@oh-my-pi/pi-coding-agent 17.2.0 → 17.2.1

package/dist/types/security/contracts/types.d.ts

@@ -0,0 +1,234 @@
+export type SecuritySeverityLevel = "critical" | "high" | "medium" | "low" | "informational";
+export type SecurityConfidenceLevel = "high" | "medium" | "low";
+export type SecurityScanStatus = "planned" | "running" | "completed" | "partial" | "cancelled" | "failed";
+export type SecurityCoverageCompleteness = "complete" | "partial" | "unknown";
+export type SecurityValidationStatus = "unvalidated" | "validated" | "rejected" | "partial" | "error";
+export type SecurityDispositionStatus = "open" | "false_positive" | "accepted_risk" | "fixed" | "wont_fix";
+export type SecurityTargetKind = "repository" | "scoped_path" | "ref_diff" | "working_tree" | "imported";
+export type SecurityProducerKind = "omp-native" | "codex-security-bundle" | "codex-security-cloud" | "sarif-import";
+export interface SecurityProducer {
+    kind: SecurityProducerKind;
+    name: string;
+    version?: string;
+    vendor?: string;
+    revision?: string;
+    pluginVersion?: string;
+}
+export interface SecurityUpstreamProvenance {
+    repository?: string;
+    revision?: string;
+    packageVersion?: string;
+    pluginVersion?: string;
+    archiveSha256?: string;
+}
+export interface SecurityProvenance {
+    producer: SecurityProducer;
+    createdAt: string;
+    importedAt?: string;
+    sourceIds?: Record<string, string>;
+    vendorFingerprints?: Record<string, string>;
+    upstream?: SecurityUpstreamProvenance;
+    metadata?: Record<string, unknown>;
+}
+export interface SecurityLocation {
+    path: string;
+    startLine: number;
+    endLine?: number;
+    startColumn?: number;
+    endColumn?: number;
+    role?: string;
+}
+export interface SecurityEvidence {
+    id: string;
+    kind: "code" | "trace" | "validation" | "note";
+    label: string;
+    explanation: string;
+    location?: SecurityLocation;
+    excerpt?: string;
+}
+export interface SecurityOccurrence {
+    id: string;
+    locations: SecurityLocation[];
+    evidenceIds: string[];
+}
+export interface SecuritySeverity {
+    level: SecuritySeverityLevel;
+    score?: number;
+    scoringSystem?: string;
+    vector?: string;
+    rationale?: string;
+}
+export interface SecurityConfidence {
+    level: SecurityConfidenceLevel;
+    rationale?: string;
+}
+export interface SecurityTaxonomy {
+    category: string;
+    cwe: string[];
+    tags?: string[];
+}
+export interface SecurityValidation {
+    status: SecurityValidationStatus;
+    summary?: string;
+    evidenceIds: string[];
+    validatedAt?: string;
+}
+export interface SecurityDisposition {
+    status: SecurityDispositionStatus;
+    rationale?: string;
+    updatedAt?: string;
+    actor?: string;
+}
+export interface SecurityFinding {
+    id: string;
+    scanId: string;
+    fingerprint: string;
+    ruleId: string;
+    anchor?: string;
+    title: string;
+    summary: string;
+    severity: SecuritySeverity;
+    confidence: SecurityConfidence;
+    taxonomy: SecurityTaxonomy;
+    occurrences: SecurityOccurrence[];
+    evidence: SecurityEvidence[];
+    remediation?: string;
+    validation: SecurityValidation;
+    disposition: SecurityDisposition;
+    provenance: SecurityProvenance;
+    extensions?: Record<string, unknown>;
+}
+export interface SecurityCoverageSurface {
+    id: string;
+    label: string;
+    disposition: "reported" | "no_issue_found" | "rejected" | "not_applicable" | "needs_follow_up";
+    receiptRefs: string[];
+    riskArea?: string;
