pi2dsh 0.2.0 → 0.3.0

package/dist/{runtime-D84Hv_3m.mjs → runtime-oLd2EInK.mjs}

@@ -1,9 +1,9 @@
 
 import { t as getAgentDir } from "./pi-config-shim-CZ1wFzqM.mjs";
-import { x as Theme } from "./pi-coding-agent-Dsg6_0ua.mjs";
+import { E as __setSubagentSessionFactory, S as Theme, f as ExtensionRunner } from "./pi-coding-agent-Z1hTs61i.mjs";
 import { createRequire } from "node:module";
-import { access, readFile } from "node:fs/promises";
-import { join } from "node:path";
+import { access, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { EventEmitter } from "node:events";
 import { AsyncLocalStorage } from "node:async_hooks";
@@ -277,6 +277,573 @@ var PiSessionBridge = class {
 	}
 };
 //#endregion
+//#region src/subagent-bridge.ts
+let subagentSerial = 0;
+var PiBridgedAgentSession = class {
+	agent = {};
+	messages = [];
+	#host;
+	#handle;
+	#session;
+	#tools;
+	#subscribers = /* @__PURE__ */ new Set();
+	#disposers = [];
+	#activeToolNames;
+	#sessionName = "";
+	#turns = 0;
+	#aborted = false;
+	constructor(host, handle, tools) {
+		this.#host = host;
+		this.#handle = handle;
+		this.#session = handle.agent.session ?? {};
+		this.#tools = tools;
+		this.#activeToolNames = tools.map((tool) => tool?.name).filter((name) => typeof name === "string");
+		const cordis = host.cordis;
+		const offEvents = cordis.on("session/event", (session, event) => {
+			if (session !== this.#session) return;
+			this.#project(event);
+		});
+		const offPre = cordis.on("tools/pre-execute", async (exec, next) => {
+			if (exec.agent !== this.#handle.agent || this.agent.beforeToolCall === void 0) return next();
+			const decision = await this.agent.beforeToolCall({ toolCall: {
+				name: exec.name,
+				id: exec.callId,
+				arguments: exec.arguments
+			} }, void 0);
+			if (decision?.block === true) return {
+				kind: "deny",
+				reason: decision.reason ?? `Tool "${exec.name}" is not available to this subagent.`
+			};
+			return next();
+		});
+		this.#disposers.push(offEvents, offPre);
+	}
+	#project(event) {
+		const type = event.type;
+		const emit = (piEvent) => {
+			for (const handler of [...this.#subscribers]) try {
+				handler(piEvent);
+			} catch {}
+		};
+		if (type === "turn/start") emit({
+			type: "turn_start",
+			turnIndex: Number(event.data.turn ?? 1) - 1
+		});
+		if (type === "tool/call") {
+			const data = event.data;
+			let args = {};
+			try {
+				args = JSON.parse(String(data.arguments ?? "{}"));
+			} catch {
+				args = {};
+			}
+			emit({
+				type: "tool_execution_start",
+				toolCallId: data.callId,
+				toolName: data.name,
+				args
+			});
+		}
+		if (type === "assistant/chunk") {
+			const chunk = event.data.chunk ?? {};
+			const delta = typeof chunk.text === "string" ? chunk.text : typeof chunk.delta === "string" ? chunk.delta : "";
+			emit({
+				type: "message_update",
+				message: {
+					role: "assistant",
+					content: [{
+						type: "text",
+						text: delta
+					}]
+				},
+				assistantMessageEvent: {
+					type: "text_delta",
+					delta,
+					...chunk
+				}
+			});
+		}
+		const message = this.#host.messageFromSessionEvent(event);
+		if (message !== void 0) {
+			this.messages.push(message);
+			emit({
+				type: "message_start",
+				message
+			});
+			emit({
+				type: "message_end",
+				message
+			});
+		}
+		if (type === "turn/end") {
+			this.#turns += 1;
+			emit({
+				type: "turn_end",
+				turnIndex: Number(event.data.turn ?? 1) - 1,
+				message: {
+					role: "assistant",
+					content: []
+				},
+				toolResults: []
+			});
+		}
+	}
+	subscribe(handler) {
