@alpacakit/agents 0.1.0-beta.36 → 0.1.0-beta.39

package/README.md

@@ -8,8 +8,9 @@ Design: [`src/v2/design/l_agents_library.md`](https://github.com/alpacakit/alpac
 
 The whole runtime surface — including extension points — ships from one
 root entry. Only genuine isolation lives on a subpath: dev fakes
-(`/testing`), the codex app-server client (`/codex`), the native keyring
-(`/keyring`), and machine-local config storage (`/config`).
+(`/testing`), the codex app-server client (`/codex`), and machine-local
+config storage (`/config`). The OS keychain is not here at all: it belongs
+to `@alpacakit/core/keyring`, the single keychain owner of the workspace.
 
 Most apps need only a handful of root exports: `runAgent`,
 `createAgentRuntime`, `processEnv`, the built-in `claude` / `codex`
@@ -276,7 +277,9 @@ const config = await loadAgentsRuntimeConfig(
 
 Family-specific conventions (a fixed path env var + a keyring service)
 belong in the consumer's own convention module, not in this package — they
-are a plain instance of the same preset shape.
+are a plain instance of the same preset shape. Secret resolvers backed by the
+OS keychain come from `@alpacakit/core/keyring`; this package only consumes
+the `SecretResolver` port.
 
 ## Host plane: execution availability, skills & MCP (operator)
 
@@ -301,16 +304,17 @@ installed skills and MCP servers remains in progress.
 | `/config/extension` | custom agent-config kinds (`defineAgentConfigType`) |
 | `/testing` | `fakeExec`, `fakeClock`, `fakeAgent`, `fakeSecretResolver` — no subprocess ever spawns |
 | `/codex` | codex app-server JSON-RPC client (advanced) |
-| `/keyring` | `keyringResolver` (loads the optional `@napi-rs/keyring` peer) |
 
 ## Status
 
 Implemented: kernel (runtime, run handle, guards, classification), CLI
 blueprint with built-in `claude()` / `codex()`, ambient execution availability,
 structured output with repair, fleet with cooldown / auth-mark stores, auth
-materials and secret resolvers, `openaiCompatible` (engine port; the built-in HTTP
-chat-completions engine is the dependency-free default), and the first
-host-plane skill / MCP implementations (Claude local-dir skills plus
-Claude / Codex stdio MCP registration). Not yet implemented: the
-in-process pi-session engine for `openaiCompatible`, GitHub / plugin skill
-installers, and availability listing for installed skills / MCP servers.
+materials and secret resolvers, `openaiCompatible` (engine port; the built-in
+HTTP chat-completions engine is the dependency-free default and the in-process
+`piSessionEngine` ships behind an optional peer, selected per agent config by
+`engine: "pi"`), CLI sign-in for `codex` (oauth, device) and `claude` (oauth —
+the CLI has no device flow), and the first host-plane skill / MCP
+implementations (Claude local-dir skills plus Claude / Codex stdio MCP
+registration). Not yet implemented: GitHub / plugin skill installers and
+availability listing for installed skills / MCP servers.

package/dist/agents/claude.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/agents/claude.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA8CH,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAM/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG/D,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAC7D,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAsK1D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CA0CvD;AAoSD,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;CAClD,CAAC;AAEF,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,eAAe,CAAC,QAAQ,CAAC,CA2E7E"}
+{"version":3,"file":"claude.d.ts","sourceRoot":"","sources":["../../src/agents/claude.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA+CH,OAAO,EACL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAO/B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAG/D,eAAO,MAAM,yBAAyB,sBAAsB,CAAC;AAC7D,eAAO,MAAM,sBAAsB,sBAAsB,CAAC;AAsK1D;;;;;GAKG;AACH,wBAAgB,sBAAsB,IAAI,cAAc,CA0CvD;AA6TD,MAAM,MAAM,aAAa,GAAG;IAC1B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;CAClD,CAAC;AAEF,wBAAgB,MAAM,CAAC,OAAO,GAAE,aAAkB,GAAG,eAAe,CAAC,QAAQ,CAAC,CAgF7E"}

package/dist/agents/claude.js

@@ -7,6 +7,7 @@
  */
 import { cp, mkdir, readdir, readFile, rm, stat } from "node:fs/promises";
 import path from "node:path";
+import { LOGIN_METHOD } from "../auth/login.js";
 import { cliLoginProbe } from "../auth/login-probe.js";
 import { AUTH_MATERIAL_KIND, envVarAuthMaterial } from "../auth/material.js";
 import { requireSecret } from "../auth/secrets.js";
@@ -22,6 +23,7 @@ import { listMcpServersViaCli } from "../host/mcp-list.js";
 import { hostCommandFailedError, runHostCommand, runHostCommandResult, } from "../host/run-command.js";
 import { parseEpochTimestamp, } from "../kernel/classify.js";
 import { defineCliAgent, } from "../kernel/cli-agent.js";
+import { cliLoginCommand } from "../kernel/cli-login.js";
 import { GRANT_KIND, SANDBOX_MODE } from "../kernel/options.js";
 export const CLAUDE_CONFIG_DIR_ENV_VAR = "CLAUDE_CONFIG_DIR";
 export const CLAUDE_API_KEY_ENV_VAR = "ANTHROPIC_API_KEY";
@@ -224,6 +226,29 @@ const homeDirHandler = envVarAuthMaterial({
         ctx,
     }),
 });
+/**
+ * `claude auth login --claudeai` writes its credential into
+ * `CLAUDE_CONFIG_DIR`, so pointing that at the requested home is the whole
+ * isolation mechanism — the competing token variables are unset for the same
+ * reason `homeDirHandler` unsets them: an inherited token would authenticate
+ * the CLI without ever populating the home we are creating.
+ *
+ * Only `oauth` is offered. The CLI has no device-code flow (`--console` /
+ * `--sso` are still browser flows), and declaring an unimplemented method
+ * would make `agent.login.supports("device")` lie.
+ */
+function claudeLogin(args) {
+    return (request, ctx) => cliLoginCommand({
+        command: CLAUDE.command,
+        args,
+        envPatch: {
+            set: { [CLAUDE_CONFIG_DIR_ENV_VAR]: request.homeDir },
+            unset: COMPETING_TOKEN_VARS,
+        },
+        request,
+        ctx,
+    });
+}
 /** Install/list roots in priority order; the first is the install target. */
 function claudeSkillRoots(ctx) {
     const userRoot = {
@@ -494,6 +519,11 @@ export function claude(options = {}) {
                 unset: COMPETING_CONFIG_VARS,
             }),
         },
+        login: {
+            methods: {
+                [LOGIN_METHOD.oauth]: claudeLogin(CLAUDE.auth.loginArgs),
+            },
+        },
         skills: {
             list: listClaudeSkills,
             install: {

