@pi-in-go/pigpen-pi-typesafe 0.1.0

package/CREDITS.md

@@ -0,0 +1,14 @@
+# Credits
+
+This Package is a Go port of **pi-typesafe** 0.8.0, https://github.com/DevMortimer/pi-typesafe, by
+**Ryan Gapac** (MIT, Copyright (c) 2026 Ryan Gapac). It is an independent project, not affiliated with TypeSafe AI or
+the Pi authors, and so is this port.
+
+- Pinned commit: `ed439f834665ad6fc652787f5ba7c23852566d49` (release 0.8.0, "Add Command Code backend and caller-supplied endpoints")
+- The unmodified original, with its tests, is vendored in `components/pi-typesafe/port/oracle/`; its license is in `LICENSE`
+  of this Package and in `components/pi-typesafe/port/oracle/LICENSE`.
+- What is modified: everything. The behavior, wording and structure follow the original; the code is a Go
+  implementation over the shared TypeSafe client (`components/typesafe`, a port of the official `@typesafe-ai/sdk`).
+  The mapping from each original file to its Go file is in `components/pi-typesafe/port/PORT.md`, with every deliberate difference.
+
+The Go code, scenarios and tests were written for Pigpen by Michael Kinsy.

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2026 Ryan Gapac
+Copyright (c) 2026 Michael Kinsy (the Go port)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,45 @@
+# pi-typesafe (Go port)
+
+[Jev](https://typesafe.ai) inside PiG: TypeSafe's judgment model answers typed questions about some state and returns
+probabilities instead of prose. This Package gives PiG three things:
+
+- **A tool for the agent**: `typesafe_evaluate` hands batched Choice, Score and Noul questions to Jev in one call.
+- **A playground**: `/typesafe test` and `/typesafe playground` run requests from the terminal without touching the model's context.
+- **A typed API for other extensions**: the library half is the Package [`pi-typesafe-api`](../pi-typesafe-api/README.md).
+
+It is a Go port of [pi-typesafe](https://github.com/DevMortimer/pi-typesafe) by Ryan Gapac (MIT; see [CREDITS.md](CREDITS.md)),
+built on the shared client [`typesafe`](../typesafe/README.md). Independent project: not affiliated with TypeSafe AI.
+
+## Off by default, and where your content goes
+
+The tool is registered but **disabled**: nothing is sent until the operator runs `/typesafe enable` (and confirms the notice) or
+sets `PI_TYPESAFE_ENABLED=1` for a headless run. Every submission goes to **`api.typesafe.ai`** and may incur charges, **unless the
+own-model backend is selected**, which answers with the model PiG is configured with and sends the content to *that model's
+provider* instead, never to TypeSafe. Select it with `PI_TYPESAFE_BACKEND=ownmodel` before launch or `/typesafe backend ownmodel`
+in a session. Consent is per destination: switching backend disables the tool again. The consent dialog and the tool description
+name the destination in use. Do not submit secrets; results are model judgments, not proof or authorization.
+
+## Use
+
+```sh
+pig install ./components/pi-typesafe        # builds from source on first use (Go toolchain), or fuses into a Piglet Binary
+```
+
+Inside PiG: `/typesafe login` (hidden input; the key is verified and stored with owner-only permissions in
+`<PiG agent dir>/pi-typesafe/`), `/typesafe test`, `/typesafe enable`. For CI set `TYPESAFE_API_KEY`; it wins over the stored key.
+Commands: `login logout setup status enable disable test playground` and `backend [typesafe|ownmodel]`.
+Limits: 32 questions and 64 KiB of JSON per request, 20 attempts per session, 15 s per request, no automatic retries; optional
+day caps `PI_TYPESAFE_MAX_REQUESTS_PER_DAY`, `PI_TYPESAFE_MAX_INPUT_TOKENS_PER_DAY`, `PI_TYPESAFE_MAX_USD_PER_DAY`.
