@tiny-fish/cli 0.39.1-next.309 → 0.40.0

package/dist/lib/harness-spec.d.ts

@@ -1,5 +1,5 @@
 /** The `skills` CLI's own agent names, not ours. */
-export type SkillAgent = 'claude-code' | 'codex' | 'cursor' | 'hermes-agent' | 'opencode';
+export type SkillAgent = 'claude-code' | 'codex' | 'cursor' | 'hermes-agent' | 'opencode' | 'pi';
 export interface HarnessSupportCheck {
     args: string[];
     /** Missing → nothing can work; setup fails. */
@@ -67,17 +67,17 @@ export interface HarnessSpec {
     /** Printed after a successful connect, on both the launch and non-launch paths. */
     postConnectNote?: string;
     /** Sign-in is the CLI's own interactive `tinyfish auth login`. */
-    signInViaCliLogin: boolean;
+    signInViaCliLogin?: true;
     /** Stored-key auth verification works against this harness's config. */
-    canVerifyAuth: boolean;
+    canVerifyAuth?: true;
     /** The CLI holds or writes the key; no harness `mcp add` carries it. */
-    keyHeldByCli: boolean;
+    keyHeldByCli?: true;
     /** Connect writes the MCP config file; no harness binary is spawned. */
-    cliWritesConfig: boolean;
-    /** Binary resolves the config path; absent binary, nothing reads it. */
-    configPathFromBinary?: true;
+    cliWritesConfig?: true;
+    /** A second reader (Cursor's IDE) loads the config with no harness binary on PATH. */
+    readableWithoutBinary?: true;
     /** `mcp add` succeeds unauthenticated; OAuth lands at first tool use. */
-    authDeferredAtInstall: boolean;
+    authDeferredAtInstall?: true;
 }
 /** One entry per harness; every per-harness list derives from it. */
 export declare const HARNESS_SPECS: {
@@ -110,11 +110,6 @@ export declare const HARNESS_SPECS: {
             args: string[];
             label: string;
         }[];
-        signInViaCliLogin: false;
-        canVerifyAuth: false;
-        keyHeldByCli: false;
-        cliWritesConfig: false;
-        authDeferredAtInstall: false;
     };
     codex: {
         command: string;
@@ -136,10 +131,6 @@ export declare const HARNESS_SPECS: {
             deferred: string;
         };
         loginArgs: string[];
-        signInViaCliLogin: false;
-        canVerifyAuth: false;
-        keyHeldByCli: false;
-        cliWritesConfig: false;
         authDeferredAtInstall: true;
     };
     cursor: {
@@ -148,11 +139,10 @@ export declare const HARNESS_SPECS: {
         configDir: string;
         reloadAction: string;
         skillAgent: "cursor";
-        signInViaCliLogin: false;
+        readableWithoutBinary: true;
         canVerifyAuth: true;
         keyHeldByCli: true;
         cliWritesConfig: true;
-        authDeferredAtInstall: false;
     };
     grok: {
         command: string;
@@ -175,11 +165,6 @@ export declare const HARNESS_SPECS: {
             viaEnv: true;
         };
         signInHint: string;
-        signInViaCliLogin: false;
-        canVerifyAuth: false;
-        keyHeldByCli: false;
-        cliWritesConfig: false;
-        authDeferredAtInstall: false;
     };
     hermes: {
         command: string;
@@ -201,23 +186,16 @@ export declare const HARNESS_SPECS: {
             label: string;
         };
         postConnectNote: string;
-        signInViaCliLogin: false;
-        canVerifyAuth: false;
         keyHeldByCli: true;
-        cliWritesConfig: false;
-        authDeferredAtInstall: false;
     };
     omp: {
         command: string;
         displayName: string;
         configDir: string;
         reloadAction: string;
-        configPathFromBinary: true;
-        signInViaCliLogin: false;
         canVerifyAuth: true;
         keyHeldByCli: true;
         cliWritesConfig: true;
-        authDeferredAtInstall: false;
     };
     openclaw: {
         command: string;
@@ -235,8 +213,6 @@ export declare const HARNESS_SPECS: {
         signInViaCliLogin: true;
         canVerifyAuth: true;
         keyHeldByCli: true;
-        cliWritesConfig: false;
-        authDeferredAtInstall: false;
     };
     opencode: {
         command: string;
@@ -259,11 +235,16 @@ export declare const HARNESS_SPECS: {
         loginArgs: string[];
         removals: never[];
         postConnectNote: string;
-        signInViaCliLogin: false;
-        canVerifyAuth: false;
-        keyHeldByCli: false;
-        cliWritesConfig: false;
-        authDeferredAtInstall: false;
+    };
+    pi: {
+        command: string;
+        displayName: string;
+        configDir: string;
+        reloadAction: string;
+        skillAgent: "pi";
+        canVerifyAuth: true;
+        keyHeldByCli: true;
+        cliWritesConfig: true;
     };
 };
 /** Derived from spec keys; one entry extends every union. */
@@ -275,4 +256,4 @@ export type NonNativeHarness = {
     [K in Harness]: 'urlStyle' extends keyof (typeof HARNESS_SPECS)[K] ? never : K;
 }[Harness];
 /** Native MCP harnesses carry add-generation fields; the rest override connect. */
-export declare const NATIVE_HARNESSES: ("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "claude-code")[];
+export declare const NATIVE_HARNESSES: ("openclaw" | "omp" | "grok" | "cursor" | "codex" | "hermes" | "opencode" | "pi" | "claude-code")[];

