@pasko70/pibo 1.16.6 → 2.1.1

package/dist/mcp/runtime-session.js

@@ -0,0 +1,166 @@
+import { createHash } from "node:crypto";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { getDefaultEnvironment, StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";
+import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import { filterTools, isHttpServer, } from "./config.js";
+const SECRET_KEY_RE = /(api[_-]?key|authorization|bearer|cookie|credential|oauth|password|secret|token)/i;
+const ENV_REFERENCE_RE = /\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g;
+function resolveEnvironmentString(value, environment) {
+    const missing = new Set();
+    const resolved = value.replace(ENV_REFERENCE_RE, (_match, name) => {
+        const replacement = environment[name];
+        if (replacement === undefined) {
+            missing.add(name);
+            return "";
+        }
+        return replacement;
+    });
+    if (missing.size > 0)
+        throw new Error(`Missing environment variables: ${[...missing].sort().join(", ")}`);
+    return resolved;
+}
+function generatedSecretName(serverName, path, value) {
+    const readable = [serverName, ...path]
+        .join("_")
+        .toUpperCase()
+        .replace(/[^A-Z0-9_]+/g, "_")
+        .replace(/^_+|_+$/g, "")
+        .slice(0, 72);
+    const hash = createHash("sha256").update(`${serverName}\0${path.join(".")}\0${value}`).digest("hex").slice(0, 12).toUpperCase();
+    return `PIBO_RUNTIME_MCP_${readable || "VALUE"}_${hash}`;
+}
+function urlLooksSensitive(value) {
+    try {
+        const url = new URL(value);
+        if (url.username || url.password)
+            return true;
+        for (const key of url.searchParams.keys()) {
+            if (SECRET_KEY_RE.test(key))
+                return true;
+        }
+    }
+    catch {
+        return false;
+    }
+    return false;
+}
+function scopeConfigValue(serverName, value, path, environment, secretEnvironment, forceSecret = false) {
+    if (typeof value === "string") {
+        const hasReference = ENV_REFERENCE_RE.test(value);
+        ENV_REFERENCE_RE.lastIndex = 0;
+        const secret = forceSecret || hasReference || SECRET_KEY_RE.test(path.at(-1) ?? "") || (path.at(-1) === "url" && urlLooksSensitive(value));
+        if (!secret)
+            return { materialized: value, resolved: value };
+        const resolved = resolveEnvironmentString(value, environment);
+        const environmentName = generatedSecretName(serverName, path, value);
+        secretEnvironment[environmentName] = resolved;
+        return { materialized: `\${${environmentName}}`, resolved };
+    }
+    if (Array.isArray(value)) {
+        const materialized = [];
+        const resolved = [];
+        for (const [index, item] of value.entries()) {
+            const scoped = scopeConfigValue(serverName, item, [...path, String(index)], environment, secretEnvironment, forceSecret);
+            materialized.push(scoped.materialized);
+            resolved.push(scoped.resolved);
+        }
+        return { materialized, resolved };
+    }
+    if (value && typeof value === "object") {
+        const materialized = {};
+        const resolved = {};
+        for (const [key, item] of Object.entries(value)) {
+            const scoped = scopeConfigValue(serverName, item, [...path, key], environment, secretEnvironment, forceSecret || path.at(-1) === "env" || path.at(-1) === "headers" || path.at(-1) === "args");
+            materialized[key] = scoped.materialized;
+            resolved[key] = scoped.resolved;
+        }
+        return { materialized, resolved };
+    }
+    return { materialized: value, resolved: value };
+}
+export function scopePiboMcpServerConfig(serverName, config, environment) {
+    const secretEnvironment = {};
+    const scoped = scopeConfigValue(serverName, config, [], environment, secretEnvironment);
+    return {
+        materialized: scoped.materialized,
+        resolved: scoped.resolved,
+        secretEnvironment,
+        secretEnvironmentKeys: Object.keys(secretEnvironment).sort(),
+    };
+}
+export function redactMcpRuntimeError(error, secretValues = []) {
+    let message = error instanceof Error ? error.message : String(error);
+    for (const value of secretValues) {
+        if (value)
+            message = message.split(value).join("[REDACTED]");
+    }
+    return message.replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]");
+}
+export async function verifyPiboMcpServer(serverName, config, options) {
+    const client = new Client({ name: "pibo-runtime-resource-verifier", version: "1.0.0" }, { capabilities: {} });
+    let transport;
+    if (isHttpServer(config)) {
