codiedev 0.9.70 → 0.9.71

package/dist/managedPi.js

@@ -0,0 +1,284 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ManagedPiArgError = exports.GUARD_SOURCE = exports.BLOCKED_BASE_URL = exports.CAPTURE_FILE = exports.GUARD_FILE = exports.PI_PROVIDER_ENV = exports.PI_PROVIDER_ID = void 0;
+exports.managedPiAgentDir = managedPiAgentDir;
+exports.piProviderConfig = piProviderConfig;
+exports.prepareManagedPiDir = prepareManagedPiDir;
+exports.managedPiEnv = managedPiEnv;
+exports.managedPiArgs = managedPiArgs;
+exports.runManagedPi = runManagedPi;
+// `codie --pi [args]`: pi as a Codiedev harness, on the company's approved
+// gateway models (the same catalog and key the OpenCode engine uses).
+//
+// The managed launch closes every path to a model that skips the gateway
+// instead of trusting the user's ~/.pi:
+//   - pi runs from a Codiedev-owned agent dir (PI_CODING_AGENT_DIR), rewritten
+//     on every launch: only the `codiedev` provider, no packages, no
+//     extensions and no auth.json (so no stored provider credentials).
+//   - provider API keys pi would read from the environment are removed.
+//   - extension discovery is off (`--no-extensions`, which also skips
+//     project-local .pi/extensions); the only extensions are the guard below
+//     and the Codiedev capture extension.
+//   - flags that bring their own credentials or code (--api-key, --provider,
+//     -e) and the package subcommands are refused.
+//   - the guard points every other provider at a dead loopback address and
+//     keeps the session on an approved model, which covers an in-session
+//     /login too. Throwing from pi's before_provider_request does NOT stop a
+//     request (pi logs it and sends anyway), hence the base-URL override.
+//
+// Sessions, skills, prompts, themes and context files keep working; they
+// don't reach a model on their own. Ported from #1783, minus the harness-pack
+// proxy: pi talks to the gateway directly, like `codie`.
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const codieLauncher_1 = require("./codieLauncher");
+const utils_1 = require("./utils");
+exports.PI_PROVIDER_ID = "codiedev";
+/** Env vars pi reads provider credentials from (`pi --help`, pi 0.73). */
+exports.PI_PROVIDER_ENV = [
+    "ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "AZURE_OPENAI_API_KEY",
+    "AZURE_OPENAI_BASE_URL", "AZURE_OPENAI_RESOURCE_NAME", "DEEPSEEK_API_KEY", "GEMINI_API_KEY",
+    "GROQ_API_KEY", "CEREBRAS_API_KEY", "XAI_API_KEY", "FIREWORKS_API_KEY", "OPENROUTER_API_KEY",
+    "AI_GATEWAY_API_KEY", "ZAI_API_KEY", "MISTRAL_API_KEY", "MINIMAX_API_KEY", "MOONSHOT_API_KEY",
+    "OPENCODE_API_KEY", "KIMI_API_KEY", "CLOUDFLARE_API_KEY", "XIAOMI_API_KEY",
+    "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY",
+    "AWS_PROFILE", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN",
+    "AWS_BEARER_TOKEN_BEDROCK", "GOOGLE_APPLICATION_CREDENTIALS", "GOOGLE_CLOUD_API_KEY",
+    "COPILOT_GITHUB_TOKEN",
+];
+/** pi subcommands that install or change extension sources. */
+const BLOCKED_SUBCOMMANDS = new Set(["install", "remove", "uninstall", "config"]);
+exports.GUARD_FILE = "codie-guard.ts";
+exports.CAPTURE_FILE = "codiedev-capture.ts";
+/** Where the guard points every other provider: a loopback port nothing
+ * listens on, so a request (and whatever key it carries) never leaves the
+ * machine. */
+exports.BLOCKED_BASE_URL = "http://127.0.0.1:9/blocked-by-codiedev";
+/** The pi extension that keeps a managed session on Codiedev models and tags
+ * each gateway request with the session, repo and skills, so gateway billing
+ * joins the captured pi session (same headers as the OpenCode metadata
+ * plugin, assets/git-refs.mjs). */
+exports.GUARD_SOURCE = `// Written by Codiedev on every \`codie --pi\` launch. Edits are overwritten.
