@a5c-ai/genty-platform 5.1.1-staging.00ceebd28cf2

package/dist/harness/parallelFileOps.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Parallel file operations (GAP-PAR-005).
+ *
+ * Provides concurrency-limited helpers for reading, writing, and globbing
+ * files in parallel. Uses a simple semaphore to cap concurrency without
+ * external dependencies.
+ */
+export interface FileReadResult {
+    path: string;
+    content: string;
+    error?: undefined;
+}
+export interface FileReadError {
+    path: string;
+    content?: undefined;
+    error: string;
+}
+export type FileReadOutcome = FileReadResult | FileReadError;
+/**
+ * Read multiple files concurrently with a configurable concurrency limit.
+ *
+ * @param paths - Absolute or relative file paths to read.
+ * @param concurrency - Max concurrent reads. Default: 8.
+ * @returns An array of outcomes (one per input path, preserving order).
+ */
+export declare function readFilesParallel(paths: string[], concurrency?: number): Promise<FileReadOutcome[]>;
+export interface FileWriteEntry {
+    path: string;
+    content: string;
+}
+export interface FileWriteResult {
+    path: string;
+    ok: boolean;
+    error?: string;
+}
+/**
+ * Write multiple files concurrently with a configurable concurrency limit.
+ * Creates parent directories as needed.
+ *
+ * @param entries - File path + content pairs.
+ * @param concurrency - Max concurrent writes. Default: 8.
+ */
+export declare function writeFilesParallel(entries: FileWriteEntry[], concurrency?: number): Promise<FileWriteResult[]>;
+/**
+ * Run multiple glob patterns in parallel and return merged results.
+ *
+ * Uses a simple recursive readdir + minimatch-style check.
+ * For production use, consider swapping in a dedicated glob library.
+ *
+ * @param patterns - Glob patterns (only `*` and `**` are supported in
+ *                   the simple built-in matcher).
+ * @param cwd - Base directory to resolve against.
+ * @param concurrency - Max concurrent pattern evaluations. Default: 4.
+ */
+export declare function globParallel(patterns: string[], cwd: string, concurrency?: number): Promise<string[]>;
+//# sourceMappingURL=parallelFileOps.d.ts.map

package/dist/harness/parallelFileOps.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"parallelFileOps.d.ts","sourceRoot":"","sources":["../../src/harness/parallelFileOps.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgCH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,SAAS,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,eAAe,GAAG,cAAc,GAAG,aAAa,CAAC;AAE7D;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EAAE,EACf,WAAW,SAAI,GACd,OAAO,CAAC,eAAe,EAAE,CAAC,CAU5B;AAMD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,cAAc,EAAE,EACzB,WAAW,SAAI,GACd,OAAO,CAAC,eAAe,EAAE,CAAC,CAgB5B;AAMD;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAAE,EAClB,GAAG,EAAE,MAAM,EACX,WAAW,SAAI,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CAiBnB"}