+        transport = new StreamableHTTPClientTransport(new URL(config.url), {
+            requestInit: { headers: config.headers },
+        });
+    }
+    else {
+        const env = {
+            ...getDefaultEnvironment(),
+            ...(config.env ?? {}),
+        };
+        transport = new StdioClientTransport({
+            command: config.command,
+            args: config.args,
+            env,
+            cwd: config.cwd,
+            stderr: "pipe",
+        });
+    }
+    const signal = AbortSignal.timeout(options.timeoutMs);
+    try {
+        await client.connect(transport, { signal, timeout: options.timeoutMs, maxTotalTimeout: options.timeoutMs });
+        const capabilities = client.getServerCapabilities();
+        const listedTools = capabilities?.tools
+            ? (await client.listTools(undefined, { signal, timeout: options.timeoutMs, maxTotalTimeout: options.timeoutMs })).tools
+            : [];
+        const tools = filterTools(listedTools.map((tool) => ({
+            name: tool.name,
+            ...(tool.description ? { description: tool.description } : {}),
+        })), config);
+        let resources = [];
+        let resourceTemplates = [];
+        if (capabilities?.resources) {
+            const listed = await client.listResources(undefined, { signal, timeout: options.timeoutMs, maxTotalTimeout: options.timeoutMs });
+            resources = listed.resources.map((resource) => ({
+                uri: resource.uri,
+                ...(resource.name ? { name: resource.name } : {}),
+                ...(resource.description ? { description: resource.description } : {}),
+                ...(resource.mimeType ? { mimeType: resource.mimeType } : {}),
+            }));
+            const templates = await client.listResourceTemplates(undefined, { signal, timeout: options.timeoutMs, maxTotalTimeout: options.timeoutMs });
+            resourceTemplates = templates.resourceTemplates.map((template) => ({
+                uriTemplate: template.uriTemplate,
+                ...(template.name ? { name: template.name } : {}),
+                ...(template.description ? { description: template.description } : {}),
+                ...(template.mimeType ? { mimeType: template.mimeType } : {}),
+            }));
+        }
+        const version = client.getServerVersion();
+        return {
+            status: "connected",
+            ...(version?.name ? { serverName: version.name } : {}),
+            ...(version?.version ? { serverVersion: version.version } : {}),
+            ...(client.getInstructions() ? { instructions: client.getInstructions() } : {}),
+            tools,
+            resources,
+            resourceTemplates,
+        };
+    }
+    catch (error) {
+        throw new Error(`MCP server "${serverName}" verification failed: ${redactMcpRuntimeError(error)}`);
+    }
+    finally {
+        await client.close().catch(async () => transport.close().catch(() => { }));
+    }
+}

package/dist/plugins/builtin.js

@@ -2,32 +2,27 @@ import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createPiboGatewayToolProfiles } from "../gateway/tool.js";
 import { InitialSessionContextBuilder } from "../core/profiles.js";
+import { createDefaultPiboProfile, DEFAULT_PIBO_PROFILE_NAME } from "../core/default-profile.js";
 import { parsePiboThinkingLevel } from "../core/thinking.js";
 import { createWebSearchToolProfile } from "../tools/web-search.js";
 import { CODEX_BROWSER_TOOL_NAMES, createCodexBrowserToolProfiles } from "../tools/codex-browser.js";
 import { createRuntimeToolProfile } from "../tools/runtime/tool.js";
-import { completeLogin, getLoginStatus, removeLogin, setApiKey, startLogin } from "../auth/login-actions.js";
 import { loadModelCatalog } from "../apps/chat/model-catalog.js";
 import { piboCodexCompatPlugin } from "./codex-compat.js";
+import { piboCodexNativePlugin } from "./codex-native.js";
 import { addPiboNativeToolingContext, registerPiboNativeTooling } from "./native-tooling.js";
 import { piboWebAnnotationsPlugin } from "./web-annotations.js";
+import { piboOmpPlugin } from "./omp.js";
 import { definePiboPlugin, PiboPluginRegistry } from "./registry.js";
-export const DEFAULT_PIBO_PROFILE_NAME = "base";
+import { PI_AGENT_RUNTIME_DRIVER } from "../agent-runtimes/pi/adapter.js";
+export { createDefaultPiboProfile, DEFAULT_PIBO_PROFILE_NAME } from "../core/default-profile.js";
+export { CODEX_NATIVE_PROFILE_NAME, CODEX_NATIVE_RUNTIME_INSTANCE_ID, piboCodexNativePlugin, } from "./codex-native.js";
+export { OMP_PROFILE_NAME, OMP_RUNTIME_INSTANCE_ID, piboOmpPlugin, } from "./omp.js";
 const GATEWAY_PROFILE_TOOLS = ["pibo_gateway_send"];
