@trim21/personal-pi-extensions 0.0.123 → 0.0.125

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.123",
+  "version": "0.0.125",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -19,14 +19,14 @@
   },
   "scripts": {
     "check": "tsc --noEmit && prettier --check .",
+    "lint": "eslint .",
     "format": "prettier --write .",
-    "build:cli": "esbuild bin/cli.ts --bundle --platform=node --format=esm --outfile=dist/cli.js --external:@earendil-works/pi-coding-agent --external:typebox --external:node:*",
     "test": "vitest run",
     "prepare": "husky"
   },
   "peerDependencies": {
-    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-agent-core": "*",
+    "@earendil-works/pi-ai": "*",
     "@earendil-works/pi-coding-agent": "*",
     "@earendil-works/pi-tui": "*",
     "typebox": "*"
@@ -36,11 +36,13 @@
     "@earendil-works/pi-coding-agent": "^0.80.0",
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.1",
+    "eslint": "^10.8.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.0.8",
     "prettier": "^3.6.0",
     "typebox": "1.3.1",
-    "typescript": "^7.0.0",
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.65.0",
     "vitest": "^4.1.10"
   },
   "pi": {
@@ -55,7 +57,11 @@
     ]
   },
   "lint-staged": {
-    "*.{ts,tsx,js,jsx,json,md,yaml,yml}": [
+    "*.{ts,tsx,js,jsx}": [
+      "eslint --fix",
+      "prettier --write"
+    ],
+    "*.{json,md,yaml,yml}": [
       "prettier --write"
     ]
   },

package/src/bwrap/index.ts

@@ -62,7 +62,12 @@ import { fileURLToPath } from "node:url";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
-import { type BashOperations, createBashTool, getAgentDir } from "@earendil-works/pi-coding-agent";
+import {
+  type BashOperations,
+  createBashTool,
+  getAgentDir,
+  Theme,
+} from "@earendil-works/pi-coding-agent";
 
 const SANDBOX_PROMPT = `
 ## Command Execution
@@ -166,10 +171,10 @@ function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
   const base = {
     mode: config.mode,
     bwrapPath: config.bwrapPath,
-    writablePaths: config.writablePaths ?? ([".", "/tmp"] as string[]),
+    writablePaths: config.writablePaths ?? [".", "/tmp"],
     extraWritablePaths: config.extraWritablePaths,
-    tmpfsPaths: config.tmpfsPaths ?? ([] as string[]),
-    extraArgs: config.extraArgs ?? ([] as string[]),
+    tmpfsPaths: config.tmpfsPaths ?? [],
+    extraArgs: config.extraArgs ?? [],
   };
   switch (config.mode) {
     case "allow-all":
@@ -229,7 +234,7 @@ function loadConfig(cwd: string): BwrapConfig {
       try {
         Object.assign(target, JSON.parse(readFileSync(path, "utf-8")));
       } catch (e) {
-        console.error(`Warning: Could not parse ${path}: ${e}`);
+        console.error(`Warning: Could not parse ${path}: ${String(e)}`);
       }
     }
   }
@@ -507,13 +512,6 @@ const sandboxedBashSchema = Type.Object({
   ),
 });
 
-interface SandboxedBashInput {
-  command: string;
-  timeout?: number;
-  request_full_access?: boolean;
-  request_full_access_reason?: string;
-}
-
 export default function (pi: ExtensionAPI) {
   pi.registerFlag("no-bwrap", {
     description: "Disable bwrap sandboxing for bash commands",
@@ -525,7 +523,6 @@ export default function (pi: ExtensionAPI) {
   const localBash = createBashTool(localCwd);
 
   let resolved: ResolvedBwrap | null = null;
-  let manuallyDisabled = false;
 
   function getResolved(): ResolvedBwrap {
     if (!resolved) {
@@ -534,10 +531,6 @@ export default function (pi: ExtensionAPI) {
     return resolved;
   }
 
-  function isEnabled() {
-    return !manuallyDisabled && getResolved().bwrapEnabled;
-  }
-
   function setMode(mode: BwrapMode) {
     const config = loadConfig(localCwd);
     config.mode = mode;
@@ -607,24 +600,21 @@ export default function (pi: ExtensionAPI) {
     },
   });
 
