@galaxy-foundry/gxwf-pi-harness 0.0.0 → 0.1.0

package/Dockerfile

@@ -0,0 +1,19 @@
+ARG NODE_IMAGE=node:22.19.0-bookworm-slim
+FROM ${NODE_IMAGE}
+
+ARG PI_VERSION=0.84.4
+ARG FOUNDRY_CLI_VERSION=0.1.0
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
+    && rm -rf /var/lib/apt/lists/*
+RUN npm install -g --ignore-scripts \
+    "@earendil-works/pi-coding-agent@${PI_VERSION}" \
+    "@galaxy-foundry/gxwf-foundry@${FOUNDRY_CLI_VERSION}"
+
+LABEL org.galaxyproject.foundry.pi-version="${PI_VERSION}" \
+      org.galaxyproject.foundry.cli-version="${FOUNDRY_CLI_VERSION}" \
+      org.galaxyproject.foundry.pi-rpc-version="1"
+
+WORKDIR /workspace
+ENTRYPOINT ["pi"]

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Galaxy Project
+Copyright (c) 2026 John Chilton
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,5 +1,43 @@
 # @galaxy-foundry/gxwf-pi-harness
 
-Reserved bootstrap package for the Galaxy Workflow Foundry Pi evaluation harness.
+Pi-backed worker isolation for evaluating published Galaxy Workflow Foundry skills.
 
-The implementation will be published from [galaxyproject/foundry](https://github.com/galaxyproject/foundry) through npm trusted publishing.
+The package has two surfaces:
+
+- `runPiSkill()` starts one ephemeral Pi RPC worker with one explicitly loaded skill, a fresh configuration directory, staged declared inputs, and ambient resource discovery disabled.
+- `@galaxy-foundry/gxwf-pi-harness/extension` registers the constrained `foundry_subagent` tool used by a top-level Pipeline skill.
+
+The extension derives the worker's expected artifacts exclusively from the selected published cast's `_provenance.json`. The parent agent can choose the skill, task, and declared inputs, but cannot replace or suppress that artifact contract.
+
+Local mode is process and context isolation, not a security boundary. The trace CLI defaults each local run to a unique directory under the operating system's temporary directory, and both local and container workers load a dereferenced staged copy of the selected skill rather than its checkout path. An explicit `--run-dir` still overrides that diagnostic default.
+
+Container mode runs the whole Pi RPC worker inside a disposable Docker container. It mounts the staged skill bundle and copied declared inputs read-only, mounts only the run's output directory read-write, and uses tmpfs for Pi configuration and temporary files. The checkout itself is never mounted.
+
+Build the default image from the repository root:
+
+```sh
+npm run gxwf-pi-harness:container-build
+```
+
+The image pins Pi 0.84.4 and the `@galaxy-foundry/gxwf-foundry` CLI 0.1.0 required by the pilot `summarize-nextflow` skill. It carries compatibility labels for both runtimes that are checked before every run. A caller may use `--sandbox-image <ref>` for another locally available image with the same labels. The runner resolves the ref to an immutable image ID before launch and records that ID, any repository digests, every mount, the network policy, and the names—not values—of forwarded credential variables.
+
+Container provider access is explicit. Use `--sandbox-network bridge` and repeat `--credential-env <NAME>` for only the variables the provider needs. Use `--sandbox-network none` for credential-free probes. Run the Docker boundary test with `npm run gxwf-pi-harness:container-test`.
+
+## Extension configuration
+
+- `FOUNDRY_SKILLS_DIR` — required path to the installed Foundry skills root.
+- `FOUNDRY_RUNS_DIR` — directory for child run records; defaults to a temporary directory.
+- `FOUNDRY_WORKER_TIMEOUT_MS` — child wall timeout; defaults to ten minutes.
+- `FOUNDRY_SANDBOX` — `local` (default) or `container`.
+- `FOUNDRY_SANDBOX_IMAGE` — optional compatible container image ref.
+- `FOUNDRY_SANDBOX_NETWORK` — `bridge` (default) or `none`.
+- `FOUNDRY_SANDBOX_CREDENTIAL_ENV` — comma-separated environment-variable allowlist.
+
+The trace-mode CLI also accepts `--thinking <level>` when an evaluation should pin Pi's
+reasoning level rather than use the model default.
+
+The extension accepts skill names, never arbitrary skill paths. It resolves each name as one direct child of `FOUNDRY_SKILLS_DIR` and starts the child through the same runner used by trace-mode callers.
+
+## License
+
+MIT.