package/dist/lib/harness-spec.js

@@ -82,11 +82,6 @@ export const HARNESS_SPECS = {
                 label: 'local TinyFish registration',
             },
         ],
-        signInViaCliLogin: false,
-        canVerifyAuth: false,
-        keyHeldByCli: false,
-        cliWritesConfig: false,
-        authDeferredAtInstall: false,
     },
     codex: {
         command: 'codex',
@@ -110,10 +105,6 @@ export const HARNESS_SPECS = {
         // `--oauth-resource` duplicates the resource Codex discovers; Clerk rejects both.
         // `mcp add` still runs OAuth inline, so `loginArgs` stays a retry.
         loginArgs: ['mcp', 'login', 'tinyfish'],
-        signInViaCliLogin: false,
-        canVerifyAuth: false,
-        keyHeldByCli: false,
-        cliWritesConfig: false,
         // TODO(PF-3580): connect now probes Codex sign-in, so this over-warns a signed-in install.
         authDeferredAtInstall: true,
     },
@@ -123,11 +114,10 @@ export const HARNESS_SPECS = {
         configDir: '.cursor',
         reloadAction: 'reload the window',
         skillAgent: 'cursor',
-        signInViaCliLogin: false,
+        readableWithoutBinary: true,
         canVerifyAuth: true,
         keyHeldByCli: true,
         cliWritesConfig: true,
-        authDeferredAtInstall: false,
     },
     grok: {
         command: 'grok',
@@ -148,11 +138,6 @@ export const HARNESS_SPECS = {
         // Grok expands `${VAR}` in headers at load, so the key stays out of argv and config.toml.
         header: { name: 'Authorization', sep: ': ', valuePrefix: 'Bearer ', viaEnv: true },
         signInHint: GROK_SIGN_IN_HINT,
-        signInViaCliLogin: false,
-        canVerifyAuth: false,
-        keyHeldByCli: false,
-        cliWritesConfig: false,
-        authDeferredAtInstall: false,
     },
     hermes: {
         command: 'hermes',
@@ -175,24 +160,17 @@ export const HARNESS_SPECS = {
             label: 'TinyFish web plugin from Hermes',
         },
         postConnectNote: HERMES_RESTART_NOTE,
-        signInViaCliLogin: false,
-        // Stays false: keyed already covers auth; true breaks keyless installs.
-        canVerifyAuth: false,
+        // No canVerifyAuth: keyed already covers auth; true breaks keyless installs.
         keyHeldByCli: true,
-        cliWritesConfig: false,
-        authDeferredAtInstall: false,
     },
     omp: {
         command: 'omp',
         displayName: 'omp',
         configDir: '.omp',
         reloadAction: 'restart it',
-        configPathFromBinary: true,
-        signInViaCliLogin: false,
         canVerifyAuth: true,
         keyHeldByCli: true,
         cliWritesConfig: true,
-        authDeferredAtInstall: false,
     },
     openclaw: {
         command: 'openclaw',
@@ -212,8 +190,6 @@ export const HARNESS_SPECS = {
         signInViaCliLogin: true,
         canVerifyAuth: true,
         keyHeldByCli: true,
-        cliWritesConfig: false,
-        authDeferredAtInstall: false,
     },
     opencode: {
         command: 'opencode',
@@ -236,11 +212,16 @@ export const HARNESS_SPECS = {
         // `opencode mcp add` upserts by name and ships no `mcp remove`.
         removals: [],
         postConnectNote: OPENCODE_MODEL_NOTE,
-        signInViaCliLogin: false,
-        canVerifyAuth: false,
-        keyHeldByCli: false,
-        cliWritesConfig: false,
-        authDeferredAtInstall: false,
+    },
+    pi: {
+        command: 'pi',
+        displayName: 'Pi',
+        configDir: '.pi/agent',
+        reloadAction: 'restart it',
+        skillAgent: 'pi',
+        canVerifyAuth: true,
+        keyHeldByCli: true,
+        cliWritesConfig: true,
     },
 };
 export const ALL_HARNESSES = Object.keys(HARNESS_SPECS);

