@timurproko/a1 0.1.8-dev.ece8cef → 0.2.1-dev.590

package/dist/integrations/pi/engine/project-trust-preflight.d.ts

@@ -0,0 +1,21 @@
+export interface PiProjectTrustPreflightRequest {
+    readonly cwd: string;
+    readonly defaultDecision: "ask" | "always" | "never";
+}
+export type PiProjectTrustPreflightPrompt = (request: PiProjectTrustPreflightRequest) => Promise<boolean | null>;
+export interface PiProjectTrustPreflightResult {
+    readonly trusted: boolean;
+    readonly source: "saved" | "default" | "interactive" | "fail-closed";
+    readonly diagnostic: string | null;
+}
+export interface ResolvePiProjectTrustPreflightOptions {
+    readonly cwd: string;
+    readonly agentDir: string;
+    readonly prompt?: PiProjectTrustPreflightPrompt;
+}
+/**
+ * Resolves trust from global state only. It never constructs a project-trusted
+ * settings manager or resource loader; callers may do that only after this
+ * result exists.
+ */
+export declare function resolvePiProjectTrustPreflight(options: ResolvePiProjectTrustPreflightOptions): Promise<PiProjectTrustPreflightResult>;

package/dist/integrations/pi/engine/project-trust-preflight.js

@@ -0,0 +1,46 @@
+import { ProjectTrustStore, SettingsManager, } from "../startup-public.js";
+/**
+ * Resolves trust from global state only. It never constructs a project-trusted
+ * settings manager or resource loader; callers may do that only after this
+ * result exists.
+ */
+export async function resolvePiProjectTrustPreflight(options) {
+    const trustStore = new ProjectTrustStore(options.agentDir);
+    const saved = trustStore.get(options.cwd);
+    if (saved !== null)
+        return { trusted: saved, source: "saved", diagnostic: null };
+    // Security: projectTrusted:false is the boundary: this read may see global
+    // settings but cannot consume project settings or construct project resources.
+    const globalSettings = SettingsManager.create(options.cwd, options.agentDir, { projectTrusted: false });
+    const fallback = globalSettings.getDefaultProjectTrust();
+    if (fallback === "always")
+        return { trusted: true, source: "default", diagnostic: null };
+    if (fallback === "never")
+        return { trusted: false, source: "default", diagnostic: null };
+    if (options.prompt === undefined) {
+        return {
+            trusted: false,
+            source: "fail-closed",
+            diagnostic: `Project resources in ${options.cwd} were withheld because trust requires interaction`,
+        };
+    }
+    try {
+        const decision = await options.prompt({ cwd: options.cwd, defaultDecision: fallback });
+        if (decision === null) {
+            return {
+                trusted: false,
+                source: "fail-closed",
+                diagnostic: `Project resources in ${options.cwd} were withheld because trust selection was cancelled`,
+            };
+        }
+        trustStore.set(options.cwd, decision);
+        return { trusted: decision, source: "interactive", diagnostic: null };
+    }
+    catch (error) {
+        return {
+            trusted: false,
+            source: "fail-closed",
+            diagnostic: `Project resources in ${options.cwd} were withheld because trust resolution failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/integrations/pi/engine/prompt-suggestions.d.ts

@@ -0,0 +1,30 @@
+import type { AgentSession, AgentSessionRuntime } from "../startup-public.js";
+import { type OwnedUiModelInfo, type OwnedUiPromptSuggestionGeneratorPort, type OwnedUiPromptSuggestionReasoning, type OwnedUiPromptSuggestionRequest, type OwnedUiPromptSuggestionResult } from "../../../contracts/owned-ui/index.js";
+/** The run position a suggestion request must still match to be answered. */
+export interface PiPromptSuggestionIdentity {
+    readonly sessionId: string;
+    readonly sessionGeneration: number;
+    readonly runSequence: number;
+    readonly responseSequence: number;
+}
+export interface PiPromptSuggestionPorts {
+    session(): AgentSession | undefined;
+    runtime(): AgentSessionRuntime | undefined;
+    activeModel(): OwnedUiModelInfo | null;
+    /** The adapter's current position; a request for an earlier position is answered "unavailable". */
+    identity(): PiPromptSuggestionIdentity;
+    /** True while the adapter cannot serve: disposed, overloaded, or admission stopped. */
+    unavailable(): boolean;
+}
+/**
+ * Contextual prompt suggestions generated against the bound session's own conversation prefix
+ * through pinned Pi's model runtime, so the provider serves the suggestion from the run's prompt
+ * cache. The adapter supplies the session, runtime, model, and run position through ports and
+ * remains the port the owned UI calls.
+ */
+export declare class PiPromptSuggestions implements OwnedUiPromptSuggestionGeneratorPort {
+    #private;
+    constructor(ports: PiPromptSuggestionPorts);
+    reasoningPolicy(): OwnedUiPromptSuggestionReasoning;
+    generate(request: OwnedUiPromptSuggestionRequest): Promise<OwnedUiPromptSuggestionResult>;
+}

