cannot read is not one it can allow.
  */
-function buildPiHookMatchers(hookScriptPath) {
-    return [
-        { matcher: 'Bash', hooks: [{ type: 'command', command: hookScriptPath }] },
-        { matcher: 'Edit', hooks: [{ type: 'command', command: hookScriptPath }] },
-        { matcher: 'Write', hooks: [{ type: 'command', command: hookScriptPath }] },
-        { matcher: '.*', hooks: [{ type: 'command', command: hookScriptPath }] },
-    ];
+function intuticEvaluate(event, ctx) {
+  _intuticSessionId = '';
+  try { _intuticSessionId = String(ctx.sessionManager.getSessionId() || ''); } catch (e) {}
+  const tool = String((event && event.toolName) || 'tool');
+  const input = event && event.input;
+  if (!input || typeof input !== 'object' || Array.isArray(input)) {
+    const reason = '[Intutic Governance] BLOCKED: tool "' + tool + '" was called with input the gate cannot read (' +
+      (input === null ? 'null' : typeof input) + '); refusing rather than allowing a call it cannot evaluate.';
+    try { logEvent('tool_blocked', tool, reason); } catch (e) {}
+    throw new Error(reason);
+  }
+  const target = input.path || input.file_path || input.filePath || input.target || '';
+  const command = input.command || input.cmd || input.script || '';
+  intuticGate(tool, target, command, logEvent, _intuticWsId, input, _intuticSessionId);
+  logEvent('tool_allowed', tool, '');
 }
+
 /**
- * Merge Pi hooks.json — upsert intutic-governance entries under
- * `hooks.PreToolUse`. Existing entries with our command path are filtered out
- * then re-added so there are no duplicates.
+ * Fail closed: a fault inside the gate is a refusal, never an allow. The gate
+ * body reports a refusal on stderr for the hook processes; inside Pi that
+ * line would land in the middle of the terminal UI, and the reason reaches
+ * the user in the tool result anyway, so stderr is muted for the call. The
+ * evaluation is synchronous, so nothing else logs in between.
  */
-function mergePiHooks(existing, hookScriptPath) {
-    const preToolUse = existing.hooks?.PreToolUse ?? [];
-    // Filter out any existing entries that reference our hook script
-    const filtered = preToolUse.filter((m) => !m.hooks.some((h) => h.command === hookScriptPath));
-    return {
-        ...existing,
-        hooks: {
-            ...(existing.hooks ?? {}),
-            PreToolUse: [...filtered, ...buildPiHookMatchers(hookScriptPath)],
-        },
-    };
+function toolCall(event, ctx) {
+  const consoleError = console.error;
+  console.error = () => {};
+  try {
+    intuticEvaluate(event, ctx);
+    return undefined;
+  } catch (err) {
+    let reason = String((err && err.message) || err);
+    if (reason.indexOf('[Intutic Governance]') !== 0) {
+      reason = '[Intutic Governance] BLOCKED: gate fault (failing closed): ' + reason;
+      try { logEvent('tool_blocked', String((event && event.toolName) || 'unknown'), reason); } catch (e) {}
+    }
+    return { block: true, reason };
+  } finally {
+    console.error = consoleError;
+  }
 }
-// ─── Pi models.json merge ─────────────────────────────────────────────────────
+
+export default function intuticGovernance(pi) {
+  pi.on('tool_call', toolCall);
+}
+`;
+}
+// ─── <agent-dir>/models.json ─────────────────────────────────────────────────
 /**
  * Merge Pi models.json — point the anthropic and openai providers at the
  * proxy, each with the base URL its SDK expects (the Anthropic SDK appends
  * `/v1/messages`, the OpenAI one `/chat/completions`). Google is left alone:
  * the proxy does not serve the Gemini API, so routing it there would break it.
- * Every other provider and key is kept.
+ * Every other provider and key is kept. A provider entry may carry `baseUrl`
+ * alone (`ProviderConfigSchema` in `packages/coding-agent/src/core/model-config.ts`).
