@oh-my-pi/pi-coding-agent 17.1.8 → 17.2.1

package/dist/types/tools/acp-bridge.d.ts

@@ -16,14 +16,37 @@ import type { ToolSession } from "./index.js";
  * that must stay off the editor's buffer.
  */
 export declare function shouldRouteWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string): boolean;
+/**
+ * Result of a bridge-routed write: the content actually verified on disk
+ * after the client processed the write, plus whether that content diverges
+ * from what the tool asked to persist.
+ *
+ * ACP's `fs/write_text_file` has no "verbatim, no side effects" guarantee —
+ * a client (e.g. Zed with `format_on_save: on`) may reformat the buffer as
+ * part of handling the write before it settles on disk. Silently trusting
+ * the requested `content` as "what's now on disk" lets that drift poison
+ * every snapshot/tag/hash a caller derives from the write, which then reads
+ * back as unrelated whole-file corruption on the *next* edit. Reading the
+ * file back and reporting what's actually there keeps callers honest.
+ */
+export interface BridgeWriteResult {
+    /** Content actually present on disk immediately after the bridge write. */
+    text: string;
+    /** `true` when `text` differs from the content the tool asked to write. */
+    driftedFromRequest: boolean;
+}
 /**
  * Try to route a file write through the ACP client bridge.
  *
  * Performs the full guard check, bridge call (wrapped in {@link ToolError}),
- * FS-scan cache invalidation, and session mutation-version bump.
+ * a post-write read-back to detect client-side transformation (e.g.
+ * format-on-save), FS-scan cache invalidation, and session mutation-version
+ * bump.
  *
- * Returns `true` when the bridge was used and the caller must skip the
- * writethrough path. Returns `false` when the bridge is unavailable or the
- * path should not be routed through it.
+ * Returns `undefined` when the bridge is unavailable or the path should not
+ * be routed through it — the caller must fall back to the writethrough path.
+ * Returns a {@link BridgeWriteResult} when the bridge was used; callers MUST
+ * use `result.text` (not the content they requested) for any snapshot, hash,
+ * or tag derived from this write.
  */
-export declare function routeWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string, content: string, signal?: AbortSignal): Promise<boolean>;
+export declare function routeWriteThroughBridge(session: ToolSession, requestedPath: string, absolutePath: string, content: string, signal?: AbortSignal): Promise<BridgeWriteResult | undefined>;

package/dist/types/tools/builtin-names.d.ts

@@ -1,4 +1,4 @@
-export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "github", "glob", "grep", "lsp", "inspect_image", "browser", "computer", "checkpoint", "rewind", "task", "hub", "todo", "web_search", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
+export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "github", "glob", "grep", "lsp", "inspect_image", "browser", "computer", "checkpoint", "rewind", "security_scan", "task", "hub", "todo", "web_search", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
 export type BuiltinToolName = (typeof BUILTIN_TOOL_NAMES)[number];
 /** Hidden built-ins: constructible and `--tools`-addressable, but never part of the default active set. */
 export declare const HIDDEN_TOOL_NAMES: readonly ["yield", "goal"];

package/dist/types/tools/grep.d.ts

@@ -55,7 +55,23 @@ export interface GrepToolDetails {
     missingPaths?: string[];
 }
 type SearchParams = typeof searchSchema.infer;
+/**
+ * Construction-time overrides for callers that are not the model.
+ *
+ * The model-facing schema deliberately does not grow these: they exist for
+ * wire bridges (the Cursor `pi_grep` frame) whose protocol carries an explicit
+ * context width and total match cap, and which would otherwise have to drop
+ * them. Unset means "use the session settings / built-in caps" — the behavior
+ * every model-issued call keeps.
+ */
+export interface GrepToolOptions {
+    /** Overrides `grep.contextBefore`/`grep.contextAfter` for every call on this instance. */
+    context?: number;
+    /** Caps total surfaced matches. Applied on top of the built-in per-file and file-window caps, never above them. */
+    totalMatchLimit?: number;
+}
 export declare class GrepTool implements AgentTool<typeof searchSchema, GrepToolDetails> {
+    #private;
     private readonly session;
     readonly name = "grep";
     readonly approval: (args: unknown) => ToolTier;
@@ -71,7 +87,7 @@ export declare class GrepTool implements AgentTool<typeof searchSchema, GrepTool
         skip?: number | null | undefined;
     }, {}>;
     readonly strict = true;
-    constructor(session: ToolSession);
+    constructor(session: ToolSession, options?: GrepToolOptions);
     execute(_toolCallId: string, params: SearchParams, signal?: AbortSignal, _onUpdate?: AgentToolUpdateCallback<GrepToolDetails>, _toolContext?: AgentToolContext): Promise<AgentToolResult<GrepToolDetails>>;
 }
 interface GrepRenderArgs {

