pi-fabric 0.92.32 → 0.92.33

package/dist/chunks/{chunk-DUMIK5RZ.js → chunk-CEXO6ELQ.js}

@@ -4,7 +4,7 @@ import {
 } from "./chunk-J2HV2URQ.js";
 import {
   NESTED_TOOL_CALL_ID_PREFIX
-} from "./chunk-JOEFBOFN.js";
+} from "./chunk-DLLIRB63.js";
 import {
   THINKING_DIGEST_CUSTOM_TYPE,
   buildThinkingDigest,
@@ -2012,4 +2012,4 @@ export {
   PrewalkController,
   PrewalkDriftTracker
 };
-//# sourceMappingURL=chunk-DUMIK5RZ.js.map
+//# sourceMappingURL=chunk-CEXO6ELQ.js.map

package/dist/chunks/{chunk-JOEFBOFN.js → chunk-DLLIRB63.js}

@@ -26,7 +26,7 @@ import {
 } from "./chunk-PSNXUZMY.js";
 import {
   FABRIC_NESTED_TOOL_CALL_ID_PREFIX
-} from "./chunk-FAMBJFFF.js";
+} from "./chunk-IJL3QK3J.js";
 import {
   FabricResolutionError,
   FabricTraceSafeError,
@@ -1467,4 +1467,4 @@ export {
   NESTED_TOOL_CALL_ID_PREFIX,
   ActionRegistry
 };
-//# sourceMappingURL=chunk-JOEFBOFN.js.map
+//# sourceMappingURL=chunk-DLLIRB63.js.map

package/dist/chunks/{chunk-FAMBJFFF.js → chunk-IJL3QK3J.js}

@@ -1,4 +1,5 @@
 // src/protocol.ts
+var FABRIC_BASH_MIDDLEWARE = Symbol.for("pi-fabric:bash-middleware:v1");
 var FABRIC_PROVIDER_REGISTER_EVENT = "pi-fabric:provider:register:v1";
 var FABRIC_PROVIDER_DISCOVER_EVENT = "pi-fabric:provider:discover:v1";
 var FABRIC_COMPONENT_REGISTER_EVENT = "pi-fabric:component:register:v1";
@@ -43,6 +44,7 @@ var readFabricToolResultProxyDetailsV1 = (value) => {
 };
 
 export {
+  FABRIC_BASH_MIDDLEWARE,
   FABRIC_PROVIDER_REGISTER_EVENT,
   FABRIC_PROVIDER_DISCOVER_EVENT,
   FABRIC_COMPONENT_REGISTER_EVENT,
@@ -57,4 +59,4 @@ export {
   FABRIC_TOOL_RESULT_PROXY_KIND,
   readFabricToolResultProxyDetailsV1
 };
-//# sourceMappingURL=chunk-FAMBJFFF.js.map
+//# sourceMappingURL=chunk-IJL3QK3J.js.map

