@oh-my-pi/pi-coding-agent 17.2.5 → 17.2.7

package/src/security/contracts/schemas.ts

@@ -1,201 +1,219 @@
-import { type } from "arktype";
+import { type } from "@oh-my-pi/omptype";
+import { once } from "@oh-my-pi/pi-utils";
 
-const stringRecordSchema = type({ "[string]": "string" });
-const unknownRecordSchema = type({ "[string]": "unknown" });
+export const getSecurityContractSchemas = once(() => {
+	const stringRecordSchema = type({ "[string]": "string" });
+	const unknownRecordSchema = type({ "[string]": "unknown" });
 
-export const securityProducerSchema = type({
-	kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
-	name: "string > 0",
-	"version?": "string",
-	"vendor?": "string",
-	"revision?": "string",
-	"pluginVersion?": "string",
-});
-
-export const securityProvenanceSchema = type({
-	producer: securityProducerSchema,
-	createdAt: "string > 0",
-	"importedAt?": "string",
-	"sourceIds?": stringRecordSchema,
-	"vendorFingerprints?": stringRecordSchema,
-	"upstream?": {
-		"repository?": "string",
+	const securityProducerSchema = type({
+		kind: "'omp-native' | 'codex-security-bundle' | 'codex-security-cloud' | 'sarif-import'",
+		name: "string > 0",
+		"version?": "string",
+		"vendor?": "string",
 		"revision?": "string",
-		"packageVersion?": "string",
 		"pluginVersion?": "string",
-		"archiveSha256?": "string",
-	},
-	"metadata?": unknownRecordSchema,
-});
+	});
 
-export const securityLocationSchema = type({
-	path: "string > 0",
-	startLine: "number.integer >= 1",
-	"endLine?": "number.integer >= 1",
-	"startColumn?": "number.integer >= 1",
-	"endColumn?": "number.integer >= 1",
-	"role?": "string",
-});
+	const securityProvenanceSchema = type({
+		producer: securityProducerSchema,
+		createdAt: "string > 0",
+		"importedAt?": "string",
+		"sourceIds?": stringRecordSchema,
+		"vendorFingerprints?": stringRecordSchema,
+		"upstream?": {
+			"repository?": "string",
+			"revision?": "string",
+			"packageVersion?": "string",
+			"pluginVersion?": "string",
+			"archiveSha256?": "string",
+		},
+		"metadata?": unknownRecordSchema,
+	});
 
-export const securityEvidenceSchema = type({
-	id: "string > 0",
-	kind: "'code' | 'trace' | 'validation' | 'note'",
-	label: "string > 0",
-	explanation: "string",
-	"location?": securityLocationSchema,
-	"excerpt?": "string",
-});
+	const securityLocationSchema = type({
+		path: "string > 0",
+		startLine: "number.integer >= 1",
+		"endLine?": "number.integer >= 1",
+		"startColumn?": "number.integer >= 1",
+		"endColumn?": "number.integer >= 1",
+		"role?": "string",
+	});
 
-export const securityOccurrenceSchema = type({
-	id: "string > 0",
-	locations: securityLocationSchema.array().atLeastLength(1),
-	evidenceIds: "string[]",
-});
+	const securityEvidenceSchema = type({
+		id: "string > 0",
+		kind: "'code' | 'trace' | 'validation' | 'note'",
+		label: "string > 0",
+		explanation: "string",
+		"location?": securityLocationSchema,
+		"excerpt?": "string",
+	});
 
-export const securityFindingSchema = type({
-	id: "string > 0",
-	scanId: "string > 0",
-	fingerprint: "string > 0",
-	ruleId: "string > 0",
-	"anchor?": "string",
-	title: "string > 0",
-	summary: "string",
-	severity: {
-		level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
-		"score?": "number",
-		"scoringSystem?": "string",
-		"vector?": "string",
-		"rationale?": "string",
-	},
-	confidence: {
-		level: "'high' | 'medium' | 'low'",
-		"rationale?": "string",
-	},
-	taxonomy: {
-		category: "string > 0",
-		cwe: "string[]",
-		"tags?": "string[]",
-	},
-	occurrences: securityOccurrenceSchema.array().atLeastLength(1),
-	evidence: securityEvidenceSchema.array(),
-	"remediation?": "string",
-	validation: {
-		status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
-		"summary?": "string",
+	const securityOccurrenceSchema = type({
+		id: "string > 0",
+		locations: securityLocationSchema.array().atLeastLength(1),
 		evidenceIds: "string[]",
-		"validatedAt?": "string",
-	},
-	disposition: {
-		status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
-		"rationale?": "string",
-		"updatedAt?": "string",
-		"actor?": "string",
-	},
-	provenance: securityProvenanceSchema,
-	"extensions?": unknownRecordSchema,
-});
+	});
 
