pi-openappa 0.0.0-stage → 0.2.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 aemonge
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,159 @@
-# Temporary Holding Version
+# pi-openappa
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+A thin [OpenAPPA](https://openappa.com) guard extension for
+[Pi](https://pi.dev): every tool call in a protected session is checked by the
+APPA runtime before it runs, and every tool result before the model sees it.
+No policy logic lives here — the APPA runtime owns every decision; this
+extension only translates events and enforces the answer.
+
+```text
+pi event ──▶ adapter ──▶ `appa hook` ──▶ APPA runtime
+                                          allow / deny / replace
+pi event ◀── enforce  ◀── decision  ◀────────────┘
+```
+
+## Requirements
+
+- The `appa` binary on `PATH`: `curl -fsSL https://openappa.com/install.sh | sh`
+  (the extension installs it automatically when missing) — version 0.31.x
+  verified; see `docs/wire-notes.md` for the recorded contract
+- An APPA runtime listening on loopback (default `127.0.0.1:8787`)
+- A policy (`appa.toml`) that declares the tools your sessions may use
+
+## Install
+
+```sh
+pi install npm:pi-openappa        # published on npm; indexed by the Pi gallery
+pi install ./pi-openappa          # from a checkout
+```
+
+## Smoke test
+
+Ship and verify in one pass:
+
+```sh
+just deploy                        # sync the lockfile, run checks, npm publish
+just remove                        # drop a local-checkout install, if present
+pi install npm:pi-openappa         # install the published package
+pi                                 # any session: protection on, appa auto-installs
+appa --version                     # OK — the runtime is on PATH
+```
+
+`pi install` only registers the package — extension code runs when a session
+starts, so `appa` appears after that first session, not before.
+
+## Protect sessions
+
+Protection is **on by default**: every Pi session is guarded unless you opt
+out. Opt-outs, most specific first:
+
+- **Per launch:** `APPA_GATE=0 pi` (and `APPA_GATE=1 pi` to force it on).
+- **Per project:** create `<project>/.pi/no-openappa` — sessions started in
+  that directory run unguarded.
+- **Globally:** `/appa off` once (marker `~/.config/pi-openappa/off`) — every
+  session everywhere runs unguarded until `/appa on`.
+
+The project marker `<project>/.pi/openappa` names that project's policy
+(absolute or cwd-relative) and re-enables protection even when globally off;
+empty content falls back to `APPA_CONFIG` or APPA's default:
+
+  ```sh
+  cd your-project && mkdir -p .pi && echo "appa.toml" > .pi/openappa
+  ```
+
+A protected session brings the runtime up on its own: `session_start` invokes
+`appa hook --ensure-runtime`, passing `--config "$APPA_CONFIG"` when set and
+otherwise letting APPA use its own default policy (`~/.config/appa/appa.toml`).
+Protected sessions therefore need zero manual server management. A custom
+`APPA_RUNTIME_URL` names a runtime that is *yours* to start — the hook
+refuses with exactly that reason instead of guessing.
+
+When the default `appa` is missing from `PATH`, a protected session installs
+it itself — once, with a UI notice — by running the same official script
+(`curl -fsSL https://openappa.com/install.sh | sh`), then retries starting
+the runtime. Sessions that name a custom `APPA_HOOK_BIN` are never
+auto-installed.
+
+While protected, a runtime that cannot answer blocks the call and the reason
+is returned to the model — **silence never means yes**; `/appa off` always
+works, even with every tool call blocked. One exception: with **no policy
+anywhere** (`APPA_CONFIG`, marker content, and `~/.config/appa/appa.toml` all
+absent) and no runtime answering, the session runs **unprotected** with one
+startup warning naming the fixes — an unconfigured guard must not lock you
+out of your own machine. A named policy that fails stays fail-closed.
+Opted-out sessions never invoke the hook.
