@sangyaahub/pi-marg 1.0.0

package/.mcp.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "codegraph": {
+      "type": "stdio",
+      "command": "codegraph",
+      "args": [
+        "serve",
+        "--mcp"
+      ]
+    }
+  }
+}

package/.omp-plugin/marketplace.json

@@ -0,0 +1,42 @@
+{
+  "$schema": "https://anthropic.com/claude-code/marketplace.schema.json",
+  "name": "pi-marg-marketplace",
+  "owner": {
+    "name": "Sangyaa",
+    "email": "contact@sangyaa.co"
+  },
+  "metadata": {
+    "description": "PiMarg — a governed development path for Pi Agent and Oh My Pi.",
+    "version": "1.0.0"
+  },
+  "plugins": [
+    {
+      "name": "pi-marg",
+      "description": "Intent-led development workflow with live A/B/C/D routing, capability detection, verification, and approval gates.",
+      "source": "./",
+      "version": "1.0.0",
+      "author": {
+        "name": "Sangyaa",
+        "email": "contact@sangyaa.co"
+      },
+      "homepage": "https://github.com/sangyaahub/pi-marg",
+      "repository": "https://github.com/sangyaahub/pi-marg.git",
+      "license": "MIT",
+      "category": "development",
+      "keywords": [
+        "pi",
+        "omp",
+        "workflow",
+        "model-routing",
+        "codegraph",
+        "approvals"
+      ],
+      "tags": [
+        "pi-agent",
+        "oh-my-pi",
+        "multi-model",
+        "governed-workflow"
+      ]
+    }
+  ]
+}

package/BRAND.md

@@ -0,0 +1,25 @@
+# PiMarg brand
+
+PiMarg is an open-source project by [Sangyaa](https://sangyaa.co).
+
+## Assets
+
+- `assets/pi-marg-banner.png` is the public repository and Pi catalog preview.
+- `assets/brand/sangyaa-mark.png` is the official Sangyaa mark sourced from `sangyaa.co` on 2026-09-09.
+- `assets/pi-marg-banner-source.html` is the editable, offline source for the banner.
+
+## Palette
+
+| Use | Colour |
+|---|---|
+| Sangyaa blue | `#0451F7` |
+| Deep blue | `#021E5C` |
+| Gold | `#C27B1A` |
+| Warm white | `#FAFAF7` |
+| Ink | `#161614` |
+
+The product name is written **PiMarg** in prose and `pi-marg` in package, plugin, and repository identifiers.
+
+## Permission
+
+The software is licensed under MIT. The Sangyaa name and logo remain brand identifiers of Sangyaa; the MIT license does not grant permission to imply Sangyaa endorsement of a modified or unrelated product. Forks may accurately describe their origin and should make material modifications clear.

package/CHANGELOG.md

@@ -0,0 +1,11 @@
+# Changelog
+
+## 1.0.0 — 2026-09-08
+
+- First PiMarg release for Pi Agent and Oh My Pi.
+- Sangyaa visual identity, public repository metadata, npm package metadata, and OMP marketplace catalog.
+- Shared A/B/C/D model-routing core with distinct-reviewer enforcement.
+- Runtime-specific adapters for schemas, session events, model discovery, protected inputs, and automatic Pi workflow entry.
+- Capability-gated CodeGraph, LSP, task, Advisor, review, memory, UI, debugger, and security routes.
+- One-use approval guard for destructive actions, pushes, merges, sharing, and web publication.
+- Responsive, offline interactive workflow demo.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,9 @@
+# Code of Conduct
+
+PiMarg welcomes people of every background and experience level. Be respectful, assume good intent while checking facts, critique ideas rather than people, and keep discussions focused on improving the project.
+
+Harassment, discrimination, threats, doxxing, sexualized attention, and deliberately disruptive conduct are not accepted in project spaces.
+
+Report conduct concerns privately to `contact@sangyaa.co`. Maintainers may edit or remove content, restrict participation, or take other proportionate action to protect the community. Reports will be handled as privately as practical.
+
+This policy applies in repository spaces and when someone is representing PiMarg or Sangyaa in public project activity.

