@caupulican/pi-adaptative 0.94.1 → 0.96.0

package/docs/worker-profiles.md

@@ -1,22 +1,24 @@
 # Task worker presets
 
-Native delegation does not require a profile. `delegate.authority` can choose a child model, reasoning level, role label, and classified tool names directly. Omitted fields inherit from the caller, and Pi persists the resulting immutable execution grant. The model-facing tool has no token, cost, time, attempt, or tool-call ceiling fields; those come only from host settings or owner-authored profiles.
+Native delegation does not require a profile. The model-facing `delegate start` action exposes only top-level `model`, `thinkingLevel`, `path`, and `toolNames` overrides. Omitted fields inherit the live compatible foreground model, thinking level, classified tools, and machine scope. Pi compiles that request into an immutable host execution grant; the model does not provide an authority envelope, role/capability grant, budget, or tool-call ceiling. Budgets, leases, and other limits come from host settings and owner-authored profiles.
 
 `delegate` profile actions remain useful when the foreground orchestrator wants a reusable session-scoped preset. They do not edit user or project profile files. Task presets are:
 
-- Derived only from an owner-authorized base profile.
+- Derived from an owner-authored base profile or the live compatible foreground contract.
 - Immutable and assigned a `task-...` ID by Pi.
 - Stored on the owning session branch, never shared across independent sessions.
 - Limited to 32 presets per session.
-- Unable to add tools or resources beyond the base profile, and always inherit its budget unchanged.
+- Unable to add tools or resources; tools may only narrow the inherited surface and resources/budgets stay host-owned.
 - Limited to configured, authenticated, non-exhausted models and a reasoning level that model supports.
 
-Use `delegate { action: "profile_inspect" }` when the reusable bases or model combinations are unknown. Then call `profile_create` with a concise task and only the model/tool/resource defaults worth preserving. Pass the returned profile ID unchanged to `delegate start`; never invent one.
+Use `delegate { action: "profile_inspect" }` when reusable owner-authored bases or model combinations are unknown. Otherwise `profile_create` can derive directly from the live foreground contract. Supply a concise task and only the model, thinking, path, or tool narrowing worth preserving. Pass the returned profile ID unchanged to `delegate start`; never invent one.
 
-Worker agents do not receive the root-only profile/status actions. They receive `delegate` only when their admitted tool set and capability ceiling both retain delegation; a caller can create a non-delegating leaf by narrowing either field. Delegating workers may recursively create descendants within the fixed depth, direct-child, session-agent, and queue bounds. They can discover safe session-peer metadata, exchange non-waking threaded messages and bounded broadcasts, and use event-driven `wait`/`wait_many`, but bounded transcript reads and waking controls remain limited to the caller's own control subtree. Transcript cursors address raw session entries, so a continuation page may be empty after non-message entries; an individually oversized message is omitted with a count instead of being truncated. A descendant may vary model or role through another preset, but it cannot acquire new resources: pointers must fully match the ancestor's admitted pointer metadata, soul text must match exactly, and verifier resources and authority stay within the ancestral verifier or worker boundary.
+Worker agents are root-managed leaves. They do not receive root-only profile/status/control actions or `delegate`, and cannot create descendants. The root owns worker lifecycle, queue admission, budgets, leases, cancellation, status, and bounded transcript retrieval. Each fresh worker receives a new classified tool surface and the live compatible model, thinking level, tools, and machine scope; top-level overrides can narrow or focus that inherited base. Worker output is untrusted evidence delivered to the owning root through the durable terminal handoff.
+
+The root `memory` tool and raw memory prompt snapshot never enter a worker or child session. When retrieval is enabled and the admitted profile or dispatch selects `memory_read`, Pi materializes a fresh query-only broker with `memory.query` authority and returns bounded, source-labeled evidence; it cannot write memory or expose memory files.
 
 New agents may receive immutable sanitized birth context with `forkTurns: "none"`, `"all"`, or a positive user-turn count such as `"3"`. Omitted starts receive no parent transcript, so a self-contained task cannot inherit and mistake parent-level orchestration intent for child ownership. Explicit inheritance remains available inside the exact provider/model boundary. Crossing either provider or model defaults to no inherited turns, and an explicit non-`none` cross-boundary fork is rejected. Tool calls/results, reasoning/commentary, system/developer/custom messages, mailbox controls, non-text content, and incomplete assistant output never enter the snapshot. Dispatching another task with an existing `agentId` reuses that agent's durable transcript and cannot replace its birth context.
 
 `delegate tasks` is the bounded view of the same durable task/DAG runtime used for dispatch and recovery. A new task may name existing same-objective task IDs with `dependsOn`; it remains pending until those dependencies complete, while invalid or cyclic edges fail closed. Evidence-classified transient failures retain their attempt/retry count and exact `notBefore` deadline across restart. Agent, task, and attempt projections are independently capped at 256 entries.
 
