@caupulican/pi-adaptative 0.80.103 → 0.81.1

package/dist/core/system-prompt-builder.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Session system-prompt construction.
+ *
+ * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the assembly of the
+ * session's base system prompt from live session state — the active profile's situational soul, the
+ * self-modification and autonomy guardrail blocks, the memory block, the loader's custom/append
+ * prompts, and the per-tool snippet/guideline surface — into the {@link BuildSystemPromptOptions}
+ * that the pure {@link buildSystemPrompt} renderer (core/system-prompt.ts, a different job: the
+ * stateless string builder) consumes. Holds the last-built `_baseSystemPromptOptions` so a
+ * before_agent_start extension hook can read it. Takes narrow accessor deps (each read fresh, since
+ * several collaborators — tool registries, memory manager, extension runner — are reassigned across
+ * the session lifecycle) rather than the whole AgentSession.
+ */
+import type { Extension } from "./extensions/types.ts";
+import type { MemoryManager } from "./memory/memory-manager.ts";
+import type { ResourceLoader } from "./resource-loader.ts";
+import type { SettingsManager } from "./settings-manager.ts";
+import { type BuildSystemPromptOptions } from "./system-prompt.ts";
+export interface SystemPromptBuilderDeps {
+    /** The session's working directory (read fresh; base for self-modification source resolution). */
+    getCwd(): string;
+    /** The session's settings manager — soul, self-modification, autonomy, and auto-learn settings. */
+    getSettingsManager(): SettingsManager;
+    /** The session's resource loader — custom/append system prompts, active skills, agents files. */
+    getResourceLoader(): ResourceLoader;
+    /** The session's memory manager — the static, frozen-per-session memory system-prompt block. */
+    getMemoryManager(): MemoryManager;
+    /** Whether a tool name is currently registered on the session. */
+    hasTool(name: string): boolean;
+    /** The one-line prompt snippet registered for a tool, if any. */
+    getToolPromptSnippet(name: string): string | undefined;
+    /** The extra guideline bullets registered for a tool, if any. */
+    getToolPromptGuidelines(name: string): string[] | undefined;
+    /** The session's currently active extensions. */
+    getActiveExtensions(): ReadonlyArray<Extension>;
+}
+export declare class SystemPromptBuilder {
+    private readonly deps;
+    private _baseSystemPromptOptions;
+    constructor(deps: SystemPromptBuilderDeps);
+    /** The options used to render the last base prompt — read by a before_agent_start extension hook. */
+    getBaseSystemPromptOptions(): BuildSystemPromptOptions;
+    normalizePromptSnippet(text: string | undefined): string | undefined;
+    normalizePromptGuidelines(guidelines: string[] | undefined): string[];
+    /**
+     * R6: the active profile's situational soul, wrapped so the model reads it as its identity for this
+     * situation. Empty when no active profile defines a soul.
+     */
+    private _buildSituationSoulPrompt;
+    private _buildSelfModificationPrompt;
+    private _buildAutonomyPrompt;
+    private _buildSystemPromptOptionsForToolNames;
+    rebuildSystemPrompt(toolNames: string[]): string;
+    /**
+     * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt
+     * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,
+     * so it must also receive a system prompt whose tool guidelines/snippets match that filtered
+     * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which
+     * later turns and extension events read).
+     */
+    buildSystemPromptForToolNames(toolNames: string[]): string;
+}
+//# sourceMappingURL=system-prompt-builder.d.ts.map

package/dist/core/system-prompt-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-prompt-builder.d.ts","sourceRoot":"","sources":["../../src/core/system-prompt-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,KAAK,wBAAwB,EAAqB,MAAM,oBAAoB,CAAC;AAEtF,MAAM,WAAW,uBAAuB;IACvC,kGAAkG;IAClG,MAAM,IAAI,MAAM,CAAC;IACjB,qGAAmG;IACnG,kBAAkB,IAAI,eAAe,CAAC;IACtC,mGAAiG;IACjG,iBAAiB,IAAI,cAAc,CAAC;IACpC,kGAAgG;IAChG,gBAAgB,IAAI,aAAa,CAAC;IAClC,kEAAkE;IAClE,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,iEAAiE;IACjE,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACvD,iEAAiE;IACjE,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5D,iDAAiD;IACjD,mBAAmB,IAAI,aAAa,CAAC,SAAS,CAAC,CAAC;CAChD;AAED,qBAAa,mBAAmB;IAC/B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAA0B;IAC/C,OAAO,CAAC,wBAAwB,CAA4B;IAE5D,YAAY,IAAI,EAAE,uBAAuB,EAExC;IAED,uGAAqG;IACrG,0BAA0B,IAAI,wBAAwB,CAErD;IAED,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAOnE;IAED,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,GAAG,SAAS,GAAG,MAAM,EAAE,CAapE;IAED;;;OAGG;IACH,OAAO,CAAC,yBAAyB;IAMjC,OAAO,CAAC,4BAA4B;IAgDpC,OAAO,CAAC,oBAAoB;IAyB5B,OAAO,CAAC,qCAAqC;IAiD7C,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAG/C;IAED;;;;;;OAMG;IACH,6BAA6B,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAEzD;CACD","sourcesContent":["/**\n * Session system-prompt construction.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the assembly of the\n * session's base system prompt from live session state — the active profile's situational soul, the\n * self-modification and autonomy guardrail blocks, the memory block, the loader's custom/append\n * prompts, and the per-tool snippet/guideline surface — into the {@link BuildSystemPromptOptions}\n * that the pure {@link buildSystemPrompt} renderer (core/system-prompt.ts, a different job: the\n * stateless string builder) consumes. Holds the last-built `_baseSystemPromptOptions` so a\n * before_agent_start extension hook can read it. Takes narrow accessor deps (each read fresh, since\n * several collaborators — tool registries, memory manager, extension runner — are reassigned across\n * the session lifecycle) rather than the whole AgentSession.\n */\n\nimport { existsSync } from \"node:fs\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport type { Extension } from \"./extensions/types.ts\";\nimport type { MemoryManager } from \"./memory/memory-manager.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\nimport { UNTRUSTED_BOUNDARY_SYSTEM_RULE } from \"./security/untrusted-boundary.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { type BuildSystemPromptOptions, buildSystemPrompt } from \"./system-prompt.ts\";\n\nexport interface SystemPromptBuilderDeps {\n\t/** The session's working directory (read fresh; base for self-modification source resolution). */\n\tgetCwd(): string;\n\t/** The session's settings manager — soul, self-modification, autonomy, and auto-learn settings. */\n\tgetSettingsManager(): SettingsManager;\n\t/** The session's resource loader — custom/append system prompts, active skills, agents files. */\n\tgetResourceLoader(): ResourceLoader;\n\t/** The session's memory manager — the static, frozen-per-session memory system-prompt block. */\n\tgetMemoryManager(): MemoryManager;\n\t/** Whether a tool name is currently registered on the session. */\n\thasTool(name: string): boolean;\n\t/** The one-line prompt snippet registered for a tool, if any. */\n\tgetToolPromptSnippet(name: string): string | undefined;\n\t/** The extra guideline bullets registered for a tool, if any. */\n\tgetToolPromptGuidelines(name: string): string[] | undefined;\n\t/** The session's currently active extensions. */\n\tgetActiveExtensions(): ReadonlyArray<Extension>;\n}\n\nexport class SystemPromptBuilder {\n\tprivate readonly deps: SystemPromptBuilderDeps;\n\tprivate _baseSystemPromptOptions!: BuildSystemPromptOptions;\n\n\tconstructor(deps: SystemPromptBuilderDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\t/** The options used to render the last base prompt — read by a before_agent_start extension hook. */\n\tgetBaseSystemPromptOptions(): BuildSystemPromptOptions {\n\t\treturn this._baseSystemPromptOptions;\n\t}\n\n\tnormalizePromptSnippet(text: string | undefined): string | undefined {\n\t\tif (!text) return undefined;\n\t\tconst oneLine = text\n\t\t\t.replace(/[\\r\\n]+/g, \" \")\n\t\t\t.replace(/\\s+/g, \" \")\n\t\t\t.trim();\n\t\treturn oneLine.length > 0 ? oneLine : undefined;\n\t}\n\n\tnormalizePromptGuidelines(guidelines: string[] | undefined): string[] {\n\t\tif (!guidelines || guidelines.length === 0) {\n\t\t\treturn [];\n\t\t}\n\n\t\tconst unique = new Set<string>();\n\t\tfor (const guideline of guidelines) {\n\t\t\tconst normalized = guideline.trim();\n\t\t\tif (normalized.length > 0) {\n\t\t\t\tunique.add(normalized);\n\t\t\t}\n\t\t}\n\t\treturn Array.from(unique);\n\t}\n\n\t/**\n\t * R6: the active profile's situational soul, wrapped so the model reads it as its identity for this\n\t * situation. Empty when no active profile defines a soul.\n\t */\n\tprivate _buildSituationSoulPrompt(): string | undefined {\n\t\tconst soul = this.deps.getSettingsManager().getActiveProfileSoul();\n\t\tif (!soul) return undefined;\n\t\treturn `<situation_soul>\\n${soul}\\n</situation_soul>`;\n\t}\n\n\tprivate _buildSelfModificationPrompt(): string | undefined {\n\t\tconst settings = this.deps.getSettingsManager().getSelfModificationSettings();\n\t\tif (!settings.enabled) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\t// Resolve from an ordered candidate list first (portable WSL/Termux switching\n\t\t// from settings alone), then fall back to the legacy single sourcePath.\n\t\tconst rawCandidates = [\n\t\t\t...(Array.isArray(settings.sourcePaths) ? settings.sourcePaths : []),\n\t\t\t...(settings.sourcePath ? [settings.sourcePath] : []),\n\t\t]\n\t\t\t.map((candidate) => candidate?.trim())\n\t\t\t.filter((candidate): candidate is string => Boolean(candidate));\n\n\t\tif (rawCandidates.length === 0) {\n\t\t\treturn `Pi self-modification guardrails (local setting active, source missing):\n- Self-modification is enabled, but no \\`selfModification.sourcePaths\\`/\\`selfModification.sourcePath\\` value is set.\n- Do not modify Pi core or runtime output. Ask the user to set \\`selfModification.sourcePaths\\` to the pi-adaptative source checkout before proceeding.`;\n\t\t}\n\n\t\tconst resolvedCandidates = rawCandidates.map((candidate) =>\n\t\t\tresolvePath(candidate, this.deps.getCwd(), { trim: true }),\n\t\t);\n\t\tconst sourcePath =\n\t\t\tresolvedCandidates.find(\n\t\t\t\t(candidate) => existsSync(candidate) && existsSync(resolvePath(\"package.json\", candidate)),\n\t\t\t) ?? resolvedCandidates[0];\n\t\tconst sourceLooksValid = existsSync(sourcePath) && existsSync(resolvePath(\"package.json\", sourcePath));\n\t\tconst sourceStatus = sourceLooksValid\n\t\t\t? sourcePath\n\t\t\t: `${sourcePath} (missing or not a source checkout; ask the user to correct \\`selfModification.sourcePaths\\` before editing)`;\n\t\tconst autonomy = this.deps.getSettingsManager().getAutonomySettings();\n\t\tconst settingsGate =\n\t\t\tautonomy.mode === \"full\"\n\t\t\t\t? \"In autonomy.mode=full, autonomy/autoLearn setting tuning is covered by the standing autonomy grant; ask before changing credentials, provider auth, package sources, or unrelated preferences.\"\n\t\t\t\t: \"Ask for explicit approval before changing global settings.\";\n\t\treturn `Pi self-modification guardrails (local setting active):\n- Authorized pi-adaptative source path: ${sourceStatus}\n- Only modify Pi core/harness source under the authorized source path; never patch installed node_modules or generated runtime output as the source of truth.\n- Before changing Pi itself, restate the objective and scope, inspect relevant source/docs/examples, and make the smallest auditable change.\n- Preserve user changes: check git status before and after, avoid unrelated edits, and do not overwrite concurrent work.\n- Validate with focused tests and broader checks proportional to risk before claiming success.\n- Reload/restart/renew only after source changes are saved and auditable.\n- ${settingsGate}\n- Always ask for explicit approval before publishing, pushing, tagging, or releasing.`;\n\t}\n\n\tprivate _buildAutonomyPrompt(): string | undefined {\n\t\tconst autoLearn = this.deps.getSettingsManager().getAutoLearnSettings();\n\t\tconst autonomy = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (!autoLearn.enabled && autonomy.mode !== \"full\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst reflection = autoLearn.reflectionReview ?? autonomy.mode !== \"off\";\n\t\tconst model = autoLearn.model?.trim() || \"active\";\n\t\tif (autonomy.mode === \"full\") {\n\t\t\treturn `Pi autonomy policy (mode full, standing autonomy):\n- Setting-authorized background learners may run after long sessions or corrective/complex turns using model ${model}; they may act without asking first inside this standing grant.\n- Standing grant: write high-confidence durable memory, create/patch user/project skills, create/patch small user/project extensions/tools, tune autonomy/autoLearn settings, edit the authorized selfModification.sourcePath, run validation, and leave audit/rollback evidence.\n- Hard stops still require explicit foreground approval: publish/npm release, git push, tag creation, credential/provider-auth changes, destructive user-data deletion, network-exposed services, or expanding authority beyond this policy.\n- Treat current-turn evidence as a cue, not proof; prefer deterministic or longitudinal corroboration for durable behavior changes.\n- Active-task work remains primary: autonomy runs must not interrupt user-visible execution or claim task completion without evidence.`;\n\t\t}\n\t\treturn `Pi autonomy policy (mode ${autonomy.mode}):\n- Setting-authorized background learners may run after long sessions${reflection ? \" or corrective/complex turns\" : \"\"} using model ${model}.\n- Background learning may query durable memory and run bounded learning tools.\n- Auto-apply is limited to high-confidence durable memory when explicitly configured; tooling, skill, prompt, extension, settings, and core-source changes stay proposal/approval-gated.\n- Treat current-turn evidence as a cue, not proof; prefer longitudinal corroboration before changing durable behavior.\n- Active-task work remains primary: learning runs must not interrupt user-visible execution or claim task completion.`;\n\t}\n\n\tprivate _buildSystemPromptOptionsForToolNames(toolNames: string[]): BuildSystemPromptOptions {\n\t\tconst validToolNames = toolNames.filter((name) => this.deps.hasTool(name));\n\t\tconst toolSnippets: Record<string, string> = {};\n\t\tconst promptGuidelines: string[] = [];\n\t\tfor (const name of validToolNames) {\n\t\t\tconst snippet = this.deps.getToolPromptSnippet(name);\n\t\t\tif (snippet) {\n\t\t\t\ttoolSnippets[name] = snippet;\n\t\t\t}\n\n\t\t\tconst toolGuidelines = this.deps.getToolPromptGuidelines(name);\n\t\t\tif (toolGuidelines) {\n\t\t\t\tpromptGuidelines.push(...toolGuidelines);\n\t\t\t}\n\t\t}\n\n\t\tconst loaderSystemPrompt = this.deps.getResourceLoader().getSystemPrompt();\n\t\tconst loaderAppendSystemPrompt = this.deps.getResourceLoader().getAppendSystemPrompt();\n\t\tconst appendSystemPromptParts = [\n\t\t\t// R6: situational soul — the active profile's identity prefix, switched atomically with the\n\t\t\t// profile's capabilities/model. Most prominent, so it comes first.\n\t\t\tthis._buildSituationSoulPrompt(),\n\t\t\t// Always-on untrusted-content boundary contract (gives the <untrusted_content> fences meaning).\n\t\t\tUNTRUSTED_BOUNDARY_SYSTEM_RULE,\n\t\t\tthis._buildSelfModificationPrompt(),\n\t\t\tthis._buildAutonomyPrompt(),\n\t\t\t// Memory subsystem: static, frozen-per-session block (e.g. file-store MEMORY.md/USER.md).\n\t\t\tthis.deps.getMemoryManager().buildSystemPromptBlock() || undefined,\n\t\t\t...loaderAppendSystemPrompt,\n\t\t].filter((part): part is string => Boolean(part));\n\t\tconst appendSystemPrompt = appendSystemPromptParts.length > 0 ? appendSystemPromptParts.join(\"\\n\\n\") : undefined;\n\t\t// Only surface skills the active profile permits — the agent must not be told about (or able\n\t\t// to invoke) a skill its profile blocks.\n\t\tconst loadedSkills = this.deps.getResourceLoader().getActiveSkills();\n\t\tconst loadedContextFiles = this.deps.getResourceLoader().getAgentsFiles().agentsFiles;\n\n\t\treturn {\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tskills: loadedSkills,\n\t\t\tcontextFiles: loadedContextFiles,\n\t\t\tcustomPrompt: loaderSystemPrompt,\n\t\t\tappendSystemPrompt,\n\t\t\tselectedTools: validToolNames,\n\t\t\ttoolSnippets,\n\t\t\tpromptGuidelines,\n\t\t\textensions: [...this.deps.getActiveExtensions()],\n\t\t};\n\t}\n\n\trebuildSystemPrompt(toolNames: string[]): string {\n\t\tthis._baseSystemPromptOptions = this._buildSystemPromptOptionsForToolNames(toolNames);\n\t\treturn buildSystemPrompt(this._baseSystemPromptOptions);\n\t}\n\n\t/**\n\t * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt\n\t * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,\n\t * so it must also receive a system prompt whose tool guidelines/snippets match that filtered\n\t * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which\n\t * later turns and extension events read).\n\t */\n\tbuildSystemPromptForToolNames(toolNames: string[]): string {\n\t\treturn buildSystemPrompt(this._buildSystemPromptOptionsForToolNames(toolNames));\n\t}\n}\n"]}