package/CONTRIBUTING.md

@@ -0,0 +1,11 @@
+# Contributing
+
+Thank you for improving PiMarg.
+
+1. Open an issue or discussion for material workflow or compatibility changes.
+2. Keep shared decisions in `core/` and runtime differences in `adapters/pi/` or `adapters/omp/`.
+3. Do not weaken the A/C or B/D separation rule, evidence gates, or protected-action defaults without an explicit security rationale.
+4. Run `./scripts/validate.sh` and `bun test tests`.
+5. Describe which Pi and OMP versions you tested and any capability left unverified.
+
+By submitting a contribution, you agree that it may be distributed under this repository's MIT License.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sangyaa and PiMarg contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MODEL-SETUP.md

@@ -0,0 +1,73 @@
+# Model setup
+
+PiMarg reads the active Pi or OMP model registry whenever `auto_model_route` runs. Exact selectors are deliberately absent from this document because providers rename and replace models.
+
+```text
+LIVE AUTHENTICATED CATALOG
+            │
+     ┌──────┴──────┐
+     ▼             ▼
+ frontier       execution
+   A / C          B / D
+     │             │
+     └─ different ─┘ within each pair
+```
+
+## Roles
+
+| Stage | Purpose | Preferred class |
+|---|---|---|
+| A | Discovery and difficult reasoning | Latest eligible Claude frontier, OpenAI frontier, or Grok frontier |
+| C | Independent plan review | A different frontier model/family from A |
+| B | Execute the accepted plan | Claude/OpenAI mid-layer, Cursor Composer, eligible zero-metered route, or Devin SWE |
+| D | Independent implementation review | A different execution model/family from B |
+
+“Zero-metered” means the runtime reports zero token price for that route. Subscription quotas and pool limits can still apply.
+
+## Pi Agent
+
+Use Pi's normal provider configuration or environment variables, then verify availability with:
+
+```bash
+pi --list-models
+```
+
+The Pi adapter reads `ctx.scopedModels` when the session has a model allowlist; otherwise it reads `ctx.modelRegistry.getAvailable()`. This respects both authentication and an intentional session scope.
+
+## Oh My Pi
+
+Use OMP `/login`, then inspect `/model` or:
+
+```bash
+omp models list
+```
+
+The OMP adapter reads `ctx.models.list()` and activates an exact catalog entry with `pi.setModel()`.
+
+## Selection workflow
+
+1. Run `/auto-models choose`.
+2. Request `action: catalog` with the confirmed work type.
+3. Select A and C from frontier candidates.
+4. Select B and D when implementation is required.
+5. Resolve any A=C or B=D identity conflict before continuing.
+6. Activate the saved selector immediately before its stage.
+
+The normalized identity check treats the same underlying model reached through different providers as the same candidate when their identifiers normalize equally.
+
+## Devin
+
+Native Devin model entries are ordinary B/D candidates when the runtime catalog exposes them. A separate external Devin session appears only when a Devin tool is detected. Creating that session is a web mutation and requires one-use `post-web` approval.
+
+## Advisor and supplemental reviewers
+
+The selected C and D models are the authoritative reviewers. OMP Advisor, a Pi reviewer extension, or another watcher may supplement them only when detected; it must not replace the distinct-model contract.
+
+## Cost defaults
+
+- Give A one bounded discovery pass.
+- Give C the plan, acceptance criteria, assumptions, and risks—not the whole repository.
+- Use a capable mid-layer or included route for routine B execution.
+- Give D the diff, CodeGraph impact, decisions, and test evidence.
+- Escalate B or D to a frontier model only after concrete failure or for genuinely high-risk work.
+- Record model, stage, outcome, and available usage data so optimization measures cost per accepted result.