+import { execFileSync } from "node:child_process";
+import { getProviders } from "@mariozechner/pi-ai";
+
+const PROVIDER = ${JSON.stringify(exports.PI_PROVIDER_ID)};
+const BLOCKED = ${JSON.stringify(exports.BLOCKED_BASE_URL)};
+const ours = (m) => Boolean(m && m.provider === PROVIDER);
+const label = (m) => (m ? m.provider + "/" + m.id : "that model");
+// pi runs a header value starting with "!" as a shell command, so no value
+// may start with one; branch and skill names are user-controlled.
+const clean = (v, max) => String(v ?? "").replace(/[\\r\\n]/g, "").trim().replace(/^!+/, "").slice(0, max);
+const git = (cwd, args) => { try { return execFileSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1500 }).trim(); } catch { return ""; } };
+
+export default function (pi) {
+  for (const p of getProviders()) if (p !== PROVIDER) pi.registerProvider(p, { baseUrl: BLOCKED });
+
+  let last;
+  const skills = new Set();
+  const fallback = (ctx) => last ?? ctx.modelRegistry.getAll().find(ours);
+  const pin = async (model, ctx) => {
+    const back = fallback(ctx);
+    if (back) await pi.setModel(back);
+    if (ctx.hasUI) ctx.ui.notify("codie: " + label(model) + " isn't a Codiedev-approved model" + (back ? "; using " + back.id : "") + ".", "warning");
+  };
+  const tag = (ctx) => {
+    const headers = {};
+    const session = clean(ctx.sessionManager?.getSessionId?.(), 200);
+    if (session) headers["X-Codiedev-Session-Id"] = session;
+    const repo = clean(git(ctx.cwd, ["remote", "get-url", "origin"]).replace(/\\/\\/[^/@]*@/, "//"), 2048);
+    if (repo) headers["X-Codiedev-Repo-Url"] = repo;
+    const branch = clean(git(ctx.cwd, ["branch", "--show-current"]), 200);
+    if (branch) headers["X-Codiedev-Branch"] = branch;
+    const sha = clean(git(ctx.cwd, ["rev-parse", "HEAD"]), 40);
+    if (/^[0-9a-f]{7,40}$/i.test(sha)) headers["X-Codiedev-Head-Sha"] = sha;
+    const list = clean([...skills].join(","), 4096);
+    if (list) headers["X-Codiedev-Skills-Used"] = list;
+    // pi replaces the provider's whole request config here, so the key name
+    // goes with the headers every time.
+    pi.registerProvider(PROVIDER, { apiKey: "CODIEDEV_GATEWAY_KEY", headers });
+  };
+
+  pi.on("session_start", async (_event, ctx) => {
+    skills.clear();
+    for (const m of ctx.modelRegistry.getAll()) if (!ours(m)) pi.registerProvider(m.provider, { baseUrl: BLOCKED });
+    if (ours(ctx.model)) last = ctx.model;
+    else await pin(ctx.model, ctx);
+    tag(ctx);
+  });
+  pi.on("model_select", async (event, ctx) => {
+    if (ours(event.model)) last = event.model;
+    else await pin(event.model, ctx);
+  });
+  pi.on("input", async (event) => {
+    const m = String(event?.text ?? "").match(/^\\/skill:([a-z0-9][a-z0-9_.:-]{0,119})(?:\\s|$)/i);
+    if (m && skills.size < 50) skills.add(m[1]);
+  });
+  pi.on("tool_result", async (event) => {
+    const p = String(event?.input?.path ?? "").replace(/\\\\/g, "/").match(/\\/([a-z0-9][a-z0-9_.:-]{0,119})\\/SKILL\\.md$/i);
+    if (event?.toolName === "read" && !event.isError && p && skills.size < 50) skills.add(p[1]);
+  });
+  // Before every model call in the turn: the agent may have switched branch.
