@oh-my-pi/pi-coding-agent 17.2.0 → 17.2.1

package/src/slash-commands/helpers/security.ts

@@ -0,0 +1,451 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { prompt } from "@oh-my-pi/pi-utils";
+import { parseInternalUrl } from "../../internal-urls/parse";
+import { SecurityProtocolHandler } from "../../internal-urls/security-protocol";
+import validationRequestPrompt from "../../prompts/security/validate-request.md" with { type: "text" };
+import { selectSecurityAccount } from "../../security/auth";
+import { CodexSecurityCloudClient, pullCodexSecurityCloudResults } from "../../security/cloud";
+import type { SecurityDispositionStatus } from "../../security/contracts";
+import type { SecurityPreflightInput } from "../../security/coordinator";
+import { getSecurityCoordinator } from "../../security/coordinator";
+import { importCodexSecurityBundle, importSarifFile } from "../../security/importers";
+import type { SecurityTargetRequest } from "../../security/preflight";
+import { SecurityStore, writeSecurityFileAtomic } from "../../security/store";
+import { shortenPath } from "../../tools/render-utils";
+import { parseCommandArgs } from "../../utils/command-args";
+import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types";
+import { commandConsumed, errorMessage, parseSubcommand, usage } from "./parse";
+
+interface SecurityPlanCliOptions {
+	target: SecurityTargetRequest;
+	knowledgeBasePaths: string[];
+	outputRoot?: string;
+	archiveExisting?: boolean;
+	credentialId?: number;
+}
+
+const DISPOSITIONS: ReadonlySet<SecurityDispositionStatus> = new Set([
+	"open",
+	"false_positive",
+	"accepted_risk",
+	"fixed",
+	"wont_fix",
+]);
+
+function coordinatorFor(runtime: SlashCommandRuntime) {
+	return getSecurityCoordinator({
+		cwd: runtime.cwd,
+		settings: runtime.settings,
+		authStorage: runtime.session.modelRegistry.authStorage,
+		modelRegistry: runtime.session.modelRegistry,
+		activeModel: runtime.session.model,
+		sessionId: runtime.session.sessionId,
+		agentId: runtime.session.getAgentId(),
+		asyncJobManager: runtime.session.asyncJobManager,
+	});
+}
+
+function requireToken(tokens: readonly string[], index: number, flag: string): string {
+	const value = tokens[index];
+	if (!value || value.startsWith("--")) throw new Error(`${flag} requires a value`);
+	return value;
+}
+
+function parsePositiveCredential(value: string): number {
+	const credentialId = Number(value);
+	if (!Number.isSafeInteger(credentialId) || credentialId < 1) throw new Error(`Invalid credential id: ${value}`);
+	return credentialId;
+}
+
+function parsePlanOptions(rest: string): SecurityPlanCliOptions {
+	const tokens = parseCommandArgs(rest);
+	const includePaths: string[] = [];
+	const excludePaths: string[] = [];
+	const knowledgeBasePaths: string[] = [];
+	let kind: SecurityTargetRequest["kind"] = "repository";
+	let baseRevision: string | undefined;
+	let headRevision: string | undefined;
+	let outputRoot: string | undefined;
+	let archiveExisting = false;
+	let credentialId: number | undefined;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		switch (token) {
+			case "--path":
+				includePaths.push(requireToken(tokens, ++index, token));
+				// `--path` scopes the target; it never overrides an explicit --diff/--working-tree selection.
+				if (kind === "repository") kind = "scoped_path";
+				break;
+			case "--exclude":
+				excludePaths.push(requireToken(tokens, ++index, token));
+				break;
+			case "--working-tree":
+				kind = "working_tree";
+				break;
+			case "--diff":
+				kind = "ref_diff";
+				baseRevision = requireToken(tokens, ++index, token);
+				headRevision = requireToken(tokens, ++index, token);
+				break;
+			case "--knowledge-base":
+				knowledgeBasePaths.push(requireToken(tokens, ++index, token));
+				break;
+			case "--output":
+				outputRoot = requireToken(tokens, ++index, token);
+				break;
+			case "--archive-existing":
+				archiveExisting = true;
+				break;
+			case "--credential":
+				credentialId = parsePositiveCredential(requireToken(tokens, ++index, token));
+				break;
+			default:
+				throw new Error(`Unknown security plan option: ${token}`);
+		}
+	}
+	const common = { includePaths, excludePaths };
+	const target: SecurityTargetRequest =
+		kind === "ref_diff"
+			? {
+					kind,
+					baseRevision: baseRevision ?? "",
+					headRevision: headRevision ?? "",
+					...common,
+				}
+			: kind === "working_tree"