+    notes?: string;
+}
+export interface SecurityCoverageDeferred {
+    id: string;
+    reason: string;
+    paths?: string[];
+    surfaceIds?: string[];
+}
+export interface SecurityCoverage {
+    mode: "repository" | "scoped_path" | "diff" | "working_tree" | "deep_repository" | "imported";
+    completeness: SecurityCoverageCompleteness;
+    inventoryStrategy: "repository" | "scoped_path" | "diff" | "directory" | "custom" | "imported";
+    includePaths: string[];
+    excludePaths: string[];
+    surfaces: SecurityCoverageSurface[];
+    explicitExclusions: Array<{
+        pattern: string;
+        reason: string;
+    }>;
+    deferred: SecurityCoverageDeferred[];
+    openQuestions?: Array<{
+        question: string;
+        followUpPrompt?: string;
+    }>;
+}
+export interface SecurityTarget {
+    kind: SecurityTargetKind;
+    repositoryRoot: string;
+    displayName: string;
+    revision?: string;
+    baseRevision?: string;
+    headRevision?: string;
+    includePaths: string[];
+    excludePaths: string[];
+    treeDigest: string;
+}
+export interface SecurityModelRef {
+    provider: string;
+    modelId: string;
+    thinkingLevel?: string;
+}
+export interface SecurityAccountRef {
+    provider: string;
+    credentialId: number;
+    accountId?: string;
+    email?: string;
+    organizationId?: string;
+    organizationName?: string;
+}
+export interface SecurityKnowledgeBaseRef {
+    path: string;
+    sha256: string;
+    size: number;
+}
+export interface SecurityOutputPlan {
+    root: string;
+    archiveExisting: boolean;
+    existingState: "absent" | "empty" | "archivable";
+}
+export interface SecurityScanPlan {
+    documentType: "omp-security.scan-plan";
+    schemaVersion: "1.0";
+    id: string;
+    createdAt: string;
+    repositoryRoot: string;
+    target: SecurityTarget;
+    knowledgeBases: SecurityKnowledgeBaseRef[];
+    output: SecurityOutputPlan;
+    model: SecurityModelRef;
+    account: SecurityAccountRef;
+    configFingerprint: string;
+    workflowFingerprint: string;
+    fingerprint: string;
+}
+export interface SecurityScanMetrics {
+    runtimeMs?: number;
+    tokenUsage?: {
+        input: number;
+        output: number;
+        reasoning: number;
+        cacheRead: number;
+        cacheWrite: number;
+        total: number;
+    };
+    cost?: number;
+    premiumRequests?: number;
+}
+export interface SecurityScan {
+    documentType: "omp-security.scan";
+    schemaVersion: "1.0";
+    id: string;
+    projectKey: string;
+    status: SecurityScanStatus;
+    createdAt: string;
+    startedAt?: string;
+    completedAt?: string;
+    plan?: SecurityScanPlan;
+    target: SecurityTarget;
+    producer: SecurityProducer;
+    provenance: SecurityProvenance;
+    findingIds: string[];
+    coverage: SecurityCoverage;
+    reportRef?: string;
+    sarifRef?: string;
+    error?: string;
+    metrics?: SecurityScanMetrics;
+}
+export interface SecurityScanBundle {
+    scan: SecurityScan;
+    findings: SecurityFinding[];
+    report?: string;
+    sarif?: Record<string, unknown>;
+}
+export interface SecurityFindingMatch {
+    beforeFindingId?: string;
+    afterFindingId?: string;
+    fingerprint: string;
+    status: "unchanged" | "new" | "resolved";
+    matchBasis?: "fingerprint" | "rule_location" | "taxonomy_location";
+}
+export interface SecurityComparisonReport {
+    beforeScanId: string;
+    afterScanId: string;
+    matches: SecurityFindingMatch[];
+    unchanged: number;
+    introduced: number;
+    resolved: number;
+}