+  pi.on("turn_start", async (_event, ctx) => tag(ctx));
+  pi.on("before_provider_request", (_event, ctx) => {
+    // Belt and braces: the request is already headed for BLOCKED.
+    if (!ours(ctx.model)) ctx.abort();
+  });
+}
+`;
+function managedPiAgentDir(stateDir) {
+    return path.join(stateDir, "managed", "pi", "agent");
+}
+/** pi's models.json entry for the gateway. The key is read from
+ * CODIEDEV_GATEWAY_KEY at request time (pi resolves an env var name). */
+function piProviderConfig(gatewayUrl, catalog) {
+    return {
+        baseUrl: gatewayUrl.replace(/\/+$/, ""),
+        api: "openai-completions",
+        apiKey: "CODIEDEV_GATEWAY_KEY",
+        compat: { supportsDeveloperRole: false, supportsReasoningEffort: false },
+        models: catalog.map((model) => ({
+            id: (0, codieLauncher_1.bareModel)(model.id),
+            name: model.name || (0, codieLauncher_1.bareModel)(model.id),
+            ...(model.limit ? { contextWindow: model.limit.context, maxTokens: model.limit.output } : {}),
+            // pi shows a session's spend from this. The gateway publishes prompt and
+            // completion prices only, so cache is unpriced; gateway settlement is
+            // the true figure.
+            ...(model.cost ? { cost: { input: model.cost.input, output: model.cost.output, cacheRead: 0, cacheWrite: 0 } } : {}),
+        })),
+    };
+}
+function writeJsonAtomic(file, value) {
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+    fs.renameSync(tmp, file);
+}
+/** Rewrite everything Codiedev owns in the managed agent dir. Sessions (and
+ * anything else pi keeps there) are left alone. Returns the extensions to load. */
+function prepareManagedPiDir(opts) {
+    const { agentDir, gatewayUrl, catalog } = opts;
+    if (!catalog.length)
+        throw new Error("No company-approved models were returned by Codiedev");
+    const ids = catalog.map((model) => (0, codieLauncher_1.bareModel)(model.id));
+    const requested = (0, codieLauncher_1.bareModel)(opts.model ?? "");
+    if (requested && !ids.includes(requested)) {
+        throw new Error(`Primary agent model is not approved for this Codiedev account: ${requested}`);
+    }
+    fs.mkdirSync(agentDir, { recursive: true, mode: 0o700 });
+    writeJsonAtomic(path.join(agentDir, "models.json"), { providers: { [exports.PI_PROVIDER_ID]: piProviderConfig(gatewayUrl, catalog) } });
+    writeJsonAtomic(path.join(agentDir, "settings.json"), {
+        defaultProvider: exports.PI_PROVIDER_ID,
+        defaultModel: requested || ids[0],
+        enabledModels: ids.map((id) => `${exports.PI_PROVIDER_ID}/${id}`),
+        packages: [],
+        extensions: [],
+        skills: opts.skillPaths ?? [],
+        enableInstallTelemetry: false,
+    });
+    // Stored provider credentials (a /login from an earlier session) and any
+    // extensions dropped into the dir go away on every launch.
+    fs.rmSync(path.join(agentDir, "auth.json"), { force: true });
+    fs.rmSync(path.join(agentDir, "extensions"), { recursive: true, force: true });
+    const guard = path.join(agentDir, exports.GUARD_FILE);
+    fs.writeFileSync(guard, exports.GUARD_SOURCE, { mode: 0o600 });
+    const capture = path.join(agentDir, exports.CAPTURE_FILE);
+    fs.writeFileSync(capture, (0, utils_1.piExtensionSource)(opts.agentSecurityEnabled), { mode: 0o600 });
+    return [guard, capture];
+}
+/** The child env: no provider credentials, pi pointed at the managed dir. */
+function managedPiEnv(env, agentDir, key, platform = process.platform) {
+    const blocked = new Set([...exports.PI_PROVIDER_ENV, "PI_CODING_AGENT_DIR"]);
+    const out = {};
+    for (const [k, v] of Object.entries(env)) {
+        // Windows env names are case-insensitive.