+		this.#subscribers.add(handler);
+		return () => this.#subscribers.delete(handler);
+	}
+	async prompt(text) {
+		const blocks = await this.#host.piContentToDsh([{
+			type: "text",
+			text: String(text)
+		}]);
+		const cordis = this.#host.cordis;
+		const completed = new Promise((resolve) => {
+			const off = cordis.on("session/event", (session, event) => {
+				if (session !== this.#session) return;
+				if (event.type === "turn/end") {
+					off();
+					resolve();
+				}
+			});
+			this.#disposers.push(off);
+		});
+		this.#host.deliver(this.#handle.agent, createUserMessage({
+			content: blocks,
+			source: {
+				kind: "plugin",
+				plugin: this.#host.messageSource
+			}
+		}), "followup");
+		await completed;
+	}
+	steer(text) {
+		this.#host.piContentToDsh([{
+			type: "text",
+			text: String(text)
+		}]).then((blocks) => {
+			this.#host.deliver(this.#handle.agent, createUserMessage({
+				content: blocks,
+				source: {
+					kind: "plugin",
+					plugin: this.#host.messageSource
+				}
+			}), "steer");
+		});
+	}
+	abort() {
+		this.#aborted = true;
+		const cancel = this.#handle.agent.cancel;
+		cancel?.({
+			kind: "hook",
+			reason: "pi2dsh subagent abort()"
+		});
+	}
+	setSessionName(name) {
+		this.#sessionName = String(name);
+	}
+	getSessionName() {
+		return this.#sessionName;
+	}
+	getSessionStats() {
+		return {
+			turns: this.#turns,
+			messages: this.messages.length,
+			aborted: this.#aborted
+		};
+	}
+	getAllTools() {
+		return [...this.#tools];
+	}
+	getActiveToolNames() {
+		return [...this.#activeToolNames];
+	}
+	setActiveToolsByName(names) {
+		this.#activeToolNames = names.filter((name) => typeof name === "string");
+	}
+	async bindExtensions(_bindings = {}) {}
+	async dispose() {
+		for (const dispose of this.#disposers.splice(0)) try {
+			dispose();
+		} catch {}
+		this.#subscribers.clear();
+		await this.#handle.dispose();
+	}
+};
+async function createBridgedAgentSession(host, options) {
+	const agents = host.cordis.get("agents");
+	if (agents?.create === void 0) throw new Error("pi2dsh: createAgentSession() needs the DSH agent registry in the host composition");
+	subagentSerial += 1;
+	const sessionId = `pi2dsh-sub-${Date.now().toString(36)}-${subagentSerial}`;
+	let handle;
+	try {
+		handle = await agents.create({
+			sessionId,
+			meta: {
+				cwd: typeof options.cwd === "string" ? options.cwd : host.cwd(),
+				origin: "subagent",
+				...host.parentSessionId() !== void 0 ? { parentSession: host.parentSessionId() } : {}
+			}
+		});
+	} catch (error) {
+		throw new Error(`pi2dsh: subagent creation needs the DSH host loop (model runtime) to provide the agent factory; this composition cannot run one (${error instanceof Error ? error.message : String(error)})`);
+	}
+	const tools = [...Array.isArray(options.tools) ? options.tools : [], ...Array.isArray(options.customTools) ? options.customTools : []];
+	return { session: new PiBridgedAgentSession(host, handle, tools) };
+}
+//#endregion
+//#region src/compat/vendor/pi-ai-abort.ts
+function abortReason(signal) {
+	if (signal.reason !== void 0) return signal.reason;
+	const error = /* @__PURE__ */ new Error("The operation was aborted");
+	error.name = "AbortError";
+	return error;
+}
+/** Create an operation-local signal for public APIs whose signal is optional. */
+function operationSignal(signal) {
+	return signal ?? new AbortController().signal;
+}
+/**
+* Stop waiting for an operation when its signal aborts while continuing to
+* observe the abandoned promise so a later rejection is always handled.
