@fitchmultz/pi-subagents 0.0.0-stage → 0.44.4

package/scripts/build.mjs

@@ -0,0 +1,134 @@
+#!/usr/bin/env node
+/**
+ * Purpose: Produce the compiled runtime files that the Pi extension manifest loads.
+ * Responsibilities: Run TypeScript emit into a staging directory, then atomically swap it
+ * into dist/ so a failed TypeScript emit never destroys a previously working dist.
+ * Usage: `npm run build`; also invoked by scripts/prepare.mjs during install lifecycles, which may pass
+ * the path of a throwaway compiler's `bin/tsc` as the first argument.
+ * Invariants/Assumptions: `node_modules` (or that argument) provides `typescript`; deleting `dist/` is safe generated output.
+ */
+
+import { execFile as execFileCallback } from "node:child_process";
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import { readFile, readdir, rename, rm, writeFile } from "node:fs/promises";
+import { join } from "node:path";
+import process from "node:process";
+import { setTimeout as delay } from "node:timers/promises";
+import { promisify } from "node:util";
+
+const execFile = promisify(execFileCallback);
+const RM_OPTIONS = { force: true, maxRetries: 5, recursive: true, retryDelay: 100 };
+const RENAME_RETRY_LIMIT = 50;
+const RENAME_RETRY_MS = 50;
+// Use the current Node binary without a shell, including install paths with spaces.
+const tscPath = process.argv[2] ?? join(process.cwd(), "node_modules", "typescript", "bin", "tsc");
+
+async function discardStaging(path) {
+	try {
+		await rm(path, RM_OPTIONS);
+	} catch (error) {
+		// Cleanup is always best-effort: it must not turn a successful race loss
+		// into failure or replace the compiler/publish error that matters.
+		console.warn(`could not remove staging ${path}: ${error?.message ?? error}`);
+	}
+}
+
+function isOwnerGone(pid) {
+	try {
+		process.kill(pid, 0);
+		return false;
+	} catch (error) {
+		return error?.code === "ESRCH";
+	}
+}
+
+async function hasPublishedDist(path) {
+	try {
+		return (await readdir(path)).length > 0;
+	} catch {
+		return false;
+	}
+}
+
+async function reapStrandedStaging(cwd) {
+	// Signal 0 proves only that the owner was gone at probe time. Pid reuse
+	// between this probe and removal is inherent to pid-based reaping.
+	for (const entry of await readdir(cwd, { withFileTypes: true })) {
+		const match = /^dist\.staging\.(\d+)$/.exec(entry.name);
+		if (!match || !entry.isDirectory()) continue;
+		const ownerPid = Number(match[1]);
+		if (ownerPid === process.pid || !isOwnerGone(ownerPid)) continue;
+		await discardStaging(join(cwd, entry.name));
+	}
+}
+
+async function compileToStaging(cwd, stagingDir) {
+	try {
+		const { stderr, stdout } = await execFile(
+			process.execPath,
+			[tscPath, "-p", "tsconfig.build.json", "--outDir", stagingDir],
+			{ cwd, maxBuffer: 10 * 1024 * 1024 },
+		);
+		if (stdout) process.stdout.write(stdout);
+		if (stderr) process.stderr.write(stderr);
+		const stamp = "extension/build-info.js";
+		const hash = createHash("sha256");
+		for (const file of (await readdir(stagingDir, { recursive: true })).filter((file) => file.endsWith(".js") && file !== stamp).sort()) {
+			hash.update(file).update("\0").update(await readFile(join(stagingDir, file))).update("\0");
+		}
+		const { version } = JSON.parse(await readFile(join(cwd, "package.json"), "utf8"));
+		await writeFile(join(stagingDir, stamp), `export const EXTENSION_BUILD = Object.freeze(${JSON.stringify({ version, sha256: hash.digest("hex") })});\n`);
+	} catch (error) {
+		if (error?.stdout) process.stdout.write(error.stdout);
+		if (error?.stderr) process.stderr.write(error.stderr);
+		await discardStaging(stagingDir);
+		throw error;
+	}
+}
+
+async function publishStaging(stagingDir, distDir) {
+	try {
+		// A failed dist removal must fail loudly; keep it outside the retry loop.
+		// Remove dist exactly once so retries never delete a concurrent winner.
+		await rm(distDir, RM_OPTIONS);
+		for (let retry = 0; ; retry++) {
+			try {
+				await rename(stagingDir, distDir);
+				return;
+			} catch (error) {
+				// A completed staged build is non-empty; a bare directory is not proof
+				// that a concurrent publisher won the race.