 const PIBO_PACKAGE_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../..");
 function builtinSkillPath(name) {
     return resolve(PIBO_PACKAGE_ROOT, "skills", "builtin", name, "SKILL.md");
 }
-const LOGIN_PROVIDERS = [
-    { id: "openai-codex", name: "OpenAI (ChatGPT Plus/Pro)", authMethods: ["device_code"] },
-    { id: "openai", name: "OpenAI API", authMethods: ["api_key"] },
-    { id: "anthropic", name: "Anthropic", authMethods: ["api_key"] },
-    { id: "qwen-token-plan", name: "Qwen Token Plan", authMethods: ["api_key"] },
-    { id: "kimi-coding", name: "Kimi for Coding", authMethods: ["api_key"] },
-    { id: "google", name: "Google Gemini", authMethods: ["api_key"] },
-    { id: "groq", name: "Groq", authMethods: ["api_key"] },
-    { id: "ollama", name: "Ollama", authMethods: ["api_key"] },
-];
 function getObjectParams(event) {
     const params = "params" in event ? event.params : undefined;
     if (!params || typeof params !== "object" || Array.isArray(params))
@@ -75,12 +70,35 @@ function getThinkingParams(event) {
         throw new Error("thinking requires params.level to be a string");
     return { level: parsePiboThinkingLevel(raw.level) };
 }
+function requireApprovalResponseParams(event) {
+    const params = getObjectParams(event);
+    if (!params || typeof params.requestId !== "string" || !params.requestId.trim()) {
+        throw new Error("runtime.approval.respond requires params.requestId");
+    }
+    if (typeof params.decision !== "string" || !params.decision.trim()) {
+        throw new Error("runtime.approval.respond requires params.decision");
+    }
+    return { requestId: params.requestId, decision: params.decision };
+}
+function requireUserInputResponseParams(event) {
+    const params = getObjectParams(event);
+    if (!params || typeof params.requestId !== "string" || !params.requestId.trim()) {
+        throw new Error("runtime.user_input.respond requires params.requestId");
+    }
+    if (!params.answers || typeof params.answers !== "object" || Array.isArray(params.answers)) {
+        throw new Error("runtime.user_input.respond requires params.answers");
+    }
+    return { requestId: params.requestId, answers: params.answers };
+}
 function requireLoginStartParams(event) {
     const params = getObjectParams(event);
     if (!params || typeof params.provider !== "string" || params.provider.length === 0) {
         throw new Error("login.start requires params.provider");
     }
-    return { provider: params.provider };
+    if (params.method !== undefined && params.method !== "device_code" && params.method !== "browser_oauth") {
+        throw new Error("login.start params.method must be device_code or browser_oauth");
+    }
+    return { provider: params.provider, method: params.method };
 }
 function requireLoginCompleteParams(event) {
     const params = getObjectParams(event);
@@ -90,10 +108,28 @@ function requireLoginCompleteParams(event) {
     if (params.code !== undefined && typeof params.code !== "string") {
         throw new Error("login.complete params.code must be a string when provided");
     }
-    if (typeof params.state !== "string" || params.state.length === 0) {
-        throw new Error("login.complete requires params.state");
+    const flowId = typeof params.flowId === "string" && params.flowId.length > 0
+        ? params.flowId
+        : typeof params.state === "string" && params.state.length > 0
+            ? params.state
+            : undefined;
+    if (!flowId)
+        throw new Error("login.complete requires params.flowId");
+    return { provider: params.provider, code: params.code, flowId };
+}
+function requireLoginCancelParams(event) {
+    const params = getObjectParams(event);
+    if (!params || typeof params.provider !== "string" || params.provider.length === 0) {
+        throw new Error("login.cancel requires params.provider");
     }
-    return { provider: params.provider, code: params.code, state: params.state };
+    const flowId = typeof params.flowId === "string" && params.flowId.length > 0
+        ? params.flowId
+        : typeof params.state === "string" && params.state.length > 0
+            ? params.state
+            : undefined;
+    if (!flowId)
+        throw new Error("login.cancel requires params.flowId");
+    return { provider: params.provider, flowId };
 }
 function requireLoginApiKeyParams(event) {
     const params = getObjectParams(event);
@@ -121,11 +157,18 @@ export const piboCorePlugin = definePiboPlugin({
     id: "pibo.core",
     name: "Pibo Core",
     register(api) {
+        api.registerAgentRuntimeDriver(PI_AGENT_RUNTIME_DRIVER);
+        api.registerAgentRuntimeInstance({ id: "pi", adapterId: "pi", displayName: "Pi Coding Agent" });