package/dist/chunks/chunk-IJL3QK3J.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/protocol.ts"],
+  "sourcesContent": ["import type { BashOperations, BashToolOptions, ExtensionContext } from \"@earendil-works/pi-coding-agent\";\n\n/** Host-local opt-in on a bash ToolDefinition; never serialized into guest schemas. */\nexport const FABRIC_BASH_MIDDLEWARE = Symbol.for(\"pi-fabric:bash-middleware:v1\");\n\n/** The extension keeps standalone execution; Fabric owns local process/job lifetime. */\nexport interface FabricBashMiddlewareV1 {\n  version: 1;\n  options?: Omit<BashToolOptions, \"operations\">;\n  /** Filter output before Fabric retains it in previews, results, or background logs. */\n  wrapOperations: (operations: BashOperations) => BashOperations;\n}\n\nexport const FABRIC_PROVIDER_REGISTER_EVENT = \"pi-fabric:provider:register:v1\";\nexport const FABRIC_PROVIDER_DISCOVER_EVENT = \"pi-fabric:provider:discover:v1\";\nexport const FABRIC_COMPONENT_REGISTER_EVENT = \"pi-fabric:component:register:v1\";\nexport const FABRIC_COMPONENT_DISCOVER_EVENT = \"pi-fabric:component:discover:v1\";\nexport const FABRIC_PREWALK_REQUEST_EVENT = \"pi-fabric:prewalk:request:v1\";\n\nexport type FabricPrewalkRequestResultV1 =\n  | { ok: true }\n  | { ok: false; error: string };\n\n/** Host-local request used by queue extensions that need an acknowledged prewalk arm. */\nexport interface FabricPrewalkRequestV1 {\n  version: 1;\n  context: ExtensionContext;\n  claim: () => boolean;\n  respond: (result: FabricPrewalkRequestResultV1) => void;\n}\n\nexport const readFabricPrewalkRequestV1 = (\n  value: unknown,\n): FabricPrewalkRequestV1 | undefined => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  if (\n    record.version !== 1 ||\n    typeof record.context !== \"object\" ||\n    record.context === null ||\n    typeof record.claim !== \"function\" ||\n    typeof record.respond !== \"function\"\n  ) {\n    return undefined;\n  }\n  return value as FabricPrewalkRequestV1;\n};\n\nexport const FABRIC_PEER_CARDS_EVENT = \"pi-fabric:peers:cards:v1\";\nexport const FABRIC_PEER_AWAIT_SETTLE_EVENT = \"pi-fabric:peer:await-settle:v1\";\n\n/** One root peer session on the project mesh, for pickers and status lines. */\nexport interface FabricPeerCardV1 {\n  id: string;\n  /** Linear-style project label (e.g. \"PQS-2\") minted by the owning host. */\n  label: string;\n  status: \"idle\" | \"running\";\n  model?: string;\n  cwd?: string;\n  startedAt: number;\n  updatedAt: number;\n  pendingMessages: boolean;\n}\n\nexport type FabricPeerCardsResultV1 =\n  | { ok: true; cards: FabricPeerCardV1[] }\n  | { ok: false; error: string };\n\n/** Host-local request used by queue extensions to enumerate live peer sessions. */\nexport interface FabricPeerCardsRequestV1 {\n  version: 1;\n  context: ExtensionContext;\n  claim: () => boolean;\n  respond: (result: FabricPeerCardsResultV1) => void;\n}\n\nexport const readFabricPeerCardsRequestV1 = (\n  value: unknown,\n): FabricPeerCardsRequestV1 | undefined => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  if (\n    record.version !== 1 ||\n    typeof record.context !== \"object\" ||\n    record.context === null ||\n    typeof record.claim !== \"function\" ||\n    typeof record.respond !== \"function\"\n  ) {\n    return undefined;\n  }\n  return value as FabricPeerCardsRequestV1;\n};\n\nexport interface FabricPeerSettleProgressV1 {\n  waiting: Array<{ label: string; status: \"idle\" | \"running\" }>;\n}\n\nexport type FabricPeerAwaitSettleResultV1 =\n  | { ok: true }\n  | { ok: false; error: string };\n\n/**\n * Host-local request used by queue extensions to hold dispatch until peer\n * sessions settle. A peer counts as settled once it has been quiet\n * (status-wide) for settledForMs; peers that vanish from the mesh count as\n * settled since they can no longer conflict. Selector matches a peer label\n * (case-insensitive) or exact participant id; omitted waits on all peers.