-export const securityCoverageSchema = type({
-	mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
-	completeness: "'complete' | 'partial' | 'unknown'",
-	inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	surfaces: type({
-		id: "string > 0",
-		label: "string > 0",
-		disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
-		receiptRefs: "string[]",
-		"riskArea?": "string",
-		"notes?": "string",
-	}).array(),
-	explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
-	deferred: type({
+	const securityFindingSchema = type({
 		id: "string > 0",
-		reason: "string > 0",
-		"paths?": "string[]",
-		"surfaceIds?": "string[]",
-	}).array(),
-	"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
-});
+		scanId: "string > 0",
+		fingerprint: "string > 0",
+		ruleId: "string > 0",
+		"anchor?": "string",
+		title: "string > 0",
+		summary: "string",
+		severity: {
+			level: "'critical' | 'high' | 'medium' | 'low' | 'informational'",
+			"score?": "number",
+			"scoringSystem?": "string",
+			"vector?": "string",
+			"rationale?": "string",
+		},
+		confidence: {
+			level: "'high' | 'medium' | 'low'",
+			"rationale?": "string",
+		},
+		taxonomy: {
+			category: "string > 0",
+			cwe: "string[]",
+			"tags?": "string[]",
+		},
+		occurrences: securityOccurrenceSchema.array().atLeastLength(1),
+		evidence: securityEvidenceSchema.array(),
+		"remediation?": "string",
+		validation: {
+			status: "'unvalidated' | 'validated' | 'rejected' | 'partial' | 'error'",
+			"summary?": "string",
+			evidenceIds: "string[]",
+			"validatedAt?": "string",
+		},
+		disposition: {
+			status: "'open' | 'false_positive' | 'accepted_risk' | 'fixed' | 'wont_fix'",
+			"rationale?": "string",
+			"updatedAt?": "string",
+			"actor?": "string",
+		},
+		provenance: securityProvenanceSchema,
+		"extensions?": unknownRecordSchema,
+	});
 
-export const securityTargetSchema = type({
-	kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
-	repositoryRoot: "string > 0",
-	displayName: "string > 0",
-	"revision?": "string",
-	"baseRevision?": "string",
-	"headRevision?": "string",
-	includePaths: "string[]",
-	excludePaths: "string[]",
-	treeDigest: "string > 0",
-});
+	const securityCoverageSchema = type({
+		mode: "'repository' | 'scoped_path' | 'diff' | 'working_tree' | 'deep_repository' | 'imported'",
+		completeness: "'complete' | 'partial' | 'unknown'",
+		inventoryStrategy: "'repository' | 'scoped_path' | 'diff' | 'directory' | 'custom' | 'imported'",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		surfaces: type({
+			id: "string > 0",
+			label: "string > 0",
+			disposition: "'reported' | 'no_issue_found' | 'rejected' | 'not_applicable' | 'needs_follow_up'",
+			receiptRefs: "string[]",
+			"riskArea?": "string",
+			"notes?": "string",
+		}).array(),
+		explicitExclusions: type({ pattern: "string", reason: "string" }).array(),
+		deferred: type({
+			id: "string > 0",
+			reason: "string > 0",
+			"paths?": "string[]",
+			"surfaceIds?": "string[]",
+		}).array(),
+		"openQuestions?": type({ question: "string > 0", "followUpPrompt?": "string" }).array(),
+	});
 