package/dist/harness/parallelFileOps.js

@@ -0,0 +1,166 @@
+"use strict";
+/**
+ * Parallel file operations (GAP-PAR-005).
+ *
+ * Provides concurrency-limited helpers for reading, writing, and globbing
+ * files in parallel. Uses a simple semaphore to cap concurrency without
+ * external dependencies.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readFilesParallel = readFilesParallel;
+exports.writeFilesParallel = writeFilesParallel;
+exports.globParallel = globParallel;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+// ---------------------------------------------------------------------------
+// Concurrency limiter
+// ---------------------------------------------------------------------------
+async function runWithConcurrency(tasks, concurrency) {
+    const results = new Array(tasks.length);
+    let nextIndex = 0;
+    async function worker() {
+        while (nextIndex < tasks.length) {
+            const idx = nextIndex++;
+            results[idx] = await tasks[idx]();
+        }
+    }
+    const workers = Array.from({ length: Math.min(concurrency, tasks.length) }, () => worker());
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * Read multiple files concurrently with a configurable concurrency limit.
+ *
+ * @param paths - Absolute or relative file paths to read.
+ * @param concurrency - Max concurrent reads. Default: 8.
+ * @returns An array of outcomes (one per input path, preserving order).
+ */
+async function readFilesParallel(paths, concurrency = 8) {
+    const tasks = paths.map((p) => async () => {
+        try {
+            const content = await node_fs_1.promises.readFile(p, 'utf-8');
+            return { path: p, content };
+        }
+        catch (err) {
+            return { path: p, error: err instanceof Error ? err.message : String(err) };
+        }
+    });
+    return runWithConcurrency(tasks, concurrency);
+}
+/**
+ * Write multiple files concurrently with a configurable concurrency limit.
+ * Creates parent directories as needed.
+ *
+ * @param entries - File path + content pairs.
+ * @param concurrency - Max concurrent writes. Default: 8.
+ */
+async function writeFilesParallel(entries, concurrency = 8) {
+    const tasks = entries.map((entry) => async () => {
+        try {
+            const dir = entry.path.replace(/[\\/][^\\/]+$/, '');
+            await node_fs_1.promises.mkdir(dir, { recursive: true });
+            await node_fs_1.promises.writeFile(entry.path, entry.content, 'utf-8');
+            return { path: entry.path, ok: true };
+        }
+        catch (err) {
+            return {
+                path: entry.path,
+                ok: false,
+                error: err instanceof Error ? err.message : String(err),
+            };
+        }
+    });
+    return runWithConcurrency(tasks, concurrency);
+}
+// ---------------------------------------------------------------------------
+// globParallel
+// ---------------------------------------------------------------------------
+/**
+ * Run multiple glob patterns in parallel and return merged results.
+ *
+ * Uses a simple recursive readdir + minimatch-style check.
+ * For production use, consider swapping in a dedicated glob library.
+ *
+ * @param patterns - Glob patterns (only `*` and `**` are supported in
+ *                   the simple built-in matcher).
+ * @param cwd - Base directory to resolve against.
+ * @param concurrency - Max concurrent pattern evaluations. Default: 4.
+ */
+async function globParallel(patterns, cwd, concurrency = 4) {
+    const tasks = patterns.map((pattern) => async () => {
+        return matchGlob(pattern, cwd);
+    });
+    const perPattern = await runWithConcurrency(tasks, concurrency);
+    // Deduplicate
+    const seen = new Set();
+    const result = [];
+    for (const group of perPattern) {
+        for (const p of group) {
+            if (!seen.has(p)) {
+                seen.add(p);
+                result.push(p);
+            }
+        }
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Simple glob matcher (no external dep)
+// ---------------------------------------------------------------------------
+function globToRegExp(pattern) {
+    let re = '';
+    let i = 0;
+    while (i < pattern.length) {
+        const ch = pattern[i];
+        if (ch === '*' && pattern[i + 1] === '*') {
+            // Match any path segments
+            if (pattern[i + 2] === '/' || pattern[i + 2] === '\\') {
+                re += '(?:.+[\\\\/])?';
+                i += 3;
+            }
+            else {
+                re += '.*';
+                i += 2;
+            }
+        }
+        else if (ch === '*') {
+            re += '[^\\\\/]*';
+            i++;
+        }
+        else if (ch === '?') {
+            re += '[^\\\\/]';
+            i++;
+        }
+        else if (ch === '/' || ch === '\\') {
+            re += '[\\\\/]';
+            i++;
+        }
+        else {
+            re += ch.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+            i++;
+        }
+    }
+    return new RegExp(`^${re}$`);
+}
+async function listRecursive(dir) {
+    const entries = await node_fs_1.promises.readdir(dir, { withFileTypes: true });
+    const results = [];
+    for (const entry of entries) {
+        const full = (0, node_path_1.join)(dir, entry.name);
+        if (entry.isDirectory()) {
+            results.push(...(await listRecursive(full)));
+        }
+        else {
+            results.push(full);
+        }
+    }
+    return results;
+}
+async function matchGlob(pattern, cwd) {
+    const regex = globToRegExp(pattern);
+    const allFiles = await listRecursive(cwd);
+    return allFiles.filter((f) => {
+        const relative = f.slice(cwd.length).replace(/^[\\/]/, '');
+        return regex.test(relative);
+    });
+}