+				if (await hasPublishedDist(distDir)) {
+					console.warn("dist/ was published by a concurrent build; discarding this build's staging tree.");
+					return;
+				}
+				// At most 50 retries (~2.5s) keep persistent filesystem errors bounded.
+				if (existsSync(stagingDir) && retry < RENAME_RETRY_LIMIT) {
+					await delay(RENAME_RETRY_MS);
+					continue;
+				}
+				throw error;
+			}
+		}
+	} finally {
+		// Safe after success too: rename moved stagingDir, so force makes this a no-op.
+		await discardStaging(stagingDir);
+	}
+}
+
+async function main() {
+	const cwd = process.cwd();
+	if (!existsSync(tscPath)) throw new Error(`typescript is not installed at ${tscPath}; run npm install first.`);
+	await reapStrandedStaging(cwd);
+	// Pid-scoped staging isolates concurrent emits; only a complete tree publishes.
+	const stagingDir = join(cwd, `dist.staging.${process.pid}`);
+	await rm(stagingDir, RM_OPTIONS);
+	await compileToStaging(cwd, stagingDir);
+	await publishStaging(stagingDir, join(cwd, "dist"));
+}
+
+main().catch((error) => {
+	console.error(error instanceof Error ? error.message : String(error));
+	process.exitCode = 1;
+});

package/scripts/check-compat.mjs

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+import assert from "node:assert/strict";
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdtempSync, rmSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+  console.log("Usage: node scripts/check-compat.mjs\n\nRun selected-host full CI and native package checks with actual editor receipts.\nAn owned temporary editor checkout is removed after checks; supplied sources stay read-only.\nEnvironment: PI_EDITOR_RECEIPT_TEST_ROOT optionally supplies a clean frozen Git checkout.\nExamples:\n  npm run check:compat\n  PI_EDITOR_RECEIPT_TEST_ROOT=/path/to/pi-apply-edits npm run check:compat\nExit codes: 0 passed; 1 invalid input, unavailable source or failed checks.");
+  process.exit(0);
+}
+assert.equal(process.argv.length, 2, "Expected no arguments; use --help");
+await import("./compat-host.mjs");
+const run = (command, args, options = {}) => {
+  const result = spawnSync(command, args, { stdio: "inherit", timeout: 1_200_000, ...options });
+  if (result.error) throw result.error;
+  assert.equal(result.status, 0, `${command} ${args.join(" ")} failed (${result.status ?? result.signal})`);
+  return result.stdout?.trim();
+};
+const git = (cwd, args) => run("git", args, { cwd, stdio: ["ignore", "pipe", "inherit"], encoding: "utf8" });
+const root = mkdtempSync(join(tmpdir(), "ps-editor-"));
+const editor = join(root, "source");
+try {
+  const supplied = process.env.PI_EDITOR_RECEIPT_TEST_ROOT;
+  let expectedRef;
+  if (supplied) {
+    const source = resolve(supplied);
+    expectedRef = git(source, ["rev-parse", "HEAD"]);
+    assert.equal(git(source, ["status", "--porcelain", "--untracked-files=all"]), "", "Supplied editor source must be clean");
+    run("git", ["clone", "--no-hardlinks", "--quiet", source, editor]);
+    git(editor, ["checkout", "--quiet", "--detach", expectedRef]);
+  } else {
+    run("git", ["clone", "--depth", "1", "--branch", "main", "--single-branch", "--quiet", "https://github.com/fitchmultz/pi-apply-edits.git", editor]);
+  }
+  const ref = git(editor, ["rev-parse", "HEAD"]);
+  assert.match(ref, /^[a-f0-9]{40}$/);
+  if (expectedRef) assert.equal(ref, expectedRef);
+  assert.ok(existsSync(join(editor, "extensions", "apply-edits.ts")), "Editor source lacks its native extension");
+  // Only the editor's real third-party runtime dependencies; Pi supplies its own peers through the loader.
+  run("npm", ["ci", "--omit=dev", "--ignore-scripts", "--legacy-peer-deps", "--no-audit", "--no-fund"], { cwd: editor });
+  git(editor, ["diff", "--exit-code"]);
+  console.log(JSON.stringify({ nativeEditor: { ref, source: editor, supplied: supplied ? resolve(supplied) : null } }));
+  const env = { ...process.env, PI_EDITOR_RECEIPT_TEST_ROOT: editor };
+  run("npm", ["run", "ci"], { env });
+  run(process.execPath, ["scripts/native-package-smoke.mjs"], { env });
+} finally {
+  rmSync(root, { recursive: true, force: true });
+}

package/scripts/compat-host.mjs

@@ -0,0 +1,19 @@
+// Validate the graph prepared by the compatibility runner; never install a host here.