  */
 export function mergePiModels(existing, proxyUrl) {
     const providers = existing.providers ?? {};
@@ -163,70 +211,33 @@ export function mergePiModels(existing, proxyUrl) {
 }
 // ─── Main export ──────────────────────────────────────────────────────────────
 /**
- * Write the Pi governance hook script, merge hooks.json and models.json,
- * and write the env snippet.
+ * Write the Pi governance extension into `~/.pi/agent/extensions/` and merge
+ * the proxy routing into `~/.pi/agent/models.json`.
  *
- * Safe to call repeatedly — uses atomic rename so partial writes never
- * leave a corrupt state.
+ * Safe to call repeatedly: atomic renames and a fixed file name, so repeated
+ * syncs replace rather than stack. Pi discovers the extension by scanning the
+ * directory; nothing registers it.
  *
  * @param workspaceRoot - Absolute workspace root path.
  * @param proxyUrl      - Intutic proxy URL for LLM provider routing.
  * @param workspaceId   - Workspace ID embedded in every hook event payload.
  */
 export async function writePiHooks(workspaceRoot, proxyUrl, workspaceId = '') {
-    // ── 1. Ensure directories ──────────────────────────────────────────────────
-    const globalHookDir = path.join(os.homedir(), '.intutic', 'hooks');
-    const hookEventsDir = path.join(workspaceRoot, '.intutic', 'events');
-    const envDir = path.join(workspaceRoot, '.intutic', 'env');
-    const piDir = path.join(os.homedir(), '.pi');
-    await keepOriginal(PI_HOOKS_CONFIG, workspaceRoot);
-    await keepOriginal(PI_MODELS_CONFIG, workspaceRoot);
-    await Promise.all([
-        fs.mkdir(globalHookDir, { recursive: true }),
-        fs.mkdir(hookEventsDir, { recursive: true }),
-        fs.mkdir(envDir, { recursive: true }),
-        fs.mkdir(piDir, { recursive: true }),
-    ]);
-    // ── 2. Write bash hook script ──────────────────────────────────────────────
-    const hookScriptPath = path.join(globalHookDir, 'pi-check.sh');
-    const tmpScript = hookScriptPath + '.intutic-tmp';
-    await fs.writeFile(tmpScript, buildPiCheckScript(proxyUrl, workspaceRoot, workspaceId), 'utf-8');
-    await fs.rename(tmpScript, hookScriptPath);
-    await fs.chmod(hookScriptPath, 0o755);
-    log.info({ action: 'pi_hook_script_written', path: hookScriptPath }, 'Pi hook script written');
-    // ── 3. Write/merge ~/.pi/hooks.json ───────────────────────────────────────
+    await fs.mkdir(path.join(workspaceRoot, '.intutic', 'events'), { recursive: true });
+    const extensionPath = path.join(os.homedir(), PI_EXTENSION_FILE);
+    await writeOwnedFile(extensionPath, workspaceRoot, buildPiExtension(proxyUrl, workspaceRoot, workspaceId));
+    log.info({ action: 'pi_extension_written', path: extensionPath }, 'Pi governance extension written');
     // A file that is not a plain JSON object is left untouched (and reported)
     // rather than replaced with only the Intutic entries.