package/dist/integrations/pi/engine/prompt-suggestions.js

@@ -0,0 +1,102 @@
+import { isRecord, stringValue } from "./message-values.js";
+import { CONTEXTUAL_PROMPT_SUGGESTION_INSTRUCTION, assertOwnedUiPromptSuggestionRequest, assertOwnedUiPromptSuggestionResult, normalizePromptSuggestionCandidate, } from "../../../contracts/owned-ui/index.js";
+/**
+ * Contextual prompt suggestions generated against the bound session's own conversation prefix
+ * through pinned Pi's model runtime, so the provider serves the suggestion from the run's prompt
+ * cache. The adapter supplies the session, runtime, model, and run position through ports and
+ * remains the port the owned UI calls.
+ */
+export class PiPromptSuggestions {
+    #ports;
+    constructor(ports) {
+        this.#ports = ports;
+    }
+    reasoningPolicy() {
+        const session = this.#ports.session();
+        if (!session?.model)
+            return "unavailable";
+        if (!session.model.reasoning)
+            return "ordinary";
+        // Performance: the run's own level keeps the provider's thinking parameters, and the cached prefix, identical.
+        return readSuggestionReasoning(session.thinkingLevel);
+    }
+    async generate(request) {
+        assertOwnedUiPromptSuggestionRequest(request);
+        const identity = request.identity;
+        const session = this.#ports.session();
+        const runtime = this.#ports.runtime();
+        const activeModel = this.#ports.activeModel();
+        const current = this.#ports.identity();
+        if (this.#ports.unavailable() || session === undefined || runtime === undefined || request.signal.aborted
+            || identity.sessionId !== current.sessionId
+            || identity.sessionGeneration !== current.sessionGeneration
+            || identity.runSequence !== current.runSequence
+            || identity.responseSequence !== current.responseSequence
+            || activeModel === null
+            || identity.model.providerId !== activeModel.providerId
+            || identity.model.modelId !== activeModel.modelId) {
+            return { identity, outcome: request.signal.aborted ? "cancelled" : "unavailable", text: null };
+        }
+        const model = session.model;
+        const agent = session.agent;
+        const agentState = agent.state;
+        const policy = this.reasoningPolicy();
+        if (model === undefined || policy === "unavailable" || typeof runtime.services.modelRuntime.completeSimple !== "function") {
+            return { identity, outcome: "unavailable", text: null };
+        }
+        // Performance: mirror the primary loop's request shape so the provider serves the conversation prefix
+        // from the run's prompt cache. `onResponse` stays out: extensions must not see a suggestion as a response.
+        const reasoning = policy === "ordinary" || policy === "off" ? undefined : policy;
+        let response;
+        try {
+            const transformed = typeof agent.transformContext === "function"
+                ? await agent.transformContext(agentState.messages, request.signal)
+                : agentState.messages;
+            const messages = typeof agent.convertToLlm === "function"
+                ? await agent.convertToLlm(transformed)
+                : transformed.filter(message => message.role === "user" || message.role === "assistant" || message.role === "toolResult");
+            response = await runtime.services.modelRuntime.completeSimple(model, {
+                systemPrompt: agentState.systemPrompt,
+                messages: [
+                    ...messages,
+                    { role: "user", content: CONTEXTUAL_PROMPT_SUGGESTION_INSTRUCTION, timestamp: Date.now() },
+                ],
+                tools: agentState.tools,
+            }, {
+                signal: request.signal,
+                ...(reasoning === undefined ? {} : { reasoning }),
+                ...(agent.sessionId === undefined ? {} : { sessionId: agent.sessionId }),
+                ...(agent.thinkingBudgets === undefined ? {} : { thinkingBudgets: agent.thinkingBudgets }),
+                ...(agent.transport === undefined ? {} : { transport: agent.transport }),
+                ...(agent.onPayload === undefined ? {} : { onPayload: agent.onPayload }),
+            });
+        }
+        catch {
+            return { identity, outcome: request.signal.aborted ? "cancelled" : "provider-failure", text: null };
+        }
+        if (request.signal.aborted || (isRecord(response) && response.stopReason === "aborted")) {
+            return { identity, outcome: "cancelled", text: null };
+        }
+        if (!isRecord(response) || stringValue(response.errorMessage) !== undefined || response.stopReason === "error") {
+            return { identity, outcome: "provider-failure", text: null };
+        }
+        const content = Array.isArray(response.content) ? response.content : [];
+        if (response.stopReason === "length" || content.some(block => isRecord(block) && block.type === "toolCall")) {
+            return { identity, outcome: "rejected", text: null };
+        }
+        // Security: validate all text, not just the first block of a multi-part response.
+        const rawText = content.filter(block => isRecord(block) && block.type === "text")
+            .map(block => stringValue(block.text) ?? "").join("\n");
+        const text = normalizePromptSuggestionCandidate(rawText);
+        const result = text === null
+            ? { identity, outcome: rawText.trim() ? "rejected" : "empty", text: null }
+            : { identity, outcome: "candidate", text };
+        assertOwnedUiPromptSuggestionResult(result);
+        return result;
+    }
+}
+function readSuggestionReasoning(value) {
+    return value === "minimal" || value === "low" || value === "medium" || value === "high" || value === "xhigh" || value === "max"
+        ? value
+        : "off";
+}