package/PUBLISHING.md

@@ -0,0 +1,53 @@
+# Publishing PiMarg
+
+This checklist is for maintainers. Public mutations remain subject to PiMarg's one-use approval gates.
+
+## Before a release
+
+1. Update `package.json`, `.omp-plugin/marketplace.json`, and `CHANGELOG.md` to the same version.
+2. Run `./scripts/validate.sh`, `bun test tests`, and `npm pack --dry-run`.
+3. Smoke-test the package root with the supported Pi and OMP versions.
+4. Inspect the packed file list for secrets, generated debris, and missing runtime files.
+
+## GitHub and OMP
+
+The public `sangyaahub/pi-marg` repository is itself an OMP marketplace because it contains `.omp-plugin/marketplace.json`.
+
+Users add and install it with:
+
+```bash
+omp plugin marketplace add sangyaahub/pi-marg
+omp plugin install --scope user pi-marg@pi-marg-marketplace
+```
+
+Create an annotated `v<version>` tag and GitHub release only after the matching commit is on `main` and the checks pass.
+
+## Pi package catalog
+
+Pi's package catalog discovers public npm packages carrying the `pi-package` keyword. PiMarg is published under SangyaaHub's npm scope as `@sangyaahub/pi-marg`.
+
+First publication requires an npm-authenticated maintainer:
+
+```bash
+npm whoami
+npm publish --access public
+```
+
+After npm indexes the package, search for `@sangyaahub/pi-marg` at `https://pi.dev/packages` and verify:
+
+```bash
+pi install npm:@sangyaahub/pi-marg
+```
+
+For later releases, prefer npm trusted publishing with GitHub OIDC and provenance instead of a long-lived repository token. Never commit npm credentials.
+
+## Approval order
+
+Use a fresh, exact one-use approval immediately before each public action:
+
+```text
+APPROVE ACTION: post-web
+APPROVE ACTION: push-main
+```
+
+Repository creation, GitHub release creation, and npm publication are separate `post-web` actions. A main-branch push uses `push-main`.