         api.registerSkill({
             name: "pi-agent-harness",
             path: builtinSkillPath("pi-agent-harness"),
             kind: "builtin",
         });
+        api.registerSkill({
+            name: "pibo-agent-runtime-adapter",
+            path: builtinSkillPath("pibo-agent-runtime-adapter"),
+            kind: "builtin",
+        });
         api.registerSkill({
             name: "pibo-spec-writing",
             path: builtinSkillPath("pibo-spec-writing"),
@@ -203,6 +246,26 @@ export const piboCorePlugin = definePiboPlugin({
                 return await context.compact(customInstructions);
             },
         });
+        api.registerGatewayAction({
+            name: "runtime.approval.respond",
+            description: "Respond to a pending runtime approval request.",
+            hidden: true,
+            async execute(context, event) {
+                const params = requireApprovalResponseParams(event);
+                await context.respondToApproval(params.requestId, params.decision);
+                return { requestId: params.requestId, responded: true };
+            },
+        });
+        api.registerGatewayAction({
+            name: "runtime.user_input.respond",
+            description: "Respond to a pending structured runtime user-input request.",
+            hidden: true,
+            async execute(context, event) {
+                const params = requireUserInputResponseParams(event);
+                await context.respondToUserInput(params.requestId, params.answers);
+                return { requestId: params.requestId, responded: true };
+            },
+        });
         api.registerGatewayAction({
             name: "session_id",
             description: "Return the routed Pibo session id.",
@@ -255,7 +318,7 @@ export const piboCorePlugin = definePiboPlugin({
         });
         api.registerGatewayAction({
             name: "thinking",
-            description: "Show or set the routed Pi thinking level.",
+            description: "Show or set the active runtime reasoning level.",
             slashCommands: ["thinking"],
             execute(context, event) {
                 const params = getThinkingParams(event);
@@ -346,81 +409,164 @@ export const piboCorePlugin = definePiboPlugin({
         });
         api.registerGatewayAction({
             name: "login",
-            description: "Open the interactive provider login menu.",
+            description: "Open the interactive provider login menu for the active runtime.",
             slashCommands: ["login"],
-            execute() {
-                const statuses = new Map(getLoginStatus().map((status) => [status.id, status.configured]));
+            async execute(context) {
+                const statuses = await context.getRuntimeAuthStatus();
                 return {
                     action: "show_login_menu",
-                    providers: LOGIN_PROVIDERS.map((provider) => ({
-                        ...provider,
-                        authMethods: [...provider.authMethods],
-                        configured: statuses.get(provider.id) ?? false,
+                    runtimeInstanceId: context.runtimeInstanceId,
+                    providers: statuses.map((status) => ({
+                        id: status.id,
+                        name: status.displayName ?? status.id,
+                        authMethods: status.methods.map((method) => method.id),
+                        configured: status.configured,
+                        state: status.state,
+                        message: status.message,
                     })),
                 };
             },
         });
         api.registerGatewayAction({
             name: "model",
-            description: "Open the interactive model selector for authenticated providers.",
+            description: "Open the interactive model selector for the active runtime.",
             slashCommands: ["model"],
-            async execute() {
+            async execute(context) {
+                const runtimeCatalog = await context.getModelCatalog();
+                if (runtimeCatalog) {
+                    let authStatusAvailable = false;
+                    let authStatuses = new Map();
+                    try {
+                        const statuses = await context.getRuntimeAuthStatus();
+                        authStatusAvailable = true;
+                        authStatuses = new Map(statuses.map((status) => [status.id, status.configured]));
+                    }
+                    catch {
+                        // Runtimes that do not declare auth may use model-catalog compatibility metadata.