package/dist/core/system-prompt-builder.js

@@ -0,0 +1,181 @@
+/**
+ * Session system-prompt construction.
+ *
+ * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the assembly of the
+ * session's base system prompt from live session state — the active profile's situational soul, the
+ * self-modification and autonomy guardrail blocks, the memory block, the loader's custom/append
+ * prompts, and the per-tool snippet/guideline surface — into the {@link BuildSystemPromptOptions}
+ * that the pure {@link buildSystemPrompt} renderer (core/system-prompt.ts, a different job: the
+ * stateless string builder) consumes. Holds the last-built `_baseSystemPromptOptions` so a
+ * before_agent_start extension hook can read it. Takes narrow accessor deps (each read fresh, since
+ * several collaborators — tool registries, memory manager, extension runner — are reassigned across
+ * the session lifecycle) rather than the whole AgentSession.
+ */
+import { existsSync } from "node:fs";
+import { resolvePath } from "../utils/paths.js";
+import { UNTRUSTED_BOUNDARY_SYSTEM_RULE } from "./security/untrusted-boundary.js";
+import { buildSystemPrompt } from "./system-prompt.js";
+export class SystemPromptBuilder {
+    deps;
+    _baseSystemPromptOptions;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** The options used to render the last base prompt — read by a before_agent_start extension hook. */
+    getBaseSystemPromptOptions() {
+        return this._baseSystemPromptOptions;
+    }
+    normalizePromptSnippet(text) {
+        if (!text)
+            return undefined;
+        const oneLine = text
+            .replace(/[\r\n]+/g, " ")
+            .replace(/\s+/g, " ")
+            .trim();
+        return oneLine.length > 0 ? oneLine : undefined;
+    }
+    normalizePromptGuidelines(guidelines) {
+        if (!guidelines || guidelines.length === 0) {
+            return [];
+        }
+        const unique = new Set();
+        for (const guideline of guidelines) {
+            const normalized = guideline.trim();
+            if (normalized.length > 0) {
+                unique.add(normalized);
+            }
+        }
+        return Array.from(unique);
+    }
+    /**
+     * R6: the active profile's situational soul, wrapped so the model reads it as its identity for this
+     * situation. Empty when no active profile defines a soul.
+     */
+    _buildSituationSoulPrompt() {
+        const soul = this.deps.getSettingsManager().getActiveProfileSoul();
+        if (!soul)
+            return undefined;
+        return `<situation_soul>\n${soul}\n</situation_soul>`;
+    }
+    _buildSelfModificationPrompt() {
+        const settings = this.deps.getSettingsManager().getSelfModificationSettings();
+        if (!settings.enabled) {
+            return undefined;
+        }
+        // Resolve from an ordered candidate list first (portable WSL/Termux switching
+        // from settings alone), then fall back to the legacy single sourcePath.
+        const rawCandidates = [
+            ...(Array.isArray(settings.sourcePaths) ? settings.sourcePaths : []),
+            ...(settings.sourcePath ? [settings.sourcePath] : []),
+        ]
+            .map((candidate) => candidate?.trim())
+            .filter((candidate) => Boolean(candidate));
+        if (rawCandidates.length === 0) {
+            return `Pi self-modification guardrails (local setting active, source missing):
+- Self-modification is enabled, but no \`selfModification.sourcePaths\`/\`selfModification.sourcePath\` value is set.
+- Do not modify Pi core or runtime output. Ask the user to set \`selfModification.sourcePaths\` to the pi-adaptative source checkout before proceeding.`;
+        }
+        const resolvedCandidates = rawCandidates.map((candidate) => resolvePath(candidate, this.deps.getCwd(), { trim: true }));
+        const sourcePath = resolvedCandidates.find((candidate) => existsSync(candidate) && existsSync(resolvePath("package.json", candidate))) ?? resolvedCandidates[0];
+        const sourceLooksValid = existsSync(sourcePath) && existsSync(resolvePath("package.json", sourcePath));
+        const sourceStatus = sourceLooksValid
+            ? sourcePath
+            : `${sourcePath} (missing or not a source checkout; ask the user to correct \`selfModification.sourcePaths\` before editing)`;
+        const autonomy = this.deps.getSettingsManager().getAutonomySettings();
+        const settingsGate = autonomy.mode === "full"
+            ? "In autonomy.mode=full, autonomy/autoLearn setting tuning is covered by the standing autonomy grant; ask before changing credentials, provider auth, package sources, or unrelated preferences."
+            : "Ask for explicit approval before changing global settings.";
+        return `Pi self-modification guardrails (local setting active):
+- Authorized pi-adaptative source path: ${sourceStatus}
+- Only modify Pi core/harness source under the authorized source path; never patch installed node_modules or generated runtime output as the source of truth.
+- Before changing Pi itself, restate the objective and scope, inspect relevant source/docs/examples, and make the smallest auditable change.
+- Preserve user changes: check git status before and after, avoid unrelated edits, and do not overwrite concurrent work.
+- Validate with focused tests and broader checks proportional to risk before claiming success.
+- Reload/restart/renew only after source changes are saved and auditable.
+- ${settingsGate}
+- Always ask for explicit approval before publishing, pushing, tagging, or releasing.`;
+    }
+    _buildAutonomyPrompt() {
+        const autoLearn = this.deps.getSettingsManager().getAutoLearnSettings();
+        const autonomy = this.deps.getSettingsManager().getAutonomySettings();
+        if (!autoLearn.enabled && autonomy.mode !== "full") {
+            return undefined;
+        }
+        const reflection = autoLearn.reflectionReview ?? autonomy.mode !== "off";
+        const model = autoLearn.model?.trim() || "active";
+        if (autonomy.mode === "full") {
+            return `Pi autonomy policy (mode full, standing autonomy):
+- Setting-authorized background learners may run after long sessions or corrective/complex turns using model ${model}; they may act without asking first inside this standing grant.
+- Standing grant: write high-confidence durable memory, create/patch user/project skills, create/patch small user/project extensions/tools, tune autonomy/autoLearn settings, edit the authorized selfModification.sourcePath, run validation, and leave audit/rollback evidence.
+- Hard stops still require explicit foreground approval: publish/npm release, git push, tag creation, credential/provider-auth changes, destructive user-data deletion, network-exposed services, or expanding authority beyond this policy.
+- Treat current-turn evidence as a cue, not proof; prefer deterministic or longitudinal corroboration for durable behavior changes.
+- Active-task work remains primary: autonomy runs must not interrupt user-visible execution or claim task completion without evidence.`;
+        }
+        return `Pi autonomy policy (mode ${autonomy.mode}):
+- Setting-authorized background learners may run after long sessions${reflection ? " or corrective/complex turns" : ""} using model ${model}.
+- Background learning may query durable memory and run bounded learning tools.
+- Auto-apply is limited to high-confidence durable memory when explicitly configured; tooling, skill, prompt, extension, settings, and core-source changes stay proposal/approval-gated.
+- Treat current-turn evidence as a cue, not proof; prefer longitudinal corroboration before changing durable behavior.
+- Active-task work remains primary: learning runs must not interrupt user-visible execution or claim task completion.`;
+    }
+    _buildSystemPromptOptionsForToolNames(toolNames) {
+        const validToolNames = toolNames.filter((name) => this.deps.hasTool(name));
+        const toolSnippets = {};
+        const promptGuidelines = [];
+        for (const name of validToolNames) {
+            const snippet = this.deps.getToolPromptSnippet(name);
+            if (snippet) {
+                toolSnippets[name] = snippet;
+            }
+            const toolGuidelines = this.deps.getToolPromptGuidelines(name);
+            if (toolGuidelines) {
+                promptGuidelines.push(...toolGuidelines);
+            }
+        }
+        const loaderSystemPrompt = this.deps.getResourceLoader().getSystemPrompt();
+        const loaderAppendSystemPrompt = this.deps.getResourceLoader().getAppendSystemPrompt();
+        const appendSystemPromptParts = [
+            // R6: situational soul — the active profile's identity prefix, switched atomically with the
+            // profile's capabilities/model. Most prominent, so it comes first.
+            this._buildSituationSoulPrompt(),
+            // Always-on untrusted-content boundary contract (gives the <untrusted_content> fences meaning).
+            UNTRUSTED_BOUNDARY_SYSTEM_RULE,
+            this._buildSelfModificationPrompt(),
+            this._buildAutonomyPrompt(),
+            // Memory subsystem: static, frozen-per-session block (e.g. file-store MEMORY.md/USER.md).
+            this.deps.getMemoryManager().buildSystemPromptBlock() || undefined,
+            ...loaderAppendSystemPrompt,
+        ].filter((part) => Boolean(part));
+        const appendSystemPrompt = appendSystemPromptParts.length > 0 ? appendSystemPromptParts.join("\n\n") : undefined;
+        // Only surface skills the active profile permits — the agent must not be told about (or able
+        // to invoke) a skill its profile blocks.
+        const loadedSkills = this.deps.getResourceLoader().getActiveSkills();
+        const loadedContextFiles = this.deps.getResourceLoader().getAgentsFiles().agentsFiles;
+        return {
+            cwd: this.deps.getCwd(),
+            skills: loadedSkills,
+            contextFiles: loadedContextFiles,
+            customPrompt: loaderSystemPrompt,
+            appendSystemPrompt,
+            selectedTools: validToolNames,
+            toolSnippets,
+            promptGuidelines,
+            extensions: [...this.deps.getActiveExtensions()],
+        };
+    }
+    rebuildSystemPrompt(toolNames) {
+        this._baseSystemPromptOptions = this._buildSystemPromptOptionsForToolNames(toolNames);
+        return buildSystemPrompt(this._baseSystemPromptOptions);
+    }
+    /**
+     * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt
+     * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,
+     * so it must also receive a system prompt whose tool guidelines/snippets match that filtered
+     * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which
+     * later turns and extension events read).
+     */
+    buildSystemPromptForToolNames(toolNames) {
+        return buildSystemPrompt(this._buildSystemPromptOptionsForToolNames(toolNames));
+    }
+}
+//# sourceMappingURL=system-prompt-builder.js.map