package/dist/types/security/contracts/validation.d.ts

@@ -0,0 +1,5 @@
+import type { SecurityFinding, SecurityScan, SecurityScanBundle, SecurityScanPlan } from "./types.js";
+export declare function parseSecurityFinding(value: unknown): SecurityFinding;
+export declare function parseSecurityScan(value: unknown): SecurityScan;
+export declare function parseSecurityScanPlan(value: unknown): SecurityScanPlan;
+export declare function parseSecurityScanBundle(value: unknown): SecurityScanBundle;

package/dist/types/security/coordinator.d.ts

@@ -0,0 +1,100 @@
+import type { Model } from "@oh-my-pi/pi-ai";
+import type { AsyncJobManager } from "../async/job-manager.js";
+import type { ModelRegistry } from "../config/model-registry.js";
+import type { Settings } from "../config/settings.js";
+import type { ToolDefinition } from "../extensibility/extensions/index.js";
+import type { AuthStorage } from "../session/auth-storage.js";
+import { SessionManager } from "../session/session-manager.js";
+import type { SecurityScanPlan } from "./contracts/index.js";
+import type { SecurityGitAdapter, SecurityTargetRequest } from "./preflight.js";
+import { SecurityStore } from "./store.js";
+export type SecurityOperationPhase = "queued" | "preparing" | "reviewing" | "publishing" | "completed" | "partial" | "cancelled" | "failed";
+export interface SecurityOperationSnapshot {
+    operationId: string;
+    planId: string;
+    scanId: string;
+    phase: SecurityOperationPhase;
+    createdAt: string;
+    updatedAt: string;
+    jobId?: string;
+    sessionFile?: string;
+    findingCount: number;
+    error?: string;
+}
+export interface SecurityCoordinatorHost {
+    cwd: string;
+    settings: Settings;
+    authStorage: AuthStorage;
+    modelRegistry: ModelRegistry;
+    activeModel?: Model;
+    sessionId?: string;
+    agentId?: string;
+    asyncJobManager?: AsyncJobManager;
+}
+export interface SecurityPreflightInput {
+    target?: SecurityTargetRequest;
+    knowledgeBasePaths?: string[];
+    outputRoot?: string;
+    archiveExisting?: boolean;
+    credentialId?: number;
+    model?: Model;
+    thinkingLevel?: string;
+    signal?: AbortSignal;
+}
+export interface SecurityStartInput {
+    planId: string;
+}
+export interface SecurityScanSession {
+    prompt(text: string, options?: {
+        expandPromptTemplates?: boolean;
+        synthetic?: boolean;
+        userInitiated?: boolean;
+    }): Promise<boolean>;
+    waitForIdle(): Promise<void>;
+    getSessionStats?(): {
+        tokens: {
+            input: number;
+            output: number;
+            reasoning: number;
+            cacheRead: number;
+            cacheWrite: number;
+            total: number;
+        };
+        cost: number;
+        premiumRequests: number;
+    };
+    abort(options?: {
+        reason?: string;
+    }): Promise<void>;
+    dispose(): Promise<void>;
+    readonly sessionFile?: string;
+}
+export interface SecurityScanSessionFactoryInput {
+    host: SecurityCoordinatorHost;
+    plan: SecurityScanPlan;
+    executionRoot: string;
+    scanId: string;
+    model: Model;
+    publicationTool: ToolDefinition;
+    sessionManager: SessionManager;
+}
+export type SecurityScanSessionFactory = (input: SecurityScanSessionFactoryInput) => Promise<SecurityScanSession>;
+export interface SecurityCoordinatorDependencies {
+    createSession?: SecurityScanSessionFactory;
+    openStore?: (repositoryRoot: string) => Promise<SecurityStore>;
+    gitAdapter?: SecurityGitAdapter;
+    now?: () => Date;
+    createOperationId?: () => string;
+}
+export declare class SecurityCoordinator {
+    #private;
+    constructor(host: SecurityCoordinatorHost, dependencies?: SecurityCoordinatorDependencies);
+    preflight(input?: SecurityPreflightInput): Promise<SecurityScanPlan>;
+    start(input: SecurityStartInput): Promise<SecurityOperationSnapshot>;
+    status(operationId: string): Promise<SecurityOperationSnapshot | null>;
+    listOperations(): Promise<SecurityOperationSnapshot[]>;
+    cancel(operationId: string): Promise<boolean>;
+    wait(operationId: string): Promise<SecurityOperationSnapshot>;
+}
+export declare function getSecurityCoordinator(host: SecurityCoordinatorHost): SecurityCoordinator;
+export declare function resetSecurityCoordinatorsForTests(): void;