+*/
+function raceWithAbortSignal(operation, signal) {
+	if (signal.aborted) {
+		operation.catch(() => {});
+		return Promise.reject(abortReason(signal));
+	}
+	return new Promise((resolve, reject) => {
+		let settled = false;
+		const cleanup = () => signal.removeEventListener("abort", onAbort);
+		const onAbort = () => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(abortReason(signal));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		operation.then((value) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			resolve(value);
+		}, (error) => {
+			if (settled) return;
+			settled = true;
+			cleanup();
+			reject(error);
+		});
+		if (signal.aborted) onAbort();
+	});
+}
+//#endregion
+//#region src/compat/vendor/pi-ai-credential-store.ts
+/**
+* Default in-memory credential store. Apps inject persistent stores.
+* Keyed by `Provider.id`, one credential per provider; see `CredentialStore`.
+* Writes are serialized per provider through a promise chain.
+*/
+var InMemoryCredentialStore = class {
+	credentials = /* @__PURE__ */ new Map();
+	chains = /* @__PURE__ */ new Map();
+	/** Serialize tasks per provider id without releasing the chain before active work settles. */
+	enqueue(providerId, task, options) {
+		const signal = operationSignal(options?.signal);
+		const previous = this.chains.get(providerId) ?? Promise.resolve();
+		const queued = (async () => {
+			await previous.catch(() => {});
+			signal.throwIfAborted();
+			return task();
+		})();
+		const tail = queued.catch(() => {});
+		this.chains.set(providerId, tail);
+		tail.then(() => {
+			if (this.chains.get(providerId) === tail) this.chains.delete(providerId);
+		});
+		return raceWithAbortSignal(queued, signal);
+	}
+	async read(providerId, options) {
+		options?.signal?.throwIfAborted();
+		return this.credentials.get(providerId);
+	}
+	async list(options) {
+		options?.signal?.throwIfAborted();
+		return [...this.credentials].map(([providerId, credential]) => ({
+			providerId,
+			type: credential.type
+		}));
+	}
+	modify(providerId, fn, options) {
+		return this.enqueue(providerId, async () => {
+			const current = this.credentials.get(providerId);
+			const next = await fn(current);
+			options?.signal?.throwIfAborted();
+			if (next !== void 0) this.credentials.set(providerId, next);
+			return next ?? current;
+		}, options);
+	}
+	delete(providerId, options) {
+		return this.enqueue(providerId, async () => {
+			this.credentials.delete(providerId);
+		}, options);
+	}
+};
+//#endregion
+//#region src/compat/vendor/pi-ai-diagnostics.ts
+function formatThrownValue(value) {
+	if (value instanceof Error) return value.message || value.name;
+	if (typeof value === "string") return value;
+	return String(value);
+}
+//#endregion
+//#region src/compat/vendor/pi-ai-auth-resolve.ts
+var ModelsError = class extends Error {
+	code;
+	constructor(code, message, options) {
+		super(withCauseDetail(message, options?.cause), options);
+		this.name = "ModelsError";
+		this.code = code;
+	}
+};
+/** Callers surface `error.message` only, so keep the underlying reason in it. */
+function withCauseDetail(message, cause) {
+	if (cause === void 0 || cause === null) return message;
+	const detail = formatThrownValue(cause).trim();
+	if (!detail || message.includes(detail)) return message;
+	return `${message}: ${detail}`;
+}
+/**
+* Auth resolution shared by the `Models` and `ImagesModels` collections.
+* A stored credential owns the provider: ambient/env is consulted only when
+* nothing is stored. No silent env fallback after a failed refresh or for a
+* credential type without a matching handler.