package/dist/harness/piSecureSandbox.d.ts

@@ -0,0 +1,8 @@
+import type { SecureBashBackend } from "./piSecureSandboxTypes";
+export type { PiBashOperations, SecureBashBackend } from "./piSecureSandboxTypes";
+export declare function createSecureBashBackend(options: {
+    workspace: string;
+    mode: "auto" | "secure" | "local";
+    image?: string;
+}): Promise<SecureBashBackend | null>;
+//# sourceMappingURL=piSecureSandbox.d.ts.map

package/dist/harness/piSecureSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piSecureSandbox.d.ts","sourceRoot":"","sources":["../../src/harness/piSecureSandbox.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAuF,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACrJ,YAAY,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAqUlF,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAkBpC"}

package/dist/harness/piSecureSandbox.js

@@ -0,0 +1,366 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSecureBashBackend = createSecureBashBackend;
+const path = __importStar(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const AGENTSH_MODULE_ID = "@agentsh/secure-sandbox";
+const DEFAULT_SANDBOX_IMAGE = process.env.BABYSITTER_PI_SANDBOX_IMAGE || "node:22-bookworm";
+const DEFAULT_INSTALL_STRATEGY = process.env.BABYSITTER_PI_SANDBOX_INSTALL_STRATEGY || "download";
+const CONTAINER_WORKSPACE = "/workspace";
+const dynamicImportAgentSH = (() => {
+    if (process.env.VITEST) {
+        return (specifier) => Promise.resolve(`${specifier}`).then(s => __importStar(require(s)));
+    }
+    // eslint-disable-next-line @typescript-eslint/no-implied-eval
+    return new Function("id", "return import(id)");
+})();
+async function loadAgentSHModule() {
+    return await dynamicImportAgentSH(AGENTSH_MODULE_ID);
+}
+function isAbortError(error) {
+    return error instanceof Error
+        && (error.name === "AbortError" || error.message.toLowerCase().includes("aborted"));
+}
+function shellQuote(value) {
+    return `'${value.replace(/'/g, `'"'"'`)}'`;
+}
+function buildEnvPrefix(env) {
+    if (!env)
+        return "";
+    const parts = Object.entries(env)
+        .filter((entry) => typeof entry[1] === "string")
+        .map(([key, value]) => `${key}=${shellQuote(value)}`);
+    return parts.length > 0 ? `${parts.join(" ")} ` : "";
+}
+function toDockerExecArgs(containerName, options) {
+    const args = ["exec"];
+    if (options?.detached)
+        args.push("-d");
+    if (options?.cwd)
+        args.push("-w", options.cwd);
+    if (options?.sudo)
+        args.push("--user", "root");
+    if (options?.env) {
+        for (const [key, value] of Object.entries(options.env)) {
+            args.push("-e", `${key}=${value}`);
+        }
+    }
+    args.push(containerName);
+    return args;
+}
+function mapHostPathToContainer(workspaceHost, targetPath) {
+    if (!targetPath)
+        return CONTAINER_WORKSPACE;
+    const base = path.resolve(workspaceHost);
+    const target = path.resolve(targetPath);
+    const relative = path.relative(base, target);
+    if (!relative || relative === ".")
+        return CONTAINER_WORKSPACE;
+    if (relative.startsWith("..") || path.isAbsolute(relative))
+        return CONTAINER_WORKSPACE;
+    return path.posix.join(CONTAINER_WORKSPACE, ...relative.split(path.sep).filter(Boolean));
+}
+function normalizeContainerPath(workspaceHost, targetPath) {
+    if (!targetPath)
+        return CONTAINER_WORKSPACE;
+    if (targetPath.startsWith("/"))
+        return targetPath;
+    return mapHostPathToContainer(workspaceHost, targetPath);
+}
+function createContainerName() {
+    const random = Math.random().toString(36).slice(2, 10);
+    return `babysitter-pi-${process.pid}-${random}`;
+}
+function runCommand(command, args, options) {
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const child = (0, node_child_process_1.spawn)(command, args, {
+            cwd: options?.cwd,
+            env: options?.env,
+            stdio: ["pipe", "pipe", "pipe"],
+            windowsHide: true,
+        });
+        const stdout = [];
+        const stderr = [];
+        let timedOut = false;
+        let timer;
+        if (options?.timeout && options.timeout > 0) {
+            timer = setTimeout(() => {
+                timedOut = true;
+                child.kill("SIGTERM");
+            }, options.timeout);
+        }
+        child.stdout.on("data", (chunk) => stdout.push(chunk));
+        child.stderr.on("data", (chunk) => stderr.push(chunk));
+        child.stdin.on("error", (error) => {
+            if (error.code === "EPIPE")
+                return;
+            if (!settled) {
+                settled = true;
+                reject(error);
+            }
+        });
+        child.on("error", (error) => {
+            if (!settled) {
+                settled = true;
+                reject(error);
+            }
+        });
+        child.on("close", (code) => {
+            if (settled)
+                return;
+            settled = true;
+            if (timer)
+                clearTimeout(timer);
+            if (timedOut) {
+                reject(new Error(`${command} timed out after ${options?.timeout}ms`));
+                return;
+            }
+            resolve({
+                stdout: Buffer.concat(stdout).toString("utf8"),
+                stderr: Buffer.concat(stderr).toString("utf8"),
+                exitCode: code ?? 1,
+            });
+        });
+        if (options?.input !== undefined) {
+            try {
+                child.stdin.write(options.input);
+            }
+            catch (error) {
+                const err = error;
+                if (err.code !== "EPIPE") {
+                    settled = true;
+                    reject(error);
+                    return;
+                }
+            }
+        }
+        child.stdin.end();
+    });
+}
+class DockerSandboxAdapter {
+    containerName;
+    workspaceHost;
+    constructor(containerName, workspaceHost) {
+        this.containerName = containerName;
+        this.workspaceHost = workspaceHost;
+    }
+    async exec(cmd, args, opts) {
+        const dockerArgs = [
+            ...toDockerExecArgs(this.containerName, {
+                cwd: normalizeContainerPath(this.workspaceHost, opts?.cwd),