-  pi.on("session_start", async (_event, ctx) => {
-    const noBwrap = pi.getFlag("no-bwrap") as boolean;
+  pi.on("session_start", (_event, ctx) => {
+    const noBwrap = pi.getFlag("no-bwrap") === true;
 
     if (noBwrap) {
-      manuallyDisabled = true;
       resolved = null;
       ctx.ui.notify("bwrap sandbox disabled via --no-bwrap", "warning");
       return;
     }
 
     if (!process.env.HOME) {
-      manuallyDisabled = true;
       ctx.ui.notify("bwrap requires HOME environment variable", "error");
       return;
     }
 
     if (process.platform !== "linux") {
-      manuallyDisabled = true;
       ctx.ui.notify("bwrap sandbox requires Linux", "warning");
       return;
     }
@@ -637,7 +627,6 @@ export default function (pi: ExtensionAPI) {
         findBwrap(resolved.bwrapPath);
       } catch (err) {
         resolved = null;
-        manuallyDisabled = true;
         ctx.ui.notify(err instanceof Error ? err.message : "bwrap not found", "error");
         return;
       }
@@ -657,7 +646,6 @@ export default function (pi: ExtensionAPI) {
 
   pi.on("session_shutdown", () => {
     resolved = null;
-    manuallyDisabled = false;
   });
 
   pi.on("before_agent_start", (event) => {
@@ -671,11 +659,11 @@ export default function (pi: ExtensionAPI) {
 
   pi.registerCommand("bwrap", {
     description: "Show bwrap sandbox configuration",
-    handler: async (_args, ctx) => {
+    handler: (_args, ctx) => {
       const r = getResolved();
       if (!r.bwrapEnabled) {
         ctx.ui.notify(`bwrap disabled (mode: ${r.mode})`, "info");
-        return;
+        return Promise.resolve();
       }
 
       const net = r.network ? "net" : "no-net";
@@ -686,6 +674,7 @@ export default function (pi: ExtensionAPI) {
         `bwrap ${r.mode} ${net} write:[${w.join(", ")}] tmpfs:[${t.join(", ") || "-"}]`,
         "info",
       );
+      return Promise.resolve();
     },
   });
 
@@ -694,7 +683,7 @@ export default function (pi: ExtensionAPI) {
     ctx: {
       ui: {
         notify: (m: string, t?: "info" | "warning" | "error") => void;
-        theme: any;
+        theme: Theme;
         setStatus: (k: string, t: string | undefined) => void;
       };
     },
@@ -718,16 +707,16 @@ export default function (pi: ExtensionAPI) {
 
   pi.registerCommand("bwrap-allow-all", {
     description: "Disable bwrap sandbox, full access",
-    handler: async (_args, ctx) => switchMode("allow-all", ctx),
+    handler: (_args, ctx) => Promise.resolve(switchMode("allow-all", ctx)),
   });
 
   pi.registerCommand("bwrap-workspace-write", {
     description: "Sandbox on, network off, workspace writable",
-    handler: async (_args, ctx) => switchMode("workspace-write", ctx),
+    handler: (_args, ctx) => Promise.resolve(switchMode("workspace-write", ctx)),
   });
 
   pi.registerCommand("bwrap-readonly", {
     description: "Sandbox on, network off, no writes",
-    handler: async (_args, ctx) => switchMode("readonly", ctx),
+    handler: (_args, ctx) => Promise.resolve(switchMode("readonly", ctx)),
   });
 }

package/src/gh-readonly.ts

@@ -33,6 +33,7 @@
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
+import { Value } from "typebox/value";
 import { spawn } from "node:child_process";
 import { homedir } from "node:os";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
@@ -48,8 +49,7 @@ interface GhResult {
 
 // ── helpers ──────────────────────────────────────────────────────────────────
 
-function execGh(
-  pi: ExtensionAPI,
+function runGh(
   args: string[],
   ctx: { cwd?: string; signal?: AbortSignal; timeout?: number },
 ): Promise<GhResult> {
@@ -109,7 +109,7 @@ function execGh(
       resolve({ stdout, stderr, code: code ?? 0, killed, combined: combined.join("") });
     });
 
-    proc.on("error", (_err) => {
+    proc.on("error", () => {
       if (timeoutId) clearTimeout(timeoutId);
       if (ctx.signal) {
         ctx.signal.removeEventListener("abort", killProcess);
@@ -119,35 +119,67 @@ function execGh(
   });
 }
 
-/** Result of a gh invocation. On failure, `args` carries the full raw command input for debugging. */
-export interface GhExecResult {
-  ok: boolean;
-  stdout: string;
-  error: string | null;
-  args: string[];
+/**
+ * Error thrown by `ghExec` when the `gh` invocation exits non-zero.
+ * The message carries the toolcall input (JSON) wrapped in `<input>` markers,
+ * and the command output wrapped in `<output>` markers.
+ */
+export class GhError extends Error {
+  readonly args: string[];
+  readonly code: number;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly input?: unknown;
+
+  constructor(args: string[], result: GhResult, input?: unknown) {
+    const inputText = input === undefined ? "" : `<input>${JSON.stringify(input)}<input>\n`;
+    super(`${inputText}<output>${result.combined.trim() || `exit code ${result.code}`}<output>`);
+    this.name = "GhError";
+    this.args = args;
+    this.code = result.code;
+    this.stdout = result.stdout;
+    this.stderr = result.stderr;
+    this.input = input;
+  }
 }
 