+
+## Configuration
+
+| Variable | Default | Meaning |
+|---|---|---|
+| `APPA_GATE` | unset | `1` forces protection on for this launch; `0` forces it off |
+| `.pi/openappa` | absent | Project marker: names that project's policy and forces protection on |
+| `.pi/no-openappa` | absent | Project opt-out: sessions started there run unguarded |
+| `APPA_RUNTIME_URL` | `http://127.0.0.1:8787` | Runtime endpoint (loopback only) |
+| `APPA_CONFIG` | unset | `appa.toml` the session auto-starts the runtime with |
+| `APPA_HOOK_BIN` | `appa` | Hook binary to invoke |
+| `APPA_INSTALL_CMD` | `curl -fsSL https://openappa.com/install.sh \| sh` | Auto-install command for a missing default `appa` (pin a mirror or offline copy) |
+| `APPA_HOOK_TIMEOUT_MS` | `15000` | Kill the hook after this long; the call is then blocked |
+| `APPA_INSTALL_TIMEOUT_MS` | `120000` | Kill a stuck auto-install after this long |
+
+`/appa` reports protection, opt-out state, and runtime health; `/appa off`
+disables protection globally (marker `~/.config/pi-openappa/off`) and
+`/appa on` re-enables it, taking effect immediately including the
+current session.
+
+## Event mapping
+
+| Pi event | APPA event | Effect |
+|---|---|---|
+| `session_start` | `SessionStart` | opens the trajectory; warns when the runtime is down |
+| `before_agent_start` | `UserPromptSubmit` | turn boundary (never gates) |
+| `tool_call` | `PreToolUse` | deny blocks the call; the reason reaches the model |
+| `tool_result` | `PostToolUse` | replace swaps the result the model sees |
+| `turn_end` | `Stop` | reported (`--turn-end`), never gates |
+
+Pi built-in tool names map to Claude Code policy names (`bash`→`Bash`,
+`find`→`Glob`, …); custom and MCP tools pass through under their own names and
+policies declare them verbatim.
+
+## Limitations
+
+- **Load order matters in theory**: the runtime digests tool arguments at
+  `PreToolUse`. If another extension rewrites `event.input` after this
+  handler runs, the executed arguments differ from the checked ones and the
+  runtime withholds the result (`byte_mismatch`). Load pi-openappa last if
+  you combine it with argument-rewriting extensions.
+- **Policy edits reach new sessions only**: trajectories keep the policy they
+  opened with, by runtime design. When iterating on a policy, restart the
+  runtime (and start fresh sessions) — a stale runtime or an old trajectory
+  will keep serving the old policy.
+- **Subagents**: spawning is mediated as a plain tool call (deny blocks the
+  spawn). Child trajectories are not linked into the parent's label chain
+  yet; a gated child Pi process opens its own root trajectory.
+- **On by default**: installing this extension guards every session and may
+  download and run openappa.com's install script once on first run. The
+  opt-outs above and `APPA_INSTALL_CMD` are the escapes.
+- **Auto-install is `curl \| sh`**: a protected session with the default
+  binary missing downloads and runs the script with user privileges, at most
+  once per session start. Pre-install `appa` or pin `APPA_INSTALL_CMD` to
+  avoid it.
+- The adapter never starts a runtime for opted-out sessions; auto-start needs
+  either `APPA_CONFIG` or an installed APPA deployment.
+- OpenAPPA is Preview & RFC: wire surfaces may break without shims. The
+  entire wire contract lives in `src/hook-client.ts` and `src/adapter.ts`
+  (verified facts in `docs/wire-notes.md`), and the adapter core is
+  runtime-agnostic so a pi-durable wiring can reuse it unchanged.
+
+## Development
+
+```sh
+npm test        # node --test, mock-driven, no runtime needed
+npm run typecheck
+```
+
+The adapter core (`src/adapter.ts`) has no Pi imports by design; the Pi
+wiring is `extensions/index.ts` only.
+
+## License
+
+MIT

package/docs/wire-notes.md

@@ -0,0 +1,80 @@
+# Wire notes: `appa hook` contract (verified 2026-10-06, appa 0.31.1)
+
+All facts below were probed live against `appa runtime` on 127.0.0.1:8791 with a
+minimal one-tool policy. Probes: SessionStart, UserPromptSubmit, PreToolUse (allow,
+undeclared-refuse), PostToolUse (byte-mismatch withhold), Stop --turn-end, plus
+ungated and runtime-down probes.