package/dist/integrations/pi/engine/provider-authentication.d.ts

@@ -0,0 +1,34 @@
+import { type AgentSession, type AgentSessionRuntime } from "../startup-public.js";
+import type { PiWorkflowContexts } from "./workflow-contexts.js";
+import type { OwnedUiModelInfo } from "../../../contracts/owned-ui/index.js";
+import type { PiWorkflowInteractionHost, PiWorkflowRequest, PiWorkflowResult } from "./workflows.js";
+type PiSessionApi = AgentSession;
+type PiRuntimeApi = AgentSessionRuntime;
+export interface PiProviderAuthenticationPorts {
+    runtime(): PiRuntimeApi | undefined;
+    requireSession(): PiSessionApi;
+    disposed(): boolean;
+    sessionGeneration(): number;
+    interaction(): PiWorkflowInteractionHost;
+    setActiveModel(model: OwnedUiModelInfo): void;
+    reconcileActiveModelAvailability(): void;
+    emitView(): void;
+}
+/**
+ * Pinned Pi's provider login and logout: resolving a provider reference to an authentication
+ * method, driving the model runtime's login through the owned interaction host, selecting the
+ * provider's pinned default model when the session had none, and the deferred catalog refresh
+ * whose notices follow the saved-credential status. Wording follows pinned Pi exactly.
+ */
+export declare class PiProviderAuthentication {
+    #private;
+    constructor(options: {
+        readonly agentDir: string;
+        readonly contexts: PiWorkflowContexts;
+    }, ports: PiProviderAuthenticationPorts);
+    /** Run pinned Pi's `/login` for a provider reference or an explicit `type:provider` selection. */
+    login(request: PiWorkflowRequest, session: PiSessionApi, runtime: PiRuntimeApi, argument: string, selection: string | undefined): Promise<PiWorkflowResult>;
+    /** Run pinned Pi's `/logout` for a `type:provider` selection. */
+    logout(request: PiWorkflowRequest, runtime: PiRuntimeApi, selection: string): Promise<PiWorkflowResult>;
+}
+export {};