package/dist/agents/openai-compatible/engine.d.ts

@@ -2,10 +2,11 @@
  * The engine port: how a resolved OpenAI-compatible config is turned
  * into an AgentRun. The engine owns its own availability — its doctor
  * checks describe requirements of the engine itself (peer packages,
- * node floor), never of the config (the resolver owns those). The
- * shipped default is the dependency-free fetch chat-completions engine;
- * an in-process pi-session engine (design E3, v1 parity) is a
- * detail-backlog implementation of this same port.
+ * node floor), never of the config (the resolver owns those). Two
+ * implementations ship: the dependency-free fetch chat-completions engine
+ * (the default), and the in-process pi-session engine (`piSessionEngine`
+ * in `pi/engine.ts`, which needs pi installed as an optional peer),
+ * selected per agent config with `engine: "pi"`.
  */
 import type { DoctorCheck } from "../../host/capabilities.js";
 import type { AgentRun, RunContext } from "../../kernel/definition.js";

package/dist/agents/openai-compatible/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/agents/openai-compatible/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,sBAAsB;IACrC,YAAY,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAChD,GAAG,CACD,MAAM,EAAE,8BAA8B,EACtC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,UAAU,GACd,QAAQ,CAAC;CACb"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../../src/agents/openai-compatible/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,YAAY,CAAC;AAEjE,MAAM,WAAW,sBAAsB;IACrC,YAAY,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAChD,GAAG,CACD,MAAM,EAAE,8BAA8B,EACtC,OAAO,EAAE,kBAAkB,EAC3B,GAAG,EAAE,UAAU,GACd,QAAQ,CAAC;CACb"}

package/dist/agents/openai-compatible/engine.js

@@ -2,9 +2,10 @@
  * The engine port: how a resolved OpenAI-compatible config is turned
  * into an AgentRun. The engine owns its own availability — its doctor
  * checks describe requirements of the engine itself (peer packages,
- * node floor), never of the config (the resolver owns those). The
- * shipped default is the dependency-free fetch chat-completions engine;
- * an in-process pi-session engine (design E3, v1 parity) is a
- * detail-backlog implementation of this same port.
+ * node floor), never of the config (the resolver owns those). Two
+ * implementations ship: the dependency-free fetch chat-completions engine
+ * (the default), and the in-process pi-session engine (`piSessionEngine`
+ * in `pi/engine.ts`, which needs pi installed as an optional peer),
+ * selected per agent config with `engine: "pi"`.
  */
 export {};

package/dist/config/agent-configs.d.ts

@@ -1,7 +1,7 @@
 import { type JsonObject } from "@alpacakit/core";
 import { type AgentConfigKind } from "./ids.js";
 import type { AgentConfig, AgentConfigType, AgentConfigTypeRegistry } from "./model.js";
-import { AGENT_CONFIG_KIND } from "./values.js";
+import { AGENT_CONFIG_KIND, type OpenAiCompatibleEngineKind } from "./values.js";
 type BuiltinAgentConfigPayload = {
     readonly model: string | null;
     readonly effort: string | null;
@@ -12,6 +12,7 @@ type OpenAiCompatibleAgentConfigPayload = {
     readonly apiKey: string | null;
     readonly headers: Readonly<Record<string, string>>;
     readonly requestParams: JsonObject;
+    readonly engine: OpenAiCompatibleEngineKind;
 };
 export type BuiltinAgentConfigOptions = {
     readonly id: string;
@@ -27,6 +28,7 @@ export type OpenAiCompatibleAgentConfigOptions = {
     readonly apiKey?: string;
     readonly headers?: Readonly<Record<string, string>>;
     readonly requestParams?: JsonObject;
+    readonly engine?: OpenAiCompatibleEngineKind;
 };
 export declare function codexAgentConfig(options: BuiltinAgentConfigOptions): AgentConfig<typeof AGENT_CONFIG_KIND.codex, BuiltinAgentConfigPayload>;
 export declare function claudeAgentConfig(options: BuiltinAgentConfigOptions): AgentConfig<typeof AGENT_CONFIG_KIND.claude, BuiltinAgentConfigPayload>;

package/dist/config/agent-configs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-configs.d.ts","sourceRoot":"","sources":["../../src/config/agent-configs.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,UAAU,EAEhB,MAAM,iBAAiB,CAAC;AAQzB,OAAO,EAAE,KAAK,eAAe,EAAiB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAGf,uBAAuB,EAGxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EAGlB,MAAM,aAAa,CAAC;AAQrB,KAAK,yBAAyB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAOF,KAAK,kCAAkC,GAAG;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;CACpC,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;CACrC,CAAC;AAiCF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,yBAAyB,GACjC,WAAW,CAAC,OAAO,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAExE;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,yBAAyB,GACjC,WAAW,CAAC,OAAO,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAEzE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,WAAW,CACZ,OAAO,iBAAiB,CAAC,gBAAgB,EACzC,kCAAkC,CACnC,CAaA;AA2CD,wBAAgB,oCAAoC,IAAI,uBAAuB,CAoB9E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,EAC1B,OAAO,SAAS,MAAM,EAEtB,UAAU,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAClD,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAEzC"}
+{"version":3,"file":"agent-configs.d.ts","sourceRoot":"","sources":["../../src/config/agent-configs.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,KAAK,UAAU,EAEhB,MAAM,iBAAiB,CAAC;AAUzB,OAAO,EAAE,KAAK,eAAe,EAAiB,MAAM,UAAU,CAAC;AAC/D,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAGf,uBAAuB,EAGxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,iBAAiB,EAKjB,KAAK,0BAA0B,EAChC,MAAM,aAAa,CAAC;AAQrB,KAAK,yBAAyB,GAAG;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC,CAAC;AAOF,KAAK,kCAAkC,GAAG;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,MAAM,EAAE,0BAA0B,CAAC;CAC7C,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,kCAAkC,GAAG;IAC/C,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,UAAU,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,0BAA0B,CAAC;CAC9C,CAAC;AAiCF,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,yBAAyB,GACjC,WAAW,CAAC,OAAO,iBAAiB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAExE;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,yBAAyB,GACjC,WAAW,CAAC,OAAO,iBAAiB,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAEzE;AAED,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,WAAW,CACZ,OAAO,iBAAiB,CAAC,gBAAgB,EACzC,kCAAkC,CACnC,CAcA;AAgDD,wBAAgB,oCAAoC,IAAI,uBAAuB,CAoB9E;AAED,wBAAgB,qBAAqB,CACnC,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,EAC1B,OAAO,SAAS,MAAM,EAEtB,UAAU,EAAE,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAClD,eAAe,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAEzC"}