+import assert from "node:assert/strict";
+import { createHash } from "node:crypto";
+import { readFileSync, realpathSync } from "node:fs";
+import { findPackageJSON } from "node:module";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const hostRoot = realpathSync(dirname(findPackageJSON("@earendil-works/pi-coding-agent", import.meta.url)));
+export const hostIndex = join(hostRoot, "dist/index.js");
+const manifest = JSON.parse(readFileSync(join(hostRoot, "package.json"), "utf8"));
+export const hostCli = realpathSync(join(hostRoot, manifest.bin.pi));
+for (const [name, actual] of [["PI_COMPAT_EXPECTED_PACKAGE_DIR", hostRoot], ["PI_HOST_INDEX", hostIndex], ["PI_HOST_CLI", hostCli]]) {
+  if (process.env[name]) assert.equal(realpathSync(process.env[name]), realpathSync(actual), `${name} must select the installed graph`);
+}
+if (process.env.PI_COMPAT_EXPECTED_VERSION) assert.equal(manifest.version, process.env.PI_COMPAT_EXPECTED_VERSION);
+assert.equal(realpathSync(fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent"))), realpathSync(hostIndex));
+const hash = path => createHash("sha256").update(readFileSync(path)).digest("hex");
+console.log(JSON.stringify({ host: process.env.PI_COMPAT_HOST ?? "local", version: manifest.version, node: process.version, hostRoot, hostIndex, hostCli, indexSha256: hash(hostIndex), cliSha256: hash(hostCli) }));

package/scripts/linux-smoke.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
+  printf '%s\n' 'Usage: bash scripts/linux-smoke.sh
+
+Validate committed HEAD in Docker against a credential-free, prebuilt Pi 1.0
+Linux archive with a single top-level pi/ directory and built SDK/CLI output.
+
+Example:
+  PI_LINUX_PI_ARCHIVE=/tmp/pi-linux.tar.gz bash scripts/linux-smoke.sh
+
+Environment:
+  PI_LINUX_PI_ARCHIVE  Absolute archive path (required)
+  PI_LINUX_IMAGE      Node 24.21.0+ Linux image (default: node:24-bookworm)
+
+Exit codes: 0 passed; 1 validation failed; 2 invalid arguments.'
+  exit 0
+fi
+if [[ $# -ne 0 ]]; then
+  printf '%s\n' 'No arguments accepted; use --help.' >&2
+  exit 2
+fi
+: "${PI_LINUX_PI_ARCHIVE:?Set PI_LINUX_PI_ARCHIVE to an absolute path to a credential-free prebuilt Linux Pi 1.0 .tar.gz (top-level pi/) with its Linux dependencies and built SDK/CLI.}"
+
+# Validate committed HEAD without passing host credentials or mounting the checkout.
+git -C "$(dirname "$0")/.." archive HEAD | docker run --rm --init -i \
+  --mount "type=bind,src=$PI_LINUX_PI_ARCHIVE,dst=/native-pi.tar.gz,readonly" \
+  "${PI_LINUX_IMAGE:-node:24-bookworm}" bash -c '
+set -euo pipefail
+mkdir /workspace /native-pi
+tar -xf - -C /workspace
+tar -xzf /native-pi.tar.gz -C /native-pi --strip-components=1
+chown -R node:node /workspace /native-pi
+runuser -u node -- bash -c '\''
+set -euo pipefail
+cd /workspace
+node --version
+npm --version
+uname -sm
+npm ci
+ln -sf /native-pi/packages/coding-agent/dist/bundle/cli.js node_modules/.bin/pi
+export PI_INTERCOM_TEST_SDK=/native-pi/packages/coding-agent
+export PI_OWNERSHIP_TEST_PACKAGE_ROOT="$PI_INTERCOM_TEST_SDK"
+export PI_CONTEXT_TEST_PACKAGE_ROOT="$PI_INTERCOM_TEST_SDK"
+export PI_PACKAGE_DIR="$PI_INTERCOM_TEST_SDK"
+export PATH="$PWD/node_modules/.bin:$PATH"
+pi --version
+npm run ci
+'\''
+'

package/scripts/local-install-smoke.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+import { mkdtempSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { spawnSync } from "node:child_process";