package/dist/types/security/importers/codex-security.d.ts

@@ -0,0 +1,7 @@
+import type { SecurityScanBundle } from "../contracts/index.js";
+export interface CodexSecurityImportOptions {
+    repositoryRoot: string;
+    createdAt?: string;
+    createScanId?: () => string;
+}
+export declare function importCodexSecurityBundle(bundleDirectory: string, options: CodexSecurityImportOptions): Promise<SecurityScanBundle>;

package/dist/types/security/importers/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./codex-security.js";
+export * from "./sarif.js";

package/dist/types/security/importers/sarif.d.ts

@@ -0,0 +1,9 @@
+import type { SecurityScanBundle } from "../contracts/index.js";
+export interface SarifImportOptions {
+    repositoryRoot: string;
+    sourcePath?: string;
+    createdAt?: string;
+    createScanId?: () => string;
+}
+export declare function importSarif(input: unknown, options: SarifImportOptions): Promise<SecurityScanBundle>;
+export declare function importSarifFile(filePath: string, options: Omit<SarifImportOptions, "sourcePath">): Promise<SecurityScanBundle>;

package/dist/types/security/index.d.ts

@@ -0,0 +1,13 @@
+export * from "./auth.js";
+export * from "./cloud.js";
+export * from "./comparison.js";
+export * from "./contracts/index.js";
+export * from "./coordinator.js";
+export * from "./importers/index.js";
+export * from "./preflight.js";
+export * from "./provenance.js";
+export * from "./publication.js";
+export * from "./remediation.js";
+export * from "./resource-output.js";
+export * from "./sarif.js";
+export * from "./store.js";

package/dist/types/security/preflight.d.ts

@@ -0,0 +1,61 @@
+import type { SecurityAccountRef, SecurityModelRef, SecurityOutputPlan, SecurityScanPlan } from "./contracts/index.js";
+export type SecurityTargetRequest = {
+    kind: "repository";
+    includePaths?: string[];
+    excludePaths?: string[];
+} | {
+    kind: "scoped_path";
+    includePaths: string[];
+    excludePaths?: string[];
+} | {
+    kind: "ref_diff";
+    baseRevision: string;
+    headRevision: string;
+    includePaths?: string[];
+    excludePaths?: string[];
+} | {
+    kind: "working_tree";
+    includePaths?: string[];
+    excludePaths?: string[];
+};
+export interface SecurityPlanRequest {
+    cwd: string;
+    target: SecurityTargetRequest;
+    knowledgeBasePaths?: string[];
+    outputRoot: string;
+    archiveExisting?: boolean;
+    model: SecurityModelRef;
+    account: SecurityAccountRef;
+    config: unknown;
+    workflowFingerprint: string;
+    signal?: AbortSignal;
+    createdAt?: string;
+}
+export interface SecurityPlanFreshnessInput {
+    config: unknown;
+    workflowFingerprint: string;
+    signal?: AbortSignal;
+}
+export interface SecurityGitAdapter {
+    root(cwd: string, signal?: AbortSignal): Promise<string | null>;
+    headSha(cwd: string, signal?: AbortSignal): Promise<string | null>;
+    resolveRef(cwd: string, refName: string, signal?: AbortSignal): Promise<string | null>;
+    diffTree(cwd: string, base: string, head: string, signal?: AbortSignal): Promise<string>;
+    status(cwd: string, signal?: AbortSignal): Promise<string>;
+    files(cwd: string, signal?: AbortSignal): Promise<string[]>;
+    untracked(cwd: string, signal?: AbortSignal): Promise<string[]>;
+}
+export declare const DEFAULT_SECURITY_GIT_ADAPTER: SecurityGitAdapter;
+export declare class StaleSecurityScanPlanError extends Error {
+    readonly expected: string;
+    readonly actual: string;
+    constructor(expected: string, actual: string);
+}
+export declare function pathMatchesSecurityScope(relativePath: string, includePaths: readonly string[], excludePaths: readonly string[]): boolean;
+export interface PreparedSecurityOutput {
+    root: string;
+    archivedTo?: string;
+}
+export declare function prepareSecurityOutputDirectory(output: SecurityOutputPlan, archiveSuffix?: string): Promise<PreparedSecurityOutput>;
+export declare function createSecurityScanPlan(request: SecurityPlanRequest, adapter?: SecurityGitAdapter): Promise<SecurityScanPlan>;
+export declare function assertSecurityScanPlanFresh(plan: SecurityScanPlan, freshness: SecurityPlanFreshnessInput, adapter?: SecurityGitAdapter): Promise<void>;