+                    }
+                    const providers = new Map();
+                    for (const model of runtimeCatalog.models) {
+                        const providerId = model.provider ?? runtimeCatalog.runtimeInstanceId;
+                        const providerLabel = typeof model.options?.providerDisplayName === "string"
+                            ? model.options.providerDisplayName
+                            : providerId;
+                        const authConfigured = authStatuses.get(providerId)
+                            ?? (authStatusAvailable
+                                ? false
+                                : typeof model.options?.authConfigured === "boolean"
+                                    ? model.options.authConfigured
+                                    : !context.runtimeAuthRequired);
+                        let provider = providers.get(providerId);
+                        if (!provider) {
+                            provider = { id: providerId, label: providerLabel, authConfigured, models: [] };
+                            providers.set(providerId, provider);
+                        }
+                        provider.models.push({
+                            provider: providerId,
+                            id: model.id,
+                            label: model.displayName ?? model.id,
+                            ...(model.reasoningOptions ? { supportsReasoning: model.reasoningOptions.length > 0 } : {}),
+                        });
+                    }
+                    return { action: "show_model_menu", providers: [...providers.values()] };
+                }
                 const catalog = await loadModelCatalog(process.cwd());
                 return {
                     action: "show_model_menu",
-                    providers: catalog.providers
-                        .filter((provider) => provider.authConfigured)
-                        .map((provider) => ({
+                    providers: catalog.providers.map((provider) => ({
                         ...provider,
-                        models: provider.models.filter((model) => model.authConfigured !== false),
+                        models: provider.models,
                     })),
                 };
             },
         });
         api.registerGatewayAction({
             name: "login.start",
-            description: "Start an OAuth login flow for a provider. Returns a URL to open in a browser.",
+            description: "Start a provider login flow for the active runtime.",
             slashCommands: [],
-            async execute(_context, event) {
+            async execute(context, event) {
                 const params = requireLoginStartParams(event);
-                return await startLogin(params.provider);
+                const status = (await context.getRuntimeAuthStatus()).find((candidate) => candidate.id === params.provider);
+                const method = params.method ?? status?.methods.find((candidate) => candidate.id !== "api_key")?.id;
+                if (method !== "device_code" && method !== "browser_oauth") {
+                    throw new Error(`Provider "${params.provider}" does not expose an interactive login method.`);
+                }
+                const result = await context.startRuntimeAuth({ providerId: params.provider, method });
+                return {
+                    ...result,
+                    runtimeInstanceId: context.runtimeInstanceId,
+                    ...(result.flow ? {
+                        type: result.flow.method,
+                        url: result.flow.verificationUrl,
+                        verificationUrl: result.flow.verificationUrl,
+                        userCode: result.flow.userCode,
+                        instructions: result.flow.instructions,
+                        flowId: result.flow.flowId,
+                        state: result.flow.flowId,
+                    } : {}),
+                };
             },
         });
         api.registerGatewayAction({
             name: "login.complete",
-            description: "Complete an OAuth login flow with the authorization code from the provider callback.",
+            description: "Read or complete a provider login flow for the active runtime.",
             slashCommands: [],
-            async execute(_context, event) {
+            async execute(context, event) {
                 const params = requireLoginCompleteParams(event);
-                return await completeLogin(params.provider, params.code, params.state);