+				? { kind, ...common }
+				: kind === "scoped_path"
+					? { kind, ...common }
+					: { kind: "repository", ...common };
+	return { target, knowledgeBasePaths, outputRoot, archiveExisting, credentialId };
+}
+
+async function preflight(runtime: SlashCommandRuntime, rest: string) {
+	const options = parsePlanOptions(rest);
+	const input: SecurityPreflightInput = {
+		target: options.target,
+		knowledgeBasePaths: options.knowledgeBasePaths,
+		outputRoot: options.outputRoot,
+		archiveExisting: options.archiveExisting,
+		credentialId: options.credentialId,
+		model: runtime.session.model,
+	};
+	return coordinatorFor(runtime).preflight(input);
+}
+
+function scanIdFromInput(value: string): string {
+	const trimmed = value.trim();
+	const match = trimmed.match(/^security:\/\/scans\/([^/]+)/);
+	return match?.[1] ?? trimmed;
+}
+
+function findingTarget(value: string): { uri: string; scanId: string; findingId: string } {
+	const trimmed = value.trim();
+	const uriMatch = trimmed.match(/^security:\/\/scans\/([^/]+)\/findings\/([^/]+)$/);
+	if (uriMatch) return { uri: trimmed, scanId: uriMatch[1]!, findingId: uriMatch[2]! };
+	const [scanId, findingId] = parseCommandArgs(trimmed);
+	if (!scanId || !findingId) throw new Error("validate requires a finding URI or <scan-id> <finding-id>");
+	return { uri: `security://scans/${scanId}/findings/${findingId}`, scanId, findingId };
+}
+
+async function showResource(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const raw = rest.trim();
+	if (!raw) throw new Error("show requires a scan id or security:// URI");
+	const uri = raw.startsWith("security://") ? raw : `security://scans/${scanIdFromInput(raw)}`;
+	const handler = new SecurityProtocolHandler(undefined, () => true);
+	const resource = await handler.resolve(parseInternalUrl(uri), { cwd: runtime.cwd });
+	await runtime.output(resource.content);
+}
+
+async function importResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const [source] = parseCommandArgs(rest);
+	if (!source) throw new Error("import requires a SARIF file or Codex Security bundle directory");
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const absolute = path.resolve(runtime.cwd, source);
+	const stats = await fs.stat(absolute);
+	const bundle = stats.isDirectory()
+		? await importCodexSecurityBundle(absolute, { repositoryRoot: store.repositoryRoot })
+		: await importSarifFile(absolute, { repositoryRoot: store.repositoryRoot });
+	await store.putBundle(bundle);
+	await runtime.output(`Imported ${bundle.findings.length} finding(s) as security scan ${bundle.scan.id}.`);
+}
+
+async function exportResults(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const tokens = parseCommandArgs(rest);
+	const scanId = tokens[0];
+	if (!scanId) throw new Error("export requires <scan-id> --output <path> [--format bundle|sarif|report]");
+	let outputPath: string | undefined;
+	let format: "bundle" | "sarif" | "report" = "bundle";
+	for (let index = 1; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		if (token === "--output") outputPath = requireToken(tokens, ++index, token);
+		else if (token === "--format") {
+			const value = requireToken(tokens, ++index, token);
+			if (value !== "bundle" && value !== "sarif" && value !== "report") {
+				throw new Error(`Unknown export format: ${value}`);
+			}
+			format = value;
+		} else throw new Error(`Unknown export option: ${token}`);
+	}
+	if (!outputPath) throw new Error("export requires --output <path>");
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const bundle = await store.getBundle(scanIdFromInput(scanId));
+	if (!bundle) throw new Error(`Unknown security scan: ${scanId}`);
+	let content: string;
+	if (format === "sarif") {
+		if (!bundle.sarif) throw new Error(`Security scan ${scanId} has no SARIF result`);
+		content = `${JSON.stringify(bundle.sarif, null, 2)}\n`;
+	} else if (format === "report") {
+		if (bundle.report === undefined) throw new Error(`Security scan ${scanId} has no report`);
+		content = bundle.report;
+	} else {
+		content = `${JSON.stringify(bundle, null, 2)}\n`;
+	}
+	const absolute = path.resolve(runtime.cwd, outputPath);
+	await writeSecurityFileAtomic(absolute, content, { hardenParent: false });
+	await runtime.output(`Exported security scan ${scanId} to ${shortenPath(absolute)}.`);
+}
+
+interface CloudCliOptions {
+	credentialId?: number;
+	configurationId?: string;
+	repositoryId?: string;
+	repositoryUrl?: string;