package/dist/container-rpc-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=container-rpc-entry.d.ts.map

package/dist/container-rpc-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-rpc-entry.d.ts","sourceRoot":"","sources":["../src/container-rpc-entry.ts"],"names":[],"mappings":""}

package/dist/container-rpc-entry.js

@@ -0,0 +1,37 @@
+import { spawn, spawnSync } from "node:child_process";
+import process from "node:process";
+import { buildDockerRunArgs } from "./container.js";
+const encoded = process.env.FOUNDRY_CONTAINER_LAUNCH_CONFIG;
+if (!encoded)
+    throw new Error("FOUNDRY_CONTAINER_LAUNCH_CONFIG is required");
+const config = JSON.parse(encoded);
+const args = buildDockerRunArgs(config, process.argv.slice(2));
+const child = spawn(config.docker_bin, args, { stdio: ["pipe", "pipe", "pipe"] });
+process.stdin.pipe(child.stdin);
+child.stdout.pipe(process.stdout);
+child.stderr.pipe(process.stderr);
+let stopping = false;
+function stop() {
+    if (stopping)
+        return;
+    stopping = true;
+    child.kill("SIGTERM");
+    spawnSync(config.docker_bin, ["container", "rm", "--force", config.container_name], {
+        stdio: "ignore",
+        timeout: 2_000,
+    });
+}
+process.once("SIGINT", stop);
+process.once("SIGTERM", stop);
+child.once("error", (error) => {
+    process.stderr.write(`Unable to start Docker worker: ${error.message}\n`);
+    process.stdin.unpipe(child.stdin);
+    process.stdin.pause();
+    process.exitCode = 1;
+});
+child.once("exit", (code, signal) => {
+    process.stdin.unpipe(child.stdin);
+    process.stdin.pause();
+    process.exitCode = code ?? (signal ? 1 : 0);
+});
+//# sourceMappingURL=container-rpc-entry.js.map

package/dist/container-rpc-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-rpc-entry.js","sourceRoot":"","sources":["../src/container-rpc-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,kBAAkB,EAA8B,MAAM,gBAAgB,CAAC;AAEhF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;AAC5D,IAAI,CAAC,OAAO;IAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAC;AAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAElF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAElC,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,SAAS,IAAI;IACX,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;QAClF,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;IAClC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/container.d.ts

@@ -0,0 +1,33 @@
+export declare const FOUNDRY_CLI_VERSION = "0.1.0";
+export declare const DEFAULT_CONTAINER_IMAGE: string;
+export declare const CONTAINER_PI_VERSION_LABEL = "org.galaxyproject.foundry.pi-version";
+export declare const CONTAINER_FOUNDRY_VERSION_LABEL = "org.galaxyproject.foundry.cli-version";
+export declare const CONTAINER_RPC_VERSION_LABEL = "org.galaxyproject.foundry.pi-rpc-version";
+export declare const CONTAINER_RPC_VERSION = "1";
+export type ContainerNetworkPolicy = "bridge" | "none";
+export interface ContainerMount {
+    type: "bind" | "tmpfs";
+    source?: string;
+    target: string;
+    read_only: boolean;
+    purpose: "skill" | "inputs" | "output" | "agent-config" | "temporary-files";
+}
+export interface ContainerImageResolution {
+    requested: string;
+    resolved_id: string;
+    repo_digests: string[];
+    pi_version: string;
+    foundry_cli_version: string;
+}
+export interface ContainerLaunchConfig {
+    docker_bin: string;
+    container_name: string;
+    image_id: string;
+    network: ContainerNetworkPolicy;
+    credential_env: string[];
+    user?: string;
+    mounts: ContainerMount[];
+}
+export declare function inspectContainerImage(image: string, dockerBin?: string): ContainerImageResolution;
+export declare function buildDockerRunArgs(config: ContainerLaunchConfig, piArgs: string[]): string[];
+//# sourceMappingURL=container.d.ts.map