-export const securityScanPlanSchema = type({
-	documentType: "'omp-security.scan-plan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	createdAt: "string > 0",
-	repositoryRoot: "string > 0",
-	target: securityTargetSchema,
-	knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
-	output: {
-		root: "string > 0",
-		archiveExisting: "boolean",
-		existingState: "'absent' | 'empty' | 'archivable'",
-	},
-	model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
-	account: {
-		provider: "string > 0",
-		credentialId: "number.integer >= 1",
-		"accountId?": "string",
-		"email?": "string",
-		"organizationId?": "string",
-		"organizationName?": "string",
-	},
-	configFingerprint: "string > 0",
-	workflowFingerprint: "string > 0",
-	fingerprint: "string > 0",
-});
+	const securityTargetSchema = type({
+		kind: "'repository' | 'scoped_path' | 'ref_diff' | 'working_tree' | 'imported'",
+		repositoryRoot: "string > 0",
+		displayName: "string > 0",
+		"revision?": "string",
+		"baseRevision?": "string",
+		"headRevision?": "string",
+		includePaths: "string[]",
+		excludePaths: "string[]",
+		treeDigest: "string > 0",
+	});
 
-export const securityScanMetricsSchema = type({
-	"runtimeMs?": "number >= 0",
-	"tokenUsage?": {
-		input: "number >= 0",
-		output: "number >= 0",
-		reasoning: "number >= 0",
-		cacheRead: "number >= 0",
-		cacheWrite: "number >= 0",
-		total: "number >= 0",
-	},
-	"cost?": "number >= 0",
-	"premiumRequests?": "number >= 0",
-});
+	const securityScanPlanSchema = type({
+		documentType: "'omp-security.scan-plan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		createdAt: "string > 0",
+		repositoryRoot: "string > 0",
+		target: securityTargetSchema,
+		knowledgeBases: type({ path: "string > 0", sha256: "string > 0", size: "number.integer >= 0" }).array(),
+		output: {
+			root: "string > 0",
+			archiveExisting: "boolean",
+			existingState: "'absent' | 'empty' | 'archivable'",
+		},
+		model: { provider: "string > 0", modelId: "string > 0", "thinkingLevel?": "string" },
+		account: {
+			provider: "string > 0",
+			credentialId: "number.integer >= 1",
+			"accountId?": "string",
+			"email?": "string",
+			"organizationId?": "string",
+			"organizationName?": "string",
+		},
+		configFingerprint: "string > 0",
+		workflowFingerprint: "string > 0",
+		fingerprint: "string > 0",
+	});
 
-export const securityScanSchema = type({
-	documentType: "'omp-security.scan'",
-	schemaVersion: "'1.0'",
-	id: "string > 0",
-	projectKey: "string > 0",
-	status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
-	createdAt: "string > 0",
-	"startedAt?": "string",
-	"completedAt?": "string",
-	"plan?": securityScanPlanSchema,
-	target: securityTargetSchema,
-	producer: securityProducerSchema,
-	provenance: securityProvenanceSchema,
-	findingIds: "string[]",
-	coverage: securityCoverageSchema,
-	"reportRef?": "string",
-	"sarifRef?": "string",
-	"error?": "string",
-	"metrics?": securityScanMetricsSchema,
-});
+	const securityScanMetricsSchema = type({
+		"runtimeMs?": "number >= 0",
+		"tokenUsage?": {
+			input: "number >= 0",
+			output: "number >= 0",
+			reasoning: "number >= 0",
+			cacheRead: "number >= 0",
+			cacheWrite: "number >= 0",
+			total: "number >= 0",
+		},
+		"cost?": "number >= 0",
+		"premiumRequests?": "number >= 0",
+	});
+
+	const securityScanSchema = type({
+		documentType: "'omp-security.scan'",
+		schemaVersion: "'1.0'",
+		id: "string > 0",
+		projectKey: "string > 0",
+		status: "'planned' | 'running' | 'completed' | 'partial' | 'cancelled' | 'failed'",
+		createdAt: "string > 0",
+		"startedAt?": "string",
+		"completedAt?": "string",
+		"plan?": securityScanPlanSchema,
+		target: securityTargetSchema,
+		producer: securityProducerSchema,
+		provenance: securityProvenanceSchema,
+		findingIds: "string[]",
+		coverage: securityCoverageSchema,
+		"reportRef?": "string",
+		"sarifRef?": "string",
+		"error?": "string",
+		"metrics?": securityScanMetricsSchema,
+	});
+
+	const securityScanBundleSchema = type({
+		scan: securityScanSchema,
+		findings: securityFindingSchema.array(),
+		"report?": "string",
+		"sarif?": unknownRecordSchema,
+	});
 