\n */\nexport interface FabricPeerAwaitSettleRequestV1 {\n  version: 1;\n  context: ExtensionContext;\n  selector?: string;\n  settledForMs?: number;\n  signal?: AbortSignal;\n  update?: (progress: FabricPeerSettleProgressV1) => void;\n  claim: () => boolean;\n  respond: (result: FabricPeerAwaitSettleResultV1) => void;\n}\n\nexport const readFabricPeerAwaitSettleRequestV1 = (\n  value: unknown,\n): FabricPeerAwaitSettleRequestV1 | undefined => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  const signal = record.signal as AbortSignal | undefined;\n  if (\n    record.version !== 1 ||\n    typeof record.context !== \"object\" ||\n    record.context === null ||\n    typeof record.claim !== \"function\" ||\n    typeof record.respond !== \"function\" ||\n    (record.selector !== undefined && typeof record.selector !== \"string\") ||\n    (record.settledForMs !== undefined && typeof record.settledForMs !== \"number\") ||\n    (signal !== undefined && typeof signal.aborted !== \"boolean\") ||\n    (record.update !== undefined && typeof record.update !== \"function\")\n  ) {\n    return undefined;\n  }\n  return value as FabricPeerAwaitSettleRequestV1;\n};\n\n/** Identifies host-side tool lifecycle events replayed for a nested Fabric call. */\nexport const FABRIC_NESTED_TOOL_CALL_ID_PREFIX = \"fabric_\";\n\n/** Discriminant for the transient details envelope on a proxied provider result. */\nexport const FABRIC_TOOL_RESULT_PROXY_KIND = \"pi-fabric.tool-result-proxy.v1\";\n\n/**\n * Host-only middleware details for non-Pi Fabric providers. `result` is the\n * exact value before maxNestedResultChars is enforced and is not persisted as\n * a separate Pi tool-result message.\n */\nexport interface FabricToolResultProxyDetailsV1 {\n  kind: typeof FABRIC_TOOL_RESULT_PROXY_KIND;\n  ref: string;\n  result: unknown;\n}\n\nexport const readFabricToolResultProxyDetailsV1 = (\n  value: unknown,\n): FabricToolResultProxyDetailsV1 | undefined => {\n  if (typeof value !== \"object\" || value === null || Array.isArray(value)) return undefined;\n  const record = value as Record<string, unknown>;\n  if (\n    record.kind !== FABRIC_TOOL_RESULT_PROXY_KIND ||\n    typeof record.ref !== \"string\" ||\n    !Object.prototype.hasOwnProperty.call(record, \"result\")\n  ) {\n    return undefined;\n  }\n  return record as unknown as FabricToolResultProxyDetailsV1;\n};\n\nexport type FabricRisk = \"read\" | \"write\" | \"execute\" | \"network\" | \"agent\";\nexport type FabricEffectKind = \"none\" | \"scoped\" | \"transactional\" | \"emission\";\nexport type FabricEffectOrdering = \"commutative\" | \"ordered\" | \"unknown\";\n\nexport interface FabricActionEffect {\n  kind: FabricEffectKind;\n  resources?: string[];\n  ordering?: FabricEffectOrdering;\n}\n\n/** MCP tool annotations (Model Context Protocol ToolAnnotations), cached when a runtime surfaces them. */\nexport interface FabricToolAnnotations {\n  readOnlyHint?: boolean;\n  idempotentHint?: boolean;\n  destructiveHint?: boolean;\n  openWorldHint?: boolean;\n}\nexport type FabricActivityEntityKind =\n  | \"agent\"\n  | \"actor\"\n  | \"tool\"\n  | \"extension\"\n  | \"mcp\"\n  | \"mesh\"\n  | \"task\"\n  | \"custom\";\n\nexport type FabricInvocationActivityUpdate =\n  | { type: \"progress\"; message: string }\n  | { type: \"entity\"; id: string; kind: FabricActivityEntityKind; name?: string }\n  | { type: \"metrics\"; tokens?: number; toolCalls?: number; cost?: number };\n\nexport interface FabricMediaBlock {\n  type: \"image\";\n  data: string;\n  mimeType: string;\n}\n\nexport interface FabricActionDescriptor {\n  name: string;\n  description: string;\n  inputSchema: Record<string, unknown>;\n  outputSchema?: Record<string, unknown>;\n  risk: FabricRisk;\n  namespace?: string;\n  effect?: FabricActionEffect;\n  annotations?: FabricToolAnnotations;\n}\n\nexport interface FabricCapabilityActionHead {\n  key: string;\n  parentKey: string;\n  ref: string;\n  name: string;\n  description: string;\n  descriptorHash: string;\n  risk: FabricRisk;\n  namespace?: string;\n  effect?: FabricActionEffect;\n}\n\nexport interface FabricCapabilityProviderHead {\n  key: string;\n  parentKey: string;\n  name: string;\n  description: string;\n  descriptorHash: