@byok-sdk/client 0.12.0 → 0.14.0

package/dist/adapters/pi/events.d.ts

@@ -1,7 +1,7 @@
 import type { AgentEvent } from '@byok-sdk/protocol';
 import type { PiRpcMessage } from './rpc-client';
 /**
- * Map pi 0.84.2 RPC frames into BYOK's runtime-neutral event contract.
+ * Map pi 0.85.1 RPC frames into BYOK's runtime-neutral event contract.
  *
  * `agent_settled` is the only whole-task completion authority. `agent_end`
  * ends one low-level agent run, but pi may still perform retry/compaction or

package/dist/adapters/pi/pi-adapter.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderProfileBinding } from '@byok-sdk/protocol';
 import { type RuntimeAdapter, type RuntimeDetectResult, type RuntimeAdapterPrepareInput, type RuntimeAdapterPrepareResult } from '../../types';
 import { type ResolvedBin } from './resolve-bin';
 import { type ResolvedPiExtensions } from './resolve-extensions';
@@ -22,6 +23,8 @@ export interface PiAdapterOptions {
      * and transparently proxies the pinned Pi RPC process.
      */
     byokLauncher?: PiByokLauncherConfig;
+    /** Admission-time exact local profile check. Tests may replace the process boundary. */
+    validateProviderProfileBinding?: (binding: ProviderProfileBinding, launcher: PiByokLauncherConfig) => Promise<void>;
 }
 export interface PiByokLauncherConfig {
     command: string;

package/dist/adapters/pi/rpc-client.d.ts

@@ -18,6 +18,24 @@ export interface PiRpcClientOptions {
     cwd: string;
     env: NodeJS.ProcessEnv;
     spawnFn?: SpawnFn;
+    /** Explicit GUI-owned interaction lane; omission retains unattended cancellation. */
+    extensionUi?: {
+        mode: 'hold';
+        onRequest: (request: PiRpcMessage) => void;
+    };
+    /** Synchronous observation before command receipts resolve, for an owned relay. */
+    onFrame?: (frame: PiRpcMessage) => void;
+    /**
+     * DI seam scoped to ADOPTION only (`../process-tree.ts`'s
+     * `adoptOwnedProcessTree`), so the win32 job-object branch is exercisable
+     * from POSIX. Disposal keeps `process.platform` as its own authority — this
+     * must never silently reroute the taskkill sweep on a real host.
+     */
+    platform?: NodeJS.Platform;
+    /** DI seam for the win32 job-object backstop; see `../win32-job-object.ts`. */
+    jobObject?: {
+        assign(pid: number): Promise<void>;
+    };
 }
 /**
  * JSONL request/response + event-stream client for `pi --mode rpc`.
@@ -32,6 +50,7 @@ export interface PiRpcClientOptions {
  * response can overtake a slower in-flight command's response).
  */
 export declare class PiRpcClient {
+    private readonly options;
     private readonly child;
     private buffer;
     private nextId;
@@ -42,12 +61,23 @@ export declare class PiRpcClient {
     private readonly closedPromise;
     private resolveClosed;
     private disposalAttempt;
+    /** Resolves once this tree is backstopped (see `adoptOwnedProcessTree`); rejects with the adoption failure, having already terminated the tree. */
+    private readonly adopted;
+    /** Set before the fail-closed termination starts, so it — not the exit code of the kill we ourselves requested — becomes this client's exit error. */
+    private adoptionFailure;
     /** Bounded tail of recent stderr lines — pi discarded this entirely before (nothing ever read `child.stderr`), which is exactly why finding #1 (`Error: Unknown option: --session-id`, exit 1) had to be root-caused by hand instead of reading it off a thrown error. See `buildExitError`. */
     private readonly stderrRing;
     /** Count of pi RPC message types `PiSession` (pi-adapter.ts) has told us have no `AgentEvent` mapping and aren't routine bookkeeping — see `recordUnmappedFrame`. */
     private readonly unmappedFrameCounts;
     constructor(options: PiRpcClientOptions);
-    /** Send a command, resolved with its correlated `response` message. */
+    /**
+     * Send a command, resolved with its correlated `response` message.
+     *
+     * Adoption is awaited FIRST — this is `PiAdapter.start()`'s first awaited
+     * operation, so an unbackstopped tree never receives the initial prompt and
+     * never yields a session. The wait costs one settled-promise turn once the
+     * tree is adopted; every later command sees it already resolved.
+     */
     send(command: Record<string, unknown> & {
         type: string;
         id?: string;
@@ -77,8 +107,24 @@ export declare class PiRpcClient {
     waitClosed(): Promise<void>;
     dispose(): Promise<void>;
     private processTreeOptions;
+    /**
+     * Backstop this tree, or tear it down. Adoption failure is a start-time
+     * precondition, not a degraded mode: the child is terminated through the one
+     * disposal authority and the failure is re-thrown, which is what makes the
+     * first `send()` — and therefore `PiAdapter.start()` — fail before any
+     * session is published. Both cleanup attempts are best-effort because the
+     * adoption failure, not a terminator's own complaint, is the reason to report.
+     */
+    private adoptOwnedTree;
     private onData;
     private onLine;
+    /** Write an explicit host-owned response; completion is a transport receipt only. */
+    respondExtensionUi(response: {
+        id: string;
+        cancelled?: true;
+        confirmed?: boolean;
+        value?: string;
+    }): Promise<void>;
     /**
      * Answer pi's extension-UI blocking protocol headlessly (rpc.md's
      * "Extension UI Protocol"). Fail-closed policy, stated explicitly because

package/dist/adapters/pi/subagents-policy-extension.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer';
 
-// ../../node_modules/.bun/pi-subagents@0.60.0+ba57dcb6e433cb73/node_modules/pi-subagents/src/runs/shared/capability-ceiling.ts
+// ../../node_modules/.bun/pi-subagents@0.60.0+5c5e823a15db0d8e/node_modules/pi-subagents/src/runs/shared/capability-ceiling.ts
 var SUBAGENT_CAPABILITY_CEILING_VERSION = 1;
 var SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY = "pi-subagents.capability-ceiling.v1";
 function registry() {