+import process from "node:process";
+import { hostCli } from "./compat-host.mjs";
+
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+	console.log(`Usage: node scripts/local-install-smoke.mjs\n\nInstalls this repository into an isolated temporary Pi home, then verifies pi list\ncan resolve the single package. User-level Pi settings are not modified.\n\nExit codes:\n  0  local path install/list smoke passed\n  1  pi install or pi list failed, or the installed package was not listed`);
+	process.exit(0);
+}
+
+function isolatedEnv(home) {
+	const env = { ...process.env };
+	for (const key of Object.keys(env)) if (key.startsWith("PI_SUBAGENT_")) delete env[key];
+	return {
+		...env,
+		HOME: home,
+		XDG_CONFIG_HOME: join(home, ".config"),
+		XDG_CACHE_HOME: join(home, ".cache"),
+		PI_CODING_AGENT_DIR: join(home, ".pi", "agent"),
+		PI_OFFLINE: "1",
+		PATH: process.env.PATH ?? "",
+	};
+}
+
+function runPi(args, env) {
+	const result = spawnSync(process.execPath, [hostCli, ...args], {
+		cwd: process.cwd(),
+		env,
+		encoding: "utf-8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	return {
+		ok: !result.error && result.status === 0,
+		output: result.error ? result.error.message : `${result.stdout ?? ""}${result.stderr ?? ""}`,
+		status: result.status,
+	};
+}
+
+function requireSuccess(label, result) {
+	if (result.ok) return;
+	throw new Error(`${label} failed with ${result.status ?? "spawn error"}:\n${result.output}`);
+}
+
+const repoRoot = resolve(process.cwd());
+const home = mkdtempSync(join(tmpdir(), "pi-subagents-install-smoke-"));
+
+try {
+	const env = isolatedEnv(home);
+	requireSuccess("pi install pi-subagents", runPi(["install", repoRoot, "--approve"], env));
+
+	const list = runPi(["list", "--approve"], env);
+	requireSuccess("pi list", list);
+	if (!list.output.includes(repoRoot)) {
+		throw new Error(`pi list did not include installed local path ${repoRoot}:\n${list.output}`);
+	}
+
+	console.log("[local-install-smoke] installed and listed the single pi-subagents package with bundled intercom");
+} catch (error) {
+	console.error(`[local-install-smoke] ${error instanceof Error ? error.message : String(error)}`);
+	process.exitCode = 1;
+} finally {
+	rmSync(home, { recursive: true, force: true });
+}

package/scripts/native-package-smoke.mjs

@@ -0,0 +1,82 @@
+// Full runtime-only package: native SDK + bundled CLI, one private Intercom broker, no model calls.
+import assert from "node:assert/strict";
+import { spawn, spawnSync } from "node:child_process";
+import { once } from "node:events";
+import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { pathToFileURL } from "node:url";
+import { hostCli, hostIndex, hostRoot } from "./compat-host.mjs";
+
+const packageRoot = resolve(process.argv[2] ?? ".");
+const root = mkdtempSync(join(tmpdir(), "ps-native-"));
+const agentDir = join(root, "agent");
+mkdirSync(agentDir);
+Object.assign(process.env, { HOME: root, USERPROFILE: root, PI_CODING_AGENT_DIR: agentDir, PI_SUBAGENT_TEMP_ROOT: join(root, "pi-subagents-runs"), PI_OFFLINE: "1", PI_TELEMETRY: "0", PI_PACKAGE_DIR: hostRoot });
+// A pruned extension cannot discover the embedding SDK via its own node_modules or PATH.
+// PI_PACKAGE_DIR is the existing detached-runtime host contract, not a loader workaround.