string;\n  actions: FabricCapabilityActionHead[];\n}\n\nexport interface FabricCapabilityBindingView {\n  ref: string;\n  provider: string;\n  providerBindingId: string;\n  generation: number;\n  descriptorHash: string;\n}\n\nexport interface FabricCommittedCapabilityView {\n  id: string;\n  /** Runtime-local digest including provider binding generations. */\n  digest: string;\n  /** Portable digest of exact refs and descriptor semantics across runtimes. */\n  semanticDigest: string;\n  bindings: Record<string, FabricCapabilityBindingView>;\n}\n\nexport interface FabricCapabilityResolution {\n  satisfied: boolean;\n  missing: string[];\n  optionalMissing: string[];\n  view?: FabricCommittedCapabilityView;\n}\n\nexport interface FabricCapabilityCatalog {\n  kind: \"pi-fabric.capability-catalog\";\n  version: 1;\n  root: {\n    key: \"capability:fabric\";\n    name: \"Fabric capabilities\";\n    description: string;\n    descriptorHash: string;\n  };\n  providers: FabricCapabilityProviderHead[];\n  totalActions: number;\n  indexedActions: number;\n  complete: boolean;\n  reasons: string[];\n}\n\nexport interface FabricProviderListRequest {\n  namespace?: string;\n  query?: string;\n  limit?: number;\n}\n\n/** One named action whose arguments should be typed in guest declarations. */\nexport interface FabricNamedActionTypeSource {\n  name: string;\n  inputSchema: Record<string, unknown>;\n}\n\n/** One MCP server plus the tools to type for `mcp.<server>.*` guest calls. */\nexport interface FabricMcpServerTypeSource {\n  server: string;\n  tools: FabricNamedActionTypeSource[];\n}\n\nexport type {\n  FabricKernel,\n  FabricKernelRuntime,\n  FabricHostCall,\n  FabricSandboxOptions,\n  FabricSandboxResult,\n  FabricSandboxTerminationReason,\n} from \"./runtime/kernel.js\";\nexport type { FabricPythonRuntime } from \"./config.js\";\n\n/**\n * Live descriptor snapshot the registry hands to the guest declaration\n * builder so dynamic surfaces (mcp, extensions) get argument checking before\n * the sandbox runs. Empty/absent sections keep the loose static declarations.\n */\nexport interface FabricGuestTypeSources {\n  mcpServers?: FabricMcpServerTypeSource[];\n  extensionTools?: FabricNamedActionTypeSource[];\n}\n\n/**\n * Pre-rendered `declare const` blocks replacing the loose mcp/extensions\n * declaration lines. Values are full replacement text (helpers + declare).\n */\nexport interface FabricDynamicGuestDeclarations {\n  mcp?: string;\n  extensions?: string;\n}\n\nexport interface FabricInvocationContext {\n  cwd: string;\n  signal: AbortSignal | undefined;\n  parentToolCallId: string;\n  nestedToolCallId: string;\n  extensionContext: ExtensionContext;\n  update(message: string): void;\n  activity?(update: FabricInvocationActivityUpdate): void;\n  /** Host-supplied inside fabric_exec so agents.handoff schedules the outer-call boundary. */\n  deferHandoff?(args: Record<string, unknown>): Record<string, unknown>;\n  // Out-of-band image content blocks a provider (currently only pi.read of an\n  // image file) wants attached to the call audit, so the single-call render can\n  // re-attach them to the fabric_exec result content for pi core's kitty image\n  // preview. Bypasses the result char bound that would truncate the base64.\n  // `note` is the read tool's own text output (e.g. \"Read image file [image/png]\"),\n  // captured after any tool_result patch so a handoff that strips pi's\n  // non-vision note has run; used as the single-call body + content text so the\n  // preview shows the clean note instead of the swapped description.\n  attachMedia?(blocks: FabricMediaBlock[], note?: string): void;\n  // Providers call this after mutable tool_call middleware has run so live and\n  // durable audit surfaces reflect the arguments actually passed to the tool.\n  updateArguments?(args: Record<string, unknown>): void;\n  // Ephemeral renderer-only metadata. It is exposed to live Fabric previews but\n  // never projected into the durable execution trace.\n  attachPreview?