package/dist/core/system-prompt-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-prompt-builder.js","sourceRoot":"","sources":["../../src/core/system-prompt-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,OAAO,EAAE,8BAA8B,EAAE,MAAM,kCAAkC,CAAC;AAElF,OAAO,EAAiC,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAqBtF,MAAM,OAAO,mBAAmB;IACd,IAAI,CAA0B;IACvC,wBAAwB,CAA4B;IAE5D,YAAY,IAA6B,EAAE;QAC1C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;IAED,uGAAqG;IACrG,0BAA0B,GAA6B;QACtD,OAAO,IAAI,CAAC,wBAAwB,CAAC;IAAA,CACrC;IAED,sBAAsB,CAAC,IAAwB,EAAsB;QACpE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI;aAClB,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC;aACxB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;aACpB,IAAI,EAAE,CAAC;QACT,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAAA,CAChD;IAED,yBAAyB,CAAC,UAAgC,EAAY;QACrE,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;QACjC,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;YACpC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACxB,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAAA,CAC1B;IAED;;;OAGG;IACK,yBAAyB,GAAuB;QACvD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,CAAC;QACnE,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,OAAO,qBAAqB,IAAI,qBAAqB,CAAC;IAAA,CACtD;IAEO,4BAA4B,GAAuB;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,2BAA2B,EAAE,CAAC;QAC9E,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,8EAA8E;QAC9E,wEAAwE;QACxE,MAAM,aAAa,GAAG;YACrB,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD;aACC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;aACrC,MAAM,CAAC,CAAC,SAAS,EAAuB,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;QAEjE,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO;;wJAE8I,CAAC;QACvJ,CAAC;QAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAC1D,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAC1D,CAAC;QACF,MAAM,UAAU,GACf,kBAAkB,CAAC,IAAI,CACtB,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC,CAC1F,IAAI,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,gBAAgB,GAAG,UAAU,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,WAAW,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;QACvG,MAAM,YAAY,GAAG,gBAAgB;YACpC,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,GAAG,UAAU,8GAA8G,CAAC;QAC/H,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACtE,MAAM,YAAY,GACjB,QAAQ,CAAC,IAAI,KAAK,MAAM;YACvB,CAAC,CAAC,gMAAgM;YAClM,CAAC,CAAC,4DAA4D,CAAC;QACjE,OAAO;0CACiC,YAAY;;;;;;IAMlD,YAAY;sFACsE,CAAC;IAAA,CACrF;IAEO,oBAAoB,GAAuB;QAClD,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,oBAAoB,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,mBAAmB,EAAE,CAAC;QACtE,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YACpD,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,IAAI,QAAQ,CAAC,IAAI,KAAK,KAAK,CAAC;QACzE,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,QAAQ,CAAC;QAClD,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO;+GACqG,KAAK;;;;uIAImB,CAAC;QACtI,CAAC;QACD,OAAO,4BAA4B,QAAQ,CAAC,IAAI;sEACoB,UAAU,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,EAAE,gBAAgB,KAAK;;;;sHAIrB,CAAC;IAAA,CACrH;IAEO,qCAAqC,CAAC,SAAmB,EAA4B;QAC5F,MAAM,cAAc,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3E,MAAM,YAAY,GAA2B,EAAE,CAAC;QAChD,MAAM,gBAAgB,GAAa,EAAE,CAAC;QACtC,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,OAAO,EAAE,CAAC;gBACb,YAAY,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC;YAC9B,CAAC;YAED,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAC/D,IAAI,cAAc,EAAE,CAAC;gBACpB,gBAAgB,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC;YAC1C,CAAC;QACF,CAAC;QAED,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,CAAC;QAC3E,MAAM,wBAAwB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,qBAAqB,EAAE,CAAC;QACvF,MAAM,uBAAuB,GAAG;YAC/B,8FAA4F;YAC5F,mEAAmE;YACnE,IAAI,CAAC,yBAAyB,EAAE;YAChC,gGAAgG;YAChG,8BAA8B;YAC9B,IAAI,CAAC,4BAA4B,EAAE;YACnC,IAAI,CAAC,oBAAoB,EAAE;YAC3B,0FAA0F;YAC1F,IAAI,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC,sBAAsB,EAAE,IAAI,SAAS;YAClE,GAAG,wBAAwB;SAC3B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,MAAM,kBAAkB,GAAG,uBAAuB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjH,+FAA6F;QAC7F,yCAAyC;QACzC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrE,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC,cAAc,EAAE,CAAC,WAAW,CAAC;QAEtF,OAAO;YACN,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACvB,MAAM,EAAE,YAAY;YACpB,YAAY,EAAE,kBAAkB;YAChC,YAAY,EAAE,kBAAkB;YAChC,kBAAkB;YAClB,aAAa,EAAE,cAAc;YAC7B,YAAY;YACZ,gBAAgB;YAChB,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;SAChD,CAAC;IAAA,CACF;IAED,mBAAmB,CAAC,SAAmB,EAAU;QAChD,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC,qCAAqC,CAAC,SAAS,CAAC,CAAC;QACtF,OAAO,iBAAiB,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IAAA,CACxD;IAED;;;;;;OAMG;IACH,6BAA6B,CAAC,SAAmB,EAAU;QAC1D,OAAO,iBAAiB,CAAC,IAAI,CAAC,qCAAqC,CAAC,SAAS,CAAC,CAAC,CAAC;IAAA,CAChF;CACD","sourcesContent":["/**\n * Session system-prompt construction.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Owns the assembly of the\n * session's base system prompt from live session state — the active profile's situational soul, the\n * self-modification and autonomy guardrail blocks, the memory block, the loader's custom/append\n * prompts, and the per-tool snippet/guideline surface — into the {@link BuildSystemPromptOptions}\n * that the pure {@link buildSystemPrompt} renderer (core/system-prompt.ts, a different job: the\n * stateless string builder) consumes. Holds the last-built `_baseSystemPromptOptions` so a\n * before_agent_start extension hook can read it. Takes narrow accessor deps (each read fresh, since\n * several collaborators — tool registries, memory manager, extension runner — are reassigned across\n * the session lifecycle) rather than the whole AgentSession.\n */\n\nimport { existsSync } from \"node:fs\";\nimport { resolvePath } from \"../utils/paths.ts\";\nimport type { Extension } from \"./extensions/types.ts\";\nimport type { MemoryManager } from \"./memory/memory-manager.ts\";\nimport type { ResourceLoader } from \"./resource-loader.ts\";\nimport { UNTRUSTED_BOUNDARY_SYSTEM_RULE } from \"./security/untrusted-boundary.ts\";\nimport type { SettingsManager } from \"./settings-manager.ts\";\nimport { type BuildSystemPromptOptions, buildSystemPrompt } from \"./system-prompt.ts\";\n\nexport interface SystemPromptBuilderDeps {\n\t/** The session's working directory (read fresh; base for self-modification source resolution). */\n\tgetCwd(): string;\n\t/** The session's settings manager — soul, self-modification, autonomy, and auto-learn settings. */\n\tgetSettingsManager(): SettingsManager;\n\t/** The session's resource loader — custom/append system prompts, active skills, agents files. */\n\tgetResourceLoader(): ResourceLoader;\n\t/** The session's memory manager — the static, frozen-per-session memory system-prompt block. */\n\tgetMemoryManager(): MemoryManager;\n\t/** Whether a tool name is currently registered on the session. */\n\thasTool(name: string): boolean;\n\t/** The one-line prompt snippet registered for a tool, if any. */\n\tgetToolPromptSnippet(name: string): string | undefined;\n\t/** The extra guideline bullets registered for a tool, if any. */\n\tgetToolPromptGuidelines(name: string): string[] | undefined;\n\t/** The session's currently active extensions. */\n\tgetActiveExtensions(): ReadonlyArray<Extension>;\n}\n\nexport class SystemPromptBuilder {\n\tprivate readonly deps: SystemPromptBuilderDeps;\n\tprivate _baseSystemPromptOptions!: BuildSystemPromptOptions;\n\n\tconstructor(deps: SystemPromptBuilderDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\t/** The options used to render the last base prompt — read by a before_agent_start extension hook. */\n\tgetBaseSystemPromptOptions(): BuildSystemPromptOptions {\n\t\treturn this._baseSystemPromptOptions;\n\t}\n\n\tnormalizePromptSnippet(text: string | undefined): string | undefined {\n\t\tif (!text) return undefined;\n\t\tconst oneLine = text\n\t\t\t.replace(/[\\r\\n]+/g, \" \")\n\t\t\t.replace(/\\s+/g, \" \")\n\t\t\t.trim();\n\t\treturn oneLine.length > 0 ? oneLine : undefined;\n\t}\n\n\tnormalizePromptGuidelines(guidelines: string[] | undefined): string[] {\n\t\tif (!guidelines || guidelines.length === 0) {\n\t\t\treturn [];\n\t\t}\n\n\t\tconst unique = new Set<string>();\n\t\tfor (const guideline of guidelines) {\n\t\t\tconst normalized = guideline.trim();\n\t\t\tif (normalized.length > 0) {\n\t\t\t\tunique.add(normalized);\n\t\t\t}\n\t\t}\n\t\treturn Array.from(unique);\n\t}\n\n\t/**\n\t * R6: the active profile's situational soul, wrapped so the model reads it as its identity for this\n\t * situation. Empty when no active profile defines a soul.\n\t */\n\tprivate _buildSituationSoulPrompt(): string | undefined {\n\t\tconst soul = this.deps.getSettingsManager().getActiveProfileSoul();\n\t\tif (!soul) return undefined;\n\t\treturn `<situation_soul>\\n${soul}\\n</situation_soul>`;\n\t}\n\n\tprivate _buildSelfModificationPrompt(): string | undefined {\n\t\tconst settings = this.deps.getSettingsManager().getSelfModificationSettings();\n\t\tif (!settings.enabled) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\t// Resolve from an ordered candidate list first (portable WSL/Termux switching\n\t\t// from settings alone), then fall back to the legacy single sourcePath.\n\t\tconst rawCandidates = [\n\t\t\t...(Array.isArray(settings.sourcePaths) ? settings.sourcePaths : []),\n\t\t\t...(settings.sourcePath ? [settings.sourcePath] : []),\n\t\t]\n\t\t\t.map((candidate) => candidate?.trim())\n\t\t\t.filter((candidate): candidate is string => Boolean(candidate));\n\n\t\tif (rawCandidates.length === 0) {\n\t\t\treturn `Pi self-modification guardrails (local setting active, source missing):\n- Self-modification is enabled, but no \\`selfModification.sourcePaths\\`/\\`selfModification.sourcePath\\` value is set.\n- Do not modify Pi core or runtime output. Ask the user to set \\`selfModification.sourcePaths\\` to the pi-adaptative source checkout before proceeding.`;\n\t\t}\n\n\t\tconst resolvedCandidates = rawCandidates.map((candidate) =>\n\t\t\tresolvePath(candidate, this.deps.getCwd(), { trim: true }),\n\t\t);\n\t\tconst sourcePath =\n\t\t\tresolvedCandidates.find(\n\t\t\t\t(candidate) => existsSync(candidate) && existsSync(resolvePath(\"package.json\", candidate)),\n\t\t\t) ?? resolvedCandidates[0];\n\t\tconst sourceLooksValid = existsSync(sourcePath) && existsSync(resolvePath(\"package.json\", sourcePath));\n\t\tconst sourceStatus = sourceLooksValid\n\t\t\t? sourcePath\n\t\t\t: `${sourcePath} (missing or not a source checkout; ask the user to correct \\`selfModification.sourcePaths\\` before editing)`;\n\t\tconst autonomy = this.deps.getSettingsManager().getAutonomySettings();\n\t\tconst settingsGate =\n\t\t\tautonomy.mode === \"full\"\n\t\t\t\t? \"In autonomy.mode=full, autonomy/autoLearn setting tuning is covered by the standing autonomy grant; ask before changing credentials, provider auth, package sources, or unrelated preferences.\"\n\t\t\t\t: \"Ask for explicit approval before changing global settings.\";\n\t\treturn `Pi self-modification guardrails (local setting active):\n- Authorized pi-adaptative source path: ${sourceStatus}\n- Only modify Pi core/harness source under the authorized source path; never patch installed node_modules or generated runtime output as the source of truth.\n- Before changing Pi itself, restate the objective and scope, inspect relevant source/docs/examples, and make the smallest auditable change.\n- Preserve user changes: check git status before and after, avoid unrelated edits, and do not overwrite concurrent work.\n- Validate with focused tests and broader checks proportional to risk before claiming success.\n- Reload/restart/renew only after source changes are saved and auditable.\n- ${settingsGate}\n- Always ask for explicit approval before publishing, pushing, tagging, or releasing.`;\n\t}\n\n\tprivate _buildAutonomyPrompt(): string | undefined {\n\t\tconst autoLearn = this.deps.getSettingsManager().getAutoLearnSettings();\n\t\tconst autonomy = this.deps.getSettingsManager().getAutonomySettings();\n\t\tif (!autoLearn.enabled && autonomy.mode !== \"full\") {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst reflection = autoLearn.reflectionReview ?? autonomy.mode !== \"off\";\n\t\tconst model = autoLearn.model?.trim() || \"active\";\n\t\tif (autonomy.mode === \"full\") {\n\t\t\treturn `Pi autonomy policy (mode full, standing autonomy):\n- Setting-authorized background learners may run after long sessions or corrective/complex turns using model ${model}; they may act without asking first inside this standing grant.\n- Standing grant: write high-confidence durable memory, create/patch user/project skills, create/patch small user/project extensions/tools, tune autonomy/autoLearn settings, edit the authorized selfModification.sourcePath, run validation, and leave audit/rollback evidence.\n- Hard stops still require explicit foreground approval: publish/npm release, git push, tag creation, credential/provider-auth changes, destructive user-data deletion, network-exposed services, or expanding authority beyond this policy.\n- Treat current-turn evidence as a cue, not proof; prefer deterministic or longitudinal corroboration for durable behavior changes.\n- Active-task work remains primary: autonomy runs must not interrupt user-visible execution or claim task completion without evidence.`;\n\t\t}\n\t\treturn `Pi autonomy policy (mode ${autonomy.mode}):\n- Setting-authorized background learners may run after long sessions${reflection ? \" or corrective/complex turns\" : \"\"} using model ${model}.\n- Background learning may query durable memory and run bounded learning tools.\n- Auto-apply is limited to high-confidence durable memory when explicitly configured; tooling, skill, prompt, extension, settings, and core-source changes stay proposal/approval-gated.\n- Treat current-turn evidence as a cue, not proof; prefer longitudinal corroboration before changing durable behavior.\n- Active-task work remains primary: learning runs must not interrupt user-visible execution or claim task completion.`;\n\t}\n\n\tprivate _buildSystemPromptOptionsForToolNames(toolNames: string[]): BuildSystemPromptOptions {\n\t\tconst validToolNames = toolNames.filter((name) => this.deps.hasTool(name));\n\t\tconst toolSnippets: Record<string, string> = {};\n\t\tconst promptGuidelines: string[] = [];\n\t\tfor (const name of validToolNames) {\n\t\t\tconst snippet = this.deps.getToolPromptSnippet(name);\n\t\t\tif (snippet) {\n\t\t\t\ttoolSnippets[name] = snippet;\n\t\t\t}\n\n\t\t\tconst toolGuidelines = this.deps.getToolPromptGuidelines(name);\n\t\t\tif (toolGuidelines) {\n\t\t\t\tpromptGuidelines.push(...toolGuidelines);\n\t\t\t}\n\t\t}\n\n\t\tconst loaderSystemPrompt = this.deps.getResourceLoader().getSystemPrompt();\n\t\tconst loaderAppendSystemPrompt = this.deps.getResourceLoader().getAppendSystemPrompt();\n\t\tconst appendSystemPromptParts = [\n\t\t\t// R6: situational soul — the active profile's identity prefix, switched atomically with the\n\t\t\t// profile's capabilities/model. Most prominent, so it comes first.\n\t\t\tthis._buildSituationSoulPrompt(),\n\t\t\t// Always-on untrusted-content boundary contract (gives the <untrusted_content> fences meaning).\n\t\t\tUNTRUSTED_BOUNDARY_SYSTEM_RULE,\n\t\t\tthis._buildSelfModificationPrompt(),\n\t\t\tthis._buildAutonomyPrompt(),\n\t\t\t// Memory subsystem: static, frozen-per-session block (e.g. file-store MEMORY.md/USER.md).\n\t\t\tthis.deps.getMemoryManager().buildSystemPromptBlock() || undefined,\n\t\t\t...loaderAppendSystemPrompt,\n\t\t].filter((part): part is string => Boolean(part));\n\t\tconst appendSystemPrompt = appendSystemPromptParts.length > 0 ? appendSystemPromptParts.join(\"\\n\\n\") : undefined;\n\t\t// Only surface skills the active profile permits — the agent must not be told about (or able\n\t\t// to invoke) a skill its profile blocks.\n\t\tconst loadedSkills = this.deps.getResourceLoader().getActiveSkills();\n\t\tconst loadedContextFiles = this.deps.getResourceLoader().getAgentsFiles().agentsFiles;\n\n\t\treturn {\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tskills: loadedSkills,\n\t\t\tcontextFiles: loadedContextFiles,\n\t\t\tcustomPrompt: loaderSystemPrompt,\n\t\t\tappendSystemPrompt,\n\t\t\tselectedTools: validToolNames,\n\t\t\ttoolSnippets,\n\t\t\tpromptGuidelines,\n\t\t\textensions: [...this.deps.getActiveExtensions()],\n\t\t};\n\t}\n\n\trebuildSystemPrompt(toolNames: string[]): string {\n\t\tthis._baseSystemPromptOptions = this._buildSystemPromptOptionsForToolNames(toolNames);\n\t\treturn buildSystemPrompt(this._baseSystemPromptOptions);\n\t}\n\n\t/**\n\t * Build a system prompt for a specific tool surface WITHOUT touching the session's base prompt\n\t * state. Used for a router-swapped turn (G4): the routed model runs against a filtered tool set,\n\t * so it must also receive a system prompt whose tool guidelines/snippets match that filtered\n\t * surface — but the change is per-turn, so it must not mutate `_baseSystemPromptOptions` (which\n\t * later turns and extension events read).\n\t */\n\tbuildSystemPromptForToolNames(toolNames: string[]): string {\n\t\treturn buildSystemPrompt(this._buildSystemPromptOptionsForToolNames(toolNames));\n\t}\n}\n"]}