package/dist/lib/harness.js

@@ -28,6 +28,8 @@ const HARNESS_FINGERPRINTS = [
     { name: 'hermes', matches: (env) => hasVarWithPrefix(env, 'HERMES_') },
     // Exact key, not a prefix: opencode writes OPENCODE=1 at startup, reads every OPENCODE_* as config.
     { name: 'opencode', matches: (env) => Boolean(env['OPENCODE']) },
+    // Observed: pi launched from Claude Code inherits CLAUDECODE=1.
+    { name: 'pi', matches: (env) => env['PI_CODING_AGENT'] === 'true' },
     {
         name: 'claude-code',
         matches: (env) => env['CLAUDECODE'] === '1' || Boolean(env['CLAUDE_CODE_ENTRYPOINT']),

package/dist/lib/hermes-config.d.ts

@@ -1,5 +1,8 @@
 /** Every message about the entry names this path. */
 export declare function hermesConfigPath(home: string): string;
+export declare const HERMES_HEADER_TEMPLATE = "Bearer ${MCP_TINYFISH_API_KEY}";
+/** Both the writer and the gate key on this, so they cannot disagree. */
+export declare const HERMES_MCP_SERVER_KEY = "tinyfish";
 /** Callers branch on these; each is a different repair. */
 export type HermesEntry = {
     state: 'unreadable';