package/dist/types/tools/hub/launch.d.ts

@@ -7,7 +7,7 @@
 import type { AgentToolResult } from "@oh-my-pi/pi-agent-core";
 import type { Component } from "@oh-my-pi/pi-tui";
 import type { RenderResultOptions } from "../../extensibility/custom-tools/types.js";
-import type { DaemonSnapshot, DaemonSpec, DaemonState } from "../../launch/protocol.js";
+import type { DaemonRpcResult, DaemonSnapshot, DaemonSpec, DaemonState } from "../../launch/protocol.js";
 import type { Theme } from "../../modes/theme/theme.js";
 import type { ToolSession } from "../index.js";
 /** Broker-facing launch parameters; the hub adapts its `ps` op to `list` before calling in. */
@@ -57,6 +57,10 @@ export interface LaunchToolDetails {
     /** describe: immutable launch spec backing the command/cwd detail lines. */
     spec?: DaemonSpec;
 }
+/** Resolve display rows while keeping legacy raw replay outside the client process. */
+export declare function renderLaunchLogTerminalRows(result: Extract<DaemonRpcResult, {
+    op: "logs";
+}>, params: Pick<LaunchParams, "head" | "lines">): Promise<string[] | undefined>;
 /** Run one broker operation for the calling session's project. */
 export declare function executeLaunch(session: ToolSession, params: LaunchParams, signal?: AbortSignal): Promise<AgentToolResult<LaunchToolDetails>>;
 /** Args shape visible to the renderer, possibly mid-stream (every field optional). */

package/dist/types/tools/index.d.ts

@@ -1,5 +1,5 @@
-import type { InMemorySnapshotStore } from "@oh-my-pi/hashline";
-import type { AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
+import type { Clipboard, InMemorySnapshotStore } from "@oh-my-pi/hashline";
+import type { AgentOptions, AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
 import type { FetchImpl, ImageContent, Model, ServiceTierByFamily, ToolChoice } from "@oh-my-pi/pi-ai";
 import type { AsyncJobManager } from "../async/job-manager.js";
 import type { Rule } from "../capability/rule.js";
@@ -65,6 +65,7 @@ export * from "./read.js";
 export * from "./report-tool-issue.js";
 export * from "./resolve.js";
 export * from "./review.js";
+export * from "./security-scan.js";
 export * from "./todo.js";
 export * from "./tts.js";
 export * from "./vibe.js";
@@ -123,6 +124,8 @@ export interface ToolSession {
     suppressSpawnAdvisory?: boolean;
     /** Optional fetch implementation injected into the URL read pipeline (tests, proxies). Defaults to global fetch. */
     fetch?: FetchImpl;
+    /** Provider credential resolver forwarded unchanged to restricted child sessions. */
+    getApiKey?: AgentOptions["getApiKey"];
     /** Skip subprocess-kernel availability checks and warmup */
     skipPythonPreflight?: boolean;
     /** Pre-loaded context files (AGENTS.md, etc) */
@@ -152,6 +155,8 @@ export interface ToolSession {
     customToolPaths?: ToolPathWithSource[];
     /** Whether LSP integrations are enabled */
     enableLsp?: boolean;
+    /** Whether LSP is limited to navigation and diagnostics. */
+    lspReadOnly?: boolean;
     /** Whether this invocation may expose IRC. `false` removes it even for subagents. */
     enableIrc?: boolean;
     /**
@@ -321,6 +326,9 @@ export interface ToolSession {
      *  reconstruct the version the model authored anchors against when the
      *  file changed out-of-band. Lazily initialized by `getFileSnapshotStore`. */
     fileSnapshotStore?: InMemorySnapshotStore;
+    /** Per-session `CUT`/`PASTE` clipboard register shared across edit
+     *  calls. Lazily initialized by `getEditClipboard`. */
+    editClipboard?: Clipboard;
     /** Per-session log of unresolved git merge conflict regions surfaced by
      *  `read`. Each entry gets a stable id N referenced by `write conflict://N`
      *  to splice the recorded region with replacement content. Lazily initialized