package/dist/types/security/provenance.d.ts

@@ -0,0 +1,24 @@
+import type { SecurityAccountRef, SecurityProducer, SecurityProvenance, SecurityScan } from "./contracts/index.js";
+export declare const CODEX_SECURITY_UPSTREAM: {
+    readonly repository: "https://github.com/openai/codex-security";
+    readonly revision: "f22d4a36f26d16287bcdfd707b369116e02a08c3";
+    readonly packageVersion: "0.1.1";
+    readonly pluginVersion: "0.1.14";
+    readonly archiveSha256: "13745c495b7c5cf5273cf2115df86b9c3ec3056f43151c869e004aa3f30bcffb";
+};
+export declare const OMP_SECURITY_WORKFLOW_VERSION = "1.0.0";
+export declare function createNativeSecurityProducer(): SecurityProducer;
+export declare function createSecurityCredentialAffinity(account: SecurityAccountRef): string;
+export declare function redactPrivateSecurityMetadata(value: unknown): unknown;
+export declare function createPublicSecurityScan(scan: SecurityScan, options?: {
+    includePlan?: boolean;
+}): unknown;
+export declare function createNativeSecurityProvenance(options: {
+    createdAt: string;
+    account: SecurityAccountRef;
+    planFingerprint: string;
+    workflowFingerprint: string;
+    sessionId?: string;
+    operationId?: string;
+}): SecurityProvenance;
+export declare function createSecurityWorkflowFingerprint(inputs: readonly string[]): string;

package/dist/types/security/publication.d.ts

@@ -0,0 +1,78 @@
+import type { ToolDefinition } from "../extensibility/extensions/index.js";
+import type { SecurityScanBundle, SecurityScanPlan } from "./contracts/index.js";
+import { type SecurityStore } from "./store.js";
+export declare const securityPublishSchema: import("arktype/internal/variants/object.ts").ObjectType<{
+    findings: {
+        rule_id: string;
+        title: string;
+        summary: string;
+        severity: "critical" | "high" | "informational" | "low" | "medium";
+        confidence: "high" | "low" | "medium";
+        category: string;
+        anchor?: string | undefined;
+        cwe?: string[] | undefined;
+        locations: {
+            path: string;
+            start_line: number;
+            end_line?: number | undefined;
+            start_column?: number | undefined;
+            end_column?: number | undefined;
+            role?: string | undefined;
+        }[];
+        evidence?: {
+            label: string;
+            explanation: string;
+            excerpt?: string | undefined;
+            location?: {
+                path: string;
+                start_line: number;
+                end_line?: number | undefined;
+                start_column?: number | undefined;
+                end_column?: number | undefined;
+                role?: string | undefined;
+            } | undefined;
+        }[] | undefined;
+        remediation?: string | undefined;
+        validation?: "partial" | "unvalidated" | "validated" | undefined;
+    }[];
+    coverage: {
+        completeness: "complete" | "partial" | "unknown";
+        surfaces?: {
+            label: string;
+            disposition: "needs_follow_up" | "no_issue_found" | "not_applicable" | "rejected" | "reported";
+            risk_area?: string | undefined;
+            notes?: string | undefined;
+            receipt_refs?: string[] | undefined;
+        }[] | undefined;
+        explicit_exclusions?: {
+            pattern: string;
+            reason: string;
+        }[] | undefined;
+        deferred?: {
+            reason: string;
+            paths?: string[] | undefined;
+            surface_ids?: string[] | undefined;
+        }[] | undefined;
+        open_questions?: {
+            question: string;
+            follow_up_prompt?: string | undefined;
+        }[] | undefined;
+    };
+    report: string;
+}, {}>;
+export type SecurityPublishParams = typeof securityPublishSchema.infer;
+export interface SecurityPublishDetails {
+    scanId: string;
+    findingCount: number;
+    status: "completed";
+}
+export interface SecurityPublicationOptions {
+    plan: SecurityScanPlan;
+    scanId: string;
+    store: SecurityStore;
+    startedAt: string;
+    sessionId?: string;
+    operationId?: string;
+    onPublished?: (bundle: SecurityScanBundle) => void | Promise<void>;
+}
+export declare function createSecurityPublicationTool(options: SecurityPublicationOptions): ToolDefinition<typeof securityPublishSchema, SecurityPublishDetails>;