package/dist/lib/hermes-config.js

@@ -8,7 +8,9 @@ export function hermesConfigPath(home) {
     return path.join(home, 'config.yaml');
 }
 // Hermes persists the key as an interpolation template (mcp_config.py:174-182).
-const HEADER_TEMPLATE = `Bearer \${${HERMES_KEY_VAR}}`;
+export const HERMES_HEADER_TEMPLATE = `Bearer \${${HERMES_KEY_VAR}}`;
+/** Both the writer and the gate key on this, so they cannot disagree. */
+export const HERMES_MCP_SERVER_KEY = 'tinyfish';
 // Foreign file: model only what we read, tolerate the rest.
 const entrySchema = z.looseObject({
     // Anything goes: the runtime defaults unrecognised values to enabled.
@@ -16,7 +18,9 @@ const entrySchema = z.looseObject({
     headers: z.record(z.string(), z.unknown()).optional(),
 });
 const configSchema = z
-    .looseObject({ mcp_servers: z.looseObject({ tinyfish: entrySchema.nullish() }).nullish() })
+    .looseObject({
+    mcp_servers: z.looseObject({ [HERMES_MCP_SERVER_KEY]: entrySchema.nullish() }).nullish(),
+})
     .nullish();
 const TRUTHY_STRINGS = new Set(['true', '1', 'yes', 'on']);
 const FALSY_STRINGS = new Set(['false', '0', 'no', 'off']);
@@ -42,7 +46,7 @@ function isEnabled(value) {
 /** Only the header template proves this entry uses the seeded key. */
 function hasKeyHeader(headers) {
     const authorization = Object.entries(headers ?? {}).find(([name]) => name.toLowerCase() === 'authorization');
-    return authorization?.[1] === HEADER_TEMPLATE;
+    return authorization?.[1] === HERMES_HEADER_TEMPLATE;
 }
 /** Connect's gate and doctor's probe share this, so they cannot disagree. */
 export function readHermesEntry(home) {
@@ -60,7 +64,7 @@ export function readHermesEntry(home) {
     catch {
         return { state: 'unparseable' };
     }
-    const entry = config?.mcp_servers?.tinyfish;
+    const entry = config?.mcp_servers?.[HERMES_MCP_SERVER_KEY];
     if (!entry)
         return { state: 'absent' };
     const usesKeyHeader = hasKeyHeader(entry.headers);

package/dist/lib/hermes-env.d.ts

@@ -1,6 +1,11 @@
-export declare const HERMES_PROBE_TIMEOUT_MS = 15000;
+/** Each reason is a different repair, so telemetry keeps them apart. */
+export type HermesHomeReason = 'timeout' | 'exit' | 'no_line' | 'relative';
+/** Failure carries why, so connect tags it without a second probe. */
+export interface HermesHomeFailure {
+    reason: HermesHomeReason;
+}
 /** Asking Hermes beats reimplementing its profile override, which we'd drift from. */
-export declare function resolveHermesHome(): string | undefined;
+export declare function resolveHermesHome(): string | HermesHomeFailure;
 export declare const HERMES_KEY_VAR = "MCP_TINYFISH_API_KEY";
 /** Named in every message about the seeded key, so no caller rebuilds the path. */
 export declare function hermesEnvPath(home: string): string;

package/dist/lib/hermes-env.js

@@ -7,22 +7,23 @@ import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
 import { sanitizeLine } from './output.js';
 // display_hermes_home() abbreviates under $HOME, so the value is not always absolute.
 const HERMES_HOME_LINE = /^\s*hermes_home:\s*(\S.*?)\s*$/m;
-// One value: the next cold-start bump must move both probes together.
-export const HERMES_PROBE_TIMEOUT_MS = HARNESS_PROBE_TIMEOUT_MS;
 /** Asking Hermes beats reimplementing its profile override, which we'd drift from. */
 export function resolveHermesHome() {
     const result = spawn.sync('hermes', ['dump'], {
         encoding: 'utf8',
         env: { ...process.env, FORCE_COLOR: '0', NO_COLOR: '1' },
-        timeout: HERMES_PROBE_TIMEOUT_MS,
+        timeout: HARNESS_PROBE_TIMEOUT_MS,
     });
+    if (result.error?.code === 'ETIMEDOUT') {
+        return { reason: 'timeout' };
+    }
     if (result.error || result.status !== 0)
-        return undefined;
+        return { reason: 'exit' };
     const raw = HERMES_HOME_LINE.exec(sanitizeLine(`${result.stdout ?? ''}\n${result.stderr ?? ''}`))?.[1];
     if (!raw)
-        return undefined;
+        return { reason: 'no_line' };
     const expanded = raw === '~' || raw.startsWith('~/') ? path.join(os.homedir(), raw.slice(2)) : raw;
-    return path.isAbsolute(expanded) ? expanded : undefined;
+    return path.isAbsolute(expanded) ? expanded : { reason: 'relative' };
 }
 export const HERMES_KEY_VAR = 'MCP_TINYFISH_API_KEY';
 /** Named in every message about the seeded key, so no caller rebuilds the path. */