+const sdk = await import(pathToFileURL(hostIndex).href);
+const broker = spawn(process.execPath, [join(packageRoot, "dist/pi-intercom/broker/broker.js")], { cwd: root, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
+let brokerLog = "";
+broker.stdout.on("data", data => { brokerLog += data; });
+broker.stderr.on("data", data => { brokerLog += data; });
+let session;
+try {
+  for (let i = 0; !brokerLog.includes("Intercom broker started"); i++) {
+    assert.ok(i < 100 && broker.exitCode === null, brokerLog || "Private broker did not start");
+    await delay(50);
+  }
+  const settingsManager = sdk.SettingsManager.inMemory({ packages: [packageRoot], compaction: { enabled: false }, retry: { enabled: false } });
+  const loader = new sdk.DefaultResourceLoader({ cwd: root, agentDir, settingsManager, noSkills: true, noContextFiles: true, noPromptTemplates: true, noThemes: true });
+  await loader.reload();
+  assert.deepEqual(loader.getExtensions().errors, []);
+  assert.deepEqual(loader.getExtensions().warnings ?? [], []);
+  assert.equal(loader.getExtensions().extensions.length, 2);
+  const modelRuntime = await sdk.ModelRuntime.create({ authPath: join(agentDir, "auth.json"), modelsPath: null, modelsStorePath: join(agentDir, "models-store.json"), allowModelNetwork: false });
+  ({ session } = await sdk.createAgentSession({ cwd: root, agentDir, settingsManager, resourceLoader: loader, modelRuntime, sessionManager: sdk.SessionManager.create(root, join(root, "sessions")), noTools: "builtin" }));
+  const errors = [];
+  await session.bindExtensions({ mode: "print", onError: error => errors.push(error) });
+  for (const name of ["delegate", "load_subagent", "load_intercom"]) assert.ok(session.getActiveToolNames().includes(name), name);
+  for (const name of ["agent_runs", "subagent", "intercom"]) assert.ok(!session.getActiveToolNames().includes(name), `${name} starts lazy`);
+  await session.agent.state.tools.find(tool => tool.name === "load_subagent").execute("controls", { advanced: false }, new AbortController().signal);
+  assert.ok(session.getActiveToolNames().includes("agent_runs"));
+  assert.ok(!session.getActiveToolNames().includes("subagent"));
+  await session.agent.state.tools.find(tool => tool.name === "load_intercom").execute("peers", {}, new AbortController().signal);
+  const status = await session.agent.state.tools.find(tool => tool.name === "intercom").execute("status", { action: "status" }, new AbortController().signal);
+  assert.match(JSON.stringify(status.content), /Connected: Yes/);
+  const runs = await session.agent.state.tools.find(tool => tool.name === "agent_runs").execute("history-list", { action: "list" }, new AbortController().signal);
+  assert.notEqual(runs.isError, true, JSON.stringify(runs.content));
+  assert.equal(runs.details.runList.total, 0);
+  assert.deepEqual(errors, []);
+  const marker = join(root, "cli.json");
+  const observer = join(root, "observer.ts");
+  writeFileSync(observer, `import { writeFileSync } from "node:fs";
+import { SubagentHistoryIndex } from ${JSON.stringify(join(packageRoot, "dist/history/index.js"))};
+export default function(pi) { pi.on("session_start", async (_event, ctx) => {
+const index = new SubagentHistoryIndex(${JSON.stringify(agentDir)});
+try {
+  await index.setOwner({ ownerSessionId: ctx.sessionManager.getSessionId(), runs: [] });
+  const history = await index.listRuns();
+  writeFileSync(${JSON.stringify(marker)}, JSON.stringify({ tools: pi.getActiveTools(), commands: pi.getCommands().map(c => c.name), historyRuns: history.total }));
+} finally { await index.close(); ctx.shutdown(); }
+}); }`);
+  const cliEnv = { ...process.env, PATH: "/usr/bin:/bin" };
+  delete cliEnv.PI_PACKAGE_DIR; // Ordinary CLI consumers locate their host through argv, unlike detached SDK embeddings.
+  const child = spawnSync(process.execPath, [hostCli, "--mode", "rpc", "--no-session", "-ne", "-ns", "-np", "-nc", "--no-themes", "--approve", "-e", packageRoot, "-e", observer], { cwd: root, env: cliEnv, input: "", encoding: "utf8", timeout: 30_000 });
+  assert.equal(child.status, 0, `${child.error ?? ""}\n${child.stderr}`);
+  assert.doesNotMatch(child.stderr, /Failed to load extension|ERR_INTERNAL_ASSERTION|Extension error/);
+  const observed = JSON.parse(readFileSync(marker, "utf8"));
+  assert.equal(observed.historyRuns, 0, "CLI workers must inherit the selected host without Pi on PATH");
+  for (const name of ["delegate", "load_subagent", "load_intercom"]) assert.ok(observed.tools.includes(name), name);
+  for (const name of ["agent_runs", "subagent", "intercom"]) assert.ok(!observed.tools.includes(name), `${name} starts lazy in CLI`);
+  assert.ok(observed.commands.includes("subagents-doctor"));
