@oh-my-pi/pi-coding-agent 17.2.4 → 17.2.6

package/src/sdk.ts

@@ -17,6 +17,7 @@ import type {
 	Model,
 	ModelUsageHealth,
 	ProviderSessionState,
+	ServiceTier,
 	SimpleStreamOptions,
 } from "@oh-my-pi/pi-ai";
 import { resolveApiKeyOnce } from "@oh-my-pi/pi-ai/auth-retry";
@@ -102,6 +103,7 @@ import {
 import { type FileSlashCommand, loadSlashCommands as loadSlashCommandsInternal } from "./extensibility/slash-commands";
 import type { HindsightSessionState } from "./hindsight/state";
 import { LocalProtocolHandler, type LocalProtocolOptions } from "./internal-urls";
+import { setSharedLspEnabled } from "./lsp/client";
 import { LSP_STARTUP_EVENT_CHANNEL, type LspStartupEvent } from "./lsp/startup-events";
 import {
 	deduplicateMCPToolsByName,
@@ -169,6 +171,7 @@ import {
 } from "./system-prompt";
 import { AgentOutputManager } from "./task/output-manager";
 import { wrapStreamFnWithProviderConcurrency } from "./task/provider-concurrency";
+import { isScoutSpawnable } from "./task/spawn-policy";
 import type { StructuredSubagentSchemaMode } from "./task/types";
 import {
 	AUTO_THINKING,
@@ -379,6 +382,8 @@ export interface CreateAgentSessionOptions {
 	thinkingLevel?: ConfiguredThinkingLevel;
 	/** Hard ceiling on the session's thinking effort (e.g. a task spawn's `task.maxEffort`-capped hint); retry-fallback recovery re-clamps to it. */
 	thinkingLevelCeiling?: Effort;
+	/** OpenAI service-tier override for this session. `null` omits `service_tier`. */
+	openAIServiceTier?: ServiceTier | null;
 	/** Models available for cycling (Ctrl+P in interactive mode) */
 	scopedModels?: Array<{ model: Model; thinkingLevel?: ThinkingLevel }>;
 	/** Prewalk from the starting model to a fast/cheap target at the first edit/write once the todo list exists. */
@@ -1681,6 +1686,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 		// entries capture it at fetch time and are dropped at injection if a newer
 		// mutation (any tool) bumped it in the meantime.
 		const fileMutationVersions = new Map<string, number>();
+		const disposeCallbacks = new Set<() => void>();
 		const activeToolNames = new Set<string>();
 		const toolRegistry = new Map<string, Tool>();
 		const setActiveToolNames = (names: Iterable<string>): void => {
@@ -1734,6 +1740,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			trackEvalExecution: (execution, abortController) =>
 				session ? session.trackEvalExecution(execution, abortController) : execution,
 			getSessionId: () => sessionManager.getSessionId?.() ?? null,
+			isDisposed: () => session?.isDisposed ?? false,
 			getHindsightSessionState: () => session?.getHindsightSessionState(),
 			getMnemopiSessionState: () => session?.getMnemopiSessionState(),
 			getAgentId: () => resolvedAgentId,
@@ -1760,6 +1767,14 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			recordEvalSubagentUsage: output => sessionManager.recordEvalSubagentOutput(output),
 			getClientBridge: () => session?.clientBridge,
 			queueDeferredDiagnostics: entry => session?.yieldQueue.enqueue(LSP_LATE_DIAGNOSTIC_MESSAGE_TYPE, entry),
+			queueLaunchCompletion: notification =>
+				session?.queueLaunchCompletion(notification) ??
+				Promise.reject(new Error("Session unavailable for launch completion delivery")),
+			registerDisposeCallback: callback => {
+				disposeCallbacks.add(callback);
+				return () => disposeCallbacks.delete(callback);
+			},
+			registerSessionChangeCallback: callback => session?.registerSessionChangeCallback(callback),
 			bumpFileMutationVersion: path => {
 				const next = (fileMutationVersions.get(path) ?? 0) + 1;
 				fileMutationVersions.set(path, next);
@@ -2674,7 +2689,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 		// a real tool.
 		//
 		// It must be a `replace`-mode instance. `PiEditExecArgs` carries
-		// `old_text`/`new_text` pairs, which is exactly `replace`'s schema and
+		// `old_string`/`new_string` replacements, which is exactly `replace`'s schema and
 		// nothing else's — under the default `hashline` mode the frame's args do
 		// not match the tool's parameters at all. The registry instance follows
 		// the session's configured mode, so the bridge builds its own.
@@ -2875,8 +2890,8 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 				}
 			}
 			let appendPrompt: string | undefined = appendParts.length > 0 ? appendParts.join("\n\n") : undefined;
-			// Owned/in-band tool dialects (non-native) require the catalog as `# Tool:`
-			// sections; native tool calling lets the compact name list suffice.
+			// Owned/in-band tool dialects (non-native) require the full functions-
+			// namespace catalog; native tool calling lets the compact name list suffice.
 			const nativeTools = resolveDialect(settings.get("tools.format"), agent?.state.model ?? model) === undefined;
 			const promptTools = projectSystemPromptToolMetadata(
 				tools,
@@ -2910,6 +2925,10 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 				eagerTasksAlways,
 				taskBatch: settings.get("task.batch"),
 				taskMaxConcurrency: settings.get("task.maxConcurrency"),
+				scoutAvailable: isScoutSpawnable(
+					settings.get("task.disabledAgents") as string[] | undefined,
+					options.spawns ?? "*",
+				),
 				taskIrcEnabled: !restrictToolNames && isIrcEnabled(settings, options.taskDepth ?? 0),
 				autoQaEnabled: !restrictToolNames && isAutoQaEnabled(settings),
 				secretsEnabled,
@@ -3143,13 +3162,19 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 		const openaiWebsocketSetting = settings.get("providers.openaiWebsockets") ?? "off";
 		const preferOpenAICodexWebsockets =
 			openaiWebsocketSetting === "on" ? true : openaiWebsocketSetting === "off" ? false : undefined;
-		const initialServiceTierByFamily = hasServiceTierEntry
+		const configuredServiceTierByFamily = hasServiceTierEntry
 			? (existingSession.serviceTier ?? {})
 			: buildServiceTierByFamily(
 					settings.get("tier.openai"),
 					settings.get("tier.anthropic"),
 					settings.get("tier.google"),
 				);
+		const initialServiceTierByFamily = { ...configuredServiceTierByFamily };
+		if (options.openAIServiceTier === null) {
+			delete initialServiceTierByFamily.openai;
+		} else if (options.openAIServiceTier !== undefined) {
+			initialServiceTierByFamily.openai = options.openAIServiceTier;
+		}
 