package/dist/lib/hermes-plugin.d.ts

@@ -4,6 +4,10 @@ export declare const HERMES_PLUGIN_SHA = "496cd63fefd982bbaa8a85ce78ef2270d70098
 export declare const HERMES_PLUGIN_VERSION = "0.1.0";
 export declare const HERMES_PLUGIN_MANUAL_INSTALL = "hermes plugins install tinyfish-io/tinyfish-web-agent-integrations/hermes --ref 496cd63fefd982bbaa8a85ce78ef2270d700984f --enable";
 export declare function installHermesPlugin(home: string, apiKey: string, { verbose }: Pick<InstallOptions, 'verbose'>): void;
+/** Absent `enabled` reads as enabled, so never write this field-by-field. */
+export declare function writeHermesMcpEntry(home: string, mcpUrl: string): void;
+/** Retracts our row; an absent `enabled` reads as enabled, so a partial one is live. */
+export declare function removeHermesMcpEntry(home: string): void;
 /** After install only: backends must never name an absent provider. */
 export declare function setHermesWebBackends(home: string): void;
 /** Ours-only unsets: a user-chosen backend value survives the uninstall. */

package/dist/lib/hermes-plugin.js

@@ -7,7 +7,8 @@ import { z } from 'zod';
 import { capturedOutput, replay, SKILL_INSTALL_TIMEOUT_MS, STEP_MAX_BUFFER, } from './cli-install.js';
 import { commandNotFound, ConnectStepError, spawnStepError, throwIfInterrupted, } from './connect-runtime.js';
 import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
-import { errLine } from './output.js';
+import { HERMES_HEADER_TEMPLATE, HERMES_MCP_SERVER_KEY } from './hermes-config.js';
+import { errLine, parseJson } from './output.js';
 // Bump per CLI release.
 export const HERMES_PLUGIN_SHA = '496cd63fefd982bbaa8a85ce78ef2270d700984f';
 // Bump with the SHA; the source is `hermes/plugin.yaml` at that commit.
@@ -95,6 +96,21 @@ function configWrite(home, args) {
     replay(capturedOutput(result));
     throw error;
 }
+/** Absent `enabled` reads as enabled, so never write this field-by-field. */
+export function writeHermesMcpEntry(home, mcpUrl) {
+    const entry = {
+        url: mcpUrl,
+        headers: { Authorization: HERMES_HEADER_TEMPLATE },
+        enabled: true,
+    };
+    const result = hermesConfig(['set', `mcp_servers.${HERMES_MCP_SERVER_KEY}`, JSON.stringify(entry)], home);
+    // `config set` exits 0 on a bad key, so only an interrupt is worth raising here.
+    throwIfInterrupted(result);
+}
+/** Retracts our row; an absent `enabled` reads as enabled, so a partial one is live. */
+export function removeHermesMcpEntry(home) {
+    configWrite(home, ['unset', `mcp_servers.${HERMES_MCP_SERVER_KEY}`]);
+}
 const HERMES_BACKEND_KEYS = ['web.search_backend', 'web.extract_backend'];
 // Dispatch falls back to web.backend, and the plugin's own setup can set it.
 const HERMES_OWNED_BACKEND_KEYS = [...HERMES_BACKEND_KEYS, 'web.backend'];
@@ -127,14 +143,6 @@ const hermesPluginStatusSchema = z.looseObject({
     provider_available: z.boolean().nullish(),
     web_backend_configured: z.boolean(),
 });
-function parseJson(text) {
-    try {
-        return JSON.parse(text);
-    }
-    catch {
-        return undefined;
-    }
-}
 /** `status --json` always exits 0; a non-zero exit means the subcommand is absent. */
 export function readHermesPluginStatus(home) {
     const result = spawn.sync('hermes', ['tinyfish', 'status', '--json'], {

package/dist/lib/output.d.ts

@@ -16,3 +16,5 @@ export declare function errLine(line: string): void;
 export declare function warnLine(line: string): void;
 export declare function err(data: unknown): void;
 export declare function handleApiError(e: unknown): never;
+/** Undefined, not a throw: callers hand the value to a Zod safeParse. */
+export declare function parseJson(text: string): unknown;