package/dist/config/agent-configs.js

@@ -1,11 +1,13 @@
+import path from "node:path";
 import { createKeyedRegistry, createSchemaRuntimeCodec, jsonValueSchema, } from "@alpacakit/core";
 import { z } from "zod";
 import { claude } from "../agents/claude.js";
 import { codex } from "../agents/codex.js";
 import { openaiCompatible } from "../agents/openai-compatible.js";
+import { piSessionEngine } from "../agents/openai-compatible/pi/engine.js";
 import { agentConfigId } from "./ids.js";
 import { formatFieldPath, ZOD_ISSUE_CODE } from "./support.js";
-import { AGENT_CONFIG_KIND, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, } from "./values.js";
+import { AGENT_CONFIG_KIND, AGENTS_CONFIG_DIRECTORY, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, OPENAI_COMPATIBLE_ENGINE, } from "./values.js";
 const ENV_TEMPLATE_EXPRESSION_START = "${";
 const OPENAI_COMPATIBLE_PAYLOAD_FIELD = {
     apiKey: "apiKey",
@@ -44,6 +46,7 @@ export function openAiCompatibleAgentConfig(options) {
             apiKey: options.apiKey ?? null,
             headers: options.headers ?? {},
             requestParams: options.requestParams ?? {},
+            engine: options.engine ?? OPENAI_COMPATIBLE_ENGINE.fetch,
         },
     };
 }
@@ -61,6 +64,11 @@ const openAiCompatibleAgentConfigPayloadCodec = createSchemaRuntimeCodec(z
     apiKey: z.string().min(1).nullable(),
     headers: z.record(z.string(), z.string().min(1)).readonly(),
     requestParams: z.record(z.string(), jsonValueSchema).readonly(),
+    // Defaulted, not required: an agent-settings file written before the
+    // engine choice existed reads back as the `fetch` it was running on.
+    engine: z
+        .enum(Object.values(OPENAI_COMPATIBLE_ENGINE))
+        .default(OPENAI_COMPATIBLE_ENGINE.fetch),
 })
     .strict()
     .readonly()
@@ -164,8 +172,9 @@ function createOpenAiCompatibleAgentConfig() {
                 headers: input.record.payload.headers,
                 requestParams: input.record.payload.requestParams,
             };
+            const engine = resolveOpenAiCompatibleEngine(input.record.payload.engine, input.rootDir);
             return {
-                agents: [openaiCompatible(config)],
+                agents: [openaiCompatible(config, engine === null ? {} : { engine })],
                 candidates: [
                     {
                         candidate: { agentId, model: input.record.payload.model },
@@ -181,6 +190,18 @@ function createOpenAiCompatibleAgentConfig() {
         },
     });
 }
+/**
+ * `null` selects `openaiCompatible`'s own dependency-free default rather than
+ * naming it twice. The pi engine's agent home is derived from the config root
+ * so the persisted payload stays machine-independent.
+ */
+function resolveOpenAiCompatibleEngine(kind, rootDir) {
+    return kind === OPENAI_COMPATIBLE_ENGINE.pi
+        ? piSessionEngine({
+            agentDir: path.join(rootDir, AGENTS_CONFIG_DIRECTORY.piAgentHome),
+        })
+        : null;
+}
 function rejectDirectSecretIfPresent(value, field, context) {
     if (value === null) {
         return;

package/dist/config/compose.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/config/compose.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EAEV,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAwBpB,KAAK,iCAAiC,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1D,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,iCAAiC,GACvC,mBAAmB,CA2CrB"}
+{"version":3,"file":"compose.d.ts","sourceRoot":"","sources":["../../src/config/compose.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EACV,uBAAuB,EACvB,mBAAmB,EACnB,UAAU,EAEV,mBAAmB,EACpB,MAAM,YAAY,CAAC;AAwBpB,KAAK,iCAAiC,GAAG;IACvC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,mBAAmB,CAAC,iBAAiB,CAAC,CAAC;IACjE,QAAQ,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;IACnD,QAAQ,CAAC,eAAe,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1D,CAAC;AAEF,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,iCAAiC,GACvC,mBAAmB,CA4CrB"}

package/dist/config/compose.js

@@ -37,6 +37,7 @@ export function composeRuntimeConfig(input) {
             record: validation.record,
             profiles: input.data.profiles,
             ambientBuiltinAuth: input.data.agentConfigs.ambientBuiltinAuth.enabled,
+            rootDir: input.data.paths.rootDir,
         });
         for (const agent of projection.agents) {
             addAgentDefinition(agentDefinitions, agent);

package/dist/config/index.d.ts

@@ -8,5 +8,6 @@ export type { AgentConfigId, AgentConfigKind, ProfileId } from "./ids.js";
 export { agentConfigId, agentConfigKind, profileId } from "./ids.js";
 export type { AgentConfig, AgentConfigManager, AgentConfigPatch, AgentConfigSettings, AgentsConfigPaths, AgentsRuntimeConfig, ApiKeyProfileInput, CandidateSource, CandidateSourceInfo, CandidateWithSource, HomeDirProfileInput, NamedSecretResolver, ProfileInputBase, ProfileManager, ProfileRecord, } from "./model.js";
 export { DEFAULT_AGENTS_CONFIG_AGENT_SETTINGS } from "./store.js";
-export { AGENT_CONFIG_KIND, AGENTS_CONFIG_FILE, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, DEFAULT_AGENT_CONFIG_ID, } from "./values.js";
+export type { OpenAiCompatibleEngineKind } from "./values.js";
+export { AGENT_CONFIG_KIND, AGENTS_CONFIG_DIRECTORY, AGENTS_CONFIG_FILE, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, DEFAULT_AGENT_CONFIG_ID, OPENAI_COMPATIBLE_ENGINE, } from "./values.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,yBAAyB,EACzB,kCAAkC,GACnC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,2BAA2B,GAC5B,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,qBAAqB,EACrB,wBAAwB,GACzB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,YAAY,EACZ,uBAAuB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACrE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,EAClB,eAAe,EACf,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,aAAa,GACd,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,oCAAoC,EAAE,MAAM,YAAY,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,kBAAkB,EAClB,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,aAAa,CAAC"}