+	environmentId?: string;
+	lookbackDays?: number | "all";
+}
+
+function parseCloudOptions(rest: string, subcommand: string): CloudCliOptions {
+	const tokens = parseCommandArgs(rest);
+	const options: CloudCliOptions = {};
+	let positionalConsumed = false;
+	for (let index = 0; index < tokens.length; index++) {
+		const token = tokens[index]!;
+		switch (token) {
+			case "--credential":
+				options.credentialId = parsePositiveCredential(requireToken(tokens, ++index, token));
+				break;
+			case "--repo-id":
+				options.repositoryId = requireToken(tokens, ++index, token);
+				break;
+			case "--repo-url":
+				options.repositoryUrl = requireToken(tokens, ++index, token);
+				break;
+			case "--environment":
+				options.environmentId = requireToken(tokens, ++index, token);
+				break;
+			case "--lookback": {
+				const value = requireToken(tokens, ++index, token);
+				if (value === "all") {
+					options.lookbackDays = value;
+					break;
+				}
+				const days = Number(value);
+				if (!Number.isSafeInteger(days) || days < 1) throw new Error(`Invalid lookback: ${value}`);
+				options.lookbackDays = days;
+				break;
+			}
+			default:
+				if (!token.startsWith("--") && !positionalConsumed && (subcommand === "status" || subcommand === "pull")) {
+					options.configurationId = token;
+					positionalConsumed = true;
+					break;
+				}
+				throw new Error(`Unknown security cloud option: ${token}`);
+		}
+	}
+	return options;
+}
+
+function cloudClientFor(runtime: SlashCommandRuntime, credentialId?: number): CodexSecurityCloudClient {
+	const authStorage = runtime.session.modelRegistry.authStorage;
+	const account = selectSecurityAccount(authStorage, "openai-codex", credentialId, runtime.session.sessionId);
+	return new CodexSecurityCloudClient({ authStorage, account });
+}
+
+async function handleCloudCommand(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const { verb, rest: optionsText } = parseSubcommand(rest);
+	const subcommand = verb || "scans";
+	const options = parseCloudOptions(optionsText, subcommand);
+	const client = cloudClientFor(runtime, options.credentialId);
+	switch (subcommand) {
+		case "scans": {
+			const configurations = await client.listAllConfigurations();
+			await runtime.output(
+				configurations.length === 0
+					? "No Codex Security cloud scan configurations are available for this account."
+					: configurations
+							.map(item =>
+								[
+									item.id,
+									item.state ?? "unknown",
+									item.currentStep ?? "unknown",
+									`repo=${item.repositoryId}`,
+									`environment=${item.environmentId}`,
+									item.repositoryUrl,
+									item.remainingScans === undefined ? "" : `${item.remainingScans} scan(s) remaining`,
+								]
+									.filter(Boolean)
+									.join(" "),
+							)
+							.join("\n"),
+			);
+			return;
+		}
+		case "start": {
+			if (!options.repositoryId || !options.repositoryUrl || !options.environmentId) {
+				throw new Error("cloud start requires --repo-id, --repo-url, and --environment");
+			}
+			const configuration = await client.startScan({
+				repositoryId: options.repositoryId,
+				repositoryUrl: options.repositoryUrl,
+				environmentId: options.environmentId,
+				lookbackDays: options.lookbackDays,
+			});
+			await runtime.output(
+				`Codex Security cloud scan ${configuration.id} started for ${configuration.repositoryUrl}. This consumes cloud scan allowance.`,
+			);
+			return;
+		}
+		case "status": {
+			if (!options.configurationId) throw new Error("cloud status requires a configuration id");
+			await runtime.output(JSON.stringify(await client.getStats(options.configurationId), null, 2));
+			return;
+		}
+		case "pull": {
+			if (!options.configurationId) throw new Error("cloud pull requires a configuration id");
+			const store = await SecurityStore.openForCwd(runtime.cwd);
+			const bundle = await pullCodexSecurityCloudResults({
+				client,
+				configurationId: options.configurationId,
+				store,
+			});
+			await runtime.output(
+				`Imported ${bundle.findings.length} Codex Security cloud finding(s) as security scan ${bundle.scan.id}.`,
+			);
+			return;
+		}
+		default:
+			throw new Error("Usage: /security cloud <scans|start|status|pull>");
+	}
+}
+
+async function updateDisposition(runtime: SlashCommandRuntime, rest: string): Promise<void> {
+	const [scanId, findingId, status, ...rationaleParts] = parseCommandArgs(rest);