package/dist/lib/output.js

@@ -70,3 +70,12 @@ export function handleApiError(e) {
     }
     process.exit(1);
 }
+/** Undefined, not a throw: callers hand the value to a Zod safeParse. */
+export function parseJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}

package/dist/lib/pi-config.d.ts

@@ -0,0 +1,26 @@
+import { type McpJsonServerEntry, type McpJsonWriteResult } from './mcp-json-config.js';
+/** Mirrors pi's own getAgentDir: the override wins, else `~/.pi/agent`. */
+export declare function piAgentDir(): string;
+export declare function piMcpPath(): string;
+/** Reports the header's shape, never its value. */
+export declare function readPiTinyfishEntry(): McpJsonServerEntry;
+/** Merges only the `tinyfish` key. */
+export declare function writePiMcpConfig(mcpUrl: string, apiKey?: string): McpJsonWriteResult;
+/** Dry-run description of the pending write; touches nothing. */
+export declare function planPiWrite(mcpUrl: string, apiKey?: string): string;
+/** Removes only the `tinyfish` key. */
+export declare function removePiMcpServer(): McpJsonWriteResult;
+export declare const PI_ADAPTER_INSTALL_COMMAND = "pi install npm:pi-mcp-adapter";
+/** `unknown` keeps a settings file we could not read apart from one that lists no adapter. */
+export type PiAdapterState = 'installed' | 'absent' | 'unknown';
+/** Core pi has no MCP, so without this package the entry we write is never read. */
+export declare function piMcpAdapterState(cwd?: string): PiAdapterState;
+/** Tests share one process; the probe result must not. */
+export declare function resetPiBinaryCache(): void;
+/** npm ships an unrelated `pi` that prints `3`; only a semver answer is the harness. */
+export declare function piBinaryIsPi(): boolean;
+/** `skills` hardcodes the default dir, so an override leaves the skill where pi will not look. */
+export declare function piSkillDirMismatch(): {
+    installedTo: string;
+    readFrom: string;
+} | undefined;