+                env: opts?.env,
+                detached: opts?.detached,
+                sudo: opts?.sudo,
+            }),
+            cmd,
+            ...(args ?? []),
+        ];
+        const result = await runCommand("docker", dockerArgs);
+        if (opts?.detached) {
+            return { stdout: "", stderr: "", exitCode: result.exitCode };
+        }
+        return result;
+    }
+    async writeFile(filePath, content, opts) {
+        const result = await runCommand("docker", [
+            ...toDockerExecArgs(this.containerName, {
+                cwd: CONTAINER_WORKSPACE,
+                sudo: opts?.sudo,
+            }),
+            "sh",
+            "-lc",
+            "mkdir -p \"$(dirname \"$1\")\" && cat > \"$1\"",
+            "--",
+            filePath,
+        ], { input: content });
+        if (result.exitCode !== 0) {
+            throw new Error(result.stderr || result.stdout || `writeFile failed for ${filePath}`);
+        }
+    }
+    async readFile(filePath) {
+        const result = await runCommand("docker", [
+            ...toDockerExecArgs(this.containerName, { cwd: CONTAINER_WORKSPACE }),
+            "sh",
+            "-lc",
+            "cat \"$1\"",
+            "--",
+            filePath,
+        ]);
+        if (result.exitCode !== 0) {
+            throw new Error(result.stderr || result.stdout || `readFile failed for ${filePath}`);
+        }
+        return result.stdout;
+    }
+    async fileExists(filePath) {
+        const result = await runCommand("docker", [
+            ...toDockerExecArgs(this.containerName, { cwd: CONTAINER_WORKSPACE }),
+            "sh",
+            "-lc",
+            "test -f \"$1\"",
+            "--",
+            filePath,
+        ]);
+        return result.exitCode === 0;
+    }
+    async stop() {
+        await runCommand("docker", ["rm", "-f", this.containerName]).catch(() => undefined);
+    }
+}
+class DockerSecureBashBackend {
+    workspaceHost;
+    image;
+    containerName = createContainerName();
+    adapter;
+    securedSandbox = null;
+    containerStarted = false;
+    constructor(workspaceHost, image) {
+        this.workspaceHost = workspaceHost;
+        this.image = image;
+        this.adapter = new DockerSandboxAdapter(this.containerName, this.workspaceHost);
+    }
+    get promptNote() {
+        return [
+            "The bash tool runs inside a secure Docker sandbox protected by AgentSH.",
+            `The project workspace is mounted inside that sandbox at ${CONTAINER_WORKSPACE}.`,
+            "Filesystem tools operate on the host mirror of the same workspace files.",
+        ].join(" ");
+    }
+    get operations() {
+        return {
+            exec: async (command, cwd, options) => {
+                if (options.signal?.aborted) {
+                    return { exitCode: null };
+                }
+                const sandbox = await this.initialize();
+                const sandboxCommand = `${buildEnvPrefix(options.env)}${command}`;
+                try {
+                    const result = await sandbox.exec(sandboxCommand, {
+                        cwd: mapHostPathToContainer(this.workspaceHost, cwd),
+                        timeout: options.timeout,
+                    });
+                    if (result.stdout)
+                        options.onData(Buffer.from(result.stdout));
+                    if (result.stderr)
+                        options.onData(Buffer.from(result.stderr));
+                    if (options.signal?.aborted) {
+                        return { exitCode: null };
+                    }
+                    return { exitCode: result.exitCode };
+                }
+                catch (error) {
+                    if (isAbortError(error) || options.signal?.aborted) {
+                        return { exitCode: null };
+                    }
+                    throw error;
+                }
+            },
+        };
+    }
+    async dispose() {
+        if (this.securedSandbox) {
+            await this.securedSandbox.stop().catch(() => undefined);
+            this.securedSandbox = null;
+            this.containerStarted = false;
+            return;
+        }
+        if (this.containerStarted) {
+            await this.adapter.stop?.();
+            this.containerStarted = false;
+        }
+    }
+    async ensureReady() {
+        await this.initialize();
+    }
+    async initialize() {
+        if (this.securedSandbox)
+            return this.securedSandbox;
+        await this.startContainer();
+        try {
+            const mod = await loadAgentSHModule();
+            this.securedSandbox = await mod.secureSandbox(this.adapter, {
+                workspace: CONTAINER_WORKSPACE,
+                realPaths: true,
+                installStrategy: DEFAULT_INSTALL_STRATEGY,
+            });
+            return this.securedSandbox;
+        }
+        catch (error) {
+            await this.adapter.stop?.();
+            throw error;
+        }
+    }
+    async startContainer() {
+        if (this.containerStarted)
+            return;
+        const result = await runCommand("docker", [
+            "run",
+            "-d",
+            "--rm",
+            "--name",
+            this.containerName,
+            "-v",
+            `${path.resolve(this.workspaceHost)}:${CONTAINER_WORKSPACE}`,
+            "-w",
+            CONTAINER_WORKSPACE,
+            this.image,
+            "tail",
+            "-f",
+            "/dev/null",
+        ]);
+        if (result.exitCode !== 0) {
+            throw new Error(result.stderr || result.stdout || "Failed to start PI secure sandbox container.");
+        }
+        this.containerStarted = true;
+    }
+}
+async function createSecureBashBackend(options) {
+    if (options.mode === "local") {
+        return null;
+    }
+    const backend = new DockerSecureBashBackend(path.resolve(options.workspace), options.image || DEFAULT_SANDBOX_IMAGE);
+    try {
+        await backend.ensureReady();
+    }
+    catch (error) {
+        await backend.dispose().catch(() => undefined);
+        if (options.mode === "auto") {
+            return null;
+        }
+        throw error;
+    }
+    return backend;
+}