+
+## Transport
+
+- Subprocess: `appa hook` (env inherited; gate and URL read from env)
+- Gate: inert unless `APPA_GATE=1` — ungated always exits 0, no side effects
+- URL: `APPA_RUNTIME_URL` (default `127.0.0.1:8787`, loopback only)
+- Turn-end: pass `--turn-end` (non-blocking report; exit 0 even when down)
+- Payload: Claude Code hook JSON on stdin
+
+## Payload fields (accepted and observed)
+
+- `session_id` — becomes trajectory `cc:<session_id>` in the runtime
+- `hook_event_name` — `SessionStart` | `UserPromptSubmit` | `PreToolUse` |
+  `PostToolUse` | `Stop`
+- `source` (SessionStart): `startup` | `resume`
+- `prompt` (UserPromptSubmit)
+- `tool_name`, `tool_input` (PreToolUse / PostToolUse)
+- `tool_response` (PostToolUse)
+- `cwd`
+
+## Decision protocol (observed)
+
+- Exit 0, no stdout (or `{}`) → proceed. SessionStart/UserPromptSubmit behave so.
+- Exit 0 + `{"hookSpecificOutput":{"hookEventName":"PreToolUse",
+  "permissionDecision":"allow","permissionDecisionReason":"..."}}` → proceed.
+- Exit 2 + stderr `OpenAPPA hook blocked: <reason>` → block; reason goes to the
+  model. Observed for an undeclared tool (HTTP 409 upstream, stdout carries
+  `{"error": "<reason>"}`).
+- Exit 0 + `{"decision":"block","reason":"...",
+  "hookSpecificOutput":{"hookEventName":"PostToolUse","updatedToolOutput":{...}}}`
+  → PostToolUse replacement: `updatedToolOutput` is what the model must see
+  (observed: withheld-result notice replacing a mismatched result).
+- Runtime down: PreToolUse exit 2 (fail-closed, stderr names 127.0.0.1:8787);
+  Stop --turn-end exit 0 + stderr warning.
+
+## Hard constraints
+
+1. **Byte-exact echo**: PostToolUse `tool_input` must be byte-identical to the
+   PreToolUse `tool_input` (runtime digests it canonically; mismatch → result
+   withheld with `byte_mismatch`). The extension must remember the exact object
+   it sent per tool call id.
+2. **Tool naming**: the runtime sees `host/claude-code/<Name>`; policies are
+   written in Claude-Code naming. Map pi built-ins: bash→Bash,
+   powershell→PowerShell, read→Read, edit→Edit, write→Write, grep→Grep,
+   find→Glob, ls→LS. Unknown/custom tools pass through verbatim; policy authors
+   declare them under the pi name.
+3. **tool_response shape**: Claude-Code-shaped for tools where pi provides the
+   data (bash: `stdout`/`stderr`/`exitcode`/`interrupted` from details when
+   present); otherwise generic `{ "output": <joined text>, "isError": <bool> }`.
+
+## Session mapping
+
+pi `session_start.reason`: `startup|new` → `startup`; `resume|fork|reload` →
+`resume`.
+
+## Not yet observed (client parses defensively)
+
+- `permissionDecision: "deny"` exact shape (a declared-but-denied call)
+- `deliver_value` / remedy offers on PreToolUse
+- Subagent (`SubagentStop`, child trajectories) — out of v1 scope
+
+## Auto-start (verified 2026-10-06)
+
+- `appa hook --ensure-runtime --config <path>` with nothing on the default
+  port boots a runtime on `127.0.0.1:8787`; the hook exits 0.
+- `--ensure-runtime` with a custom `APPA_RUNTIME_URL` exits 2:
+  `the runtime could not be started: nothing answers <url>, and a runtime at
+  a URL the session named is the user's own to start` — custom URLs are
+  user-managed by design; nothing binds 8787 in that case.
+
+## Test seam
+
+`appa replay <dir>` checks `.appa` trace files against a policy; mock-driven unit
+tests remain our primary seam (no runtime needed).

package/extensions/index.ts

@@ -0,0 +1,263 @@
+/**
+ * pi-openappa — Pi extension wiring for OpenAPPA.