+        if (blocked.has(platform === "win32" ? k.toUpperCase() : k))
+            continue;
+        out[k] = v;
+    }
+    out.PI_CODING_AGENT_DIR = agentDir;
+    out.PI_TELEMETRY = "0";
+    out.CODIEDEV_GATEWAY_KEY = key;
+    return out;
+}
+class ManagedPiArgError extends Error {
+}
+exports.ManagedPiArgError = ManagedPiArgError;
+/** Refuse what would bring other credentials or code into the session, then
+ * pin extension loading to the managed extensions. */
+function managedPiArgs(args, extensions) {
+    if (args.length && BLOCKED_SUBCOMMANDS.has(args[0])) {
+        throw new ManagedPiArgError(`\`pi ${args[0]}\` changes extension sources, which codie --pi manages. Ask your Codiedev admin to approve a package instead.`);
+    }
+    for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a === "--")
+            break;
+        const [flag, inline] = a.startsWith("--") && a.includes("=") ? [a.slice(0, a.indexOf("=")), a.slice(a.indexOf("=") + 1)] : [a, undefined];
+        if (flag === "--api-key")
+            throw new ManagedPiArgError("--api-key isn't allowed in codie --pi: models come from Codiedev.");
+        if (flag === "-e" || flag === "--extension")
+            throw new ManagedPiArgError(`${flag} isn't allowed in codie --pi: extensions are managed by Codiedev.`);
+        if (flag === "--provider") {
+            const value = inline ?? args[i + 1];
+            if (value !== exports.PI_PROVIDER_ID)
+                throw new ManagedPiArgError(`--provider ${value ?? "(none)"} isn't allowed in codie --pi: only Codiedev-approved models are available.`);
+        }
+    }
+    return ["--no-extensions", ...extensions.flatMap((file) => ["-e", file]), ...args];
+}
+function runManagedPi(opts) {
+    const env = opts.env ?? process.env;
+    const agentDir = managedPiAgentDir(opts.stateDir);
+    const extensions = prepareManagedPiDir({
+        agentDir, gatewayUrl: opts.gatewayUrl, catalog: opts.catalog, model: env.CODIEDEV_MODEL,
+        skillPaths: opts.skillPaths, agentSecurityEnabled: opts.agentSecurityEnabled,
+    });
+    const args = managedPiArgs(opts.args, extensions);
+    const bin = opts.bin ?? env.CODIEDEV_PI_BIN ?? "pi";
+    const result = (0, child_process_1.spawnSync)(bin, args, {
+        stdio: "inherit",
+        env: managedPiEnv(env, agentDir, opts.key),
+        // pi's npm launcher is a .cmd shim on Windows.