package/dist/adapters/pi/subagents-policy-extension.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../node_modules/.bun/pi-subagents@0.60.0+ba57dcb6e433cb73/node_modules/pi-subagents/src/runs/shared/capability-ceiling.ts","../../../src/adapters/pi/subagents-policy-config.ts","../../../src/adapters/pi/subagents-policy-extension.ts"],"names":[],"mappings":";;;AAEO,IAAM,mCAAA,GAAsC,CAAA;AAC5C,IAAM,wCAAA,GAA2C,oCAAA;AA4CxD,SAAS,QAAA,GAAqB;AAC7B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,wCAAwC,CAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,UAAA;AACd,EAAA,MAAM,QAAA,GAAW,MAAM,GAAG,CAAA;AAC1B,EAAA,IAAI,QAAA,YAAoB,KAAK,OAAO,QAAA;AACpC,EAAA,MAAM,OAAA,uBAAwB,GAAA,EAAI;AAClC,EAAA,KAAA,CAAM,GAAG,CAAA,GAAI,OAAA;AACb,EAAA,OAAO,OAAA;AACR;AAEA,SAAS,YAAA,CAAa,OAAgB,KAAA,EAAuB;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,MAAU,wBAAA,CAAyB,IAAA,CAAK,KAAK,CAAA,IAAK,OAAO,UAAA,CAAW,KAAA,CAAM,MAAK,EAAG,MAAM,IAAI,GAAA,EAAK;AACxI,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,+EAAA,CAAiF,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,MAAM,IAAA,EAAK;AACnB;AAEA,SAAS,iBAAiB,OAAA,EAAuE;AAChG,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,iDAAiD,CAAA;AACxI,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,cAAc,CAAA;AAC7D,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,eAAe,CAAA;AAC/D,EAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,gBAAgB,CAAA;AACjE,EAAA,IAAI,CAAC,mBAAmB,CAAC,gBAAA,IAAoB,CAAC,iBAAA,EAAmB,MAAM,IAAI,KAAA,CAAM,sFAAsF,CAAA;AACvK,EAAA,IAAI,iBAAA,IAAqB,OAAO,OAAA,CAAQ,cAAA,KAAmB,WAAW,MAAM,IAAI,MAAM,gEAAgE,CAAA;AACtJ,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,EAAyC,OAAA,KAA0C;AACzG,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,KAAK,GAAG,OAAO,MAAA;AAC3C,IAAA,MAAM,MAAA,GAAS,QAAQ,KAAK,CAAA;AAC5B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,oBAAA,CAAsB,CAAA;AACrG,IAAA,IAAI,MAAA,CAAO,SAAS,GAAA,EAAK,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,6BAAA,CAA+B,CAAA;AAC3G,IAAA,OAAO,CAAC,GAAG,IAAI,IAAI,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,KAAU;AACxC,MAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,EAAO,CAAA,EAAG,KAAK,CAAA,MAAA,CAAQ,CAAA;AACjD,MAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,QAAA,EAAW,IAAI,CAAA,EAAA,CAAI,CAAA;AAC/F,MAAA,IAAI,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA,GAAI,GAAA,EAAK,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,QAAA,EAAW,IAAI,CAAA,uBAAA,CAAyB,CAAA;AACtI,MAAA,OAAO,IAAA;AAAA,IACR,CAAC,CAAC,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,EACX,CAAA;AACA,EAAA,MAAM,YAAA,GAAe,aAAA,CAAc,cAAA,EAAgB,qBAAqB,CAAA;AACxE,EAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,eAAA,EAAiB,qBAAqB,CAAA;AAC1E,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,mCAAA;AAAA,IACT,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,KAAiB,EAAC;AAAA,IACrD,GAAI,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,KAAkB,EAAC;AAAA,IACvD,cAAA,EAAgB,QAAQ,cAAA,KAAmB,IAAA;AAAA,IAC3C,SAAS;AAAC,GACX;AACD;AAaO,SAAS,kCAAkC,OAAA,EAAoF;AACrI,EAAA,MAAM,SAAA,GAAY,YAAA,CAAa,OAAA,CAAQ,SAAA,EAAW,WAAW,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AACpD,EAAA,IAAI,UAAA,GAAa,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAM,CAAA;AAC3B,EAAA,MAAM,QAAQ,QAAA,EAAS;AACvB,EAAA,IAAI,OAAA,GAAU,KAAA,CAAM,GAAA,CAAI,SAAS,CAAA;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AACb,IAAA,OAAA,uBAAc,GAAA,EAAI;AAClB,IAAA,KAAA,CAAM,GAAA,CAAI,WAAW,OAAO,CAAA;AAAA,EAC7B;AACA,EAAA,MAAM,kBAAkB,MAAM;AAC7B,IAAA,UAAA,GAAa,iBAAiB,UAAU,CAAA;AACxC,IAAA,UAAA,CAAW,OAAA,GAAU,CAAC,MAAM,CAAA;AAC5B,IAAA,OAAA,CAAS,IAAI,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EACpD,CAAA;AACA,EAAA,eAAA,EAAgB;AAChB,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACN,OAAO,OAAA,EAAS;AACf,MAAA,IAAI,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,qDAAqD,CAAA;AACnF,MAAA,UAAA,GAAa,iBAAiB,OAAO,CAAA;AACrC,MAAA,UAAA,CAAW,OAAA,GAAU,CAAC,MAAM,CAAA;AAC5B,MAAA,OAAA,CAAS,IAAI,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,IACpD,CAAA;AAAA,IACA,OAAA,GAAU;AACT,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,OAAA,CAAS,OAAO,KAAK,CAAA;AACrB,MAAA,IAAI,OAAA,CAAS,IAAA,KAAS,CAAA,EAAG,KAAA,CAAM,OAAO,SAAS,CAAA;AAAA,IAChD;AAAA,GACD;AACD;;;ACzIO,IAAM,uBAAA,GAA0B,yBAAA;AAMhC,IAAM,+BAAA,GAAkC,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAGrE,IAAM,gCAAA,GAAmC;AAAA,EAC9C,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;;;ACJA,SAAS,cAAA,GAAsC;AAC7C,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAChD,EAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AACnD,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,uBAAuB,CAAA,6BAAA,CAA+B,CAAA;AAC3E;AAMe,SAAR,4BAA6C,EAAA,EAAwB;AAC1E,EAAA,MAAM,OAAO,cAAA,EAAe;AAC5B,EAAA,IAAI,OAAA;AAEJ,EAAA,EAAA,CAAG,EAAA,CAAG,eAAA,EAAiB,CAAC,MAAA,EAAQ,GAAA,KAAQ;AACtC,IAAA,OAAA,EAAS,OAAA,EAAQ;AACjB,IAAA,OAAA,GAAU,MAAA;AACV,IAAA,IAAI,SAAS,MAAA,EAAQ;AAErB,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,cAAA,CAAe,YAAA,EAAa;AAClD,IAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAClG,IAAA,OAAA,GAAU,iCAAA,CAAkC;AAAA,MAC1C,SAAA;AAAA,MACA,MAAA,EAAQ,mBAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,YAAA,EAAc,+BAAA;AAAA,QACd,aAAA,EAAe,gCAAA;AAAA,QACf,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,WAAA,EAAa,CAAC,KAAA,KAAU;AAC5B,IAAA,IAAI,SAAS,UAAA,IAAc,KAAA,CAAM,QAAA,KAAa,UAAA,IAAc,YAAY,MAAA,EAAW;AACjF,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,oBAAoB,MAAM;AAC9B,IAAA,OAAA,EAAS,OAAA,EAAQ;AACjB,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ,CAAC,CAAA;AACH","file":"subagents-policy-extension.js","sourcesContent":["import { Buffer } from \"node:buffer\";\n\nexport const SUBAGENT_CAPABILITY_CEILING_VERSION = 1 as const;\nexport const SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY = \"pi-subagents.capability-ceiling.v1\";\nexport const SUBAGENT_CAPABILITY_CEILING_ENV = \"PI_SUBAGENT_CAPABILITY_CEILING_V1\";\n\nexport type SubagentCapabilityCeiling =\n\t| { allowedTools: readonly string[]; allowedAgents?: readonly string[]; denyExtensions?: boolean }\n\t| { allowedTools?: readonly string[]; allowedAgents?: readonly string[]; denyExtensions: boolean }\n\t| { allowedTools?: readonly string[]; allowedAgents: readonly string[]; denyExtensions?: boolean };\n\nexport interface ResolvedSubagentCapabilityCeiling {\n\tversion: typeof SUBAGENT_CAPABILITY_CEILING_VERSION;\n\tallowedTools?: string[];\n\tallowedAgents?: string[];\n\tdenyExtensions: boolean;\n\tsources: string[];\n}\n\nexport interface SubagentCapabilityAudit {\n\tceiling: ResolvedSubagentCapabilityCeiling;\n\trequestedTools?: string[];\n\teffectiveTools: string[];\n\tremovedTools: string[];\n\tinternalTools: string[];\n\textensionsDenied: boolean;\n\tremovedExtensionCount: number;\n\trequestedMcpToolCount: number;\n\teffectiveMcpTools: string[];\n\tagentAllowed: boolean;\n\tagentRestrictionSources?: string[];\n}\n\nexport interface RegisterSubagentCapabilityCeilingOptions {\n\tsessionId: string;\n\tsource: string;\n\tceiling: SubagentCapabilityCeiling;\n}\n\nexport interface SubagentCapabilityCeilingHandle {\n\tupdate(ceiling: SubagentCapabilityCeiling): void;\n\tdispose(): void;\n}\n\ntype Registration = { source: string; ceiling: ResolvedSubagentCapabilityCeiling };\ntype Registry = Map<string, Map<symbol, Registration>>;\n\nfunction registry(): Registry {\n\tconst key = Symbol.for(SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY);\n\tconst store = globalThis as typeof globalThis & { [key: symbol]: unknown };\n\tconst existing = store[key];\n\tif (existing instanceof Map) return existing as Registry;\n\tconst created: Registry = new Map();\n\tstore[key] = created;\n\treturn created;\n}\n\nfunction validateText(value: unknown, field: string): string {\n\tif (typeof value !== \"string\" || !value.trim() || /[\\u0000-\\u001f\\u007f]/u.test(value) || Buffer.byteLength(value.trim(), \"utf8\") > 256) {\n\t\tthrow new Error(`Invalid capability ceiling ${field}; expected a non-empty string without control characters (max 256 UTF-8 bytes).`);\n\t}\n\treturn value.trim();\n}\n\nfunction normalizeCeiling(ceiling: SubagentCapabilityCeiling): ResolvedSubagentCapabilityCeiling {\n\tif (!ceiling || typeof ceiling !== \"object\" || Array.isArray(ceiling)) throw new Error(\"Invalid capability ceiling; expected an object.\");\n\tconst hasAllowedTools = Object.hasOwn(ceiling, \"allowedTools\");\n\tconst hasAllowedAgents = Object.hasOwn(ceiling, \"allowedAgents\");\n\tconst hasDenyExtensions = Object.hasOwn(ceiling, \"denyExtensions\");\n\tif (!hasAllowedTools && !hasAllowedAgents && !hasDenyExtensions) throw new Error(\"Invalid capability ceiling; expected allowedTools, allowedAgents, or denyExtensions.\");\n\tif (hasDenyExtensions && typeof ceiling.denyExtensions !== \"boolean\") throw new Error(\"Invalid capability ceiling denyExtensions; expected a boolean.\");\n\tconst normalizeList = (field: \"allowedTools\" | \"allowedAgents\", pattern: RegExp): string[] | undefined => {\n\t\tif (!Object.hasOwn(ceiling, field)) return undefined;\n\t\tconst values = ceiling[field];\n\t\tif (!Array.isArray(values)) throw new Error(`Invalid capability ceiling ${field}; expected an array.`);\n\t\tif (values.length > 256) throw new Error(`Invalid capability ceiling ${field}; expected at most 256 names.`);\n\t\treturn [...new Set(values.map((entry) => {\n\t\t\tconst name = validateText(entry, `${field} entry`);\n\t\t\tif (!pattern.test(name)) throw new Error(`Invalid capability ceiling ${field} entry '${name}'.