package/dist/types/tools/path-utils.d.ts

@@ -129,6 +129,25 @@ export declare function isReadableUrlPath(value: string): boolean;
  * filesystem root is almost never what they intended.
  */
 export declare function resolveToCwd(filePath: string, cwd: string): string;
+/**
+ * Resolve a path that MUST stay inside `cwd`, or `null` when it would escape.
+ *
+ * {@link resolveToCwd} deliberately honors absolute paths, `~`, and `..` —
+ * correct for a path a user typed, wrong for one a remote peer supplied.
+ * Callers handling untrusted input (Cursor's `download_path`) use this instead:
+ * only a non-empty relative path landing under the live cwd is accepted, so
+ * neither `/etc/passwd` nor `../../escape` can be written through.
+ *
+ * The lexical check alone is not containment: a symlink inside the workspace
+ * can point anywhere, so `out/config` under a `ws/out -> /elsewhere` link is
+ * relative, `..`-free, and still writes outside. Both the target and its
+ * deepest existing ancestor are therefore realpath-resolved — the ancestor
+ * because a download names a file that does not exist yet, so the link in its
+ * path is the only thing that can be resolved before the write.
+ *
+ * The cwd itself is rejected: a download names a file, never the directory.
+ */
+export declare function confineToWorkspace(filePath: string, cwd: string): string | null;
 export declare function formatPathRelativeToCwd(filePath: string, cwd: string, options?: {
     trailingSlash?: boolean;
 }): string;

package/dist/types/tools/read.d.ts

@@ -24,6 +24,8 @@ export interface ReadToolDetails {
     method?: string;
     notes?: string[];
     meta?: OutputMeta;
+    /** Full on-disk byte size recorded before applying a file range. */
+    fileSize?: number;
     /** Raw text + start line for user-visible TUI rendering, set when content is text-like.
      * Mirrors the same lines the model receives but without hashline/line-number prefixes,
      * so the TUI can render the file content with its own gutter without re-parsing the formatted text. */

package/dist/types/tools/security-scan.d.ts

@@ -0,0 +1,96 @@
+import type { AgentTool, AgentToolResult, ToolTier } from "@oh-my-pi/pi-agent-core";
+import { type CodexSecurityCloudConfiguration, type CodexSecurityCloudStats } from "../security/cloud.js";
+import { type SecurityValidationStatus } from "../security/contracts/index.js";
+import type { SecurityOperationSnapshot } from "../security/coordinator.js";
+import type { ToolSession } from "./index.js";
+declare const securityScanSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    action: "cancel" | "cloud_pull" | "cloud_scans" | "cloud_start" | "cloud_status" | "preflight" | "start" | "status" | "validate";
+    plan_id?: string | undefined;
+    operation_id?: string | undefined;
+    target_kind?: "ref_diff" | "repository" | "scoped_path" | "working_tree" | undefined;
+    include_paths?: string[] | undefined;
+    exclude_paths?: string[] | undefined;
+    base_revision?: string | undefined;
+    head_revision?: string | undefined;
+    knowledge_base_paths?: string[] | undefined;
+    output_root?: string | undefined;
+    archive_existing?: boolean | undefined;
+    credential_id?: number | undefined;
+    scan_id?: string | undefined;
+    finding_id?: string | undefined;
+    validation_status?: "error" | "partial" | "rejected" | "unvalidated" | "validated" | undefined;
+    validation_summary?: string | undefined;
+    validation_evidence?: {
+        label: string;
+        explanation: string;
+    }[] | undefined;
+    cloud_configuration_id?: string | undefined;
+    repository_id?: string | undefined;
+    repository_url?: string | undefined;
+    environment_id?: string | undefined;
+    lookback_days?: number | "all" | undefined;
+}, {}>;
+type SecurityScanParams = typeof securityScanSchema.infer;
+export interface SecurityScanToolDetails {
+    action: SecurityScanParams["action"];
+    plan?: {
+        id: string;
+        fingerprint: string;
+    };
+    operation?: SecurityOperationSnapshot;
+    cancelled?: boolean;
+    finding?: {
+        id: string;
+        validationStatus: SecurityValidationStatus;
+    };
+    cloudConfigurations?: CodexSecurityCloudConfiguration[];
+    cloudStats?: CodexSecurityCloudStats;
+    cloudScan?: {
+        id: string;
+        repositoryUrl: string;
+    };
+    importedScan?: {
+        id: string;
+        findingCount: number;
+    };
+}
+export declare class SecurityScanTool implements AgentTool<typeof securityScanSchema, SecurityScanToolDetails> {
+    readonly session: ToolSession;
+    readonly name = "security_scan";
+    readonly approval: ToolTier;
+    readonly label = "Security Scan";
+    readonly loadMode = "discoverable";
+    readonly summary = "Run OMP-native scans and explicit Codex Security cloud operations";
+    readonly description: string;
+    readonly parameters: import("arktype/internal/variants/object.ts").ObjectType<{
+        action: "cancel" | "cloud_pull" | "cloud_scans" | "cloud_start" | "cloud_status" | "preflight" | "start" | "status" | "validate";
+        plan_id?: string | undefined;
+        operation_id?: string | undefined;
+        target_kind?: "ref_diff" | "repository" | "scoped_path" | "working_tree" | undefined;
+        include_paths?: string[] | undefined;
+        exclude_paths?: string[] | undefined;
+        base_revision?: string | undefined;
+        head_revision?: string | undefined;
+        knowledge_base_paths?: string[] | undefined;
+        output_root?: string | undefined;
+        archive_existing?: boolean | undefined;
+        credential_id?: number | undefined;
+        scan_id?: string | undefined;
+        finding_id?: string | undefined;
+        validation_status?: "error" | "partial" | "rejected" | "unvalidated" | "validated" | undefined;
+        validation_summary?: string | undefined;
+        validation_evidence?: {
+            label: string;
+            explanation: string;
+        }[] | undefined;
+        cloud_configuration_id?: string | undefined;
+        repository_id?: string | undefined;
+        repository_url?: string | undefined;
+        environment_id?: string | undefined;
+        lookback_days?: number | "all" | undefined;
+    }, {}>;
+    readonly strict = true;
+    constructor(session: ToolSession);
+    execute(_toolCallId: string, params: SecurityScanParams, signal?: AbortSignal): Promise<AgentToolResult<SecurityScanToolDetails>>;
+}
+export {};

