@pentect/pi 0.0.2 → 0.0.26

package/README.md

@@ -1,19 +1,19 @@
 # @pentect/pi
 
-Pentect protection for Pi.
-
-## Install
-
-Install `pentect`, then run:
+Run [Pi](https://github.com/badlogic/pi-mono) through Pentect's local HTTP
+protection without changing Pi's saved configuration.
 
 ```sh
-pi install npm:@pentect/pi
+npx @pentect/pi --model openai/gpt-5
 ```
 
-Start Pi normally:
+For a permanent command:
 
 ```sh
-pi
+npm install --global @pentect/pi
+pentect-pi --model openai/gpt-5
 ```
 
-Pentect runs behind Pi's existing interface. No separate launcher is required.
+The package installs matching Pentect and Pi versions. It is a small launcher,
+not a prompt hook: requests go through the same loopback gateway as
+`pentect pi`.

package/bin/pentect-pi.js

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { invocation, piBinaryFromEntry } from "../lib/command.js";
+
+const require = createRequire(import.meta.url);
+
+function packageBinary(name, binary) {
+  const manifestPath = require.resolve(`${name}/package.json`);
+  const manifest = JSON.parse(readFileSync(manifestPath, "utf8"));
+  const relative =
+    typeof manifest.bin === "string" ? manifest.bin : manifest.bin?.[binary];
+  if (typeof relative !== "string" || relative.length === 0) {
+    throw new Error(`${name} does not provide the expected ${binary} command`);
+  }
+  return resolve(dirname(manifestPath), relative);
+}
+
+try {
+  const pentectCli = packageBinary("pentect", "pentect");
+  // Pi exports dist/index.js but intentionally does not export package.json.
+  // Its pinned package exposes the adjacent dist/cli.js as the `pi` binary.
+  const piCli = piBinaryFromEntry(
+    require.resolve("@mariozechner/pi-coding-agent"),
+  );
+  const next = invocation(pentectCli, piCli, process.argv.slice(2));
+  const result = spawnSync(next.command, next.args, { stdio: "inherit" });
+  if (result.error) throw result.error;
+  if (result.signal) process.kill(process.pid, result.signal);
+  process.exitCode = result.status ?? 1;
+} catch (error) {
+  const message = error instanceof Error ? error.message : String(error);
+  console.error(`pentect-pi: ${message}`);
+  process.exitCode = 1;
+}

package/lib/command.js

@@ -0,0 +1,20 @@
+import { dirname, resolve } from "node:path";
+
+export function invocation(pentectCli, piCli, userArgs, node = process.execPath) {
+  return {
+    command: node,
+    args: [
+      pentectCli,
+      "pi",
+      "--pi",
+      node,
+      "--",
+      piCli,
+      ...userArgs,
+    ],
+  };
+}
+
+export function piBinaryFromEntry(entry) {
+  return resolve(dirname(entry), "cli.js");
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@pentect/pi",
-  "version": "0.0.2",
-  "description": "Pentect protection for Pi",
+  "version": "0.0.26",
+  "description": "Run Pi through Pentect's local HTTP protection",
   "type": "module",
   "license": "MIT",
   "repository": {
@@ -9,35 +9,33 @@
     "url": "git+https://github.com/EdamAme-x/pentect.git",
     "directory": "integrations/pi"
   },
-  "homepage": "https://github.com/EdamAme-x/pentect/tree/main/integrations/pi",
+  "homepage": "https://pentect.dev/clients/pi/",
   "bugs": "https://github.com/EdamAme-x/pentect/issues",
   "publishConfig": {
     "access": "public"
   },
   "keywords": [
-    "pi-package",
-    "pi-extension",
-    "pentect"
+    "ai-security",
+    "pi-coding-agent",
+    "secret-detection"
   ],
+  "bin": {
+    "pentect-pi": "bin/pentect-pi.js"
+  },
   "files": [
-    "extensions"
+    "bin",
+    "lib",
+    "README.md"
   ],
-  "pi": {
-    "extensions": [
-      "./extensions/pentect.js"
-    ]
-  },
   "scripts": {
-    "check": "node --check extensions/pentect.js",
+    "check": "node --check bin/pentect-pi.js && node --check lib/command.js",
     "test": "node --test"
   },
-  "peerDependencies": {
-    "@earendil-works/pi-coding-agent": ">=0.80.7 <0.81.0"
-  },
-  "devDependencies": {
-    "@earendil-works/pi-coding-agent": "0.80.7"
+  "dependencies": {
+    "@mariozechner/pi-coding-agent": "0.73.1",
+    "pentect": "0.0.26"
   },
   "engines": {
-    "node": ">=22.19.0"
+    "node": ">=20.6.0"
   }
 }