`);\n\t\t\tif (Buffer.byteLength(name, \"utf8\") > 128) throw new Error(`Invalid capability ceiling ${field} entry '${name}'; max 128 UTF-8 bytes.`);\n\t\t\treturn name;\n\t\t}))].sort();\n\t};\n\tconst allowedTools = normalizeList(\"allowedTools\", /^[A-Za-z0-9_.:-]+$/u);\n\tconst allowedAgents = normalizeList(\"allowedAgents\", /^[A-Za-z0-9_.:-]+$/u);\n\treturn {\n\t\tversion: SUBAGENT_CAPABILITY_CEILING_VERSION,\n\t\t...(allowedTools !== undefined ? { allowedTools } : {}),\n\t\t...(allowedAgents !== undefined ? { allowedAgents } : {}),\n\t\tdenyExtensions: ceiling.denyExtensions === true,\n\t\tsources: [],\n\t};\n}\n\nexport function parseSubagentCapabilityCeiling(value: unknown, field = \"capability ceiling\"): ResolvedSubagentCapabilityCeiling {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`Invalid ${field}; expected an object.`);\n\tconst record = value as Record<string, unknown>;\n\tif (record.version !== SUBAGENT_CAPABILITY_CEILING_VERSION) throw new Error(`Invalid ${field} version.`);\n\tconst normalized = normalizeCeiling(record as SubagentCapabilityCeiling);\n\tconst sources = record.sources;\n\tif (!Array.isArray(sources) || sources.some((source) => typeof source !== \"string\")) throw new Error(`Invalid ${field} sources; expected an array of strings.`);\n\tnormalized.sources = [...new Set(sources.map((source) => validateText(source, `${field} source`)))].sort();\n\treturn normalized;\n}\n\nexport function registerSubagentCapabilityCeiling(options: RegisterSubagentCapabilityCeilingOptions): SubagentCapabilityCeilingHandle {\n\tconst sessionId = validateText(options.sessionId, \"sessionId\");\n\tconst source = validateText(options.source, \"source\");\n\tlet normalized = normalizeCeiling(options.ceiling);\n\tconst token = Symbol(source);\n\tconst store = registry();\n\tlet session = store.get(sessionId);\n\tif (!session) {\n\t\tsession = new Map();\n\t\tstore.set(sessionId, session);\n\t}\n\tconst setRegistration = () => {\n\t\tnormalized = normalizeCeiling(normalized);\n\t\tnormalized.sources = [source];\n\t\tsession!.set(token, { source, ceiling: normalized });\n\t};\n\tsetRegistration();\n\tlet disposed = false;\n\treturn {\n\t\tupdate(ceiling) {\n\t\t\tif (disposed) throw new Error(\"Cannot update a disposed capability ceiling handle.\");\n\t\t\tnormalized = normalizeCeiling(ceiling);\n\t\t\tnormalized.sources = [source];\n\t\t\tsession!.set(token, { source, ceiling: normalized });\n\t\t},\n\t\tdispose() {\n\t\t\tif (disposed) return;\n\t\t\tdisposed = true;\n\t\t\tsession!.delete(token);\n\t\t\tif (session!.size === 0) store.delete(sessionId);\n\t\t},\n\t};\n}\n\nexport function intersectSubagentCapabilityCeilings(...ceilings: Array<ResolvedSubagentCapabilityCeiling | undefined>): ResolvedSubagentCapabilityCeiling | undefined {\n\tconst active = ceilings.filter((ceiling): ceiling is ResolvedSubagentCapabilityCeiling => ceiling !== undefined);\n\tif (active.length === 0) return undefined;\n\tconst intersectLists = (field: \"allowedTools\" | \"allowedAgents\"): string[] | undefined => {\n\t\tconst definedLists = active.filter((ceiling) => ceiling[field] !== undefined).map((ceiling) => new Set(ceiling[field]));\n\t\tif (definedLists.length === 0) return undefined;\n\t\treturn [...definedLists[0]!].filter((entry) => definedLists.every((list) => list.has(entry))).sort();\n\t};\n\tconst allowedTools = intersectLists(\"allowedTools\");\n\tconst allowedAgents = intersectLists(\"allowedAgents\");\n\treturn {\n\t\tversion: SUBAGENT_CAPABILITY_CEILING_VERSION,\n\t\t...(allowedTools !== undefined ? { allowedTools } : {}),\n\t\t...(allowedAgents !== undefined ? { allowedAgents } : {}),\n\t\tdenyExtensions: active.some((ceiling) => ceiling.denyExtensions),\n\t\tsources: [...new Set(active.flatMap((ceiling) => ceiling.sources))].sort(),\n\t};\n}\n\nexport function resolveSubagentCapabilityCeiling(sessionId: string | undefined, inherited?: ResolvedSubagentCapabilityCeiling): ResolvedSubagentCapabilityCeiling | undefined {\n\tconst active: ResolvedSubagentCapabilityCeiling[] = [];\n\tif (sessionId) {\n\t\tconst registrations = registry().get(sessionId);\n\t\tif (registrations) active.push(...Array.from(registrations.values(), ({ ceiling }) => ceiling));\n\t}\n\treturn intersectSubagentCapabilityCeilings(inherited, ...active);\n}\n\nexport function resolveCurrentSubagentCapabilityCeiling(sessionId: string | undefined): ResolvedSubagentCapabilityCeiling | undefined {\n\treturn resolveSubagentCapabilityCeiling(sessionId, decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]));\n}\n\nexport function isAgentAllowedByCapabilityCeiling(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): boolean {\n\treturn ceiling?.allowedAgents === undefined || ceiling.allowedAgents.includes(agentName);\n}\n\nexport function capabilityCeilingAgentRestrictionMessage(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): string | undefined {\n\tif (isAgentAllowedByCapabilityCeiling(agentName, ceiling)) return undefined;\n\tconst sources = ceiling?.sources.length ? ceiling.sources.join(\", \") : \"unknown source\";\n\tconst allowed = ceiling?.allowedAgents?.length ? ceiling.allowedAgents.join(\", \") : \"(none)\";\n\treturn `Capability ceiling from ${sources} does not allow agent '${agentName}'. Allowed agents: ${allowed}.`;\n}\n\nexport function assertAgentAllowedByCapabilityCeiling(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): void {\n\tconst message = capabilityCeilingAgentRestrictionMessage(agentName, ceiling);\n\tif (message) throw new Error(message);\n}\n\nexport function capabilityCeilingAgentRestrictionSources(ceiling: ResolvedSubagentCapabilityCeiling | undefined): string[] | undefined {\n\treturn ceiling?.allowedAgents === undefined ? undefined : [...ceiling.sources];\n}\n\nexport function encodeSubagentCapabilityCeiling(ceiling: ResolvedSubagentCapabilityCeiling | undefined): string | undefined {\n\tif (!ceiling) return undefined;\n\treturn Buffer.from(JSON.stringify(ceiling), \"utf8\").toString(\"base64url\");\n}\n\nexport function decodeSubagentCapabilityCeiling(value: string | undefined): ResolvedSubagentCapabilityCeiling | undefined {\n\tif (value === undefined || value === \"\") return undefined;\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\"));\n\t} catch (error) {\n\t\tthrow new Error(`Invalid inherited capability ceiling: ${error instanceof Error ? error.message : String(error)}`);\n\t}\n\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed) || (parsed as { version?: unknown }).version !== SUBAGENT_CAPABILITY_CEILING_VERSION) {\n\t\tthrow new Error(\"Invalid inherited capability ceiling version.\");\n\t}\n\treturn parseSubagentCapabilityCeiling(parsed, \"inherited capability ceiling\");\n}\n","export const BYOK_PI_PERMISSION_MODE = 'BYOK_PI_PERMISSION_MODE';\n\n/** SDK-owned extension tools that do not mutate the task workspace. */\nexport const BYOK_PI_READONLY_PARENT_TOOLS = ['subagent', 'todo'] as const;\n\n/** Child tools retained when a readonly parent delegates through pi-subagents. */\nexport const BYOK_PI_READONLY_SUBAGENT_TOOLS = ['read', 'grep', 'find', 'ls'] as const;\n\n/** Package-provided read-only roles; writer and ambient custom roles stay unavailable. */\nexport const BYOK_PI_READONLY_SUBAGENT_AGENTS = [\n  'reviewer',\n  'oracle',\n  'codex-exec',\n  'claude-code',\n  'cursor-agent',\n] as const;\n","import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';\nimport {\n  registerSubagentCapabilityCeiling,\n  type SubagentCapabilityCeilingHandle,\n} from 'pi-subagents/capability-ceiling';\nimport {\n  BYOK_PI_PERMISSION_MODE,\n  BYOK_PI_READONLY_SUBAGENT_AGENTS,\n  BYOK_PI_READONLY_SUBAGENT_TOOLS,\n} from './subagents-policy-config';\n\nfunction permissionMode(): 'auto' | 'readonly' {\n  const mode = process.env[BYOK_PI_PERMISSION_MODE];\n  if (mode === 'auto' || mode === 'readonly') return mode;\n  throw new Error(`${BYOK_PI_PERMISSION_MODE} must be \"auto\" or \"readonly\"`);\n}\n\n/**\n * Keep pi-subagents available in every Pi session without letting a readonly\n * parent widen its task contract through a child process.\n */\nexport default function registerByokSubagentsPolicy(pi: ExtensionAPI): void {\n  const mode = permissionMode();\n  let ceiling: SubagentCapabilityCeilingHandle | undefined;\n\n  pi.on('session_start', (_event, ctx) => {\n    ceiling?.dispose();\n    ceiling = undefined;\n    if (mode === 'auto') return;\n\n    const sessionId = ctx.sessionManager.getSessionId();\n    if (!sessionId) throw new Error('readonly Pi subagent policy requires an authoritative session id');\n    ceiling = registerSubagentCapabilityCeiling({\n      sessionId,\n      source: 'byok-sdk-readonly',\n      ceiling: {\n        allowedTools: BYOK_PI_READONLY_SUBAGENT_TOOLS,\n        allowedAgents: BYOK_PI_READONLY_SUBAGENT_AGENTS,\n        denyExtensions: true,\n      },\n    });\n  });\n\n  pi.on('tool_call', (event) => {\n    if (mode === 'readonly' && event.toolName === 'subagent' && ceiling === undefined) {\n      return {\n        block: true,\n        terminate: true,\n        reason: 'readonly Pi subagent capability ceiling is unavailable',\n      };\n    }\n  });\n\n  pi.on('session_shutdown', () => {\n    ceiling?.dispose();\n    ceiling = undefined;\n  });\n}\n"]}
