open-multi-agent-kit 0.80.5 → 0.80.7

package/dist/core/exec.js.map

@@ -1 +1 @@
-{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/core/exec.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAwBhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,OAAe,EACf,IAAc,EACd,GAAW,EACX,OAAqB,EACC;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG;YACH,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,SAAqC,CAAC;QAC1C,IAAI,kBAA8C,CAAC;QAEnD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrB,sDAAsD;gBACtD,qEAAqE;gBACrE,0DAA0D;gBAC1D,kBAAkB,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;oBACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,CAAC;gBAAA,CACD,EAAE,IAAI,CAAC,CAAC;gBACT,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;QAAA,CACD,CAAC;QAEF,sBAAsB;QACtB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC5B,WAAW,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC7C,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC5B,WAAW,EAAE,CAAC;YAAA,CACd,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAA,CAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAA,CAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;YAChC,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,kBAAkB;gBAAE,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAAA,CAC1C,CAAC;QAEF,0EAA0E;QAC1E,qCAAqC;QACrC,mBAAmB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAAA,CAClB,CAAC;aACD,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC,CAAC,CAAC;QAAA,CACV,CAAC,CAAC;IAAA,CACJ,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Shared command execution utilities for extensions and custom tools.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { waitForChildProcess } from \"../utils/child-process.ts\";\n\n/**\n * Options for executing shell commands.\n */\nexport interface ExecOptions {\n\t/** AbortSignal to cancel the command */\n\tsignal?: AbortSignal;\n\t/** Timeout in milliseconds */\n\ttimeout?: number;\n\t/** Working directory */\n\tcwd?: string;\n}\n\n/**\n * Result of executing a shell command.\n */\nexport interface ExecResult {\n\tstdout: string;\n\tstderr: string;\n\tcode: number;\n\tkilled: boolean;\n}\n\n/**\n * Execute a shell command and return stdout/stderr/code.\n * Supports timeout and abort signal.\n */\nexport async function execCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\toptions?: ExecOptions,\n): Promise<ExecResult> {\n\treturn new Promise((resolve) => {\n\t\tconst proc = spawn(command, args, {\n\t\t\tcwd,\n\t\t\tshell: false,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t});\n\n\t\tlet stdout = \"\";\n\t\tlet stderr = \"\";\n\t\tlet killed = false;\n\t\tlet timeoutId: NodeJS.Timeout | undefined;\n\t\tlet forceKillTimeoutId: NodeJS.Timeout | undefined;\n\n\t\tconst killProcess = () => {\n\t\t\tif (!killed) {\n\t\t\t\tkilled = true;\n\t\t\t\tproc.kill(\"SIGTERM\");\n\t\t\t\t// Force kill after 5 seconds if SIGTERM doesn't work.\n\t\t\t\t// Note: proc.killed only means a signal was successfully SENT, so we\n\t\t\t\t// must check whether the process actually exited instead.\n\t\t\t\tforceKillTimeoutId = setTimeout(() => {\n\t\t\t\t\tif (proc.exitCode === null && proc.signalCode === null) {\n\t\t\t\t\t\tproc.kill(\"SIGKILL\");\n\t\t\t\t\t}\n\t\t\t\t}, 5000);\n\t\t\t\tforceKillTimeoutId.unref();\n\t\t\t}\n\t\t};\n\n\t\t// Handle abort signal\n\t\tif (options?.signal) {\n\t\t\tif (options.signal.aborted) {\n\t\t\t\tkillProcess();\n\t\t\t} else {\n\t\t\t\toptions.signal.addEventListener(\"abort\", killProcess, { once: true });\n\t\t\t}\n\t\t}\n\n\t\t// Handle timeout\n\t\tif (options?.timeout && options.timeout > 0) {\n\t\t\ttimeoutId = setTimeout(() => {\n\t\t\t\tkillProcess();\n\t\t\t}, options.timeout);\n\t\t}\n\n\t\tproc.stdout?.on(\"data\", (data) => {\n\t\t\tstdout += data.toString();\n\t\t});\n\n\t\tproc.stderr?.on(\"data\", (data) => {\n\t\t\tstderr += data.toString();\n\t\t});\n\n\t\tconst settle = (code: number) => {\n\t\t\tif (timeoutId) clearTimeout(timeoutId);\n\t\t\tif (forceKillTimeoutId) clearTimeout(forceKillTimeoutId);\n\t\t\tif (options?.signal) {\n\t\t\t\toptions.signal.removeEventListener(\"abort\", killProcess);\n\t\t\t}\n\t\t\tresolve({ stdout, stderr, code, killed });\n\t\t};\n\n\t\t// Wait for process termination without hanging on inherited stdio handles\n\t\t// held open by detached descendants.\n\t\twaitForChildProcess(proc)\n\t\t\t.then((code) => {\n\t\t\t\tsettle(code ?? 0);\n\t\t\t})\n\t\t\t.catch((_err) => {\n\t\t\t\tsettle(1);\n\t\t\t});\n\t});\n}\n"]}
+{"version":3,"file":"exec.js","sourceRoot":"","sources":["../../src/core/exec.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AA0BhE;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAChC,OAAe,EACf,IAAc,EACd,GAAW,EACX,OAAqB,EACC;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE;YACjC,GAAG;YACH,GAAG,EAAE,OAAO,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG;YAChC,KAAK,EAAE,KAAK;YACZ,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SACjC,CAAC,CAAC;QAEH,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,IAAI,SAAqC,CAAC;QAC1C,IAAI,kBAA8C,CAAC;QAEnD,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC;YACzB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,GAAG,IAAI,CAAC;gBACd,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACrB,sDAAsD;gBACtD,qEAAqE;gBACrE,0DAA0D;gBAC1D,kBAAkB,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;oBACrC,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;wBACxD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACtB,CAAC;gBAAA,CACD,EAAE,IAAI,CAAC,CAAC;gBACT,kBAAkB,CAAC,KAAK,EAAE,CAAC;YAC5B,CAAC;QAAA,CACD,CAAC;QAEF,sBAAsB;QACtB,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;YACrB,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC5B,WAAW,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACP,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACvE,CAAC;QACF,CAAC;QAED,iBAAiB;QACjB,IAAI,OAAO,EAAE,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;YAC7C,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC;gBAC5B,WAAW,EAAE,CAAC;YAAA,CACd,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAA,CAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;YACjC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAA,CAC1B,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC;YAChC,IAAI,SAAS;gBAAE,YAAY,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,kBAAkB;gBAAE,YAAY,CAAC,kBAAkB,CAAC,CAAC;YACzD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;gBACrB,OAAO,CAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAAA,CAC1C,CAAC;QAEF,0EAA0E;QAC1E,qCAAqC;QACrC,mBAAmB,CAAC,IAAI,CAAC;aACvB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;QAAA,CAClB,CAAC;aACD,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAChB,MAAM,CAAC,CAAC,CAAC,CAAC;QAAA,CACV,CAAC,CAAC;IAAA,CACJ,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Shared command execution utilities for extensions and custom tools.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { waitForChildProcess } from \"../utils/child-process.ts\";\n\n/**\n * Options for executing shell commands.\n */\nexport interface ExecOptions {\n\t/** AbortSignal to cancel the command */\n\tsignal?: AbortSignal;\n\t/** Timeout in milliseconds */\n\ttimeout?: number;\n\t/** Working directory */\n\tcwd?: string;\n\t/** Environment variables for the spawned process. Defaults to the parent environment. */\n\tenv?: NodeJS.ProcessEnv;\n}\n\n/**\n * Result of executing a shell command.\n */\nexport interface ExecResult {\n\tstdout: string;\n\tstderr: string;\n\tcode: number;\n\tkilled: boolean;\n}\n\n/**\n * Execute a shell command and return stdout/stderr/code.\n * Supports timeout and abort signal.\n */\nexport async function execCommand(\n\tcommand: string,\n\targs: string[],\n\tcwd: string,\n\toptions?: ExecOptions,\n): Promise<ExecResult> {\n\treturn new Promise((resolve) => {\n\t\tconst proc = spawn(command, args, {\n\t\t\tcwd,\n\t\t\tenv: options?.env ?? process.env,\n\t\t\tshell: false,\n\t\t\tstdio: [\"ignore\", \"pipe\", \"pipe\"],\n\t\t});\n\n\t\tlet stdout = \"\";\n\t\tlet stderr = \"\";\n\t\tlet killed = false;\n\t\tlet timeoutId: NodeJS.Timeout | undefined;\n\t\tlet forceKillTimeoutId: NodeJS.Timeout | undefined;\n\n\t\tconst killProcess = () => {\n\t\t\tif (!killed) {\n\t\t\t\tkilled = true;\n\t\t\t\tproc.kill(\"SIGTERM\");\n\t\t\t\t// Force kill after 5 seconds if SIGTERM doesn't work.\n\t\t\t\t// Note: proc.killed only means a signal was successfully SENT, so we\n\t\t\t\t// must check whether the process actually exited instead.\n\t\t\t\tforceKillTimeoutId = setTimeout(() => {\n\t\t\t\t\tif (proc.exitCode === null && proc.signalCode === null) {\n\t\t\t\t\t\tproc.kill(\"SIGKILL\");\n\t\t\t\t\t}\n\t\t\t\t}, 5000);\n\t\t\t\tforceKillTimeoutId.unref();\n\t\t\t}\n\t\t};\n\n\t\t// Handle abort signal\n\t\tif (options?.signal) {\n\t\t\tif (options.signal.aborted) {\n\t\t\t\tkillProcess();\n\t\t\t} else {\n\t\t\t\toptions.signal.addEventListener(\"abort\", killProcess, { once: true });\n\t\t\t}\n\t\t}\n\n\t\t// Handle timeout\n\t\tif (options?.timeout && options.timeout > 0) {\n\t\t\ttimeoutId = setTimeout(() => {\n\t\t\t\tkillProcess();\n\t\t\t}, options.timeout);\n\t\t}\n\n\t\tproc.stdout?.on(\"data\", (data) => {\n\t\t\tstdout += data.toString();\n\t\t});\n\n\t\tproc.stderr?.on(\"data\", (data) => {\n\t\t\tstderr += data.toString();\n\t\t});\n\n\t\tconst settle = (code: number) => {\n\t\t\tif (timeoutId) clearTimeout(timeoutId);\n\t\t\tif (forceKillTimeoutId) clearTimeout(forceKillTimeoutId);\n\t\t\tif (options?.signal) {\n\t\t\t\toptions.signal.removeEventListener(\"abort\", killProcess);\n\t\t\t}\n\t\t\tresolve({ stdout, stderr, code, killed });\n\t\t};\n\n\t\t// Wait for process termination without hanging on inherited stdio handles\n\t\t// held open by detached descendants.\n\t\twaitForChildProcess(proc)\n\t\t\t.then((code) => {\n\t\t\t\tsettle(code ?? 0);\n\t\t\t})\n\t\t\t.catch((_err) => {\n\t\t\t\tsettle(1);\n\t\t\t});\n\t});\n}\n"]}

package/dist/core/export-html/template.js

@@ -20,7 +20,7 @@
 
       // Parse URL parameters for deep linking: leafId and targetId
       // Check for injected params (when loaded in iframe via srcdoc) or use window.location
-      const injectedParams = document.querySelector('meta[name="pi-url-params"]');
+      const injectedParams = document.querySelector('meta[name="omk-url-params"]');
       const searchString = injectedParams ? injectedParams.content : window.location.search.substring(1);
       const urlParams = new URLSearchParams(searchString);
       const urlLeafId = urlParams.get('leafId');
@@ -1097,7 +1097,7 @@
         // Check for injected base URL (used when loaded in iframe via srcdoc)
         const baseUrlMeta =
           document.querySelector('meta[name="omk-share-base-url"]') ||
-          document.querySelector('meta[name="pi-share-base-url"]');
+          document.querySelector('meta[name="omk-share-base-url"]');
         const baseUrl = baseUrlMeta ? baseUrlMeta.content : window.location.href.split('?')[0];
 
         const url = new URL(window.location.href);

package/dist/core/extensions/builtin/command-safety-gate.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Built-in command-safety gate extension.