package/dist/config/index.js

@@ -3,4 +3,4 @@ export { AGENTS_CONFIG_ERROR_CODE, AgentsConfigError, isAgentsConfigError, } fro
 export { loadAgentsRuntimeConfig, openAgentsConfig, candidatesForFleet, secretsForRuntime, } from "./config.js";
 export { agentConfigId, agentConfigKind, profileId } from "./ids.js";
 export { DEFAULT_AGENTS_CONFIG_AGENT_SETTINGS } from "./store.js";
-export { AGENT_CONFIG_KIND, AGENTS_CONFIG_FILE, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, DEFAULT_AGENT_CONFIG_ID, } from "./values.js";
+export { AGENT_CONFIG_KIND, AGENTS_CONFIG_DIRECTORY, AGENTS_CONFIG_FILE, BUILTIN_AGENT_ID, CANDIDATE_SOURCE_KIND, DEFAULT_AGENT_CONFIG_ID, OPENAI_COMPATIBLE_ENGINE, } from "./values.js";

package/dist/config/model.d.ts

@@ -68,6 +68,12 @@ export type AgentConfigProjectionInput<Kind extends AgentConfigKind, Payload ext
     readonly record: AgentConfig<Kind, Payload>;
     readonly profiles: readonly ProfileRecord[];
     readonly ambientBuiltinAuth: boolean;
+    /**
+     * The machine-local config root. An agent config whose engine keeps state
+     * on disk (the pi session engine's agent home) hangs it off this root
+     * rather than putting a machine path in the persisted payload.
+     */
+    readonly rootDir: string;
 };
 export interface AgentConfigType<Kind extends AgentConfigKind, Payload extends JsonObject, AgentId extends string> {
     readonly kind: Kind;

package/dist/config/model.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/config/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IAC3D,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAC7D,gBAAgB,CAAC,OAAO,CAAC,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEJ,MAAM,MAAM,kBAAkB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAC5D,gBAAgB,CAAC,OAAO,CAAC,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEJ,MAAM,MAAM,WAAW,CACrB,IAAI,SAAS,eAAe,GAAG,eAAe,EAC9C,OAAO,SAAS,UAAU,GAAG,UAAU,IACrC;IACF,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,OAAO,SAAS,MAAM,IAAI;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,0BAA0B,CACpC,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,IACxB;IACF,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;CACtC,CAAC;AAEF,MAAM,WAAW,eAAe,CAC9B,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,EAC1B,OAAO,SAAS,MAAM;IAEtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CACL,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,GAC/C,qBAAqB,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAC5C,eAAe,EACf,eAAe,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,CACrD,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM;IAC7D,IAAI,IAAI,OAAO,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,UAAU,CACR,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,SAAS,CACP,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5C,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACjE,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACvE"}
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../src/config/model.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC1E,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,KAAK,EAAE,aAAa,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC1E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEzD,MAAM,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3D,MAAM,MAAM,iBAAiB,GAAG;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,uBAAuB,EAAE,MAAM,CAAC;IACzC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IAC3D,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gBAAgB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAC7D,gBAAgB,CAAC,OAAO,CAAC,GAAG;IAC1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;AAEJ,MAAM,MAAM,kBAAkB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAC5D,gBAAgB,CAAC,OAAO,CAAC,GAAG;IAC1B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;CAC5B,CAAC;AAEJ,MAAM,MAAM,WAAW,CACrB,IAAI,SAAS,eAAe,GAAG,eAAe,EAC9C,OAAO,SAAS,UAAU,GAAG,UAAU,IACrC;IACF,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,kBAAkB,EAAE;QAC3B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,CAAC;IACF,QAAQ,CAAC,YAAY,EAAE,SAAS,WAAW,EAAE,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC;CAC/B,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,eAAe,GACzB,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAC;AAErE,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAC;CAChC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC;CACtC,CAAC;AAEF,MAAM,MAAM,qBAAqB,CAAC,OAAO,SAAS,MAAM,IAAI;IAC1D,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9D,CAAC;AAEF,MAAM,MAAM,0BAA0B,CACpC,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,IACxB;IACF,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,WAAW,eAAe,CAC9B,IAAI,SAAS,eAAe,EAC5B,OAAO,SAAS,UAAU,EAC1B,OAAO,SAAS,MAAM;IAEtB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC7C,OAAO,CACL,KAAK,EAAE,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,GAC/C,qBAAqB,CAAC,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAC5C,eAAe,EACf,eAAe,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,CACrD,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,mBAAmB,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,IAAI;IACjE,QAAQ,CAAC,MAAM,EAAE,SAAS,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,QAAQ,CAAC,UAAU,EAAE,SAAS,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7D,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAC;IAC1C,QAAQ,CAAC,eAAe,EAAE,SAAS,mBAAmB,EAAE,CAAC;CAC1D,CAAC;AAEF,MAAM,WAAW,cAAc,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM;IAC7D,IAAI,IAAI,OAAO,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnD,UAAU,CACR,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,GAClC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,SAAS,CACP,KAAK,EAAE,kBAAkB,CAAC,OAAO,CAAC,GACjC,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC5E,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACxC,WAAW,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC5C,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IACzE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IACjE,qBAAqB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;CACvE"}

package/dist/config/values.d.ts

@@ -18,4 +18,23 @@ export declare const CANDIDATE_SOURCE_KIND: {
     readonly ambient: "ambient";
     readonly configured: "configured";
 };
+/**
+ * Which engine an `openai-compatible` agent config runs on: the
+ * dependency-free HTTP chat-completions default, or the in-process pi
+ * session, which needs pi installed as an optional peer.
+ */
+export declare const OPENAI_COMPATIBLE_ENGINE: {
+    readonly fetch: "fetch";
+    readonly pi: "pi";
+};
+export type OpenAiCompatibleEngineKind = (typeof OPENAI_COMPATIBLE_ENGINE)[keyof typeof OPENAI_COMPATIBLE_ENGINE];
+/**
+ * Directories the config root owns beyond its files. `pi` is the agent home
+ * the pi engine loads resources and skills from; it is shared by every
+ * `openai-compatible` agent config in one root, so installing a skill there
+ * is a property of the machine's agents home, not of one agent.
+ */
+export declare const AGENTS_CONFIG_DIRECTORY: {
+    readonly piAgentHome: "pi";
+};
 //# sourceMappingURL=values.d.ts.map