+  console.log("[native-package-smoke] both compiled entries, history worker, broker registration/status, bundled RPC startup, and shutdown passed");
+} finally {
+  try {
+    if (session) { await session.extensionRunner.emit({ type: "session_shutdown", reason: "quit" }); session.dispose(); }
+  } finally {
+    if (broker.exitCode === null) { const exited = once(broker, "exit"); broker.kill("SIGTERM"); await exited; }
+    rmSync(root, { recursive: true, force: true });
+  }
+}

package/scripts/package-smoke.mjs

@@ -0,0 +1,205 @@
+#!/usr/bin/env node
+import { spawnSync } from "node:child_process";
+import { createRequire } from "node:module";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { dirname, join } from "node:path";
+import { pathToFileURL } from "node:url";
+import process from "node:process";
+import { hostCli, hostRoot } from "./compat-host.mjs";
+
+const require = createRequire(import.meta.url);
+const packageJson = require("../package.json");
+process.env.PI_PACKAGE_DIR = hostRoot;
+let productionRoot;
+
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+	console.log(`Usage: node scripts/package-smoke.mjs\n\nVerifies the local pi-subagents package shape without publishing.\n\nChecks:\n  - npm pack includes subagent and intercom runtime resources\n  - package.json pi manifest points at both extensions and skills without registering example prompts\n  - both compiled dist extension entrypoints load as native ES modules\n  - a packed production install with dev dependencies omitted can load the detached runner and native broker\n\nExit codes:\n  0  smoke passed\n  1  package shape or runtime load check failed`);
+	process.exit(0);
+}
+
+function fail(message) {
+	console.error(`[package-smoke] ${message}`);
+	if (productionRoot) console.error(`[package-smoke] failure evidence: ${productionRoot}`);
+	process.exit(1);
+}
+
+function run(command, args, cwd = process.cwd(), env = process.env) {
+	const result = spawnSync(command, args, {
+		cwd,
+		env,
+		encoding: "utf-8",
+		stdio: ["ignore", "pipe", "pipe"],
+	});
+	if (result.error) throw new Error(`failed to start ${command}: ${result.error.message}`);
+	if (result.status !== 0) {
+		process.stderr.write(result.stderr);
+		process.stdout.write(result.stdout);
+		throw new Error(`${command} ${args.join(" ")} exited with ${result.status}`);
+	}
+	return result.stdout;
+}
+
+function runOrFail(command, args, cwd = process.cwd()) {
+	try {
+		return run(command, args, cwd);
+	} catch (error) {
+		fail(error instanceof Error ? error.message : String(error));
+	}
+}
+
+function assertPackedFile(files, path) {
+	if (!files.some((file) => file.path === path)) fail(`npm pack output is missing ${path}`);
+}
+
+function assertNotPackedFile(files, path) {
+	if (files.some((file) => file.path === path)) fail(`npm pack output should not include ${path}`);
+}
+
+productionRoot = mkdtempSync(join(tmpdir(), "pi-subagents-package-smoke-"));
+const packDir = join(productionRoot, "pack");
+mkdirSync(packDir);
+const packOutput = runOrFail("npm", ["pack", "--json", "--pack-destination", packDir]);
+let packs;
+try {
+	packs = JSON.parse(packOutput);
+} catch (error) {
+	fail(`npm pack --json returned invalid JSON: ${error instanceof Error ? error.message : String(error)}`);
+}
+// npm 11 returns an array; npm 12 keys the same records by package name.
+const pack = Object.values(packs)[0];
+if (!pack || !Array.isArray(pack.files)) fail("npm pack --json did not report a file list");
+
+for (const path of [
+	"package.json",
+	"LICENSE",
+	"README.md",
+	"dist/extension/index.js",
+	"dist/pi-intercom/index.js",
+	"dist/pi-intercom/broker/broker.js",
+	"dist/runs/background/subagent-runner-launcher.js",
+	"src/extension/index.ts",
+	"src/extension/schemas.ts",
+	"src/pi-intercom/index.ts",
+	"src/pi-intercom/broker/broker.ts",
+	"src/pi-intercom/ui/session-list.ts",
+	"src/shared/types.ts",
+	"src/runs/background/subagent-runner-launcher.ts",
+	"agents/reviewer.md",
+	"agents/reviewer-gpt.md",
+	"agents/watcher.md",
+	"skills/pi-subagents/SKILL.md",
+	"skills/pi-intercom/SKILL.md",
+	"docs/intercom.md",
+	"prompts/review-loop.md",
+	"scripts/real-pi-smoke.mjs",
+]) {
+	assertPackedFile(pack.files, path);
+}
+
+assertNotPackedFile(pack.files, "install.mjs");
+
+if (packageJson.name !== "@fitchmultz/pi-subagents" || packageJson.private === true || packageJson.publishConfig?.access !== "public") fail("package.json must expose the owned public scoped npm identity");
+if (packageJson.bin !== undefined) fail("package.json must not expose a legacy npx/bin installer");
+if (!packageJson.pi?.extensions?.includes("./dist/extension/index.js")) fail("package.json pi.extensions must include ./dist/extension/index.js");
+if (!packageJson.pi?.extensions?.includes("./dist/pi-intercom/index.js")) fail("package.json pi.extensions must include ./dist/pi-intercom/index.js");