+	if (!scanId || !findingId || !status) {
+		throw new Error("disposition requires <scan-id> <finding-id> <status> [rationale]");
+	}
+	if (!DISPOSITIONS.has(status as SecurityDispositionStatus)) throw new Error(`Unknown disposition: ${status}`);
+	const rationale = rationaleParts.join(" ").trim();
+	if (status !== "open" && !rationale) throw new Error(`${status} requires a rationale`);
+	const store = await SecurityStore.openForCwd(runtime.cwd);
+	const finding = await store.updateDisposition(scanId, findingId, {
+		status: status as SecurityDispositionStatus,
+		rationale: rationale || undefined,
+		updatedAt: new Date().toISOString(),
+		actor: "operator",
+	});
+	await runtime.output(`Finding ${finding.id} disposition is now ${finding.disposition.status}.`);
+}
+
+export async function handleSecurityCommand(
+	command: ParsedSlashCommand,
+	runtime: SlashCommandRuntime,
+): Promise<SlashCommandResult> {
+	if (!runtime.settings.get("security.enabled")) {
+		return usage("Security is disabled. Enable security.enabled before using /security.", runtime);
+	}
+	const { verb, rest } = parseSubcommand(command.args);
+	try {
+		switch (verb || "scans") {
+			case "plan": {
+				const plan = await preflight(runtime, rest);
+				await runtime.output(`Security plan ${plan.id} is ready. Fingerprint: ${plan.fingerprint}.`);
+				return commandConsumed();
+			}
+			case "scan": {
+				const coordinator = coordinatorFor(runtime);
+				const planId = rest.trim().startsWith("secplan_") ? rest.trim() : (await preflight(runtime, rest)).id;
+				const operation = await coordinator.start({ planId });
+				await runtime.output(`Security scan ${operation.scanId} started as ${operation.operationId}.`);
+				return commandConsumed();
+			}
+			case "status": {
+				const coordinator = coordinatorFor(runtime);
+				const operationId = rest.trim();
+				if (operationId) {
+					const operation = await coordinator.status(operationId);
+					if (!operation) throw new Error(`Unknown security operation: ${operationId}`);
+					await runtime.output(JSON.stringify(operation, null, 2));
+				} else {
+					await runtime.output(JSON.stringify(await coordinator.listOperations(), null, 2));
+				}
+				return commandConsumed();
+			}
+			case "cancel": {
+				const operationId = rest.trim();
+				if (!operationId) throw new Error("cancel requires an operation id");
+				await runtime.output(
+					(await coordinatorFor(runtime).cancel(operationId))
+						? `Cancellation requested for ${operationId}.`
+						: `No cancellable security operation ${operationId}.`,
+				);
+				return commandConsumed();
+			}
+			case "scans": {
+				const scans = await (await SecurityStore.openForCwd(runtime.cwd)).listScans();
+				await runtime.output(
+					scans.length === 0
+						? "No security scans are stored for this project."
+						: scans
+								.map(scan => `${scan.id} ${scan.status} ${scan.findingCount} finding(s) ${scan.producer.name}`)
+								.join("\n"),
+				);
+				return commandConsumed();
+			}
+			case "show":
+				await showResource(runtime, rest);
+				return commandConsumed();
+			case "import":
+				await importResults(runtime, rest);
+				return commandConsumed();
+			case "export":
+				await exportResults(runtime, rest);
+				return commandConsumed();
+			case "validate": {
+				const target = findingTarget(rest);
+				return {
+					prompt: prompt
+						.render(validationRequestPrompt, {
+							findingUri: target.uri,
+							scanId: target.scanId,
+							findingId: target.findingId,
+						})
+						.trim(),
+				};
+			}
+			case "compare": {
+				const [beforeScanId, afterScanId] = parseCommandArgs(rest);
+				if (!beforeScanId || !afterScanId) throw new Error("compare requires <before-scan-id> <after-scan-id>");
+				const report = await (await SecurityStore.openForCwd(runtime.cwd)).compare(beforeScanId, afterScanId);
+				await runtime.output(JSON.stringify(report, null, 2));
+				return commandConsumed();
+			}
+			case "cloud":
+				await handleCloudCommand(runtime, rest);
+				return commandConsumed();
+			case "disposition":
+				await updateDisposition(runtime, rest);
+				return commandConsumed();
+			default:
+				return usage(
+					"Usage: /security <plan|scan|status|cancel|scans|cloud|show|import|export|validate|compare|disposition>",
+					runtime,
+				);
+		}
+	} catch (error) {
+		await runtime.output(`Security: ${errorMessage(error)}`);
+		return commandConsumed();
+	}
+}