package/dist/types/tools/xdev.d.ts

@@ -103,10 +103,11 @@ export declare function resolveMountedXdevTool(state: XdevState, name: string):
 export declare function resolveMountedXdevExecutable(state: XdevState, name: string): Tool | undefined;
 /** Mounted tools in presentation order, resolved from the canonical map. */
 export declare function listXdevTools(state: XdevState): Tool[];
-/** `{name, summary}` pairs for prompt templates and `/tools` display. */
+/** `{name, summary, dynamic}` triples for prompt templates and `/tools` display. */
 export declare function xdevEntries(state: XdevState): Array<{
     name: string;
     summary: string;
+    dynamic: boolean;
 }>;
 /** `read xd://` listing with one device per line. */
 export declare function xdevListing(state: XdevState): string;

package/dist/types/utils/changelog.d.ts

@@ -1,3 +1,4 @@
+import type { SettingValue } from "../config/settings.js";
 export interface ChangelogEntry {
     major: number;
     minor: number;
@@ -21,7 +22,13 @@ export interface StartupChangelogSelection {
     persistCurrentVersion: boolean;
     truncated: boolean;
     selectedEntries: number;
+    totalUnseenEntries: number;
+    latestVersion: string | undefined;
+    changeCount: number;
+    categoryCounts: Record<string, number>;
 }
+/** Format the compact, deterministic startup update notice. */
+export declare function formatStartupChangelogSummary(selection: StartupChangelogSelection): string;
 /**
  * Parse changelog entries from omp's package asset when available, falling back
  * to the copy embedded in compiled binaries.
@@ -55,6 +62,18 @@ export declare function renderChangelogEntries(entries: ChangelogEntry[], option
  * Select bounded release notes for interactive startup.
  */
 export declare function selectStartupChangelog(entries: ChangelogEntry[], lastVersion: string | undefined, currentVersion: string): StartupChangelogSelection;
+/**
+ * Resolve and persist the automatic startup changelog decision.
+ *
+ * Hidden mode advances the marker only for an upgrade, so downgrades do not
+ * erase knowledge of a newer version the user has already seen.
+ */
+export declare function resolveStartupChangelogForDisplay(options: {
+    mode: SettingValue<"startup.changelogMode">;
+    currentVersion: string;
+    changelogPath?: string;
+    agentDir?: string;
+}): Promise<StartupChangelogSelection | undefined>;
 export { getChangelogPath } from "../config.js";
 /**
  * Last omp version whose changelog the user has seen. Stored as a plain-text