+
+The **Piglet** [`pig-typesafe`](../../piglets/pig-typesafe/README.md) selects this Package (still off by default).
+
+## Differences from the original
+
+Listed with reasons in [port/PORT.md](port/PORT.md): PiG's agent directory, the own-model backend, question order in tool
+arguments (the SDK decodes them into maps), TypeBox-versus-host validation wording, and a backend switch that stops a request
+admitted before it (nothing is sent to a destination nobody consented to).
+
+## Proof
+
+`port/` holds the evidence: the unmodified original and its 134 tests (`port/oracle`), Go twins of every test case, 12 scenarios
+whose traces the original recorded under Pi (re-recorded on Pi 1.0.1) and the port reproduces under PiG (`port/golden`), and a mutation list.

package/extensions/pi-typesafe/branches_test.go

@@ -0,0 +1,185 @@
+package pi_typesafe_test
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+
+	pi_typesafe "github.com/MichaelKinsy/pigpen/components/pi-typesafe/extensions/pi-typesafe"
+)
+
+func (r *rig) lastLevel() string { r.mu.Lock(); defer r.mu.Unlock(); return r.levels[len(r.levels)-1] }
+
+func TestStartupCalloutIsAWarningNotificationWithUI(t *testing.T) {
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	r := newRig(t)
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	before := r.noticeCount()
+	r.startSession("startup")
+	if r.noticeCount() != before+1 || r.lastLevel() != "warning" || len(r.messages) != 0 {
+		t.Fatalf("notices=%v levels=%v messages=%v", r.notices, r.levels, r.messages)
+	}
+}
+
+func TestStartupCalloutWithoutUIIsAStatusMessage(t *testing.T) {
+	isolate(t)
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	no := false
+	var notices, messages, types []string
+	host := StartHost(t, pi_typesafe.New(pi_typesafe.Options{}), HostOptions{HasUI: &no, Mode: "print", OnCall: func(method string, args map[string]any) (map[string]any, string) {
+		switch method {
+		case "ui.notify":
+			notices = append(notices, args["message"].(string))
+		case "sendMessage":
+			m := args["message"].(map[string]any)
+			messages = append(messages, m["content"].(string))
+			types = append(types, m["customType"].(string))
+		}
+		return nil, ""
+	}})
+	host.Fire("session_start", map[string]any{"reason": "startup"})
+	if len(notices) != 0 || len(messages) != 1 || types[0] != "typesafe-status" || !strings.Contains(messages[0], "judgments are skipped") {
+		t.Fatalf("notices=%v messages=%v", notices, messages)
+	}
+}
+
+func TestForbiddenKeyIsCalledOutLikeARejectedOne(t *testing.T) {
+	r := newRig(t)
+	t.Setenv("TYPESAFE_API_KEY", "offline-test-key")
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	r.startSession("startup")
+	r.respond = func(*http.Request) *http.Response { return jsonResponse(403, map[string]any{"error": "no"}) }
+	before := r.noticeCount()
+	if _, failure := r.tool(nil); !strings.Contains(failure, "HTTP 403") {
+		t.Fatalf("failure = %q", failure)
+	}
+	said := strings.Join(r.noticesSince(before), "\n")
+	if !strings.Contains(said, "TypeSafe is not authenticated (TypeSafe returned HTTP 403.") || !strings.Contains(said, "Judgments will fail until the key is fixed.") {
+		t.Fatalf("said = %q", said)
+	}
+	// A busy service is not an authentication problem: no callout.