-Pi admits fleet and queue capacity before registering a new logical child; every accepted queued child then has a stable agent ID. Queue and projection admission preserve one continuation slot for every pending mandatory verifier, and a verifier blocked by saturation is retried from durable subject state when capacity changes. A parent that waits yields its scheduler slot until an event-driven state change. A worker cannot wait for itself or for a queued target blocked by its own write reservation; that wait fails immediately and tells the worker to finish its task so the owning parent can continue coordination. Every terminal child writes one bounded, idempotent handoff to its owning parent's mailbox. Review-pending results retain terminal status `partial`, and project-level blockers retain `blocked`; neither is projected as a harness failure. Evidence-classified retries stay nonterminal and report that their durable state is preserved. A full mailbox retains that handoff by terminal attempt ID until an explicit capacity/state/recovery signal drains it; no timer polls for delivery. Active parents receive the handoff without transcript races; idle registered parents resume once. Child output remains in the child transcript. `interrupt`, `resume`, `cancel`, and `follow_up` are subtree-scoped; a paused objective keeps a suspended worker nonterminal until resume. `retire` closes only an idle leaf with no unresolved mailbox/reply work and preserves its binding and transcript. A resumed worker retains the exact admitted preset or adaptive grant, model, resources, lineage, and transcript.
+Pi admits fleet and queue capacity before registering each root-dispatched worker; every accepted queued worker then has a stable agent ID. Queue and projection admission preserve one continuation slot for every pending mandatory verifier, and a verifier blocked by saturation is retried from durable subject state when capacity changes. The root yields its scheduler slot while waiting for an event-driven state change. A worker cannot wait for itself or for a queued target blocked by its own write reservation; that wait fails immediately and tells the worker to finish its task so the root can continue coordination. Every terminal worker writes one bounded, idempotent handoff to the owning root's mailbox. Review-pending results retain terminal status `partial`, and project-level blockers retain `blocked`; neither is projected as a harness failure. Evidence-classified retries stay nonterminal and report that their durable state is preserved. A full mailbox retains that handoff by terminal attempt ID until an explicit capacity/state/recovery signal drains it; no timer polls for delivery. The root receives the handoff without transcript races and resumes once when idle. Worker output remains in the worker transcript. `interrupt`, `resume`, `cancel`, and `follow_up` are root-owned; a paused objective keeps a suspended worker nonterminal until resume. `retire` closes only an idle leaf with no unresolved mailbox/reply work and preserves its binding and transcript. A resumed worker retains the exact admitted preset or adaptive grant, model, resources, lineage, and transcript.

package/docs/worktree-sync.md

@@ -164,24 +164,22 @@ environment value a lane-bound process can set to shed the worker ceiling below.
 
 ### Forbidden-tool ceiling
 
-A worker session can never activate: `goal`, `pipeline`, `delegate`, `improvement_loop`,
-`extensionify`, `skillify`, `run_toolkit_script`, `model_fitness`, `tmux_agent_manager`,
-`context_scout`, `python`. This is enforced as the FIRST line of the tool registry's allow
+A worker session can never activate: the legacy composite `goal`, `secret_store`, `memory`, `delegate`,
+`improvement_loop`, `model_fitness`, `tmux_agent_manager`, or `context_scout`. This is enforced as the FIRST line of the tool registry's allow
 predicate (`RuntimeBuilder.refreshToolRegistry`'s `isAllowedTool`) -- it wins over an allow-list,
-an exclude-list, or an active resource profile that names the tool explicitly. `goal`/`delegate`/
-`tmux_agent_manager` are sub-orchestration (a worker dispatching its own workers
-defeats single-owner lane accountability); `improvement_loop`/`extensionify`/`skillify` are
-self-adaptation surface a worker should never mutate; `run_toolkit_script`/`model_fitness` spend
-budget a worker's dispatcher does not control. **`python`** is included because it is a bounded but
-still largely unrestricted execution contract -- excluding it is load-bearing for the zero-footprint
-guarantee below (an unbounded interpreter can write state anywhere it can reach on disk).
-**`context_scout`** is excluded because it is itself sub-orchestration: it spawns its own isolated
-agent loop.
-
-`bash` is deliberately **not** forbidden. It stays available as the same documented cooperative
-boundary the lane gate already applies to foreign (non-`pi`) CLIs it cannot structurally contain --
-a worker's bash access is bounded by the lane gate's G8/G10 rules and the path envelope below, not
-by removing the tool.
+an exclude-list, or an active resource profile that names the tool explicitly. The legacy `goal`
+stays root-only because its composite action set embeds `dispatch_worker`; its non-dispatching
+`create_goal`/`get_goal`/`update_goal` lifecycle tools inherit normally. `delegate`,
+`tmux_agent_manager`, `context_scout`, and `model_fitness` launch agent/provider worker loops.
+`memory` and `improvement_loop` mutate root-owned reflection state, while `secret_store` mutates
+machine credential/project bindings. Ordinary tools including `pipeline`, `ask_question`, `skill`,
+`extensionify`, `skillify`, and `run_toolkit_script` inherit when the orchestrator exposes them.
+
+`bash` and `python` are deliberately **not** forbidden. Removing only one execution route would not
+create a meaningful filesystem boundary. Pi hard-denies private harness roots for structural
+read/write/edit/search calls, but arbitrary process code remains a deliberate host-trust boundary and
+can reach any file visible to the OS account. The harness does not claim a process sandbox it does not
+have; lane G8/G10 and the land gate remain the backstops for repository integration.
 