+if (!packageJson.pi?.skills?.includes("./skills")) fail("package.json pi.skills must include ./skills");
+if (packageJson.pi?.prompts !== undefined) fail("package.json pi.prompts must stay unset so example prompts are not registered as slash commands");
+
+for (const entrypoint of ["../dist/extension/index.js", "../dist/pi-intercom/index.js"]) {
+	const extensionModule = await import(new URL(entrypoint, import.meta.url));
+	if (typeof extensionModule.default !== "function") fail(`${entrypoint} did not load a default registration function`);
+}
+
+let productionImportError;
+try {
+	const installDir = join(productionRoot, "install");
+	mkdirSync(installDir);
+	writeFileSync(join(installDir, "package.json"), JSON.stringify({ private: true, type: "module" }));
+	const filename = pack.filename;
+	if (typeof filename !== "string") throw new Error("npm pack did not report a tarball filename");
+	run("npm", ["install", "--ignore-scripts", "--omit=dev", "--legacy-peer-deps", join(packDir, filename)], installDir);
+	const installedRoot = join(installDir, "node_modules", packageJson.name);
+	if (!existsSync(installedRoot)) throw new Error(`production install is missing ${packageJson.name}`);
+	const gitPackageRoot = join(productionRoot, "git-package");
+	cpSync(installedRoot, gitPackageRoot, { recursive: true });
+	run("npm", ["install", "--ignore-scripts", "--omit=dev", "--legacy-peer-deps"], gitPackageRoot);
+	for (const name of ["typebox", "@earendil-works/pi-agent-core", "@earendil-works/pi-ai", "@earendil-works/pi-coding-agent", "@earendil-works/pi-tui"]) {
+		if (existsSync(join(gitPackageRoot, "node_modules", name))) throw new Error(`runtime-only package shadows host-provided ${name}`);
+	}
+	const hostTypebox = await import(pathToFileURL(createRequire(join(hostRoot, "dist/index.js")).resolve("typebox")).href);
+	const nativeTypebox = await import(pathToFileURL(join(gitPackageRoot, "dist/shared/native-typebox.js")).href);
+	if (nativeTypebox.Type !== hostTypebox.Type) throw new Error("packed runtime did not use the selected host's TypeBox");
+	await import(pathToFileURL(join(gitPackageRoot, "dist", "runs", "shared", "acceptance-contract.js")).href);
+	await import(pathToFileURL(join(gitPackageRoot, "dist", "runs", "shared", "supervisor-questions.js")).href);
+	const brokerSpawn = await import(pathToFileURL(join(gitPackageRoot, "dist", "pi-intercom", "broker", "spawn.js")).href);
+	const brokerCwd = brokerSpawn.getBrokerSpawnOptions().cwd;
+	if (realpathSync(brokerCwd) !== realpathSync(gitPackageRoot)) throw new Error(`packed broker resolved ${brokerCwd} instead of ${gitPackageRoot}`);
+	run(process.execPath, ["--check", join(gitPackageRoot, "dist", "pi-intercom", "broker", "broker.js")], gitPackageRoot);
+	const distPiArgs = await import(pathToFileURL(join(gitPackageRoot, "dist", "runs", "shared", "pi-args.js")).href);
+	const childArgs = distPiArgs.buildPiArgs({
+		baseArgs: [],
+		task: "package-smoke",
+		sessionEnabled: false,
+		inheritProjectContext: false,
+		inheritSkills: false,
+		allowSubagents: true,
+	}).args ?? [];
+	const childExtensionPaths = childArgs.flatMap((arg, index) => (arg === "--extension" ? [childArgs[index + 1]] : []));
+	if (childExtensionPaths.length === 0) throw new Error("dist buildPiArgs emitted no --extension paths");
+	for (const extensionPath of childExtensionPaths) {
+		if (!existsSync(extensionPath)) throw new Error(`dist buildPiArgs emitted a missing --extension path: ${extensionPath}`);
+	}
+
+	const home = join(productionRoot, "native-home");
+	const asyncDir = join(home, "run");
+	mkdirSync(asyncDir, { recursive: true });
+	const sessionFile = join(home, "child.jsonl");
+	writeFileSync(sessionFile, `${JSON.stringify({ type: "session", version: 3, id: "packed-native-probe", cwd: home, timestamp: new Date().toISOString() })}\n`);
+	const marker = join(home, "native-started.json");
+	const observer = join(home, "observe.ts");
+	writeFileSync(observer, `import { writeFileSync, writeSync } from "node:fs";
+import { fauxAssistantMessage, fauxProvider } from "@earendil-works/pi-ai";
+export default function (pi) {
+	const faux = fauxProvider();
+	pi.registerProvider("faux", { api: faux.api, baseUrl: faux.getModel().baseUrl, apiKey: "fixture-key", models: faux.models, streamSimple: faux.provider.streamSimple });
+	pi.on("session_start", (_event, ctx) => {
+		pi.appendEntry("package-probe", { nativeSession: true });
+		writeFileSync(${JSON.stringify(marker)}, JSON.stringify({ sessionFile: ctx.sessionManager.getSessionFile(), model: { provider: ctx.model?.provider, id: ctx.model?.id }, modelCalls: faux.state.callCount }));
+		const message = fauxAssistantMessage("PACKED_NATIVE_COMPLETE");
+		// Pi redirects extension stdout to stderr; this fixture emits controlled wire records.