+{"version":3,"sources":["../../../../../node_modules/.bun/pi-subagents@0.60.0+5c5e823a15db0d8e/node_modules/pi-subagents/src/runs/shared/capability-ceiling.ts","../../../src/adapters/pi/subagents-policy-config.ts","../../../src/adapters/pi/subagents-policy-extension.ts"],"names":[],"mappings":";;;AAEO,IAAM,mCAAA,GAAsC,CAAA;AAC5C,IAAM,wCAAA,GAA2C,oCAAA;AA4CxD,SAAS,QAAA,GAAqB;AAC7B,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,GAAA,CAAI,wCAAwC,CAAA;AAC/D,EAAA,MAAM,KAAA,GAAQ,UAAA;AACd,EAAA,MAAM,QAAA,GAAW,MAAM,GAAG,CAAA;AAC1B,EAAA,IAAI,QAAA,YAAoB,KAAK,OAAO,QAAA;AACpC,EAAA,MAAM,OAAA,uBAAwB,GAAA,EAAI;AAClC,EAAA,KAAA,CAAM,GAAG,CAAA,GAAI,OAAA;AACb,EAAA,OAAO,OAAA;AACR;AAEA,SAAS,YAAA,CAAa,OAAgB,KAAA,EAAuB;AAC5D,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,CAAC,KAAA,CAAM,IAAA,MAAU,wBAAA,CAAyB,IAAA,CAAK,KAAK,CAAA,IAAK,OAAO,UAAA,CAAW,KAAA,CAAM,MAAK,EAAG,MAAM,IAAI,GAAA,EAAK;AACxI,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,+EAAA,CAAiF,CAAA;AAAA,EACrI;AACA,EAAA,OAAO,MAAM,IAAA,EAAK;AACnB;AAEA,SAAS,iBAAiB,OAAA,EAAuE;AAChG,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,QAAA,IAAY,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,iDAAiD,CAAA;AACxI,EAAA,MAAM,eAAA,GAAkB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,cAAc,CAAA;AAC7D,EAAA,MAAM,gBAAA,GAAmB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,eAAe,CAAA;AAC/D,EAAA,MAAM,iBAAA,GAAoB,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,gBAAgB,CAAA;AACjE,EAAA,IAAI,CAAC,mBAAmB,CAAC,gBAAA,IAAoB,CAAC,iBAAA,EAAmB,MAAM,IAAI,KAAA,CAAM,sFAAsF,CAAA;AACvK,EAAA,IAAI,iBAAA,IAAqB,OAAO,OAAA,CAAQ,cAAA,KAAmB,WAAW,MAAM,IAAI,MAAM,gEAAgE,CAAA;AACtJ,EAAA,MAAM,aAAA,GAAgB,CAAC,KAAA,EAAyC,OAAA,KAA0C;AACzG,IAAA,IAAI,CAAC,MAAA,CAAO,MAAA,CAAO,OAAA,EAAS,KAAK,GAAG,OAAO,MAAA;AAC3C,IAAA,MAAM,MAAA,GAAS,QAAQ,KAAK,CAAA;AAC5B,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,QAAS,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,oBAAA,CAAsB,CAAA;AACrG,IAAA,IAAI,MAAA,CAAO,SAAS,GAAA,EAAK,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,6BAAA,CAA+B,CAAA;AAC3G,IAAA,OAAO,CAAC,GAAG,IAAI,IAAI,MAAA,CAAO,GAAA,CAAI,CAAC,KAAA,KAAU;AACxC,MAAA,MAAM,IAAA,GAAO,YAAA,CAAa,KAAA,EAAO,CAAA,EAAG,KAAK,CAAA,MAAA,CAAQ,CAAA;AACjD,MAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,QAAA,EAAW,IAAI,CAAA,EAAA,CAAI,CAAA;AAC/F,MAAA,IAAI,MAAA,CAAO,UAAA,CAAW,IAAA,EAAM,MAAM,CAAA,GAAI,GAAA,EAAK,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,KAAK,CAAA,QAAA,EAAW,IAAI,CAAA,uBAAA,CAAyB,CAAA;AACtI,MAAA,OAAO,IAAA;AAAA,IACR,CAAC,CAAC,CAAC,CAAA,CAAE,IAAA,EAAK;AAAA,EACX,CAAA;AACA,EAAA,MAAM,YAAA,GAAe,aAAA,CAAc,cAAA,EAAgB,qBAAqB,CAAA;AACxE,EAAA,MAAM,aAAA,GAAgB,aAAA,CAAc,eAAA,EAAiB,qBAAqB,CAAA;AAC1E,EAAA,OAAO;AAAA,IACN,OAAA,EAAS,mCAAA;AAAA,IACT,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAE,YAAA,KAAiB,EAAC;AAAA,IACrD,GAAI,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,KAAkB,EAAC;AAAA,IACvD,cAAA,EAAgB,QAAQ,cAAA,KAAmB,IAAA;AAAA,IAC3C,SAAS;AAAC,GACX;AACD;AAaO,SAAS,kCAAkC,OAAA,EAAoF;AACrI,EAAA,MAAM,SAAA,GAAY,YAAA,CAAa,OAAA,CAAQ,SAAA,EAAW,WAAW,CAAA;AAC7D,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,OAAA,CAAQ,MAAA,EAAQ,QAAQ,CAAA;AACpD,EAAA,IAAI,UAAA,GAAa,gBAAA,CAAiB,OAAA,CAAQ,OAAO,CAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,OAAO,MAAM,CAAA;AAC3B,EAAA,MAAM,QAAQ,QAAA,EAAS;AACvB,EAAA,IAAI,OAAA,GAAU,KAAA,CAAM,GAAA,CAAI,SAAS,CAAA;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AACb,IAAA,OAAA,uBAAc,GAAA,EAAI;AAClB,IAAA,KAAA,CAAM,GAAA,CAAI,WAAW,OAAO,CAAA;AAAA,EAC7B;AACA,EAAA,MAAM,kBAAkB,MAAM;AAC7B,IAAA,UAAA,GAAa,iBAAiB,UAAU,CAAA;AACxC,IAAA,UAAA,CAAW,OAAA,GAAU,CAAC,MAAM,CAAA;AAC5B,IAAA,OAAA,CAAS,IAAI,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,EACpD,CAAA;AACA,EAAA,eAAA,EAAgB;AAChB,EAAA,IAAI,QAAA,GAAW,KAAA;AACf,EAAA,OAAO;AAAA,IACN,OAAO,OAAA,EAAS;AACf,MAAA,IAAI,QAAA,EAAU,MAAM,IAAI,KAAA,CAAM,qDAAqD,CAAA;AACnF,MAAA,UAAA,GAAa,iBAAiB,OAAO,CAAA;AACrC,MAAA,UAAA,CAAW,OAAA,GAAU,CAAC,MAAM,CAAA;AAC5B,MAAA,OAAA,CAAS,IAAI,KAAA,EAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,YAAY,CAAA;AAAA,IACpD,CAAA;AAAA,IACA,OAAA,GAAU;AACT,MAAA,IAAI,QAAA,EAAU;AACd,MAAA,QAAA,GAAW,IAAA;AACX,MAAA,OAAA,CAAS,OAAO,KAAK,CAAA;AACrB,MAAA,IAAI,OAAA,CAAS,IAAA,KAAS,CAAA,EAAG,KAAA,CAAM,OAAO,SAAS,CAAA;AAAA,IAChD;AAAA,GACD;AACD;;;ACzIO,IAAM,uBAAA,GAA0B,yBAAA;AAMhC,IAAM,+BAAA,GAAkC,CAAC,MAAA,EAAQ,MAAA,EAAQ,QAAQ,IAAI,CAAA;AAGrE,IAAM,gCAAA,GAAmC;AAAA,EAC9C,UAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,aAAA;AAAA,EACA;AACF,CAAA;;;ACJA,SAAS,cAAA,GAAsC;AAC7C,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,GAAA,CAAI,uBAAuB,CAAA;AAChD,EAAA,IAAI,IAAA,KAAS,MAAA,IAAU,IAAA,KAAS,UAAA,EAAY,OAAO,IAAA;AACnD,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,uBAAuB,CAAA,6BAAA,CAA+B,CAAA;AAC3E;AAMe,SAAR,4BAA6C,EAAA,EAAwB;AAC1E,EAAA,MAAM,OAAO,cAAA,EAAe;AAC5B,EAAA,IAAI,OAAA;AAEJ,EAAA,EAAA,CAAG,EAAA,CAAG,eAAA,EAAiB,CAAC,MAAA,EAAQ,GAAA,KAAQ;AACtC,IAAA,OAAA,EAAS,OAAA,EAAQ;AACjB,IAAA,OAAA,GAAU,MAAA;AACV,IAAA,IAAI,SAAS,MAAA,EAAQ;AAErB,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,cAAA,CAAe,YAAA,EAAa;AAClD,IAAA,IAAI,CAAC,SAAA,EAAW,MAAM,IAAI,MAAM,kEAAkE,CAAA;AAClG,IAAA,OAAA,GAAU,iCAAA,CAAkC;AAAA,MAC1C,SAAA;AAAA,MACA,MAAA,EAAQ,mBAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,YAAA,EAAc,+BAAA;AAAA,QACd,aAAA,EAAe,gCAAA;AAAA,QACf,cAAA,EAAgB;AAAA;AAClB,KACD,CAAA;AAAA,EACH,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,WAAA,EAAa,CAAC,KAAA,KAAU;AAC5B,IAAA,IAAI,SAAS,UAAA,IAAc,KAAA,CAAM,QAAA,KAAa,UAAA,IAAc,YAAY,MAAA,EAAW;AACjF,MAAA,OAAO;AAAA,QACL,KAAA,EAAO,IAAA;AAAA,QACP,SAAA,EAAW,IAAA;AAAA,QACX,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF,CAAC,CAAA;AAED,EAAA,EAAA,CAAG,EAAA,CAAG,oBAAoB,MAAM;AAC9B,IAAA,OAAA,EAAS,OAAA,EAAQ;AACjB,IAAA,OAAA,GAAU,MAAA;AAAA,EACZ,CAAC,CAAA;AACH","file":"subagents-policy-extension.js","sourcesContent":["import { Buffer } from \"node:buffer\";\n\nexport const SUBAGENT_CAPABILITY_CEILING_VERSION = 1 as const;\nexport const SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY = \"pi-subagents.capability-ceiling.v1\";\nexport const SUBAGENT_CAPABILITY_CEILING_ENV = \"PI_SUBAGENT_CAPABILITY_CEILING_V1\";\n\nexport type SubagentCapabilityCeiling =\n\t| { allowedTools: readonly string[]; allowedAgents?: readonly string[]; denyExtensions?: boolean }\n\t| { allowedTools?: readonly string[]; allowedAgents?: readonly string[]; denyExtensions: boolean }\n\t| { allowedTools?: readonly string[]; allowedAgents: readonly string[]; denyExtensions?: boolean };\n\nexport interface ResolvedSubagentCapabilityCeiling {\n\tversion: typeof SUBAGENT_CAPABILITY_CEILING_VERSION;\n\tallowedTools?: string[];\n\tallowedAgents?: string[];\n\tdenyExtensions: boolean;\n\tsources: string[];\n}\n\nexport interface SubagentCapabilityAudit {\n\tceiling: ResolvedSubagentCapabilityCeiling;\n\trequestedTools?: string[];\n\teffectiveTools: string[];\n\tremovedTools: string[];\n\tinternalTools: string[];\n\textensionsDenied: boolean;\n\tremovedExtensionCount: number;\n\trequestedMcpToolCount: number;\n\teffectiveMcpTools: string[];\n\tagentAllowed: boolean;\n\tagentRestrictionSources?: string[];\n}\n\nexport interface RegisterSubagentCapabilityCeilingOptions {\n\tsessionId: string;\n\tsource: string;\n\tceiling: SubagentCapabilityCeiling;\n}\n\nexport interface SubagentCapabilityCeilingHandle {\n\tupdate(ceiling: SubagentCapabilityCeiling): void;\n\tdispose(): void;\n}\n\ntype Registration = { source: string; ceiling: ResolvedSubagentCapabilityCeiling };\ntype Registry = Map<string, Map<symbol, Registration>>;\n\nfunction registry(): Registry {\n\tconst key = Symbol.for(SUBAGENT_CAPABILITY_CEILING_REGISTRY_KEY);\n\tconst store = globalThis as typeof globalThis & { [key: symbol]: unknown };\n\tconst existing = store[key];\n\tif (existing instanceof Map) return existing as Registry;\n\tconst created: Registry = new Map();\n\tstore[key] = created;\n\treturn created;\n}\n\nfunction validateText(value: unknown, field: string): string {\n\tif (typeof value !== \"string\" || !value.trim() || /[\\u0000-\\u001f\\u007f]/u.test(value) || Buffer.byteLength(value.trim(), \"utf8\") > 256) {\n\t\tthrow new Error(`Invalid capability ceiling ${field}; expected a non-empty string without control characters (max 256 UTF-8 bytes).`);\n\t}\n\treturn value.trim();\n}\n\nfunction normalizeCeiling(ceiling: SubagentCapabilityCeiling): ResolvedSubagentCapabilityCeiling {\n\tif (!ceiling || typeof ceiling !== \"object\" || Array.isArray(ceiling)) throw new Error(\"Invalid capability ceiling; expected an object.\");\n\tconst hasAllowedTools = Object.hasOwn(ceiling, \"allowedTools\");\n\tconst hasAllowedAgents = Object.hasOwn(ceiling, \"allowedAgents\");\n\tconst hasDenyExtensions = Object.hasOwn(ceiling, \"denyExtensions\");\n\tif (!hasAllowedTools && !hasAllowedAgents && !hasDenyExtensions) throw new Error(\"Invalid capability ceiling; expected allowedTools, allowedAgents, or denyExtensions.\");\n\tif (hasDenyExtensions && typeof ceiling.denyExtensions !== \"boolean\") throw new Error(\"Invalid capability ceiling denyExtensions; expected a boolean.\");\n\tconst normalizeList = (field: \"allowedTools\" | \"allowedAgents\", pattern: RegExp): string[] | undefined => {\n\t\tif (!Object.hasOwn(ceiling, field)) return undefined;\n\t\tconst values = ceiling[field];\n\t\tif (!Array.isArray(values)) throw new Error(`Invalid capability ceiling ${field}; expected an array.`);\n\t\tif (values.length > 256) throw new Error(`Invalid capability ceiling ${field}; expected at most 256 names.`);\n\t\treturn [...new Set(values.map((entry) => {\n\t\t\tconst name = validateText(entry, `${field} entry`);\n\t\t\tif (!pattern.test(name)) throw new Error(`Invalid capability ceiling ${field} entry '${name}'.