package/dist/types/security/remediation.d.ts

@@ -0,0 +1,27 @@
+import type { IsoBackendKind } from "@oh-my-pi/pi-natives";
+import type { IsolationContext } from "../task/isolation-runner.js";
+import type { IsolationHandle, WorktreeBaseline } from "../task/worktree.js";
+export interface SecurityRemediationRequest {
+    cwd: string;
+    findingIds: string[];
+    isolationId?: string;
+    preferredBackend?: IsoBackendKind;
+}
+export interface SecurityRemediationWorkspace {
+    id: string;
+    repositoryRoot: string;
+    worktreePath: string;
+    findingIds: string[];
+    backend: IsoBackendKind;
+    fellBack: boolean;
+    fallbackReason: string | null;
+    cleanup(): Promise<void>;
+}
+export interface SecurityRemediationDependencies {
+    prepareContext?: (cwd: string) => Promise<IsolationContext>;
+    createIsolation?: (repositoryRoot: string, id: string, preferred?: IsoBackendKind) => Promise<IsolationHandle>;
+    cleanupIsolation?: (handle: IsolationHandle) => Promise<void>;
+    createId?: () => string;
+}
+export declare function assertSecurityRemediationBaselineClean(baseline: WorktreeBaseline): void;
+export declare function prepareSecurityRemediationWorkspace(request: SecurityRemediationRequest, dependencies?: SecurityRemediationDependencies): Promise<SecurityRemediationWorkspace>;

package/dist/types/security/resource-output.d.ts

@@ -0,0 +1,8 @@
+import type { InternalResource } from "../internal-urls/index.js";
+export interface SecurityResourceOptions {
+    url: string;
+    content: string;
+    contentType: InternalResource["contentType"];
+    isDirectory?: boolean;
+}
+export declare function createSecurityResource(options: SecurityResourceOptions): InternalResource;

package/dist/types/security/sarif.d.ts

@@ -0,0 +1,2 @@
+import type { SecurityScanBundle } from "./contracts/index.js";
+export declare function exportSecurityBundleToSarif(bundle: SecurityScanBundle): Record<string, unknown>;

package/dist/types/security/store.d.ts

@@ -0,0 +1,40 @@
+import type { SecurityComparisonReport, SecurityDisposition, SecurityEvidence, SecurityFinding, SecurityScan, SecurityScanBundle, SecurityScanPlan, SecurityValidation } from "./contracts/index.js";
+export interface SecurityScanSummary {
+    id: string;
+    status: SecurityScan["status"];
+    createdAt: string;
+    completedAt?: string;
+    producer: SecurityScan["producer"];
+    findingCount: number;
+    target: SecurityScan["target"];
+}
+export interface SecurityStoreOptions {
+    stateRoot?: string;
+    signal?: AbortSignal;
+}
+export interface SecurityFileWriteOptions {
+    hardenParent?: boolean;
+}
+export declare function writeSecurityFileAtomic(filePath: string, content: string, options?: SecurityFileWriteOptions): Promise<void>;
+export declare function writeSecurityBundleToDirectory(directory: string, input: SecurityScanBundle): Promise<void>;
+export declare class SecurityStore {
+    #private;
+    constructor(repositoryRoot: string, projectKey: string, projectDirectory: string);
+    static open(repositoryRoot: string, options?: SecurityStoreOptions): Promise<SecurityStore>;
+    static openForCwd(cwd: string, options?: SecurityStoreOptions): Promise<SecurityStore>;
+    get repositoryRoot(): string;
+    get projectKey(): string;
+    get projectDirectory(): string;
+    putBundle(input: SecurityScanBundle): Promise<void>;
+    putPlan(input: SecurityScanPlan): Promise<void>;
+    getPlan(planId: string): Promise<SecurityScanPlan | null>;
+    listPlans(): Promise<SecurityScanPlan[]>;
+    getScan(scanId: string): Promise<SecurityScan | null>;
+    getBundle(scanId: string): Promise<SecurityScanBundle | null>;
+    listScans(): Promise<SecurityScanSummary[]>;
+    getFinding(scanId: string, findingId: string): Promise<SecurityFinding | null>;
+    updateDisposition(scanId: string, findingId: string, disposition: SecurityDisposition): Promise<SecurityFinding>;
+    updateValidation(scanId: string, findingId: string, validation: SecurityValidation, evidence?: readonly SecurityEvidence[]): Promise<SecurityFinding>;
+    compare(beforeScanId: string, afterScanId: string): Promise<SecurityComparisonReport>;
+    storeDigest(): Promise<string>;
+}