+ *
+ * Thin by design: translate Pi events to `appa hook` invocations and enforce
+ * the answer. No policy logic lives here; the APPA runtime owns every
+ * decision. Protection is opt-in per session (APPA_GATE=1 at launch) and
+ * fail-closed while gated: if the runtime cannot answer, the call is blocked.
+ *
+ * Wire facts and constraints: docs/wire-notes.md
+ */
+
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import {
+  parseCallDecision,
+  parseResultDecision,
+  postToolUsePayload,
+  preToolUsePayload,
+  promptPayload,
+  sessionStartPayload,
+  stopPayload,
+  toolResponseFrom,
+} from "../src/adapter.ts";
+import { invokeAppaHook, resolveHookBin, type HookOutcome } from "../src/hook-client.ts";
+import { installAppa, type InstallOutcome } from "../src/installer.ts";
+import {
+  appaDefaultPolicyExists,
+  captureGate,
+  checkHealth,
+  setGloballyOff,
+  type GateState,
+} from "../src/gate.ts";
+
+interface TextPart {
+  type: "text";
+  text: string;
+}
+
+export default function (pi: ExtensionAPI): void {
+  /** Launch-fixed protection state; null until the session starts. */
+  let gate: GateState | null = null;
+  let sessionId = "";
+  /** No policy anywhere and nothing answered: this session runs unprotected. */
+  let unprotected = false;
+  /**
+   * toolCallId → the exact `input` object sent in the PreToolUse payload.
+   * PostToolUse must echo it byte-identically or the runtime withholds the
+   * result (byte_mismatch, see wire notes).
+   */
+  const pendingInputs = new Map<string, Record<string, unknown>>();
+
+  const gated = (): boolean => gate?.gated === true && !unprotected;
+
+  pi.on("session_start", async (event, ctx) => {
+    gate = captureGate(process.env, ctx.cwd);
+    sessionId = ctx.sessionManager.getSessionId();
+    if (!gate.gated) return;
+    unprotected = false;
+
+    const payload = sessionStartPayload(sessionId, event.reason, ctx.cwd);
+    const options = {
+      ensureRuntime: true,
+      ...(gate.config !== undefined ? { config: gate.config } : {}),
+    };
+    const notify = (message: string, kind: "info" | "warning"): void => {
+      if (ctx.hasUI) ctx.ui.notify(message, kind);
+    };
+    let outcome = await invokeAppaHook(payload, options);
+    let warnedAlready = false;
+    // A missing default `appa` is self-provisioned: run the official install
+    // script once, then retry bringing the runtime up. Custom APPA_HOOK_BINs
+    // are the user's own and never auto-installed.
+    if (outcome.binaryMissing && resolveHookBin(process.env) === "appa") {
+      notify(
+        "`appa` was not found — installing the OpenAPPA runtime " +
+          "(https://openappa.com/install.sh)…",
+        "info",
+      );
+      const install = await installAppa();
+      if (install.exitCode !== 0) {
+        warnedAlready = true;
+        notify(
+          `OpenAPPA auto-install failed: ${outcomeTail(install)}. ` +
+            "Tool calls stay blocked; install `appa` manually (see the README) or run /appa off.",
+          "warning",
+        );
+      } else {
+        const retry = await invokeAppaHook(payload, options);
+        if (retry.binaryMissing) {
+          warnedAlready = true;
+          notify(
+            "OpenAPPA auto-install finished but `appa` is still not on PATH. " +
+              `Installer output: ${outcomeTail(install)} — restart the session once PATH has it.`,
+            "warning",
+          );
+        }
+        outcome = retry;
+      }
+    }
+    if (outcome.exitCode !== 0) {
+      // No policy anywhere and nothing answering: run this session
+      // unprotected with one warning instead of fail-closed (the configured
+      // default). A named policy that fails stays fail-closed below.