+/** Run `gh` and return stdout. On non-zero exit, throws a `GhError` carrying the toolcall input and raw command. */
 async function ghExec(
-  pi: ExtensionAPI,
   args: string[],
-  ctx: { cwd?: string; signal?: AbortSignal },
-): Promise<GhExecResult> {
-  const result = await execGh(pi, args, ctx);
+  ctx: { cwd?: string; signal?: AbortSignal; input?: unknown },
+): Promise<string> {
+  const result = await runGh(args, ctx);
   if (result.code !== 0) {
-    return {
-      ok: false,
-      stdout: "",
-      error: result.combined.trim() || `exit code ${result.code}`,
-      args,
-    };
+    throw new GhError(args, result, ctx.input);
   }
-  return { ok: true, stdout: result.stdout, error: null, args };
+  return result.stdout;
 }
 
 function repoArgs(repo?: string): string[] {
   return repo ? ["--repo", repo] : [];
 }
 
+// ── runtime validation schemas for JSON.parse results ───────────────────────
+
+const repoViewSchema = Type.Object({ nameWithOwner: Type.String() });
+
+const stepSchema = Type.Object({
+  name: Type.String(),
+  number: Type.Number(),
+  status: Type.String(),
+  conclusion: Type.Union([Type.String(), Type.Null()]),
+});
+
+const jobRunSchema = Type.Object({
+  id: Type.Number(),
+  name: Type.String(),
+  status: Type.String(),
+  conclusion: Type.Union([Type.String(), Type.Null()]),
+  steps: Type.Array(stepSchema),
+});
+
+const jobsResponseSchema = Type.Object({ jobs: Type.Array(jobRunSchema) });
+
 function truncate(
   text: string,
   maxLines = 2000,
@@ -171,22 +203,14 @@ function truncate(
 }
 
 /**
- * Convert a gh invocation result into a tool result.
- *
- * On failure, returns the error text as content and includes the raw command
- * input (`args`) in `details` so the user can debug what the model actually ran.
+ * Format a successful gh invocation's stdout into a tool result.
+ * Failures are thrown by `ghExec` as `GhError`, so only the success path lives here.
  */
-function toToolResult(res: GhExecResult): {
+function toToolResult(stdout: string): {
   content: Array<{ type: "text"; text: string }>;
   details: Record<string, unknown>;
 } {
-  if (!res.ok) {
-    return {
-      content: [{ type: "text", text: `gh ${res.args.join(" ")} failed: ${res.error}` }],
-      details: { error: res.error, args: res.args },
-    };
-  }
-  const { text, truncated } = truncate(res.stdout);
+  const { text, truncated } = truncate(stdout);
   return { content: [{ type: "text", text }], details: { truncated } };
 }
 
@@ -220,16 +244,16 @@ export function stepsDetail(
 }
 
 /** In-flight dedup map to avoid concurrent fetches of the same log. */
-const inflightLogs = new Map<string, Promise<GhExecResult & { log?: string }>>();
+const inflightLogs = new Map<string, Promise<string>>();
 
 async function getJobLog(
-  pi: ExtensionAPI,
   runId: string,
   jobId: number,
   effectiveRepo: string,
   signal: AbortSignal | undefined,
   cwd: string | undefined,
-): Promise<GhExecResult & { log?: string }> {
+  input?: unknown,
+): Promise<string> {
   const cacheDir = join(homedir(), ".cache", "pi", "ci-logs", runId);
   const cacheFile = join(cacheDir, `${jobId}.log`);
   const key = `${runId}:${jobId}`;
@@ -238,28 +262,27 @@ async function getJobLog(
   const inflight = inflightLogs.get(key);
   if (inflight) return inflight;
 
-  const fetchAndCache = async (): Promise<GhExecResult & { log?: string }> => {
+  const fetchAndCache = async (): Promise<string> => {
     // Check file cache
     try {
-      const cached = await readFile(cacheFile, "utf-8");
-      return { ok: true, stdout: cached, error: null, args: [], log: cached };
+      return await readFile(cacheFile, "utf-8");
     } catch {
       // Not cached, fetch from GitHub
     }
 
-    const res = await ghExec(pi, ["api", `/repos/${effectiveRepo}/actions/jobs/${jobId}/logs`], {
+    const log = await ghExec(["api", `/repos/${effectiveRepo}/actions/jobs/${jobId}/logs`], {
       cwd,
       signal,
+      input,
     });
-    if (!res.ok) return res;
 