package/README.md

@@ -0,0 +1,191 @@
+<p align="center">
+  <img src="assets/pi-marg-banner.png" alt="PiMarg by Sangyaa — the governed development path for Pi Agent and Oh My Pi" width="100%">
+</p>
+
+<p align="center">
+  <a href="https://github.com/sangyaahub/pi-marg/releases"><img alt="Version 1.0.0" src="https://img.shields.io/badge/version-1.0.0-0451F7"></a>
+  <a href="LICENSE"><img alt="MIT License" src="https://img.shields.io/badge/license-MIT-C27B1A"></a>
+  <a href="https://pi.dev/packages?name=pi-marg"><img alt="Pi package" src="https://img.shields.io/badge/Pi-package-0338A8"></a>
+  <a href="https://omp.sh"><img alt="Oh My Pi plugin" src="https://img.shields.io/badge/OMP-plugin-021E5C"></a>
+</p>
+
+# PiMarg
+
+**Version 1.0.0 · MIT licensed · Pi Agent + Oh My Pi · by [Sangyaa](https://sangyaa.co)**
+
+PiMarg turns an ordinary prompt into a governed development path. It identifies the work boundary, selects one engineering method, discovers the models and tools the active runtime really provides, separates thinking from execution, records evidence, and stops before protected actions.
+
+```text
+                           shared workflow core
+                    intent · models · approvals · evidence
+                                      │
+                         ┌────────────┴────────────┐
+                         ▼                         ▼
+                     Pi adapter                OMP adapter
+                  TypeBox · Pi events       Zod · OMP events
+                         │                         │
+                         └────────────┬────────────┘
+                                      ▼
+                  A discover → C plan review → plan gate
+                                      │
+                                      ▼
+                       B build → verify → D review
+                                      │
+                                      ▼
+                      security when needed → lessons
+```
+
+The same model-selection and approval logic lives in `core/`. Runtime-specific code is limited to `adapters/pi/` and `adapters/omp/`.
+
+## Why PiMarg
+
+- Confirms job/client versus personal work; job/client mode suppresses Sangyaa branding by default.
+- Routes seven work types: idea, new feature, improvement, proactive bug fix, security, repository analysis, and business/sales analysis.
+- Uses one primary Compound Engineering, Superpowers, GSD Core, or automatically selected workflow spine.
+- Discovers current authenticated model selectors instead of pinning dated model names.
+- Enforces that A and C use different underlying models, and B and D use different underlying models.
+- Uses CodeGraph for repository architecture and impact when available, with LSP/AST or repository-native tools for exact code questions.
+- Adds conditional testing, debugger, browser/desktop, security, Advisor, task, and memory routes only when detected.
+- Tracks the plan, decisions, evidence, and one lesson under `.agent-work/sessions/`.
+- Requires a one-use approval before delete/remove, push, merge, web publication, session sharing, or external-agent creation.
+
+## Compatibility
+
+| Capability | Pi Agent | Oh My Pi |
+|---|---|---|
+| Ordinary prompts enter the workflow | Pi bootstrap hook | OMP global rule |
+| Shared skills and decision flow | Yes | Yes |
+| Dynamic A/B/C/D model routing | Pi model registry | OMP model registry |
+| Approval guard | Pi event adapter | OMP event adapter |
+| Slash workflow entry points | Pi prompt templates | OMP commands |
+| CodeGraph | CLI/integration when detected | MCP integration when configured |
+| Advisor, checkpoint, security scan, Hindsight | Extension/fallback when detected | Native capability when enabled |
+| Parallel agents | Only when a compatible task extension exists | Native `task`/workflow routes when available |
+
+Tested locally against Pi Agent `0.85.1` and OMP `18.1.14`. Optional features are always capability-detected, so their absence produces a recorded fallback rather than a false success claim.
+
+## Try the demo
+
+Open [`demo/pi-marg-v1.0.html`](demo/pi-marg-v1.0.html) in a modern browser. It is self-contained and offline. Use **Play Flow** for a walkthrough or **Presenter Mode** to hide the configuration panel.
+
+## Install
+
+Review extensions before installation: both Pi and OMP packages execute with your local user permissions.
+
+Preview the local installation commands:
+
+```bash
+./scripts/install.sh --runtime pi
+./scripts/install.sh --runtime omp
+```
+
+Apply one runtime:
+
+```bash
+./scripts/install.sh --runtime pi --apply
+./scripts/install.sh --runtime omp --apply
+```
+
+Install both only when you use both CLIs:
+
+```bash
+./scripts/install.sh --runtime both --apply
+```
+
+Install PiMarg from the Pi package catalog/npm:
+
+```bash
+pi install npm:@sangyaahub/pi-marg
+```
+
+Or install Pi and OMP directly from this GitHub repository:
+
+```bash
+pi install https://github.com/sangyaahub/pi-marg
+omp plugin marketplace add sangyaahub/pi-marg
+omp plugin install --scope user pi-marg@pi-marg-marketplace
+```
+
+## Configure models
+
+Authenticate providers using the active runtime's normal login flow, then run:
+
+```text
+/auto-models choose
+```
+
+The router builds choices from the live authenticated registry. It does not promise that a subscription route is free or unlimited. See [MODEL-SETUP.md](MODEL-SETUP.md).
+
+## Start a workflow
+
+Type a normal request or invoke:
+
+```text
+/auto add CSV export to this repository
+```
+
+Useful entry points:
+
+- `/auto-models choose` — refresh A/B/C/D choices.
+- `/auto-runtime status` — show detected capabilities and fallbacks.
+- `/auto-review plan|code` — run the independent review contract.
+- `/auto-status` — show the current ledger and evidence.
+- `/auto-close` — verify completion and write the session lesson once.
+
+On Pi these are prompt templates. On OMP they are command files. Ordinary new substantive prompts also enter the workflow automatically: Pi uses a lightweight bootstrap hook, while OMP loads the packaged global rule. The workflow instructions and state contract are shared.
+
+## Protected actions
+
+The default policy is `ask`. A protected action remains blocked until the complete next user message is exactly one of:
+
+```text
+APPROVE ACTION: delete-remove
+APPROVE ACTION: push-main
+APPROVE ACTION: merge-pr
+APPROVE ACTION: post-web
+```
+
+Each phrase permits one matching call and is then consumed. Set `PIMARG_APPROVAL_POLICY=allow` before starting the runtime only when intentionally enabling automated protected actions. `UNIVERSAL_AUTO_MODE_APPROVAL_POLICY` and `OMP_AUTO_MODE_APPROVAL_POLICY` remain recognized for migration.
+
+## CodeGraph policy
+
+For an existing repository, preview setup first:
+
+```bash
+./scripts/setup-codegraph.sh /absolute/path/to/repository
+```
+
+Apply after reviewing the preview:
+
+```bash
+./scripts/setup-codegraph.sh --apply /absolute/path/to/repository
+```
+
+OMP can expose CodeGraph through `.mcp.json`. Pi uses a detected CodeGraph CLI or another installed integration. When CodeGraph is missing, the workflow may use precise repository-native tools, but it must not claim a repository-wide architecture or impact scan occurred.
+
+## Project structure
+
+```text
+core/                    shared policy and routing logic
+adapters/pi/             Pi extensions and prompt templates
+adapters/omp/            OMP extensions
+skills/                  shared workflow skills
+commands/ agents/ rules/ OMP-native resources
+demo/                    offline interactive presentation
+tests/                   shared core and adapter contract tests
+```
+
+## Validate
+
+```bash
+./scripts/validate.sh
+bun test tests
+```
+
+## License
+
+PiMarg is an open-source project by [Sangyaa](https://sangyaa.co). Product branding uses Sangyaa's official mark and palette; see [BRAND.md](BRAND.md) for permitted use.
+
+Copyright © 2026 Sangyaa and PiMarg contributors. Released under the [MIT License](LICENSE). Everyone may use, copy, modify, merge, publish, distribute, sublicense, or sell copies subject to the license notice and warranty disclaimer.
+
+Contributions are welcome; see [CONTRIBUTING.md](CONTRIBUTING.md). Report vulnerabilities using [SECURITY.md](SECURITY.md).