+      if (
+        resolveHookBin(process.env) === "appa" &&
+        gate.config === undefined &&
+        !appaDefaultPolicyExists(process.env) &&
+        !(await checkHealth(gate.runtimeUrl)).ok
+      ) {
+        unprotected = true;
+        if (!warnedAlready) {
+          notify(
+            "OpenAPPA is on by default, but no policy exists (APPA_CONFIG, " +
+              ".pi/openappa, or ~/.config/appa/appa.toml) and no runtime answers " +
+              `at ${gate.runtimeUrl} — this session runs unprotected. ` +
+              "Write a policy, or run /appa off.",
+            "warning",
+          );
+        }
+        return;
+      }
+      if (ctx.hasUI && !warnedAlready) {
+      const remedy =
+        gate.config === undefined
+          ? " Provide a policy (this project's .pi/openappa, APPA_CONFIG, or ~/.config/appa/appa.toml), or run /appa off."
+          : "";
+      ctx.ui.notify(
+        `OpenAPPA gated but the runtime did not answer (${gate.runtimeUrl}): ` +
+          `${outcome.stderr.trim() || `exit ${outcome.exitCode}`}.${remedy} ` +
+          "Tool calls will be blocked until it answers.",
+        "warning",
+      );
+      }
+    }
+  });
+
+  pi.on("before_agent_start", async (event, ctx) => {
+    if (!gated()) return;
+    // The prompt event establishes the turn boundary; it does not gate.
+    await invokeAppaHook(promptPayload(sessionId, event.prompt, ctx.cwd));
+  });
+
+  pi.on("tool_call", async (event, ctx) => {
+    if (!gated()) return;
+    const payload = preToolUsePayload(sessionId, event.toolName, event.input, ctx.cwd);
+    const outcome = await invokeAppaHook(payload);
+    const decision = parseCallDecision(outcome.exitCode, outcome.stdout, outcome.stderr);
+    if (decision.type === "deny") {
+      return { block: true, reason: `appa: ${decision.reason}` };
+    }
+    pendingInputs.set(event.toolCallId, event.input);
+    return undefined;
+  });
+
+  pi.on("tool_result", async (event, ctx) => {
+    if (!gated()) return;
+    const sentInput = pendingInputs.get(event.toolCallId);
+    pendingInputs.delete(event.toolCallId);
+    const response = toolResponseFrom({
+      text: joinContent(event.content),
+      isError: event.isError,
+      details: event.details,
+    });
+    const payload = postToolUsePayload(
+      sessionId,
+      event.toolName,
+      sentInput ?? event.input,
+      response,
+      ctx.cwd,
+    );
+    const outcome = await invokeAppaHook(payload);
+    const decision = parseResultDecision(outcome.exitCode, outcome.stdout, outcome.stderr);
+    if (decision.type === "pass") {
+      return undefined;
+    }
+    return {
+      content: [{ type: "text", text: decision.text } satisfies TextPart],
+      isError: decision.isError,
+    };
+  });
+
+  pi.on("turn_end", async () => {
+    if (!gated()) return;
+    // Turn completion is reported, never gated (matching --turn-end).
+    await invokeAppaHook(stopPayload(sessionId), { turnEnd: true });
+  });
+
+  pi.on("session_shutdown", () => {
+    pendingInputs.clear();
+  });
+
+  pi.registerCommand("appa", {
+    description: "Show OpenAPPA status; `appa on|off` toggles protection globally",
+    handler: async (args, ctx) => {
+      const arg = args.trim();
+      if (arg === "on" || arg === "off") {
+        setGloballyOff(process.env, arg === "off");
+        gate = captureGate(process.env, ctx.cwd);
+        if (ctx.hasUI) {
+          ctx.ui.notify(
+            arg === "on"
+              ? "OpenAPPA protection re-enabled: on by default for every session."