+*/
+function resolveProviderAuth(provider, credentials, authContext, overrides) {
+	const signal = operationSignal(overrides?.signal);
+	return raceWithAbortSignal(resolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal), signal);
+}
+async function resolveProviderAuthWithSignal(provider, credentials, authContext, overrides, signal) {
+	signal.throwIfAborted();
+	const requestAuthContext = overrides?.env ? overlayEnvAuthContext(authContext, overrides.env) : authContext;
+	if (overrides?.apiKey !== void 0 && provider.auth.apiKey) return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, {
+		type: "api_key",
+		key: overrides.apiKey,
+		env: overrides.env
+	}, signal);
+	const stored = await readCredential(credentials, provider.id, signal);
+	if (stored) {
+		if (stored.type === "oauth" && provider.auth.oauth) return resolveStoredOAuth(credentials, provider.id, provider.auth.oauth, stored, signal, overrides?.minOAuthValidityMs);
+		if (stored.type === "api_key" && provider.auth.apiKey) {
+			const credential = overrides?.env ? {
+				...stored,
+				env: {
+					...stored.env,
+					...overrides.env
+				}
+			} : stored;
+			return resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, credential, signal);
+		}
+		return;
+	}
+	return provider.auth.apiKey ? resolveApiKey(requestAuthContext, provider.auth.apiKey, provider.id, void 0, signal) : void 0;
+}
+function overlayEnvAuthContext(base, env) {
+	return {
+		env: async (name) => env[name] || await base.env(name),
+		fileExists: (path) => base.fileExists(path)
+	};
+}
+const DEFAULT_OAUTH_MINIMUM_VALIDITY_MS = 3e5;
+const DEFAULT_OAUTH_REFRESH_TIMEOUT_MS = 15e3;
+/**
+* OAuth resolution with double-checked locking: tokens with less than five
+* minutes remaining lock, re-check expiry under the lock, refresh once
+* globally, and persist the rotated credential before release.
+*/
+async function resolveStoredOAuth(credentials, providerId, oauth, stored, signal, minOAuthValidityMs) {
+	const minimumValidityMs = Math.max(DEFAULT_OAUTH_MINIMUM_VALIDITY_MS, minOAuthValidityMs ?? 0);
+	const expiresSoon = (credential) => Date.now() + minimumValidityMs >= credential.expires;
+	let credential = stored;
+	if (expiresSoon(credential)) {
+		let post;
+		try {
+			post = await credentials.modify(providerId, async (current) => {
+				if (current?.type !== "oauth") return void 0;
+				if (!expiresSoon(current)) return void 0;
+				try {
+					const refreshSignal = AbortSignal.any([signal, AbortSignal.timeout(DEFAULT_OAUTH_REFRESH_TIMEOUT_MS)]);
+					return await oauth.refresh(current, refreshSignal);
+				} catch (error) {
+					throw new ModelsError("oauth", `OAuth refresh failed for ${providerId}`, { cause: error });
+				}
+			}, { signal });
+		} catch (error) {
+			if (error instanceof ModelsError) throw error;
+			throw new ModelsError("auth", `Credential store modify failed for ${providerId}`, { cause: error });
+		}
+		if (post?.type !== "oauth") return void 0;
+		credential = post;
+		if (minOAuthValidityMs !== void 0 && expiresSoon(credential)) throw new ModelsError("oauth", `OAuth refresh returned a token that expires too soon for ${providerId}`);
+	}
+	try {
+		return {
+			auth: await oauth.toAuth(credential),
+			source: "OAuth"
+		};
+	} catch (error) {
+		throw new ModelsError("oauth", `OAuth auth derivation failed for ${providerId}`, { cause: error });
+	}
+}
+async function resolveApiKey(authContext, apiKey, providerId, credential, signal) {
+	try {
+		return await apiKey.resolve({
+			ctx: authContext,