+                return {
+                    ...(await context.completeRuntimeAuth({ providerId: params.provider, flowId: params.flowId, code: params.code })),
+                    runtimeInstanceId: context.runtimeInstanceId,
+                };
             },
         });
         api.registerGatewayAction({
             name: "login.apikey",
-            description: "Set an API key directly for a provider.",
+            description: "Set an API key for a provider on the active runtime.",
             slashCommands: [],
-            execute(_context, event) {
+            async execute(context, event) {
                 const params = requireLoginApiKeyParams(event);
-                return setApiKey(params.provider, params.apiKey);
+                return {
+                    ...(await context.startRuntimeAuth({ providerId: params.provider, method: "api_key", apiKey: params.apiKey })),
+                    runtimeInstanceId: context.runtimeInstanceId,
+                };
+            },
+        });
+        api.registerGatewayAction({
+            name: "login.cancel",
+            description: "Cancel a pending provider login for the active runtime.",
+            slashCommands: [],
+            async execute(context, event) {
+                const params = requireLoginCancelParams(event);
+                return {
+                    ...(await context.cancelRuntimeAuth({ providerId: params.provider, flowId: params.flowId })),
+                    runtimeInstanceId: context.runtimeInstanceId,
+                };
             },
         });
         api.registerGatewayAction({
             name: "login.status",
-            description: "Check the authentication status for providers.",
+            description: "Check provider authentication status for the active runtime.",
             slashCommands: [],
-            execute(_context, event) {
+            async execute(context, event) {
                 const params = getObjectParams(event);
                 const provider = typeof params?.provider === "string" ? params.provider : undefined;
-                return { providers: getLoginStatus(provider) };
+                const providers = await context.getRuntimeAuthStatus();
+                return {
+                    runtimeInstanceId: context.runtimeInstanceId,
+                    providers: provider ? providers.filter((status) => status.id === provider) : providers,
+                };
             },
         });
         api.registerGatewayAction({
             name: "logout",
-            description: "Remove stored credentials for a provider.",
+            description: "Remove stored credentials for a provider on the active runtime.",
             slashCommands: [],
-            execute(_context, event) {
+            async execute(context, event) {
                 const params = requireLogoutParams(event);
-                return removeLogin(params.provider);
+                return {
+                    ...(await context.logoutRuntimeAuth({ providerId: params.provider })),
+                    runtimeInstanceId: context.runtimeInstanceId,
+                };
             },
         });
     },
@@ -443,11 +589,11 @@ export const piboGatewayProducerPlugin = definePiboPlugin({
     },
 });
 export function createDefaultPiboPlugins() {
-    return [piboCorePlugin, piboCodexCompatPlugin, piboWebAnnotationsPlugin];
+    return [piboCorePlugin, piboCodexNativePlugin, piboCodexCompatPlugin, piboWebAnnotationsPlugin, piboOmpPlugin];
 }
 export function createGatewayProducerPiboPluginRegistry() {
     return PiboPluginRegistry.create({
-        plugins: [piboCorePlugin, piboGatewayProducerPlugin, piboCodexCompatPlugin, piboWebAnnotationsPlugin],
+        plugins: [piboCorePlugin, piboCodexNativePlugin, piboGatewayProducerPlugin, piboCodexCompatPlugin, piboWebAnnotationsPlugin, piboOmpPlugin],
     });
 }
 export function createDefaultPiboPluginRegistry() {
@@ -457,12 +603,6 @@ export function selectDefaultPiboProfileName(registry) {
     const names = registry.getProfileNames();
     return names.includes(DEFAULT_PIBO_PROFILE_NAME) ? DEFAULT_PIBO_PROFILE_NAME : names[0] ?? DEFAULT_PIBO_PROFILE_NAME;
 }
-export function createDefaultPiboProfile() {
-    return new InitialSessionContextBuilder(DEFAULT_PIBO_PROFILE_NAME)
-        .withBuiltinToolNames(["read", "bash", "edit", "write"])
-        .withToolPackages({ goalControl: true })
-        .createSession();
-}
 export function resolvePiboProfileNameFromRegistryOrDefault(registry, profileName) {