+	r.respond = func(*http.Request) *http.Response { return jsonResponse(503, map[string]any{}) }
+	before = r.noticeCount()
+	_, _ = r.tool(nil)
+	if r.noticeCount() != before {
+		t.Fatalf("a 503 must not call out: %v", r.noticesSince(before))
+	}
+}
+
+func TestLogoutForgetsTheAuthRecord(t *testing.T) {
+	r := newRig(t)
+	t.Setenv("TYPESAFE_API_KEY", "offline-test-key")
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	r.startSession("startup")
+	if _, failure := r.tool(nil); failure != "" {
+		t.Fatal(failure)
+	}
+	record := filepath.Join(r.agentDir, "pi-typesafe", "auth-state.json")
+	if !fileExists(record) {
+		t.Fatal("a successful request records the verification")
+	}
+	r.command("logout")
+	if fileExists(record) {
+		t.Fatal("logout must forget verification and degradation")
+	}
+}
+
+func TestEnableRefusesAnUnusableStoredKey(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX permission bits")
+	}
+	r := newRig(t)
+	stored := filepath.Join(r.agentDir, "pi-typesafe", "auth.json")
+	if err := os.MkdirAll(filepath.Dir(stored), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := os.WriteFile(stored, []byte(`{"apiKey":"stored-key-0123456789abcdef"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	_ = os.Chmod(stored, 0o644)
+	prior := r.confirmations
+	r.command("enable")
+	if !strings.HasPrefix(r.lastNotice(), "The stored key cannot be used. Refusing to read") || r.lastLevel() != "warning" || r.confirmations != prior {
+		t.Fatalf("notice = %s (%s)", r.lastNotice(), r.lastLevel())
+	}
+	r.command("setup")
+	if !strings.Contains(r.lastNotice(), "Key unusable — Refusing to read") {
+		t.Fatalf("setup = %s", r.lastNotice())
+	}
+}
+
+func TestSampleTestAsksForConsentThenRecordsAnEntry(t *testing.T) {
+	r := newRig(t)
+	t.Setenv("TYPESAFE_API_KEY", "offline-test-key")
+	r.respond = func(*http.Request) *http.Response {
+		return jsonResponse(200, map[string]any{"model": "jev-test", "usage": map[string]any{"input_tokens": 9, "output_tokens": 0}, "answers": map[string]any{
+			"category":    map[string]any{"type": "choice", "choice": "billing", "confidence": 1, "probabilities": map[string]any{"billing": 1, "technical": 0, "other": 0}},
+			"urgent":      map[string]any{"type": "noul", "noul": 0.8},
+			"frustration": map[string]any{"type": "score", "score": 1, "confidence": 1, "probabilities": map[string]any{"0": 0, "1": 1, "2": 0}, "legend": map[string]any{"0": "a", "1": "b", "2": "c"}},
+		}})
+	}
+	r.command("test")
+	if len(r.confirmTitles) != 1 || r.confirmTitles[0] != "Send this TypeSafe request?" || !strings.Contains(r.confirmBodies[0], "api.typesafe.ai") {
+		t.Fatalf("confirmations = %v %v", r.confirmTitles, r.confirmBodies)
+	}
+	if len(r.entryTypes) != 1 || r.entryTypes[0] != "typesafe-result" || r.network.Load() != 1 {
+		t.Fatalf("entries = %v network=%d", r.entryTypes, r.network.Load())
+	}
+	// The entry keeps the question order for the renderer.