     // Write to cache
     await mkdir(cacheDir, { recursive: true });
     await withFileMutationQueue(cacheFile, async () => {
-      await writeFile(cacheFile, res.stdout);
+      await writeFile(cacheFile, log);
     });
 
-    return { ...res, log: res.stdout };
+    return log;
   };
 
   const promise = fetchAndCache();
@@ -272,15 +295,15 @@ async function getJobLog(
 }
 
 async function resolveRepo(
-  pi: ExtensionAPI,
   repo: string | undefined,
   signal: AbortSignal | undefined,
   cwd: string | undefined,
-): Promise<GhExecResult & { repo?: string }> {
-  if (repo) return { ok: true, stdout: "", error: null, args: [], repo };
-  const res = await ghExec(pi, ["repo", "view", "--json", "nameWithOwner"], { cwd, signal });
-  if (!res.ok) return res;
-  return { ...res, repo: JSON.parse(res.stdout).nameWithOwner };
+  input?: unknown,
+): Promise<string> {
+  if (repo) return repo;
+  const stdout = await ghExec(["repo", "view", "--json", "nameWithOwner"], { cwd, signal, input });
+  const { nameWithOwner } = Value.Parse(repoViewSchema, JSON.parse(stdout));
+  return nameWithOwner;
 }
 
 export function statusIcon(conclusion: string | null): string {
@@ -400,10 +423,9 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO (defaults to current repo)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo } = params as { number: number | string; repo?: string };
+      const { number, repo } = params;
       return toToolResult(
         await ghExec(
-          pi,
           [
             "issue",
             "view",
@@ -412,7 +434,7 @@ export default function (pi: ExtensionAPI) {
             "--json",
             "title,state,body,author,createdAt,updatedAt,closedAt,url,labels,assignees,comments,milestone,number",
           ],
-          { cwd: ctx.cwd, signal },
+          { cwd: ctx.cwd, signal, input: params },
         ),
       );
     },
@@ -430,11 +452,11 @@ export default function (pi: ExtensionAPI) {
       limit: Type.Optional(Type.Number({ description: "Max results (default 30)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { repo, state, limit } = params as { repo?: string; state?: string; limit?: number };
+      const { repo, state, limit } = params;
       const args = ["issue", "list", ...repoArgs(repo)];
       if (state) args.push("--state", state);
       if (limit) args.push("--limit", String(limit));
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -449,10 +471,9 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo } = params as { number: number | string; repo?: string };
+      const { number, repo } = params;
       return toToolResult(
         await ghExec(
-          pi,
           [
             "pr",
             "view",
@@ -461,7 +482,7 @@ export default function (pi: ExtensionAPI) {
             "--json",
             "title,state,body,author,createdAt,updatedAt,mergedAt,mergedBy,headRefName,baseRefName,url,additions,deletions,changedFiles,labels,assignees,reviewRequests,reviews,comments,number",
           ],
-          { cwd: ctx.cwd, signal },
+          { cwd: ctx.cwd, signal, input: params },
         ),
       );
     },
@@ -481,11 +502,11 @@ export default function (pi: ExtensionAPI) {
       limit: Type.Optional(Type.Number({ description: "Max results (default 30)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { repo, state, limit } = params as { repo?: string; state?: string; limit?: number };
+      const { repo, state, limit } = params;
       const args = ["pr", "list", ...repoArgs(repo)];
       if (state) args.push("--state", state);
       if (limit) args.push("--limit", String(limit));
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -500,12 +521,9 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo } = params as {
-        number: number | string;
-        repo?: string;
-      };
+      const { number, repo } = params;
       const args = ["pr", "diff", String(number), ...repoArgs(repo)];
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -520,11 +538,12 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo } = params as { number: number | string; repo?: string };
+      const { number, repo } = params;
       return toToolResult(
-        await ghExec(pi, ["pr", "checks", String(number), ...repoArgs(repo)], {
+        await ghExec(["pr", "checks", String(number), ...repoArgs(repo)], {
           cwd: ctx.cwd,
           signal,
+          input: params,
         }),
       );
     },
@@ -548,31 +567,26 @@ export default function (pi: ExtensionAPI) {
       ),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo, reviews } = params as {
-        number: number | string;
-        repo?: string;
-        reviews?: boolean;
-      };
+      const { number, repo, reviews } = params;
       let out: string;
       if (reviews) {
-        const resolved = await resolveRepo(pi, repo, signal, ctx.cwd);
-        if (!resolved.ok) return toToolResult(resolved);
+        const effectiveRepo = await resolveRepo(repo, signal, ctx.cwd, params);
 