+		writeSync(1, JSON.stringify({ type: "message_end", message }) + "\\n" + JSON.stringify({ type: "agent_settled" }) + "\\n");
+		process.exit(0);
+	});
+}`);
+	const nativeEnv = { ...process.env, HOME: home, PI_CODING_AGENT_DIR: join(home, "agent"), PI_OFFLINE: "1" };
+	for (const key of Object.keys(nativeEnv)) if (key.startsWith("PI_SUBAGENT_") || /(?:API_KEY|AUTH_TOKEN|ACCESS_TOKEN)$/.test(key)) delete nativeEnv[key];
+	nativeEnv.PI_SUBAGENT_TEMP_ROOT = join(home, "pi-subagents-runtime");
+	const piPackageRoot = hostRoot;
+	const bin = join(home, "bin");
+	mkdirSync(bin);
+	writeFileSync(join(bin, "pi"), `#!/bin/sh\nexec "${process.execPath}" "${hostCli}" "$@"\n`, { mode: 0o755 });
+	// A wrapper-only PATH also covers managed installs whose shim is not a symlink.
+	nativeEnv.PATH = `${bin}:${dirname(process.execPath)}:/usr/bin:/bin`;
+	delete nativeEnv.PI_PACKAGE_DIR;
+	const configPath = join(home, "config.json");
+	const resultPath = join(home, "result.json");
+	writeFileSync(configPath, JSON.stringify({ id: "packed-native", cwd: home, asyncDir, resultPath, piPackageRoot, placeholder: "{previous}", resultMode: "single", sessionDir: home, steps: [{ agent: "probe", task: "Controlled package startup check; no model call", model: "faux/faux-1", sessionFile, extensions: [observer], inheritProjectContext: false, inheritSkills: false }] }));
+	run(process.execPath, [join(gitPackageRoot, "dist/runs/background/subagent-runner-launcher.js"), join(gitPackageRoot, "dist/runs/background/subagent-runner.js"), configPath], home, nativeEnv);
+	const result = JSON.parse(readFileSync(resultPath, "utf8"));
+	if (result.success !== true || result.results?.[0]?.output !== "PACKED_NATIVE_COMPLETE") throw new Error(`Packed detached runner did not complete its controlled native Pi child: ${JSON.stringify({ nativeStarted: existsSync(marker), children: result.results?.map(({ exitCode, error, output }) => ({ exitCode, error, output })) })}`);
+	const observed = JSON.parse(readFileSync(marker, "utf8"));
+	if (observed.sessionFile !== sessionFile) throw new Error("Packed child did not bind the requested native Pi session");
+	if (observed.model?.provider !== "faux" || observed.model?.id !== "faux-1" || observed.modelCalls !== 0) throw new Error("Packed child must select the native faux model without invoking it");
+	console.log("[package-smoke] packed detached Node runner completed a controlled native Pi startup (no model call)");
+	process.stdout.write(run(process.execPath, [join(process.cwd(), "scripts/native-package-smoke.mjs"), gitPackageRoot], home, { ...nativeEnv, PI_PACKAGE_DIR: hostRoot }));
+} catch (error) {
+	productionImportError = error;
+} finally {
+	if (!productionImportError) rmSync(productionRoot, { recursive: true, force: true });
+}
+if (productionImportError) {
+	fail(`packed production install could not load runtime paths: ${productionImportError instanceof Error ? productionImportError.message : String(productionImportError)}`);
+}
+
+console.log(`[package-smoke] ${pack.name}@${pack.version}: ${pack.files.length} files packed; subagent, intercom, runner, and broker paths loaded`);