 ### `worktree_sync` tool scoping for a worker
 
@@ -207,7 +205,15 @@ deliberately engine-level and applies to `land`/`release_lane` ONLY -- `sync`/`c
 from the tool-layer `laneKey` check above. `release_lane`'s existing G11 discard-confirm requirement
 is unaffected: it still applies once ownership no longer conflicts.
 
-### Edit/write path envelope
+### Structural path envelopes
+
+Every worker session wraps structural read/write/edit/grep/find/ls calls in a symlink-safe private-path
+envelope. `auth.json`, `MEMORY.md`, `USER.md`, settings/model files, session/state/work roots, and the
+active project's `.pi/settings.json` are denied before the underlying tool runs. The positive scope is
+empty for an unrestricted worker, meaning arbitrary sibling projects and machine paths remain available
+as required by the inherited full-machine profile. A managed Pi worker launched with an explicit profile
+`path` receives that path through an immutable startup channel, and the same envelope then denies
+structural access outside it.
 
 For a lane-bound session, `edit`/`write` targets are checked against the lane's own worktree root
 (`WorktreeLaneGate.checkMutation`'s `targetPath` parameter, resolved by `RuntimeBuilder`'s tool
@@ -216,8 +222,8 @@ lane's worktree root and the target are both resolved through `realpath` (walkin
 nearest EXISTING ancestor when the target itself does not exist yet, so a not-yet-created file
 cannot be smuggled through a symlink that escapes the lane). A target outside the resolved lane root
 is refused (`path_outside_lane`). No active lane record leaves the existing fail-open behavior
-unchanged. `bash` is untouched by this check -- its containment stays the G10 cooperative boundary
-described above.
+unchanged. Arbitrary process code is untouched by the structural envelope and retains the explicit
+host-trust semantics described above.
 
 ### Zero state/settings footprint
 

package/examples/extensions/custom-provider-anthropic/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-extension-custom-provider",
-  "version": "0.94.1",
+  "version": "0.96.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pi-extension-custom-provider",
-      "version": "0.94.1",
+      "version": "0.96.0",
       "dependencies": {
         "@anthropic-ai/sdk": "^0.52.0"
       }

package/examples/extensions/custom-provider-anthropic/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-anthropic",
   "private": true,
-  "version": "0.94.1",
+  "version": "0.96.0",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/custom-provider-gitlab-duo/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-custom-provider-gitlab-duo",
   "private": true,
-  "version": "0.94.1",
+  "version": "0.96.0",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/examples/extensions/sandbox/package-lock.json

@@ -1,12 +1,12 @@
 {
 	"name": "pi-extension-sandbox",
-	"version": "0.94.1",
+	"version": "0.96.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "pi-extension-sandbox",
-			"version": "0.94.1",
+			"version": "0.96.0",
 			"dependencies": {
 				"@anthropic-ai/sandbox-runtime": "^0.0.26"
 			}

package/examples/extensions/sandbox/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "pi-extension-sandbox",
 	"private": true,
-	"version": "0.94.1",
+	"version": "0.96.0",
 	"type": "module",
 	"scripts": {
 		"clean": "echo 'nothing to clean'",

package/examples/extensions/with-deps/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pi-extension-with-deps",
-  "version": "0.94.1",
+  "version": "0.96.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pi-extension-with-deps",
-      "version": "0.94.1",
+      "version": "0.96.0",
       "dependencies": {
         "ms": "^2.1.3"
       },

package/examples/extensions/with-deps/package.json

@@ -1,7 +1,7 @@
 {
   "name": "pi-extension-with-deps",
   "private": true,
-  "version": "0.94.1",
+  "version": "0.96.0",
   "type": "module",
   "scripts": {
     "clean": "echo 'nothing to clean'",