package/dist/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,uBAAuB,QAAmF,CAAC;AACxH,eAAO,MAAM,0BAA0B,yCAAyC,CAAC;AACjF,eAAO,MAAM,+BAA+B,0CAA0C,CAAC;AACvF,eAAO,MAAM,2BAA2B,6CAA6C,CAAC;AACtF,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,iBAAiB,CAAC;CAC7E;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,sBAAsB,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAgBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,SAAS,SAAW,GACnB,wBAAwB,CAwC1B;AAoBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CA6B5F"}

package/dist/container.js

@@ -0,0 +1,101 @@
+import { spawnSync } from "node:child_process";
+import { VERSION as PI_VERSION } from "@earendil-works/pi-coding-agent";
+export const FOUNDRY_CLI_VERSION = "0.1.0";
+export const DEFAULT_CONTAINER_IMAGE = `galaxy-foundry/gxwf-pi-harness:pi-${PI_VERSION}-foundry-${FOUNDRY_CLI_VERSION}`;
+export const CONTAINER_PI_VERSION_LABEL = "org.galaxyproject.foundry.pi-version";
+export const CONTAINER_FOUNDRY_VERSION_LABEL = "org.galaxyproject.foundry.cli-version";
+export const CONTAINER_RPC_VERSION_LABEL = "org.galaxyproject.foundry.pi-rpc-version";
+export const CONTAINER_RPC_VERSION = "1";
+function dockerFailure(command, stderr) {
+    const detail = stderr?.trim();
+    return new Error(`Docker ${command.join(" ")} failed${detail ? `: ${detail}` : ""}. ` +
+        `Build the default image with "npm run gxwf-pi-harness:container-build" or supply --sandbox-image.`);
+}
+export function inspectContainerImage(image, dockerBin = "docker") {
+    if (!image.trim())
+        throw new Error("container image must not be empty");
+    const command = ["image", "inspect", image];
+    const inspected = spawnSync(dockerBin, command, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (inspected.error)
+        throw inspected.error;
+    if (inspected.status !== 0)
+        throw dockerFailure(command, inspected.stderr);
+    const parsed = JSON.parse(inspected.stdout);
+    if (!Array.isArray(parsed) || parsed.length !== 1) {
+        throw new Error(`Docker returned an invalid image inspection for ${image}`);
+    }
+    const record = parsed[0];
+    if (typeof record.Id !== "string" || !record.Id.startsWith("sha256:")) {
+        throw new Error(`Docker image ${image} has no immutable sha256 image id`);
+    }
+    const labels = record.Config?.Labels ?? {};
+    const imagePiVersion = labels?.[CONTAINER_PI_VERSION_LABEL];
+    const foundryCliVersion = labels?.[CONTAINER_FOUNDRY_VERSION_LABEL];
+    const rpcVersion = labels?.[CONTAINER_RPC_VERSION_LABEL];
+    if (imagePiVersion !== PI_VERSION ||
+        foundryCliVersion !== FOUNDRY_CLI_VERSION ||
+        rpcVersion !== CONTAINER_RPC_VERSION) {
+        throw new Error(`Docker image ${image} is not a compatible Foundry Pi worker ` +
+            `(expected Pi ${PI_VERSION}, Foundry CLI ${FOUNDRY_CLI_VERSION}, and RPC contract ${CONTAINER_RPC_VERSION})`);
+    }
+    return {
+        requested: image,
+        resolved_id: record.Id,
+        repo_digests: Array.isArray(record.RepoDigests)
+            ? record.RepoDigests.filter((value) => typeof value === "string")
+            : [],
+        pi_version: imagePiVersion,
+        foundry_cli_version: foundryCliVersion,
+    };
+}
+function bindMountArgument(mount) {
+    if (!mount.source)
+        throw new Error(`bind mount ${mount.target} has no source`);
+    if (mount.source.includes(",")) {
+        throw new Error(`Docker bind mount source cannot contain a comma: ${mount.source}`);
+    }
+    return [
+        "type=bind",
+        `src=${mount.source}`,
+        `dst=${mount.target}`,
+        ...(mount.read_only ? ["readonly", "bind-recursive=disabled"] : []),
+    ].join(",");
+}
+function tmpfsArgument(mount) {
+    const size = mount.purpose === "agent-config" ? "64m" : "128m";
+    return `${mount.target}:rw,nosuid,nodev,size=${size},mode=1777`;
+}
+export function buildDockerRunArgs(config, piArgs) {
+    const args = [
+        "run",
+        "--rm",
+        "--interactive",
+        "--pull=never",
+        "--name",
+        config.container_name,
+        "--init",
+        "--read-only",
+        "--cap-drop=ALL",
+        "--security-opt=no-new-privileges",
+        "--pids-limit=256",
+        `--network=${config.network}`,
+        "--workdir=/workspace",
+    ];
+    if (config.user)
+        args.push(`--user=${config.user}`);
+    for (const mount of config.mounts) {
+        if (mount.type === "bind")
+            args.push("--mount", bindMountArgument(mount));
+        else
+            args.push("--tmpfs", tmpfsArgument(mount));
+    }
+    args.push("--env=HOME=/tmp", "--env=PI_CODING_AGENT_DIR=/pi-agent", "--env=PI_SKIP_VERSION_CHECK=1");
+    for (const name of config.credential_env)
+        args.push("--env", name);
+    args.push(config.image_id, ...piArgs);
+    return args;
+}
+//# sourceMappingURL=container.js.map