package/dist/config/values.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/config/values.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;CAG1B,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC"}
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../src/config/values.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,eAAO,MAAM,kBAAkB;;;;CAIrB,CAAC;AAEX,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,eAAO,MAAM,uBAAuB;;;CAG1B,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,wBAAwB;;;CAG3B,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACpC,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAC;AAE3E;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB;;CAE1B,CAAC"}

package/dist/config/values.js

@@ -20,3 +20,21 @@ export const CANDIDATE_SOURCE_KIND = {
     ambient: "ambient",
     configured: "configured",
 };
+/**
+ * Which engine an `openai-compatible` agent config runs on: the
+ * dependency-free HTTP chat-completions default, or the in-process pi
+ * session, which needs pi installed as an optional peer.
+ */
+export const OPENAI_COMPATIBLE_ENGINE = {
+    fetch: "fetch",
+    pi: "pi",
+};
+/**
+ * Directories the config root owns beyond its files. `pi` is the agent home
+ * the pi engine loads resources and skills from; it is shared by every
+ * `openai-compatible` agent config in one root, so installing a skill there
+ * is a property of the machine's agents home, not of one agent.
+ */
+export const AGENTS_CONFIG_DIRECTORY = {
+    piAgentHome: "pi",
+};

package/dist/index.d.ts

@@ -4,8 +4,8 @@
  * One root entry holds the whole surface: extension points must never
  * require knowing which internal layer owns them. Only genuine isolation
  * lives on a subpath — dev fakes (`/testing`), the codex app-server client
- * (`/codex`), the native keyring (`/keyring`), and machine-local config
- * storage (`/config`).
+ * (`/codex`), and machine-local config storage (`/config`). The OS keychain
+ * is not here at all: it belongs to `@alpacakit/core/keyring`.
  */
 export { BUILTIN_AGENT_ID, type BuiltinAgentId, builtinAgentFactories, } from "./agents/builtin.js";
 export { claude, type ClaudeOptions, structuredQuotaMatcher, } from "./agents/claude.js";
@@ -18,7 +18,6 @@ export type { LoginCapability, LoginContext, LoginEvent, LoginHandle, LoginHandl
 export { LOGIN_EVENT_TYPE, LOGIN_METHOD } from "./auth/login.js";
 export type { ApiKeyProfileOptions, AuthCapability, AuthMaterial, AuthMaterialDescriptor, AuthMaterialKind, AuthProfile, AuthStatus, HomeDirProfileOptions, MaterialHandler, MaterialHandlers, SecretRef, } from "./auth/material.js";
 export { AUTH_MATERIAL_KIND, AUTH_STATUS, createApiKeyProfile, createHomeDirProfile, envVarAuthMaterial, } from "./auth/material.js";
-export { fileProfileStore, type ProfileStore } from "./auth/profile-store.js";
 export { envResolver, requireSecret } from "./auth/secrets.js";
 export type { ChildProcessAbsenceProof, ChildProcessCompletion, ChildProcessIdentity, ChildProcessLifecycle, ChildProcessTerminationEvidence, ChildProcessTerminationPhase, ChildProcessTerminationResult, ChildProcessUnkillableReason, ControlledExec, ControlledExecOptions, ControlledExecProcess, ControlledProcessRecovery, } from "./core/controlled-process.js";
 export { CHILD_PROCESS_ABSENCE_PROOF, CHILD_PROCESS_TERMINATION_EVIDENCE_KIND, CHILD_PROCESS_TERMINATION_KIND, CHILD_PROCESS_TERMINATION_PHASE, CHILD_PROCESS_UNKILLABLE_REASON, } from "./core/controlled-process.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,MAAM,EACN,KAAK,aAAa,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,YAAY,EACV,eAAe,EACf,YAAY,EACZ,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,SAAS,GACV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,KAAK,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,2BAA2B,EAC3B,uCAAuC,EACvC,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EACjB,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,cAAc,EACd,KAAK,EACL,iBAAiB,EACjB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iCAAiC,EACjC,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,sCAAsC,EACtC,8CAA8C,EAC9C,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,YAAY,EACV,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,MAAM,EACN,QAAQ,EACR,KAAK,EACL,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,QAAQ,EACR,OAAO,EACP,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,EACT,QAAQ,GACT,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElE,YAAY,EACV,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAEzE,YAAY,EACV,aAAa,EACb,YAAY,EACZ,OAAO,EACP,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,EACL,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,2CAA2C,GAC5C,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,QAAQ,EACR,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,MAAM,EACN,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,OAAO,EACP,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EACV,eAAe,EACf,QAAQ,EACR,UAAU,GACX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,YAAY,EACV,WAAW,EACX,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,8BAA8B,EAC9B,KAAK,EACL,MAAM,EACN,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EACV,KAAK,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,GACR,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,YAAY,EACZ,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,gBAAgB,EAChB,KAAK,cAAc,EACnB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,MAAM,EACN,KAAK,aAAa,EAClB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,yCAAyC,CAAC;AACtF,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,eAAe,GAChB,MAAM,yCAAyC,CAAC;AACjD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,YAAY,EACV,eAAe,EACf,YAAY,EACZ,UAAU,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,QAAQ,GACT,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AACjE,YAAY,EACV,oBAAoB,EACpB,cAAc,EACd,YAAY,EACZ,sBAAsB,EACtB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,qBAAqB,EACrB,eAAe,EACf,gBAAgB,EAChB,SAAS,GACV,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,WAAW,EACX,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC/D,YAAY,EACV,wBAAwB,EACxB,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EACrB,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,4BAA4B,EAC5B,cAAc,EACd,qBAAqB,EACrB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,2BAA2B,EAC3B,uCAAuC,EACvC,8BAA8B,EAC9B,+BAA+B,EAC/B,+BAA+B,GAChC,MAAM,8BAA8B,CAAC;AACtC,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EACL,aAAa,EACb,eAAe,EACf,eAAe,EACf,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,YAAY,EACV,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,8BAA8B,EAC9B,iBAAiB,EACjB,kCAAkC,EAClC,kCAAkC,EAClC,0CAA0C,EAC1C,cAAc,EACd,KAAK,EACL,iBAAiB,EACjB,WAAW,GACZ,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,iCAAiC,EACjC,UAAU,EACV,mBAAmB,EACnB,YAAY,EACZ,sCAAsC,EACtC,8CAA8C,EAC9C,qBAAqB,EACrB,YAAY,EACZ,mBAAmB,EACnB,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AACtE,YAAY,EACV,KAAK,EACL,IAAI,EACJ,SAAS,EACT,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,UAAU,EACV,sBAAsB,EACtB,2BAA2B,EAC3B,MAAM,EACN,QAAQ,EACR,KAAK,EACL,cAAc,EACd,eAAe,EACf,aAAa,GACd,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EACV,UAAU,EACV,eAAe,EACf,aAAa,EACb,QAAQ,EACR,OAAO,EACP,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,EACT,QAAQ,GACT,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,mBAAmB,EACnB,cAAc,EACd,WAAW,GACZ,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElE,YAAY,EACV,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAEzE,YAAY,EACV,aAAa,EACb,YAAY,EACZ,OAAO,EACP,aAAa,EACb,SAAS,EACT,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,EACL,sBAAsB,EACtB,YAAY,EACZ,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,oBAAoB,EACpB,YAAY,EACZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,aAAa,EACb,aAAa,EACb,iBAAiB,EACjB,aAAa,EACb,UAAU,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,cAAc,EACd,oBAAoB,EACpB,mBAAmB,EACnB,yBAAyB,GAC1B,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpE,YAAY,EACV,iBAAiB,EACjB,2BAA2B,EAC3B,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,yBAAyB,EACzB,0BAA0B,EAC1B,wBAAwB,EACxB,2CAA2C,GAC5C,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,YAAY,EACZ,cAAc,EACd,cAAc,EACd,cAAc,EACd,eAAe,EACf,aAAa,EACb,QAAQ,EACR,aAAa,EACb,cAAc,EACd,YAAY,EACZ,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,gBAAgB,EAChB,kBAAkB,GACnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,8BAA8B,EAC9B,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,cAAc,EACd,SAAS,EACT,aAAa,EACb,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACnE,YAAY,EACV,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,YAAY,EACV,iBAAiB,EACjB,eAAe,EACf,cAAc,GACf,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,MAAM,EACN,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,OAAO,EACP,qBAAqB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EACV,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,kBAAkB,GACnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EACV,eAAe,EACf,QAAQ,EACR,UAAU,GACX,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACrD,YAAY,EACV,WAAW,EACX,qBAAqB,GACtB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,WAAW,EACX,UAAU,EACV,QAAQ,EACR,WAAW,GACZ,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EACL,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,8BAA8B,EAC9B,KAAK,EACL,MAAM,EACN,cAAc,EACd,kBAAkB,EAClB,oBAAoB,EACpB,eAAe,EACf,UAAU,EACV,YAAY,EACZ,OAAO,EACP,WAAW,GACZ,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAC/D,YAAY,EACV,KAAK,EACL,YAAY,EACZ,mBAAmB,GACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAAE,KAAK,eAAe,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAEhE,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,OAAO,GACR,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,eAAe,EACf,2BAA2B,EAC3B,YAAY,EACZ,kBAAkB,GACnB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,YAAY,EACV,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,iCAAiC,CAAC"}