package/SECURITY.md

@@ -0,0 +1,11 @@
+# Security policy
+
+## Reporting a vulnerability
+
+Do not disclose exploitable vulnerabilities in a public issue. Use [GitHub private vulnerability reporting](https://github.com/sangyaahub/pi-marg/security/advisories/new). If that is unavailable, email `contact@sangyaa.co` with the subject `PiMarg security report`.
+
+Include the affected version, runtime, reproduction steps, impact, and any suggested countermeasure. Never include live credentials, client data, or personal information.
+
+## Scope
+
+The approval guard is defense in depth, not an operating-system sandbox. Pi and OMP extensions execute with the user's local permissions. Users must review source code and install only trusted releases.

package/SUPPORT.md

@@ -0,0 +1,7 @@
+# Support
+
+Use [GitHub Discussions](https://github.com/sangyaahub/pi-marg/discussions) for setup questions and workflow ideas.
+
+Use [GitHub Issues](https://github.com/sangyaahub/pi-marg/issues) for reproducible bugs and feature requests. Include your operating system, Pi or OMP version, installation source, relevant commands, and redacted output.
+
+For vulnerabilities, follow [SECURITY.md](SECURITY.md) instead of opening a public issue.

package/adapters/omp/extensions/approval-guard.ts

@@ -0,0 +1,43 @@
+import {
+  OneUseApprovals,
+  approvalInstruction,
+  approvalPolicyFromEnvironment,
+  classifyInput,
+  classifyToolCall,
+  parseApproval,
+} from "../../../core/approval-policy";
+
+export default function approvalGuard(pi: any) {
+  const approvals = new OneUseApprovals();
+  const clear = () => approvals.clear();
+
+  pi.on("session_start", clear);
+  pi.on("session_switch", clear);
+  pi.on("session_branch", clear);
+
+  pi.on("input", async (event: any, ctx: any) => {
+    if (event.source === "extension") return;
+    const granted = parseApproval(event.text);
+    if (granted) {
+      approvals.grant(granted);
+      if (ctx.hasUI) ctx.ui.notify(`One ${granted} action is approved for this session.`, "warning");
+      return;
+    }
+
+    const action = classifyInput(event.text);
+    if (!action || approvalPolicyFromEnvironment() === "allow") return;
+    if (approvals.consume(action)) return;
+    if (ctx.hasUI) ctx.ui.notify(`Blocked ${event.text.trim()}. Approve once with: ${approvalInstruction(action)}`, "warning");
+    return { handled: true };
+  });
+
+  pi.on("tool_call", async (event: any) => {
+    if (approvalPolicyFromEnvironment() === "allow") return;
+    const action = classifyToolCall(event.toolName, event.input);
+    if (!action || approvals.consume(action)) return;
+    return {
+      block: true,
+      reason: `PiMarg blocked a protected ${action} action. Show the exact action and consequence, then ask for exactly:\n${approvalInstruction(action)}\nThe approval permits one matching call only.`,
+    };
+  });
+}