(preview: unknown): void;\n  capabilityView?: FabricCommittedCapabilityView;\n  /** Advisory for ordinary calls; strict components reject concurrent conflicting effects. */\n  effectPolicy?: \"advisory\" | \"strict\";\n}\n\nexport interface FabricScopedProviderResult {\n  value: unknown;\n  dispose(): void | Promise<void>;\n}\n\nexport interface FabricProvider {\n  name: string;\n  description: string;\n  list(\n    request: FabricProviderListRequest,\n    context: FabricInvocationContext,\n  ): Promise<FabricActionDescriptor[]>;\n  describe(\n    actionName: string,\n    context: FabricInvocationContext,\n  ): Promise<FabricActionDescriptor | undefined>;\n  prepareArguments?(\n    actionName: string,\n    args: Record<string, unknown>,\n    context: FabricInvocationContext,\n  ): Record<string, unknown> | Promise<Record<string, unknown>>;\n  invoke(\n    actionName: string,\n    args: Record<string, unknown>,\n    context: FabricInvocationContext,\n  ): Promise<unknown>;\n  acquire?(\n    actionName: string,\n    args: Record<string, unknown>,\n    context: FabricInvocationContext,\n  ): Promise<FabricScopedProviderResult>;\n  invocationEnded?(parentToolCallId: string): Promise<void>;\n  subscribeCatalog?(listener: () => void): () => void;\n  close?(): Promise<void>;\n}\n\nexport interface FabricProviderRegistration {\n  version: 1;\n  provider: FabricProvider;\n  overwrite?: boolean;\n}\n\nexport interface FabricProviderDiscovery {\n  version: 1;\n  register(provider: FabricProvider, options?: { overwrite?: boolean }): void;\n}\n\nexport type {\n  ComponentChangeRequest as FabricComponentChangeRequest,\n  ComponentChangePlan as FabricComponentChangePlan,\n} from \"./components/control.js\";\n\nexport type {\n  FabricCapabilityRequirement,\n  FabricComponentChildOptions,\n  FabricComponentContext,\n  FabricComponentDefinition,\n  FabricComponentDiscovery,\n  FabricComponentDisposer,\n  FabricComponentEffect,\n  FabricComponentEffectConflict,\n  FabricComponentEffectInfo,\n  FabricComponentEffectOptions,\n  FabricComponentEffectRegistration,\n  FabricComponentEntry,\n  FabricComponentGraph,\n  FabricComponentGuarantee,\n  FabricComponentHandle,\n  FabricComponentInfo,\n  FabricComponentProviderLease,\n  FabricModelGuidance,\n  FabricModelGuidanceInfo,\n  FabricModelGuidancePlacement,\n  FabricModelGuidanceTarget,\n  FabricComponentProvision,\n  FabricComponentRegistration,\n  FabricComponentState,\n  FabricComponentStopOptions,\n} from \"./components/types.js\";\n\nexport {\n  FABRIC_EXECUTION_GUIDANCE_SLOT,\n  MAX_FABRIC_MODEL_GUIDANCE_CONTENT_CHARS,\n  MAX_FABRIC_MODEL_GUIDANCE_PER_COMPONENT,\n  MAX_FABRIC_MODEL_GUIDANCE_REGISTRATIONS,\n  MAX_FABRIC_MODEL_GUIDANCE_SNAPSHOT_CHARS,\n  MAX_FABRIC_MODEL_GUIDANCE_TOTAL_CHARS,\n} from \"./components/model-guidance.js\";\n"],
+  "mappings": ";AAGO,IAAM,yBAAyB,OAAO,IAAI,8BAA8B;AAUxE,IAAM,iCAAiC;AACvC,IAAM,iCAAiC;AACvC,IAAM,kCAAkC;AACxC,IAAM,kCAAkC;AACxC,IAAM,+BAA+B;AAcrC,IAAM,6BAA6B,CACxC,UACuC;AACvC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,MACE,OAAO,YAAY,KACnB,OAAO,OAAO,YAAY,YAC1B,OAAO,YAAY,QACnB,OAAO,OAAO,UAAU,cACxB,OAAO,OAAO,YAAY,YAC1B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,IAAM,0BAA0B;AAChC,IAAM,iCAAiC;AA2BvC,IAAM,+BAA+B,CAC1C,UACyC;AACzC,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,MACE,OAAO,YAAY,KACnB,OAAO,OAAO,YAAY,YAC1B,OAAO,YAAY,QACnB,OAAO,OAAO,UAAU,cACxB,OAAO,OAAO,YAAY,YAC1B;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AA4BO,IAAM,qCAAqC,CAChD,UAC+C;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,QAAM,SAAS,OAAO;AACtB,MACE,OAAO,YAAY,KACnB,OAAO,OAAO,YAAY,YAC1B,OAAO,YAAY,QACnB,OAAO,OAAO,UAAU,cACxB,OAAO,OAAO,YAAY,cACzB,OAAO,aAAa,UAAa,OAAO,OAAO,aAAa,YAC5D,OAAO,iBAAiB,UAAa,OAAO,OAAO,iBAAiB,YACpE,WAAW,UAAa,OAAO,OAAO,YAAY,aAClD,OAAO,WAAW,UAAa,OAAO,OAAO,WAAW,YACzD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAGO,IAAM,oCAAoC;AAG1C,IAAM,gCAAgC;AAatC,IAAM,qCAAqC,CAChD,UAC+C;AAC/C,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,QAAM,SAAS;AACf,MACE,OAAO,SAAS,iCAChB,OAAO,OAAO,QAAQ,YACtB,CAAC,OAAO,UAAU,eAAe,KAAK,QAAQ,QAAQ,GACtD;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/core/action-registry.js