-        const [commentsRes, reviewsRes] = await Promise.all([
-          ghExec(pi, ["api", `/repos/${resolved.repo!}/pulls/${String(number)}/comments`], {
+        const [comments, reviewsOut] = await Promise.all([
+          ghExec(["api", `/repos/${effectiveRepo}/pulls/${String(number)}/comments`], {
             cwd: ctx.cwd,
             signal,
+            input: params,
           }),
-          ghExec(pi, ["api", `/repos/${resolved.repo!}/pulls/${String(number)}/reviews`], {
+          ghExec(["api", `/repos/${effectiveRepo}/pulls/${String(number)}/reviews`], {
             cwd: ctx.cwd,
             signal,
+            input: params,
           }),
         ]);
-        if (!commentsRes.ok) return toToolResult(commentsRes);
-        if (!reviewsRes.ok) return toToolResult(reviewsRes);
 
-        const reviewComments = JSON.parse(commentsRes.stdout);
-        const reviewSummaries = JSON.parse(reviewsRes.stdout);
+        const reviewComments = Value.Parse(Type.Array(Type.Unknown()), JSON.parse(comments));
+        const reviewSummaries = Value.Parse(Type.Array(Type.Unknown()), JSON.parse(reviewsOut));
 
         out = JSON.stringify(
           {
@@ -583,16 +597,14 @@ export default function (pi: ExtensionAPI) {
           2,
         );
       } else {
-        const res = await ghExec(
-          pi,
+        out = await ghExec(
           ["pr", "view", String(number), ...repoArgs(repo), "--json", "comments"],
           {
             cwd: ctx.cwd,
             signal,
+            input: params,
           },
         );
-        if (!res.ok) return toToolResult(res);
-        out = res.stdout;
       }
       const { text, truncated } = truncate(out);
       return {
@@ -613,13 +625,13 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { number, repo } = params as { number: number | string; repo?: string };
+      const { number, repo } = params;
       return toToolResult(
-        await ghExec(
-          pi,
-          ["issue", "view", String(number), ...repoArgs(repo), "--json", "comments"],
-          { cwd: ctx.cwd, signal },
-        ),
+        await ghExec(["issue", "view", String(number), ...repoArgs(repo), "--json", "comments"], {
+          cwd: ctx.cwd,
+          signal,
+          input: params,
+        }),
       );
     },
   });
@@ -639,17 +651,12 @@ export default function (pi: ExtensionAPI) {
       workflow: Type.Optional(Type.String({ description: "Filter by workflow name or file" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { repo, limit, status, workflow } = params as {
-        repo?: string;
-        limit?: number;
-        status?: string;
-        workflow?: string;
-      };
+      const { repo, limit, status, workflow } = params;
       const args = ["run", "list", ...repoArgs(repo)];
       if (limit) args.push("--limit", String(limit));
       if (status) args.push("--status", status);
       if (workflow) args.push("--workflow", workflow);
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -689,40 +696,17 @@ export default function (pi: ExtensionAPI) {
       ),
     }),
     async execute(_id, params, signal, onUpdate, ctx) {
-      const { run_id, repo, job, step, offset, limit } = params as {
-        run_id: number | string;
-        repo?: string;
-        job?: string;
-        step?: string;
-        offset?: number;
-        limit?: number;
-      };
+      const { run_id, repo, job, step, offset, limit } = params;
 
       // ── Fetch specific step logs ───────────────────────────────────────
       if (step !== undefined && step !== null) {
-        const resolved = await resolveRepo(pi, repo, signal, ctx.cwd);
-        if (!resolved.ok) return toToolResult(resolved);
+        const effectiveRepo = await resolveRepo(repo, signal, ctx.cwd, params);
 
-        const jobsRes = await ghExec(
-          pi,
-          ["api", `/repos/${resolved.repo!}/actions/runs/${run_id}/jobs`],
-          { cwd: ctx.cwd, signal },
+        const jobsOut = await ghExec(
+          ["api", `/repos/${effectiveRepo}/actions/runs/${run_id}/jobs`],
+          { cwd: ctx.cwd, signal, input: params },
         );
-        if (!jobsRes.ok) return toToolResult(jobsRes);
-        const { jobs } = JSON.parse(jobsRes.stdout) as {
-          jobs: Array<{
-            id: number;
-            name: string;
-            status: string;
-            conclusion: string | null;
-            steps: Array<{
-              name: string;
-              number: number;
-              status: string;
-              conclusion: string | null;
-            }>;
-          }>;
-        };
+        const { jobs } = Value.Parse(jobsResponseSchema, JSON.parse(jobsOut));
 
         if (!jobs || jobs.length === 0) {
           return {
@@ -804,16 +788,14 @@ export default function (pi: ExtensionAPI) {
           details: {},
         });
 