+ *
+ * Wires the pure `classifyShellCommand` verdict engine into the live bash entry
+ * points with one shared decision engine (`evaluateCommandGate`):
+ * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop
+ *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a
+ *   dialog-capable UI is available and otherwise deny headlessly (parity with
+ *   user bash). `priv.*` is never auto-allowed.
+ * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic
+ *   FAILED `BashResult` instead of running the command.
+ * - RPC bash routes through `AgentSession.executeBash({ safetyGate: "headless" })`
+ *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.
+ *
+ * Fail-closed contract:
+ * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the
+ *   runner and default execution continues (fail-open). Returning a synthetic
+ *   failed `result` short-circuits execution safely.
+ * - `confirm`-tier verdicts deny by default when no interactive UI is available.
+ * - `priv.*` verdicts are never headless-allowed.
+ *
+ * This gate reuses `command-safety.ts` read-only and adds no new classification
+ * branches. `extraDeny` patterns can only promote allow/confirm to block; they
+ * can never relax a block verdict.
+ */
+import type { BashResult } from "../../bash-executor.ts";
+import { type ExtensionAPI } from "../types.ts";
+/** Confirmation callback. Returns true when the user approves execution. */
+export type ConfirmFn = (message: string) => Promise<boolean>;
+/** Options controlling how a bash command is evaluated by the shared gate. */
+export interface CommandGateOptions {
+    /** Whether a dialog-capable UI is available for confirmation. */
+    hasUI: boolean;
+    /** Interactive confirmation callback used when `hasUI` is true. */
+    confirm?: ConfirmFn;
+    /** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to "deny". */
+    headlessConfirmPolicy?: "deny" | "allow";
+    /** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */
+    extraDeny?: string[];
+}
+/** @deprecated Back-compat alias for {@link CommandGateOptions}. */
+export type UserBashEvaluateOptions = CommandGateOptions;
+/**
+ * Pure block-only check for an LLM `bash` tool call.
+ *
+ * Only block-tier verdicts produce a block here; confirm/allow pass through.
+ * Used as a low-level non-negotiable floor (for example by the bash tool's
+ * effective-command check after commandPrefix/spawnHook) where no confirm UI
+ * or policy context exists. The confirm-deny behavior for the live tool_call
+ * gate lives in {@link evaluateCommandGate}.
+ */
+export declare function evaluateBashToolCall(command: string, extraDeny?: string[]): {
+    block: true;
+    reason: string;
+} | undefined;
+/**
+ * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).
+ *
+ * - block  => deny.
+ * - confirm => hasUI ? (approved ? undefined : deny) : (policy === "allow" && !priv ? undefined : deny).
+ * - allow  => undefined (preserve later extensions / default execution).
+ */
+export declare function evaluateCommandGate(command: string, opts: CommandGateOptions): Promise<{
+    deny: boolean;
+    reason: string;
+} | undefined>;
+/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */
+export declare const evaluateUserBash: typeof evaluateCommandGate;
+/** Build a synthetic failed `BashResult` surfacing the safety reason. */
+export declare function buildBlockedBashResult(reason: string): BashResult;
+/**
+ * Extension factory. Registered as the first extension so its handlers run
+ * before any discovered extension (`tool_call` short-circuits on first block;
+ * `user_bash` short-circuits on first truthy result).
+ */
+export default function commandSafetyGate(omk: ExtensionAPI): void;
+//# sourceMappingURL=command-safety-gate.d.ts.map

package/dist/core/extensions/builtin/command-safety-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety-gate.d.ts","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzD,OAAO,EAAE,KAAK,YAAY,EAAuB,MAAM,aAAa,CAAC;AAErE,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,WAAW,kBAAkB;IAClC,iEAAiE;IACjE,KAAK,EAAE,OAAO,CAAC;IACf,mEAAmE;IACnE,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,kGAAkG;IAClG,qBAAqB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,4FAA4F;IAC5F,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,oEAAoE;AACpE,MAAM,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAiCzD;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,SAAS,CAAC,EAAE,MAAM,EAAE,GAClB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAM7C;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAAC,CAwBxD;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,4BAAsB,CAAC;AAEpD,yEAAyE;AACzE,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAOjE;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CAyBjE","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tif (opts.hasUI) {\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}

package/dist/core/extensions/builtin/command-safety-gate.js

@@ -0,0 +1,147 @@
+/**
+ * Built-in command-safety gate extension.
+ *
+ * Wires the pure `classifyShellCommand` verdict engine into the live bash entry
+ * points with one shared decision engine (`evaluateCommandGate`):
+ * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop
+ *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a
+ *   dialog-capable UI is available and otherwise deny headlessly (parity with
+ *   user bash). `priv.*` is never auto-allowed.
+ * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic
+ *   FAILED `BashResult` instead of running the command.
+ * - RPC bash routes through `AgentSession.executeBash({ safetyGate: "headless" })`
+ *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.
+ *
+ * Fail-closed contract:
+ * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the
+ *   runner and default execution continues (fail-open). Returning a synthetic
+ *   failed `result` short-circuits execution safely.
+ * - `confirm`-tier verdicts deny by default when no interactive UI is available.
+ * - `priv.*` verdicts are never headless-allowed.
+ *
+ * This gate reuses `command-safety.ts` read-only and adds no new classification
+ * branches. `extraDeny` patterns can only promote allow/confirm to block; they
+ * can never relax a block verdict.
+ */
+import { classifyShellCommand } from "../../command-safety.js";
+import { isToolCallEventType } from "../types.js";
+function formatReason(verdict) {
+    return `[${verdict.rule}] ${verdict.reason}`;
+}
+function matchesExtraDeny(command, patterns) {
+    if (!patterns || patterns.length === 0)
+        return false;
+    for (const pattern of patterns) {
+        if (pattern.length > 0 && command.includes(pattern))
+            return true;
+    }
+    return false;
+}
+/**
+ * Classify a command, applying `extraDeny` promotion.
+ *
+ * `extraDeny` can only escalate allow/confirm to block; an existing block
+ * verdict is returned unchanged.
+ */
+function classifyWithExtraDeny(command, extraDeny) {
+    const verdict = classifyShellCommand(command);
+    if (verdict.risk === "block")
+        return verdict;
+    if (matchesExtraDeny(command, extraDeny)) {
+        return {
+            risk: "block",
+            rule: "command.extra_deny",
+            reason: "Command matches a configured deny pattern.",
+        };
+    }
+    return verdict;
+}
+/**
+ * Pure block-only check for an LLM `bash` tool call.
+ *
+ * Only block-tier verdicts produce a block here; confirm/allow pass through.
+ * Used as a low-level non-negotiable floor (for example by the bash tool's
+ * effective-command check after commandPrefix/spawnHook) where no confirm UI
+ * or policy context exists. The confirm-deny behavior for the live tool_call
+ * gate lives in {@link evaluateCommandGate}.
+ */
+export function evaluateBashToolCall(command, extraDeny) {
+    const verdict = classifyWithExtraDeny(command, extraDeny);
+    if (verdict.risk === "block") {
+        return { block: true, reason: formatReason(verdict) };
+    }
+    return undefined;
+}
+/**
+ * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).
+ *
+ * - block  => deny.
+ * - confirm => hasUI ? (approved ? undefined : deny) : (policy === "allow" && !priv ? undefined : deny).
+ * - allow  => undefined (preserve later extensions / default execution).
+ */
+export async function evaluateCommandGate(command, opts) {
+    const verdict = classifyWithExtraDeny(command, opts.extraDeny);
+    if (verdict.risk === "allow")
+        return undefined;
+    if (verdict.risk === "block") {
+        return { deny: true, reason: formatReason(verdict) };
+    }
+    // confirm-tier verdict.
+    if (opts.hasUI) {
+        if (opts.confirm) {
+            const approved = await opts.confirm(formatReason(verdict));
+            return approved ? undefined : { deny: true, reason: formatReason(verdict) };
+        }
+        // UI claimed but no confirm callback: cannot obtain consent => fail-closed.
+        return { deny: true, reason: formatReason(verdict) };
+    }
+    // Headless: privilege escalation is never auto-allowed.
+    const isPrivilege = verdict.rule.startsWith("priv.");
+    if (!isPrivilege && opts.headlessConfirmPolicy === "allow") {
+        return undefined;
+    }
+    return { deny: true, reason: formatReason(verdict) };
+}
+/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */
+export const evaluateUserBash = evaluateCommandGate;
+/** Build a synthetic failed `BashResult` surfacing the safety reason. */
+export function buildBlockedBashResult(reason) {
+    return {
+        output: `command-safety: blocked\n${reason}`,
+        exitCode: 1,
+        cancelled: false,
+        truncated: false,
+    };
+}
+/**
+ * Extension factory. Registered as the first extension so its handlers run
+ * before any discovered extension (`tool_call` short-circuits on first block;
+ * `user_bash` short-circuits on first truthy result).