package/dist/integrations/pi/engine/provider-authentication.js

@@ -0,0 +1,209 @@
+import { join } from "node:path";
+import { isRecord, requireCapability, stringProperty } from "./message-values.js";
+import { CredentialSynchronizationError } from "../startup-public.js";
+import { AUTH_REFRESH_TIMEOUT_MS, isUnknownModel, PINNED_DEFAULT_MODEL_BY_PROVIDER, workflowLoginNotification, workflowResult } from "./workflow-support.js";
+/**
+ * Pinned Pi's provider login and logout: resolving a provider reference to an authentication
+ * method, driving the model runtime's login through the owned interaction host, selecting the
+ * provider's pinned default model when the session had none, and the deferred catalog refresh
+ * whose notices follow the saved-credential status. Wording follows pinned Pi exactly.
+ */
+export class PiProviderAuthentication {
+    #agentDir;
+    #contexts;
+    #ports;
+    constructor(options, ports) {
+        this.#agentDir = options.agentDir;
+        this.#contexts = options.contexts;
+        this.#ports = ports;
+    }
+    /** Run pinned Pi's `/login` for a provider reference or an explicit `type:provider` selection. */
+    async login(request, session, runtime, argument, selection) {
+        if (!selection && !argument)
+            return workflowResult(request.command, "failed", "Login requires the owned authentication controller");
+        const modelRuntime = runtime.services.modelRuntime;
+        let loginSelection = selection ?? argument;
+        if (!selection && argument && !argument.includes(":")) {
+            const normalized = argument.toLowerCase();
+            const providers = modelRuntime.getProviders?.();
+            const providerMatches = Array.isArray(providers) ? providers.filter(isRecord).filter(candidate => stringProperty(candidate, "id")?.toLowerCase() === normalized
+                || stringProperty(candidate, "name")?.toLowerCase() === normalized) : [];
+            const providerReference = providerMatches.length === 1 ? stringProperty(providerMatches[0], "id") ?? argument : argument;
+            const matching = this.#contexts.loginOptions().filter(option => option.id.endsWith(`:${providerReference}`));
+            if (matching.length > 1) {
+                const provider = modelRuntime.getProvider?.(providerReference);
+                const providerName = stringProperty(provider, "name") ?? providerReference;
+                return workflowResult(request.command, "failed", `Authentication method for ${providerName} requires the owned authentication controller`);
+            }
+            if (matching[0])
+                loginSelection = matching[0].id;
+        }
+        const [authTypeValue = "oauth", providerId = loginSelection] = loginSelection.includes(":")
+            ? loginSelection.split(":", 2)
+            : ["oauth", loginSelection];
+        const authType = authTypeValue === "api_key" ? "api_key" : "oauth";
+        const provider = modelRuntime.getProvider?.(providerId);
+        const providerName = stringProperty(provider, "name") ?? providerId;
+        const previousModel = session.model;
+        this.#ports.interaction().startLogin?.({ providerId, providerName, authType });
+        try {
+            await requireCapability(modelRuntime.login, "login").call(modelRuntime, providerId, authType, {
+                signal: AbortSignal.timeout(120_000),
+                prompt: async (prompt) => {
+                    const promptType = stringProperty(prompt, "type");
+                    const options = isRecord(prompt) && Array.isArray(prompt.options)
+                        ? prompt.options.filter(isRecord).flatMap(option => {
+                            const id = stringProperty(option, "id");
+                            const label = stringProperty(option, "label");
+                            return id && label ? [{ id, label }] : [];
+                        })
+                        : [];
+                    const response = await this.#ports.interaction().prompt({
+                        type: promptType === "select"
+                            ? "select"
+                            : promptType === "manual_code"
+                                ? "manual-code"
+                                : authType === "api_key"
+                                    ? "secret"
+                                    : "text",
+                        message: stringProperty(prompt, "message") ?? `Authenticate ${providerName}`,
+                        ...(stringProperty(prompt, "placeholder") === undefined ? {} : { placeholder: stringProperty(prompt, "placeholder") }),
+                        ...(options.length === 0 ? {} : { options }),
+                    });
+                    if (response === null)
+                        throw new Error("Login cancelled");
+                    return response;
+                },
+                notify: (event) => {
+                    const notification = workflowLoginNotification(event);
+                    if (notification)
+                        this.#ports.interaction().notify(notification);
+                },
+            });
+        }
+        catch (error) {
+            if (error instanceof Error && error.message === "Login cancelled") {
+                return workflowResult(request.command, "cancelled", "Login cancelled", undefined, "silent");
+            }
+            const detail = error instanceof Error ? error.message : String(error);
+            const actionLabel = authType === "api_key" ? `Saved API key for ${providerName}` : `Logged in to ${providerName}`;
+            const message = error instanceof CredentialSynchronizationError
+                ? `${actionLabel}, but local model state could not be synchronized: ${detail}`
+                : authType === "api_key"
+                    ? `Failed to save API key for ${providerName}: ${detail}`
+                    : `Failed to login to ${providerName}: ${detail}`;
+            return workflowResult(request.command, "failed", message);
+        }
+        finally {
+            this.#ports.interaction().finishLogin?.();
+        }
+        return await this.#completeProviderAuthentication(providerId, providerName, authType, previousModel);
+    }
+    /** Run pinned Pi's `/logout` for a `type:provider` selection. */
+    async logout(request, runtime, selection) {