-        const logRes = await getJobLog(
-          pi,
+        const rawLog = await getJobLog(
           String(run_id),
           targetJob.id,
-          resolved.repo!,
+          effectiveRepo,
           signal,
           ctx.cwd,
+          params,
         );
-        if (!logRes.ok) return toToolResult(logRes);
-        const rawLog = logRes.log!;
 
         const stepLog = extractStepFromLog(rawLog, stepNum, targetJob.steps);
         if (stepLog === null) {
@@ -891,29 +873,14 @@ export default function (pi: ExtensionAPI) {
         details: {},
       });
 
-      const resolved = await resolveRepo(pi, repo, signal, ctx.cwd);
-      if (!resolved.ok) return toToolResult(resolved);
+      const effectiveRepo = await resolveRepo(repo, signal, ctx.cwd, params);
 
-      const jobsRes = await ghExec(
-        pi,
-        ["api", `/repos/${resolved.repo!}/actions/runs/${run_id}/jobs`],
-        { cwd: ctx.cwd, signal },
-      );
-      if (!jobsRes.ok) return toToolResult(jobsRes);
-      const { jobs } = JSON.parse(jobsRes.stdout) as {
-        jobs: Array<{
-          id: number;
-          name: string;
-          status: string;
-          conclusion: string | null;
-          steps: Array<{
-            name: string;
-            number: number;
-            status: string;
-            conclusion: string | null;
-          }>;
-        }>;
-      };
+      const jobsOut = await ghExec(["api", `/repos/${effectiveRepo}/actions/runs/${run_id}/jobs`], {
+        cwd: ctx.cwd,
+        signal,
+        input: params,
+      });
+      const { jobs } = Value.Parse(jobsResponseSchema, JSON.parse(jobsOut));
 
       if (!jobs || jobs.length === 0) {
         return {
@@ -974,15 +941,14 @@ export default function (pi: ExtensionAPI) {
         if (failedSteps.length === 0) continue;
 
         try {
-          const logRes = await getJobLog(pi, String(run_id), j.id, resolved.repo!, signal, ctx.cwd);
-          if (!logRes.ok) {
-            contents.push({
-              type: "text",
-              text: `\n⚠️ Could not auto-fetch logs for ${j.name}: gh ${logRes.args.join(" ")} failed: ${logRes.error}`,
-            });
-            continue;
-          }
-          const rawLog = logRes.log!;
+          const rawLog = await getJobLog(
+            String(run_id),
+            j.id,
+            effectiveRepo,
+            signal,
+            ctx.cwd,
+            params,
+          );
 
           for (const fs of failedSteps) {
             if (fetchedCount >= maxFailed) break;
@@ -1046,13 +1012,13 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { run_id, repo } = params as { run_id: number | string; repo?: string };
-      const resolved = await resolveRepo(pi, repo, signal, ctx.cwd);
-      if (!resolved.ok) return toToolResult(resolved);
+      const { run_id, repo } = params;
+      const effectiveRepo = await resolveRepo(repo, signal, ctx.cwd, params);
       return toToolResult(
-        await ghExec(pi, ["api", `/repos/${resolved.repo!}/actions/runs/${run_id}/jobs`], {
+        await ghExec(["api", `/repos/${effectiveRepo}/actions/runs/${run_id}/jobs`], {
           cwd: ctx.cwd,
           signal,
+          input: params,
         }),
       );
     },
@@ -1068,10 +1034,10 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { repo } = params as { repo?: string };
+      const { repo } = params;
       const args = ["repo", "view"];
       if (repo) args.push(repo);
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -1086,10 +1052,10 @@ export default function (pi: ExtensionAPI) {
       limit: Type.Optional(Type.Number({ description: "Max results (default 10)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { repo, limit } = params as { repo?: string; limit?: number };
+      const { repo, limit } = params;
       const args = ["release", "list", ...repoArgs(repo)];
       if (limit) args.push("--limit", String(limit));
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -1104,11 +1070,12 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { tag, repo } = params as { tag: string; repo?: string };
+      const { tag, repo } = params;
       return toToolResult(
-        await ghExec(pi, ["release", "view", tag, ...repoArgs(repo)], {
+        await ghExec(["release", "view", tag, ...repoArgs(repo)], {
           cwd: ctx.cwd,
           signal,
+          input: params,
         }),
       );
     },
@@ -1130,11 +1097,7 @@ export default function (pi: ExtensionAPI) {
       ),
     }),
     async execute(_id, params, signal, onUpdate, ctx) {
-      const { number, repo, fail_fast } = params as {
-        number: number | string;
-        repo?: string;
-        fail_fast?: boolean;
-      };
+      const { number, repo, fail_fast } = params;
 
       onUpdate?.({
         content: [{ type: "text", text: `Watching CI checks for PR #${number}...` }],
@@ -1144,7 +1107,7 @@ export default function (pi: ExtensionAPI) {
       const args = ["pr", "checks", String(number), ...repoArgs(repo), "--watch"];
       if (fail_fast) args.push("--fail-fast");
 