+              : "OpenAPPA protection disabled globally (/appa on re-enables).",
+            "info",
+          );
+        }
+        return;
+      }
+      const state = gate ?? captureGate(process.env, ctx.cwd);
+      const mode =
+        state.source === "project"
+          ? "project (.pi/openappa)"
+          : state.source === "env-on"
+            ? "launch (APPA_GATE=1)"
+            : state.source === "env-off"
+              ? "launch opt-out (APPA_GATE=0)"
+              : state.source === "project-off"
+                ? "project opt-out (.pi/no-openappa)"
+                : state.source === "global-off"
+                  ? "global opt-out (/appa on re-enables)"
+                  : "on by default (/appa off disables)";
+      const lines: string[] = [];
+      lines.push(state.gated ? `Protection: ON (session ${sessionId || "not started"})` : `Protection: off — ${mode}`);
+      if (unprotected) {
+        lines.push("Session: unprotected — no policy found; see the startup warning.");
+      }
+      if (state.gated && !unprotected) lines.push(`Mode: ${mode}`);
+      if (state.config !== undefined) lines.push(`Policy: ${state.config}`);
+      lines.push(`Runtime: ${state.runtimeUrl}`);
+      const health = await checkHealth(state.runtimeUrl);
+      lines.push(`Health: ${health.ok ? "ok" : `unreachable (${health.detail})`}`);
+      if (state.gated && !health.ok) {
+        lines.push("While the runtime is down, gated tool calls are blocked (fail-closed).");
+      }
+      const message = lines.join("\n");
+      if (ctx.hasUI) {
+        ctx.ui.notify(message, health.ok || !state.gated ? "info" : "warning");
+      }
+    },
+  });
+}
+
+/** Last ~200 chars of installer output, whitespace-normalized, for notices. */
+function outcomeTail(outcome: InstallOutcome): string {
+  const text = `${outcome.stderr} ${outcome.stdout}`.trim().replace(/\s+/g, " ");
+  if (text === "") return "(no output)";
+  return text.length > 200 ? `…${text.slice(-200)}` : text;
+}
+
+function joinContent(content: ReadonlyArray<unknown>): string {
+  const parts: string[] = [];
+  for (const item of content) {
+    if (
+      typeof item === "object" &&
+      item !== null &&
+      (item as { type?: unknown }).type === "text"
+    ) {
+      parts.push(String((item as { text?: unknown }).text ?? ""));
+    } else {
+      parts.push("[non-text content omitted]");
+    }
+  }
+  return parts.join("\n");
+}

package/justfile

@@ -0,0 +1,39 @@
+# pi-openappa — a Pi extension for OpenAPPA
+# Just runs from the repo root; recipes are boring on purpose.
+
+# Run everything a change should pass (default)
+default: check
+
+# Tests + typecheck together
+check: test typecheck
+
+# Mock-driven test suite (no APPA runtime needed)
+test:
+    npm test
+
+# TypeScript check, no emit
+typecheck:
+    npm run typecheck
+
+# Install this checkout as a local Pi package (loads live from this path)
+install:
+    pi install {{justfile_directory()}}
+
+# Reconcile Pi package installations after dependency changes
+update:
+    pi update --extensions
+
+# Remove this checkout from Pi's packages
+remove:
+    pi remove {{justfile_directory()}}
+
+# Publish to npm (requires `npm login`; the Pi gallery indexes the pi-package keyword)
+publish: check
+    npm publish
+
+# Ship a version: sync the lockfile version, run every check, publish to npm
+# (run the README smoke test right after)
+deploy:
+    npm install --package-lock-only --no-audit --no-fund
+    just check
+    npm publish

package/package.json

@@ -1,6 +1,37 @@
 {
   "name": "pi-openappa",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.2.0",
+  "description": "Thin OpenAPPA guard extension for Pi: gates tool calls through the APPA runtime. No policy logic lives here.",
+  "keywords": [
+    "pi-package",
+    "openappa",
+    "appa",
+    "security",
+    "guardrails",
+    "policy"
+  ],
+  "license": "MIT",
+  "author": "aemonge",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/aemonge-dev/pi-openappa.git"
+  },
+  "homepage": "https://github.com/aemonge-dev/pi-openappa#readme",
+  "bugs": "https://github.com/aemonge-dev/pi-openappa/issues",
+  "type": "module",
+  "pi": {
+    "extensions": ["./extensions/index.ts"]
+  },
+  "main": "./extensions/index.ts",
+  "scripts": {
+    "test": "node --test 'test/*.test.ts'",
+    "typecheck": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*"
+  },
+  "devDependencies": {
+    "@earendil-works/pi-coding-agent": "^1.0.4",
+    "typescript": "^5.9.3"
+  }
+}