 		// One-shot launch-latency marker: fired the first time the loop dispatches
 		// a chat request to the provider transport. See onFirstChatDispatch.
@@ -3252,6 +3277,11 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 		// Restore messages if session has existing data
 		if (hasExistingSession) {
 			agent.replaceMessages(existingSession.messages);
+			if (options.openAIServiceTier !== undefined) {
+				sessionManager.appendServiceTierChange(
+					Object.keys(initialServiceTierByFamily).length > 0 ? initialServiceTierByFamily : null,
+				);
+			}
 		} else {
 			// Save initial model, thinking level, and service tier for new sessions so they can be restored on resume.
 			if (model) {
@@ -3262,8 +3292,10 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 				// classification persists its concrete effort once a real user turn runs.
 				sessionManager.appendThinkingLevelChange(effectiveThinkingLevel);
 			}
-			if (Object.keys(initialServiceTierByFamily).length > 0) {
-				sessionManager.appendServiceTierChange(initialServiceTierByFamily);
+			if (options.openAIServiceTier !== undefined || Object.keys(initialServiceTierByFamily).length > 0) {
+				sessionManager.appendServiceTierChange(
+					Object.keys(initialServiceTierByFamily).length > 0 ? initialServiceTierByFamily : null,
+				);
 			}
 		}
 