+			credential,
+			signal
+		});
+	} catch (error) {
+		throw new ModelsError("auth", `API key auth failed for provider ${providerId}`, { cause: error });
+	}
+}
+async function readCredential(credentials, providerId, signal) {
+	try {
+		return await credentials.read(providerId, { signal });
+	} catch (error) {
+		throw new ModelsError("auth", `Credential store read failed for ${providerId}`, { cause: error });
+	}
+}
+//#endregion
+//#region src/compat/vendor/pi-oauth-adapt.ts
+function adaptOAuth(config) {
+	return {
+		name: config.name,
+		isSubscription: config.isSubscription,
+		login: async (callbacks) => {
+			return {
+				...await config.login({
+					onAuth: (info) => callbacks.notify({
+						type: "auth_url",
+						...info
+					}),
+					onDeviceCode: (info) => callbacks.notify({
+						type: "device_code",
+						...info
+					}),
+					onPrompt: (prompt) => callbacks.prompt({
+						type: "text",
+						...prompt
+					}),
+					onProgress: (message) => callbacks.notify({
+						type: "progress",
+						message
+					}),
+					onManualCodeInput: () => callbacks.prompt({
+						type: "manual_code",
+						message: "Paste the authorization code"
+					}),
+					onSelect: (prompt) => callbacks.prompt({
+						type: "select",
+						...prompt
+					}),
+					signal: callbacks.signal
+				}),
+				type: "oauth"
+			};
+		},
+		refresh: async (credential, signal) => ({
+			...await config.refreshToken(credential, signal),
+			type: "oauth"
+		}),
+		toAuth: async (credential) => ({ apiKey: config.getApiKey(credential) })
+	};
+}
+//#endregion
+//#region src/oauth-bridge.ts
+var FileCredentialStore = class extends InMemoryCredentialStore {
+	#path;
+	constructor(path) {
+		super();
+		this.#path = path;
+		try {
+			const data = JSON.parse(readFileSync(path, "utf8"));
+			for (const [providerId, credential] of Object.entries(data)) this.credentials.set(providerId, credential);
+		} catch {}
+	}
+	get path() {
+		return this.#path;
+	}
+	async #persist() {
+		const credentials = this.credentials;
+		const data = Object.fromEntries(credentials);
+		await mkdir(dirname(this.#path), { recursive: true });
+		const temp = `${this.#path}.tmp-${process.pid}-${Math.floor(Math.random() * 1e9).toString(36)}`;
+		await writeFile(temp, `${JSON.stringify(data, null, 2)}\n`, { mode: 384 });
+		await rename(temp, this.#path);
+	}
+	modify(providerId, fn, options) {
+		return super.modify(providerId, async (current) => {
+			const next = await fn(current);
+			if (next !== void 0) {
+				this.credentials.set(providerId, next);
+				await this.#persist();
+			}
+			return next;
+		}, options);
+	}
+	delete(providerId, options) {
+		return super.delete(providerId, options).then(() => this.#persist());
+	}
+};
+function oauthInteraction(ui, signal) {
+	return {
+		signal: signal ?? new AbortController().signal,
+		async prompt(prompt) {
+			if (prompt.type === "select") {
+				const options = prompt.options ?? [];
+				const picked = await ui.select(prompt.message, options.map((option) => option.label));
+				return options.find((option) => option.label === picked)?.id ?? picked;
+			}
+			return ui.input(prompt.message, prompt.placeholder);
+		},
+		notify(event) {
+			if (event.type === "auth_url") ui.notify(`Open this URL to authorize: ${event.url}${event.instructions !== void 0 ? `\n${event.instructions}` : ""}`);
+			else if (event.type === "device_code") ui.notify(`Visit ${event.verificationUri} and enter code ${event.userCode}`);
+			else if (event.message !== void 0) ui.notify(event.message);