+ */
+export default function commandSafetyGate(omk) {
+    omk.on("tool_call", async (event, ctx) => {
+        if (!isToolCallEventType("bash", event))
+            return undefined;
+        const decision = await evaluateCommandGate(event.input.command, {
+            hasUI: ctx.hasUI,
+            confirm: ctx.hasUI ? (message) => ctx.ui.confirm("Command safety", message) : undefined,
+            headlessConfirmPolicy: "deny",
+        });
+        if (decision?.deny) {
+            return { block: true, reason: decision.reason };
+        }
+        return undefined;
+    });
+    omk.on("user_bash", async (event, ctx) => {
+        const decision = await evaluateCommandGate(event.command, {
+            hasUI: ctx.hasUI,
+            confirm: ctx.hasUI ? (message) => ctx.ui.confirm("Command safety", message) : undefined,
+            headlessConfirmPolicy: "deny",
+        });
+        if (decision?.deny) {
+            return { result: buildBlockedBashResult(decision.reason) };
+        }
+        return undefined;
+    });
+}
+//# sourceMappingURL=command-safety-gate.js.map

package/dist/core/extensions/builtin/command-safety-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-safety-gate.js","sourceRoot":"","sources":["../../../../src/core/extensions/builtin/command-safety-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAGH,OAAO,EAAuB,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAqB,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAoBrE,SAAS,YAAY,CAAC,OAAuB,EAAU;IACtD,OAAO,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;AAAA,CAC7C;AAED,SAAS,gBAAgB,CAAC,OAAe,EAAE,QAA8B,EAAW;IACnF,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;IAClE,CAAC;IACD,OAAO,KAAK,CAAC;AAAA,CACb;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAoB,EAAkB;IACrF,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IAC7C,IAAI,gBAAgB,CAAC,OAAO,EAAE,SAAS,CAAC,EAAE,CAAC;QAC1C,OAAO;YACN,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,oBAAoB;YAC1B,MAAM,EAAE,4CAA4C;SACpD,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAAA,CACf;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAe,EACf,SAAoB,EAC0B;IAC9C,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,SAAS,CAAC;AAAA,CACjB;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAe,EACf,IAAwB,EACiC;IACzD,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAE/D,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wBAAwB;IACxB,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,OAAO,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,CAAC;QACD,4EAA4E;QAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,wDAAwD;IACxD,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,qBAAqB,KAAK,OAAO,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC;AAAA,CACrD;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAEpD,yEAAyE;AACzE,MAAM,UAAU,sBAAsB,CAAC,MAAc,EAAc;IAClE,OAAO;QACN,MAAM,EAAE,4BAA4B,MAAM,EAAE;QAC5C,QAAQ,EAAE,CAAC;QACX,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;KAChB,CAAC;AAAA,CACF;AAED;;;;GAIG;AACH,MAAM,CAAC,OAAO,UAAU,iBAAiB,CAAC,GAAiB,EAAQ;IAClE,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE;YAC/D,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,qBAAqB,EAAE,MAAM;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;IAEH,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC;QACzC,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,OAAO,EAAE;YACzD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;YACvF,qBAAqB,EAAE,MAAM;SAC7B,CAAC,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5D,CAAC;QACD,OAAO,SAAS,CAAC;IAAA,CACjB,CAAC,CAAC;AAAA,CACH","sourcesContent":["/**\n * Built-in command-safety gate extension.\n *\n * Wires the pure `classifyShellCommand` verdict engine into the live bash entry\n * points with one shared decision engine (`evaluateCommandGate`):\n * - LLM tool calls (`tool_call` for the `bash` tool) — block-tier verdicts stop\n *   execution via `{ block, reason }`. confirm-tier verdicts prompt when a\n *   dialog-capable UI is available and otherwise deny headlessly (parity with\n *   user bash). `priv.*` is never auto-allowed.\n * - User `!`/`!!` bash (`user_bash`) — block/confirm verdicts produce a synthetic\n *   FAILED `BashResult` instead of running the command.\n * - RPC bash routes through `AgentSession.executeBash({ safetyGate: \"headless\" })`\n *   which reuses `evaluateCommandGate` and `buildBlockedBashResult` directly.\n *\n * Fail-closed contract:\n * - `user_bash` deny NEVER throws. A thrown `user_bash` handler is logged by the\n *   runner and default execution continues (fail-open). Returning a synthetic\n *   failed `result` short-circuits execution safely.\n * - `confirm`-tier verdicts deny by default when no interactive UI is available.\n * - `priv.*` verdicts are never headless-allowed.\n *\n * This gate reuses `command-safety.ts` read-only and adds no new classification\n * branches. `extraDeny` patterns can only promote allow/confirm to block; they\n * can never relax a block verdict.\n */\n\nimport type { BashResult } from \"../../bash-executor.ts\";\nimport { type CommandVerdict, classifyShellCommand } from \"../../command-safety.ts\";\nimport { type ExtensionAPI, isToolCallEventType } from \"../types.ts\";\n\n/** Confirmation callback. Returns true when the user approves execution. */\nexport type ConfirmFn = (message: string) => Promise<boolean>;\n\n/** Options controlling how a bash command is evaluated by the shared gate. */\nexport interface CommandGateOptions {\n\t/** Whether a dialog-capable UI is available for confirmation. */\n\thasUI: boolean;\n\t/** Interactive confirmation callback used when `hasUI` is true. */\n\tconfirm?: ConfirmFn;\n\t/** Headless policy for `confirm`-tier verdicts. `priv.*` is never allowed. Defaults to \"deny\". */\n\theadlessConfirmPolicy?: \"deny\" | \"allow\";\n\t/** Extra substrings that promote allow/confirm verdicts to block. Never relaxes a block. */\n\textraDeny?: string[];\n}\n\n/** @deprecated Back-compat alias for {@link CommandGateOptions}. */\nexport type UserBashEvaluateOptions = CommandGateOptions;\n\nfunction formatReason(verdict: CommandVerdict): string {\n\treturn `[${verdict.rule}] ${verdict.reason}`;\n}\n\nfunction matchesExtraDeny(command: string, patterns: string[] | undefined): boolean {\n\tif (!patterns || patterns.length === 0) return false;\n\tfor (const pattern of patterns) {\n\t\tif (pattern.length > 0 && command.includes(pattern)) return true;\n\t}\n\treturn false;\n}\n\n/**\n * Classify a command, applying `extraDeny` promotion.\n *\n * `extraDeny` can only escalate allow/confirm to block; an existing block\n * verdict is returned unchanged.\n */\nfunction classifyWithExtraDeny(command: string, extraDeny?: string[]): CommandVerdict {\n\tconst verdict = classifyShellCommand(command);\n\tif (verdict.risk === \"block\") return verdict;\n\tif (matchesExtraDeny(command, extraDeny)) {\n\t\treturn {\n\t\t\trisk: \"block\",\n\t\t\trule: \"command.extra_deny\",\n\t\t\treason: \"Command matches a configured deny pattern.\",\n\t\t};\n\t}\n\treturn verdict;\n}\n\n/**\n * Pure block-only check for an LLM `bash` tool call.\n *\n * Only block-tier verdicts produce a block here; confirm/allow pass through.\n * Used as a low-level non-negotiable floor (for example by the bash tool's\n * effective-command check after commandPrefix/spawnHook) where no confirm UI\n * or policy context exists. The confirm-deny behavior for the live tool_call\n * gate lives in {@link evaluateCommandGate}.\n */\nexport function evaluateBashToolCall(\n\tcommand: string,\n\textraDeny?: string[],\n): { block: true; reason: string } | undefined {\n\tconst verdict = classifyWithExtraDeny(command, extraDeny);\n\tif (verdict.risk === \"block\") {\n\t\treturn { block: true, reason: formatReason(verdict) };\n\t}\n\treturn undefined;\n}\n\n/**\n * Shared gate decision for any bash command (LLM tool call, user bash, RPC bash).\n *\n * - block  => deny.\n * - confirm => hasUI ? (approved ? undefined : deny) : (policy === \"allow\" && !priv ? undefined : deny).\n * - allow  => undefined (preserve later extensions / default execution).\n */\nexport async function evaluateCommandGate(\n\tcommand: string,\n\topts: CommandGateOptions,\n): Promise<{ deny: boolean; reason: string } | undefined> {\n\tconst verdict = classifyWithExtraDeny(command, opts.extraDeny);\n\n\tif (verdict.risk === \"allow\") return undefined;\n\tif (verdict.risk === \"block\") {\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// confirm-tier verdict.\n\tif (opts.hasUI) {\n\t\tif (opts.confirm) {\n\t\t\tconst approved = await opts.confirm(formatReason(verdict));\n\t\t\treturn approved ? undefined : { deny: true, reason: formatReason(verdict) };\n\t\t}\n\t\t// UI claimed but no confirm callback: cannot obtain consent => fail-closed.\n\t\treturn { deny: true, reason: formatReason(verdict) };\n\t}\n\n\t// Headless: privilege escalation is never auto-allowed.\n\tconst isPrivilege = verdict.rule.startsWith(\"priv.\");\n\tif (!isPrivilege && opts.headlessConfirmPolicy === \"allow\") {\n\t\treturn undefined;\n\t}\n\treturn { deny: true, reason: formatReason(verdict) };\n}\n\n/** @deprecated Back-compat alias; prefer {@link evaluateCommandGate}. */\nexport const evaluateUserBash = evaluateCommandGate;\n\n/** Build a synthetic failed `BashResult` surfacing the safety reason. */\nexport function buildBlockedBashResult(reason: string): BashResult {\n\treturn {\n\t\toutput: `command-safety: blocked\\n${reason}`,\n\t\texitCode: 1,\n\t\tcancelled: false,\n\t\ttruncated: false,\n\t};\n}\n\n/**\n * Extension factory. Registered as the first extension so its handlers run\n * before any discovered extension (`tool_call` short-circuits on first block;\n * `user_bash` short-circuits on first truthy result).\n */\nexport default function commandSafetyGate(omk: ExtensionAPI): void {\n\tomk.on(\"tool_call\", async (event, ctx) => {\n\t\tif (!isToolCallEventType(\"bash\", event)) return undefined;\n\t\tconst decision = await evaluateCommandGate(event.input.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { block: true, reason: decision.reason };\n\t\t}\n\t\treturn undefined;\n\t});\n\n\tomk.on(\"user_bash\", async (event, ctx) => {\n\t\tconst decision = await evaluateCommandGate(event.command, {\n\t\t\thasUI: ctx.hasUI,\n\t\t\tconfirm: ctx.hasUI ? (message) => ctx.ui.confirm(\"Command safety\", message) : undefined,\n\t\t\theadlessConfirmPolicy: \"deny\",\n\t\t});\n\t\tif (decision?.deny) {\n\t\t\treturn { result: buildBlockedBashResult(decision.reason) };\n\t\t}\n\t\treturn undefined;\n\t});\n}\n"]}

package/dist/core/extensions/loader.d.ts

@@ -3,7 +3,7 @@
  *
  */
 import { type EventBus } from "../event-bus.ts";
-import type { Extension, ExtensionFactory, ExtensionRuntime, LoadExtensionsResult } from "./types.ts";
+import type { Extension, ExtensionFactory, ExtensionRuntime, LoadExtensionsOptions, LoadExtensionsResult } from "./types.ts";
 /**
  * Create a runtime with throwing stubs for action methods.
  * Runner.bindCore() replaces these with real implementations.
@@ -12,13 +12,13 @@ export declare function createExtensionRuntime(): ExtensionRuntime;
 /**
  * Create an Extension from an inline factory function.
  */
-export declare function loadExtensionFromFactory(factory: ExtensionFactory, cwd: string, eventBus: EventBus, runtime: ExtensionRuntime, extensionPath?: string): Promise<Extension>;
+export declare function loadExtensionFromFactory(factory: ExtensionFactory, cwd: string, eventBus: EventBus, runtime: ExtensionRuntime, extensionPath?: string, options?: LoadExtensionsOptions): Promise<Extension>;
 /**
  * Load extensions from paths.