package/dist/types/utils/git.d.ts

@@ -147,6 +147,14 @@ export declare const GIT_COMMAND_TIMEOUT_MS: number;
 export declare const GIT_NETWORK_TIMEOUT_MS: number;
 /** Maximum captured stdout or stderr bytes retained from git and gh subprocesses. */
 export declare const GIT_COMMAND_OUTPUT_LIMIT_BYTES: number;
+/**
+ * Deadline for synchronous git plumbing commands launched via
+ * {@link gitSpawnSyncText}. These run on the render path (e.g. reftable HEAD
+ * resolution), so the deadline is short: a command that has not exited by then
+ * is killed and reported as {@link GIT_COMMAND_TIMEOUT_EXIT_CODE} so the caller
+ * degrades instead of freezing the UI indefinitely.
+ */
+export declare const GIT_SPAWN_SYNC_TIMEOUT_MS = 5000;
 interface CommandOptions {
     readonly env?: Record<string, string | undefined>;
     readonly maxOutputBytes?: number;
@@ -271,6 +279,8 @@ export declare const log: {
 export declare const revList: {
     /** Commits in `base..head`, oldest first. */
     range(cwd: string, base: string, head: string, signal?: AbortSignal): Promise<string[]>;
+    /** Commits reachable from `ref` that touched `file`, newest first, capped at `limit`. */
+    touching(cwd: string, ref: string, file: string, limit: number, signal?: AbortSignal): Promise<string[]>;
 };
 export declare const branch: {
     /** Current branch name, or null if detached/unavailable. */

package/dist/types/utils/jj.d.ts

@@ -16,14 +16,21 @@ export interface JjRepository {
     storeDir: string;
 }
 /** Options for `jj diff` invocations. */
-export interface DiffOptions {
+export interface DiffOptions extends JjCommandOptions {
     /** Optional file paths to restrict the diff with `-- <files>`. */
     readonly files?: readonly string[];
     /** Return only changed file names instead of Git-format diff text. */
     readonly nameOnly?: boolean;
-    /** Optional abort signal passed to the spawned `jj` process. */
+}
+/** Options for a bounded `jj` subprocess query. */
+export interface JjCommandOptions {
+    /** Optional cancellation signal for the subprocess. */
     readonly signal?: AbortSignal;
+    /** Deadline in milliseconds. Defaults to {@link JJ_COMMAND_TIMEOUT_MS}. */
+    readonly timeoutMs?: number;
 }
+/** Default finite deadline for local jj subprocesses. */
+export declare const JJ_COMMAND_TIMEOUT_MS = 5000;
 /** Error thrown when a checked `jj` command exits non-zero. */
 export declare class JjCommandError extends Error {
     /** Arguments passed after the common `jj --no-pager --color=never` prefix. */
@@ -46,7 +53,7 @@ export declare const workingCopy: {
      * Label `@` with its nearest bookmark, falling back to its short change ID.
      * Returns `null` when `jj` is unavailable or the query fails.
      */
-    label(cwd: string, signal?: AbortSignal): Promise<string | null>;
+    label(cwd: string, options?: JjCommandOptions): Promise<string | null>;
     /** Parse working-copy label query output. */
     parseLabel: typeof parseWorkingCopyLabel;
 };
@@ -56,7 +63,7 @@ export declare const status: {
      * Count changes in `@` relative to its parent using the Git status shape.
      * Jujutsu has no index, so `staged` is always zero.
      */
-    summary(cwd: string, signal?: AbortSignal): Promise<git.GitStatusSummary | null>;
+    summary(cwd: string, options?: JjCommandOptions): Promise<git.GitStatusSummary | null>;
     /** Parse `jj diff --summary` output into status counts. */
     parse: typeof parseStatusSummary;
 };

package/dist/types/web/search/types.d.ts

@@ -34,7 +34,7 @@ export declare const SEARCH_PROVIDER_OPTIONS: readonly [{
 }, {
     readonly value: "exa";
     readonly label: "Exa";
-    readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+    readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
 }, {
     readonly value: "tinyfish";
     readonly label: "TinyFish";
@@ -136,7 +136,7 @@ export declare const SEARCH_PROVIDER_CHOICES: ({
 } | {
     readonly value: "exa";
     readonly label: "Exa";
-    readonly description: "Uses Exa API when EXA_API_KEY is set; falls back to Exa MCP";
+    readonly description: "API via /login exa or EXA_API_KEY; explicit keyless fallback via MCP";
 } | {
     readonly value: "tinyfish";
     readonly label: "TinyFish";