+        shell: process.platform === "win32",
+    });
+    if (result.error && result.error.code === "ENOENT") {
+        throw new Error("pi isn't installed. Install it with `npm install -g @mariozechner/pi-coding-agent`, then run `codie --pi` again.");
+    }
+    if (result.error)
+        throw result.error;
+    return result.status === null ? 1 : result.status;
+}

package/dist/packs/harnesses.d.ts

@@ -1,6 +1,6 @@
 import { PackManifest } from "./manifest";
 import { RegistryEntry } from "./store";
-export declare const HARNESSES: readonly ["claude", "copilot", "codex", "cursor", "codie"];
+export declare const HARNESSES: readonly ["claude", "copilot", "codex", "cursor", "codie", "pi"];
 export type HarnessName = (typeof HARNESSES)[number];
 export interface RunResult {
     status: number | null;
@@ -67,5 +67,8 @@ export declare function installCursorPlugin(home: string, slug: string, sourceDi
 export declare function removeCursorPlugin(home: string, slug: string): boolean;
 export declare const cursorAdapter: Adapter;
 export declare const codieAdapter: Adapter;
+/** pi has no plugin system; it loads extra skill dirs from settings.json
+ * `skills`. Point it at the portable copy (no Claude model aliases). */
+export declare const piAdapter: Adapter;
 export declare const ADAPTERS: Adapter[];
 export declare function parseHarnessList(value: string | undefined): HarnessName[] | undefined;

package/dist/packs/harnesses.js

@@ -33,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ADAPTERS = exports.codieAdapter = exports.cursorAdapter = exports.CURSOR_MARKER = exports.codexAdapter = exports.copilotAdapter = exports.claudeAdapter = exports.HARNESSES = void 0;
+exports.ADAPTERS = exports.piAdapter = exports.codieAdapter = exports.cursorAdapter = exports.CURSOR_MARKER = exports.codexAdapter = exports.copilotAdapter = exports.claudeAdapter = exports.HARNESSES = void 0;
 exports.defaultRunner = defaultRunner;
 exports.onPath = onPath;
 exports.copyCursorSkills = copyCursorSkills;
@@ -51,7 +51,7 @@ const path = __importStar(require("path"));
 const child_process_1 = require("child_process");
 const harnessDirs_1 = require("../harnessDirs");
 const paths_1 = require("./paths");
-exports.HARNESSES = ["claude", "copilot", "codex", "cursor", "codie"];
+exports.HARNESSES = ["claude", "copilot", "codex", "cursor", "codie", "pi"];
 function defaultRunner(env) {
     return (command, args, options = {}) => {
         const result = (0, child_process_1.spawnSync)(command, args, {
@@ -395,7 +395,48 @@ exports.codieAdapter = {
     plan: () => "inject skills/agents/hook shim at next codie launch",
     uninstall: () => "removed from next `codie` launch",
 };
-exports.ADAPTERS = [exports.claudeAdapter, exports.copilotAdapter, exports.codexAdapter, exports.cursorAdapter, exports.codieAdapter];
+function piSettingsPath(env, home) {
+    return path.join((0, harnessDirs_1.piAgentDir)(env, home), "settings.json");
+}
+/** Rewrite pi's `skills` list, keeping every other setting. Refuses a
+ * settings file it can't parse rather than replacing the user's config. */
+function updatePiSkillPaths(file, update) {
+    let settings = {};
+    if (fs.existsSync(file)) {
+        const parsed = JSON.parse(fs.readFileSync(file, "utf8"));
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+            throw new Error(`${file} is not a JSON object; leaving it alone`);
+        settings = parsed;
+    }
+    const current = Array.isArray(settings.skills) ? settings.skills.filter((p) => typeof p === "string") : [];
+    const next = update(current);
+    if (next.length === current.length && next.every((p, i) => p === current[i]))
+        return false;
+    settings.skills = next;
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    const tmp = `${file}.${process.pid}.tmp`;
+    fs.writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
+    fs.renameSync(tmp, file);
+    return true;
+}
+/** pi has no plugin system; it loads extra skill dirs from settings.json
+ * `skills`. Point it at the portable copy (no Claude model aliases). */
+exports.piAdapter = {
+    name: "pi",
+    detect: (ctx) => onPath("pi", ctx.env) || fs.existsSync((0, harnessDirs_1.piAgentDir)(ctx.env, ctx.home)),
+    install: (ctx) => {
+        const skills = path.join(ctx.portablePluginDir, "skills");
+        const changed = updatePiSkillPaths(piSettingsPath(ctx.env, ctx.home), (paths) => paths.includes(skills) ? paths : [...paths, skills]);
+        return changed ? "installed" : "already installed";
+    },
+    plan: (ctx) => `add ${path.join(ctx.portablePluginDir, "skills")} to ${piSettingsPath(ctx.env, ctx.home)} skills`,
+    uninstall: (ctx) => {
+        const dir = (0, paths_1.pluginDir)((0, paths_1.portableRoot)(ctx.root), ctx.slug);
+        const changed = updatePiSkillPaths(piSettingsPath(ctx.env, ctx.home), (paths) => paths.filter((p) => p !== dir && !p.startsWith(dir + path.sep)));
+        return changed ? "uninstalled" : "already removed";
+    },
+};
+exports.ADAPTERS = [exports.claudeAdapter, exports.copilotAdapter, exports.codexAdapter, exports.cursorAdapter, exports.codieAdapter, exports.piAdapter];
 function parseHarnessList(value) {
     if (value === undefined)
         return undefined;

package/dist/piHooks.d.ts

@@ -0,0 +1,22 @@
+/** customType of the context message the Codiedev extension injects. */
+export declare const PI_CONTEXT_CUSTOM_TYPE = "codiedev";
+/**
+ * pi session JSONL → Claude Code-shaped JSONL.