package/npm-shrinkwrap.json

@@ -1,17 +1,17 @@
 {
 	"name": "@caupulican/pi-adaptative",
-	"version": "0.94.1",
+	"version": "0.96.0",
 	"lockfileVersion": 3,
 	"requires": true,
 	"packages": {
 		"": {
 			"name": "@caupulican/pi-adaptative",
-			"version": "0.94.1",
+			"version": "0.96.0",
 			"license": "MIT",
 			"dependencies": {
-				"@caupulican/pi-agent-core": "^0.94.1",
-				"@caupulican/pi-ai": "^0.94.1",
-				"@caupulican/pi-tui": "^0.94.1",
+				"@caupulican/pi-agent-core": "^0.96.0",
+				"@caupulican/pi-ai": "^0.96.0",
+				"@caupulican/pi-tui": "^0.96.0",
 				"@silvia-odwyer/photon-node": "0.3.4",
 				"chalk": "5.6.2",
 				"cross-spawn": "7.0.6",
@@ -506,11 +506,11 @@
 			}
 		},
 		"node_modules/@caupulican/pi-agent-core": {
-			"version": "0.94.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-agent-core/-/pi-agent-core-0.94.1.tgz",
+			"version": "0.96.0",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-agent-core/-/pi-agent-core-0.96.0.tgz",
 			"license": "MIT",
 			"dependencies": {
-				"@caupulican/pi-ai": "^0.94.1",
+				"@caupulican/pi-ai": "^0.96.0",
 				"ignore": "7.0.5",
 				"typebox": "1.1.38",
 				"yaml": "2.9.0"
@@ -520,8 +520,8 @@
 			}
 		},
 		"node_modules/@caupulican/pi-ai": {
-			"version": "0.94.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-ai/-/pi-ai-0.94.1.tgz",
+			"version": "0.96.0",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-ai/-/pi-ai-0.96.0.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"@anthropic-ai/sdk": "0.117.1",
@@ -546,8 +546,8 @@
 			}
 		},
 		"node_modules/@caupulican/pi-tui": {
-			"version": "0.94.1",
-			"resolved": "https://registry.npmjs.org/@caupulican/pi-tui/-/pi-tui-0.94.1.tgz",
+			"version": "0.96.0",
+			"resolved": "https://registry.npmjs.org/@caupulican/pi-tui/-/pi-tui-0.96.0.tgz",
 			"license": "MIT",
 			"dependencies": {
 				"get-east-asian-width": "1.6.0",

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@caupulican/pi-adaptative",
-	"version": "0.94.1",
+	"version": "0.96.0",
 	"description": "Adaptive fork of Pi coding agent for self-evolving agent harness experiments",
 	"type": "module",
 	"piConfig": {
@@ -89,9 +89,9 @@
 		"postinstall": "node scripts/postinstall-python-runtime.mjs"
 	},
 	"dependencies": {
-		"@caupulican/pi-agent-core": "^0.94.1",
-		"@caupulican/pi-ai": "^0.94.1",
-		"@caupulican/pi-tui": "^0.94.1",
+		"@caupulican/pi-agent-core": "^0.96.0",
+		"@caupulican/pi-ai": "^0.96.0",
+		"@caupulican/pi-tui": "^0.96.0",
 		"@silvia-odwyer/photon-node": "0.3.4",
 		"chalk": "5.6.2",
 		"cross-spawn": "7.0.6",