@@ -3285,6 +3317,9 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 				const id = sessionManager.getSessionId?.();
 				return id ? `${id}-advisor` : null;
 			},
+			queueLaunchCompletion: notification =>
+				session?.queueLaunchCompletion(notification) ??
+				Promise.reject(new Error("Session unavailable for launch completion delivery")),
 			getAgentId: () => "advisor",
 			// The primary's availability signals are wrong for advisors: their tool
 			// slate is filtered separately at runtime (default read/grep/glob, no
@@ -3341,6 +3376,7 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			initialAdvisorCosts,
 			settings,
 			autoApprove: options.autoApprove,
+			scoutAllowedBySpawnPolicy: isScoutSpawnable(undefined, options.spawns ?? "*"),
 			evalKernelOwnerId,
 			// Defined only for top-level sessions (creation is gated above).
 			// AgentSession uses this to decide whether it may dispose the global
@@ -3499,6 +3535,8 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 					unsubscribeCredentialDisabled?.();
 					unsubscribeMcpNotifications?.();
 					unregisterMcpPostmortem?.();
+					for (const callback of disposeCallbacks) callback();
+					disposeCallbacks.clear();
 					// Drop refs so the process-global postmortem list doesn't retain
 					// the bridge closure past explicit dispose.
 					unsubscribeMcpNotifications = undefined;
@@ -3543,6 +3581,11 @@ async function createAgentSessionScoped(options: CreateAgentSessionOptions): Pro
 			}
 		}
 
+		// Broker-shared language servers: one server per project, multiplexed
+		// across omp instances by the LSP mux daemon. Session-level because the
+		// flag lives in module state consulted on every client cold-start.
+		setSharedLspEnabled(enableLsp && settings.get("lsp.shared"));
+
 		// Start LSP warmup in the background so startup does not block on language server initialization.
 		// With `lsp.lazy` (the default) the warmup is skipped: recognized servers are still discovered and
 		// surfaced in the UI as "available", but cold-start on first use — the lsp tool or an edit/write

package/src/secrets/index.ts

@@ -203,7 +203,7 @@ export function collectEnvSecrets(): SecretEntry[] {
  * API keys) that are NOT configured via secrets.yml or the environment. Without
  * these, such a token in a tool result falls through to pi-ai's irreversible
  * provider-boundary redaction (`[openai_token_redacted]`); the model then echoes
- * that placeholder into edit-tool `old_text`, which can never match the real
+ * that placeholder into edit-tool `old_string`, which can never match the real
  * bytes on disk (issue #6968). Routing the same shapes through the obfuscator
  * mints reversible keyed placeholders that `deobfuscateToolArguments` restores
  * before tool execution, keeping exact-match edits working while the credential

package/src/security/contracts/schemas.ts

@@ -1,201 +1,223 @@
-import { type } from "arktype";
+import { once } from "@oh-my-pi/pi-utils";
+import { scope } from "arktype";
 
-const stringRecordSchema = type({ "[string]": "string" });
-const unknownRecordSchema = type({ "[string]": "unknown" });
+export const getSecurityContractSchemas = once(() => {
+	// Security schemas validate only during security scans, so lazy construction
+	// with interpreted traversal avoids eager JIT startup tax without changing correctness.
+	const { type } = scope({}, { jitless: true });
 
-export const securityProducerSchema = type({
-	kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
-	name: "string > 0",
-	"version?": "string",
-	"vendor?": "string",
-	"revision?": "string",
-	"pluginVersion?": "string",
-});
+	const stringRecordSchema = type({ "[string]": "string" });
+	const unknownRecordSchema = type({ "[string]": "unknown" });
 
-export const securityProvenanceSchema = type({
-	producer: securityProducerSchema,
-	createdAt: "string > 0",
-	"importedAt?": "string",
-	"sourceIds?": stringRecordSchema,
-	"vendorFingerprints?": stringRecordSchema,
-	"upstream?": {
-		"repository?": "string",
+	const securityProducerSchema = type({
+		kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
+		name: "string > 0",
+		"version?": "string",
+		"vendor?": "string",
 		"revision?": "string",
-		"packageVersion?": "string",
 		"pluginVersion?": "string",
-		"archiveSha256?": "string",
-	},
-	"metadata?": unknownRecordSchema,
-});
+	});
 