+	if !strings.Contains(string(r.entries[0]), `"order":["category","urgent","frustration"]`) {
+		t.Fatalf("entry = %s", r.entries[0])
+	}
+}
+
+func TestRenderersDrawCallPartialAndEntry(t *testing.T) {
+	r := newRig(t)
+	render := func(args map[string]any) string {
+		raw, failure := r.host.roundTrip(map[string]any{"method": "render_tool", "tool": "typesafe_evaluate", "args": mustJSON(args)})
+		if failure != "" {
+			t.Fatal(failure)
+		}
+		return string(raw)
+	}
+	if got := render(map[string]any{"card": "a", "phase": "call", "width": 80, "args": map[string]any{"questions": map[string]any{"a": 1, "b": 2}}}); !strings.Contains(got, "TypeSafe · 2 questions · external request") {
+		t.Errorf("call = %s", got)
+	}
+	if got := render(map[string]any{"card": "a", "phase": "result", "width": 80, "options": map[string]any{"isPartial": true}}); !strings.Contains(got, "TypeSafe · waiting for response") {
+		t.Errorf("partial = %s", got)
+	}
+	if got := render(map[string]any{"card": "a", "phase": "result", "width": 80, "result": map[string]any{"content": []any{map[string]any{"type": "text", "text": "plain failure"}}}}); !strings.Contains(got, "plain failure") {
+		t.Errorf("text fallback = %s", got)
+	}
+	raw, failure := r.host.roundTrip(map[string]any{"method": "render_entry", "tool": "typesafe-result", "args": mustJSON(map[string]any{"entry": map[string]any{}, "width": 80})})
+	if failure != "" || !strings.Contains(string(raw), "TypeSafe · no result") {
+		t.Errorf("empty entry = %s %s", raw, failure)
+	}
+}
+
+func TestToolContentIsTheEvaluationJSONTheModelReads(t *testing.T) {
+	r := newRig(t)
+	t.Setenv("TYPESAFE_API_KEY", "offline-test-key")
+	t.Setenv("PI_TYPESAFE_ENABLED", "1")
+	r.startSession("startup")
+	raw, failure := r.host.Tool("typesafe_evaluate", defaultParams)
+	if failure != "" {
+		t.Fatal(failure)
+	}
+	var result struct {
+		Content string         `json:"content"`
+		Details map[string]any `json:"details"`
+	}
+	if err := json.Unmarshal(raw, &result); err != nil {
+		t.Fatal(err)
+	}
+	var content map[string]any
+	if err := json.Unmarshal([]byte(result.Content), &content); err != nil {
+		t.Fatalf("content is not JSON: %q", result.Content)
+	}
+	if content["model"] != "jev-test" || content["elapsedMs"] == nil || content["order"] != nil || result.Details["order"] == nil {
+		t.Fatalf("content = %s details = %v", result.Content, result.Details)
+	}
+}

package/extensions/pi-typesafe/command.go

@@ -0,0 +1,319 @@
+package pi_typesafe
+
+import (
+	"bytes"
+	"encoding/json"
+	"fmt"
+	"strings"
+
+	sdk "github.com/MichaelKinsy/PiG/extensions/sdk"
+	pitypesafe "github.com/MichaelKinsy/pigpen/components/pi-typesafe-api"
+	"github.com/MichaelKinsy/pigpen/components/pi-typesafe-api/hostmodel"
+	"github.com/MichaelKinsy/pigpen/components/pi-typesafe-api/ui"
+)
+
+// actions are the /typesafe subcommands the usage text lists, in the original's order.
+var actions = []string{"login", "logout", "setup", "status", "enable", "disable", "test", "playground"}
+
+// backendAction is this port's addition (the own-model backend): it is completed but not part of the usage text.
+const backendAction = "backend"
+
+func (s *state) registerCommand() {
+	s.ext.RegisterCommand("typesafe", sdk.CommandOptions{
+		Description: "TypeSafe login, consent, usage, sample test, and JSON playground",
+		GetArgumentCompletions: func(prefix string) ([]sdk.AutocompleteItem, error) {
+			var items []sdk.AutocompleteItem
+			for _, a := range append(append([]string(nil), actions...), backendAction) {
+				if strings.HasPrefix(a, prefix) {
+					items = append(items, sdk.AutocompleteItem{Value: a, Label: a})
+				}
+			}
+			return items, nil
+		},
+		Handler: s.command,
+	})
+}
+
+func (s *state) reporter(ctx sdk.Context) func(text, level string) {
+	return func(text, level string) {
+		if ctx.HasUI() {
+			ctx.Notify(text, level)
+			return
+		}
+		_ = ctx.SendMessage(statusType, text, true, sdk.SendMessageOptions{})
+	}
+}
+
+func contains(list []string, v string) bool {
+	for _, e := range list {
+		if e == v {
+			return true
+		}
+	}
+	return false
+}
+
+func (s *state) command(ctx sdk.Context, args string) error {
+	// The original takes the whole argument text as the action (args.trim() || "status"), so trailing words make
+	// an unknown action; only this port's backend action takes an argument.