+        const [credentialType = "oauth", providerId = selection] = selection.includes(":") ? selection.split(":", 2) : ["oauth", selection];
+        const modelRuntime = runtime.services.modelRuntime;
+        const provider = modelRuntime.getProvider?.(providerId);
+        const providerName = stringProperty(provider, "name") ?? providerId;
+        try {
+            await requireCapability(modelRuntime.logout, "logout").call(modelRuntime, providerId, { signal: AbortSignal.timeout(15_000) });
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            const message = error instanceof CredentialSynchronizationError
+                ? `Credentials removed for ${providerName}, but local model state could not be synchronized: ${detail}`
+                : `Logout failed: ${detail}`;
+            return workflowResult(request.command, "failed", message);
+        }
+        this.#ports.reconcileActiveModelAvailability();
+        this.#ports.emitView();
+        return workflowResult(request.command, "completed", credentialType === "api_key"
+            ? `Removed stored API key for ${providerName}. Environment variables and models.json config are unchanged.`
+            : `Logged out of ${providerName}`);
+    }
+    async #completeProviderAuthentication(providerId, providerName, authType, previousModel) {
+        const session = this.#ports.requireSession();
+        const modelRuntime = this.#ports.runtime()?.services.modelRuntime;
+        if (!modelRuntime)
+            throw new Error("engine runtime is unavailable");
+        const actionLabel = authType === "oauth" ? `Logged in to ${providerName}` : `Saved API key for ${providerName}`;
+        let selectedModelId;
+        let selectionError;
+        if (isUnknownModel(previousModel)) {
+            const available = modelRuntime.getAvailableSnapshot?.() ?? [];
+            const providerModels = available.filter(model => stringProperty(model, "provider") === providerId);
+            const defaultModelId = PINNED_DEFAULT_MODEL_BY_PROVIDER[providerId];
+            if (defaultModelId === undefined) {
+                selectionError = `${actionLabel}, but no default model is configured for provider "${providerId}". Use /model to select a model.`;
+            }
+            else if (providerModels.length === 0) {
+                selectionError = `${actionLabel}, but no models are available for that provider. Use /model to select a model.`;
+            }
+            else {
+                const selectedModel = providerModels.find(model => stringProperty(model, "id") === defaultModelId);
+                if (selectedModel === undefined) {
+                    selectionError = `${actionLabel}, but its default model "${defaultModelId}" is not available. Use /model to select a model.`;
+                }
+                else {
+                    try {
+                        await session.setModel(selectedModel);
+                        selectedModelId = stringProperty(selectedModel, "id") ?? defaultModelId;
+                        this.#ports.setActiveModel({
+                            providerId,
+                            modelId: selectedModelId,
+                            displayName: stringProperty(selectedModel, "name") ?? selectedModelId,
+                        });
+                    }
+                    catch (error) {
+                        selectionError = `${actionLabel}, but selecting its default model failed: ${error instanceof Error ? error.message : String(error)}. Use /model to select a model.`;
+                    }
+                }
+            }
+        }
+        this.#ports.reconcileActiveModelAvailability();
+        this.#ports.emitView();
+        const status = `${actionLabel}.${selectedModelId ? ` Selected ${selectedModelId}.` : ""} Credentials saved to ${join(this.#agentDir, "auth.json")}`;
+        const messages = [
+            { kind: "status", message: status },
+            ...(selectionError === undefined ? [] : [{ kind: "error", message: selectionError }]),
+        ];
+        this.#scheduleAuthenticatedProviderRefresh(providerId, actionLabel);
+        return workflowResult("login", "completed", status, undefined, "status", messages);
+    }
+    #scheduleAuthenticatedProviderRefresh(providerId, actionLabel) {
+        const runtime = this.#ports.runtime();
+        const refresh = runtime?.services.modelRuntime.refresh;
+        if (!runtime || typeof refresh !== "function")
+            return;
+        const generation = this.#ports.sessionGeneration();
+        const publish = this.#ports.interaction().publish;
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), AUTH_REFRESH_TIMEOUT_MS);
+        // Compatibility: post-authentication refresh starts on the next turn so its notices follow the saved-credential status.
+        void new Promise(resolve => setTimeout(resolve, 0))
+            .then(() => refresh.call(runtime.services.modelRuntime, { providers: [providerId], signal: controller.signal }))
+            .then(result => {
+            if (this.#ports.disposed() || this.#ports.sessionGeneration() !== generation)
+                return;
+            if (isRecord(result) && result.aborted === true) {
+                publish?.({ kind: "warning", message: `${actionLabel}, but its model catalog refresh timed out; using cached models.` });
+            }
+            else if (isRecord(result) && result.errors instanceof Map && result.errors.size > 0) {
+                publish?.({ kind: "warning", message: `${actionLabel}, but its model catalog could not be refreshed; using cached models.` });
+            }
+            this.#ports.reconcileActiveModelAvailability();
+            this.#ports.emitView();
+        })
+            .catch(error => {
+            if (this.#ports.disposed() || this.#ports.sessionGeneration() !== generation)
+                return;
+            publish?.({
+                kind: "warning",
+                message: controller.signal.aborted
+                    ? `${actionLabel}, but its model catalog refresh timed out; using cached models.`
+                    : `${actionLabel}, but its model catalog could not be refreshed: ${error instanceof Error ? error.message : String(error)}`,
+            });
+        })
+            .finally(() => clearTimeout(timeout));
+    }
+}