package/dist/index.js

@@ -4,8 +4,8 @@
  * One root entry holds the whole surface: extension points must never
  * require knowing which internal layer owns them. Only genuine isolation
  * lives on a subpath — dev fakes (`/testing`), the codex app-server client
- * (`/codex`), the native keyring (`/keyring`), and machine-local config
- * storage (`/config`).
+ * (`/codex`), and machine-local config storage (`/config`). The OS keychain
+ * is not here at all: it belongs to `@alpacakit/core/keyring`.
  */
 export { BUILTIN_AGENT_ID, builtinAgentFactories, } from "./agents/builtin.js";
 export { claude, structuredQuotaMatcher, } from "./agents/claude.js";
@@ -14,7 +14,6 @@ export { PI_DEFAULT_CONTEXT_WINDOW, PI_DEFAULT_MAX_TOKENS, piSessionEngine, } fr
 export { openaiCompatible } from "./agents/openai-compatible.js";
 export { LOGIN_EVENT_TYPE, LOGIN_METHOD } from "./auth/login.js";
 export { AUTH_MATERIAL_KIND, AUTH_STATUS, createApiKeyProfile, createHomeDirProfile, envVarAuthMaterial, } from "./auth/material.js";
-export { fileProfileStore } from "./auth/profile-store.js";
 export { envResolver, requireSecret } from "./auth/secrets.js";
 export { CHILD_PROCESS_ABSENCE_PROOF, CHILD_PROCESS_TERMINATION_EVIDENCE_KIND, CHILD_PROCESS_TERMINATION_KIND, CHILD_PROCESS_TERMINATION_PHASE, CHILD_PROCESS_UNKILLABLE_REASON, } from "./core/controlled-process.js";
 export { applyEnvPatch, EMPTY_ENV_PATCH, mergeEnvPatches, processEnv, } from "./core/env.js";

package/dist/internal/controlled-process/host-controller.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"host-controller.d.ts","sourceRoot":"","sources":["../../../src/internal/controlled-process/host-controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EAErB,6BAA6B,EAC9B,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6BtE,OAAO,KAAK,EACV,uBAAuB,EAEvB,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAqC/B,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvD;AAsED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAoJtC;AAgnBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;CACrE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC"}
+{"version":3,"file":"host-controller.d.ts","sourceRoot":"","sources":["../../../src/internal/controlled-process/host-controller.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAEV,sBAAsB,EACtB,oBAAoB,EACpB,qBAAqB,EAErB,6BAA6B,EAC9B,MAAM,kCAAkC,CAAC;AAQ1C,OAAO,KAAK,EAAY,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AA6BtE,OAAO,KAAK,EACV,uBAAuB,EAEvB,uBAAuB,EACxB,MAAM,uBAAuB,CAAC;AAqC/B,MAAM,MAAM,4BAA4B,GAAG;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;IACrC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,qBAAqB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,uBAAuB,CAAC,CAAC;IACxD,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrD,kBAAkB,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;CACvD;AAsED,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAoJtC;AA6oBD,wBAAsB,wBAAwB,CAAC,KAAK,EAAE;IACpD,QAAQ,CAAC,QAAQ,EAAE,oBAAoB,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,qBAAqB,EAAE,kBAAkB,CAAC,CAAC;CACrE,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA4BzC"}