package/extensions/pentect.js

@@ -1,252 +0,0 @@
-import { spawn } from "node:child_process";
-import {
-  createBashTool,
-  createLocalBashOperations,
-} from "@earendil-works/pi-coding-agent";
-
-const SAFE_TEXT = "[Pentect: content unavailable]";
-const SAFE_RESULT = {
-  content: [{ type: "text", text: SAFE_TEXT }],
-  details: undefined,
-  isError: true,
-};
-const BRIDGE_REQUEST_TIMEOUT_MS = 10_000;
-const SESSION_ENVIRONMENT = new Set([
-  "PENTECT_BIN",
-  "PENTECT_MEMORY_STORE_ADDR",
-  "PENTECT_MEMORY_STORE_TOKEN",
-  "PENTECT_PROCESS_HOST_READ_TOKEN",
-  "PENTECT_PROCESS_HOST_WRITE_TOKEN",
-  "PENTECT_PROCESS_HOST_ROOT",
-  "PENTECT_AGENT_LAUNCHED",
-]);
-
-function replaceObject(target, source) {
-  for (const key of Object.keys(target)) delete target[key];
-  Object.assign(target, source);
-}
-
-function createPentectBridge() {
-  const child = spawn(process.env.PENTECT_BIN || "pentect", ["bridge"], {
-    stdio: ["pipe", "pipe", "ignore"],
-    windowsHide: true,
-  });
-  let nextId = 1;
-  const pending = new Map();
-  let buffered = "";
-  let closed = false;
-
-  const fail = () => {
-    if (closed) return;
-    closed = true;
-    for (const { reject, timer } of pending.values()) {
-      clearTimeout(timer);
-      reject(new Error("Pentect unavailable"));
-    }
-    pending.clear();
-  };
-
-  child.stdout.setEncoding("utf8");
-  child.stdout.on("data", (chunk) => {
-    buffered += chunk;
-    for (;;) {
-      const end = buffered.indexOf("\n");
-      if (end < 0) break;
-      const line = buffered.slice(0, end);
-      buffered = buffered.slice(end + 1);
-      let response;
-      try {
-        response = JSON.parse(line);
-      } catch {
-        child.kill();
-        fail();
-        return;
-      }
-      const waiter = pending.get(response.id);
-      if (!waiter) continue;
-      pending.delete(response.id);
-      clearTimeout(waiter.timer);
-      if (response.ok) waiter.resolve(response.value);
-      else waiter.reject(new Error("Pentect rejected the operation"));
-    }
-  });
-  child.on("error", fail);
-  child.on("exit", fail);
-
-  return {
-    request(op, fields = {}) {
-      if (closed) return Promise.reject(new Error("Pentect unavailable"));
-      const id = nextId++;
-      return new Promise((resolve, reject) => {
-        const timer = setTimeout(() => {
-          if (!pending.delete(id)) return;
-          reject(new Error("Pentect unavailable"));
-          child.kill();
-          fail();
-        }, BRIDGE_REQUEST_TIMEOUT_MS);
-        pending.set(id, { resolve, reject, timer });
-        try {
-          child.stdin.write(
-            `${JSON.stringify({ id, op, ...fields })}\n`,
-            (error) => {
-              if (!error) return;
-              const waiter = pending.get(id);
-              if (!waiter) return;
-              pending.delete(id);
-              clearTimeout(waiter.timer);
-              reject(new Error("Pentect unavailable"));
-              child.kill();
-              fail();
-            },
-          );
-        } catch {
-          pending.delete(id);
-          clearTimeout(timer);
-          reject(new Error("Pentect unavailable"));
-          child.kill();
-          fail();
-        }
-      });
-    },
-    close() {
-      if (closed) return;
-      for (const { reject, timer } of pending.values()) {
-        clearTimeout(timer);
-        reject(new Error("Pentect unavailable"));
-      }
-      pending.clear();
-      closed = true;
-      child.kill();
-    },
-  };
-}
-
-function readSessionEnvironment(values) {
-  if (!values || typeof values !== "object" || Array.isArray(values)) {
-    throw new Error("Pentect returned an invalid session");
-  }
-  for (const [name, value] of Object.entries(values)) {