package/dist/integrations/pi/engine/repository-pr-rest.d.ts

@@ -0,0 +1,21 @@
+interface PiPullRequestIdentity {
+    readonly number: number;
+    readonly url: string;
+}
+export interface PiGitHubRepositoryIdentity {
+    readonly owner: string;
+    readonly repository: string;
+}
+type PiGitHubFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
+type PiCommandReader = (cwd: string, signal: AbortSignal) => Promise<string | null>;
+export interface PiPullRequestRestDependencies {
+    readonly readOriginUrl?: PiCommandReader;
+    readonly fetch?: PiGitHubFetch;
+}
+/** Discover one exact branch pull request through GitHub's read-only REST API. */
+export declare function readPullRequestFromGitHub(cwd: string, branch: string, signal: AbortSignal, environment?: NodeJS.ProcessEnv, dependencies?: PiPullRequestRestDependencies): Promise<PiPullRequestIdentity | null>;
+/** Parse a supported GitHub origin URL without accepting credentials or non-GitHub hosts. */
+export declare function parseGitHubRepositoryRemote(remote: string): PiGitHubRepositoryIdentity | null;
+/** Validate a GitHub REST pull list as one exact branch association. */
+export declare function parseGitHubPullRequests(value: unknown, expectedRepository: PiGitHubRepositoryIdentity, branch: string): PiPullRequestIdentity | null;
+export {};