@@ -2,11 +2,11 @@ import {
   ActionRegistry,
   NESTED_TOOL_CALL_ID_PREFIX,
   fabricActionListLimit
-} from "../chunks/chunk-JOEFBOFN.js";
+} from "../chunks/chunk-DLLIRB63.js";
 import "../chunks/chunk-LMAVZN7J.js";
 import "../chunks/chunk-7TB7NXSL.js";
 import "../chunks/chunk-PSNXUZMY.js";
-import "../chunks/chunk-FAMBJFFF.js";
+import "../chunks/chunk-IJL3QK3J.js";
 import "../chunks/chunk-D5WKZONW.js";
 import "../chunks/chunk-G4LADAYY.js";
 import "../chunks/chunk-YU62DDKK.js";

package/dist/core/shell-middleware.d.ts

@@ -0,0 +1,4 @@
+import { type FabricBashMiddlewareV1 } from "../protocol.js";
+/** Invalid opt-ins fail closed: never silently run without an extension's filters. */
+export declare const readFabricBashMiddleware: (definition: object | undefined) => FabricBashMiddlewareV1 | undefined;
+//# sourceMappingURL=shell-middleware.d.ts.map

package/dist/core/shell-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-middleware.d.ts","sourceRoot":"","sources":["../../src/core/shell-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,KAAK,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAErF,sFAAsF;AACtF,eAAO,MAAM,wBAAwB,GAAI,YAAY,MAAM,GAAG,SAAS,KAAG,sBAAsB,GAAG,SAkBlG,CAAC"}

package/dist/fabric-runtime-state.js

@@ -33,7 +33,7 @@ import {
   expandSkillDirMarkersForRead,
   resolveFabricIdentity,
   runFabricHandoffAtBoundary
-} from "./chunks/chunk-DUMIK5RZ.js";
+} from "./chunks/chunk-CEXO6ELQ.js";
 import {
   AgentTranscriptReader,
   MAX_WRITE_DIFF_BYTES,
@@ -46,7 +46,7 @@ import {
   ActionRegistry,
   fabricActionListLimit,
   repairActionName
-} from "./chunks/chunk-JOEFBOFN.js";
+} from "./chunks/chunk-DLLIRB63.js";
 import {
   formatFabricEffectConflict
 } from "./chunks/chunk-LMAVZN7J.js";
@@ -93,11 +93,12 @@ import {
   validationMessage
 } from "./chunks/chunk-PSNXUZMY.js";
 import {
+  FABRIC_BASH_MIDDLEWARE,
   FABRIC_COMPONENT_DISCOVER_EVENT,
   FABRIC_PROVIDER_DISCOVER_EVENT,
   FABRIC_TOOL_RESULT_PROXY_KIND,
   readFabricToolResultProxyDetailsV1
-} from "./chunks/chunk-FAMBJFFF.js";
+} from "./chunks/chunk-IJL3QK3J.js";
 import {
   sanitizeFabricMediaText,
   sanitizeFabricMediaValue
@@ -7240,6 +7241,32 @@ var tryExecuteGitWorktreeAdd = async (args, sessionCwd) => {
   };
 };
 