+		}
+	};
+}
+function oauthConfigOf(providerConfig) {
+	const oauth = providerConfig?.oauth;
+	return typeof oauth === "object" && oauth !== null && typeof oauth.login === "function" ? oauth : void 0;
+}
+function oauthAdapterOf(oauthConfig) {
+	if (typeof oauthConfig.toAuth === "function") return oauthConfig;
+	return adaptOAuth(oauthConfig);
+}
+function providerSupportsOAuth(providerConfig) {
+	return oauthConfigOf(providerConfig) !== void 0;
+}
+async function loginPiProvider(options) {
+	const oauthConfig = oauthConfigOf(options.providerConfig);
+	if (oauthConfig === void 0) throw new Error(`${options.providerName ?? options.providerId} does not support oauth login`);
+	const credential = await oauthAdapterOf(oauthConfig).login(oauthInteraction(options.ui, options.signal));
+	await options.store.modify(options.providerId, async () => credential);
+	return credential;
+}
+async function resolveOAuthApiKey(options) {
+	const oauthConfig = oauthConfigOf(options.providerConfig);
+	if (oauthConfig === void 0) return void 0;
+	return (await resolveProviderAuth({
+		id: options.providerId,
+		name: options.providerName ?? options.providerId,
+		auth: { oauth: oauthAdapterOf(oauthConfig) }
+	}, options.store, { env: async () => void 0 }, options.signal !== void 0 ? { signal: options.signal } : void 0))?.auth?.apiKey;
+}
+async function storedOAuthCredential(store, providerId) {
+	const stored = await store.read(providerId, void 0);
+	return stored?.type === "oauth" ? stored : void 0;
+}
+//#endregion
 //#region src/runtime.ts
 function logger(ctx) {
 	const candidate = ctx.logger;
@@ -600,6 +1167,7 @@ function contextFor(ctx, state, agent, signal, command = false) {
 		}
 	};
 	const session = agentSession(agent);
+	const providerConfig = (name) => state.providers.get(name);
 	const base = {
 		ui,
 		mode: "rpc",
@@ -615,12 +1183,45 @@ function contextFor(ctx, state, agent, signal, command = false) {
 			find: (_provider, _modelId) => void 0,
 			getError: () => void 0,
 			hasConfiguredAuth: (_model) => false,
-			getProviderAuthStatus: (_provider) => "none",
-			getProvider: (_provider) => void 0,
-			getProviderDisplayName: (provider) => provider,
-			getProviderAuth: async (_provider) => void 0,
-			getApiKeyForProvider: async (_provider) => void 0,
-			isUsingOAuth: (_model) => false,
+			getProviderAuthStatus: (provider) => providerSupportsOAuth(providerConfig(provider)) ? "oauth" : "none",
+			getProvider: (provider) => providerConfig(provider),
+			getRegisteredProviderConfig: (provider) => providerConfig(provider),
+			getRegisteredProviderIds: () => [...state.providers.keys()],
+			getProviderDisplayName: (provider) => {
+				const config = providerConfig(provider);
+				return typeof config?.name === "string" ? config.name : provider;
+			},
+			getProviderAuth: async (provider) => {
+				const config = providerConfig(provider);
+				if (!providerSupportsOAuth(config)) return void 0;
+				if (await storedOAuthCredential(oauthStoreOf(state), provider) === void 0) return void 0;
+				const apiKey = await resolveOAuthApiKey({
+					providerId: provider,
+					providerConfig: config,
+					store: oauthStoreOf(state)
+				});
+				if (apiKey === void 0) return void 0;
+				return {
+					auth: {
+						apiKey,
+						baseUrl: config.baseUrl
+					},
+					source: "OAuth"
+				};
+			},
+			getApiKeyForProvider: async (provider) => {
+				const config = providerConfig(provider);
+				if (!providerSupportsOAuth(config)) return void 0;
+				return resolveOAuthApiKey({