+ *
+ * Every message entry is kept in file order, abandoned /tree branches
+ * included: they were real model calls and real tokens. Usage is pi's own
+ * per-call record (`input` is already the uncached part). Skill runs, user
+ * interrupts and provider errors become the records the shared parsers read:
+ * `pi.skill_invoked`, Claude's interrupt marker and a native `agent.error`.
+ */
+export declare function normalizePiTranscript(content: string): string;
+/** pi writes the session header at startup; no message yet means nothing to capture. */
+export declare function isPiTranscriptEmpty(content: string): boolean;
+/** How pi was launched, from its own argv (the extension runs in pi's process). */
+export declare function piLaunchFromArgv(argv: string[]): string;
+export declare function piExtensionPath(agentDir?: string): string;
+/** What `doctor` and the security install check report for pi. */
+export declare function inspectPiExtension(file?: string, security?: boolean): {
+    status: "pass" | "fail" | "not-installed";
+    detail: string;
+};

package/dist/piHooks.js

@@ -0,0 +1,257 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PI_CONTEXT_CUSTOM_TYPE = void 0;
+exports.normalizePiTranscript = normalizePiTranscript;
+exports.isPiTranscriptEmpty = isPiTranscriptEmpty;
+exports.piLaunchFromArgv = piLaunchFromArgv;
+exports.piExtensionPath = piExtensionPath;
+exports.inspectPiExtension = inspectPiExtension;
+// pi (@mariozechner/pi-coding-agent). pi has no hook config; it loads
+// TypeScript extensions from <agentDir>/extensions/, so Codiedev installs one
+// there (see installPiExtension in utils.ts) that forwards pi's events to the
+// same hook subcommands every other harness uses.
+//
+// pi writes its own session JSONL (<agentDir>/sessions/--<cwd>--/<ts>_<id>.jsonl)
+// and the extension passes that path as transcript_path. This file turns it
+// into the Claude Code shape the shared capture pipeline parses.
+//
+// Imports only node built-ins and harnessDirs (no utils.ts) so hook.ts,
+// utils.ts and securityInstall.ts can all import it without a cycle.
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const harnessDirs_1 = require("./harnessDirs");
+/** customType of the context message the Codiedev extension injects. */
+exports.PI_CONTEXT_CUSTOM_TYPE = "codiedev";
+const SKILL_EXPANSION = /^<skill name="([^"]{1,200})" location="[^"]*">/;
+const num = (n) => (typeof n === "number" && Number.isFinite(n) ? Math.max(0, n) : 0);
+function textOf(content) {
+    if (typeof content === "string")
+        return content;
+    if (!Array.isArray(content))
+        return "";
+    return content
+        .map((block) => (block?.type === "text" && typeof block.text === "string" ? block.text : ""))
+        .filter(Boolean)
+        .join("\n");
+}
+function userBlocks(content) {
+    if (typeof content === "string")
+        return [{ type: "text", text: content }];
+    if (!Array.isArray(content))
+        return [];
+    return content.flatMap((block) => block?.type === "text" && typeof block.text === "string"
+        ? [{ type: "text", text: block.text }]
+        // Image bytes never leave the machine; keep that one was attached.