`);\n\t\t\tif (Buffer.byteLength(name, \"utf8\") > 128) throw new Error(`Invalid capability ceiling ${field} entry '${name}'; max 128 UTF-8 bytes.`);\n\t\t\treturn name;\n\t\t}))].sort();\n\t};\n\tconst allowedTools = normalizeList(\"allowedTools\", /^[A-Za-z0-9_.:-]+$/u);\n\tconst allowedAgents = normalizeList(\"allowedAgents\", /^[A-Za-z0-9_.:-]+$/u);\n\treturn {\n\t\tversion: SUBAGENT_CAPABILITY_CEILING_VERSION,\n\t\t...(allowedTools !== undefined ? { allowedTools } : {}),\n\t\t...(allowedAgents !== undefined ? { allowedAgents } : {}),\n\t\tdenyExtensions: ceiling.denyExtensions === true,\n\t\tsources: [],\n\t};\n}\n\nexport function parseSubagentCapabilityCeiling(value: unknown, field = \"capability ceiling\"): ResolvedSubagentCapabilityCeiling {\n\tif (!value || typeof value !== \"object\" || Array.isArray(value)) throw new Error(`Invalid ${field}; expected an object.`);\n\tconst record = value as Record<string, unknown>;\n\tif (record.version !== SUBAGENT_CAPABILITY_CEILING_VERSION) throw new Error(`Invalid ${field} version.`);\n\tconst normalized = normalizeCeiling(record as SubagentCapabilityCeiling);\n\tconst sources = record.sources;\n\tif (!Array.isArray(sources) || sources.some((source) => typeof source !== \"string\")) throw new Error(`Invalid ${field} sources; expected an array of strings.`);\n\tnormalized.sources = [...new Set(sources.map((source) => validateText(source, `${field} source`)))].sort();\n\treturn normalized;\n}\n\nexport function registerSubagentCapabilityCeiling(options: RegisterSubagentCapabilityCeilingOptions): SubagentCapabilityCeilingHandle {\n\tconst sessionId = validateText(options.sessionId, \"sessionId\");\n\tconst source = validateText(options.source, \"source\");\n\tlet normalized = normalizeCeiling(options.ceiling);\n\tconst token = Symbol(source);\n\tconst store = registry();\n\tlet session = store.get(sessionId);\n\tif (!session) {\n\t\tsession = new Map();\n\t\tstore.set(sessionId, session);\n\t}\n\tconst setRegistration = () => {\n\t\tnormalized = normalizeCeiling(normalized);\n\t\tnormalized.sources = [source];\n\t\tsession!.set(token, { source, ceiling: normalized });\n\t};\n\tsetRegistration();\n\tlet disposed = false;\n\treturn {\n\t\tupdate(ceiling) {\n\t\t\tif (disposed) throw new Error(\"Cannot update a disposed capability ceiling handle.\");\n\t\t\tnormalized = normalizeCeiling(ceiling);\n\t\t\tnormalized.sources = [source];\n\t\t\tsession!.set(token, { source, ceiling: normalized });\n\t\t},\n\t\tdispose() {\n\t\t\tif (disposed) return;\n\t\t\tdisposed = true;\n\t\t\tsession!.delete(token);\n\t\t\tif (session!.size === 0) store.delete(sessionId);\n\t\t},\n\t};\n}\n\nexport function intersectSubagentCapabilityCeilings(...ceilings: Array<ResolvedSubagentCapabilityCeiling | undefined>): ResolvedSubagentCapabilityCeiling | undefined {\n\tconst active = ceilings.filter((ceiling): ceiling is ResolvedSubagentCapabilityCeiling => ceiling !== undefined);\n\tif (active.length === 0) return undefined;\n\tconst intersectLists = (field: \"allowedTools\" | \"allowedAgents\"): string[] | undefined => {\n\t\tconst definedLists = active.filter((ceiling) => ceiling[field] !== undefined).map((ceiling) => new Set(ceiling[field]));\n\t\tif (definedLists.length === 0) return undefined;\n\t\treturn [...definedLists[0]!].filter((entry) => definedLists.every((list) => list.has(entry))).sort();\n\t};\n\tconst allowedTools = intersectLists(\"allowedTools\");\n\tconst allowedAgents = intersectLists(\"allowedAgents\");\n\treturn {\n\t\tversion: SUBAGENT_CAPABILITY_CEILING_VERSION,\n\t\t...(allowedTools !== undefined ? { allowedTools } : {}),\n\t\t...(allowedAgents !== undefined ? { allowedAgents } : {}),\n\t\tdenyExtensions: active.some((ceiling) => ceiling.denyExtensions),\n\t\tsources: [...new Set(active.flatMap((ceiling) => ceiling.sources))].sort(),\n\t};\n}\n\nexport function resolveSubagentCapabilityCeiling(sessionId: string | undefined, inherited?: ResolvedSubagentCapabilityCeiling): ResolvedSubagentCapabilityCeiling | undefined {\n\tconst active: ResolvedSubagentCapabilityCeiling[] = [];\n\tif (sessionId) {\n\t\tconst registrations = registry().get(sessionId);\n\t\tif (registrations) active.push(...Array.from(registrations.values(), ({ ceiling }) => ceiling));\n\t}\n\treturn intersectSubagentCapabilityCeilings(inherited, ...active);\n}\n\nexport function resolveCurrentSubagentCapabilityCeiling(sessionId: string | undefined): ResolvedSubagentCapabilityCeiling | undefined {\n\treturn resolveSubagentCapabilityCeiling(sessionId, decodeSubagentCapabilityCeiling(process.env[SUBAGENT_CAPABILITY_CEILING_ENV]));\n}\n\nexport function isAgentAllowedByCapabilityCeiling(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): boolean {\n\treturn ceiling?.allowedAgents === undefined || ceiling.allowedAgents.includes(agentName);\n}\n\nexport function capabilityCeilingAgentRestrictionMessage(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): string | undefined {\n\tif (isAgentAllowedByCapabilityCeiling(agentName, ceiling)) return undefined;\n\tconst sources = ceiling?.sources.length ? ceiling.sources.join(\", \") : \"unknown source\";\n\tconst allowed = ceiling?.allowedAgents?.length ? ceiling.allowedAgents.join(\", \") : \"(none)\";\n\treturn `Capability ceiling from ${sources} does not allow agent '${agentName}'. Allowed agents: ${allowed}.`;\n}\n\nexport function assertAgentAllowedByCapabilityCeiling(agentName: string, ceiling: ResolvedSubagentCapabilityCeiling | undefined): void {\n\tconst message = capabilityCeilingAgentRestrictionMessage(agentName, ceiling);\n\tif (message) throw new Error(message);\n}\n\nexport function capabilityCeilingAgentRestrictionSources(ceiling: ResolvedSubagentCapabilityCeiling | undefined): string[] | undefined {\n\treturn ceiling?.allowedAgents === undefined ? undefined : [...ceiling.sources];\n}\n\nexport function encodeSubagentCapabilityCeiling(ceiling: ResolvedSubagentCapabilityCeiling | undefined): string | undefined {\n\tif (!ceiling) return undefined;\n\treturn Buffer.from(JSON.stringify(ceiling), \"utf8\").toString(\"base64url\");\n}\n\nexport function decodeSubagentCapabilityCeiling(value: string | undefined): ResolvedSubagentCapabilityCeiling | undefined {\n\tif (value === undefined || value === \"\") return undefined;\n\tlet parsed: unknown;\n\ttry {\n\t\tparsed = JSON.parse(Buffer.from(value, \"base64url\").toString(\"utf8\"));\n\t} catch (error) {\n\t\tthrow new Error(`Invalid inherited capability ceiling: ${error instanceof Error ? error.message : String(error)}`);\n\t}\n\tif (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed) || (parsed as { version?: unknown }).version !== SUBAGENT_CAPABILITY_CEILING_VERSION) {\n\t\tthrow new Error(\"Invalid inherited capability ceiling version.\");\n\t}\n\treturn parseSubagentCapabilityCeiling(parsed, \"inherited capability ceiling\");\n}\n","export const BYOK_PI_PERMISSION_MODE = 'BYOK_PI_PERMISSION_MODE';\n\n/** SDK-owned extension tools that do not mutate the task workspace. */\nexport const BYOK_PI_READONLY_PARENT_TOOLS = ['subagent', 'todo'] as const;\n\n/** Child tools retained when a readonly parent delegates through pi-subagents. */\nexport const BYOK_PI_READONLY_SUBAGENT_TOOLS = ['read', 'grep', 'find', 'ls'] as const;\n\n/** Package-provided read-only roles; writer and ambient custom roles stay unavailable. */\nexport const BYOK_PI_READONLY_SUBAGENT_AGENTS = [\n  'reviewer',\n  'oracle',\n  'codex-exec',\n  'claude-code',\n  'cursor-agent',\n] as const;\n","import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';\nimport {\n  registerSubagentCapabilityCeiling,\n  type SubagentCapabilityCeilingHandle,\n} from 'pi-subagents/capability-ceiling';\nimport {\n  BYOK_PI_PERMISSION_MODE,\n  BYOK_PI_READONLY_SUBAGENT_AGENTS,\n  BYOK_PI_READONLY_SUBAGENT_TOOLS,\n} from './subagents-policy-config';\n\nfunction permissionMode(): 'auto' | 'readonly' {\n  const mode = process.env[BYOK_PI_PERMISSION_MODE];\n  if (mode === 'auto' || mode === 'readonly') return mode;\n  throw new Error(`${BYOK_PI_PERMISSION_MODE} must be \"auto\" or \"readonly\"`);\n}\n\n/**\n * Keep pi-subagents available in every Pi session without letting a readonly\n * parent widen its task contract through a child process.\n */\nexport default function registerByokSubagentsPolicy(pi: ExtensionAPI): void {\n  const mode = permissionMode();\n  let ceiling: SubagentCapabilityCeilingHandle | undefined;\n\n  pi.on('session_start', (_event, ctx) => {\n    ceiling?.dispose();\n    ceiling = undefined;\n    if (mode === 'auto') return;\n\n    const sessionId = ctx.sessionManager.getSessionId();\n    if (!sessionId) throw new Error('readonly Pi subagent policy requires an authoritative session id');\n    ceiling = registerSubagentCapabilityCeiling({\n      sessionId,\n      source: 'byok-sdk-readonly',\n      ceiling: {\n        allowedTools: BYOK_PI_READONLY_SUBAGENT_TOOLS,\n        allowedAgents: BYOK_PI_READONLY_SUBAGENT_AGENTS,\n        denyExtensions: true,\n      },\n    });\n  });\n\n  pi.on('tool_call', (event) => {\n    if (mode === 'readonly' && event.toolName === 'subagent' && ceiling === undefined) {\n      return {\n        block: true,\n        terminate: true,\n        reason: 'readonly Pi subagent capability ceiling is unavailable',\n      };\n    }\n  });\n\n  pi.on('session_shutdown', () => {\n    ceiling?.dispose();\n    ceiling = undefined;\n  });\n}\n"]}