+					providerId: provider,
+					providerConfig: config,
+					store: oauthStoreOf(state)
+				});
+			},
+			isUsingOAuth: (model) => {
+				const provider = String(model?.provider ?? "");
+				return provider.length > 0 && providerSupportsOAuth(providerConfig(provider));
+			},
 			refresh: async () => ({
 				models: [],
 				errors: []
@@ -988,8 +1589,42 @@ function subscribeInterceptors(ctx, state) {
 		};
 	});
 }
+function oauthStoreOf(state) {
+	state.oauthStore ??= new FileCredentialStore(join(getAgentDir(), "auth.json"));
+	return state.oauthStore;
+}
+function ensureLoginCommand(ctx, state) {
+	if (state.loginCommandRegistered === true) return;
+	state.loginCommandRegistered = true;
+	registerCommand(ctx, state, {
+		name: "login",
+		description: "Log in to a Pi provider through its own OAuth flow",
+		argumentHint: "<provider>",
+		async handler(args, commandContext) {
+			const oauthProviders = [...state.providers.entries()].filter(([, config]) => providerSupportsOAuth(config)).map(([name]) => name);
+			if (oauthProviders.length === 0) throw new Error("no registered Pi provider supports OAuth login");
+			const ui = commandContext.ui;
+			let providerId = args.trim().split(/\s+/u)[0] ?? "";
+			if (providerId.length === 0) providerId = oauthProviders.length === 1 ? oauthProviders[0] : String(await ui.select("Log in to which provider?", oauthProviders) ?? "");
+			const config = state.providers.get(providerId);
+			if (config === void 0 || !providerSupportsOAuth(config)) throw new Error(`unknown OAuth provider ${JSON.stringify(providerId)}; available: ${oauthProviders.join(", ")}`);
+			const oauthName = config.oauth?.name ?? providerId;
+			const commandSignal = commandContext.signal;
+			await loginPiProvider({
+				providerId,
+				providerName: oauthName,
+				providerConfig: config,
+				store: oauthStoreOf(state),
+				ui,
+				...commandSignal !== void 0 ? { signal: commandSignal } : {}
+			});
+			ui.notify(`Logged in to ${oauthName}; credential stored in ${oauthStoreOf(state).path}`);
+			return `Logged in to ${oauthName}`;
+		}
+	});
+}
 function registerTool(ctx, state, tool) {
-	if (state.tools.has(tool.name)) throw new Error(`Pi tool ${JSON.stringify(tool.name)} is already registered`);
+	if (state.tools.has(tool.name)) unregisterTool(state, tool.name);
 	const normalized = normalizeToolSchema(tool.parameters);
 	for (const warning of normalized.warnings) logger(ctx).warn(`[pi2dsh] tool ${tool.name}: ${warning}`);
 	state.tools.set(tool.name, tool);
@@ -1206,7 +1841,10 @@ function createPiApi(ctx, state) {
 			const name = typeof providerOrName === "string" ? providerOrName : String(providerOrName?.name ?? "unnamed");
 			const value = typeof providerOrName === "string" ? config ?? {} : providerOrName;
 			state.providers.set(name, value);
-			logger(ctx).info(`[pi2dsh] recorded Pi provider ${JSON.stringify(name)}; model calls stay on DSH llm adapters`);
+			if (providerSupportsOAuth(value)) {
+				ensureLoginCommand(ctx, state);
+				logger(ctx).info(`[pi2dsh] Pi provider ${JSON.stringify(name)} supports OAuth — log in with /login ${name}`);
+			} else logger(ctx).info(`[pi2dsh] recorded Pi provider ${JSON.stringify(name)}; model calls stay on DSH llm adapters`);
 		},
 		unregisterProvider(name) {
 			state.providers.delete(name);
@@ -1255,18 +1893,21 @@ function createPiApi(ctx, state) {
 			return executePiCommand(service, cwdOf(currentAgent(state)), command, args, options);
 		},
 		getActiveTools: () => getActiveTools(ctx, state),