package/src/system-prompt.ts

@@ -528,6 +528,8 @@ export interface BuildSystemPromptOptions {
 	workspaceTree?: WorkspaceTree | Promise<WorkspaceTree>;
 	/** Whether the local memory://root summary is active. */
 	memoryRootEnabled?: boolean;
+	/** Whether the read-only security:// resource namespace is active. */
+	securityEnabled?: boolean;
 	/** Active model identifier (e.g. "anthropic/claude-opus-4") used by prompt policy and optionally surfaced. */
 	model?: string;
 	/** Whether to surface `model` in the workstation block. Model-specific prompt policy still uses it. Default: true. */
@@ -585,6 +587,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		secretsEnabled = false,
 		workspaceTree: providedWorkspaceTree,
 		memoryRootEnabled = false,
+		securityEnabled = false,
 		model,
 		includeModelInPrompt = true,
 		personality = "default",
@@ -866,6 +869,7 @@ export async function buildSystemPrompt(options: BuildSystemPromptOptions = {}):
 		taskIrcEnabled,
 		secretsEnabled,
 		hasMemoryRoot: memoryRootEnabled,
+		securityEnabled,
 		hasObsidian: hasObsidian(),
 		includeWorkspaceTree,
 		renderMermaid,

package/src/task/agents.ts

@@ -12,6 +12,7 @@ import agentFrontmatterTemplate from "../prompts/agents/frontmatter.md" with { t
 import librarianMd from "../prompts/agents/librarian.md" with { type: "text" };
 import reviewerMd from "../prompts/agents/reviewer.md" with { type: "text" };
 import scoutMd from "../prompts/agents/scout.md" with { type: "text" };
+import securityReviewerMd from "../prompts/agents/security-reviewer.md" with { type: "text" };
 import taskMd from "../prompts/agents/task.md" with { type: "text" };
 import { AUTO_THINKING } from "../thinking";
 