+        : block?.type === "image" ? [{ type: "text", text: "[image]" }] : []);
+}
+/** `/x/skills/review/SKILL.md` → "review". pi's agent loads a listed skill by
+ * reading its SKILL.md; that read IS the invocation (docs/skills.md). */
+function skillFromPath(value) {
+    if (typeof value !== "string")
+        return null;
+    const m = value.replace(/\\/g, "/").match(/\/([^/]+)\/SKILL\.md$/);
+    return m ? m[1] : null;
+}
+/** A provider error's HTTP status, when pi kept it at the front ("429 …"). */
+function errorCode(message) {
+    return message.match(/^\s*(\d{3})\b/)?.[1] ?? "";
+}
+/**
+ * pi session JSONL → Claude Code-shaped JSONL.
+ *
+ * Every message entry is kept in file order, abandoned /tree branches
+ * included: they were real model calls and real tokens. Usage is pi's own
+ * per-call record (`input` is already the uncached part). Skill runs, user
+ * interrupts and provider errors become the records the shared parsers read:
+ * `pi.skill_invoked`, Claude's interrupt marker and a native `agent.error`.
+ */
+function normalizePiTranscript(content) {
+    const out = [];
+    const skillReads = new Map();
+    // pi retries a failed provider call on its own (and fires agent_end after
+    // each try). Every error in one retry streak carries the streak's first
+    // time, so limit events, which dedupe on time, count the hit once.
+    let errorStreakAt;
+    const push = (record) => out.push(JSON.stringify(record));
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        let entry;
+        try {
+            entry = JSON.parse(line);
+        }
+        catch {
+            continue; // pi may be mid-append
+        }
+        if (!entry || typeof entry !== "object")
+            continue;
+        const timestamp = typeof entry.timestamp === "string" ? entry.timestamp : undefined;
+        const uuid = typeof entry.id === "string" ? entry.id : undefined;
+        if (entry.type !== "message" || !entry.message || typeof entry.message !== "object")
+            continue;
+        const message = entry.message;
+        if (!(message.role === "assistant" && message.stopReason === "error"))
+            errorStreakAt = undefined;
+        if (message.role === "user") {
+            const text = textOf(message.content);
+            const skill = text.match(SKILL_EXPANSION)?.[1];
+            if (skill)
+                push({ type: "pi.skill_invoked", timestamp, skill });
+            push({ type: "user", uuid, timestamp, message: { role: "user", content: userBlocks(message.content) } });
+            continue;
+        }
+        if (message.role === "assistant") {
+            const blocks = [];
+            for (const block of Array.isArray(message.content) ? message.content : []) {
+                if (block?.type === "text" && typeof block.text === "string")
+                    blocks.push({ type: "text", text: block.text });
+                else if (block?.type === "thinking" && typeof block.thinking === "string")
+                    blocks.push({ type: "thinking", thinking: block.thinking });
+                else if (block?.type === "toolCall") {
+                    const input = block.arguments && typeof block.arguments === "object" ? block.arguments : {};
+                    blocks.push({ type: "tool_use", id: block.id, name: block.name ?? "tool", input });
+                    const skill = block.name === "read" ? skillFromPath(input.path) : null;
+                    if (skill && typeof block.id === "string")
+                        skillReads.set(block.id, skill);
+                }
+            }
+            const usage = message.usage ?? {};
+            const tokens = num(usage.input) + num(usage.output) + num(usage.cacheRead) + num(usage.cacheWrite);
+            // A failed call records all-zero usage; it was not a billed request.