-		getAllTools: () => toolRuntime(ctx, currentAgent(state)).schemas(currentAgent(state)).map((tool) => ({
-			name: tool.name,
-			description: tool.description ?? "",
-			parameters: tool.parameters ?? {},
-			source: state.tools.has(tool.name) ? "extension" : "builtin",
-			sourceInfo: {
-				path: "",
-				source: state.tools.has(tool.name) ? "pi2dsh" : "dsh",
-				scope: "session",
-				origin: "runtime"
-			}
-		})),
+		getAllTools: () => {
+			const visiblePiTools = new Set(state.runner.getAllRegisteredTools().map((record) => record.definition?.name).filter((name) => typeof name === "string"));
+			return toolRuntime(ctx, currentAgent(state)).schemas(currentAgent(state)).filter((tool) => !state.tools.has(tool.name) || visiblePiTools.has(tool.name)).map((tool) => ({
+				name: tool.name,
+				description: tool.description ?? "",
+				parameters: tool.parameters ?? {},
+				source: state.tools.has(tool.name) ? "extension" : "builtin",
+				sourceInfo: {
+					path: "",
+					source: state.tools.has(tool.name) ? "pi2dsh" : "dsh",
+					scope: "session",
+					origin: "runtime"
+				}
+			}));
+		},
 		setActiveTools: (names) => setActiveTools(ctx, state, names),
 		getCommands: () => [...state.commands.values()].map((command) => ({
 			name: command.name,
@@ -1439,9 +2080,20 @@ async function loadExtensions(rootDir, manifest, api, onExtensionError) {
 async function applyPiPackage(ctx, options) {
 	if (options.manifest.schemaVersion !== 1) throw new Error(`unsupported pi2dsh manifest version ${String(options.manifest.schemaVersion)}`);
 	const rootDir = fileURLToPath(options.rootUrl);
+	const runtimeTools = /* @__PURE__ */ new Map();
+	const piToolRecords = () => [...runtimeTools.values()].map((tool) => ({
+		definition: tool,
+		sourceInfo: {
+			path: "",
+			source: "pi2dsh",
+			scope: "session",
+			origin: "package"
+		}
+	}));
 	const state = {
 		handlers: /* @__PURE__ */ new Map(),
-		tools: /* @__PURE__ */ new Map(),
+		tools: runtimeTools,
+		runner: new ExtensionRunner(piToolRecords),
 		toolDisposers: /* @__PURE__ */ new Map(),
 		toolRestrictions: /* @__PURE__ */ new WeakMap(),
 		commands: /* @__PURE__ */ new Map(),
@@ -1483,6 +2135,19 @@ async function applyPiPackage(ctx, options) {
 			});
 		}
 	}
+	__setSubagentSessionFactory((subagentOptions) => createBridgedAgentSession({
+		cordis: ctx,
+		cwd: () => cwdOf(currentAgent(state)),
+		parentSessionId: () => {
+			const session = agentSession(currentAgent(state));
+			return session === void 0 ? void 0 : String(session.id ?? "") || void 0;
+		},
+		piContentToDsh: (content) => piToDshContent(ctx, content),
+		deliver: (agent, message, mode) => deliverAgentMessage(agent, message, mode),
+		messageFromSessionEvent,
+		messageSource: state.messageSource
+	}, subagentOptions));
+	ctx.effect(() => () => __setSubagentSessionFactory(void 0));
 	await registerPromptCommands(ctx, state, rootDir, options.manifest);
 	await loadExtensions(rootDir, options.manifest, createPiApi(ctx, state), (failure) => logger(ctx).warn(`[pi2dsh] extension entry failed and was skipped (matching Pi's per-extension error isolation): ${failure}`));
 	logger(ctx).info(`[pi2dsh] loaded ${options.manifest.package.name}: ${state.tools.size} tools, ${state.commands.size} commands, ${options.manifest.skillDirs.length} skill roots`);
@@ -1496,4 +2161,4 @@ const runtimeInternals = {
 //#endregion
 export { normalizeToolSchema as n, runtimeInternals as r, applyPiPackage as t };
 
-//# sourceMappingURL=runtime-D84Hv_3m.mjs.map
+//# sourceMappingURL=runtime-oLd2EInK.mjs.map