  */
-export declare function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus): Promise<LoadExtensionsResult>;
+export declare function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus, options?: LoadExtensionsOptions): Promise<LoadExtensionsResult>;
 /**
  * Discover and load extensions from standard locations.
  */
-export declare function discoverAndLoadExtensions(configuredPaths: string[], cwd: string, agentDir?: string, eventBus?: EventBus): Promise<LoadExtensionsResult>;
+export declare function discoverAndLoadExtensions(configuredPaths: string[], cwd: string, agentDir?: string, eventBus?: EventBus, options?: LoadExtensionsOptions): Promise<LoadExtensionsResult>;
 //# sourceMappingURL=loader.d.ts.map

package/dist/core/extensions/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/core/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAIhE,OAAO,KAAK,EACX,SAAS,EAET,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,EAKpB,MAAM,YAAY,CAAC;AAyFpB;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CA8CzD;AA4OD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,gBAAgB,EACzB,aAAa,SAAa,GACxB,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAyBrH;AA6GD;;GAEG;AACH,wBAAsB,yBAAyB,CAC9C,eAAe,EAAE,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAsB,EAChC,QAAQ,CAAC,EAAE,QAAQ,GACjB,OAAO,CAAC,oBAAoB,CAAC,CA2C/B","sourcesContent":["/**\n * Extension loader - loads TypeScript extension modules using jiti.\n *\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as _bundledPiAgentCore from \"@earendil-works/omk-agent-core\";\nimport * as _bundledPiAi from \"@earendil-works/omk-ai\";\nimport * as _bundledPiAiOauth from \"@earendil-works/omk-ai/oauth\";\nimport type { KeyId } from \"@earendil-works/omk-tui\";\nimport * as _bundledPiTui from \"@earendil-works/omk-tui\";\nimport { createJiti } from \"jiti/static\";\n// Static imports of packages that extensions may use.\n// These MUST be static so Bun bundles them into the compiled binary.\n// The virtualModules option then makes them available to extensions.\nimport * as _bundledTypebox from \"typebox\";\nimport * as _bundledTypeboxCompile from \"typebox/compile\";\nimport * as _bundledTypeboxValue from \"typebox/value\";\nimport { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from \"../../config.ts\";\n// NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,\n// avoiding a circular dependency. Extensions can import from open-multi-agent-kit.\nimport * as _bundledPiCodingAgent from \"../../index.ts\";\nimport { resolvePath } from \"../../utils/paths.ts\";\nimport { createEventBus, type EventBus } from \"../event-bus.ts\";\nimport type { ExecOptions } from \"../exec.ts\";\nimport { execCommand } from \"../exec.ts\";\nimport { createSyntheticSourceInfo } from \"../source-info.ts\";\nimport type {\n\tExtension,\n\tExtensionAPI,\n\tExtensionFactory,\n\tExtensionRuntime,\n\tLoadExtensionsResult,\n\tMessageRenderer,\n\tProviderConfig,\n\tRegisteredCommand,\n\tToolDefinition,\n} from \"./types.ts\";\n\n/** Modules available to extensions via virtualModules (for compiled Bun binary) */\nconst VIRTUAL_MODULES: Record<string, unknown> = {\n\ttypebox: _bundledTypebox,\n\t\"typebox/compile\": _bundledTypeboxCompile,\n\t\"typebox/value\": _bundledTypeboxValue,\n\t\"@sinclair/typebox\": _bundledTypebox,\n\t\"@sinclair/typebox/compile\": _bundledTypeboxCompile,\n\t\"@sinclair/typebox/value\": _bundledTypeboxValue,\n\t\"@earendil-works/omk-agent-core\": _bundledPiAgentCore,\n\t\"@earendil-works/omk-tui\": _bundledPiTui,\n\t\"@earendil-works/omk-ai\": _bundledPiAi,\n\t\"@earendil-works/omk-ai/oauth\": _bundledPiAiOauth,\n\t\"open-multi-agent-kit\": _bundledPiCodingAgent,\n\t\"@earendil-works/pi-agent-core\": _bundledPiAgentCore,\n\t\"@earendil-works/pi-tui\": _bundledPiTui,\n\t\"@earendil-works/pi-ai\": _bundledPiAi,\n\t\"@earendil-works/pi-ai/oauth\": _bundledPiAiOauth,\n\t\"@earendil-works/pi-coding-agent\": _bundledPiCodingAgent,\n\t\"@mariozechner/pi-agent-core\": _bundledPiAgentCore,\n\t\"@mariozechner/pi-tui\": _bundledPiTui,\n\t\"@mariozechner/pi-ai\": _bundledPiAi,\n\t\"@mariozechner/pi-ai/oauth\": _bundledPiAiOauth,\n\t\"@mariozechner/pi-coding-agent\": _bundledPiCodingAgent,\n};\n\nconst require = createRequire(import.meta.url);\n\n/**\n * Get aliases for jiti (used in Node.js/development mode).\n * In Bun binary mode, virtualModules is used instead.\n */\nlet _aliases: Record<string, string> | null = null;\n\nfunction getAliases(): Record<string, string> {\n\tif (_aliases) return _aliases;\n\n\tconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\tconst packageIndex = path.resolve(__dirname, \"../..\", \"index.js\");\n\n\tconst typeboxEntry = require.resolve(\"typebox\");\n\tconst typeboxCompileEntry = require.resolve(\"typebox/compile\");\n\tconst typeboxValueEntry = require.resolve(\"typebox/value\");\n\n\tconst packagesRoot = path.resolve(__dirname, \"../../../../\");\n\tconst resolveWorkspaceOrImport = (workspaceRelativePath: string, specifier: string): string => {\n\t\tconst workspacePath = path.join(packagesRoot, workspaceRelativePath);\n\t\tif (fs.existsSync(workspacePath)) {\n\t\t\treturn workspacePath;\n\t\t}\n\t\treturn fileURLToPath(import.meta.resolve(specifier));\n\t};\n\n\tconst piCodingAgentEntry = packageIndex;\n\tconst piAgentCoreEntry = resolveWorkspaceOrImport(\"agent/dist/index.js\", \"@earendil-works/omk-agent-core\");\n\tconst piTuiEntry = resolveWorkspaceOrImport(\"tui/dist/index.js\", \"@earendil-works/omk-tui\");\n\tconst piAiEntry = resolveWorkspaceOrImport(\"ai/dist/index.js\", \"@earendil-works/omk-ai\");\n\tconst piAiOauthEntry = resolveWorkspaceOrImport(\"ai/dist/oauth.js\", \"@earendil-works/omk-ai/oauth\");\n\n\t_aliases = {\n\t\t\"open-multi-agent-kit\": piCodingAgentEntry,\n\t\t\"@earendil-works/omk-agent-core\": piAgentCoreEntry,\n\t\t\"@earendil-works/omk-tui\": piTuiEntry,\n\t\t\"@earendil-works/omk-ai\": piAiEntry,\n\t\t\"@earendil-works/omk-ai/oauth\": piAiOauthEntry,\n\t\t\"@earendil-works/pi-coding-agent\": piCodingAgentEntry,\n\t\t\"@earendil-works/pi-agent-core\": piAgentCoreEntry,\n\t\t\"@earendil-works/pi-tui\": piTuiEntry,\n\t\t\"@earendil-works/pi-ai\": piAiEntry,\n\t\t\"@earendil-works/pi-ai/oauth\": piAiOauthEntry,\n\t\t\"@mariozechner/pi-coding-agent\": piCodingAgentEntry,\n\t\t\"@mariozechner/pi-agent-core\": piAgentCoreEntry,\n\t\t\"@mariozechner/pi-tui\": piTuiEntry,\n\t\t\"@mariozechner/pi-ai\": piAiEntry,\n\t\t\"@mariozechner/pi-ai/oauth\": piAiOauthEntry,\n\t\ttypebox: typeboxEntry,\n\t\t\"typebox/compile\": typeboxCompileEntry,\n\t\t\"typebox/value\": typeboxValueEntry,\n\t\t\"@sinclair/typebox\": typeboxEntry,\n\t\t\"@sinclair/typebox/compile\": typeboxCompileEntry,\n\t\t\"@sinclair/typebox/value\": typeboxValueEntry,\n\t};\n\n\treturn _aliases;\n}\n\ntype HandlerFn = (...args: unknown[]) => Promise<unknown>;\n\n/**\n * Create a runtime with throwing stubs for action methods.\n * Runner.bindCore() replaces these with real implementations.\n */\nexport function createExtensionRuntime(): ExtensionRuntime {\n\tconst notInitialized = () => {\n\t\tthrow new Error(\"Extension runtime not initialized. Action methods cannot be called during extension loading.\");\n\t};\n\tconst state: { staleMessage?: string } = {};\n\tconst assertActive = () => {\n\t\tif (state.staleMessage) {\n\t\t\tthrow new Error(state.staleMessage);\n\t\t}\n\t};\n\n\tconst runtime: ExtensionRuntime = {\n\t\tsendMessage: notInitialized,\n\t\tsendUserMessage: notInitialized,\n\t\tappendEntry: notInitialized,\n\t\tsetSessionName: notInitialized,\n\t\tgetSessionName: notInitialized,\n\t\tsetLabel: notInitialized,\n\t\tgetActiveTools: notInitialized,\n\t\tgetAllTools: notInitialized,\n\t\tsetActiveTools: notInitialized,\n\t\t// registerTool() is valid during extension load; refresh is only needed post-bind.\n\t\trefreshTools: () => {},\n\t\tgetCommands: notInitialized,\n\t\tsetModel: () => Promise.reject(new Error(\"Extension runtime not initialized\")),\n\t\tgetThinkingLevel: notInitialized,\n\t\tsetThinkingLevel: notInitialized,\n\t\tflagValues: new Map(),\n\t\tpendingProviderRegistrations: [],\n\t\tassertActive,\n\t\tinvalidate: (message) => {\n\t\t\tstate.staleMessage ??=\n\t\t\t\tmessage ??\n\t\t\t\t\"This extension ctx is stale after session replacement or reload. Do not use a captured pi or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().\";\n\t\t},\n\t\t// Pre-bind: queue registrations so bindCore() can flush them once the\n\t\t// model registry is available. bindCore() replaces both with direct calls.\n\t\tregisterProvider: (name, config, extensionPath = \"<unknown>\") => {\n\t\t\truntime.pendingProviderRegistrations.push({ name, config, extensionPath });\n\t\t},\n\t\tunregisterProvider: (name) => {\n\t\t\truntime.pendingProviderRegistrations = runtime.pendingProviderRegistrations.filter((r) => r.name !== name);\n\t\t},\n\t};\n\n\treturn runtime;\n}\n\n/**\n * Create the ExtensionAPI for an extension.\n * Registration methods write to the extension object.\n * Action methods delegate to the shared runtime.