package/dist/core/tool-gate-controller.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the
+ * untrusted-content output boundary.
+ *
+ * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core
+ * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its
+ * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the
+ * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`
+ * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.
+ */
+import type { Agent } from "@caupulican/pi-agent-core";
+import type { CapabilityEnvelope, GateOutcome } from "./autonomy/contracts.ts";
+import type { ExtensionRunner } from "./extensions/index.ts";
+type BeforeToolCall = NonNullable<Agent["beforeToolCall"]>;
+type AfterToolCall = NonNullable<Agent["afterToolCall"]>;
+export interface ToolGateControllerDeps {
+    /** Router escalation: block a tool the active cheap route is not allowed to run. */
+    maybeEscalateToolCall(toolName: string, args: unknown): {
+        block: true;
+        reason: string;
+    } | undefined;
+    getCwd(): string;
+    /** Active foreground capability envelope, if any — presence enables gate-outcome recording. */
+    getCapabilityEnvelope(): CapabilityEnvelope | undefined;
+    /** Record an autonomy gate outcome (only when a capability envelope is active). */
+    recordGateOutcome(outcome: GateOutcome): void;
+    getExtensionRunner(): ExtensionRunner;
+}
+export declare class ToolGateController {
+    private readonly deps;
+    constructor(deps: ToolGateControllerDeps);
+    readonly beforeToolCall: BeforeToolCall;
+    readonly afterToolCall: AfterToolCall;
+}
+export {};
+//# sourceMappingURL=tool-gate-controller.d.ts.map

package/dist/core/tool-gate-controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gate-controller.d.ts","sourceRoot":"","sources":["../../src/core/tool-gate-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAG7D,KAAK,cAAc,GAAG,WAAW,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;AAC3D,KAAK,aAAa,GAAG,WAAW,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;AAEzD,MAAM,WAAW,sBAAsB;IACtC,oFAAoF;IACpF,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG;QAAE,KAAK,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IACpG,MAAM,IAAI,MAAM,CAAC;IACjB,iGAA+F;IAC/F,qBAAqB,IAAI,kBAAkB,GAAG,SAAS,CAAC;IACxD,mFAAmF;IACnF,iBAAiB,CAAC,OAAO,EAAE,WAAW,GAAG,IAAI,CAAC;IAC9C,kBAAkB,IAAI,eAAe,CAAC;CACtC;AAED,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAE9C,YAAY,IAAI,EAAE,sBAAsB,EAEvC;IAED,QAAQ,CAAC,cAAc,EAAE,cAAc,CA4CrC;IAEF,QAAQ,CAAC,aAAa,EAAE,aAAa,CAsCnC;CACF","sourcesContent":["/**\n * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the\n * untrusted-content output boundary.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core\n * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its\n * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the\n * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`\n * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.\n */\n\nimport type { Agent } from \"@caupulican/pi-agent-core\";\nimport type { CapabilityEnvelope, GateOutcome } from \"./autonomy/contracts.ts\";\nimport { evaluateToolGate } from \"./autonomy/gates.ts\";\nimport type { ExtensionRunner } from \"./extensions/index.ts\";\nimport { classifyToolTrust, wrapUntrustedText } from \"./security/untrusted-boundary.ts\";\n\ntype BeforeToolCall = NonNullable<Agent[\"beforeToolCall\"]>;\ntype AfterToolCall = NonNullable<Agent[\"afterToolCall\"]>;\n\nexport interface ToolGateControllerDeps {\n\t/** Router escalation: block a tool the active cheap route is not allowed to run. */\n\tmaybeEscalateToolCall(toolName: string, args: unknown): { block: true; reason: string } | undefined;\n\tgetCwd(): string;\n\t/** Active foreground capability envelope, if any — presence enables gate-outcome recording. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Record an autonomy gate outcome (only when a capability envelope is active). */\n\trecordGateOutcome(outcome: GateOutcome): void;\n\tgetExtensionRunner(): ExtensionRunner;\n}\n\nexport class ToolGateController {\n\tprivate readonly deps: ToolGateControllerDeps;\n\n\tconstructor(deps: ToolGateControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\treadonly beforeToolCall: BeforeToolCall = async ({ toolCall, args }) => {\n\t\tconst escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);\n\t\tif (escalation) {\n\t\t\treturn escalation;\n\t\t}\n\n\t\t// Autonomy tool gating\n\t\tconst envelope = this.deps.getCapabilityEnvelope();\n\t\tconst gateResult = evaluateToolGate({\n\t\t\ttoolName: toolCall.name,\n\t\t\targs,\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tenvelope,\n\t\t});\n\n\t\tif (envelope) {\n\t\t\tthis.deps.recordGateOutcome(gateResult);\n\t\t}\n\n\t\tif (gateResult.outcome === \"block\" || gateResult.outcome === \"ask-user\") {\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,\n\t\t\t};\n\t\t}\n\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tif (!runner.hasHandlers(\"tool_call\")) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\ttry {\n\t\t\treturn await runner.emitToolCall({\n\t\t\t\ttype: \"tool_call\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tif (err instanceof Error) {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t\tthrow new Error(`Extension failed, blocking execution: ${String(err)}`);\n\t\t}\n\t};\n\n\treadonly afterToolCall: AfterToolCall = async ({ toolCall, args, result, isError }) => {\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet content = result.content;\n\t\tlet details = result.details;\n\t\tlet resolvedIsError = isError;\n\n\t\tif (runner.hasHandlers(\"tool_result\")) {\n\t\t\tconst hookResult = await runner.emitToolResult({\n\t\t\t\ttype: \"tool_result\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\tcontent,\n\t\t\t\tdetails,\n\t\t\t\tisError,\n\t\t\t});\n\t\t\tif (hookResult) {\n\t\t\t\tcontent = hookResult.content ?? content;\n\t\t\t\tdetails = hookResult.details;\n\t\t\t\tresolvedIsError = hookResult.isError ?? isError;\n\t\t\t}\n\t\t}\n\n\t\t// Untrusted-content boundary: structurally fence output from attacker-controllable sources\n\t\t// (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.\n\t\t// First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.\n\t\tif (classifyToolTrust(toolCall.name) === \"untrusted\") {\n\t\t\tconst source = `tool:${toolCall.name}`;\n\t\t\tconst wrapped = content.map((block) =>\n\t\t\t\tblock.type === \"text\" ? { ...block, text: wrapUntrustedText(block.text, source) } : block,\n\t\t\t);\n\t\t\tcontent = wrapped;\n\t\t}\n\n\t\tif (content === result.content && details === result.details && resolvedIsError === isError) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { content, details, isError: resolvedIsError };\n\t};\n}\n"]}