+// src/core/shell-middleware.ts
+var readFabricBashMiddleware = (definition) => {
+  if (!definition || !(FABRIC_BASH_MIDDLEWARE in definition)) return void 0;
+  const value = Reflect.get(definition, FABRIC_BASH_MIDDLEWARE);
+  const invalid = () => {
+    throw new Error("Invalid Fabric bash middleware v1; refusing to bypass shell protection");
+  };
+  if (!value || typeof value !== "object" || Array.isArray(value)) return invalid();
+  const record = value;
+  if (record.version !== 1 || typeof record.wrapOperations !== "function") return invalid();
+  if (record.options !== void 0) {
+    if (!record.options || typeof record.options !== "object" || Array.isArray(record.options)) return invalid();
+    const options = record.options;
+    const fields = {
+      commandPrefix: "string",
+      shellPath: "string",
+      exposeSessionEnvironment: "boolean",
+      spawnHook: "function"
+    };
+    for (const [key, option] of Object.entries(options)) {
+      if (!Object.hasOwn(fields, key) || option !== void 0 && typeof option !== fields[key]) return invalid();
+    }
+  }
+  return value;
+};
+
 // src/providers/pi-bash-cwd.ts
 import { accessSync, constants, statSync } from "node:fs";
 import path7 from "node:path";
@@ -7588,17 +7615,28 @@ var PiToolsProvider = class {
     const name = actionName;
     if (this.#allowedTools && !this.#allowedTools.has(name)) return void 0;
     const override = await this.#capturedTools?.describe(name, _context);
-    if (override) return { ...override, namespace: "extension-override" };
+    if (override) {
+      if (this.#bashMiddleware(name)) {
+        return {
+          ...override,
+          description: `${override.description} Shell execution and background jobs are managed by Fabric with the extension's middleware.`,
+          inputSchema: this.#descriptor(name, this.#tools[name]).inputSchema,
+          namespace: "extension-middleware"
+        };
+      }
+      return { ...override, namespace: "extension-override" };
+    }
     const tool = this.#tools[name];
     if (!tool || this.#requireCapturedOverrides) return void 0;
     return this.#descriptor(name, tool);
   }
   prepareArguments(actionName, args) {
     this.#assertAllowed(actionName);
-    const definition = this.#catalog?.get(actionName)?.definition ?? this.#tools[actionName];
+    const middleware = this.#bashMiddleware(actionName);
+    const definition = (middleware ? void 0 : this.#catalog?.get(actionName)?.definition) ?? this.#tools[actionName];
     const properties = definition?.parameters?.properties ?? {};
     args = normalizePiArguments(actionName, args, Object.keys(properties));
-    if (this.#catalog?.get(actionName)) {
+    if (this.#catalog?.get(actionName) && !middleware) {
       return this.#capturedTools.prepareArguments(actionName, args);
     }
     const tool = this.#tools[actionName];
@@ -7669,15 +7707,26 @@ var PiToolsProvider = class {
     const cwd = args[PI_BASH_CWD_KEY];
     return isPiShellToolName(name) && typeof cwd === "string" ? { ...context, cwd } : context;
   }
+  #bashMiddleware(name) {
+    if (name !== "bash" || this.#requireCapturedOverrides) return void 0;
+    return readFabricBashMiddleware(this.#catalog?.get(name)?.definition);
+  }
   #shellHangMs() {
     const value = this.#getShellHangMs?.() ?? DEFAULT_SHELL_HANG_MS;
     return Number.isFinite(value) ? Math.max(0, Math.floor(value)) : DEFAULT_SHELL_HANG_MS;
   }
-  #trackedShellDefinition(name, args, job) {
+  #trackedShellDefinition(name, args, job, middleware) {
     const cwd = typeof args[PI_BASH_CWD_KEY] === "string" ? args[PI_BASH_CWD_KEY] : this.#cwd;
     if (name === "bash") {
+      const options = middleware?.options;
+      const local = createLocalBashOperations(options?.shellPath !== void 0 ? { shellPath: options.shellPath } : void 0);
+      const operations = middleware ? middleware.wrapOperations(local) : local;
+      if (!operations || typeof operations.exec !== "function") {
+        throw new Error("Invalid Fabric bash middleware operations; refusing to bypass shell protection");
+      }
       return createBashToolDefinition2(cwd, {
-        operations: trackShellOperations(createLocalBashOperations(), job, "bash")
+        ...options,
+        operations: trackShellOperations(operations, job, "bash")