\n */\nfunction createExtensionAPI(\n\textension: Extension,\n\truntime: ExtensionRuntime,\n\tcwd: string,\n\teventBus: EventBus,\n): ExtensionAPI {\n\tconst api = {\n\t\t// Registration methods - write to extension\n\t\ton(event: string, handler: HandlerFn): void {\n\t\t\truntime.assertActive();\n\t\t\tconst list = extension.handlers.get(event) ?? [];\n\t\t\tlist.push(handler);\n\t\t\textension.handlers.set(event, list);\n\t\t},\n\n\t\tregisterTool(tool: ToolDefinition): void {\n\t\t\truntime.assertActive();\n\t\t\textension.tools.set(tool.name, {\n\t\t\t\tdefinition: tool,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t});\n\t\t\truntime.refreshTools();\n\t\t},\n\n\t\tregisterCommand(name: string, options: Omit<RegisteredCommand, \"name\" | \"sourceInfo\">): void {\n\t\t\truntime.assertActive();\n\t\t\textension.commands.set(name, {\n\t\t\t\tname,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\n\t\tregisterShortcut(\n\t\t\tshortcut: KeyId,\n\t\t\toptions: {\n\t\t\t\tdescription?: string;\n\t\t\t\thandler: (ctx: import(\"./types.ts\").ExtensionContext) => Promise<void> | void;\n\t\t\t},\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.shortcuts.set(shortcut, { shortcut, extensionPath: extension.path, ...options });\n\t\t},\n\n\t\tregisterFlag(\n\t\t\tname: string,\n\t\t\toptions: { description?: string; type: \"boolean\" | \"string\"; default?: boolean | string },\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.flags.set(name, { name, extensionPath: extension.path, ...options });\n\t\t\tif (options.default !== undefined && !runtime.flagValues.has(name)) {\n\t\t\t\truntime.flagValues.set(name, options.default);\n\t\t\t}\n\t\t},\n\n\t\tregisterMessageRenderer<T>(customType: string, renderer: MessageRenderer<T>): void {\n\t\t\truntime.assertActive();\n\t\t\textension.messageRenderers.set(customType, renderer as MessageRenderer);\n\t\t},\n\n\t\t// Flag access - checks extension registered it, reads from runtime\n\t\tgetFlag(name: string): boolean | string | undefined {\n\t\t\truntime.assertActive();\n\t\t\tif (!extension.flags.has(name)) return undefined;\n\t\t\treturn runtime.flagValues.get(name);\n\t\t},\n\n\t\t// Action methods - delegate to shared runtime\n\t\tsendMessage(message, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendMessage(message, options);\n\t\t},\n\n\t\tsendUserMessage(content, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendUserMessage(content, options);\n\t\t},\n\n\t\tappendEntry(customType: string, data?: unknown): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.appendEntry(customType, data);\n\t\t},\n\n\t\tsetSessionName(name: string): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setSessionName(name);\n\t\t},\n\n\t\tgetSessionName(): string | undefined {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getSessionName();\n\t\t},\n\n\t\tsetLabel(entryId: string, label: string | undefined): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setLabel(entryId, label);\n\t\t},\n\n\t\texec(command: string, args: string[], options?: ExecOptions) {\n\t\t\truntime.assertActive();\n\t\t\treturn execCommand(command, args, options?.cwd ?? cwd, options);\n\t\t},\n\n\t\tgetActiveTools(): string[] {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getActiveTools();\n\t\t},\n\n\t\tgetAllTools() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getAllTools();\n\t\t},\n\n\t\tsetActiveTools(toolNames: string[]): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setActiveTools(toolNames);\n\t\t},\n\n\t\tgetCommands() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getCommands();\n\t\t},\n\n\t\tsetModel(model) {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.setModel(model);\n\t\t},\n\n\t\tgetThinkingLevel() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getThinkingLevel();\n\t\t},\n\n\t\tsetThinkingLevel(level) {\n\t\t\truntime.assertActive();\n\t\t\truntime.setThinkingLevel(level);\n\t\t},\n\n\t\tregisterProvider(name: string, config: ProviderConfig) {\n\t\t\truntime.assertActive();\n\t\t\truntime.registerProvider(name, config, extension.path);\n\t\t},\n\n\t\tunregisterProvider(name: string) {\n\t\t\truntime.assertActive();\n\t\t\truntime.unregisterProvider(name, extension.path);\n\t\t},\n\n\t\t// Track pi.events subscriptions on the extension so they can be\n\t\t// unsubscribed on reload instead of stacking duplicate listeners\n\t\t// on the shared event bus.\n\t\tevents: {\n\t\t\temit: (channel, data) => {\n\t\t\t\teventBus.emit(channel, data);\n\t\t\t},\n\t\t\ton: (channel, handler) => {\n\t\t\t\tconst unsubscribe = eventBus.on(channel, handler);\n\t\t\t\textension.eventBusSubscriptions?.push(unsubscribe);\n\t\t\t\treturn unsubscribe;\n\t\t\t},\n\t\t},\n\t} as ExtensionAPI;\n\n\treturn api;\n}\n\nasync function loadExtensionModule(extensionPath: string) {\n\tconst jiti = createJiti(import.meta.url, {\n\t\tmoduleCache: false,\n\t\t// In Bun binary: use virtualModules for bundled packages (no filesystem resolution)\n\t\t// Also disable tryNative so jiti handles ALL imports (not just the entry point)\n\t\t// In Node.js/dev: use aliases to resolve to node_modules paths\n\t\t...(isBunBinary ? { virtualModules: VIRTUAL_MODULES, tryNative: false } : { alias: getAliases() }),\n\t});\n\n\tconst module = await jiti.import(extensionPath, { default: true });\n\tconst factory = module as ExtensionFactory;\n\treturn typeof factory !== \"function\" ? undefined : factory;\n}\n\n/**\n * Create an Extension object with empty collections.\n */\nfunction createExtension(extensionPath: string, resolvedPath: string): Extension {\n\tconst source =\n\t\textensionPath.startsWith(\"<\") && extensionPath.endsWith(\">\")\n\t\t\t? extensionPath.slice(1, -1).split(\":\")[0] || \"temporary\"\n\t\t\t: \"local\";\n\tconst baseDir = extensionPath.startsWith(\"<\") ? undefined : path.dirname(resolvedPath);\n\n\treturn {\n\t\tpath: extensionPath,\n\t\tresolvedPath,\n\t\tsourceInfo: createSyntheticSourceInfo(extensionPath, { source, baseDir }),\n\t\thandlers: new Map(),\n\t\ttools: new Map(),\n\t\tmessageRenderers: new Map(),\n\t\tcommands: new Map(),\n\t\tflags: new Map(),\n\t\tshortcuts: new Map(),\n\t\teventBusSubscriptions: [],\n\t};\n}\n\nasync function loadExtension(\n\textensionPath: string,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n): Promise<{ extension: Extension | null; error: string | null }> {\n\tconst resolvedPath = resolvePath(extensionPath, cwd, { normalizeUnicodeSpaces: true });\n\n\ttry {\n\t\tconst factory = await loadExtensionModule(resolvedPath);\n\t\tif (!factory) {\n\t\t\treturn { extension: null, error: `Extension does not export a valid factory function: ${extensionPath}` };\n\t\t}\n\n\t\tconst extension = createExtension(extensionPath, resolvedPath);\n\t\tconst api = createExtensionAPI(extension, runtime, cwd, eventBus);\n\t\tawait factory(api);\n\n\t\treturn { extension, error: null };\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\treturn { extension: null, error: `Failed to load extension: ${message}` };\n\t}\n}\n\n/**\n * Create an Extension from an inline factory function.\n */\nexport async function loadExtensionFromFactory(\n\tfactory: ExtensionFactory,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\textensionPath = \"<inline>\",\n): Promise<Extension> {\n\tconst extension = createExtension(extensionPath, extensionPath);\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst api = createExtensionAPI(extension, runtime, resolvedCwd, eventBus);\n\tawait factory(api);\n\treturn extension;\n}\n\n/**\n * Load extensions from paths.\n */\nexport async function loadExtensions(paths: string[], cwd: string, eventBus?: EventBus): Promise<LoadExtensionsResult> {\n\tconst extensions: Extension[] = [];\n\tconst errors: Array<{ path: string; error: string }> = [];\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedEventBus = eventBus ?? createEventBus();\n\tconst runtime = createExtensionRuntime();\n\n\tfor (const extPath of paths) {\n\t\tconst { extension, error } = await loadExtension(extPath, resolvedCwd, resolvedEventBus, runtime);\n\n\t\tif (error) {\n\t\t\terrors.push({ path: extPath, error });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (extension) {\n\t\t\textensions.push(extension);\n\t\t}\n\t}\n\n\treturn {\n\t\textensions,\n\t\terrors,\n\t\truntime,\n\t};\n}\n\ninterface OmkManifest {\n\textensions?: string[];\n\tthemes?: string[];\n\tskills?: string[];\n\tprompts?: string[];\n}\n\nfunction readOmkManifest(packageJsonPath: string): OmkManifest | null {\n\ttry {\n\t\tconst content = fs.readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst pkg = JSON.parse(content) as { omk?: unknown; pi?: unknown };\n\t\tconst manifest = pkg.omk ?? pkg.pi;\n\t\treturn manifest && typeof manifest === \"object\" ? (manifest as OmkManifest) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction isExtensionFile(name: string): boolean {\n\treturn name.endsWith(\".ts\") || name.endsWith(\".js\");\n}\n\n/**\n * Resolve extension entry points from a directory.\n *\n * Checks for:\n * 1. package.json with \"omk.extensions\" field -> returns declared paths\n * 2. index.ts or index.js -> returns the index file\n *\n * Returns resolved paths or null if no entry points found.