package/dist/core/tool-gate-controller.js

@@ -0,0 +1,94 @@
+/**
+ * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the
+ * untrusted-content output boundary.
+ *
+ * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core
+ * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its
+ * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the
+ * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`
+ * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.
+ */
+import { evaluateToolGate } from "./autonomy/gates.js";
+import { classifyToolTrust, wrapUntrustedText } from "./security/untrusted-boundary.js";
+export class ToolGateController {
+    deps;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    beforeToolCall = async ({ toolCall, args }) => {
+        const escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);
+        if (escalation) {
+            return escalation;
+        }
+        // Autonomy tool gating
+        const envelope = this.deps.getCapabilityEnvelope();
+        const gateResult = evaluateToolGate({
+            toolName: toolCall.name,
+            args,
+            cwd: this.deps.getCwd(),
+            envelope,
+        });
+        if (envelope) {
+            this.deps.recordGateOutcome(gateResult);
+        }
+        if (gateResult.outcome === "block" || gateResult.outcome === "ask-user") {
+            return {
+                block: true,
+                reason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,
+            };
+        }
+        const runner = this.deps.getExtensionRunner();
+        if (!runner.hasHandlers("tool_call")) {
+            return undefined;
+        }
+        try {
+            return await runner.emitToolCall({
+                type: "tool_call",
+                toolName: toolCall.name,
+                toolCallId: toolCall.id,
+                input: args,
+            });
+        }
+        catch (err) {
+            if (err instanceof Error) {
+                throw err;
+            }
+            throw new Error(`Extension failed, blocking execution: ${String(err)}`);
+        }
+    };
+    afterToolCall = async ({ toolCall, args, result, isError }) => {
+        const runner = this.deps.getExtensionRunner();
+        let content = result.content;
+        let details = result.details;
+        let resolvedIsError = isError;
+        if (runner.hasHandlers("tool_result")) {
+            const hookResult = await runner.emitToolResult({
+                type: "tool_result",
+                toolName: toolCall.name,
+                toolCallId: toolCall.id,
+                input: args,
+                content,
+                details,
+                isError,
+            });
+            if (hookResult) {
+                content = hookResult.content ?? content;
+                details = hookResult.details;
+                resolvedIsError = hookResult.isError ?? isError;
+            }
+        }
+        // Untrusted-content boundary: structurally fence output from attacker-controllable sources
+        // (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.
+        // First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.
+        if (classifyToolTrust(toolCall.name) === "untrusted") {
+            const source = `tool:${toolCall.name}`;
+            const wrapped = content.map((block) => block.type === "text" ? { ...block, text: wrapUntrustedText(block.text, source) } : block);
+            content = wrapped;
+        }
+        if (content === result.content && details === result.details && resolvedIsError === isError) {
+            return undefined;
+        }
+        return { content, details, isError: resolvedIsError };
+    };
+}
+//# sourceMappingURL=tool-gate-controller.js.map

package/dist/core/tool-gate-controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-gate-controller.js","sourceRoot":"","sources":["../../src/core/tool-gate-controller.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAgBxF,MAAM,OAAO,kBAAkB;IACb,IAAI,CAAyB;IAE9C,YAAY,IAA4B,EAAE;QACzC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAAA,CACjB;IAEQ,cAAc,GAAmB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxE,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QAED,uBAAuB;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,gBAAgB,CAAC;YACnC,QAAQ,EAAE,QAAQ,CAAC,IAAI;YACvB,IAAI;YACJ,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YACvB,QAAQ;SACR,CAAC,CAAC;QAEH,IAAI,QAAQ,EAAE,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,UAAU,CAAC,OAAO,KAAK,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,EAAE,CAAC;YACzE,OAAO;gBACN,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,4CAA4C,UAAU,CAAC,IAAI,MAAM,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,UAAU,GAAG;aACxH,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,IAAI,CAAC;YACJ,OAAO,MAAM,MAAM,CAAC,YAAY,CAAC;gBAChC,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,KAAK,EAAE,IAA+B;aACtC,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;gBAC1B,MAAM,GAAG,CAAC;YACX,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzE,CAAC;IAAA,CACD,CAAC;IAEO,aAAa,GAAkB,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9C,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7B,IAAI,eAAe,GAAG,OAAO,CAAC;QAE9B,IAAI,MAAM,CAAC,WAAW,CAAC,aAAa,CAAC,EAAE,CAAC;YACvC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC;gBAC9C,IAAI,EAAE,aAAa;gBACnB,QAAQ,EAAE,QAAQ,CAAC,IAAI;gBACvB,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,KAAK,EAAE,IAA+B;gBACtC,OAAO;gBACP,OAAO;gBACP,OAAO;aACP,CAAC,CAAC;YACH,IAAI,UAAU,EAAE,CAAC;gBAChB,OAAO,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;gBACxC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC;gBAC7B,eAAe,GAAG,UAAU,CAAC,OAAO,IAAI,OAAO,CAAC;YACjD,CAAC;QACF,CAAC;QAED,2FAA2F;QAC3F,+FAA+F;QAC/F,gGAAgG;QAChG,IAAI,iBAAiB,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,WAAW,EAAE,CAAC;YACtD,MAAM,MAAM,GAAG,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CACzF,CAAC;YACF,OAAO,GAAG,OAAO,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,eAAe,KAAK,OAAO,EAAE,CAAC;YAC7F,OAAO,SAAS,CAAC;QAClB,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAAA,CACtD,CAAC;CACF","sourcesContent":["/**\n * Agent tool-call gate: model-router escalation, autonomy gating, extension tool hooks, and the\n * untrusted-content output boundary.\n *\n * Extracted verbatim from agent-session.ts (god-file decomposition). Provides the two agent-core\n * hooks (`beforeToolCall`/`afterToolCall`) as bound arrow-field members the session installs onto its\n * agent. `beforeToolCall` runs the router escalation, then the autonomy tool gate (recording the\n * outcome when a capability envelope is active), then extension `tool_call` handlers. `afterToolCall`\n * runs extension `tool_result` handlers and structurally fences output from untrusted-content sources.\n */\n\nimport type { Agent } from \"@caupulican/pi-agent-core\";\nimport type { CapabilityEnvelope, GateOutcome } from \"./autonomy/contracts.ts\";\nimport { evaluateToolGate } from \"./autonomy/gates.ts\";\nimport type { ExtensionRunner } from \"./extensions/index.ts\";\nimport { classifyToolTrust, wrapUntrustedText } from \"./security/untrusted-boundary.ts\";\n\ntype BeforeToolCall = NonNullable<Agent[\"beforeToolCall\"]>;\ntype AfterToolCall = NonNullable<Agent[\"afterToolCall\"]>;\n\nexport interface ToolGateControllerDeps {\n\t/** Router escalation: block a tool the active cheap route is not allowed to run. */\n\tmaybeEscalateToolCall(toolName: string, args: unknown): { block: true; reason: string } | undefined;\n\tgetCwd(): string;\n\t/** Active foreground capability envelope, if any — presence enables gate-outcome recording. */\n\tgetCapabilityEnvelope(): CapabilityEnvelope | undefined;\n\t/** Record an autonomy gate outcome (only when a capability envelope is active). */\n\trecordGateOutcome(outcome: GateOutcome): void;\n\tgetExtensionRunner(): ExtensionRunner;\n}\n\nexport class ToolGateController {\n\tprivate readonly deps: ToolGateControllerDeps;\n\n\tconstructor(deps: ToolGateControllerDeps) {\n\t\tthis.deps = deps;\n\t}\n\n\treadonly beforeToolCall: BeforeToolCall = async ({ toolCall, args }) => {\n\t\tconst escalation = this.deps.maybeEscalateToolCall(toolCall.name, args);\n\t\tif (escalation) {\n\t\t\treturn escalation;\n\t\t}\n\n\t\t// Autonomy tool gating\n\t\tconst envelope = this.deps.getCapabilityEnvelope();\n\t\tconst gateResult = evaluateToolGate({\n\t\t\ttoolName: toolCall.name,\n\t\t\targs,\n\t\t\tcwd: this.deps.getCwd(),\n\t\t\tenvelope,\n\t\t});\n\n\t\tif (envelope) {\n\t\t\tthis.deps.recordGateOutcome(gateResult);\n\t\t}\n\n\t\tif (gateResult.outcome === \"block\" || gateResult.outcome === \"ask-user\") {\n\t\t\treturn {\n\t\t\t\tblock: true,\n\t\t\t\treason: `Tool execution blocked by autonomy gate [${gateResult.gate}]: ${gateResult.message} (${gateResult.reasonCode})`,\n\t\t\t};\n\t\t}\n\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tif (!runner.hasHandlers(\"tool_call\")) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\ttry {\n\t\t\treturn await runner.emitToolCall({\n\t\t\t\ttype: \"tool_call\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t});\n\t\t} catch (err) {\n\t\t\tif (err instanceof Error) {\n\t\t\t\tthrow err;\n\t\t\t}\n\t\t\tthrow new Error(`Extension failed, blocking execution: ${String(err)}`);\n\t\t}\n\t};\n\n\treadonly afterToolCall: AfterToolCall = async ({ toolCall, args, result, isError }) => {\n\t\tconst runner = this.deps.getExtensionRunner();\n\t\tlet content = result.content;\n\t\tlet details = result.details;\n\t\tlet resolvedIsError = isError;\n\n\t\tif (runner.hasHandlers(\"tool_result\")) {\n\t\t\tconst hookResult = await runner.emitToolResult({\n\t\t\t\ttype: \"tool_result\",\n\t\t\t\ttoolName: toolCall.name,\n\t\t\t\ttoolCallId: toolCall.id,\n\t\t\t\tinput: args as Record<string, unknown>,\n\t\t\t\tcontent,\n\t\t\t\tdetails,\n\t\t\t\tisError,\n\t\t\t});\n\t\t\tif (hookResult) {\n\t\t\t\tcontent = hookResult.content ?? content;\n\t\t\t\tdetails = hookResult.details;\n\t\t\t\tresolvedIsError = hookResult.isError ?? isError;\n\t\t\t}\n\t\t}\n\n\t\t// Untrusted-content boundary: structurally fence output from attacker-controllable sources\n\t\t// (web/search, subagents, recall, third-party tools) so injection payloads are framed as data.\n\t\t// First-party tools (read/grep/find/ls/edit/write/bash) are trusted and pass through unchanged.\n\t\tif (classifyToolTrust(toolCall.name) === \"untrusted\") {\n\t\t\tconst source = `tool:${toolCall.name}`;\n\t\t\tconst wrapped = content.map((block) =>\n\t\t\t\tblock.type === \"text\" ? { ...block, text: wrapUntrustedText(block.text, source) } : block,\n\t\t\t);\n\t\t\tcontent = wrapped;\n\t\t}\n\n\t\tif (content === result.content && details === result.details && resolvedIsError === isError) {\n\t\t\treturn undefined;\n\t\t}\n\t\treturn { content, details, isError: resolvedIsError };\n\t};\n}\n"]}