-export const securityLocationSchema = type({
-	path: "string > 0",
-	startLine: "number.integer >= 1",
-	"endLine?": "number.integer >= 1",
-	"startColumn?": "number.integer >= 1",
-	"endColumn?": "number.integer >= 1",
-	"role?": "string",
-});
+	const securityProvenanceSchema = type({
+		producer: securityProducerSchema,
+		createdAt: "string > 0",
+		"importedAt?": "string",
+		"sourceIds?": stringRecordSchema,
+		"vendorFingerprints?": stringRecordSchema,
+		"upstream?": {
+			"repository?": "string",
+			"revision?": "string",
+			"packageVersion?": "string",
+			"pluginVersion?": "string",
+			"archiveSha256?": "string",
+		},
+		"metadata?": unknownRecordSchema,
+	});
 
-export const securityEvidenceSchema = type({
-	id: "string > 0",
-	kind: "'code' | 'trace' | 'validation' | 'note'",
-	label: "string > 0",
-	explanation: "string",
-	"location?": securityLocationSchema,
-	"excerpt?": "string",
-});
+	const securityLocationSchema = type({
+		path: "string > 0",
+		startLine: "number.integer >= 1",
+		"endLine?": "number.integer >= 1",
+		"startColumn?": "number.integer >= 1",
+		"endColumn?": "number.integer >= 1",
+		"role?": "string",
+	});
 
-export const securityOccurrenceSchema = type({
-	id: "string > 0",
-	locations: securityLocationSchema.array().atLeastLength(1),
-	evidenceIds: "string[]",
-});
+	const securityEvidenceSchema = type({
+		id: "string > 0",
+		kind: "'code' | 'trace' | 'validation' | 'note'",
+		label: "string > 0",
+		explanation: "string",
+		"location?": securityLocationSchema,
+		"excerpt?": "string",
+	});
 
-export const securityFindingSchema = type({
-	id: "string > 0",
-	scanId: "string > 0",
-	fingerprint: "string > 0",
-	ruleId: "string > 0",
-	"anchor?": "string",
-	title: "string > 0",
-	summary: "string",
-	severity: {
-		level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
-		"score?": "number",
-		"scoringSystem?": "string",
-		"vector?": "string",
-		"rationale?": "string",
-	},
-	confidence: {
-		level: "'high' | 'medium' | 'low'",
-		"rationale?": "string",
-	},
-	taxonomy: {
-		category: "string > 0",
-		cwe: "string[]",
-		"tags?": "string[]",
-	},
-	occurrences: securityOccurrenceSchema.array().atLeastLength(1),
-	evidence: securityEvidenceSchema.array(),
-	"remediation?": "string",
-	validation: {
-		status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
-		"summary?": "string",
+	const securityOccurrenceSchema = type({
+		id: "string > 0",
+		locations: securityLocationSchema.array().atLeastLength(1),
 		evidenceIds: "string[]",
-		"validatedAt?": "string",
-	},
-	disposition: {
-		status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
-		"rationale?": "string",
-		"updatedAt?": "string",
-		"actor?": "string",
-	},
-	provenance: securityProvenanceSchema,
-	"extensions?": unknownRecordSchema,
-});
+	});
 
-export const securityCoverageSchema = type({
-	mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
-	completeness: "'complete' | 'partial' | 'unknown'",
-	inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	surfaces: type({
-		id: "string > 0",
-		label: "string > 0",
-		disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
-		receiptRefs: "string[]",
-		"riskArea?": "string",
-		"notes?": "string",
-	}).array(),
-	explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
-	deferred: type({
+	const securityFindingSchema = type({
 		id: "string > 0",
-		reason: "string > 0",
-		"paths?": "string[]",
-		"surfaceIds?": "string[]",
-	}).array(),
-	"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
-});
+		scanId: "string > 0",
+		fingerprint: "string > 0",
+		ruleId: "string > 0",
+		"anchor?": "string",
+		title: "string > 0",
+		summary: "string",
+		severity: {
+			level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
+			"score?": "number",
+			"scoringSystem?": "string",
+			"vector?": "string",
+			"rationale?": "string",
+		},
+		confidence: {
+			level: "'high' | 'medium' | 'low'",
+			"rationale?": "string",
+		},
+		taxonomy: {
+			category: "string > 0",
+			cwe: "string[]",
+			"tags?": "string[]",
+		},
+		occurrences: securityOccurrenceSchema.array().atLeastLength(1),
+		evidence: securityEvidenceSchema.array(),
+		"remediation?": "string",
+		validation: {
+			status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
+			"summary?": "string",
+			evidenceIds: "string[]",
+			"validatedAt?": "string",
+		},
+		disposition: {
+			status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
+			"rationale?": "string",
+			"updatedAt?": "string",
+			"actor?": "string",
+		},
+		provenance: securityProvenanceSchema,
+		"extensions?": unknownRecordSchema,
+	});
 