package/dist/integrations/pi/engine/repository-pr-rest.js

@@ -0,0 +1,155 @@
+import { execFile } from "node:child_process";
+const PROBE_TIMEOUT_MS = 5_000;
+const COMMAND_MAX_BUFFER_BYTES = 64 * 1024;
+const RESPONSE_MAX_BUFFER_BYTES = 1024 * 1024;
+const GITHUB_API_ORIGIN = "https://api.github.com";
+/** Discover one exact branch pull request through GitHub's read-only REST API. */
+export async function readPullRequestFromGitHub(cwd, branch, signal, environment = process.env, dependencies = {}) {
+    if (branch.length === 0 || signal.aborted)
+        return null;
+    const remote = await (dependencies.readOriginUrl ?? executeGitOriginUrl)(cwd, signal);
+    if (remote === null || signal.aborted)
+        return null;
+    const repository = parseGitHubRepositoryRemote(remote);
+    if (repository === null)
+        return null;
+    const endpoint = new URL(`/repos/${encodeURIComponent(repository.owner)}/${encodeURIComponent(repository.repository)}/pulls`, GITHUB_API_ORIGIN);
+    endpoint.searchParams.set("state", "all");
+    endpoint.searchParams.set("head", `${repository.owner}:${branch}`);
+    endpoint.searchParams.set("per_page", "100");
+    const headers = {
+        accept: "application/vnd.github+json",
+        "user-agent": "a1-pr-footer",
+        "x-github-api-version": "2022-11-28",
+    };
+    const token = environment.GH_TOKEN || environment.GITHUB_TOKEN;
+    if (token !== undefined && token.trim().length > 0)
+        headers.authorization = `Bearer ${token}`;
+    try {
+        const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(PROBE_TIMEOUT_MS)]);
+        const response = await (dependencies.fetch ?? fetch)(endpoint, { headers, signal: requestSignal });
+        if (!response.ok || response.redirected)
+            return null;
+        const length = response.headers.get("content-length");
+        if (length !== null && (!/^\d+$/u.test(length) || Number(length) > RESPONSE_MAX_BUFFER_BYTES))
+            return null;
+        const bytes = await response.arrayBuffer();
+        if (bytes.byteLength > RESPONSE_MAX_BUFFER_BYTES || signal.aborted)
+            return null;
+        let value;
+        try {
+            value = JSON.parse(new TextDecoder().decode(bytes));
+        }
+        catch {
+            return null;
+        }
+        return parseGitHubPullRequests(value, repository, branch);
+    }
+    catch {
+        return null;
+    }
+}
+/** Parse a supported GitHub origin URL without accepting credentials or non-GitHub hosts. */
+export function parseGitHubRepositoryRemote(remote) {
+    const value = remote.trim();
+    if (value.length === 0 || /[\r\n]/u.test(value))
+        return null;
+    const scp = /^git@github\.com:([^/]+)\/([^/]+)$/iu.exec(value);
+    if (scp !== null)
+        return normalizeRepository(scp[1], scp[2]);
+    try {
+        const url = new URL(value);
+        if ((url.protocol !== "https:" && url.protocol !== "ssh:")
+            || url.hostname.toLowerCase() !== "github.com"
+            || url.password !== ""
+            || url.port !== ""
+            || url.search !== ""
+            || url.hash !== ""
+            || (url.protocol === "https:" && url.username !== "")
+            || (url.protocol === "ssh:" && url.username !== "git"))
+            return null;
+        const path = /^\/([^/]+)\/([^/]+)$/u.exec(url.pathname);
+        return path === null ? null : normalizeRepository(path[1], path[2]);
+    }
+    catch {
+        return null;
+    }
+}
+/** Validate a GitHub REST pull list as one exact branch association. */
+export function parseGitHubPullRequests(value, expectedRepository, branch) {
+    if (!Array.isArray(value))
+        return null;
+    const fullName = `${expectedRepository.owner}/${expectedRepository.repository}`;
+    const matches = [];
+    for (const candidate of value) {
+        if (!isRecord(candidate)
+            || !Number.isSafeInteger(candidate.number)
+            || candidate.number <= 0
+            || typeof candidate.html_url !== "string"
+            || !isRecord(candidate.head)