package/dist/core/tools/artifact-retrieve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-retrieve.d.ts","sourceRoot":"","sources":["../../../src/core/tools/artifact-retrieve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAE3D,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EACN,KAAK,qBAAqB,EAG1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAO7D,QAAA,MAAM,sBAAsB;;;;EAc1B,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC3C,mGAAmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;CAC9B;AAkCD,wBAAgB,oCAAoC,CACnD,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,2BAA2B,GACnC,cAAc,CAAC,OAAO,sBAAsB,EAAE,2BAA2B,GAAG,SAAS,CAAC,CA2ExF;AAED,wBAAgB,0BAA0B,CACzC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,2BAA2B,GACnC,SAAS,CAAC,OAAO,sBAAsB,CAAC,CAE1C","sourcesContent":["import type { AgentTool } from \"@caupulican/pi-agent-core\";\nimport { Text } from \"@caupulican/pi-tui\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport {\n\ttype ArtifactRetrievalMode,\n\tDEFAULT_RETRIEVAL_MAX_LINES,\n\tretrieveArtifactSlice,\n} from \"../context/artifact-retrieval.ts\";\nimport type { ArtifactStore } from \"../context/context-artifacts.ts\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport { invalidArgText, str } from \"./render-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\nimport { formatSize } from \"./truncate.ts\";\n\nconst ARTIFACT_ID_PREFIX = \"tool-output:\";\n\nconst artifactRetrieveSchema = Type.Object({\n\tartifactId: Type.String({\n\t\tdescription:\n\t\t\t\"Artifact id from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. The 'tool-output:' prefix is optional.\",\n\t}),\n\tmode: Type.Optional(\n\t\tType.Union([Type.Literal(\"metadata\"), Type.Literal(\"head\"), Type.Literal(\"tail\")], {\n\t\t\tdescription:\n\t\t\t\t\"'metadata' for tool/path/size info only (no content); 'head' (default) for the first lines; 'tail' for the last lines.\",\n\t\t}),\n\t),\n\tmaxLines: Type.Optional(\n\t\tType.Number({ description: `Maximum lines to return for head/tail (default: ${DEFAULT_RETRIEVAL_MAX_LINES})` }),\n\t),\n});\n\nexport type ArtifactRetrieveToolInput = Static<typeof artifactRetrieveSchema>;\n\nexport interface ArtifactRetrieveToolDetails {\n\tfound: boolean;\n\tmode: ArtifactRetrievalMode;\n}\n\nexport interface ArtifactRetrieveToolOptions {\n\t/** Session-scoped artifact store to resolve ids against. Omitted: the tool reports unavailable. */\n\tartifactStore?: ArtifactStore;\n}\n\nfunction normalizeArtifactId(input: string): string {\n\treturn input.startsWith(ARTIFACT_ID_PREFIX) ? input.slice(ARTIFACT_ID_PREFIX.length) : input;\n}\n\nfunction formatMetadataText(ref: {\n\tkind: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpath?: string;\n\tbyteLength: number;\n\tlineCount?: number;\n\treproducible: boolean;\n}): string {\n\tconst lines = [\n\t\t`kind: ${ref.kind}`,\n\t\tref.toolName ? `tool: ${ref.toolName}` : undefined,\n\t\tref.command ? `command: ${ref.command}` : undefined,\n\t\tref.path ? `path: ${ref.path}` : undefined,\n\t\t`size: ${formatSize(ref.byteLength)}`,\n\t\tref.lineCount !== undefined ? `lines: ${ref.lineCount}` : undefined,\n\t\t`reproducible: ${ref.reproducible}`,\n\t];\n\treturn lines.filter((line): line is string => line !== undefined).join(\"\\n\");\n}\n\nfunction formatCall(args: { artifactId: string; mode?: string } | undefined, theme: Theme): string {\n\tconst artifactId = str(args?.artifactId);\n\tconst mode = args?.mode ?? \"head\";\n\tconst idText = artifactId === null ? invalidArgText(theme) : theme.fg(\"accent\", artifactId);\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"artifact_retrieve\"))} ${idText}${theme.fg(\"toolOutput\", ` (${mode})`)}`;\n}\n\nexport function createArtifactRetrieveToolDefinition(\n\t_cwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): ToolDefinition<typeof artifactRetrieveSchema, ArtifactRetrieveToolDetails | undefined> {\n\tconst artifactStore = options?.artifactStore;\n\treturn {\n\t\tname: \"artifact_retrieve\",\n\t\tlabel: \"artifact_retrieve\",\n\t\tdescription:\n\t\t\t\"Retrieve a bounded slice of a packed tool-output artifact by id, from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. Returns metadata, or a bounded head/tail slice -- never the full raw payload in one call.\",\n\t\tpromptSnippet: \"Retrieve a bounded slice of a packed tool-output artifact\",\n\t\tparameters: artifactRetrieveSchema,\n\t\ttoolGroup: \"explore\",\n\t\tasync execute(\n\t\t\t_toolCallId,\n\t\t\t{ artifactId, mode, maxLines }: { artifactId: string; mode?: ArtifactRetrievalMode; maxLines?: number },\n\t\t) {\n\t\t\tconst effectiveMode = mode ?? \"head\";\n\t\t\tif (!artifactStore) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: \"No artifact store is configured for this session.\" }],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst result = retrieveArtifactSlice(artifactStore, {\n\t\t\t\tartifactId: normalizeArtifactId(artifactId),\n\t\t\t\tmode,\n\t\t\t\tmaxLines,\n\t\t\t});\n\n\t\t\tif (!result.found) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `Artifact not found: ${artifactId} (${result.missingReason}). It may have been cleaned up, or the id may be incorrect.`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (result.mode === \"metadata\") {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatMetadataText(result.ref) }],\n\t\t\t\t\tdetails: { found: true, mode: \"metadata\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tlet text = result.slice;\n\t\t\tif (result.truncation.truncated) {\n\t\t\t\ttext += `\\n\\n[Showing ${result.mode} ${result.truncation.outputLines} of ${result.truncation.totalLines} lines. Full artifact: ${formatSize(result.ref.byteLength)}. Retrieve again with a different mode/maxLines for another slice.]`;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text }],\n\t\t\t\tdetails: { found: true, mode: result.mode },\n\t\t\t};\n\t\t},\n\t\trenderCall(args, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatCall(args, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\tconst content = result.content.find((part) => part.type === \"text\");\n\t\t\tconst body = content && \"text\" in content ? content.text : \"\";\n\t\t\tconst lines = body.split(\"\\n\");\n\t\t\tconst maxLines = options.expanded ? lines.length : 20;\n\t\t\tconst displayLines = lines.slice(0, maxLines);\n\t\t\tconst remaining = lines.length - maxLines;\n\t\t\tlet rendered = displayLines.map((line) => theme.fg(\"toolOutput\", line)).join(\"\\n\");\n\t\t\tif (remaining > 0) rendered += `\\n${theme.fg(\"muted\", `... (${remaining} more lines)`)}`;\n\t\t\ttext.setText(rendered);\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createArtifactRetrieveTool(\n\tcwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): AgentTool<typeof artifactRetrieveSchema> {\n\treturn wrapToolDefinition(createArtifactRetrieveToolDefinition(cwd, options));\n}\n"]}
+{"version":3,"file":"artifact-retrieve.d.ts","sourceRoot":"","sources":["../../../src/core/tools/artifact-retrieve.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAG3D,OAAO,EAAE,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EACN,KAAK,qBAAqB,EAG1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAM7D,QAAA,MAAM,sBAAsB;;;;EAc1B,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAE9E,MAAM,WAAW,2BAA2B;IAC3C,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,2BAA2B;IAC3C,mGAAmG;IACnG,aAAa,CAAC,EAAE,aAAa,CAAC;CAC9B;AAkCD,wBAAgB,oCAAoC,CACnD,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,2BAA2B,GACnC,cAAc,CAAC,OAAO,sBAAsB,EAAE,2BAA2B,GAAG,SAAS,CAAC,CA2ExF;AAED,wBAAgB,0BAA0B,CACzC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,2BAA2B,GACnC,SAAS,CAAC,OAAO,sBAAsB,CAAC,CAE1C","sourcesContent":["import type { AgentTool } from \"@caupulican/pi-agent-core\";\nimport { formatSize } from \"@caupulican/pi-agent-core/node\";\nimport { Text } from \"@caupulican/pi-tui\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport {\n\ttype ArtifactRetrievalMode,\n\tDEFAULT_RETRIEVAL_MAX_LINES,\n\tretrieveArtifactSlice,\n} from \"../context/artifact-retrieval.ts\";\nimport type { ArtifactStore } from \"../context/context-artifacts.ts\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport { invalidArgText, str } from \"./render-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst ARTIFACT_ID_PREFIX = \"tool-output:\";\n\nconst artifactRetrieveSchema = Type.Object({\n\tartifactId: Type.String({\n\t\tdescription:\n\t\t\t\"Artifact id from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. The 'tool-output:' prefix is optional.\",\n\t}),\n\tmode: Type.Optional(\n\t\tType.Union([Type.Literal(\"metadata\"), Type.Literal(\"head\"), Type.Literal(\"tail\")], {\n\t\t\tdescription:\n\t\t\t\t\"'metadata' for tool/path/size info only (no content); 'head' (default) for the first lines; 'tail' for the last lines.\",\n\t\t}),\n\t),\n\tmaxLines: Type.Optional(\n\t\tType.Number({ description: `Maximum lines to return for head/tail (default: ${DEFAULT_RETRIEVAL_MAX_LINES})` }),\n\t),\n});\n\nexport type ArtifactRetrieveToolInput = Static<typeof artifactRetrieveSchema>;\n\nexport interface ArtifactRetrieveToolDetails {\n\tfound: boolean;\n\tmode: ArtifactRetrievalMode;\n}\n\nexport interface ArtifactRetrieveToolOptions {\n\t/** Session-scoped artifact store to resolve ids against. Omitted: the tool reports unavailable. */\n\tartifactStore?: ArtifactStore;\n}\n\nfunction normalizeArtifactId(input: string): string {\n\treturn input.startsWith(ARTIFACT_ID_PREFIX) ? input.slice(ARTIFACT_ID_PREFIX.length) : input;\n}\n\nfunction formatMetadataText(ref: {\n\tkind: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpath?: string;\n\tbyteLength: number;\n\tlineCount?: number;\n\treproducible: boolean;\n}): string {\n\tconst lines = [\n\t\t`kind: ${ref.kind}`,\n\t\tref.toolName ? `tool: ${ref.toolName}` : undefined,\n\t\tref.command ? `command: ${ref.command}` : undefined,\n\t\tref.path ? `path: ${ref.path}` : undefined,\n\t\t`size: ${formatSize(ref.byteLength)}`,\n\t\tref.lineCount !== undefined ? `lines: ${ref.lineCount}` : undefined,\n\t\t`reproducible: ${ref.reproducible}`,\n\t];\n\treturn lines.filter((line): line is string => line !== undefined).join(\"\\n\");\n}\n\nfunction formatCall(args: { artifactId: string; mode?: string } | undefined, theme: Theme): string {\n\tconst artifactId = str(args?.artifactId);\n\tconst mode = args?.mode ?? \"head\";\n\tconst idText = artifactId === null ? invalidArgText(theme) : theme.fg(\"accent\", artifactId);\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"artifact_retrieve\"))} ${idText}${theme.fg(\"toolOutput\", ` (${mode})`)}`;\n}\n\nexport function createArtifactRetrieveToolDefinition(\n\t_cwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): ToolDefinition<typeof artifactRetrieveSchema, ArtifactRetrieveToolDetails | undefined> {\n\tconst artifactStore = options?.artifactStore;\n\treturn {\n\t\tname: \"artifact_retrieve\",\n\t\tlabel: \"artifact_retrieve\",\n\t\tdescription:\n\t\t\t\"Retrieve a bounded slice of a packed tool-output artifact by id, from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. Returns metadata, or a bounded head/tail slice -- never the full raw payload in one call.\",\n\t\tpromptSnippet: \"Retrieve a bounded slice of a packed tool-output artifact\",\n\t\tparameters: artifactRetrieveSchema,\n\t\ttoolGroup: \"explore\",\n\t\tasync execute(\n\t\t\t_toolCallId,\n\t\t\t{ artifactId, mode, maxLines }: { artifactId: string; mode?: ArtifactRetrievalMode; maxLines?: number },\n\t\t) {\n\t\t\tconst effectiveMode = mode ?? \"head\";\n\t\t\tif (!artifactStore) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: \"No artifact store is configured for this session.\" }],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst result = retrieveArtifactSlice(artifactStore, {\n\t\t\t\tartifactId: normalizeArtifactId(artifactId),\n\t\t\t\tmode,\n\t\t\t\tmaxLines,\n\t\t\t});\n\n\t\t\tif (!result.found) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `Artifact not found: ${artifactId} (${result.missingReason}). It may have been cleaned up, or the id may be incorrect.`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (result.mode === \"metadata\") {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatMetadataText(result.ref) }],\n\t\t\t\t\tdetails: { found: true, mode: \"metadata\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tlet text = result.slice;\n\t\t\tif (result.truncation.truncated) {\n\t\t\t\ttext += `\\n\\n[Showing ${result.mode} ${result.truncation.outputLines} of ${result.truncation.totalLines} lines. Full artifact: ${formatSize(result.ref.byteLength)}. Retrieve again with a different mode/maxLines for another slice.]`;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text }],\n\t\t\t\tdetails: { found: true, mode: result.mode },\n\t\t\t};\n\t\t},\n\t\trenderCall(args, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatCall(args, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\tconst content = result.content.find((part) => part.type === \"text\");\n\t\t\tconst body = content && \"text\" in content ? content.text : \"\";\n\t\t\tconst lines = body.split(\"\\n\");\n\t\t\tconst maxLines = options.expanded ? lines.length : 20;\n\t\t\tconst displayLines = lines.slice(0, maxLines);\n\t\t\tconst remaining = lines.length - maxLines;\n\t\t\tlet rendered = displayLines.map((line) => theme.fg(\"toolOutput\", line)).join(\"\\n\");\n\t\t\tif (remaining > 0) rendered += `\\n${theme.fg(\"muted\", `... (${remaining} more lines)`)}`;\n\t\t\ttext.setText(rendered);\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createArtifactRetrieveTool(\n\tcwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): AgentTool<typeof artifactRetrieveSchema> {\n\treturn wrapToolDefinition(createArtifactRetrieveToolDefinition(cwd, options));\n}\n"]}