     const requestedProfileName = profileName ?? selectDefaultPiboProfileName(registry);
     try {

package/dist/plugins/codex-native.js

@@ -0,0 +1,29 @@
+import { CODEX_NATIVE_ADAPTER_ID, CODEX_NATIVE_AGENT_RUNTIME_DRIVER, } from "../agent-runtimes/codex-native/adapter.js";
+import { InitialSessionContextBuilder } from "../core/profiles.js";
+import { definePiboPlugin } from "./registry.js";
+export const CODEX_NATIVE_RUNTIME_INSTANCE_ID = "codex-native";
+export const CODEX_NATIVE_PROFILE_NAME = "codex-native";
+export const piboCodexNativePlugin = definePiboPlugin({
+    id: "pibo.codex-native",
+    name: "Pibo Native Codex",
+    register(api) {
+        api.registerAgentRuntimeDriver(CODEX_NATIVE_AGENT_RUNTIME_DRIVER);
+        api.registerAgentRuntimeInstance({
+            id: CODEX_NATIVE_RUNTIME_INSTANCE_ID,
+            adapterId: CODEX_NATIVE_ADAPTER_ID,
+            displayName: "Native Codex App Server",
+        });
+        api.registerProfile({
+            name: CODEX_NATIVE_PROFILE_NAME,
+            description: "Native Codex App Server profile. Distinct from the Pi-backed Codex compatibility profile.",
+            create() {
+                return new InitialSessionContextBuilder(CODEX_NATIVE_PROFILE_NAME)
+                    .withAgentRuntime(CODEX_NATIVE_RUNTIME_INSTANCE_ID)
+                    .withBuiltinTools("disabled")
+                    .withBuiltinToolNames([])
+                    .withToolPackages({ goalControl: true })
+                    .createSession();
+            },
+        });
+    },
+});

package/dist/plugins/omp.js

@@ -0,0 +1,57 @@
+import { OMP_AGENT_RUNTIME_DRIVER } from "../agent-runtimes/omp/adapter.js";
+import { InitialSessionContextBuilder } from "../core/profiles.js";
+import { definePiboPlugin } from "./registry.js";
+export const OMP_RUNTIME_INSTANCE_ID = "omp-native";
+export const OMP_PROFILE_NAME = "orp";
+/**
+ * Resolve the OMP CLI entry for the default configured instance.
+ *
+ * The operator must point Pibo at an Oh My Pi install. We honour (in order):
+ *   PIBO_OMP_CLI       absolute path to the OMP CLI entry (clover cli.ts / dist/cli.js)
+ *   OMP_HOME           absolute directory containing `src/cli.ts`
+ * If neither is set, ompEntry stays empty and `diagnose` reports it clearly; the
+ * adapter refuses to spawn until configured. We never invent a workspace-relative
+ * default.
+ */
+function defaultOmpEntry() {
+    const cli = process.env.PIBO_OMP_CLI;
+    if (cli && (cli.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(cli)))
+        return cli.trim();
+    const home = process.env.OMP_HOME;
+    if (home && (home.startsWith("/") || /^[a-zA-Z]:[\\/]/.test(home))) {
+        return `${home.replace(/[\\/]+$/, "")}${process.platform === "win32" ? "\\" : "/"}packages/coding-agent/src/cli.ts`;
+    }
+    return "";
+}
+export const piboOmpPlugin = definePiboPlugin({
+    id: "pibo.orp",
+    name: "Pibo Oh My Pi",
+    register(api) {
+        api.registerAgentRuntimeDriver(OMP_AGENT_RUNTIME_DRIVER);
+        api.registerAgentRuntimeInstance({
+            id: OMP_RUNTIME_INSTANCE_ID,
+            adapterId: OMP_AGENT_RUNTIME_DRIVER.descriptor.id,
+            displayName: "Oh My Pi Native",
+            config: {
+                bunExecutable: "bun",
+                ompEntry: defaultOmpEntry(),
+                defaultProvider: "alibaba-token-plan",
+                defaultModel: "deepseek-v4-flash-0731",
+                environmentAllowlist: ["PATH", "SystemRoot", "WINDIR", "TZ", "HTTP_PROXY", "HTTPS_PROXY", "NO_PROXY", "ALL_PROXY"],
+                apiKeyEnvironment: ["OPENAI_API_KEY", "ANTHROPIC_API_KEY", "GEMINI_API_KEY", "DEEPSEEK_API_KEY", "ALIBABA_TOKEN_PLAN_API_KEY", "BAILIAN_TOKEN_PLAN_API_KEY"],
+            },
+        });
+        api.registerProfile({
+            name: OMP_PROFILE_NAME,
+            description: "Oh My Pi native runtime profile. Uses the OMP engine (can1357/oh-my-pi) via its RPC bridge; OMP owns its native tools, base prompt, and sessions; Pibo delivers selected portable tools, skills, and context files.",
+            create() {
+                return new InitialSessionContextBuilder(OMP_PROFILE_NAME)
+                    .withAgentRuntime(OMP_RUNTIME_INSTANCE_ID)
+                    .withBuiltinTools("disabled")
+                    .withBuiltinToolNames([])
+                    .withToolPackages({ goalControl: true })
+                    .createSession();
+            },
+        });
+    },
+});