package/dist/harness/piSecureSandboxTypes.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Type definitions for Pi secure sandbox.
+ * Extracted from piSecureSandbox.ts for max-lines compliance.
+ */
+export interface PiBashOperations {
+    exec: (command: string, cwd: string, options: {
+        onData: (data: Buffer) => void;
+        signal?: AbortSignal;
+        timeout?: number;
+        env?: NodeJS.ProcessEnv;
+    }) => Promise<{
+        exitCode: number | null;
+    }>;
+}
+export interface ExecResult {
+    stdout: string;
+    stderr: string;
+    exitCode: number;
+}
+export interface SandboxAdapterLike {
+    exec(cmd: string, args?: string[], opts?: {
+        cwd?: string;
+        sudo?: boolean;
+        detached?: boolean;
+        env?: Record<string, string>;
+    }): Promise<ExecResult>;
+    writeFile(path: string, content: string | Buffer, opts?: {
+        sudo?: boolean;
+    }): Promise<void>;
+    readFile(path: string): Promise<string>;
+    stop?(): Promise<void>;
+    fileExists?(path: string): Promise<boolean>;
+}
+export interface SecuredSandboxLike {
+    exec(command: string, opts?: {
+        cwd?: string;
+        timeout?: number;
+    }): Promise<ExecResult>;
+    stop(): Promise<void>;
+    readonly sessionId: string;
+    readonly securityMode: string;
+}
+export interface AgentSHModule {
+    secureSandbox(adapter: SandboxAdapterLike, config?: Record<string, unknown>): Promise<SecuredSandboxLike>;
+}
+export interface SecureBashBackend {
+    operations: PiBashOperations;
+    dispose(): Promise<void>;
+    promptNote: string;
+}
+//# sourceMappingURL=piSecureSandboxTypes.d.ts.map