-export const securityScanBundleSchema = type({
-	scan: securityScanSchema,
-	findings: securityFindingSchema.array(),
-	"report?": "string",
-	"sarif?": unknownRecordSchema,
+	return {
+		securityProducerSchema,
+		securityProvenanceSchema,
+		securityLocationSchema,
+		securityEvidenceSchema,
+		securityOccurrenceSchema,
+		securityFindingSchema,
+		securityCoverageSchema,
+		securityTargetSchema,
+		securityScanPlanSchema,
+		securityScanMetricsSchema,
+		securityScanSchema,
+		securityScanBundleSchema,
+	};
 });

package/src/security/contracts/validation.ts

@@ -1,5 +1,5 @@
-import { type } from "arktype";
-import { securityFindingSchema, securityScanBundleSchema, securityScanPlanSchema, securityScanSchema } from "./schemas";
+import { type } from "@oh-my-pi/omptype";
+import { getSecurityContractSchemas } from "./schemas";
 import type { SecurityFinding, SecurityScan, SecurityScanBundle, SecurityScanPlan } from "./types";
 
 function schemaError(label: string, errors: type.errors): Error {
@@ -7,24 +7,28 @@ function schemaError(label: string, errors: type.errors): Error {
 }
 
 export function parseSecurityFinding(value: unknown): SecurityFinding {
+	const { securityFindingSchema } = getSecurityContractSchemas();
 	const result = securityFindingSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security finding", result);
 	return result as SecurityFinding;
 }
 
 export function parseSecurityScan(value: unknown): SecurityScan {
+	const { securityScanSchema } = getSecurityContractSchemas();
 	const result = securityScanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan", result);
 	return result as SecurityScan;
 }
 
 export function parseSecurityScanPlan(value: unknown): SecurityScanPlan {
+	const { securityScanPlanSchema } = getSecurityContractSchemas();
 	const result = securityScanPlanSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan plan", result);
 	return result as SecurityScanPlan;
 }
 
 export function parseSecurityScanBundle(value: unknown): SecurityScanBundle {
+	const { securityScanBundleSchema } = getSecurityContractSchemas();
 	const result = securityScanBundleSchema(value);
 	if (result instanceof type.errors) throw schemaError("Security scan bundle", result);
 	const bundle = result as SecurityScanBundle;

package/src/security/publication.ts

@@ -1,4 +1,4 @@
-import { type } from "arktype";
+import { type } from "@oh-my-pi/omptype";
 import type { ToolDefinition } from "../extensibility/extensions";
 import securityPublishDescription from "../prompts/tools/security-publish.md" with { type: "text" };
 import type {

package/src/security/store.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs/promises";
 import * as path from "node:path";
 import { getSecurityProjectDir, isEnoent } from "@oh-my-pi/pi-utils";
-import { withFileLock } from "../config/file-lock";
+import { withFileLock } from "@oh-my-pi/pi-utils/file-lock";
 import * as git from "../utils/git";
 import { compareSecurityLineage } from "./comparison";
 import type {
@@ -34,7 +34,7 @@ const SECURITY_STORE_WRITE_CHAINS = new Map<string, Promise<unknown>>();
 async function withSecurityStoreWrite<T>(key: string, operation: () => Promise<T>): Promise<T> {
 	const lockTarget = path.join(key, "index.json");
 	const run = (SECURITY_STORE_WRITE_CHAINS.get(key) ?? Promise.resolve()).then(() =>
-		withFileLock(lockTarget, operation, { staleMs: 60_000, retries: 200, retryDelayMs: 50 }),
+		withFileLock(lockTarget, operation, { retries: 200, retryDelayMs: 50 }),
 	);
 	const guarded = run.catch(() => undefined);
 	SECURITY_STORE_WRITE_CHAINS.set(key, guarded);

package/src/session/agent-session-types.ts

@@ -389,5 +389,11 @@ export interface FreshSessionResult {
 	closedProviderSessions: number;
 }
 
+/** Outcome of an in-place `/clear` conversation-context reset. */
+export interface ResetSessionContextResult {
+	/** Number of live messages dropped from the model's context. */
+	droppedCount: number;
+}
+
 /** Queued user content restored to the editor. */
 export type RestoredQueuedMessage = { text: string; images?: ImageContent[] };