package/adapters/omp/extensions/model-router.ts

@@ -0,0 +1,56 @@
+import {
+  MODEL_STATE_TYPE,
+  STAGES,
+  emptyModelRouteState,
+  executeModelRoute,
+  restoreModelRouteState,
+  type ModelLike,
+  type ModelRouteParams,
+} from "../../../core/model-routing";
+
+function toolNames(pi: any): string[] {
+  return (pi.getAllTools?.() ?? [])
+    .map((tool: any) => typeof tool === "string" ? tool : String(tool?.name ?? ""))
+    .filter(Boolean);
+}
+
+function hasExternalDevin(pi: any): boolean {
+  return toolNames(pi).some((name) => /(?:^|[_-])devin(?:[_-]|$)/i.test(name));
+}
+
+export default function modelRouter(pi: any) {
+  const z = pi.zod;
+  let state = emptyModelRouteState();
+  const restore = (_event: unknown, ctx: any) => {
+    state = restoreModelRouteState(ctx.sessionManager.getBranch());
+  };
+
+  pi.on("session_start", restore);
+  pi.on("session_switch", restore);
+  pi.on("session_branch", restore);
+  pi.on("session_tree", restore);
+
+  pi.registerTool({
+    name: "auto_model_route",
+    label: "PiMarg Model Router",
+    description: "Discover, select, and activate live A/B/C/D model choices while enforcing A different from C and B different from D.",
+    parameters: z.object({
+      action: z.enum(["catalog", "select", "activate", "status"]),
+      stage: z.enum(STAGES).optional(),
+      target: z.string().optional(),
+      workType: z.number().optional(),
+    }),
+    async execute(_toolCallId: string, params: ModelRouteParams, _signal: unknown, _onUpdate: unknown, ctx: any) {
+      const models = ctx.models.list() as ModelLike[];
+      const execution = await executeModelRoute(state, params, {
+        runtimeName: "OMP",
+        models,
+        hasExternalDevin: hasExternalDevin(pi),
+        activate: (model) => pi.setModel(model),
+        persist: (nextState) => pi.appendEntry(MODEL_STATE_TYPE, nextState),
+      });
+      state = execution.state;
+      return execution.response;
+    },
+  });
+}

package/adapters/omp/extensions/runtime-capabilities.ts

@@ -0,0 +1,24 @@
+import {
+  buildRuntimeCapabilityReport,
+  normalizeCapabilityNames,
+} from "../../../core/runtime-capabilities";
+
+function response(report: unknown) {
+  return { content: [{ type: "text" as const, text: JSON.stringify(report, null, 2) }], details: report };
+}
+
+export default function runtimeCapabilities(pi: any) {
+  const z = pi.zod;
+  pi.registerTool({
+    name: "auto_runtime_status",
+    label: "PiMarg Runtime Status",
+    description: "Detect OMP tools, commands, and memory hooks before routing optional workflow stages.",
+    parameters: z.object({}),
+    async execute(_toolCallId: string, _params: unknown, _signal: unknown, _onUpdate: unknown, ctx: any) {
+      const tools = normalizeCapabilityNames(pi.getAllTools?.() ?? []);
+      const commands = normalizeCapabilityNames(pi.getCommands?.() ?? []);
+      const memoryConfigured = Boolean(ctx.memory) || tools.some((name) => ["recall", "retain", "reflect", "learn"].includes(name));
+      return response(buildRuntimeCapabilityReport("OMP", tools, commands, memoryConfigured));
+    },
+  });
+}

package/adapters/pi/extensions/approval-guard.ts

@@ -0,0 +1,39 @@
+import {
+  OneUseApprovals,
+  approvalInstruction,
+  approvalPolicyFromEnvironment,
+  classifyInput,
+  classifyToolCall,
+  parseApproval,
+} from "../../../core/approval-policy";
+
+export default function approvalGuard(pi: any) {
+  const approvals = new OneUseApprovals();
+  pi.on("session_start", () => approvals.clear());
+
+  pi.on("input", async (event: any, ctx: any) => {
+    if (event.source === "extension") return;
+    const granted = parseApproval(event.text);
+    if (granted) {
+      approvals.grant(granted);
+      if (ctx.hasUI) ctx.ui.notify(`One ${granted} action is approved for this session.`, "warning");
+      return { action: "handled" };
+    }
+
+    const action = classifyInput(event.text);
+    if (!action || approvalPolicyFromEnvironment() === "allow") return;
+    if (approvals.consume(action)) return;
+    if (ctx.hasUI) ctx.ui.notify(`Blocked ${event.text.trim()}. Approve once with: ${approvalInstruction(action)}`, "warning");
+    return { action: "handled" };
+  });
+
+  pi.on("tool_call", async (event: any) => {
+    if (approvalPolicyFromEnvironment() === "allow") return;
+    const action = classifyToolCall(event.toolName, event.input);
+    if (!action || approvals.consume(action)) return;
+    return {
+      block: true,
+      reason: `PiMarg blocked a protected ${action} action. Show the exact action and consequence, then ask for exactly:\n${approvalInstruction(action)}\nThe approval permits one matching call only.`,
+    };
+  });
+}