package/dist/bundled-resources/extensions/tmux-agent-manager/dispatch-grant.d.ts

@@ -1,133 +0,0 @@
-import type { Usage } from "@caupulican/pi-ai";
-/**
- * The STANDING GRANT for approval-gated tmux dispatch (owner authorizes once via `grant_dispatch`;
- * the extension then dispatches unattended WITHIN the grant's bounds). Pure data + pure decode/decision
- * logic only — no session/tmux/filesystem access, so every function here is directly unit-testable.
- * The extension (index.ts) owns reading/writing session custom entries and calls into this module for
- * decoding and authorization decisions.
- *
- * HONEST TRUST BOUNDARY: this grant bounds WHO may be launched, HOW OFTEN, and WITH WHAT launch-time
- * envelope (pushed into the child's own CLI flags) — it never claims to gate the child's in-process
- * tool loop, which is a separate OS process outside this runtime's `beforeToolCall` machinery.
- */
-export type Provider = "pi" | "codex" | "agy" | "claude" | "opencode" | "custom";
-export declare const GRANT_CUSTOM_TYPE = "tmux-dispatch-grant";
-export declare const GRANT_USAGE_CUSTOM_TYPE = "tmux-dispatch-grant-usage";
-export interface TmuxDispatchGrantEnvelope {
-    allowedTools?: string[];
-    resourceProfile?: string;
-    writePaths?: string[];
-}
-export interface TmuxDispatchGrantBudget {
-    maxLaunches: number;
-    maxWallClockMs?: number;
-    maxUsdAdvisory?: number;
-}
-export interface TmuxDispatchGrant {
-    grantId: string;
-    createdAt: string;
-    agent: Provider;
-    scope: {
-        goalId?: string;
-    };
-    envelope: TmuxDispatchGrantEnvelope;
-    budget: TmuxDispatchGrantBudget;
-    expiresAt?: string;
-}
-/** Appended by `revoke_grant`. Shares `GRANT_CUSTOM_TYPE` so the SAME latest-on-branch read that
- * resolves an active grant also sees a revocation and stops treating any older grant beneath it as
- * active — a tombstone is a hard stop, never skipped over to resurrect an earlier grant. */
-export interface TmuxDispatchGrantTombstone {
-    tombstone: true;
-    grantId: string;
-    revokedAt: string;
-}
-export interface TmuxDispatchGrantUsage {
-    grantId: string;
-    jobId: string;
-    at: string;
-}
-export declare function isTmuxDispatchGrantTombstone(value: unknown): value is TmuxDispatchGrantTombstone;
-export declare function isTmuxDispatchGrant(value: unknown): value is TmuxDispatchGrant;
-export declare function isTmuxDispatchGrantUsage(value: unknown): value is TmuxDispatchGrantUsage;
-export declare function makeGrantId(): string;
-export interface GrantCoverageRequest {
-    agent: Provider;
-    goalId?: string;
-    nowIso?: string;
-}
-/** Whether `grant` authorizes a launch for `request`: same agent, goal-scope match (an UNSCOPED grant
- * covers any goal including none; a goal-SCOPED grant covers ONLY that exact goalId), and the grant is
- * not past `expiresAt`. Budget (maxLaunches) is checked separately via {@link isGrantBudgetExhausted}
- * because counting usages requires the caller's session-entry access. */
-export declare function grantCovers(grant: TmuxDispatchGrant, request: GrantCoverageRequest): boolean;
-/** Count spend entries for `grantId` among already-decoded custom-entry payloads (the caller walks the
- * session branch and passes the raw `data` values — this stays pure/session-agnostic). */
-export declare function countGrantUsages(grantId: string, usageEntries: readonly unknown[]): number;
-export declare function isGrantBudgetExhausted(grant: TmuxDispatchGrant, usedCount: number): boolean;
-export declare function buildGrantUsageEntry(grantId: string, jobId: string, nowIso?: string): TmuxDispatchGrantUsage;
-export declare function buildTombstone(grantId: string, nowIso?: string): TmuxDispatchGrantTombstone;
-export interface GrantDispatchParams {
-    agent: Provider;
-    goalId?: string;
-    allowedTools?: string[];
-    resourceProfile?: string;
-    writePaths?: string[];
-    maxLaunches: number;
-    expiresInMinutes?: number;
-    maxUsdAdvisory?: number;
-}
-/** Build a new grant record from `grant_dispatch` params. Pure — the caller (index.ts) owns the
- * approval gate (ui.confirm / opt-in flag) and the `pi.appendEntry` persistence; this only shapes the
- * data, so it stays independently testable and never itself decides whether creation is authorized. */
-export declare function buildGrant(params: GrantDispatchParams, nowIso?: string): TmuxDispatchGrant;
-export declare function describeGrant(grant: TmuxDispatchGrant): string;
-export declare const DEFAULT_READ_BIASED_TOOLS: readonly string[];
-export interface LaunchProfileSource {
-    /** Human-readable identity for the scoped system prompt (e.g. "grant <id>" or a one-shot label). */
-    identity: string;
-    allowedTools?: string[];
-    resourceProfile?: string;
-    writePaths?: string[];
-    /**
-     * Worktree-sync lane key this launch is bound to (per-agent -- see `applyLaunchProfile`'s caller,
-     * which builds a per-agent `LaunchProfileSource` only when that agent carries `worktreeLane`).
-     * When present, `buildLaunchProfileFlags` appends `--worktree-lane <key>` (the same CLI flag
-     * `src/cli/args.ts` already exposes, sugar over the `PI_WORKTREE_LANE` env contract) and
-     * `buildScopedSystemPrompt` appends one lane-doctrine sentence.
-     */
-    worktreeLane?: string;
-    /**
-     * Process-matrix parent identity for this launch (see `core/process-matrix/runtime.ts`): the
-     * dispatching process's own pid/sessionId. When present, `buildLaunchProfileFlags` appends
-     * `--parent-pid`/`--parent-session` (sugar over `PI_PARENT_PID`/`PI_PARENT_SESSION`) so the
-     * child self-registers as a worker of this session and winds down gracefully if it disappears.
-     */
-    parentPid?: number;
-    parentSession?: string;
-    /** Stable goal/task identity used to fence process-matrix recovery. */
-    taskRef?: string;
-}
-/** A grant-covered launch derives its profile from the grant's envelope. */
-export declare function launchProfileSourceFromGrant(grant: TmuxDispatchGrant): LaunchProfileSource;
-/** A one-shot interactively-approved launch (no standing grant) still gets the conservative default
- * profile — approving a single launch is not the same as defining an unrestricted envelope. */
-export declare const ONE_SHOT_LAUNCH_PROFILE_SOURCE: LaunchProfileSource;
-export interface LaunchProfileFlag {
-    flag: string;
-    value?: string;
-}
-/** Build the CLI flags to append to a child `pi` invocation so the grant's envelope lives in the
- * child's OWN launch config (verified flag names: --tools, --resource-profile, --no-extensions,
- * --no-skills, --append-system-prompt). Never includes --no-approve: the child must keep gating its
- * own hard stops. */
-export declare function buildLaunchProfileFlags(source: LaunchProfileSource): LaunchProfileFlag[];
-export declare function buildScopedSystemPrompt(source: LaunchProfileSource): string;
-/** Permissively decode a worker-reported usage CLAIM (a cooperative worker may write this to a
- * well-known sibling file before printing its completion marker). Read-defensive: missing/malformed
- * numeric fields default to 0 rather than throwing — this is untrusted, OPTIONAL, advisory input, never
- * an authoritative billing record. Returns undefined only when `raw` isn't even an object, so the
- * caller can distinguish "no claim offered" (skip reporting) from "a claim was offered" (report it,
- * however partial). */
-export declare function decodeTmuxWorkerUsageClaim(raw: unknown): Usage | undefined;
-//# sourceMappingURL=dispatch-grant.d.ts.map