+            || candidate.head.ref !== branch
+            || !isRecord(candidate.head.repo)
+            || typeof candidate.head.repo.full_name !== "string"
+            || candidate.head.repo.full_name.toLowerCase() !== fullName.toLowerCase()
+            || !isRecord(candidate.base)
+            || !isRecord(candidate.base.repo)
+            || typeof candidate.base.repo.full_name !== "string"
+            || candidate.base.repo.full_name.toLowerCase() !== fullName.toLowerCase())
+            continue;
+        const eligible = candidate.state === "open"
+            || (candidate.state === "closed" && typeof candidate.merged_at === "string" && Number.isFinite(Date.parse(candidate.merged_at)));
+        if (!eligible)
+            continue;
+        const pullRequest = normalizePullRequest(candidate.number, candidate.html_url, expectedRepository);
+        if (pullRequest !== null)
+            matches.push(pullRequest);
+    }
+    return matches.length === 1 ? matches[0] : null;
+}
+function normalizePullRequest(number, value, expectedRepository) {
+    try {
+        const url = new URL(value);
+        if (url.protocol !== "https:"
+            || url.hostname.toLowerCase() !== "github.com"
+            || url.username !== ""
+            || url.password !== ""
+            || url.port !== ""
+            || url.search !== ""
+            || url.hash !== "")
+            return null;
+        const path = /^\/([^/]+)\/([^/]+)\/pull\/(\d+)\/?$/u.exec(url.pathname);
+        if (path === null
+            || Number(path[3]) !== number
+            || path[1].toLowerCase() !== expectedRepository.owner.toLowerCase()
+            || path[2].toLowerCase() !== expectedRepository.repository.toLowerCase())
+            return null;
+        return { number, url: url.href.replace(/\/$/u, "") };
+    }
+    catch {
+        return null;
+    }
+}
+function normalizeRepository(ownerValue, repositoryValue) {
+    if (ownerValue === undefined || repositoryValue === undefined)
+        return null;
+    const repository = repositoryValue.replace(/\.git$/iu, "");
+    if (!/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})$/u.test(ownerValue)
+        || !/^[A-Za-z0-9_.-]+$/u.test(repository)
+        || repository === "."
+        || repository === "..")
+        return null;
+    return { owner: ownerValue, repository };
+}
+function executeGitOriginUrl(cwd, signal) {
+    return new Promise(resolve => {
+        try {
+            execFile("git", ["config", "--get", "remote.origin.url"], { cwd, windowsHide: true, timeout: PROBE_TIMEOUT_MS, maxBuffer: COMMAND_MAX_BUFFER_BYTES, signal, encoding: "utf8" }, (error, stdout) => { resolve(error === null && typeof stdout === "string" ? stdout : null); });
+        }
+        catch {
+            resolve(null);
+        }
+    });
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/integrations/pi/engine/repository-pr.d.ts

@@ -0,0 +1,16 @@
+export interface PiPullRequestIdentity {
+    readonly number: number;
+    readonly url: string;
+}
+export type PiPullRequestProbe = (cwd: string, branch: string, signal: AbortSignal) => Promise<PiPullRequestIdentity | null>;
+type PiCommandReader = (cwd: string, signal: AbortSignal) => Promise<string | null>;
+type PiPullRequestRestProbe = (cwd: string, branch: string, signal: AbortSignal, environment: NodeJS.ProcessEnv) => Promise<PiPullRequestIdentity | null>;
+export interface PiPullRequestDiscoveryDependencies {
+    readonly executeGh?: PiCommandReader;
+    readonly restProbe?: PiPullRequestRestProbe;
+}
+/** Read an exact branch's open or merged PR, preferring GitHub CLI before the REST fallback. */
+export declare function readPullRequest(cwd: string, branch: string, signal: AbortSignal, environment?: NodeJS.ProcessEnv, dependencies?: PiPullRequestDiscoveryDependencies): Promise<PiPullRequestIdentity | null>;
+/** Parse and validate the normalized payload emitted by `gh pr view`. */
+export declare function parsePullRequest(stdout: string, branch: string): PiPullRequestIdentity | null;
+export {};