+	text := strings.TrimSpace(args)
+	fields := strings.Fields(text)
+	action := text
+	if action == "" {
+		action = "status"
+	}
+	if len(fields) > 0 && fields[0] == backendAction {
+		action = backendAction
+	}
+	report := s.reporter(ctx)
+	err := s.run(ctx, action, fields, report)
+	if err != nil {
+		report(pitypesafe.SafeError(err, s.currentBackend()).Message, "error")
+	}
+	return nil
+}
+
+func (s *state) run(ctx sdk.Context, action string, fields []string, report func(string, string)) error {
+	backend := s.currentBackend()
+	switch action {
+	case "status":
+		return s.status(ctx, report)
+	case "logout":
+		removed := pitypesafe.ClearStoredAPIKey()
+		pitypesafe.ClearAuthState()
+		s.resetClient()
+		s.setEnabled(false)
+		if removed {
+			report("Removed the stored key at "+pitypesafe.CredentialsPath()+". TypeSafe is disabled.", "info")
+		} else {
+			text := "No stored key to remove."
+			if pitypesafe.EnvKeySet() {
+				text += " TYPESAFE_API_KEY is still set in the environment."
+			}
+			report(text, "info")
+		}
+		return nil
+	case "disable":
+		s.setEnabled(false)
+		report("TypeSafe disabled for future agent calls. In-flight requests are not cancelled.", "info")
+		return nil
+	case backendAction:
+		return s.chooseBackend(fields, report)
+	}
+	if !contains(actions, action) {
+		report("Usage: /typesafe "+strings.Join(actions, " | "), "warning")
+		return nil
+	}
+	if !ctx.HasUI() {
+		report("This command needs interactive Pi. For headless tool use, explicitly set PI_TYPESAFE_ENABLED=1 and TYPESAFE_API_KEY before launching Pi.", "warning")
+		return nil
+	}
+	situation, err := pitypesafe.KeySituationFor(backend)
+	if err != nil {
+		return err
+	}
+	if backend == pitypesafe.BackendOwnModel && (action == "login" || action == "setup") {
+		report("The own-model backend needs no key: it answers with the model PiG is configured with. Use /typesafe backend typesafe to use the TypeSafe API.", "info")
+		return nil
+	}
+	if action == "login" || (action == "setup" && situation.Kind == pitypesafe.KeyMissing) {
+		if pitypesafe.EnvKeySet() {
+			report("TYPESAFE_API_KEY is set in the environment and takes precedence over a stored key. Unset it before using /typesafe login.", "warning")
+			return nil
+		}
+		login, err := ui.LoginWithPrompt(ctx, ui.LoginOptions{HTTPClient: s.opts.HTTPClient})
+		if err != nil {
+			return err
+		}
+		if login == nil {
+			report("Login cancelled; nothing was saved.", "info")
+			return nil
+		}
+		s.resetClient()
+		plural := "s"
+		if login.Models == 1 {
+			plural = ""
+		}
+		report(fmt.Sprintf("Key verified (%d model%s available) and saved to %s with owner-only permissions. Run /typesafe enable to allow agent tool calls.", login.Models, plural, login.Path), "info")
+		return nil
+	}
+	if action == "setup" {
+		current := "missing"
+		switch situation.Kind {
+		case pitypesafe.KeyEnvironment, pitypesafe.KeyStored:
+			current = "configured via " + pitypesafe.KeySourceLabel(situation)
+		case pitypesafe.KeyUnusable:
+			current = "unusable — " + situation.Reason
+		}
+		report("Key "+current+". Run /typesafe test for one sample request or /typesafe enable to allow agent tool calls.", "info")
+		return nil
+	}
+	if action == "enable" {
+		switch situation.Kind {
+		case pitypesafe.KeyMissing:
+			report("Run /typesafe login first: no API key is configured.", "warning")
+			return nil
+		case pitypesafe.KeyUnusable:
+			report("The stored key cannot be used. "+situation.Reason, "warning")
+			return nil
+		}
+		ok, err := ctx.Confirm("Enable TypeSafe for this session?", disclosure(backend))
+		if err != nil {
+			return err
+		}
+		if ok {
+			s.setEnabled(true)
+			report(fmt.Sprintf("TypeSafe enabled. Up to %d attempts in this session; /typesafe disable stops future agent calls.", pitypesafe.DefaultMaxRequests), "info")
+		}
+		return nil
+	}
+	return s.sample(ctx, action)
+}
+
+// sample is /typesafe test and /typesafe playground: validate, confirm, send, and show the result without
+// putting it in the model's context.