package/dist/internal/controlled-process/host-controller.js

@@ -366,7 +366,17 @@ async function requestTerminationBeforeDeadline(input) {
     if (raced.kind === "closed") {
         return null;
     }
-    if (raced.kind === "failure" || raced.kind === "deadline") {
+    if (raced.kind === "deadline") {
+        throw raced.error;
+    }
+    if (raced.kind === "failure") {
+        // A supervisor that rolled back before reporting its launch failure has
+        // already unlinked its socket, so this request can fail while its close is
+        // the only remaining evidence. Join that close within the same deadline;
+        // the caller still has to prove absence from the signed record.
+        if (await closedBeforeDeadline(input.supervisorClose, input.deadline)) {
+            return null;
+        }
         throw raced.error;
     }
     if (raced.response.kind !== SUPERVISOR_RESPONSE_KIND.termination) {
@@ -379,6 +389,18 @@ async function requestTerminationBeforeDeadline(input) {
         supervisorExit: null,
     };
 }
+function closedBeforeDeadline(supervisorClose, deadline) {
+    if (supervisorClose.didClose()) {
+        return Promise.resolve(true);
+    }
+    return new Promise((resolve) => {
+        const timeout = setTimeout(() => resolve(false), Math.max(0, deadline - Date.now()));
+        void supervisorClose.promise.then(() => {
+            clearTimeout(timeout);
+            resolve(true);
+        });
+    });
+}
 async function raceSupervisorRequestWithClose(input) {
     if (input.supervisorClose.didClose()) {
         return {

package/dist/internal/controlled-process/supervisor-runtime.js

@@ -238,7 +238,6 @@ async function runSupervisorSession(input) {
         shimControl = shim.stdio[SHIM_CONTROL_FD];
         shimStatus = shim.stdio[SHIM_STATUS_FD];
         shimInput = shim.stdio.at(SHIM_INPUT_FD);
-        shimInput.on("error", () => { });
         const pid = requireShimPid(shim);
         shimPid = pid;
         const record = {
@@ -701,9 +700,23 @@ function spawnShim(bootstrap) {
         env: {},
         stdio: ["ignore", "pipe", "pipe", "pipe", "pipe", "pipe"],
     });
+    containShimStdioErrors(shim);
     shim.once("error", () => { });
     return shim;
 }
+/**
+ * The supervisor owns every shim stdio error from spawn until the shim closes.
+ * Framed writes, status reads, and output pumps keep their own listeners and
+ * remain responsible for their outcomes; this owner only contains the pipe
+ * errors a dying shim raises once those operations have settled, so a late
+ * reset can never end supervisor custody before its failure is reported.
+ */
+function containShimStdioErrors(shim) {
+    for (const stream of shim.stdio) {
+        stream?.on("error", consumeShimStdioError);
+    }
+}
+function consumeShimStdioError() { }
 function waitForShimClose(shim) {
     return new Promise((resolve) => {
         shim.once("close", () => resolve());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alpacakit/agents",
-  "version": "0.1.0-beta.36",
+  "version": "0.1.0-beta.39",
   "description": "Run AI coding agents programmatically: execute, stream, classify failures, fail over.",
   "license": "MIT",
   "type": "module",
@@ -25,10 +25,6 @@
       "types": "./dist/codex/index.d.ts",
       "import": "./dist/codex/index.js"
     },
-    "./keyring": {
-      "types": "./dist/keyring/index.d.ts",
-      "import": "./dist/keyring/index.js"
-    },
     "./testing": {
       "types": "./dist/testing/index.d.ts",
       "import": "./dist/testing/index.js"
@@ -49,22 +45,18 @@
   },
   "dependencies": {
     "zod": "^4.3.6",
-    "@alpacakit/core": "0.1.0-beta.36"
+    "@alpacakit/core": "0.1.0-beta.39"
   },
   "devDependencies": {
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
-    "@earendil-works/pi-coding-agent": "0.75.5",
-    "@napi-rs/keyring": "^1.3.0"
+    "@earendil-works/pi-coding-agent": "0.75.5"
   },
   "peerDependenciesMeta": {
     "@earendil-works/pi-coding-agent": {
       "optional": true
-    },
-    "@napi-rs/keyring": {
-      "optional": true
     }
   },
   "scripts": {

package/dist/auth/profile-store.d.ts

@@ -1,14 +0,0 @@
-/**
- * Minimal file-backed profile store (A11): rows follow rule 2 and never
- * contain secret values (A9) — materials carry refs and paths only.
- * Profile management UX is consumer territory. Unlike fleet state, this
- * is durable user data: malformed or unknown-version files are typed
- * errors, never silent resets.
- */
-import { type AuthProfile } from "./material.js";
-export interface ProfileStore {
-    list(): Promise<AuthProfile[]>;
-    save(profiles: AuthProfile[]): Promise<void>;
-}
-export declare function fileProfileStore(filePath: string): ProfileStore;
-//# sourceMappingURL=profile-store.d.ts.map

package/dist/auth/profile-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"profile-store.d.ts","sourceRoot":"","sources":["../../src/auth/profile-store.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AAcrE,MAAM,WAAW,YAAY;IAC3B,IAAI,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9C;AA+FD,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAE/D"}