-export const securityTargetSchema = type({
-	kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
-	repositoryRoot: "string > 0",
-	displayName: "string > 0",
-	"revision?": "string",
-	"baseRevision?": "string",
-	"headRevision?": "string",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	treeDigest: "string > 0",
-});
+	const securityCoverageSchema = type({
+		mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
+		completeness: "'complete' | 'partial' | 'unknown'",
+		inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		surfaces: type({
+			id: "string > 0",
+			label: "string > 0",
+			disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
+			receiptRefs: "string[]",
+			"riskArea?": "string",
+			"notes?": "string",
+		}).array(),
+		explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
+		deferred: type({
+			id: "string > 0",
+			reason: "string > 0",
+			"paths?": "string[]",
+			"surfaceIds?": "string[]",
+		}).array(),
+		"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
+	});
 
-export const securityScanPlanSchema = type({
-	documentType: "'omp-security.scan-plan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	createdAt: "string > 0",
-	repositoryRoot: "string > 0",
-	target: securityTargetSchema,
-	knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
-	output: {
-		root: "string > 0",
-		archiveExisting: "boolean",
-		existingState: "'absent' | 'empty' | 'archivable'",
-	},
-	model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
-	account: {
-		provider: "string > 0",
-		credentialId: "number.integer >= 1",
-		"accountId?": "string",
-		"email?": "string",
-		"organizationId?": "string",
-		"organizationName?": "string",
-	},
-	configFingerprint: "string > 0",
-	workflowFingerprint: "string > 0",
-	fingerprint: "string > 0",
-});
+	const securityTargetSchema = type({
+		kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
+		repositoryRoot: "string > 0",
+		displayName: "string > 0",
+		"revision?": "string",
+		"baseRevision?": "string",
+		"headRevision?": "string",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		treeDigest: "string > 0",
+	});
 
-export const securityScanMetricsSchema = type({
-	"runtimeMs?": "number >= 0",
-	"tokenUsage?": {
-		input: "number >= 0",
-		output: "number >= 0",
-		reasoning: "number >= 0",
-		cacheRead: "number >= 0",
-		cacheWrite: "number >= 0",
-		total: "number >= 0",
-	},
-	"cost?": "number >= 0",
-	"premiumRequests?": "number >= 0",
-});
+	const securityScanPlanSchema = type({
+		documentType: "'omp-security.scan-plan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		createdAt: "string > 0",
+		repositoryRoot: "string > 0",
+		target: securityTargetSchema,
+		knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
+		output: {
+			root: "string > 0",
+			archiveExisting: "boolean",
+			existingState: "'absent' | 'empty' | 'archivable'",
+		},
+		model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
+		account: {
+			provider: "string > 0",
+			credentialId: "number.integer >= 1",
+			"accountId?": "string",
+			"email?": "string",
+			"organizationId?": "string",
+			"organizationName?": "string",
+		},
+		configFingerprint: "string > 0",
+		workflowFingerprint: "string > 0",
+		fingerprint: "string > 0",
+	});
 