+func (s *state) sample(ctx sdk.Context, action string) error {
+	var request any = mustParse(sampleJSON)
+	if action == "playground" {
+		pretty := indent(sampleJSON)
+		text, ok, err := ctx.Editor("TypeSafe request JSON · edit state and questions", pretty)
+		if err != nil {
+			return err
+		}
+		if !ok {
+			return nil
+		}
+		parsed, err := pitypesafe.ParseJSON([]byte(text))
+		if err != nil {
+			s.reporter(ctx)("Invalid JSON. Keep quoted strings on one line; nothing was sent.", "error")
+			return nil
+		}
+		request = parsed
+	}
+	validated, err := pitypesafe.PrepareEvaluationRequest(request, pitypesafe.PrepareOptions{})
+	if err != nil {
+		return err
+	}
+	consent := s.consentNow()
+	ok, err := ctx.Confirm("Send this TypeSafe request?", disclosure(s.currentBackend()))
+	if err != nil || !ok {
+		return err
+	}
+	// The operator confirmed one destination; a backend switch while the dialog was open voids that.
+	client, err := s.clientFor(consent)
+	if err != nil {
+		return err
+	}
+	goCtx, cancel := goContext(ctx)
+	defer cancel()
+	result, err := client.EvaluateRaw(goCtx, validated)
+	if err != nil {
+		return err
+	}
+	// Playground results stay out of LLM context; the agent tool returns its own results normally.
+	details, err := result.DetailsJSON()
+	if err != nil {
+		return err
+	}
+	return ctx.AppendEntry(entryType, json.RawMessage(details))
+}
+
+func mustParse(text string) any {
+	v, err := pitypesafe.ParseJSON([]byte(text))
+	if err != nil {
+		panic(err)
+	}
+	return v
+}
+
+// indent is JSON.stringify(value, null, 2).