package/dist/adapters/pi/team-interaction-extension.d.ts

@@ -0,0 +1,24 @@
+import type { ExtensionAPI } from '@earendil-works/pi-coding-agent';
+/** Tracks the public coalesced Pi UI span, never infers state from timers or isIdle. */
+export declare class PiInteractionGate {
+    private readonly emit;
+    private phase;
+    private sessionId;
+    private revision;
+    private readonly waiters;
+    constructor(emit: (event: {
+        type: 'byok_team_gate';
+        sessionId?: string;
+        revision: number;
+        phase: string;
+    }) => void);
+    start(sessionId: string): void;
+    openPrompt(): void;
+    closePrompt(): void;
+    fail(): void;
+    close(): void;
+    private report;
+    wait(signal?: AbortSignal): Promise<void>;
+}
+/** Load first, RPC only. The GUI host owns the process and exact-ID UI responses. */
+export default function teamInteractionExtension(pi: ExtensionAPI): void;

package/dist/adapters/pi/team-interaction-extension.js

@@ -0,0 +1,81 @@
+// src/adapters/pi/team-interaction-extension.ts
+var PiInteractionGate = class {
+  constructor(emit) {
+    this.emit = emit;
+  }
+  emit;
+  phase = "starting";
+  sessionId;
+  revision = 0;
+  waiters = /* @__PURE__ */ new Set();
+  start(sessionId) {
+    if (this.phase !== "starting" || !sessionId) return this.fail();
+    this.sessionId = sessionId;
+    this.phase = "open";
+    this.report();
+  }
+  openPrompt() {
+    if (this.phase !== "open") return this.fail();
+    this.phase = "waiting";
+    this.report();
+  }
+  closePrompt() {
+    if (this.phase !== "waiting") return this.fail();
+    this.phase = "open";
+    this.report();
+    for (const resolve of this.waiters) resolve();
+    this.waiters.clear();
+  }
+  fail() {
+    this.phase = "failed";
+    this.report();
+  }
+  close() {
+    this.phase = "closed";
+    this.report();
+  }
+  report() {
+    this.emit({ type: "byok_team_gate", ...this.sessionId ? { sessionId: this.sessionId } : {}, revision: ++this.revision, phase: this.phase });
+  }
+  async wait(signal) {
+    await Promise.resolve();
+    while (this.phase !== "open") {
+      if (signal?.aborted && this.phase === "waiting") return;
+      await new Promise((resolve) => {
+        const done = () => {
+          this.waiters.delete(done);
+          signal?.removeEventListener("abort", aborted);
+          resolve();
+        };
+        const aborted = () => {
+          if (this.phase === "waiting") done();
+        };
+        this.waiters.add(done);
+        signal?.addEventListener("abort", aborted, { once: true });
+      });
+      await Promise.resolve();
+    }
+  }
+};
+function teamInteractionExtension(pi) {
+  let ui;
+  const gate = new PiInteractionGate((event) => ui.setStatus("byok_team_gate", JSON.stringify(event)));
+  pi.on("session_start", (_event, ctx) => {
+    ui = ctx.ui;
+    gate.start(ctx.sessionManager.getSessionId());
+  });
+  pi.on("ui_prompt_start", () => gate.openPrompt());
+  pi.on("ui_prompt_end", () => gate.closePrompt());
+  pi.on("input", async () => {
+    await gate.wait();
+    return { action: "continue" };
+  });
+  pi.on("before_provider_request", async (_event, ctx) => {
+    await gate.wait(ctx.signal);
+  });
+  pi.on("session_shutdown", () => gate.close());
+}
+
+export { PiInteractionGate, teamInteractionExtension as default };
+//# sourceMappingURL=team-interaction-extension.js.map
+//# sourceMappingURL=team-interaction-extension.js.map

package/dist/adapters/pi/team-interaction-extension.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/adapters/pi/team-interaction-extension.ts"],"names":[],"mappings":";AAGO,IAAM,oBAAN,MAAwB;AAAA,EAK7B,YAA6B,IAAA,EAAwG;AAAxG,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAAyG;AAAA,EAAzG,IAAA;AAAA,EAJrB,KAAA,GAA+D,UAAA;AAAA,EAC/D,SAAA;AAAA,EACA,QAAA,GAAW,CAAA;AAAA,EACF,OAAA,uBAAc,GAAA,EAAgB;AAAA,EAE/C,MAAM,SAAA,EAAyB;AAC7B,IAAA,IAAI,KAAK,KAAA,KAAU,UAAA,IAAc,CAAC,SAAA,EAAW,OAAO,KAAK,IAAA,EAAK;AAC9D,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAW,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAQ,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EAC/D;AAAA,EACA,UAAA,GAAmB;AACjB,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,MAAA,EAAQ,OAAO,KAAK,IAAA,EAAK;AAC5C,IAAA,IAAA,CAAK,KAAA,GAAQ,SAAA;AAAW,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EACtC;AAAA,EACA,WAAA,GAAoB;AAClB,IAAA,IAAI,IAAA,CAAK,KAAA,KAAU,SAAA,EAAW,OAAO,KAAK,IAAA,EAAK;AAC/C,IAAA,IAAA,CAAK,KAAA,GAAQ,MAAA;AAAQ,IAAA,IAAA,CAAK,MAAA,EAAO;AACjC,IAAA,KAAA,MAAW,OAAA,IAAW,IAAA,CAAK,OAAA,EAAS,OAAA,EAAQ;AAAG,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACpE;AAAA,EACA,IAAA,GAAa;AAAE,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AAAU,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EAAG;AAAA,EACrD,KAAA,GAAc;AAAE,IAAA,IAAA,CAAK,KAAA,GAAQ,QAAA;AAAU,IAAA,IAAA,CAAK,MAAA,EAAO;AAAA,EAAG;AAAA,EAC9C,MAAA,GAAe;AAAE,IAAA,IAAA,CAAK,IAAA,CAAK,EAAE,IAAA,EAAM,gBAAA,EAAkB,GAAI,IAAA,CAAK,SAAA,GAAY,EAAE,SAAA,EAAW,IAAA,CAAK,WAAU,GAAI,IAAK,QAAA,EAAU,EAAE,KAAK,QAAA,EAAU,KAAA,EAAO,IAAA,CAAK,KAAA,EAAO,CAAA;AAAA,EAAG;AAAA,EACxK,MAAM,KAAK,MAAA,EAAqC;AAG9C,IAAA,MAAM,QAAQ,OAAA,EAAQ;AACtB,IAAA,OAAO,IAAA,CAAK,UAAU,MAAA,EAAQ;AAG5B,MAAA,IAAI,MAAA,EAAQ,OAAA,IAAW,IAAA,CAAK,KAAA,KAAU,SAAA,EAAW;AACjD,MAAA,MAAM,IAAI,QAAc,CAAA,OAAA,KAAW;AACjC,QAAA,MAAM,OAAO,MAAM;AAAE,UAAA,IAAA,CAAK,OAAA,CAAQ,OAAO,IAAI,CAAA;AAAG,UAAA,MAAA,EAAQ,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAG,UAAA,OAAA,EAAQ;AAAA,QAAG,CAAA;AAC1G,QAAA,MAAM,UAAU,MAAM;AAAE,UAAA,IAAI,IAAA,CAAK,KAAA,KAAU,SAAA,EAAW,IAAA,EAAK;AAAA,QAAG,CAAA;AAC9D,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,IAAI,CAAA;AAAG,QAAA,MAAA,EAAQ,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,MACnF,CAAC,CAAA;AAED,MAAA,MAAM,QAAQ,OAAA,EAAQ;AAAA,IACxB;AAAA,EACF;AACF;AAGe,SAAR,yBAA0C,EAAA,EAAwB;AACvE,EAAA,IAAI,EAAA;AACJ,EAAA,MAAM,IAAA,GAAO,IAAI,iBAAA,CAAkB,CAAA,KAAA,KAAS,EAAA,CAAG,SAAA,CAAU,gBAAA,EAAkB,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAC,CAAA;AACjG,EAAA,EAAA,CAAG,EAAA,CAAG,eAAA,EAAiB,CAAC,MAAA,EAAQ,GAAA,KAAQ;AAAE,IAAA,EAAA,GAAK,GAAA,CAAI,EAAA;AAAI,IAAA,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,cAAA,CAAe,YAAA,EAAc,CAAA;AAAA,EAAG,CAAC,CAAA;AACvG,EAAA,EAAA,CAAG,EAAA,CAAG,iBAAA,EAAmB,MAAM,IAAA,CAAK,YAAY,CAAA;AAChD,EAAA,EAAA,CAAG,EAAA,CAAG,eAAA,EAAiB,MAAM,IAAA,CAAK,aAAa,CAAA;AAC/C,EAAA,EAAA,CAAG,EAAA,CAAG,SAAS,YAAY;AAAE,IAAA,MAAM,KAAK,IAAA,EAAK;AAAG,IAAA,OAAO,EAAE,QAAQ,UAAA,EAAW;AAAA,EAAG,CAAC,CAAA;AAChF,EAAA,EAAA,CAAG,EAAA,CAAG,yBAAA,EAA2B,OAAO,MAAA,EAAQ,GAAA,KAAQ;AAAE,IAAA,MAAM,IAAA,CAAK,IAAA,CAAK,GAAA,CAAI,MAAM,CAAA;AAAA,EAAG,CAAC,CAAA;AACxF,EAAA,EAAA,CAAG,EAAA,CAAG,kBAAA,EAAoB,MAAM,IAAA,CAAK,OAAO,CAAA;AAC9C","file":"team-interaction-extension.js","sourcesContent":["import type { ExtensionAPI, ExtensionUIContext } from '@earendil-works/pi-coding-agent';\n\n/** Tracks the public coalesced Pi UI span, never infers state from timers or isIdle. */\nexport class PiInteractionGate {\n  private phase: 'starting' | 'open' | 'waiting' | 'failed' | 'closed' = 'starting';\n  private sessionId: string | undefined;\n  private revision = 0;\n  private readonly waiters = new Set<() => void>();\n  constructor(private readonly emit: (event: { type: 'byok_team_gate'; sessionId?: string; revision: number; phase: string }) => void) {}\n  start(sessionId: string): void {\n    if (this.phase !== 'starting' || !sessionId) return this.fail();\n    this.sessionId = sessionId; this.phase = 'open'; this.report();\n  }\n  openPrompt(): void {\n    if (this.phase !== 'open') return this.fail();\n    this.phase = 'waiting'; this.report();\n  }\n  closePrompt(): void {\n    if (this.phase !== 'waiting') return this.fail();\n    this.phase = 'open'; this.report();\n    for (const resolve of this.waiters) resolve(); this.waiters.clear();\n  }\n  fail(): void { this.phase = 'failed'; this.report(); }\n  close(): void { this.phase = 'closed'; this.report(); }\n  private report(): void { this.emit({ type: 'byok_team_gate', ...(this.sessionId ? { sessionId: this.sessionId } : {}), revision: ++this.revision, phase: this.phase }); }\n  async wait(signal?: AbortSignal): Promise<void> {\n    // Pi publishes span lifecycle through queueMicrotask. Drain events already\n    // scheduled before checking the admission state in this process.\n    await Promise.resolve();\n    while (this.phase !== 'open') {\n      // Unknown state never throws into Pi's best-effort extension dispatcher,\n      // which would swallow the exception and continue. Host tears down on fatal.\n      if (signal?.aborted && this.phase === 'waiting') return;\n      await new Promise<void>(resolve => {\n        const done = () => { this.waiters.delete(done); signal?.removeEventListener('abort', aborted); resolve(); };\n        const aborted = () => { if (this.phase === 'waiting') done(); };\n        this.waiters.add(done); signal?.addEventListener('abort', aborted, { once: true });\n      });\n      // A continuation may open another dialog before its start event runs.\n      await Promise.resolve();\n    }\n  }\n}\n\n/** Load first, RPC only. The GUI host owns the process and exact-ID UI responses. */\nexport default function teamInteractionExtension(pi: ExtensionAPI): void {\n  let ui: ExtensionUIContext;\n  const gate = new PiInteractionGate(event => ui.setStatus('byok_team_gate', JSON.stringify(event)));\n  pi.on('session_start', (_event, ctx) => { ui = ctx.ui; gate.start(ctx.sessionManager.getSessionId()); });\n  pi.on('ui_prompt_start', () => gate.openPrompt());\n  pi.on('ui_prompt_end', () => gate.closePrompt());\n  pi.on('input', async () => { await gate.wait(); return { action: 'continue' }; });\n  pi.on('before_provider_request', async (_event, ctx) => { await gate.wait(ctx.signal); });\n  pi.on('session_shutdown', () => gate.close());\n}\n"]}