@@ -44,6 +45,7 @@ const EMBEDDED_AGENT_DEFS: EmbeddedAgentDef[] = [
 	{ fileName: "scout.md", template: scoutMd },
 	{ fileName: "designer.md", template: designerMd },
 	{ fileName: "reviewer.md", template: reviewerMd },
+	{ fileName: "security-reviewer.md", template: securityReviewerMd },
 	{ fileName: "librarian.md", template: librarianMd },
 	{
 		fileName: "task.md",

package/src/task/executor.ts

@@ -306,6 +306,8 @@ export interface ExecutorOptions {
 	cwd: string;
 	/** Additional workspace directories to seed on the subagent session (multi-root). */
 	additionalDirectories?: string[];
+	/** Exact provider credential resolver inherited from the parent session. */
+	getApiKey?: CreateAgentSessionOptions["getApiKey"];
 	worktree?: string;
 	agent: AgentDefinition;
 	task: string;
@@ -2783,6 +2785,7 @@ export async function runSubprocess(options: ExecutorOptions): Promise<SingleRes
 				additionalDirectories: worktree !== undefined ? undefined : options.additionalDirectories,
 				authStorage,
 				modelRegistry,
+				getApiKey: options.getApiKey,
 				settings: subagentSettings,
 				model,
 				modelPattern: model || modelOverride === undefined ? undefined : modelPatterns,

package/src/task/structured-subagent.ts

@@ -373,10 +373,12 @@ function buildExecutorOptions(
 		getArtifactsDir: session.getArtifactsDir ?? (() => null),
 		getSessionId: session.getSessionId ?? (() => null),
 	};
-	const enableMCP = !policy.planMode && (session.enableMCP ?? true);
+	const restrictToolNames = policy.planMode || session.restrictToolNames === true;
+	const enableMCP = !restrictToolNames && (session.enableMCP ?? true);
 	return {
 		cwd: session.cwd,
 		additionalDirectories: session.additionalDirectories,
+		getApiKey: session.getApiKey,
 		agent: policy.effectiveAgent,
 		task: renderSubagentPrompt(request.assignment),
 		assignment: request.assignment.trim(),
@@ -408,7 +410,7 @@ function buildExecutorOptions(
 		enableLsp: policy.enableLsp,
 		enableIrc: policy.enableIrc,
 		maxRuntimeMs: request.maxRuntimeMs,
-		restrictToolNames: policy.planMode,
+		restrictToolNames,
 		keepAlive: request.keepAlive,
 		signal: request.signal,
 		eventBus: session.eventBus,
@@ -424,8 +426,8 @@ function buildExecutorOptions(
 		workspaceTree: session.workspaceTree,
 		promptTemplates: session.promptTemplates,
 		rules: session.rules,
-		preloadedExtensionPaths: policy.planMode ? [] : session.extensionPaths,
-		preloadedCustomToolPaths: policy.planMode ? [] : session.customToolPaths,
+		preloadedExtensionPaths: restrictToolNames ? [] : session.extensionPaths,
+		preloadedCustomToolPaths: restrictToolNames ? [] : session.customToolPaths,
 		localProtocolOptions,
 		parentArtifactManager: session.getArtifactManager?.() ?? undefined,
 		parentHindsightSessionState: session.getHindsightSessionState?.(),

package/src/tools/builtin-names.ts

@@ -16,6 +16,7 @@ export const BUILTIN_TOOL_NAMES = [
 	"computer",
 	"checkpoint",
 	"rewind",
+	"security_scan",
 	"task",
 	"hub",
 	"todo",