+func indent(compact string) string {
+	var b bytes.Buffer
+	if err := json.Indent(&b, []byte(compact), "", "  "); err != nil {
+		return compact
+	}
+	return b.String()
+}
+
+func (s *state) status(ctx sdk.Context, report func(string, string)) error {
+	backend := s.currentBackend()
+	state, err := pitypesafe.GetAuthState(pitypesafe.AuthOptions{Backend: backend})
+	if err != nil {
+		return err
+	}
+	auth, err := pitypesafe.DescribeAuth(state)
+	if err != nil {
+		return err
+	}
+	client := s.peekClient()
+	session := fmt.Sprintf("Session 0/%d attempts; no client yet in this session.", pitypesafe.DefaultMaxRequests)
+	today, blocked := "", ""
+	if client != nil {
+		spend := client.GetSpend()
+		session = fmt.Sprintf("Session %d/%d attempts, %d successful, %d failed, %d input tokens (~$%.4f).",
+			spend.Session.RequestsStarted, pitypesafe.DefaultMaxRequests, spend.Session.RequestsSucceeded, spend.Session.RequestsFailed, spend.Session.InputTokens, spend.Session.EstimatedUSD)
+		today = fmt.Sprintf("Today %d requests (%d ok, %d failed), %d input tokens, ~$%.4f.",
+			spend.Today.RequestsStarted, spend.Today.RequestsSucceeded, spend.Today.RequestsFailed, spend.Today.InputTokens, spend.Today.EstimatedUSD)
+		if b := spend.Blocked; b != nil {
+			blocked = fmt.Sprintf(" Cap reached: %s %s/%s on %s; no request will be submitted until the local day rolls over.", b.Cap, num(b.Used), num(b.Limit), b.Day)
+		}
+	}
+	enabled := s.isEnabled()
+	word := "disabled"
+	if enabled {
+		word = "enabled"
+	}
+	level := "info"
+	if auth.Level == pitypesafe.LevelError && enabled {
+		level = "warning"
+	}
+	model := pitypesafe.DefaultModelID(pitypesafe.DefaultBackend)
+	if backend == pitypesafe.BackendOwnModel {
+		model = "the model PiG is configured with"
+		if ref, err := hostmodel.Active(ctx); err == nil {
+			model = ref.Provider + "/" + ref.ID
+		}
+	}
+	report(fmt.Sprintf("TypeSafe: %s. %s %s %s%s Model: %s. Session limits reset on session start/reload; daily counters persist and caps come from client options or PI_TYPESAFE_MAX_* environment variables. %s",
+		word, auth.Text, session, today, blocked, model, disclosure(backend)), level)
+	return nil
+}
+
+func num(v float64) string {
+	b, _ := pitypesafe.EncodeJSON(v)
+	return string(b)
+}
+
+// chooseBackend switches between the TypeSafe API and the own-model backend. Consent is per destination, so a
+// switch disables the tool until the operator enables it again.
+func (s *state) chooseBackend(fields []string, report func(string, string)) error {
+	current := s.currentBackend()
+	if len(fields) < 2 {
+		report(fmt.Sprintf("Judgment backend: %s. Options: %s (api.typesafe.ai), %s (the model PiG is configured with). Set PI_TYPESAFE_BACKEND before launch to choose the startup backend.",
+			current, pitypesafe.BackendTypeSafe, pitypesafe.BackendOwnModel), "info")
+		return nil
+	}
+	choice := fields[1]
+	if choice != pitypesafe.BackendTypeSafe && choice != pitypesafe.BackendOwnModel {
+		report(fmt.Sprintf("Unknown backend %q. Options: %s, %s.", choice, pitypesafe.BackendTypeSafe, pitypesafe.BackendOwnModel), "warning")
+		return nil
+	}
+	if choice == current {
+		report("Backend is already "+choice+".", "info")
+		return nil
+	}
+	s.mu.Lock()
+	s.backend = choice
+	s.consent++
+	s.enabled = false
+	s.client = nil
+	s.calledOut = ""
+	s.mu.Unlock()
+	s.registerTool()
+	destination := "api.typesafe.ai"
+	if choice == pitypesafe.BackendOwnModel {
+		destination = "the provider of the model PiG is configured with"
+	}
+	report(fmt.Sprintf("Backend set to %s for this session. TypeSafe is disabled: run /typesafe enable to consent to sending content to %s.", choice, destination), "info")
+	return nil
+}

package/extensions/pi-typesafe/export_test.go

@@ -0,0 +1,9 @@
+package pi_typesafe
+
+// SetAdmittedHook replaces the seam that runs between a tool call's consent gate and its send, and returns
+// the function that restores the previous one. Tests use it to change the backend at that moment.
+func SetAdmittedHook(f func()) (restore func()) {
+	previous := admitted
+	admitted = f
+	return func() { admitted = previous }
+}