package/dist/adapters/process-tree.d.ts

@@ -1,5 +1,5 @@
-import { spawn, type ChildProcess, type SpawnOptions } from 'node:child_process';
-type KillFn = (pid: number, signal: NodeJS.Signals | number) => void;
+import { spawn, spawnSync, type ChildProcess, type SpawnOptions } from 'node:child_process';
+export type KillFn = (pid: number, signal: NodeJS.Signals | number) => void;
 export interface OwnedProcessTreeOptions {
     child: ChildProcess;
     waitClosed: () => Promise<void>;
@@ -20,6 +20,68 @@ export interface OwnedProcessTreeOptions {
  * the runtime outlive the daemon. Windows uses taskkill's `/T` tree authority.
  */
 export declare function withOwnedProcessTree<T extends SpawnOptions>(options: T): T;
+/**
+ * The `exit` listener itself. Three constraints, all load-bearing:
+ * it never awaits (Node runs nothing asynchronous after `exit` begins), it
+ * never throws (a throw here would replace the host's own exit reason), and
+ * each target is swept in its own try/catch so one unreachable tree cannot
+ * strand the rest. POSIX kills the owned process GROUP — `withOwnedProcessTree`
+ * made the root a group leader precisely so this one signal reaches the whole
+ * tree. win32 has no process groups to signal, so it pays for a synchronous
+ * `taskkill /T /F` per target.
+ */
+declare function terminateOwnedTreesForHostExit(): void;
+/**
+ * Test-only view of the host-exit backstop. Not part of any package entry
+ * point (`process-tree.ts` is internal to `@byok-sdk/client`); it exists so
+ * the registry contract can be asserted without a second production seam.
+ */
+export declare const __hostExitBackstopForTests: {
+    /** The exact function Node invokes on `exit`. */
+    run: typeof terminateOwnedTreesForHostExit;
+    registeredPids(): number[];
+    listenerCount(): number;
+};
+export interface AdoptOwnedProcessTreeOptions {
+    child: ChildProcess;
+    label: string;
+    /** DI seam — defaults to `process.platform`, mirroring {@link OwnedProcessTreeOptions}. */
+    platform?: NodeJS.Platform;
+    /** DI seam for the win32 job-object backstop — defaults to the lazily imported `./win32-job-object`. */
+    jobObject?: {
+        assign(pid: number): Promise<void>;
+    };
+    /** DI seam for the POSIX host-exit sweep — defaults to `process.kill`. */
+    killFn?: KillFn;
+    /** DI seam for the win32 host-exit sweep — defaults to `node:child_process`'s `spawnSync`. */
+    spawnSyncFn?: typeof spawnSync;
+}
+/**
+ * Take ownership of a just-spawned runtime tree, beyond what disposal covers.
+ *
+ * Two backstops with different coverage, both kernel- or runtime-owned rather
+ * than sweep-based:
+ *
+ * 1. Every platform: the tree joins a registry a once-installed, synchronous
+ *    `process` `exit` listener sweeps. This covers an ordinary daemon exit —
+ *    the case where disposal simply never ran.
+ * 2. win32 only: the root is assigned to the daemon-wide
+ *    `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` job (see `./win32-job-object.ts`).
+ *    That one is the kernel's, so it also covers the daemon deaths no listener
+ *    can observe.
+ *
+ * Fail closed: a rejected assignment propagates, and the caller must terminate
+ * the child and refuse to publish a run handle rather than run a tree nothing
+ * owns. The registration happens FIRST so a child that fails assignment is
+ * still swept if the daemon exits during the caller's cleanup.
+ *
+ * Residual boundary, stated rather than hidden: assignment happens after
+ * `spawn` returns, so a grandchild forked inside that window is outside the
+ * job; and neither backstop can run when the daemon itself is SIGKILLed or
+ * OOM-killed on POSIX, where only the job object's kernel guarantee — which
+ * POSIX does not have — would help.
+ */
+export declare function adoptOwnedProcessTree(options: AdoptOwnedProcessTreeOptions): Promise<void>;
 /**
  * Immediate termination request used by interrupt paths; close remains the
  * receipt. On win32 the request also RECORDS the pid set taskkill walked,
@@ -53,8 +115,16 @@ export declare function requestOwnedProcessTreeTermination(options: OwnedProcess
  * window means a recycled pid could read as alive. And if taskkill's output is
  * empty or unparseable, the walked set collapses to `{root}`: disposal then
  * measures the root alone and reports quiescence on that basis, which is a
- * narrower claim than the tree, not a false one. Preventing orphans left behind
- * by a DAEMON crash is a separate job-object concern, explicitly out of scope.
+ * narrower claim than the tree, not a false one.
+ *
+ * Orphans left behind by a DAEMON death are no longer out of scope, but they
+ * are not THIS function's job either — nothing here runs when the daemon is
+ * gone. {@link adoptOwnedProcessTree} owns that case with two backstops
+ * installed at spawn time: a synchronous host-`exit` sweep on every platform,
+ * and on win32 a kernel-owned kill-on-close Job Object. Their own residuals
+ * remain: the tiny window between `spawn` returning and the job assignment,
+ * and a daemon SIGKILL/OOM on POSIX, where no in-process listener can run and
+ * there is no job object to fall back on.
  */
 export declare function disposeOwnedProcessTree(options: OwnedProcessTreeOptions): Promise<void>;
 export {};

package/dist/adapters/provider-credential-environment.d.ts

@@ -13,6 +13,6 @@ export declare const PROVIDER_CREDENTIAL_ENV_NAMES: readonly ['ANTHROPIC_API_KEY
  * denying a credential is safe, while allowing every cloud credential Pi
  * could consume would regress the daemon's ambient-environment isolation.
  */
-export declare const PROVIDER_CREDENTIAL_ENV_DENY_NAMES: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "GEMINI_API_KEY", "AZURE_OPENAI_API_KEY", "DEEPSEEK_API_KEY", "GROQ_API_KEY", "MISTRAL_API_KEY", "OPENROUTER_API_KEY", "XAI_API_KEY", "ZAI_API_KEY", "ANT_LING_API_KEY", "NVIDIA_API_KEY", "CEREBRAS_API_KEY", "CLOUDFLARE_API_KEY", "AI_GATEWAY_API_KEY", "ZAI_CODING_CN_API_KEY", "OPENCODE_API_KEY", "RADIUS_API_KEY", "FIREWORKS_API_KEY", "TOGETHER_API_KEY", "BASETEN_API_KEY", "KIMI_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "QWEN_TOKEN_PLAN_API_KEY", "QWEN_TOKEN_PLAN_CN_API_KEY", "XIAOMI_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "GOOGLE_APPLICATION_CREDENTIALS", "PI_PROVIDER_API_KEY"];
+export declare const PROVIDER_CREDENTIAL_ENV_DENY_NAMES: readonly ["ANTHROPIC_API_KEY", "ANTHROPIC_OAUTH_TOKEN", "OPENAI_API_KEY", "GEMINI_API_KEY", "AZURE_OPENAI_API_KEY", "DEEPSEEK_API_KEY", "GROQ_API_KEY", "MISTRAL_API_KEY", "OPENROUTER_API_KEY", "XAI_API_KEY", "ZAI_API_KEY", "ANT_LING_API_KEY", "NVIDIA_API_KEY", "CEREBRAS_API_KEY", "CLOUDFLARE_API_KEY", "AI_GATEWAY_API_KEY", "ZAI_CODING_CN_API_KEY", "OPENCODE_API_KEY", "RADIUS_API_KEY", "FIREWORKS_API_KEY", "TOGETHER_API_KEY", "BASETEN_API_KEY", "KIMI_API_KEY", "HF_TOKEN", "MOONSHOT_API_KEY", "MINIMAX_API_KEY", "MINIMAX_CN_API_KEY", "QWEN_TOKEN_PLAN_API_KEY", "QWEN_TOKEN_PLAN_CN_API_KEY", "XIAOMI_API_KEY", "XIAOMI_TOKEN_PLAN_CN_API_KEY", "XIAOMI_TOKEN_PLAN_AMS_API_KEY", "XIAOMI_TOKEN_PLAN_SGP_API_KEY", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_SESSION_TOKEN", "GOOGLE_APPLICATION_CREDENTIALS", "PI_PROVIDER_API_KEY"];
 /** Return a copy that cannot pass ambient provider credentials to a child. */
 export declare function withoutProviderCredentials(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;