package/dist/bundled-resources/extensions/tmux-agent-manager/dispatch-grant.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"dispatch-grant.d.ts","sourceRoot":"","sources":["../../../../src/bundled-resources/extensions/tmux-agent-manager/dispatch-grant.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;;;;;;GAUG;AAEH,MAAM,MAAM,QAAQ,GAAG,IAAI,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,GAAG,UAAU,GAAG,QAAQ,CAAC;AAEjF,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AAEnE,MAAM,WAAW,yBAAyB;IACzC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,uBAAuB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,QAAQ,CAAC;IAChB,KAAK,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3B,QAAQ,EAAE,yBAAyB,CAAC;IACpC,MAAM,EAAE,uBAAuB,CAAC;IAChC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;4FAE4F;AAC5F,MAAM,WAAW,0BAA0B;IAC1C,SAAS,EAAE,IAAI,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACX;AAYD,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,0BAA0B,CAGhG;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,iBAAiB,CAM9E;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,sBAAsB,CAGxF;AAED,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED,MAAM,WAAW,oBAAoB;IACpC,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;yEAGyE;AACzE,wBAAgB,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAS5F;AAED;0FAC0F;AAC1F,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAI1F;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAE3F;AAED,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,SAA2B,GAC/B,sBAAsB,CAExB;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,SAA2B,GAAG,0BAA0B,CAE7G;AAED,MAAM,WAAW,mBAAmB;IACnC,KAAK,EAAE,QAAQ,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;uGAEuG;AACvG,wBAAgB,UAAU,CAAC,MAAM,EAAE,mBAAmB,EAAE,MAAM,SAA2B,GAAG,iBAAiB,CAuB5G;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,CAsB9D;AAMD,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAmC,CAAC;AAE3F,MAAM,WAAW,mBAAmB;IACnC,oGAAoG;IACpG,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAAC,KAAK,EAAE,iBAAiB,GAAG,mBAAmB,CAO1F;AAED;+FAC+F;AAC/F,eAAO,MAAM,8BAA8B,EAAE,mBAE5C,CAAC;AAEF,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;qBAGqB;AACrB,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,GAAG,iBAAiB,EAAE,CAYxF;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,mBAAmB,GAAG,MAAM,CAa3E;AAMD;;;;;uBAKuB;AACvB,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAkB1E"}