       });
     }
     const create = Reflect.get(PiCodingAgent2, "createPowerShellToolDefinition");
@@ -7689,7 +7738,7 @@ var PiToolsProvider = class {
       operations: trackShellOperations(operationsFactory(), job, "powershell")
     });
   }
-  async #runExecute(name, tool, args, context, onUpdate) {
+  async #runExecute(name, tool, args, context, onUpdate, middleware) {
     if (!isPiShellToolName(name) || this.#requireCapturedOverrides) {
       return await runAbortable(
         context.signal,
@@ -7702,15 +7751,21 @@ var PiToolsProvider = class {
         )
       );
     }
-    return this.#executeHungShell(name, args, context, onUpdate);
+    return this.#executeHungShell(name, args, context, onUpdate, middleware);
   }
-  async #executeHungShell(name, args, context, onUpdate) {
+  async #executeHungShell(name, args, context, onUpdate, middleware) {
     const command = typeof args.command === "string" ? args.command : "";
     const background = args.background === true;
     const executeArgs = background || "background" in args ? (({ background: _ignored, ...rest }) => rest)(args) : args;
     const job = this.#shellJobs.begin(name, command);
+    let tool;
+    try {
+      tool = this.#trackedShellDefinition(name, executeArgs, job, middleware);
+    } catch (error) {
+      await job.finish(null);
+      throw error;
+    }
     void job.readPid();
-    const tool = this.#trackedShellDefinition(name, executeArgs, job);
     let spilled = false;
     const outcome = await raceShellHang({
       hangMs: background ? 0 : this.#shellHangMs(),
@@ -7762,14 +7817,15 @@ var PiToolsProvider = class {
     const name = actionName;
     this.#assertAllowed(name);
     if (!this.#requireCapturedOverrides && !this.#tools[name]) throw new Error(`Unknown Pi tool: ${actionName}`);
-    if (name === "bash" && !this.#requireCapturedOverrides) {
+    if (name === "bash" && !this.#requireCapturedOverrides && !this.#catalog?.get(name)) {
       const intercepted = await tryExecuteGitWorktreeAdd(args, this.#cwd);
       if (intercepted) {
         this.#attachPreview(name, intercepted, args, context);
         return this.#normalizeResult(name, intercepted, args);
       }
     }
-    if (this.#catalog?.get(name)) {
+    const middleware = this.#bashMiddleware(name);
+    if (this.#catalog?.get(name) && !middleware) {
       const result = await this.#capturedTools.invoke(name, args, context);
       this.#attachReadMedia(name, result, context);
       this.#attachReadNote(name, result, context);
@@ -7784,7 +7840,8 @@ var PiToolsProvider = class {
         tool,
         args,
         context,
-        (partialResult) => this.#attachPartialPreview(name, partialResult, args, context)
+        (partialResult) => this.#attachPartialPreview(name, partialResult, args, context),
+        middleware
       ).catch((error) => {
         throwIfAborted(context.signal);
         throw isPiShellToolName(name) ? classifyPiBashError(error) : error;
@@ -7794,7 +7851,7 @@ var PiToolsProvider = class {
       this.#attachPreview(name, result, args, context);
       return this.#normalizeResult(name, result, args);
     }
-    return this.#invokeWithEvents(name, tool, args, context, runner);
+    return this.#invokeWithEvents(name, tool, args, context, runner, middleware);
   }
   // Replay the agent-core tool-execution lifecycle for a nested pi.* call, so
   // extensions that hook tool_call / tool_result / tool_execution_* see pi
@@ -7804,7 +7861,7 @@ var PiToolsProvider = class {
   // tools. tool_result patches (content/details/isError) are applied, so
   // extensions like pi-vision-handoff can replace image blocks with text
   // descriptions before the result returns to the sandbox.
-  async #invokeWithEvents(name, tool, args, context, runner) {
+  async #invokeWithEvents(name, tool, args, context, runner, middleware) {
     const toolCallId = context.nestedToolCallId;
     await runAbortable(context.signal, () => runner.emit({
       type: "tool_execution_start",
@@ -7845,7 +7902,8 @@ var PiToolsProvider = class {
               partialResult
             }))
           ).catch(() => void 0);
-        }
+        },
+        middleware
       );
     } catch (error) {
       thrown = isPiShellToolName(name) && executionStarted ? classifyPiBashError(error) : error;