package/dist/lib/pi-config.js

@@ -0,0 +1,111 @@
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import spawn from 'cross-spawn';
+import { z } from 'zod';
+import { HARNESS_PROBE_TIMEOUT_MS } from './constants.js';
+import { planWrite, readTinyfishEntry, removeServer, writeMcpConfig, } from './mcp-json-config.js';
+// pi expands `~` and `~/`; writing one literally would mkdir '~'.
+function expandTilde(dir) {
+    if (dir === '~')
+        return os.homedir();
+    // nosemgrep: path-join-resolve-traversal -- $PI_CODING_AGENT_DIR names the caller's own dir, resolved as pi does
+    return dir.startsWith('~/') ? path.join(os.homedir(), dir.slice(2)) : dir;
+}
+/** Mirrors pi's own getAgentDir: the override wins, else `~/.pi/agent`. */
+export function piAgentDir() {
+    const override = process.env['PI_CODING_AGENT_DIR'];
+    return override ? path.resolve(expandTilde(override)) : path.join(os.homedir(), '.pi', 'agent');
+}
+// Resolved per call, not cached: nothing here spawns, so drift is impossible.
+const PI_MCP_TARGET = {
+    serverKey: 'tinyfish',
+    dir: piAgentDir,
+    file: () => path.join(piAgentDir(), 'mcp.json'),
+};
+export function piMcpPath() {
+    return PI_MCP_TARGET.file();
+}
+/** Reports the header's shape, never its value. */
+export function readPiTinyfishEntry() {
+    return readTinyfishEntry(PI_MCP_TARGET);
+}
+/** Merges only the `tinyfish` key. */
+export function writePiMcpConfig(mcpUrl, apiKey) {
+    return writeMcpConfig(PI_MCP_TARGET, mcpUrl, apiKey);
+}
+/** Dry-run description of the pending write; touches nothing. */
+export function planPiWrite(mcpUrl, apiKey) {
+    return planWrite(PI_MCP_TARGET, mcpUrl, apiKey);
+}
+/** Removes only the `tinyfish` key. */
+export function removePiMcpServer() {
+    return removeServer(PI_MCP_TARGET);
+}
+export const PI_ADAPTER_INSTALL_COMMAND = 'pi install npm:pi-mcp-adapter';
+// Matches `npm:pi-mcp-adapter`, a pinned version, and git or path installs ending in the name.
+const ADAPTER_SOURCE = /(?:^|[/:])pi-mcp-adapter(?:@|$)/;
+// pi's PackageSource is a bare source or an object carrying it; `pi install` writes both.
+const packageSourceSchema = z.union([z.string(), z.object({ source: z.string() })]);
+const settingsSchema = z.object({ packages: z.array(packageSourceSchema).optional() });
+function adapterInSettings(file) {
+    let raw;
+    try {
+        raw = fs.readFileSync(file, 'utf8');
+    }
+    catch (e) {
+        // No settings file means nothing is installed; any other read failure tells us nothing.
+        return e?.code === 'ENOENT' ? 'absent' : 'unknown';
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return 'unknown';
+    }
+    const settings = settingsSchema.safeParse(parsed);
+    if (!settings.success)
+        return 'unknown';
+    const sources = (settings.data.packages ?? []).map((p) => (typeof p === 'string' ? p : p.source));
+    return sources.some((source) => ADAPTER_SOURCE.test(source)) ? 'installed' : 'absent';
+}
+/** Core pi has no MCP, so without this package the entry we write is never read. */
+export function piMcpAdapterState(cwd = process.cwd()) {
+    // `pi install -l` records the adapter project-locally, where pi reads it just the same.
+    const scopes = [
+        path.join(piAgentDir(), 'settings.json'),
+        path.join(cwd, '.pi', 'settings.json'), // nosemgrep: path-join-resolve-traversal -- fixed names under the caller's cwd
+    ].map(adapterInSettings);
+    if (scopes.includes('installed'))
+        return 'installed';
+    return scopes.includes('unknown') ? 'unknown' : 'absent';
+}
+// Cached: detection runs more than once per command and the answer cannot change mid-run.
+let cachedBinaryIsPi;
+/** Tests share one process; the probe result must not. */
+export function resetPiBinaryCache() {
+    cachedBinaryIsPi = undefined;
+}
+/** npm ships an unrelated `pi` that prints `3`; only a semver answer is the harness. */
+export function piBinaryIsPi() {
+    cachedBinaryIsPi ??= { value: probeVersion() };
+    return cachedBinaryIsPi.value;
+}
+function probeVersion() {
+    const result = spawn.sync('pi', ['--version'], {
+        encoding: 'utf8',
+        timeout: HARNESS_PROBE_TIMEOUT_MS,
+    });
+    if (result.error || result.status !== 0)
+        return false;
+    return /^\d+\.\d+\.\d+/.test((result.stdout ?? '').trim());
+}
+/** `skills` hardcodes the default dir, so an override leaves the skill where pi will not look. */
+export function piSkillDirMismatch() {
+    const agentDir = piAgentDir();
+    const fallback = path.join(os.homedir(), '.pi', 'agent');
+    if (agentDir === fallback)
+        return undefined;
+    return { installedTo: path.join(fallback, 'skills'), readFrom: path.join(agentDir, 'skills') };
+}

package/dist/lib/registration-detect.d.ts

@@ -20,7 +20,6 @@ export interface RegistrationStatus {
     recordedAuthMode?: RecordedAuthMode;
     reason?: string;
 }
-export declare function codexOauthCompleted(): boolean | undefined;
 /** Per-harness sign-in probes; connect composes these rather than the descriptor carrying them. */
 export declare const SIGN_IN_PROBES: Partial<Record<AgentClient, () => boolean | undefined>>;
 /** Never throws; a failed probe is `unknown` with a reason, so no caller can read it as healthy. */