package/dist/bundled-resources/extensions/tmux-agent-manager/dispatch-grant.js

@@ -1,199 +0,0 @@
-import * as crypto from "node:crypto";
-export const GRANT_CUSTOM_TYPE = "tmux-dispatch-grant";
-export const GRANT_USAGE_CUSTOM_TYPE = "tmux-dispatch-grant-usage";
-const PROVIDERS = ["pi", "codex", "agy", "claude", "opencode", "custom"];
-function isProvider(value) {
-    return typeof value === "string" && PROVIDERS.includes(value);
-}
-function isPlainRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-export function isTmuxDispatchGrantTombstone(value) {
-    if (!isPlainRecord(value))
-        return false;
-    return value.tombstone === true && typeof value.grantId === "string" && typeof value.revokedAt === "string";
-}
-export function isTmuxDispatchGrant(value) {
-    if (!isPlainRecord(value) || value.tombstone === true)
-        return false;
-    if (typeof value.grantId !== "string" || typeof value.createdAt !== "string" || !isProvider(value.agent))
-        return false;
-    if (!isPlainRecord(value.scope) || !isPlainRecord(value.envelope) || !isPlainRecord(value.budget))
-        return false;
-    return typeof value.budget.maxLaunches === "number" && Number.isFinite(value.budget.maxLaunches);
-}
-export function isTmuxDispatchGrantUsage(value) {
-    if (!isPlainRecord(value))
-        return false;
-    return typeof value.grantId === "string" && typeof value.jobId === "string" && typeof value.at === "string";
-}
-export function makeGrantId() {
-    return `grant-${Date.now().toString(36)}-${crypto.randomBytes(4).toString("hex")}`;
-}
-/** Whether `grant` authorizes a launch for `request`: same agent, goal-scope match (an UNSCOPED grant
- * covers any goal including none; a goal-SCOPED grant covers ONLY that exact goalId), and the grant is
- * not past `expiresAt`. Budget (maxLaunches) is checked separately via {@link isGrantBudgetExhausted}
- * because counting usages requires the caller's session-entry access. */
-export function grantCovers(grant, request) {
-    if (grant.agent !== request.agent)
-        return false;
-    if (grant.scope.goalId && grant.scope.goalId !== request.goalId)
-        return false;
-    if (grant.expiresAt) {
-        const now = Date.parse(request.nowIso ?? new Date().toISOString());
-        const expiry = Date.parse(grant.expiresAt);
-        if (Number.isFinite(expiry) && Number.isFinite(now) && now >= expiry)
-            return false;
-    }
-    return true;
-}
-/** Count spend entries for `grantId` among already-decoded custom-entry payloads (the caller walks the
- * session branch and passes the raw `data` values — this stays pure/session-agnostic). */
-export function countGrantUsages(grantId, usageEntries) {
-    let count = 0;
-    for (const entry of usageEntries)
-        if (isTmuxDispatchGrantUsage(entry) && entry.grantId === grantId)
-            count++;
-    return count;
-}
-export function isGrantBudgetExhausted(grant, usedCount) {
-    return usedCount >= grant.budget.maxLaunches;
-}
-export function buildGrantUsageEntry(grantId, jobId, nowIso = new Date().toISOString()) {
-    return { grantId, jobId, at: nowIso };
-}
-export function buildTombstone(grantId, nowIso = new Date().toISOString()) {
-    return { tombstone: true, grantId, revokedAt: nowIso };
-}
-/** Build a new grant record from `grant_dispatch` params. Pure — the caller (index.ts) owns the
- * approval gate (ui.confirm / opt-in flag) and the `pi.appendEntry` persistence; this only shapes the
- * data, so it stays independently testable and never itself decides whether creation is authorized. */
-export function buildGrant(params, nowIso = new Date().toISOString()) {
-    if (!Number.isFinite(params.maxLaunches) || params.maxLaunches < 1)
-        throw new Error("grant_dispatch requires maxLaunches >= 1");
-    const expiresAt = params.expiresInMinutes !== undefined
-        ? new Date(Date.parse(nowIso) + Math.max(1, params.expiresInMinutes) * 60_000).toISOString()
-        : undefined;
-    return {
-        grantId: makeGrantId(),
-        createdAt: nowIso,
-        agent: params.agent,
-        scope: { goalId: params.goalId },
-        envelope: {
-            allowedTools: params.allowedTools,
-            resourceProfile: params.resourceProfile,
-            writePaths: params.writePaths,
-        },
-        budget: {
-            maxLaunches: Math.trunc(params.maxLaunches),
-            maxUsdAdvisory: params.maxUsdAdvisory,
-        },
-        expiresAt,
-    };
-}
-export function describeGrant(grant) {
-    return [
-        `Grant id: ${grant.grantId}`,
-        `Agent: ${grant.agent}`,
-        grant.scope.goalId ? `Goal scope: ${grant.scope.goalId}` : "Goal scope: none (covers any goal)",
-        `Max launches: ${grant.budget.maxLaunches}`,
-        grant.expiresAt ? `Expires: ${grant.expiresAt}` : "Expires: never (until revoke_grant)",
-        grant.envelope.allowedTools?.length
-            ? `Allowed tools: ${grant.envelope.allowedTools.join(", ")}`
-            : `Allowed tools: read-biased safe default (${DEFAULT_READ_BIASED_TOOLS.join(", ")})`,
-        grant.envelope.resourceProfile
-            ? `Resource profile: ${grant.envelope.resourceProfile}`