package/dist/core/tools/artifact-retrieve.js

@@ -1,9 +1,9 @@
+import { formatSize } from "@caupulican/pi-agent-core/node";
 import { Text } from "@caupulican/pi-tui";
 import { Type } from "typebox";
 import { DEFAULT_RETRIEVAL_MAX_LINES, retrieveArtifactSlice, } from "../context/artifact-retrieval.js";
 import { invalidArgText, str } from "./render-utils.js";
 import { wrapToolDefinition } from "./tool-definition-wrapper.js";
-import { formatSize } from "./truncate.js";
 const ARTIFACT_ID_PREFIX = "tool-output:";
 const artifactRetrieveSchema = Type.Object({
     artifactId: Type.String({

package/dist/core/tools/artifact-retrieve.js.map

@@ -1 +1 @@
-{"version":3,"file":"artifact-retrieve.js","sourceRoot":"","sources":["../../../src/core/tools/artifact-retrieve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAEN,2BAA2B,EAC3B,qBAAqB,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAE3C,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,WAAW,EACV,sIAAsI;KACvI,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAClF,WAAW,EACV,wHAAwH;KACzH,CAAC,CACF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mDAAmD,2BAA2B,GAAG,EAAE,CAAC,CAC/G;CACD,CAAC,CAAC;AAcH,SAAS,mBAAmB,CAAC,KAAa,EAAU;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAAA,CAC7F;AAED,SAAS,kBAAkB,CAAC,GAQ3B,EAAU;IACV,MAAM,KAAK,GAAG;QACb,SAAS,GAAG,CAAC,IAAI,EAAE;QACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QAClD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QACnD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC1C,SAAS,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;QACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;QACnE,iBAAiB,GAAG,CAAC,YAAY,EAAE;KACnC,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CAC7E;AAED,SAAS,UAAU,CAAC,IAAuD,EAAE,KAAY,EAAU;IAClG,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5F,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;AAAA,CACpH;AAED,MAAM,UAAU,oCAAoC,CACnD,IAAY,EACZ,OAAqC,EACoD;IACzF,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAC7C,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACV,8OAA8O;QAC/O,aAAa,EAAE,2DAA2D;QAC1E,UAAU,EAAE,sBAAsB;QAClC,SAAS,EAAE,SAAS;QACpB,KAAK,CAAC,OAAO,CACZ,WAAW,EACX,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAA2E,EACtG;YACD,MAAM,aAAa,GAAG,IAAI,IAAI,MAAM,CAAC;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;oBACtF,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE;gBACnD,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;gBAC3C,IAAI;gBACJ,QAAQ;aACR,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO;oBACN,OAAO,EAAE;wBACR;4BACC,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,uBAAuB,UAAU,KAAK,MAAM,CAAC,aAAa,6DAA6D;yBAC7H;qBACD;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9C,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC1C,CAAC;YACH,CAAC;YAED,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;YACxB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,IAAI,gBAAgB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,0BAA0B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,qEAAqE,CAAC;YACzO,CAAC;YACD,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aAC3C,CAAC;QAAA,CACF;QACD,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;YAChC,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QAAA,CACZ;QACD,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC1C,IAAI,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,SAAS,GAAG,CAAC;gBAAE,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,SAAS,cAAc,CAAC,EAAE,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QAAA,CACZ;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,0BAA0B,CACzC,GAAW,EACX,OAAqC,EACM;IAC3C,OAAO,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,CAC9E","sourcesContent":["import type { AgentTool } from \"@caupulican/pi-agent-core\";\nimport { Text } from \"@caupulican/pi-tui\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport {\n\ttype ArtifactRetrievalMode,\n\tDEFAULT_RETRIEVAL_MAX_LINES,\n\tretrieveArtifactSlice,\n} from \"../context/artifact-retrieval.ts\";\nimport type { ArtifactStore } from \"../context/context-artifacts.ts\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport { invalidArgText, str } from \"./render-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\nimport { formatSize } from \"./truncate.ts\";\n\nconst ARTIFACT_ID_PREFIX = \"tool-output:\";\n\nconst artifactRetrieveSchema = Type.Object({\n\tartifactId: Type.String({\n\t\tdescription:\n\t\t\t\"Artifact id from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. The 'tool-output:' prefix is optional.\",\n\t}),\n\tmode: Type.Optional(\n\t\tType.Union([Type.Literal(\"metadata\"), Type.Literal(\"head\"), Type.Literal(\"tail\")], {\n\t\t\tdescription:\n\t\t\t\t\"'metadata' for tool/path/size info only (no content); 'head' (default) for the first lines; 'tail' for the last lines.\",\n\t\t}),\n\t),\n\tmaxLines: Type.Optional(\n\t\tType.Number({ description: `Maximum lines to return for head/tail (default: ${DEFAULT_RETRIEVAL_MAX_LINES})` }),\n\t),\n});\n\nexport type ArtifactRetrieveToolInput = Static<typeof artifactRetrieveSchema>;\n\nexport interface ArtifactRetrieveToolDetails {\n\tfound: boolean;\n\tmode: ArtifactRetrievalMode;\n}\n\nexport interface ArtifactRetrieveToolOptions {\n\t/** Session-scoped artifact store to resolve ids against. Omitted: the tool reports unavailable. */\n\tartifactStore?: ArtifactStore;\n}\n\nfunction normalizeArtifactId(input: string): string {\n\treturn input.startsWith(ARTIFACT_ID_PREFIX) ? input.slice(ARTIFACT_ID_PREFIX.length) : input;\n}\n\nfunction formatMetadataText(ref: {\n\tkind: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpath?: string;\n\tbyteLength: number;\n\tlineCount?: number;\n\treproducible: boolean;\n}): string {\n\tconst lines = [\n\t\t`kind: ${ref.kind}`,\n\t\tref.toolName ? `tool: ${ref.toolName}` : undefined,\n\t\tref.command ? `command: ${ref.command}` : undefined,\n\t\tref.path ? `path: ${ref.path}` : undefined,\n\t\t`size: ${formatSize(ref.byteLength)}`,\n\t\tref.lineCount !== undefined ? `lines: ${ref.lineCount}` : undefined,\n\t\t`reproducible: ${ref.reproducible}`,\n\t];\n\treturn lines.filter((line): line is string => line !== undefined).join(\"\\n\");\n}\n\nfunction formatCall(args: { artifactId: string; mode?: string } | undefined, theme: Theme): string {\n\tconst artifactId = str(args?.artifactId);\n\tconst mode = args?.mode ?? \"head\";\n\tconst idText = artifactId === null ? invalidArgText(theme) : theme.fg(\"accent\", artifactId);\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"artifact_retrieve\"))} ${idText}${theme.fg(\"toolOutput\", ` (${mode})`)}`;\n}\n\nexport function createArtifactRetrieveToolDefinition(\n\t_cwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): ToolDefinition<typeof artifactRetrieveSchema, ArtifactRetrieveToolDetails | undefined> {\n\tconst artifactStore = options?.artifactStore;\n\treturn {\n\t\tname: \"artifact_retrieve\",\n\t\tlabel: \"artifact_retrieve\",\n\t\tdescription:\n\t\t\t\"Retrieve a bounded slice of a packed tool-output artifact by id, from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. Returns metadata, or a bounded head/tail slice -- never the full raw payload in one call.\",\n\t\tpromptSnippet: \"Retrieve a bounded slice of a packed tool-output artifact\",\n\t\tparameters: artifactRetrieveSchema,\n\t\ttoolGroup: \"explore\",\n\t\tasync execute(\n\t\t\t_toolCallId,\n\t\t\t{ artifactId, mode, maxLines }: { artifactId: string; mode?: ArtifactRetrievalMode; maxLines?: number },\n\t\t) {\n\t\t\tconst effectiveMode = mode ?? \"head\";\n\t\t\tif (!artifactStore) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: \"No artifact store is configured for this session.\" }],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst result = retrieveArtifactSlice(artifactStore, {\n\t\t\t\tartifactId: normalizeArtifactId(artifactId),\n\t\t\t\tmode,\n\t\t\t\tmaxLines,\n\t\t\t});\n\n\t\t\tif (!result.found) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `Artifact not found: ${artifactId} (${result.missingReason}). It may have been cleaned up, or the id may be incorrect.`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (result.mode === \"metadata\") {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatMetadataText(result.ref) }],\n\t\t\t\t\tdetails: { found: true, mode: \"metadata\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tlet text = result.slice;\n\t\t\tif (result.truncation.truncated) {\n\t\t\t\ttext += `\\n\\n[Showing ${result.mode} ${result.truncation.outputLines} of ${result.truncation.totalLines} lines. Full artifact: ${formatSize(result.ref.byteLength)}. Retrieve again with a different mode/maxLines for another slice.]`;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text }],\n\t\t\t\tdetails: { found: true, mode: result.mode },\n\t\t\t};\n\t\t},\n\t\trenderCall(args, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatCall(args, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\tconst content = result.content.find((part) => part.type === \"text\");\n\t\t\tconst body = content && \"text\" in content ? content.text : \"\";\n\t\t\tconst lines = body.split(\"\\n\");\n\t\t\tconst maxLines = options.expanded ? lines.length : 20;\n\t\t\tconst displayLines = lines.slice(0, maxLines);\n\t\t\tconst remaining = lines.length - maxLines;\n\t\t\tlet rendered = displayLines.map((line) => theme.fg(\"toolOutput\", line)).join(\"\\n\");\n\t\t\tif (remaining > 0) rendered += `\\n${theme.fg(\"muted\", `... (${remaining} more lines)`)}`;\n\t\t\ttext.setText(rendered);\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createArtifactRetrieveTool(\n\tcwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): AgentTool<typeof artifactRetrieveSchema> {\n\treturn wrapToolDefinition(createArtifactRetrieveToolDefinition(cwd, options));\n}\n"]}