package/dist/types/slash-commands/helpers/security.d.ts

@@ -0,0 +1,2 @@
+import type { ParsedSlashCommand, SlashCommandResult, SlashCommandRuntime } from "../types.js";
+export declare function handleSecurityCommand(command: ParsedSlashCommand, runtime: SlashCommandRuntime): Promise<SlashCommandResult>;

package/dist/types/system-prompt.d.ts

@@ -119,6 +119,8 @@ export interface BuildSystemPromptOptions {
     workspaceTree?: WorkspaceTree | Promise<WorkspaceTree>;
     /** Whether the local memory://root summary is active. */
     memoryRootEnabled?: boolean;
+    /** Whether the read-only security:// resource namespace is active. */
+    securityEnabled?: boolean;
     /** Active model identifier (e.g. "anthropic/claude-opus-4") used by prompt policy and optionally surfaced. */
     model?: string;
     /** Whether to surface `model` in the workstation block. Model-specific prompt policy still uses it. Default: true. */

package/dist/types/task/executor.d.ts

@@ -18,6 +18,7 @@ import type { LocalProtocolOptions } from "../internal-urls/index.js";
 import type { MCPManager } from "../mcp/manager.js";
 import type { MnemopiSessionState } from "../mnemopi/state.js";
 import { type AgentReviver } from "../registry/agent-lifecycle.js";
+import { type CreateAgentSessionOptions } from "../sdk.js";
 import type { AgentSession } from "../session/agent-session.js";
 import type { ArtifactManager } from "../session/artifacts.js";
 import type { AuthStorage } from "../session/auth-storage.js";
@@ -56,6 +57,8 @@ export interface ExecutorOptions {
     cwd: string;
     /** Additional workspace directories to seed on the subagent session (multi-root). */
     additionalDirectories?: string[];
+    /** Exact provider credential resolver inherited from the parent session. */
+    getApiKey?: CreateAgentSessionOptions["getApiKey"];
     worktree?: string;
     agent: AgentDefinition;
     task: string;

package/dist/types/tools/builtin-names.d.ts

@@ -1,4 +1,4 @@
-export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "github", "glob", "grep", "lsp", "inspect_image", "browser", "computer", "checkpoint", "rewind", "task", "hub", "todo", "web_search", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
+export declare const BUILTIN_TOOL_NAMES: readonly ["read", "bash", "edit", "ast_grep", "ast_edit", "ask", "debug", "eval", "github", "glob", "grep", "lsp", "inspect_image", "browser", "computer", "checkpoint", "rewind", "security_scan", "task", "hub", "todo", "web_search", "write", "memory_edit", "retain", "recall", "reflect", "learn", "manage_skill"];
 export type BuiltinToolName = (typeof BUILTIN_TOOL_NAMES)[number];
 /** Hidden built-ins: constructible and `--tools`-addressable, but never part of the default active set. */
 export declare const HIDDEN_TOOL_NAMES: readonly ["yield", "goal"];