-      const result = await execGh(pi, args, { cwd: ctx.cwd, signal, timeout: 600_000 });
+      const result = await runGh(args, { cwd: ctx.cwd, signal, timeout: 600_000 });
 
       const exitCode = result.code;
       const stdout = result.stdout;
@@ -1184,14 +1147,14 @@ export default function (pi: ExtensionAPI) {
       repo: Type.Optional(Type.String({ description: "OWNER/REPO" })),
     }),
     async execute(_id, params, signal, onUpdate, ctx) {
-      const { run_id, repo } = params as { run_id: number | string; repo?: string };
+      const { run_id, repo } = params;
 
       onUpdate?.({
         content: [{ type: "text", text: `Watching workflow run ${run_id}...` }],
         details: {},
       });
 
-      const result = await execGh(pi, ["run", "watch", String(run_id), ...repoArgs(repo)], {
+      const result = await runGh(["run", "watch", String(run_id), ...repoArgs(repo)], {
         cwd: ctx.cwd,
         signal,
         timeout: 600_000,
@@ -1229,15 +1192,11 @@ export default function (pi: ExtensionAPI) {
       limit: Type.Optional(Type.Number({ description: "Max results (default 20)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { query, include_prs, limit } = params as {
-        query: string;
-        include_prs?: boolean;
-        limit?: number;
-      };
+      const { query, include_prs, limit } = params;
       const args = ["search", "issues", query];
       if (include_prs) args.push("--include-prs");
       if (limit) args.push("--limit", String(limit));
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 
@@ -1255,10 +1214,10 @@ export default function (pi: ExtensionAPI) {
       limit: Type.Optional(Type.Number({ description: "Max results (default 20)" })),
     }),
     async execute(_id, params, signal, _onUpdate, ctx) {
-      const { query, limit } = params as { query: string; limit?: number };
+      const { query, limit } = params;
       const args = ["search", "prs", query];
       if (limit) args.push("--limit", String(limit));
-      return toToolResult(await ghExec(pi, args, { cwd: ctx.cwd, signal }));
+      return toToolResult(await ghExec(args, { cwd: ctx.cwd, signal, input: params }));
     },
   });
 }

package/src/opencode-edit.ts

@@ -517,7 +517,9 @@ export default function (pi: ExtensionAPI) {
         } catch (error: unknown) {
           throwIfAborted();
           const msg =
-            error instanceof Error && "code" in error ? `Error code: ${error.code}` : String(error);
+            error instanceof Error && "code" in error && typeof error.code === "string"
+              ? `Error code: ${error.code}`
+              : String(error);
           throw new Error(`Could not edit file: ${filePath}. ${msg}.`);
         }
         throwIfAborted();

package/src/opencode-read.ts

@@ -317,11 +317,7 @@ export default function (pi: ExtensionAPI) {
       ),
     }),
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-      const {
-        filePath: rawPath,
-        offset,
-        limit,
-      } = params as { filePath: string; offset?: number; limit?: number };
+      const { filePath: rawPath, offset, limit } = params;
 
       const absolutePath = isAbsolute(rawPath) ? rawPath : resolvePath(ctx.cwd, rawPath);
 
@@ -336,9 +332,7 @@ export default function (pi: ExtensionAPI) {
       } catch {
         const suggestion = await didYouMean(absolutePath);
         return {
-          content: [
-            { type: "text", text: `File not found: ${absolutePath}${suggestion}` },
-          ] as TextContent[],
+          content: [{ type: "text", text: `File not found: ${absolutePath}${suggestion}` }],
           details: undefined,
         };
       }
@@ -366,7 +360,7 @@ export default function (pi: ExtensionAPI) {
         output += `\n</entries>`;
 