+{"version":3,"file":"artifact-retrieve.js","sourceRoot":"","sources":["../../../src/core/tools/artifact-retrieve.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC5D,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAe,IAAI,EAAE,MAAM,SAAS,CAAC;AAE5C,OAAO,EAEN,2BAA2B,EAC3B,qBAAqB,GACrB,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAElE,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,MAAM,sBAAsB,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1C,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC;QACvB,WAAW,EACV,sIAAsI;KACvI,CAAC;IACF,IAAI,EAAE,IAAI,CAAC,QAAQ,CAClB,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE;QAClF,WAAW,EACV,wHAAwH;KACzH,CAAC,CACF;IACD,QAAQ,EAAE,IAAI,CAAC,QAAQ,CACtB,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mDAAmD,2BAA2B,GAAG,EAAE,CAAC,CAC/G;CACD,CAAC,CAAC;AAcH,SAAS,mBAAmB,CAAC,KAAa,EAAU;IACnD,OAAO,KAAK,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAAA,CAC7F;AAED,SAAS,kBAAkB,CAAC,GAQ3B,EAAU;IACV,MAAM,KAAK,GAAG;QACb,SAAS,GAAG,CAAC,IAAI,EAAE;QACnB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;QAClD,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS;QACnD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS;QAC1C,SAAS,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;QACrC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;QACnE,iBAAiB,GAAG,CAAC,YAAY,EAAE;KACnC,CAAC;IACF,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAAA,CAC7E;AAED,SAAS,UAAU,CAAC,IAAuD,EAAE,KAAY,EAAU;IAClG,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,EAAE,IAAI,IAAI,MAAM,CAAC;IAClC,MAAM,MAAM,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAC5F,OAAO,GAAG,KAAK,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,IAAI,MAAM,GAAG,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,KAAK,IAAI,GAAG,CAAC,EAAE,CAAC;AAAA,CACpH;AAED,MAAM,UAAU,oCAAoC,CACnD,IAAY,EACZ,OAAqC,EACoD;IACzF,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,CAAC;IAC7C,OAAO;QACN,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,mBAAmB;QAC1B,WAAW,EACV,8OAA8O;QAC/O,aAAa,EAAE,2DAA2D;QAC1E,UAAU,EAAE,sBAAsB;QAClC,SAAS,EAAE,SAAS;QACpB,KAAK,CAAC,OAAO,CACZ,WAAW,EACX,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAA2E,EACtG;YACD,MAAM,aAAa,GAAG,IAAI,IAAI,MAAM,CAAC;YACrC,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;oBACtF,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9C,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,qBAAqB,CAAC,aAAa,EAAE;gBACnD,UAAU,EAAE,mBAAmB,CAAC,UAAU,CAAC;gBAC3C,IAAI;gBACJ,QAAQ;aACR,CAAC,CAAC;YAEH,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACnB,OAAO;oBACN,OAAO,EAAE;wBACR;4BACC,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,uBAAuB,UAAU,KAAK,MAAM,CAAC,aAAa,6DAA6D;yBAC7H;qBACD;oBACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE;iBAC9C,CAAC;YACH,CAAC;YAED,IAAI,MAAM,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;gBAChC,OAAO;oBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;oBACjE,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE;iBAC1C,CAAC;YACH,CAAC;YAED,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;YACxB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,IAAI,gBAAgB,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,WAAW,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,0BAA0B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,qEAAqE,CAAC;YACzO,CAAC;YACD,OAAO;gBACN,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;gBACjC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aAC3C,CAAC;QAAA,CACF;QACD,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE;YAChC,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QAAA,CACZ;QACD,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YAC7C,MAAM,IAAI,GAAI,OAAO,CAAC,aAAkC,IAAI,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACpE,MAAM,IAAI,GAAG,OAAO,IAAI,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC/B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC;YAC1C,IAAI,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnF,IAAI,SAAS,GAAG,CAAC;gBAAE,QAAQ,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,QAAQ,SAAS,cAAc,CAAC,EAAE,CAAC;YACzF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACvB,OAAO,IAAI,CAAC;QAAA,CACZ;KACD,CAAC;AAAA,CACF;AAED,MAAM,UAAU,0BAA0B,CACzC,GAAW,EACX,OAAqC,EACM;IAC3C,OAAO,kBAAkB,CAAC,oCAAoC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;AAAA,CAC9E","sourcesContent":["import type { AgentTool } from \"@caupulican/pi-agent-core\";\nimport { formatSize } from \"@caupulican/pi-agent-core/node\";\nimport { Text } from \"@caupulican/pi-tui\";\nimport { type Static, Type } from \"typebox\";\nimport type { Theme } from \"../../modes/interactive/theme/theme.ts\";\nimport {\n\ttype ArtifactRetrievalMode,\n\tDEFAULT_RETRIEVAL_MAX_LINES,\n\tretrieveArtifactSlice,\n} from \"../context/artifact-retrieval.ts\";\nimport type { ArtifactStore } from \"../context/context-artifacts.ts\";\nimport type { ToolDefinition } from \"../extensions/types.ts\";\nimport { invalidArgText, str } from \"./render-utils.ts\";\nimport { wrapToolDefinition } from \"./tool-definition-wrapper.ts\";\n\nconst ARTIFACT_ID_PREFIX = \"tool-output:\";\n\nconst artifactRetrieveSchema = Type.Object({\n\tartifactId: Type.String({\n\t\tdescription:\n\t\t\t\"Artifact id from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. The 'tool-output:' prefix is optional.\",\n\t}),\n\tmode: Type.Optional(\n\t\tType.Union([Type.Literal(\"metadata\"), Type.Literal(\"head\"), Type.Literal(\"tail\")], {\n\t\t\tdescription:\n\t\t\t\t\"'metadata' for tool/path/size info only (no content); 'head' (default) for the first lines; 'tail' for the last lines.\",\n\t\t}),\n\t),\n\tmaxLines: Type.Optional(\n\t\tType.Number({ description: `Maximum lines to return for head/tail (default: ${DEFAULT_RETRIEVAL_MAX_LINES})` }),\n\t),\n});\n\nexport type ArtifactRetrieveToolInput = Static<typeof artifactRetrieveSchema>;\n\nexport interface ArtifactRetrieveToolDetails {\n\tfound: boolean;\n\tmode: ArtifactRetrievalMode;\n}\n\nexport interface ArtifactRetrieveToolOptions {\n\t/** Session-scoped artifact store to resolve ids against. Omitted: the tool reports unavailable. */\n\tartifactStore?: ArtifactStore;\n}\n\nfunction normalizeArtifactId(input: string): string {\n\treturn input.startsWith(ARTIFACT_ID_PREFIX) ? input.slice(ARTIFACT_ID_PREFIX.length) : input;\n}\n\nfunction formatMetadataText(ref: {\n\tkind: string;\n\ttoolName?: string;\n\tcommand?: string;\n\tpath?: string;\n\tbyteLength: number;\n\tlineCount?: number;\n\treproducible: boolean;\n}): string {\n\tconst lines = [\n\t\t`kind: ${ref.kind}`,\n\t\tref.toolName ? `tool: ${ref.toolName}` : undefined,\n\t\tref.command ? `command: ${ref.command}` : undefined,\n\t\tref.path ? `path: ${ref.path}` : undefined,\n\t\t`size: ${formatSize(ref.byteLength)}`,\n\t\tref.lineCount !== undefined ? `lines: ${ref.lineCount}` : undefined,\n\t\t`reproducible: ${ref.reproducible}`,\n\t];\n\treturn lines.filter((line): line is string => line !== undefined).join(\"\\n\");\n}\n\nfunction formatCall(args: { artifactId: string; mode?: string } | undefined, theme: Theme): string {\n\tconst artifactId = str(args?.artifactId);\n\tconst mode = args?.mode ?? \"head\";\n\tconst idText = artifactId === null ? invalidArgText(theme) : theme.fg(\"accent\", artifactId);\n\treturn `${theme.fg(\"toolTitle\", theme.bold(\"artifact_retrieve\"))} ${idText}${theme.fg(\"toolOutput\", ` (${mode})`)}`;\n}\n\nexport function createArtifactRetrieveToolDefinition(\n\t_cwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): ToolDefinition<typeof artifactRetrieveSchema, ArtifactRetrieveToolDetails | undefined> {\n\tconst artifactStore = options?.artifactStore;\n\treturn {\n\t\tname: \"artifact_retrieve\",\n\t\tlabel: \"artifact_retrieve\",\n\t\tdescription:\n\t\t\t\"Retrieve a bounded slice of a packed tool-output artifact by id, from a 'Full output: artifact tool-output:<id>' reference in a prior tool result. Returns metadata, or a bounded head/tail slice -- never the full raw payload in one call.\",\n\t\tpromptSnippet: \"Retrieve a bounded slice of a packed tool-output artifact\",\n\t\tparameters: artifactRetrieveSchema,\n\t\ttoolGroup: \"explore\",\n\t\tasync execute(\n\t\t\t_toolCallId,\n\t\t\t{ artifactId, mode, maxLines }: { artifactId: string; mode?: ArtifactRetrievalMode; maxLines?: number },\n\t\t) {\n\t\t\tconst effectiveMode = mode ?? \"head\";\n\t\t\tif (!artifactStore) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: \"No artifact store is configured for this session.\" }],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tconst result = retrieveArtifactSlice(artifactStore, {\n\t\t\t\tartifactId: normalizeArtifactId(artifactId),\n\t\t\t\tmode,\n\t\t\t\tmaxLines,\n\t\t\t});\n\n\t\t\tif (!result.found) {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\ttype: \"text\",\n\t\t\t\t\t\t\ttext: `Artifact not found: ${artifactId} (${result.missingReason}). It may have been cleaned up, or the id may be incorrect.`,\n\t\t\t\t\t\t},\n\t\t\t\t\t],\n\t\t\t\t\tdetails: { found: false, mode: effectiveMode },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tif (result.mode === \"metadata\") {\n\t\t\t\treturn {\n\t\t\t\t\tcontent: [{ type: \"text\", text: formatMetadataText(result.ref) }],\n\t\t\t\t\tdetails: { found: true, mode: \"metadata\" },\n\t\t\t\t};\n\t\t\t}\n\n\t\t\tlet text = result.slice;\n\t\t\tif (result.truncation.truncated) {\n\t\t\t\ttext += `\\n\\n[Showing ${result.mode} ${result.truncation.outputLines} of ${result.truncation.totalLines} lines. Full artifact: ${formatSize(result.ref.byteLength)}. Retrieve again with a different mode/maxLines for another slice.]`;\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tcontent: [{ type: \"text\", text }],\n\t\t\t\tdetails: { found: true, mode: result.mode },\n\t\t\t};\n\t\t},\n\t\trenderCall(args, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\ttext.setText(formatCall(args, theme));\n\t\t\treturn text;\n\t\t},\n\t\trenderResult(result, options, theme, context) {\n\t\t\tconst text = (context.lastComponent as Text | undefined) ?? new Text(\"\", 0, 0);\n\t\t\tconst content = result.content.find((part) => part.type === \"text\");\n\t\t\tconst body = content && \"text\" in content ? content.text : \"\";\n\t\t\tconst lines = body.split(\"\\n\");\n\t\t\tconst maxLines = options.expanded ? lines.length : 20;\n\t\t\tconst displayLines = lines.slice(0, maxLines);\n\t\t\tconst remaining = lines.length - maxLines;\n\t\t\tlet rendered = displayLines.map((line) => theme.fg(\"toolOutput\", line)).join(\"\\n\");\n\t\t\tif (remaining > 0) rendered += `\\n${theme.fg(\"muted\", `... (${remaining} more lines)`)}`;\n\t\t\ttext.setText(rendered);\n\t\t\treturn text;\n\t\t},\n\t};\n}\n\nexport function createArtifactRetrieveTool(\n\tcwd: string,\n\toptions?: ArtifactRetrieveToolOptions,\n): AgentTool<typeof artifactRetrieveSchema> {\n\treturn wrapToolDefinition(createArtifactRetrieveToolDefinition(cwd, options));\n}\n"]}

package/dist/core/tools/bash.d.ts

@@ -1,7 +1,9 @@
-import type { AgentTool } from "@caupulican/pi-agent-core";
+import { type AgentTool } from "@caupulican/pi-agent-core";
+import { type TruncationResult } from "@caupulican/pi-agent-core/node";
 import { type Static, Type } from "typebox";
 import type { ToolDefinition } from "../extensions/types.ts";
-import { type TruncationResult } from "./truncate.ts";
+/** Test hook: override the silence threshold. Pass undefined to restore the default. */
+export declare function setCommandSilenceMsForTests(ms: number | undefined): void;
 declare const bashSchema: Type.TObject<{
     command: Type.TString;
     timeout: Type.TOptional<Type.TNumber>;