\n */\nfunction resolveExtensionEntries(dir: string): string[] | null {\n\t// Check for package.json with \"omk\" field first\n\tconst packageJsonPath = path.join(dir, \"package.json\");\n\tif (fs.existsSync(packageJsonPath)) {\n\t\tconst manifest = readOmkManifest(packageJsonPath);\n\t\tif (manifest?.extensions?.length) {\n\t\t\tconst entries: string[] = [];\n\t\t\tfor (const extPath of manifest.extensions) {\n\t\t\t\tconst resolvedExtPath = path.resolve(dir, extPath);\n\t\t\t\tif (fs.existsSync(resolvedExtPath)) {\n\t\t\t\t\tentries.push(resolvedExtPath);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (entries.length > 0) {\n\t\t\t\treturn entries;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Check for index.ts or index.js\n\tconst indexTs = path.join(dir, \"index.ts\");\n\tconst indexJs = path.join(dir, \"index.js\");\n\tif (fs.existsSync(indexTs)) {\n\t\treturn [indexTs];\n\t}\n\tif (fs.existsSync(indexJs)) {\n\t\treturn [indexJs];\n\t}\n\n\treturn null;\n}\n\n/**\n * Discover extensions in a directory.\n *\n * Discovery rules:\n * 1. Direct files: `extensions/*.ts` or `*.js` → load\n * 2. Subdirectory with index: `extensions/* /index.ts` or `index.js` → load\n * 3. Subdirectory with package.json: `extensions/* /package.json` with \"pi\" field → load what it declares\n *\n * No recursion beyond one level. Complex packages must use package.json manifest.\n */\nfunction discoverExtensionsInDir(dir: string): string[] {\n\tif (!fs.existsSync(dir)) {\n\t\treturn [];\n\t}\n\n\tconst discovered: string[] = [];\n\n\ttry {\n\t\tconst entries = fs.readdirSync(dir, { withFileTypes: true });\n\n\t\tfor (const entry of entries) {\n\t\t\tconst entryPath = path.join(dir, entry.name);\n\n\t\t\t// 1. Direct files: *.ts or *.js\n\t\t\tif ((entry.isFile() || entry.isSymbolicLink()) && isExtensionFile(entry.name)) {\n\t\t\t\tdiscovered.push(entryPath);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// 2 & 3. Subdirectories\n\t\t\tif (entry.isDirectory() || entry.isSymbolicLink()) {\n\t\t\t\tconst entries = resolveExtensionEntries(entryPath);\n\t\t\t\tif (entries) {\n\t\t\t\t\tdiscovered.push(...entries);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch {\n\t\treturn [];\n\t}\n\n\treturn discovered;\n}\n\n/**\n * Discover and load extensions from standard locations.\n */\nexport async function discoverAndLoadExtensions(\n\tconfiguredPaths: string[],\n\tcwd: string,\n\tagentDir: string = getAgentDir(),\n\teventBus?: EventBus,\n): Promise<LoadExtensionsResult> {\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedAgentDir = resolvePath(agentDir);\n\tconst allPaths: string[] = [];\n\tconst seen = new Set<string>();\n\n\tconst addPaths = (paths: string[]) => {\n\t\tfor (const p of paths) {\n\t\t\tconst resolved = path.resolve(p);\n\t\t\tif (!seen.has(resolved)) {\n\t\t\t\tseen.add(resolved);\n\t\t\t\tallPaths.push(p);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Project-local extensions: cwd/${CONFIG_DIR_NAME}/extensions/\n\tconst localExtDir = path.join(resolvedCwd, CONFIG_DIR_NAME, \"extensions\");\n\taddPaths(discoverExtensionsInDir(localExtDir));\n\n\t// 2. Global extensions: agentDir/extensions/\n\tconst globalExtDir = path.join(resolvedAgentDir, \"extensions\");\n\taddPaths(discoverExtensionsInDir(globalExtDir));\n\n\t// 3. Explicitly configured paths\n\tfor (const p of configuredPaths) {\n\t\tconst resolved = resolvePath(p, resolvedCwd, { normalizeUnicodeSpaces: true });\n\t\tif (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n\t\t\t// Check for package.json with pi manifest or index.ts\n\t\t\tconst entries = resolveExtensionEntries(resolved);\n\t\t\tif (entries) {\n\t\t\t\taddPaths(entries);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// No explicit entries - discover individual files in directory\n\t\t\taddPaths(discoverExtensionsInDir(resolved));\n\t\t\tcontinue;\n\t\t}\n\n\t\taddPaths([resolved]);\n\t}\n\n\treturn loadExtensions(allPaths, resolvedCwd, eventBus);\n}\n"]}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/core/extensions/loader.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,EAAkB,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAMhE,OAAO,KAAK,EACX,SAAS,EAGT,gBAAgB,EAChB,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EAKpB,MAAM,YAAY,CAAC;AAgJpB;;;GAGG;AACH,wBAAgB,sBAAsB,IAAI,gBAAgB,CA8CzD;AA+OD;;GAEG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,gBAAgB,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,gBAAgB,EACzB,aAAa,SAAa,EAC1B,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,SAAS,CAAC,CAMpB;AAED;;GAEG;AACH,wBAAsB,cAAc,CACnC,KAAK,EAAE,MAAM,EAAE,EACf,GAAG,EAAE,MAAM,EACX,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA+B/B;AA6GD;;GAEG;AACH,wBAAsB,yBAAyB,CAC9C,eAAe,EAAE,MAAM,EAAE,EACzB,GAAG,EAAE,MAAM,EACX,QAAQ,GAAE,MAAsB,EAChC,QAAQ,CAAC,EAAE,QAAQ,EACnB,OAAO,CAAC,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CA2C/B","sourcesContent":["/**\n * Extension loader - loads TypeScript extension modules using jiti.\n *\n */\n\nimport * as fs from \"node:fs\";\nimport { createRequire } from \"node:module\";\nimport * as path from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport * as _bundledOmkAgentCore from \"@earendil-works/omk-agent-core\";\nimport * as _bundledOmkAi from \"@earendil-works/omk-ai\";\nimport * as _bundledOmkAiOauth from \"@earendil-works/omk-ai/oauth\";\nimport type { KeyId } from \"@earendil-works/omk-tui\";\nimport * as _bundledOmkTui from \"@earendil-works/omk-tui\";\nimport { createJiti } from \"jiti/static\";\n// Static imports of packages that extensions may use.\n// These MUST be static so Bun bundles them into the compiled binary.\n// The virtualModules option then makes them available to extensions.\nimport * as _bundledTypebox from \"typebox\";\nimport * as _bundledTypeboxCompile from \"typebox/compile\";\nimport * as _bundledTypeboxValue from \"typebox/value\";\nimport { CONFIG_DIR_NAME, getAgentDir, isBunBinary } from \"../../config.ts\";\n// NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,\n// avoiding a circular dependency. Extensions can import from open-multi-agent-kit.\nimport * as _bundledOmkCodingAgent from \"../../index.ts\";\nimport { resolvePath } from \"../../utils/paths.ts\";\nimport { createEventBus, type EventBus } from \"../event-bus.ts\";\nimport type { ExecOptions } from \"../exec.ts\";\nimport { execCommand } from \"../exec.ts\";\nimport type { SandboxBackendStatus, SandboxPlatform } from \"../sandbox/policy.ts\";\nimport { buildSandboxedSpawnRequest } from \"../sandbox/spawn.ts\";\nimport { createSyntheticSourceInfo } from \"../source-info.ts\";\nimport type {\n\tExtension,\n\tExtensionAPI,\n\tExtensionExecSandbox,\n\tExtensionFactory,\n\tExtensionRuntime,\n\tLoadExtensionsOptions,\n\tLoadExtensionsResult,\n\tMessageRenderer,\n\tProviderConfig,\n\tRegisteredCommand,\n\tToolDefinition,\n} from \"./types.ts\";\n\n/** Modules available to extensions via virtualModules (for compiled Bun binary) */\nconst VIRTUAL_MODULES: Record<string, unknown> = {\n\ttypebox: _bundledTypebox,\n\t\"typebox/compile\": _bundledTypeboxCompile,\n\t\"typebox/value\": _bundledTypeboxValue,\n\t\"@sinclair/typebox\": _bundledTypebox,\n\t\"@sinclair/typebox/compile\": _bundledTypeboxCompile,\n\t\"@sinclair/typebox/value\": _bundledTypeboxValue,\n\t\"@earendil-works/omk-agent-core\": _bundledOmkAgentCore,\n\t\"@earendil-works/omk-tui\": _bundledOmkTui,\n\t\"@earendil-works/omk-ai\": _bundledOmkAi,\n\t\"@earendil-works/omk-ai/oauth\": _bundledOmkAiOauth,\n\t\"open-multi-agent-kit\": _bundledOmkCodingAgent,\n\t\"@earendil-works/pi-agent-core\": _bundledOmkAgentCore,\n\t\"@earendil-works/pi-tui\": _bundledOmkTui,\n\t\"@earendil-works/pi-ai\": _bundledOmkAi,\n\t\"@earendil-works/pi-ai/oauth\": _bundledOmkAiOauth,\n\t\"@earendil-works/pi-coding-agent\": _bundledOmkCodingAgent,\n\t\"@mariozechner/pi-agent-core\": _bundledOmkAgentCore,\n\t\"@mariozechner/pi-tui\": _bundledOmkTui,\n\t\"@mariozechner/pi-ai\": _bundledOmkAi,\n\t\"@mariozechner/pi-ai/oauth\": _bundledOmkAiOauth,\n\t\"@mariozechner/pi-coding-agent\": _bundledOmkCodingAgent,\n};\n\nconst require = createRequire(import.meta.url);\n\n/**\n * Default sandbox backend status for extension exec when none is supplied: no\n * OS-level backend, on the current platform. This makes enforce mode fail closed\n * unless the caller explicitly provides an available backend.\n */\nfunction defaultExtensionExecBackend(): SandboxBackendStatus {\n\tconst platform: SandboxPlatform =\n\t\tprocess.platform === \"linux\" ? \"linux\" : process.platform === \"darwin\" ? \"macos\" : \"unsupported\";\n\treturn { platform, backendAvailable: false };\n}\n\ninterface ExtensionExecCommandPlan {\n\treadonly command: string;\n\treadonly args: readonly string[];\n\treadonly cwd: string;\n\treadonly env?: NodeJS.ProcessEnv;\n}\n\nfunction planExtensionExecCommand(\n\tcommand: string,\n\targs: readonly string[],\n\tcwd: string,\n\toptions: ExecOptions | undefined,\n\texecSandbox: ExtensionExecSandbox | undefined,\n): ExtensionExecCommandPlan {\n\tconst requestedCwd = options?.cwd ?? cwd;\n\tif (!execSandbox) {\n\t\treturn { command, args, cwd: requestedCwd, env: options?.env };\n\t}\n\n\tconst sandbox = buildSandboxedSpawnRequest({\n\t\targv: [command, ...args],\n\t\tcwd: requestedCwd,\n\t\tenv: options?.env ?? process.env,\n\t\tpolicy: execSandbox.policy,\n\t\tbackend: execSandbox.backend ?? defaultExtensionExecBackend(),\n\t\tresolver: execSandbox.resolver,\n\t});\n\tif (!sandbox.allowed) {\n\t\tthrow new Error(`sandbox: exec denied\\n[${sandbox.rule}] ${sandbox.reason}`);\n\t}\n\n\tconst [sandboxedCommand, ...sandboxedArgs] = sandbox.argv;\n\tif (!sandboxedCommand) {\n\t\tthrow new Error(\"sandbox: exec denied\\n[sandbox.empty_argv] Sandbox wrapper returned an empty argv.\");\n\t}\n\n\treturn {\n\t\tcommand: sandboxedCommand,\n\t\targs: sandboxedArgs,\n\t\tcwd: sandbox.cwd,\n\t\tenv: sandbox.env,\n\t};\n}\n\n/**\n * Get aliases for jiti (used in Node.js/development mode).