+            const measured = tokens > 0 || message.stopReason !== "error";
+            push({
+                type: "assistant",
+                uuid,
+                timestamp,
+                message: {
+                    id: typeof message.responseId === "string" ? message.responseId : uuid,
+                    role: "assistant",
+                    model: typeof message.model === "string" ? message.model : undefined,
+                    ...(measured ? {
+                        usage: {
+                            input_tokens: num(usage.input),
+                            output_tokens: num(usage.output),
+                            cache_read_input_tokens: num(usage.cacheRead),
+                            cache_creation_input_tokens: num(usage.cacheWrite),
+                        },
+                    } : {}),
+                    content: blocks,
+                },
+            });
+            if (message.stopReason === "aborted") {
+                push({ type: "user", timestamp, message: { role: "user", content: [{ type: "text", text: "[Request interrupted by user]" }] } });
+            }
+            if (message.stopReason === "error" && typeof message.errorMessage === "string") {
+                // The call's own time, not the entry's write time, so interim and
+                // final captures agree.
+                errorStreakAt ??= typeof message.timestamp === "number" ? new Date(message.timestamp).toISOString() : timestamp;
+                push({
+                    type: "agent.error",
+                    timestamp: errorStreakAt,
+                    data: { errorContext: "model_call", error: { code: errorCode(message.errorMessage), message: message.errorMessage } },
+                });
+            }
+            continue;
+        }
+        if (message.role === "toolResult") {
+            const id = typeof message.toolCallId === "string" ? message.toolCallId : undefined;
+            const skill = id ? skillReads.get(id) : undefined;
+            if (skill && message.isError !== true)
+                push({ type: "pi.skill_invoked", timestamp, skill });
+            push({
+                type: "user",
+                uuid,
+                timestamp,
+                message: {
+                    role: "user",
+                    content: [{ type: "tool_result", tool_use_id: id, content: textOf(message.content), is_error: message.isError === true }],
+                },
+            });
+            continue;
+        }
+        // `!cmd` typed by the user: shown to the model like any user turn.
+        if (message.role === "bashExecution" && typeof message.command === "string") {
+            push({ type: "user", uuid, timestamp, message: { role: "user", content: [{ type: "text", text: `<bash-input>${message.command}</bash-input>` }] } });
+        }
+    }
+    return out.join("\n") + (out.length ? "\n" : "");
+}
+/** pi writes the session header at startup; no message yet means nothing to capture. */
+function isPiTranscriptEmpty(content) {
+    return !content.split("\n").some((line) => line.includes('"type":"message"'));
+}
+/** How pi was launched, from its own argv (the extension runs in pi's process). */
+function piLaunchFromArgv(argv) {
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        if (a === "-p" || a === "--print")
+            return "pi:print";
+        if (a === "--mode") {
+            const mode = argv[i + 1];
+            if (mode === "json" || mode === "rpc")
+                return `pi:${mode}`;
+        }
+        if (a === "--mode=json" || a === "--mode=rpc")
+            return `pi:${a.slice(7)}`;
+    }
+    return "pi:tui";
+}
+function piExtensionPath(agentDir = (0, harnessDirs_1.piAgentDir)()) {
+    return path.join(agentDir, "extensions", "codiedev.ts");
+}
+/** What `doctor` and the security install check report for pi. */
+function inspectPiExtension(file = piExtensionPath(), security = false) {
+    if (!fs.existsSync(file))
+        return { status: "not-installed", detail: `${file} not found` };
+    let source;
+    try {
+        source = fs.readFileSync(file, "utf8");
+    }
+    catch {
+        return { status: "fail", detail: `${file} unreadable` };
+    }
+    const expected = security
+        ? ["discover-pi", "security-pre-pi", "security-post-pi"]
+        : ["session-start-pi", "backup-pi", "capture-pi-final"];
+    // Quoted: "backup-pi" must not match inside some longer subcommand.
+    const missing = expected.filter((subcommand) => !source.includes(JSON.stringify(subcommand)));
+    if (missing.length)
+        return { status: "fail", detail: `missing ${missing.join(", ")} — re-run \`codiedev connect\`` };
+    if (security && source.includes("const AGENT_SECURITY_ENABLED = false;")) {
+        return { status: "fail", detail: "installed with agent security off — re-run `codiedev connect`" };
+    }
+    return { status: "pass", detail: security ? "prompt guard and tool telemetry installed" : `session start, capture and backup events (${(0, harnessDirs_1.displayPath)(file)})` };
+}