package/dist/adapters/win32-job-object.d.ts

@@ -0,0 +1,101 @@
+/**
+ * Windows kill-on-close Job Object ownership for owned runtime process trees.
+ *
+ * `adapters/process-tree.ts` can terminate a tree the daemon still controls.
+ * It cannot terminate one the daemon is no longer around to sweep: Windows
+ * never re-parents orphans, so descendants of a daemon that died (crash,
+ * SIGKILL, OOM) are unreachable to any later `taskkill /T`. A Job Object with
+ * `JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE` moves that guarantee into the kernel —
+ * ONE job is created per daemon process, every owned runtime root is assigned
+ * to it right after spawn, and the job handle is deliberately never closed.
+ * When the daemon's last handle to it goes away — for ANY reason, including a
+ * kill the daemon cannot observe — Windows terminates every process in the
+ * job.
+ *
+ * Fail-closed, no degraded path. `koffi` is an `optionalDependencies` entry of
+ * this package precisely because npm has no other per-platform install
+ * mechanism; the runtime rule, not the manifest field, carries the hardness.
+ * A missing module, a NULL handle, or a zero return from any of the four Win32
+ * calls throws {@link Win32JobObjectFailure} carrying the `GetLastError()`
+ * code, and the caller refuses to publish a run handle. Nothing here retries
+ * and nothing degrades to an unbacked tree.
+ *
+ * POSIX never loads this module: `process-tree.ts` reaches it through a
+ * dynamic `import()` taken only on the win32 branch, and `koffi` itself is
+ * imported only inside {@link loadBindings}. `__tests__/win32-job-object.test.ts`
+ * asserts that isolation from a real non-win32 subprocess.
+ *
+ * Signatures follow kernel32's documented ABI and mirror the binding table in
+ * deepseek-harness `sandbox-windows-acl` (`src/ffi.ts`), whose layout constants
+ * were verified against the real Windows headers by its own ABI probe.
+ */
+/**
+ * A Win32 HANDLE as koffi 3 hands it back: a BigInt address, or null/0n for
+ * failure. Deliberately opaque — nothing here does pointer arithmetic, and a
+ * concrete numeric type would invite it.
+ */
+export type Win32Handle = unknown;
+/** The steps a job assignment can fail at, in the order they are attempted. */
+export type Win32JobObjectStep = 'loadKoffi' | 'CreateJobObjectW' | 'SetInformationJobObject' | 'OpenProcess' | 'AssignProcessToJobObject';
+export interface Win32JobObjectFailureInput {
+    step: Win32JobObjectStep;
+    reason: string;
+    /** The `GetLastError()` code read immediately after the failing call. Absent only when the failure happened before any Win32 call (module load). */
+    win32Code?: number;
+}
+/**
+ * Start-time precondition failure of the win32 job-object backstop.
+ *
+ * Module-local by design. `RuntimeExecutionFailure` is the adapter boundary's
+ * terminal control value and is frozen, so it cannot carry `win32Code`; this
+ * failure is a transport-level precondition that each client folds into its
+ * OWN existing exit-error channel, which is what the adapter boundary already
+ * classifies. Nothing new is exported from the package index.
+ */
+export declare class Win32JobObjectFailure extends Error {
+    readonly step: Win32JobObjectStep;
+    readonly win32Code: number | undefined;
+    constructor(input: Win32JobObjectFailureInput, options?: ErrorOptions);
+}
+/** Narrowing guard usable across the two independently bundled package entries. */
+export declare function isWin32JobObjectFailure(value: unknown): value is Win32JobObjectFailure;
+/**
+ * The kernel32 calls the backstop needs. An interface, not a hard-wired koffi
+ * table, so the branch is exercisable from POSIX with a recording fake — the
+ * same DI convention `process-tree.ts` uses for `platform`/`spawnFn`/`killFn`.
+ */
+export interface JobObjectBindings {
+    /** `HANDLE CreateJobObjectW(LPSECURITY_ATTRIBUTES, LPCWSTR)` — both NULL for an unnamed, default-security job. */
+    createJobObjectW(attributes: Win32Handle, name: string | null): Win32Handle;
+    /** `BOOL SetInformationJobObject(HANDLE, JOBOBJECTINFOCLASS, LPVOID, DWORD)`. */
+    setInformationJobObject(job: Win32Handle, infoClass: number, info: Buffer, infoLength: number): number;
+    /** `HANDLE OpenProcess(DWORD, BOOL, DWORD)`. */
+    openProcess(desiredAccess: number, inheritHandle: number, pid: number): Win32Handle;
+    /** `BOOL AssignProcessToJobObject(HANDLE, HANDLE)`. */
+    assignProcessToJobObject(job: Win32Handle, process: Win32Handle): number;
+    /** `BOOL CloseHandle(HANDLE)`. */
+    closeHandle(handle: Win32Handle): number;
+    /** `DWORD GetLastError()`. */
+    getLastError(): number;
+}
+/**
+ * Resolve the kernel32 binding table, importing `koffi` on first use only.
+ *
+ * The import is dynamic and lives here alone so that merely importing
+ * `process-tree.ts` — which every adapter does, on every platform — never
+ * pulls a native addon into the process.
+ */
+export declare function loadBindings(): Promise<JobObjectBindings>;
+export interface AssignOwnedProcessToJobOptions {
+    /** DI seam — defaults to the lazily loaded real kernel32 table. */
+    bindings?: JobObjectBindings;
+}
+/**
+ * Assign one owned runtime root to the daemon-wide kill-on-close job.
+ *
+ * Every failure throws {@link Win32JobObjectFailure} naming the step and
+ * carrying the Win32 error code. The process handle is opened solely to make
+ * the assignment and is closed in a `finally`, including on the failure path —
+ * the JOB holds the process afterwards, not this handle.
+ */
+export declare function assignOwnedProcessToJob(pid: number, options?: AssignOwnedProcessToJobOptions): Promise<void>;

package/dist/agent-home.d.ts

@@ -93,6 +93,27 @@ export declare class AgentHomeLayout {
     private canonicalRoot?;
     constructor(hostStorageRoot: string);
     resolve(agentRefInput: AgentRef): Promise<AgentHomeResolution>;
+    /**
+     * Pure canonical-home derivation for read-only callers, such as the
+     * pre-admission single-writer count. It validates the AgentRef and joins
+     * exactly the same `<hostStorageRoot>/agents/<agentId>` segments
+     * {@link AgentHomeLayout.resolve} would, canonicalizing only the components
+     * that already exist.
+     *
+     * It deliberately creates no directory, takes no cross-process mutation
+     * gate and records no Agent binding, so an offer the host vetoes after the
+     * count leaves nothing behind on disk. `resolve()` stays the only path that
+     * may materialize a home or bind it to an Agent identity.
+     *
+     * An `agents` root or `agents/<agentId>` leaf that already exists but is a
+     * symlink (or any non-directory) is rejected here with the same error class
+     * and message `resolve()` raises for it, so an in-root `two -> one` link
+     * fails closed instead of silently keying the count of `one`. A leaf that
+     * does not exist yet is not an error: this derivation runs before the home
+     * is materialized. A home canonicalizing outside the `agents` root stays
+     * rejected as before.
+     */
+    canonicalHomePath(agentRefInput: AgentRef): Promise<string>;
     /**
      * Prove the canonical root is materializable and writable before the daemon
      * advertises Agent-home capability. No Agent identity or persistent Agent
@@ -120,10 +141,33 @@ export declare class AgentHomeLeaseManager {
     acquire(resolution: AgentHomeResolution): Promise<AgentHomeLease>;
     private openLeaseMarker;
 }
+/**
+ * WP0: counts-only readback of the per-canonical-Agent-home Attempt cap and
+ * what one daemon currently holds against it. Deliberately carries no home
+ * path, agentId or taskId: it exists so an operator can see that a home is
+ * still busy — including the fail-closed case where a failed `Session.close()`
+ * keeps the slot held after the task itself is gone — not to enumerate Agents.
+ * Projected into both `Daemon.status()` and the authenticated local control
+ * status (`create-daemon.ts`).
+ */
+export interface AgentHomeExecutionStatus {
+    /** Effective `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome` for this daemon. */
+    maxConcurrentMutableSessionsPerAgentHome: number;
+    /** Canonical Agent homes this daemon currently holds at least one execution lease in. */
+    activeHomes: number;
+    /** Total Attempts holding an execution lease across those homes. */
+    activeAttempts: number;
+}
 /**
  * Session-scoped execution leases share one process-owned home marker. The
  * marker remains until the final session exits, so relocation still sees the
  * Agent home as active, while different sessions no longer exclude each other.
+ *
+ * This layer counts; it does not cap. How many Attempts may be active in one
+ * canonical home is a daemon admission decision made once, before any side
+ * effect, by `TaskRunner.handleOffer`'s per-home busy gate reading
+ * {@link AgentHomeExecutionLeaseManager.activeAttemptCount} against
+ * `DaemonConfig.maxConcurrentMutableSessionsPerAgentHome` (default 1).
  */
 export declare class AgentHomeExecutionLeaseManager {
     private readonly manager;
@@ -134,6 +178,36 @@ export declare class AgentHomeExecutionLeaseManager {
         readonly taskId: string;
         readonly sessionRef?: string;
     }): Promise<AgentHomeExecutionLease>;
+    /**
+     * WP0: Attempts currently holding an execution lease on this exact
+     * canonical home, across every lane and every session. This is the number
+     * the daemon's admission gate reads before any side effect — see
+     * `TaskRunner.handleOffer`'s per-home busy gate.
+     *
+     * Derived from the one lease registry above rather than a second tally, so
+     * it inherits the lease lifecycle exactly: an entry appears at `acquire()`,
+     * survives `bindSession()` (which rekeys in place), and disappears only at
+     * `release()`, which the task runner calls after the attempt is terminal
+     * AND `Session.close()` resolved. A failed disposal never reaches
+     * `release()`, so the slot stays held — fail closed, the same posture as
+     * `runtime-disposal-failed`. Crash residue needs nothing extra here: a
+     * restarted daemon starts with an empty registry and reclaims the on-disk
+     * marker only under the same stable owner identity (`openLeaseMarker`).
+     *
+     * Counted regardless of which lease manager owns the group: the invariant
+     * being protected is the filesystem path (`MEMORY.md`, `notes/`, `.git`),
+     * not the owner identity.
+     */
+    activeAttemptCount(canonicalHome: string): number;
+    /**
+     * Counts-only readback for daemon/control status. Scoped to this manager's
+     * own leases, so the number describes this daemon rather than every home
+     * any manager in the process happens to hold. Never exposes a home path.
+     */
+    activeAttemptSummary(): {
+        readonly homes: number;
+        readonly attempts: number;
+    };
     mutate<T>(binding: AgentHomeExecutionBinding, operation: () => Promise<T>): Promise<T>;
     private exclusive;
 }