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@oh-my-pi/pi-coding-agent",
-	"version": "17.1.8",
+	"version": "17.2.1",
 	"description": "Coding agent CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://omp.sh",
 	"author": "Can Boluk",
@@ -52,17 +52,17 @@
 		"@agentclientprotocol/sdk": "1.2.1",
 		"@babel/parser": "^7.29.7",
 		"@mozilla/readability": "^0.6.0",
-		"@oh-my-pi/hashline": "17.1.8",
-		"@oh-my-pi/omp-stats": "17.1.8",
-		"@oh-my-pi/pi-agent-core": "17.1.8",
-		"@oh-my-pi/pi-ai": "17.1.8",
-		"@oh-my-pi/pi-catalog": "17.1.8",
-		"@oh-my-pi/pi-mnemopi": "17.1.8",
-		"@oh-my-pi/pi-natives": "17.1.8",
-		"@oh-my-pi/pi-tui": "17.1.8",
-		"@oh-my-pi/pi-utils": "17.1.8",
-		"@oh-my-pi/pi-wire": "17.1.8",
-		"@oh-my-pi/snapcompact": "17.1.8",
+		"@oh-my-pi/hashline": "17.2.1",
+		"@oh-my-pi/omp-stats": "17.2.1",
+		"@oh-my-pi/pi-agent-core": "17.2.1",
+		"@oh-my-pi/pi-ai": "17.2.1",
+		"@oh-my-pi/pi-catalog": "17.2.1",
+		"@oh-my-pi/pi-mnemopi": "17.2.1",
+		"@oh-my-pi/pi-natives": "17.2.1",
+		"@oh-my-pi/pi-tui": "17.2.1",
+		"@oh-my-pi/pi-utils": "17.2.1",
+		"@oh-my-pi/pi-wire": "17.2.1",
+		"@oh-my-pi/snapcompact": "17.2.1",
 		"@opentelemetry/api": "^1.9.1",
 		"@opentelemetry/api-logs": "^0.220.0",
 		"@opentelemetry/context-async-hooks": "^2.9.0",

package/scripts/security-compare.ts

@@ -0,0 +1,40 @@
+#!/usr/bin/env bun
+import * as path from "node:path";
+import { isEnoent } from "@oh-my-pi/pi-utils";
+import { compareSecurityProducers, importCodexSecurityBundle, parseSecurityScanBundle } from "../src/security";
+
+async function readBundle(directory: string) {
+	const root = path.resolve(directory);
+	let scan: unknown;
+	try {
+		scan = JSON.parse(await Bun.file(path.join(root, "scan.json")).text()) as unknown;
+	} catch (error) {
+		if (!isEnoent(error)) throw error;
+		return importCodexSecurityBundle(root, { repositoryRoot: root });
+	}
+	const findings = JSON.parse(await Bun.file(path.join(root, "findings.json")).text()) as unknown;
+	const report = await Bun.file(path.join(root, "report.md"))
+		.text()
+		.catch(() => undefined);
+	const sarifText = await Bun.file(path.join(root, "results.sarif"))
+		.text()
+		.catch(() => undefined);
+	return parseSecurityScanBundle({
+		scan,
+		findings,
+		report,
+		sarif: sarifText ? (JSON.parse(sarifText) as Record<string, unknown>) : undefined,
+	});
+}
+
+const [referenceDirectory, candidateDirectory, outputPath] = process.argv.slice(2);
+if (!referenceDirectory || !candidateDirectory) {
+	process.stderr.write(
+		"Usage: bun scripts/security-compare.ts <reference-scan-dir> <candidate-scan-dir> [output.json]\n",
+	);
+	process.exit(2);
+}
+const report = compareSecurityProducers(await readBundle(referenceDirectory), await readBundle(candidateDirectory));
+const serialized = `${JSON.stringify(report, null, 2)}\n`;
+if (outputPath) await Bun.write(path.resolve(outputPath), serialized);
+else process.stdout.write(serialized);