package/src/tools/index.ts

@@ -1,5 +1,5 @@
 import type { Clipboard, InMemorySnapshotStore } from "@oh-my-pi/hashline";
-import type { AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
+import type { AgentOptions, AgentTelemetryConfig, AgentTool } from "@oh-my-pi/pi-agent-core";
 import type { FetchImpl, ImageContent, Model, ServiceTierByFamily, ToolChoice } from "@oh-my-pi/pi-ai";
 import { logger } from "@oh-my-pi/pi-utils";
 import type { AsyncJobManager } from "../async/job-manager";
@@ -60,6 +60,7 @@ import { MemoryRetainTool } from "./memory-retain";
 import { wrapToolWithMetaNotice } from "./output-meta";
 import { ReadTool } from "./read";
 import type { PlanProposalHandler } from "./resolve";
+import { SecurityScanTool } from "./security-scan";
 import { type TodoPhase, TodoTool } from "./todo";
 import { WriteTool } from "./write";
 import { isMountableUnderXdev, type XdevState } from "./xdev";
@@ -99,6 +100,7 @@ export * from "./read";
 export * from "./report-tool-issue";
 export * from "./resolve";
 export * from "./review";
+export * from "./security-scan";
 export * from "./todo";
 export * from "./tts";
 export * from "./vibe";
@@ -162,6 +164,8 @@ export interface ToolSession {
 	suppressSpawnAdvisory?: boolean;
 	/** Optional fetch implementation injected into the URL read pipeline (tests, proxies). Defaults to global fetch. */
 	fetch?: FetchImpl;
+	/** Provider credential resolver forwarded unchanged to restricted child sessions. */
+	getApiKey?: AgentOptions["getApiKey"];
 	/** Skip subprocess-kernel availability checks and warmup */
 	skipPythonPreflight?: boolean;
 	/** Pre-loaded context files (AGENTS.md, etc) */
@@ -191,6 +195,8 @@ export interface ToolSession {
 	customToolPaths?: ToolPathWithSource[];
 	/** Whether LSP integrations are enabled */
 	enableLsp?: boolean;
+	/** Whether LSP is limited to navigation and diagnostics. */
+	lspReadOnly?: boolean;
 	/** Whether this invocation may expose IRC. `false` removes it even for subagents. */
 	enableIrc?: boolean;
 	/**
@@ -398,6 +404,7 @@ export type ToolFactory = (session: ToolSession) => Tool | null | Promise<Tool |
  */
 export const BUILTIN_TOOLS: Record<BuiltinToolName, ToolFactory> = {
 	read: s => new ReadTool(s),
+	security_scan: s => new SecurityScanTool(s),
 	bash: s => new BashTool(s),
 	edit: s => new EditTool(s),
 	ast_grep: s => new AstGrepTool(s),
@@ -587,6 +594,7 @@ export async function createTools(session: ToolSession, toolNames?: string[]): P
 		if (name === "ast_edit") return session.settings.get("astEdit.enabled");
 		if (name === "inspect_image") return isInspectImageToolActive(session);
 		if (name === "web_search") return session.settings.get("web_search.enabled");
+		if (name === "security_scan") return session.settings.get("security.enabled");
 		if (name === "ask") return session.settings.get("ask.enabled");
 		if (name === "browser") return session.settings.get("browser.enabled");
 		if (name === "computer") return session.settings.get("computer.enabled");

package/src/tools/path-utils.ts

@@ -42,6 +42,7 @@ const INTERNAL_SCHEMES_WITH_SELECTORS: Record<string, true> = {
 	omp: true,
 	pr: true,
 	rule: true,
+	security: true,
 	skill: true,
 	ssh: true,
 	vault: true,
@@ -60,6 +61,7 @@ const TOP_LEVEL_INTERNAL_URL_PREFIXES = [
 	"artifact://",
 	"skill://",
 	"rule://",
+	"security://",
 	"local://",
 	"mcp://",
 	"ssh://",
@@ -117,6 +119,7 @@ function normalizeAtPrefix(filePath: string): string {
 		withoutAt.startsWith("artifact://") ||
 		withoutAt.startsWith("skill://") ||
 		withoutAt.startsWith("rule://") ||
+		withoutAt.startsWith("security://") ||
 		withoutAt.startsWith("local:") ||
 		withoutAt.startsWith("mcp://")
 	) {