-    const existingHooks = await readJsonObjectForMerge(PI_HOOKS_CONFIG);
-    if (existingHooks !== null) {
-        const mergedHooks = mergePiHooks(existingHooks, hookScriptPath);
-        const tmpHooks = PI_HOOKS_CONFIG + '.intutic-tmp';
-        await fs.writeFile(tmpHooks, JSON.stringify(mergedHooks, null, 2) + '\n', 'utf-8');
-        await fs.rename(tmpHooks, PI_HOOKS_CONFIG);
-    }
-    log.info({ action: 'pi_hooks_written', path: PI_HOOKS_CONFIG }, 'Pi hooks.json written');
-    // ── 4. Write/merge ~/.pi/models.json ──────────────────────────────────────
-    const existingModels = await readJsonObjectForMerge(PI_MODELS_CONFIG);
+    const modelsPath = path.join(os.homedir(), PI_AGENT_DIR, 'models.json');
+    const existingModels = await readJsonObjectForMerge(modelsPath);
     if (existingModels !== null) {
-        const mergedModels = mergePiModels(existingModels, proxyUrl);
-        const tmpModels = PI_MODELS_CONFIG + '.intutic-tmp';
-        await fs.writeFile(tmpModels, JSON.stringify(mergedModels, null, 2) + '\n', 'utf-8');
-        await fs.rename(tmpModels, PI_MODELS_CONFIG);
+        await keepOriginal(modelsPath, workspaceRoot);
+        await fs.mkdir(path.dirname(modelsPath), { recursive: true });
+        const tmp = modelsPath + '.intutic-tmp';
+        await fs.writeFile(tmp, JSON.stringify(mergePiModels(existingModels, proxyUrl), null, 2) + '\n', 'utf-8');
+        await fs.rename(tmp, modelsPath);
+        log.info({ action: 'pi_models_written', path: modelsPath }, 'Pi models.json written');
     }
-    log.info({ action: 'pi_models_written', path: PI_MODELS_CONFIG }, 'Pi models.json written');
-    // ── 5. Write env snippet ───────────────────────────────────────────────────
-    const envSnippet = [
-        `# Intutic pi governance env`,
-        `INTUTIC_PI_HOOK=~/.intutic/hooks/pi-check.sh`,
-        `INTUTIC_PI_HOOKS_CONFIG=~/.pi/hooks.json`,
-        `INTUTIC_PI_MODELS_CONFIG=~/.pi/models.json`,
-        `OPENAI_BASE_URL=${proxyUrl}`,
-        `ANTHROPIC_BASE_URL=${proxyUrl}`,
-    ].join('\n') + '\n';
-    const envFilePath = path.join(envDir, 'pi.env');
-    const tmpEnv = envFilePath + '.intutic-tmp';
-    await fs.writeFile(tmpEnv, envSnippet, 'utf-8');
-    await fs.rename(tmpEnv, envFilePath);
-    log.info({ action: 'pi_env_written', path: envFilePath }, 'Pi env snippet written');
 }
 //# sourceMappingURL=piHooks.js.map

package/dist/harness/piHooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"piHooks.js","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAA;AAC/E,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAA;AAEzC,mCAAmC;AACnC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,CAAA;AAEpE,oCAAoC;AACpC,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;AAiCtE,iFAAiF;AAEjF,SAAS,kBAAkB,CACzB,QAAgB,EAChB,aAAqB,EACrB,WAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,aAAa,CAAC,CAAA;IAC5E,OAAO;;;WAGE,QAAQ;eACJ,MAAM,EAAE;eACR,WAAW;;EAExB,iBAAiB;;WAER,UAAU;;YAET,UAAU;;;;;iDAK2B,WAAW;;;EAG1D,aAAa;;mBAEI,aAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2C9B,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;;CAGjC,CAAA;AACD,CAAC;AAED,iFAAiF;AAEjF;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,cAAsB;IACjD,OAAO;QACL,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC1E,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC1E,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;QAC3E,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,EAAE;KACzE,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,QAAuB,EAAE,cAAsB;IACnE,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAA;IAEnD,iEAAiE;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAChC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,cAAc,CAAC,CAC1D,CAAA;IAED,OAAO;QACL,GAAG,QAAQ;QACX,KAAK,EAAE;YACL,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;SAClE;KACF,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB,EAAE,QAAgB;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAA2B;QACtC,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;KAChC,CAAA;IAED,MAAM,eAAe,GAA+B,EAAE,GAAG,SAAS,EAAE,CAAA;IACpE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,eAAe,CAAC,QAAQ,CAAC,GAAG;YAC1B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO;SACR,CAAA;IACH,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,eAAe;KAC3B,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,8EAA8E;IAE9E,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAClE,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,KAAK,