-            : "Resource profile: none (child launches with --no-extensions --no-skills)",
-        grant.envelope.writePaths?.length
-            ? `Write paths: ${grant.envelope.writePaths.join(", ")}`
-            : "Write paths: none declared",
-        grant.budget.maxUsdAdvisory !== undefined
-            ? `Advisory USD cap: ${grant.budget.maxUsdAdvisory} (not enforced across the process boundary — advisory only)`
-            : undefined,
-    ]
-        .filter((line) => Boolean(line))
-        .join("\n");
-}
-// ---------------------------------------------------------------------------
-// Launch-profile flags: the REAL lever — pushed into the child `pi` CLI's own config.
-// ---------------------------------------------------------------------------
-export const DEFAULT_READ_BIASED_TOOLS = ["read", "grep", "find", "ls"];
-/** A grant-covered launch derives its profile from the grant's envelope. */
-export function launchProfileSourceFromGrant(grant) {
-    return {
-        identity: `grant ${grant.grantId}`,
-        allowedTools: grant.envelope.allowedTools,
-        resourceProfile: grant.envelope.resourceProfile,
-        writePaths: grant.envelope.writePaths,
-    };
-}
-/** A one-shot interactively-approved launch (no standing grant) still gets the conservative default
- * profile — approving a single launch is not the same as defining an unrestricted envelope. */
-export const ONE_SHOT_LAUNCH_PROFILE_SOURCE = {
-    identity: "a one-shot owner-approved tmux dispatch (no standing grant)",
-};
-/** Build the CLI flags to append to a child `pi` invocation so the grant's envelope lives in the
- * child's OWN launch config (verified flag names: --tools, --resource-profile, --no-extensions,
- * --no-skills, --append-system-prompt). Never includes --no-approve: the child must keep gating its
- * own hard stops. */
-export function buildLaunchProfileFlags(source) {
-    const tools = source.allowedTools?.length ? source.allowedTools : DEFAULT_READ_BIASED_TOOLS;
-    const flags = [{ flag: "--tools", value: tools.join(",") }];
-    if (source.resourceProfile)
-        flags.push({ flag: "--resource-profile", value: source.resourceProfile });
-    else
-        flags.push({ flag: "--no-extensions" }, { flag: "--no-skills" });
-    if (source.worktreeLane)
-        flags.push({ flag: "--worktree-lane", value: source.worktreeLane });
-    if (source.parentPid !== undefined)
-        flags.push({ flag: "--parent-pid", value: String(source.parentPid) });
-    if (source.parentSession)
-        flags.push({ flag: "--parent-session", value: source.parentSession });
-    if (source.taskRef)
-        flags.push({ flag: "--task-ref", value: source.taskRef });
-    flags.push({ flag: "--append-system-prompt", value: buildScopedSystemPrompt(source) });
-    flags.push({ flag: "--session-mode", value: "worker" });
-    return flags;
-}
-export function buildScopedSystemPrompt(source) {
-    const paths = source.writePaths?.length ? source.writePaths.join(", ") : "no additional paths granted";
-    const sentences = [
-        `You are a tmux worker dispatched under ${source.identity}.`,
-        `Stay within these write paths: ${paths}.`,
-        "Hard stops — publishing/npm, git push, tagging a release, changing credentials/auth, or destructive deletion — require returning BLOCKED for owner approval. Never self-approve a hard stop.",
-    ];
-    if (source.worktreeLane) {
-        sentences.push(`You are bound to worktree-sync lane '${source.worktreeLane}': work only inside this lane's own worktree, integrate exclusively via worktree_sync land, and never touch main directly.`);
-    }
-    return sentences.join(" ");
-}
-// ---------------------------------------------------------------------------
-// Advisory worker usage claim: budget stays advisory across the process boundary.
-// ---------------------------------------------------------------------------
-/** Permissively decode a worker-reported usage CLAIM (a cooperative worker may write this to a
- * well-known sibling file before printing its completion marker). Read-defensive: missing/malformed
- * numeric fields default to 0 rather than throwing — this is untrusted, OPTIONAL, advisory input, never
- * an authoritative billing record. Returns undefined only when `raw` isn't even an object, so the
- * caller can distinguish "no claim offered" (skip reporting) from "a claim was offered" (report it,
- * however partial). */
-export function decodeTmuxWorkerUsageClaim(raw) {
-    if (!isPlainRecord(raw))
-        return undefined;
-    const num = (value) => (typeof value === "number" && Number.isFinite(value) ? value : 0);
-    const cost = isPlainRecord(raw.cost) ? raw.cost : {};
-    return {
-        input: num(raw.input),
-        output: num(raw.output),
-        cacheRead: num(raw.cacheRead),
-        cacheWrite: num(raw.cacheWrite),
-        totalTokens: num(raw.totalTokens),
-        cost: {
-            input: num(cost.input),
-            output: num(cost.output),
-            cacheRead: num(cost.cacheRead),
-            cacheWrite: num(cost.cacheWrite),
-            total: num(cost.total),
-        },
-    };
-}
-//# sourceMappingURL=dispatch-grant.js.map