         return {
-          content: [{ type: "text", text: output }] as TextContent[],
+          content: [{ type: "text", text: output }],
           details: undefined,
         };
       }
@@ -380,7 +374,7 @@ export default function (pi: ExtensionAPI) {
         await access(absolutePath, constants.R_OK);
       } catch {
         return {
-          content: [{ type: "text", text: `File not readable: ${absolutePath}` }] as TextContent[],
+          content: [{ type: "text", text: `File not readable: ${absolutePath}` }],
           details: undefined,
         };
       }
@@ -392,7 +386,7 @@ export default function (pi: ExtensionAPI) {
         const base64 = buffer.toString("base64");
         content = [
           { type: "text", text: `[Image: ${mimeType}, ${formatSize(buffer.length)}]` },
-          { type: "image", data: base64, mimeType } as ImageContent,
+          { type: "image", data: base64, mimeType },
         ];
         return { content, details: undefined };
       }
@@ -404,9 +398,7 @@ export default function (pi: ExtensionAPI) {
       // Binary file detection
       if (isBinaryExtension(absolutePath) || isBinaryFileBySample(sample)) {
         return {
-          content: [
-            { type: "text", text: `Cannot read binary file: ${absolutePath}` },
-          ] as TextContent[],
+          content: [{ type: "text", text: `Cannot read binary file: ${absolutePath}` }],
           details: undefined,
         };
       }
@@ -426,7 +418,7 @@ export default function (pi: ExtensionAPI) {
               type: "text",
               text: `Offset ${offset} is beyond end of file (${allLines.length} lines total)`,
             },
-          ] as TextContent[],
+          ],
           details: undefined,
         };
       }
@@ -477,7 +469,7 @@ export default function (pi: ExtensionAPI) {
         }
       }
 
-      content = [{ type: "text", text: outputText }] as TextContent[];
+      content = [{ type: "text", text: outputText }];
 
       return { content, details };
     },

package/src/opencode-write.ts

@@ -35,7 +35,7 @@ export default function (pi: ExtensionAPI) {
       content: Type.String({ description: "The content to write to the file" }),
     }),
     async execute(_toolCallId, params, signal, _onUpdate, ctx) {
-      const { filePath: rawPath, content } = params as { filePath: string; content: string };
+      const { filePath: rawPath, content } = params;
       const absolutePath = resolvePath(ctx.cwd, rawPath);
       const dir = dirname(absolutePath);
 
@@ -51,10 +51,7 @@ export default function (pi: ExtensionAPI) {
         throwIfAborted();
 
         return {
-          content: [{ type: "text", text: `Wrote file successfully: ${absolutePath}` }] as Array<{
-            type: "text";
-            text: string;
-          }>,
+          content: [{ type: "text", text: `Wrote file successfully: ${absolutePath}` }],
           details: undefined,
         };
       });

package/src/todo-pendant.ts

@@ -36,6 +36,10 @@ interface TaskDetails {
   error?: string;
 }
 
+function isTaskDetails(d: unknown): d is TaskDetails {
+  return typeof d === "object" && d !== null && "tasks" in d && Array.isArray(d.tasks);
+}
+
 // ---------------------------------------------------------------------------
 // Helpers
 // ---------------------------------------------------------------------------
@@ -65,8 +69,8 @@ export default function (pi: ExtensionAPI) {
   pi.on("tool_result", (event, ctx) => {
     if (event.toolName !== "todo") return;
 
-    const details = event.details as TaskDetails | undefined;
-    if (!details?.tasks?.length) {
+    const details = event.details;
+    if (!isTaskDetails(details) || !details.tasks.length) {
       ctx.ui.setWidget("todo-pendant", undefined);
       return;
     }

package/src/workspace-guard.ts

@@ -13,11 +13,18 @@
 
 import { isAbsolute, join, resolve, relative, sep } from "node:path";
 import { homedir } from "node:os";
-import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI, ToolCallEvent } from "@earendil-works/pi-coding-agent";
 
 const WRITE_TOOLS = new Set(["write", "edit"]);
 const ALWAYS_ALLOW = ["/tmp"];
 
+function getWriteTarget(input: ToolCallEvent["input"]): string | undefined {
+  if (typeof input !== "object" || input === null) return undefined;
+  if ("path" in input && typeof input.path === "string") return input.path;
+  if ("filePath" in input && typeof input.filePath === "string") return input.filePath;
+  return undefined;
+}
+
 function resolvePath(filePath: string, cwd: string): string {
   let p = filePath;
   if (p.startsWith("~")) {
@@ -46,7 +53,7 @@ function isPathAllowed(resolvedPath: string, cwd: string): boolean {
 }
 
 export default function (pi: ExtensionAPI) {
-  pi.on("before_agent_start", async (event, ctx) => {
+  pi.on("before_agent_start", (event, ctx) => {
     const currentCwd = ctx.cwd;
     return {
       systemPrompt:
@@ -60,8 +67,7 @@ export default function (pi: ExtensionAPI) {
   pi.on("tool_call", async (event, ctx) => {
     if (!WRITE_TOOLS.has(event.toolName)) return;
 
-    const input = event.input as { path?: string; filePath?: string };
-    const rawPath = input.path ?? input.filePath;
+    const rawPath = getWriteTarget(event.input);
     if (!rawPath) return;
 
     const resolved = resolvePath(rawPath, ctx.cwd);