-    if (!SESSION_ENVIRONMENT.has(name) || typeof value !== "string" || !value) {
-      throw new Error("Pentect returned an invalid session");
-    }
-  }
-  for (const required of SESSION_ENVIRONMENT) {
-    if (required === "PENTECT_BIN") continue;
-    if (typeof values[required] !== "string" || !values[required]) {
-      throw new Error("Pentect returned an incomplete session");
-    }
-  }
-  return Object.freeze({ ...values });
-}
-
-export default function pentectExtension(pi) {
-  const localBash = createLocalBashOperations();
-  let bridge;
-  let contract = "";
-  let sessionEnvironment;
-
-  const activeBridge = () => {
-    if (!bridge) throw new Error("Pentect unavailable");
-    return bridge;
-  };
-
-  const protectedBash = {
-    async exec(command, cwd, options) {
-      const next = await activeBridge().request("before", {
-        tool: "bash",
-        value: { command },
-      });
-      if (!next || typeof next.command !== "string") {
-        throw new Error("Pentect rejected the command");
-      }
-      if (!sessionEnvironment) throw new Error("Pentect unavailable");
-      // The bridge wraps the command with `pentect exec`, which masks each
-      // streamed chunk before Pi's onData callback receives it.
-      return localBash.exec(next.command, cwd, {
-        ...options,
-        env: { ...options.env, ...sessionEnvironment },
-      });
-    },
-  };
-
-  pi.on("session_start", async (_event, ctx) => {
-    bridge?.close();
-    sessionEnvironment = undefined;
-    contract = "";
-    bridge = createPentectBridge();
-    try {
-      const session = await bridge.request("session");
-      if (!session || typeof session.contract !== "string") {
-        throw new Error("Pentect returned an invalid session");
-      }
-      sessionEnvironment = readSessionEnvironment(session.environment);
-      contract = session.contract;
-      pi.registerTool(
-        createBashTool(ctx.cwd, {
-          operations: protectedBash,
-        }),
-      );
-    } catch {
-      bridge.close();
-      bridge = undefined;
-      throw new Error("Pentect unavailable");
-    }
-  });
-
-  pi.on("before_agent_start", async (event) => {
-    if (!contract || event.systemPrompt.includes(contract)) return {};
-    return { systemPrompt: `${event.systemPrompt}\n\n${contract}` };
-  });
-
-  pi.on("input", async (event, ctx) => {
-    try {
-      const text = await activeBridge().request("prompt", { value: event.text });
-      const images = event.images
-        ? await activeBridge().request("media", { value: event.images })
-        : event.images;
-      return { action: "transform", text, images };
-    } catch {
-      if (ctx.hasUI) ctx.ui.notify("Pentect unavailable", "error");
-      return { action: "handled" };
-    }
-  });
-
-  pi.on("tool_call", async (event) => {
-    if (event.toolName === "bash") return {};
-    try {
-      const next = await activeBridge().request("before", {
-        tool: event.toolName,
-        value: event.input,
-      });
-      replaceObject(event.input, next);
-      return {};
-    } catch {
-      return { block: true, reason: "Pentect unavailable" };
-    }
-  });
-
-  pi.on("tool_result", async (event) => {
-    try {
-      return await activeBridge().request("after", {
-        tool: event.toolName,
-        input: event.input,
-        value: {
-          content: event.content,
-          details: event.details,
-          isError: event.isError,
-        },
-      });
-    } catch {
-      return SAFE_RESULT;
-    }
-  });
-
-  pi.on("user_bash", async () => ({ operations: protectedBash }));
-
-  pi.on("session_shutdown", async () => {
-    bridge?.close();
-    bridge = undefined;
-    contract = "";
-    sessionEnvironment = undefined;
-  });
-}