\n * In Bun binary mode, virtualModules is used instead.\n */\nlet _aliases: Record<string, string> | null = null;\n\nfunction getAliases(): Record<string, string> {\n\tif (_aliases) return _aliases;\n\n\tconst __dirname = path.dirname(fileURLToPath(import.meta.url));\n\tconst packageIndex = path.resolve(__dirname, \"../..\", \"index.js\");\n\n\tconst typeboxEntry = require.resolve(\"typebox\");\n\tconst typeboxCompileEntry = require.resolve(\"typebox/compile\");\n\tconst typeboxValueEntry = require.resolve(\"typebox/value\");\n\n\tconst packagesRoot = path.resolve(__dirname, \"../../../../\");\n\tconst resolveWorkspaceOrImport = (workspaceRelativePath: string, specifier: string): string => {\n\t\tconst workspacePath = path.join(packagesRoot, workspaceRelativePath);\n\t\tif (fs.existsSync(workspacePath)) {\n\t\t\treturn workspacePath;\n\t\t}\n\t\treturn fileURLToPath(import.meta.resolve(specifier));\n\t};\n\n\tconst omkCodingAgentEntry = packageIndex;\n\tconst omkAgentCoreEntry = resolveWorkspaceOrImport(\"agent/dist/index.js\", \"@earendil-works/omk-agent-core\");\n\tconst omkTuiEntry = resolveWorkspaceOrImport(\"tui/dist/index.js\", \"@earendil-works/omk-tui\");\n\tconst omkAiEntry = resolveWorkspaceOrImport(\"ai/dist/index.js\", \"@earendil-works/omk-ai\");\n\tconst omkAiOauthEntry = resolveWorkspaceOrImport(\"ai/dist/oauth.js\", \"@earendil-works/omk-ai/oauth\");\n\n\t_aliases = {\n\t\t\"open-multi-agent-kit\": omkCodingAgentEntry,\n\t\t\"@earendil-works/omk-agent-core\": omkAgentCoreEntry,\n\t\t\"@earendil-works/omk-tui\": omkTuiEntry,\n\t\t\"@earendil-works/omk-ai\": omkAiEntry,\n\t\t\"@earendil-works/omk-ai/oauth\": omkAiOauthEntry,\n\t\t\"@earendil-works/pi-coding-agent\": omkCodingAgentEntry,\n\t\t\"@earendil-works/pi-agent-core\": omkAgentCoreEntry,\n\t\t\"@earendil-works/pi-tui\": omkTuiEntry,\n\t\t\"@earendil-works/pi-ai\": omkAiEntry,\n\t\t\"@earendil-works/pi-ai/oauth\": omkAiOauthEntry,\n\t\t\"@mariozechner/pi-coding-agent\": omkCodingAgentEntry,\n\t\t\"@mariozechner/pi-agent-core\": omkAgentCoreEntry,\n\t\t\"@mariozechner/pi-tui\": omkTuiEntry,\n\t\t\"@mariozechner/pi-ai\": omkAiEntry,\n\t\t\"@mariozechner/pi-ai/oauth\": omkAiOauthEntry,\n\t\ttypebox: typeboxEntry,\n\t\t\"typebox/compile\": typeboxCompileEntry,\n\t\t\"typebox/value\": typeboxValueEntry,\n\t\t\"@sinclair/typebox\": typeboxEntry,\n\t\t\"@sinclair/typebox/compile\": typeboxCompileEntry,\n\t\t\"@sinclair/typebox/value\": typeboxValueEntry,\n\t};\n\n\treturn _aliases;\n}\n\ntype HandlerFn = (...args: unknown[]) => Promise<unknown>;\n\n/**\n * Create a runtime with throwing stubs for action methods.\n * Runner.bindCore() replaces these with real implementations.\n */\nexport function createExtensionRuntime(): ExtensionRuntime {\n\tconst notInitialized = () => {\n\t\tthrow new Error(\"Extension runtime not initialized. Action methods cannot be called during extension loading.\");\n\t};\n\tconst state: { staleMessage?: string } = {};\n\tconst assertActive = () => {\n\t\tif (state.staleMessage) {\n\t\t\tthrow new Error(state.staleMessage);\n\t\t}\n\t};\n\n\tconst runtime: ExtensionRuntime = {\n\t\tsendMessage: notInitialized,\n\t\tsendUserMessage: notInitialized,\n\t\tappendEntry: notInitialized,\n\t\tsetSessionName: notInitialized,\n\t\tgetSessionName: notInitialized,\n\t\tsetLabel: notInitialized,\n\t\tgetActiveTools: notInitialized,\n\t\tgetAllTools: notInitialized,\n\t\tsetActiveTools: notInitialized,\n\t\t// registerTool() is valid during extension load; refresh is only needed post-bind.\n\t\trefreshTools: () => {},\n\t\tgetCommands: notInitialized,\n\t\tsetModel: () => Promise.reject(new Error(\"Extension runtime not initialized\")),\n\t\tgetThinkingLevel: notInitialized,\n\t\tsetThinkingLevel: notInitialized,\n\t\tflagValues: new Map(),\n\t\tpendingProviderRegistrations: [],\n\t\tassertActive,\n\t\tinvalidate: (message) => {\n\t\t\tstate.staleMessage ??=\n\t\t\t\tmessage ??\n\t\t\t\t\"This extension ctx is stale after session replacement or reload. Do not use a captured omk or command ctx after ctx.newSession(), ctx.fork(), ctx.switchSession(), or ctx.reload(). For newSession, fork, and switchSession, move post-replacement work into withSession and use the ctx passed to withSession. For reload, do not use the old ctx after await ctx.reload().\";\n\t\t},\n\t\t// Pre-bind: queue registrations so bindCore() can flush them once the\n\t\t// model registry is available. bindCore() replaces both with direct calls.\n\t\tregisterProvider: (name, config, extensionPath = \"<unknown>\") => {\n\t\t\truntime.pendingProviderRegistrations.push({ name, config, extensionPath });\n\t\t},\n\t\tunregisterProvider: (name) => {\n\t\t\truntime.pendingProviderRegistrations = runtime.pendingProviderRegistrations.filter((r) => r.name !== name);\n\t\t},\n\t};\n\n\treturn runtime;\n}\n\n/**\n * Create the ExtensionAPI for an extension.\n * Registration methods write to the extension object.\n * Action methods delegate to the shared runtime.\n */\nfunction createExtensionAPI(\n\textension: Extension,\n\truntime: ExtensionRuntime,\n\tcwd: string,\n\teventBus: EventBus,\n\texecSandbox?: ExtensionExecSandbox,\n): ExtensionAPI {\n\tconst api = {\n\t\t// Registration methods - write to extension\n\t\ton(event: string, handler: HandlerFn): void {\n\t\t\truntime.assertActive();\n\t\t\tconst list = extension.handlers.get(event) ?? [];\n\t\t\tlist.push(handler);\n\t\t\textension.handlers.set(event, list);\n\t\t},\n\n\t\tregisterTool(tool: ToolDefinition): void {\n\t\t\truntime.assertActive();\n\t\t\textension.tools.set(tool.name, {\n\t\t\t\tdefinition: tool,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t});\n\t\t\truntime.refreshTools();\n\t\t},\n\n\t\tregisterCommand(name: string, options: Omit<RegisteredCommand, \"name\" | \"sourceInfo\">): void {\n\t\t\truntime.assertActive();\n\t\t\textension.commands.set(name, {\n\t\t\t\tname,\n\t\t\t\tsourceInfo: extension.sourceInfo,\n\t\t\t\t...options,\n\t\t\t});\n\t\t},\n\n\t\tregisterShortcut(\n\t\t\tshortcut: KeyId,\n\t\t\toptions: {\n\t\t\t\tdescription?: string;\n\t\t\t\thandler: (ctx: import(\"./types.ts\").ExtensionContext) => Promise<void> | void;\n\t\t\t},\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.shortcuts.set(shortcut, { shortcut, extensionPath: extension.path, ...options });\n\t\t},\n\n\t\tregisterFlag(\n\t\t\tname: string,\n\t\t\toptions: { description?: string; type: \"boolean\" | \"string\"; default?: boolean | string },\n\t\t): void {\n\t\t\truntime.assertActive();\n\t\t\textension.flags.set(name, { name, extensionPath: extension.path, ...options });\n\t\t\tif (options.default !== undefined && !runtime.flagValues.has(name)) {\n\t\t\t\truntime.flagValues.set(name, options.default);\n\t\t\t}\n\t\t},\n\n\t\tregisterMessageRenderer<T>(customType: string, renderer: MessageRenderer<T>): void {\n\t\t\truntime.assertActive();\n\t\t\textension.messageRenderers.set(customType, renderer as MessageRenderer);\n\t\t},\n\n\t\t// Flag access - checks extension registered it, reads from runtime\n\t\tgetFlag(name: string): boolean | string | undefined {\n\t\t\truntime.assertActive();\n\t\t\tif (!extension.flags.has(name)) return undefined;\n\t\t\treturn runtime.flagValues.get(name);\n\t\t},\n\n\t\t// Action methods - delegate to shared runtime\n\t\tsendMessage(message, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendMessage(message, options);\n\t\t},\n\n\t\tsendUserMessage(content, options): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.sendUserMessage(content, options);\n\t\t},\n\n\t\tappendEntry(customType: string, data?: unknown): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.appendEntry(customType, data);\n\t\t},\n\n\t\tsetSessionName(name: string): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setSessionName(name);\n\t\t},\n\n\t\tgetSessionName(): string | undefined {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getSessionName();\n\t\t},\n\n\t\tsetLabel(entryId: string, label: string | undefined): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setLabel(entryId, label);\n\t\t},\n\n\t\tasync exec(command: string, args: string[], options?: ExecOptions) {\n\t\t\truntime.assertActive();\n\t\t\tconst planned = planExtensionExecCommand(command, args, cwd, options, execSandbox);\n\t\t\treturn execCommand(planned.command, [...planned.args], planned.cwd, { ...options, env: planned.env });\n\t\t},\n\n\t\tgetActiveTools(): string[] {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getActiveTools();\n\t\t},\n\n\t\tgetAllTools() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getAllTools();\n\t\t},\n\n\t\tsetActiveTools(toolNames: string[]): void {\n\t\t\truntime.assertActive();\n\t\t\truntime.setActiveTools(toolNames);\n\t\t},\n\n\t\tgetCommands() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getCommands();\n\t\t},\n\n\t\tsetModel(model) {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.setModel(model);\n\t\t},\n\n\t\tgetThinkingLevel() {\n\t\t\truntime.assertActive();\n\t\t\treturn runtime.getThinkingLevel();\n\t\t},\n\n\t\tsetThinkingLevel(level) {\n\t\t\truntime.assertActive();\n\t\t\truntime.setThinkingLevel(level);\n\t\t},\n\n\t\tregisterProvider(name: string, config: ProviderConfig) {\n\t\t\truntime.assertActive();\n\t\t\truntime.registerProvider(name, config, extension.path);\n\t\t},\n\n\t\tunregisterProvider(name: string) {\n\t\t\truntime.assertActive();\n\t\t\truntime.unregisterProvider(name, extension.path);\n\t\t},\n\n\t\t// Track omk.events subscriptions on the extension so they can be\n\t\t// unsubscribed on reload instead of stacking duplicate listeners\n\t\t// on the shared event bus.