package/dist/harness/piSecureSandboxTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piSecureSandboxTypes.d.ts","sourceRoot":"","sources":["../../src/harness/piSecureSandboxTypes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,CACJ,OAAO,EAAE,MAAM,EACf,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;QACP,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAC/B,MAAM,CAAC,EAAE,WAAW,CAAC;QACrB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;KACzB,KACE,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACnJ,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5F,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,UAAU,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtF,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,OAAO,EAAE,kBAAkB,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC3G;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,gBAAgB,CAAC;IAC7B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/harness/piSecureSandboxTypes.js

@@ -0,0 +1,6 @@
+"use strict";
+/**
+ * Type definitions for Pi secure sandbox.
+ * Extracted from piSecureSandbox.ts for max-lines compliance.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/harness/piWrapper/compaction.d.ts

@@ -0,0 +1,13 @@
+export declare function loadCompressionConfigSafe(cwd: string): import("@a5c-ai/babysitter-sdk").CompressionConfig | null;
+export declare function buildCompactionSettings(enabled: boolean): {
+    compaction: {
+        enabled: boolean;
+        reserveTokens?: number;
+        keepRecentTokens?: number;
+    };
+    branchSummary?: {
+        reserveTokens?: number;
+        skipPrompt?: boolean;
+    };
+};
+//# sourceMappingURL=compaction.d.ts.map

package/dist/harness/piWrapper/compaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"compaction.d.ts","sourceRoot":"","sources":["../../../src/harness/piWrapper/compaction.ts"],"names":[],"mappings":"AAEA,wBAAgB,yBAAyB,CAAC,GAAG,EAAE,MAAM,6DAMpD;AASD,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG;IACzD,UAAU,EAAE;QACV,OAAO,EAAE,OAAO,CAAC;QACjB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;IACF,aAAa,CAAC,EAAE;QACd,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,UAAU,CAAC,EAAE,OAAO,CAAC;KACtB,CAAC;CACH,CAkBA"}