package/dist/auth/profile-store.js

@@ -1,102 +0,0 @@
-/**
- * Minimal file-backed profile store (A11): rows follow rule 2 and never
- * contain secret values (A9) — materials carry refs and paths only.
- * Profile management UX is consumer territory. Unlike fleet state, this
- * is durable user data: malformed or unknown-version files are typed
- * errors, never silent resets.
- */
-import { readFile } from "node:fs/promises";
-import { AGENT_ERROR_CODE, AgentError } from "../core/error.js";
-import { isErrnoCode, writeFileAtomically } from "../core/fs.js";
-import { readUnknownRecord } from "../core/json.js";
-import { TEXT_ENCODING } from "../core/values.js";
-import { AUTH_MATERIAL_KIND } from "./material.js";
-const PROFILE_FILE_VERSION = 1;
-const PROFILE_STORE_ERROR_REASON = {
-    unreadable: "unreadable file",
-    malformedJson: "malformed JSON",
-    rootMustBeObject: "root must be an object",
-    unsupportedVersion: "unsupported version",
-    invalidProfiles: "profiles must be auth profile records",
-};
-function profileStoreError(reason, cause) {
-    return new AgentError({
-        code: AGENT_ERROR_CODE.invalidInput,
-        classification: AgentError.agentFailure(AGENT_ERROR_CODE.invalidInput),
-        message: `Invalid auth profile store: ${reason}`,
-        data: { reason },
-        ...(cause === undefined ? {} : { cause }),
-    });
-}
-function isSecretRef(value) {
-    const record = readUnknownRecord(value);
-    if (record === null) {
-        return false;
-    }
-    const { resolver, id } = record;
-    return typeof resolver === "string" && typeof id === "string";
-}
-function isAuthProfile(value) {
-    const record = readUnknownRecord(value);
-    if (record === null) {
-        return false;
-    }
-    const { id, agentId, material: materialValue } = record;
-    const material = readUnknownRecord(materialValue);
-    if (material === null) {
-        return false;
-    }
-    const { kind, path, secret } = material;
-    const materialValid = (kind === AUTH_MATERIAL_KIND.homeDir && typeof path === "string") ||
-        (kind === AUTH_MATERIAL_KIND.apiKey && isSecretRef(secret));
-    return typeof id === "string" && typeof agentId === "string" && materialValid;
-}
-function parseProfileFile(raw) {
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (error) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.malformedJson, error);
-    }
-    const root = readUnknownRecord(parsed);
-    if (root === null) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.rootMustBeObject);
-    }
-    const { version, profiles } = root;
-    if (version !== PROFILE_FILE_VERSION) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.unsupportedVersion);
-    }
-    if (!Array.isArray(profiles) || !profiles.every(isAuthProfile)) {
-        throw profileStoreError(PROFILE_STORE_ERROR_REASON.invalidProfiles);
-    }
-    return profiles;
-}
-class FileProfileStore {
-    filePath;
-    constructor(filePath) {
-        this.filePath = filePath;
-    }
-    async list() {
-        let raw;
-        try {
-            raw = await readFile(this.filePath, TEXT_ENCODING);
-        }
-        catch (error) {
-            // Durable user data: only "not created yet" reads as empty; any
-            // other read failure surfaces instead of masking real profiles.
-            if (isErrnoCode(error, "ENOENT")) {
-                return [];
-            }
-            throw profileStoreError(PROFILE_STORE_ERROR_REASON.unreadable, error);
-        }
-        return parseProfileFile(raw);
-    }
-    async save(profiles) {
-        const file = { version: PROFILE_FILE_VERSION, profiles };
-        await writeFileAtomically(this.filePath, `${JSON.stringify(file, null, 2)}\n`);
-    }
-}
-export function fileProfileStore(filePath) {
-    return new FileProfileStore(filePath);
-}

package/dist/keyring/index.d.ts

@@ -1,2 +0,0 @@
-export { keyringResolver, type KeyringResolverOptions, } from "./resolver.js";
-//# sourceMappingURL=index.d.ts.map

package/dist/keyring/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/keyring/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,KAAK,sBAAsB,GAC5B,MAAM,eAAe,CAAC"}

package/dist/keyring/index.js

@@ -1 +0,0 @@
-export { keyringResolver, } from "./resolver.js";

package/dist/keyring/resolver.d.ts

@@ -1,9 +0,0 @@
-import type { SecretResolver } from "../core/ports.js";
-export type KeyringResolverOptions = {
-    readonly service: string;
-};
-type KeyringModuleLoader = () => Promise<unknown>;
-export declare function keyringResolver(options: KeyringResolverOptions): SecretResolver;
-export declare function createKeyringResolver(options: KeyringResolverOptions, loader: KeyringModuleLoader): SecretResolver;
-export {};
-//# sourceMappingURL=resolver.d.ts.map

package/dist/keyring/resolver.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../src/keyring/resolver.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,KAAK,mBAAmB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;AAiBlD,wBAAgB,eAAe,CAC7B,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAEhB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,EAC/B,MAAM,EAAE,mBAAmB,GAC1B,cAAc,CA4BhB"}

package/dist/keyring/resolver.js

@@ -1,64 +0,0 @@
-// biome-ignore-all lint/style/useNamingConvention: Keyring peer exports mirror upstream PascalCase names.
-import { AGENT_ERROR_CODE, AgentError, NOT_AVAILABLE_CAUSE, } from "../core/error.js";
-const KEYRING_PEER_PACKAGE = "@napi-rs/keyring";
-const KEYRING_ENTRY_EXPORT = "Entry";
-const EMPTY_SECRET_VALUE = "";
-const defaultKeyringModuleLoader = () => import(KEYRING_PEER_PACKAGE);
-export function keyringResolver(options) {
-    return createKeyringResolver(options, defaultKeyringModuleLoader);
-}
-export function createKeyringResolver(options, loader) {
-    const service = options.service;
-    let modulePromise = null;
-    const load = () => {
-        modulePromise ??= loadKeyringModule(loader);
-        return modulePromise;
-    };
-    return {
-        resolve: async (id) => {
-            const module = await load();
-            try {
-                // Absent entries are the `null` return (`Entry.getPassword():
-                // string | null` in @napi-rs/keyring); anything thrown is a real
-                // keychain failure, never "missing secret".
-                const value = await new module.Entry(service, id).getPassword();
-                return value === EMPTY_SECRET_VALUE ? null : value;
-            }
-            catch (error) {
-                throw new AgentError({
-                    code: AGENT_ERROR_CODE.failed,
-                    classification: AgentError.agentFailure(AGENT_ERROR_CODE.failed),
-                    message: `Keyring secret "${id}" could not be read`,
-                    data: { exitCode: null, stdoutTail: null, stderrTail: null },
-                    cause: error,
-                });
-            }
-        },
-    };
-}
-async function loadKeyringModule(loader) {
-    let loaded;
-    try {
-        loaded = await loader();
-    }
-    catch (error) {
-        throw keyringNotInstalledError(error);
-    }
-    if (typeof loaded !== "object" || loaded === null) {
-        throw keyringNotInstalledError(null);
-    }
-    const entry = Reflect.get(loaded, KEYRING_ENTRY_EXPORT);
-    if (typeof entry !== "function") {
-        throw keyringNotInstalledError(null);
-    }
-    return { Entry: entry };
-}
-function keyringNotInstalledError(cause) {
-    return new AgentError({
-        code: AGENT_ERROR_CODE.notAvailable,
-        classification: AgentError.agentFailure(AGENT_ERROR_CODE.notAvailable),
-        message: "Keyring peer is not installed",
-        data: { cause: NOT_AVAILABLE_CAUSE.notInstalled },
-        cause,
-    });
-}