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAA;IAE5C,MAAM,YAAY,CAAC,eAAe,EAAE,aAAa,CAAC,CAAA;IAClD,MAAM,YAAY,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAA;IACnD,MAAM,OAAO,CAAC,GAAG,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QACrC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;KACrC,CAAC,CAAA;IAEF,8EAA8E;IAE9E,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAA;IAC9D,MAAM,SAAS,GAAG,cAAc,GAAG,cAAc,CAAA;IACjD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,CAAA;IAChG,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAC1C,MAAM,EAAE,CAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAA;IAErC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,wBAAwB,CAAC,CAAA;IAE9F,6EAA6E;IAE7E,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,aAAa,GAAG,MAAM,sBAAsB,CAAC,eAAe,CAAyB,CAAA;IAC3F,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,WAAW,GAAG,YAAY,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;QAC/D,MAAM,QAAQ,GAAG,eAAe,GAAG,cAAc,CAAA;QACjD,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QAClF,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAA;IAC5C,CAAC;IAED,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,eAAe,EAAE,EACrD,uBAAuB,CACxB,CAAA;IAED,6EAA6E;IAE7E,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,gBAAgB,CAA0B,CAAA;IAC9F,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,SAAS,GAAG,gBAAgB,GAAG,cAAc,CAAA;QACnD,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QACpF,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAA;IAC9C,CAAC;IAED,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,EAAE,EACvD,wBAAwB,CACzB,CAAA;IAED,8EAA8E;IAE9E,MAAM,UAAU,GAAG;QACjB,6BAA6B;QAC7B,8CAA8C;QAC9C,0CAA0C;QAC1C,4CAA4C;QAC5C,mBAAmB,QAAQ,EAAE;QAC7B,sBAAsB,QAAQ,EAAE;KACjC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IAEnB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,WAAW,GAAG,cAAc,CAAA;IAC3C,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IAEpC,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,EAAE,WAAW,EAAE,EAC/C,wBAAwB,CACzB,CAAA;AACH,CAAC"}
+{"version":3,"file":"piHooks.js","sourceRoot":"","sources":["../../src/harness/piHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AACpC,OAAO,EAAE,UAAU,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAEvE,MAAM,GAAG,GAAG,YAAY,CAAC,eAAe,CAAC,CAAA;AAEzC,oEAAoE;AACpE,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;AAErD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,YAAY,EAAE,uBAAuB,CAAC,CAAA;AAE/F,mFAAmF;AACnF,MAAM,CAAC,MAAM,mBAAmB,GAAG,kCAAkC,CAAA;AAYrE,gFAAgF;AAEhF,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,aAAqB,EAAE,WAAmB;IAC3F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC,CAAA;IACzF,OAAO;KACJ,mBAAmB;;YAEZ,QAAQ;gBACJ,MAAM,EAAE;;;;;;;;;;;;;;;;gFAgBwD,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC;;;;;;;;;;;EAWzG,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,wBAAwB,CAAC,EAAE,CAAC;;;;;;;;;;;;;;;;;;;;sBAoBzH,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmElD,CAAA;AACD,CAAC;AAED,gFAAgF;AAEhF;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,QAAwB,EAAE,QAAgB;IACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,CAAA;IAC1C,MAAM,OAAO,GAA2B;QACtC,SAAS,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrC,MAAM,EAAE,aAAa,CAAC,QAAQ,CAAC;KAChC,CAAA;IAED,MAAM,eAAe,GAA+B,EAAE,GAAG,SAAS,EAAE,CAAA;IACpE,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1D,eAAe,CAAC,QAAQ,CAAC,GAAG;YAC1B,GAAG,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO;SACR,CAAA;IACH,CAAC;IAED,OAAO;QACL,GAAG,QAAQ;QACX,SAAS,EAAE,eAAe;KAC3B,CAAA;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,QAAgB,EAChB,WAAW,GAAG,EAAE;IAEhB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnF,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAA;IAChE,MAAM,cAAc,CAAC,aAAa,EAAE,aAAa,EAAE,gBAAgB,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC,CAAA;IAC1G,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAEpG,0EAA0E;IAC1E,sDAAsD;IACtD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,aAAa,CAAC,CAAA;IACvE,MAAM,cAAc,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAA0B,CAAA;IACxF,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,YAAY,CAAC,UAAU,EAAE,aAAa,CAAC,CAAA;QAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7D,MAAM,GAAG,GAAG,UAAU,GAAG,cAAc,CAAA;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,cAAc,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;QACzG,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAChC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,wBAAwB,CAAC,CAAA;IACvF,CAAC;AACH,CAAC"}