\n\t\tevents: {\n\t\t\temit: (channel, data) => {\n\t\t\t\teventBus.emit(channel, data);\n\t\t\t},\n\t\t\ton: (channel, handler) => {\n\t\t\t\tconst unsubscribe = eventBus.on(channel, handler);\n\t\t\t\textension.eventBusSubscriptions?.push(unsubscribe);\n\t\t\t\treturn unsubscribe;\n\t\t\t},\n\t\t},\n\t} as ExtensionAPI;\n\n\treturn api;\n}\n\nasync function loadExtensionModule(extensionPath: string) {\n\tconst jiti = createJiti(import.meta.url, {\n\t\tmoduleCache: false,\n\t\t// In Bun binary: use virtualModules for bundled packages (no filesystem resolution)\n\t\t// Also disable tryNative so jiti handles ALL imports (not just the entry point)\n\t\t// In Node.js/dev: use aliases to resolve to node_modules paths\n\t\t...(isBunBinary ? { virtualModules: VIRTUAL_MODULES, tryNative: false } : { alias: getAliases() }),\n\t});\n\n\tconst module = await jiti.import(extensionPath, { default: true });\n\tconst factory = module as ExtensionFactory;\n\treturn typeof factory !== \"function\" ? undefined : factory;\n}\n\n/**\n * Create an Extension object with empty collections.\n */\nfunction createExtension(extensionPath: string, resolvedPath: string): Extension {\n\tconst source =\n\t\textensionPath.startsWith(\"<\") && extensionPath.endsWith(\">\")\n\t\t\t? extensionPath.slice(1, -1).split(\":\")[0] || \"temporary\"\n\t\t\t: \"local\";\n\tconst baseDir = extensionPath.startsWith(\"<\") ? undefined : path.dirname(resolvedPath);\n\n\treturn {\n\t\tpath: extensionPath,\n\t\tresolvedPath,\n\t\tsourceInfo: createSyntheticSourceInfo(extensionPath, { source, baseDir }),\n\t\thandlers: new Map(),\n\t\ttools: new Map(),\n\t\tmessageRenderers: new Map(),\n\t\tcommands: new Map(),\n\t\tflags: new Map(),\n\t\tshortcuts: new Map(),\n\t\teventBusSubscriptions: [],\n\t};\n}\n\nasync function loadExtension(\n\textensionPath: string,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\texecSandbox?: ExtensionExecSandbox,\n): Promise<{ extension: Extension | null; error: string | null }> {\n\tconst resolvedPath = resolvePath(extensionPath, cwd, { normalizeUnicodeSpaces: true });\n\n\ttry {\n\t\tconst factory = await loadExtensionModule(resolvedPath);\n\t\tif (!factory) {\n\t\t\treturn { extension: null, error: `Extension does not export a valid factory function: ${extensionPath}` };\n\t\t}\n\n\t\tconst extension = createExtension(extensionPath, resolvedPath);\n\t\tconst api = createExtensionAPI(extension, runtime, cwd, eventBus, execSandbox);\n\t\tawait factory(api);\n\n\t\treturn { extension, error: null };\n\t} catch (err) {\n\t\tconst message = err instanceof Error ? err.message : String(err);\n\t\treturn { extension: null, error: `Failed to load extension: ${message}` };\n\t}\n}\n\n/**\n * Create an Extension from an inline factory function.\n */\nexport async function loadExtensionFromFactory(\n\tfactory: ExtensionFactory,\n\tcwd: string,\n\teventBus: EventBus,\n\truntime: ExtensionRuntime,\n\textensionPath = \"<inline>\",\n\toptions?: LoadExtensionsOptions,\n): Promise<Extension> {\n\tconst extension = createExtension(extensionPath, extensionPath);\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst api = createExtensionAPI(extension, runtime, resolvedCwd, eventBus, options?.execSandbox);\n\tawait factory(api);\n\treturn extension;\n}\n\n/**\n * Load extensions from paths.\n */\nexport async function loadExtensions(\n\tpaths: string[],\n\tcwd: string,\n\teventBus?: EventBus,\n\toptions?: LoadExtensionsOptions,\n): Promise<LoadExtensionsResult> {\n\tconst extensions: Extension[] = [];\n\tconst errors: Array<{ path: string; error: string }> = [];\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedEventBus = eventBus ?? createEventBus();\n\tconst runtime = createExtensionRuntime();\n\n\tfor (const extPath of paths) {\n\t\tconst { extension, error } = await loadExtension(\n\t\t\textPath,\n\t\t\tresolvedCwd,\n\t\t\tresolvedEventBus,\n\t\t\truntime,\n\t\t\toptions?.execSandbox,\n\t\t);\n\n\t\tif (error) {\n\t\t\terrors.push({ path: extPath, error });\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (extension) {\n\t\t\textensions.push(extension);\n\t\t}\n\t}\n\n\treturn {\n\t\textensions,\n\t\terrors,\n\t\truntime,\n\t};\n}\n\ninterface OmkManifest {\n\textensions?: string[];\n\tthemes?: string[];\n\tskills?: string[];\n\tprompts?: string[];\n}\n\nfunction readOmkManifest(packageJsonPath: string): OmkManifest | null {\n\ttry {\n\t\tconst content = fs.readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst pkg = JSON.parse(content) as { omk?: unknown; pi?: unknown };\n\t\tconst manifest = pkg.omk ?? pkg.pi;\n\t\treturn manifest && typeof manifest === \"object\" ? (manifest as OmkManifest) : null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction isExtensionFile(name: string): boolean {\n\treturn name.endsWith(\".ts\") || name.endsWith(\".js\");\n}\n\n/**\n * Resolve extension entry points from a directory.\n *\n * Checks for:\n * 1. package.json with \"omk.extensions\" field -> returns declared paths\n * 2. index.ts or index.js -> returns the index file\n *\n * Returns resolved paths or null if no entry points found.\n */\nfunction resolveExtensionEntries(dir: string): string[] | null {\n\t// Check for package.json with \"omk\" field first\n\tconst packageJsonPath = path.join(dir, \"package.json\");\n\tif (fs.existsSync(packageJsonPath)) {\n\t\tconst manifest = readOmkManifest(packageJsonPath);\n\t\tif (manifest?.extensions?.length) {\n\t\t\tconst entries: string[] = [];\n\t\t\tfor (const extPath of manifest.extensions) {\n\t\t\t\tconst resolvedExtPath = path.resolve(dir, extPath);\n\t\t\t\tif (fs.existsSync(resolvedExtPath)) {\n\t\t\t\t\tentries.push(resolvedExtPath);\n\t\t\t\t}\n\t\t\t}\n\t\t\tif (entries.length > 0) {\n\t\t\t\treturn entries;\n\t\t\t}\n\t\t}\n\t}\n\n\t// Check for index.ts or index.js\n\tconst indexTs = path.join(dir, \"index.ts\");\n\tconst indexJs = path.join(dir, \"index.js\");\n\tif (fs.existsSync(indexTs)) {\n\t\treturn [indexTs];\n\t}\n\tif (fs.existsSync(indexJs)) {\n\t\treturn [indexJs];\n\t}\n\n\treturn null;\n}\n\n/**\n * Discover extensions in a directory.\n *\n * Discovery rules:\n * 1. Direct files: `extensions/*.ts` or `*.js` → load\n * 2. Subdirectory with index: `extensions/<name>/index.ts` or `index.js` → load\n * 3. Subdirectory with package.json: `extensions/<name>/package.json` with an `omk` manifest → load what it declares\n *\n * No recursion beyond one level. Complex packages must use package.json manifest.\n */\nfunction discoverExtensionsInDir(dir: string): string[] {\n\tif (!fs.existsSync(dir)) {\n\t\treturn [];\n\t}\n\n\tconst discovered: string[] = [];\n\n\ttry {\n\t\tconst entries = fs.readdirSync(dir, { withFileTypes: true });\n\n\t\tfor (const entry of entries) {\n\t\t\tconst entryPath = path.join(dir, entry.name);\n\n\t\t\t// 1. Direct files: *.ts or *.js\n\t\t\tif ((entry.isFile() || entry.isSymbolicLink()) && isExtensionFile(entry.name)) {\n\t\t\t\tdiscovered.push(entryPath);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\t// 2 & 3. Subdirectories\n\t\t\tif (entry.isDirectory() || entry.isSymbolicLink()) {\n\t\t\t\tconst entries = resolveExtensionEntries(entryPath);\n\t\t\t\tif (entries) {\n\t\t\t\t\tdiscovered.push(...entries);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t} catch {\n\t\treturn [];\n\t}\n\n\treturn discovered;\n}\n\n/**\n * Discover and load extensions from standard locations.\n */\nexport async function discoverAndLoadExtensions(\n\tconfiguredPaths: string[],\n\tcwd: string,\n\tagentDir: string = getAgentDir(),\n\teventBus?: EventBus,\n\toptions?: LoadExtensionsOptions,\n): Promise<LoadExtensionsResult> {\n\tconst resolvedCwd = resolvePath(cwd);\n\tconst resolvedAgentDir = resolvePath(agentDir);\n\tconst allPaths: string[] = [];\n\tconst seen = new Set<string>();\n\n\tconst addPaths = (paths: string[]) => {\n\t\tfor (const p of paths) {\n\t\t\tconst resolved = path.resolve(p);\n\t\t\tif (!seen.has(resolved)) {\n\t\t\t\tseen.add(resolved);\n\t\t\t\tallPaths.push(p);\n\t\t\t}\n\t\t}\n\t};\n\n\t// 1. Project-local extensions: cwd/${CONFIG_DIR_NAME}/extensions/\n\tconst localExtDir = path.join(resolvedCwd, CONFIG_DIR_NAME, \"extensions\");\n\taddPaths(discoverExtensionsInDir(localExtDir));\n\n\t// 2. Global extensions: agentDir/extensions/\n\tconst globalExtDir = path.join(resolvedAgentDir, \"extensions\");\n\taddPaths(discoverExtensionsInDir(globalExtDir));\n\n\t// 3. Explicitly configured paths\n\tfor (const p of configuredPaths) {\n\t\tconst resolved = resolvePath(p, resolvedCwd, { normalizeUnicodeSpaces: true });\n\t\tif (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n\t\t\t// Check for package.json with omk manifest or index.ts\n\t\t\tconst entries = resolveExtensionEntries(resolved);\n\t\t\tif (entries) {\n\t\t\t\taddPaths(entries);\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\t// No explicit entries - discover individual files in directory\n\t\t\taddPaths(discoverExtensionsInDir(resolved));\n\t\t\tcontinue;\n\t\t}\n\n\t\taddPaths([resolved]);\n\t}\n\n\treturn loadExtensions(allPaths, resolvedCwd, eventBus, options);\n}\n"]}