-export const securityScanSchema = type({
-	documentType: "'omp-security.scan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	projectKey: "string > 0",
-	status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
-	createdAt: "string > 0",
-	"startedAt?": "string",
-	"completedAt?": "string",
-	"plan?": securityScanPlanSchema,
-	target: securityTargetSchema,
-	producer: securityProducerSchema,
-	provenance: securityProvenanceSchema,
-	findingIds: "string[]",
-	coverage: securityCoverageSchema,
-	"reportRef?": "string",
-	"sarifRef?": "string",
-	"error?": "string",
-	"metrics?": securityScanMetricsSchema,
-});
+	const securityScanMetricsSchema = type({
+		"runtimeMs?": "number >= 0",
+		"tokenUsage?": {
+			input: "number >= 0",
+			output: "number >= 0",
+			reasoning: "number >= 0",
+			cacheRead: "number >= 0",
+			cacheWrite: "number >= 0",
+			total: "number >= 0",
+		},
+		"cost?": "number >= 0",
+		"premiumRequests?": "number >= 0",
+	});
+
+	const securityScanSchema = type({
+		documentType: "'omp-security.scan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		projectKey: "string > 0",
+		status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
+		createdAt: "string > 0",
+		"startedAt?": "string",
+		"completedAt?": "string",
+		"plan?": securityScanPlanSchema,
+		target: securityTargetSchema,
+		producer: securityProducerSchema,
+		provenance: securityProvenanceSchema,
+		findingIds: "string[]",
+		coverage: securityCoverageSchema,
+		"reportRef?": "string",
+		"sarifRef?": "string",
+		"error?": "string",
+		"metrics?": securityScanMetricsSchema,
+	});
+
+	const securityScanBundleSchema = type({
+		scan: securityScanSchema,
+		findings: securityFindingSchema.array(),
+		"report?": "string",
+		"sarif?": unknownRecordSchema,
+	});
 
-export const securityScanBundleSchema = type({
-	scan: securityScanSchema,
-	findings: securityFindingSchema.array(),
-	"report?": "string",
-	"sarif?": unknownRecordSchema,
+	return {
+		securityProducerSchema,
+		securityProvenanceSchema,
+		securityLocationSchema,
+		securityEvidenceSchema,
+		securityOccurrenceSchema,
+		securityFindingSchema,
+		securityCoverageSchema,
+		securityTargetSchema,
+		securityScanPlanSchema,
+		securityScanMetricsSchema,
+		securityScanSchema,
+		securityScanBundleSchema,
+	};
 });

package/src/security/contracts/validation.ts

@@ -1,5 +1,5 @@
 import { type } from "arktype";
-import { securityFindingSchema, securityScanBundleSchema, securityScanPlanSchema, securityScanSchema } from "./schemas";
+import { getSecurityContractSchemas } from "./schemas";
 import type { SecurityFinding, SecurityScan, SecurityScanBundle, SecurityScanPlan } from "./types";
 
 function schemaError(label: string, errors: type.errors): Error {
@@ -7,24 +7,28 @@ function schemaError(label: string, errors: type.errors): Error {
 }
 
 export function parseSecurityFinding(value: unknown): SecurityFinding {
+	const { securityFindingSchema } = getSecurityContractSchemas();
 	const result = securityFindingSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security finding", result);
 	return result as SecurityFinding;
 }
 
 export function parseSecurityScan(value: unknown): SecurityScan {
+	const { securityScanSchema } = getSecurityContractSchemas();
 	const result = securityScanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan", result);
 	return result as SecurityScan;
 }
 
 export function parseSecurityScanPlan(value: unknown): SecurityScanPlan {
+	const { securityScanPlanSchema } = getSecurityContractSchemas();
 	const result = securityScanPlanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan plan", result);
 	return result as SecurityScanPlan;
 }
 
 export function parseSecurityScanBundle(value: unknown): SecurityScanBundle {
+	const { securityScanBundleSchema } = getSecurityContractSchemas();
 	const result = securityScanBundleSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan bundle", result);
 	const bundle = result as SecurityScanBundle;

package/src/security/store.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getSecurityProjectDir, isEnoent } from "@oh-my-pi/pi-utils";
-import { withFileLock } from "../config/file-lock";
+import { withFileLock } from "@oh-my-pi/pi-utils/file-lock";
 import * as git from "../utils/git";
 import { compareSecurityLineage } from "./comparison";
 import type {
@@ -34,7 +34,7 @@ const SECURITY_STORE_WRITE_CHAINS = new Map<string, Promise<unknown>>();
 async function withSecurityStoreWrite<T>(key: string, operation: () => Promise<T>): Promise<T> {
 	const lockTarget = path.join(key, "index.json");
 	const run = (SECURITY_STORE_WRITE_CHAINS.get(key) ?? Promise.resolve()).then(() =>
-		withFileLock(lockTarget, operation, { staleMs: 60_000, retries: 200, retryDelayMs: 50 }),
+		withFileLock(lockTarget, operation, { retries: 200, retryDelayMs: 50 }),
 	);
 	const guarded = run.catch(() => undefined);
 	SECURITY_STORE_WRITE_CHAINS.set(key, guarded);