package/dist/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAExE,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,UAAU,YAAY,mBAAmB,EAAE,CAAC;AACxH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CAAC;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,0CAA0C,CAAC;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAoCzC,SAAS,aAAa,CAAC,OAAiB,EAAE,MAAiC;IACzE,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,KAAK,CACd,UAAU,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;QAClE,mGAAmG,CACtG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,SAAS,GAAG,QAAQ;IAEpB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,KAAK;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAY,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAuB,CAAC;IAC/C,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC,+BAA+B,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACzD,IACE,cAAc,KAAK,UAAU;QAC7B,iBAAiB,KAAK,mBAAmB;QACzC,UAAU,KAAK,qBAAqB,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yCAAyC;YAC5D,gBAAgB,UAAU,iBAAiB,mBAAmB,sBAAsB,qBAAqB,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,MAAM,CAAC,EAAE;QACtB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAClF,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,cAAc;QAC1B,mBAAmB,EAAE,iBAAiB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAqB;IAC9C,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACL,WAAW;QACX,OAAO,KAAK,CAAC,MAAM,EAAE;QACrB,OAAO,KAAK,CAAC,MAAM,EAAE;QACrB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,KAAK,CAAC,MAAM,yBAAyB,IAAI,YAAY,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA6B,EAAE,MAAgB;IAChF,MAAM,IAAI,GAAG;QACX,KAAK;QACL,MAAM;QACN,eAAe;QACf,cAAc;QACd,QAAQ;QACR,MAAM,CAAC,cAAc;QACrB,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,kCAAkC;QAClC,kBAAkB;QAClB,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,sBAAsB;KACvB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;;YACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,IAAI,CACP,iBAAiB,EACjB,qCAAqC,EACrC,+BAA+B,CAChC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/extension.d.ts

@@ -0,0 +1,3 @@
+import { type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export default function foundryPiHarness(pi: ExtensionAPI): void;
+//# sourceMappingURL=extension.d.ts.map

package/dist/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAMA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AA0HhF,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAE/D"}

package/dist/extension.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { runPiSkill } from "./runner.js";
+import { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+const FoundrySubagentParams = Type.Object({
+    skill: Type.String({ description: "Published Foundry skill name" }),
+    task: Type.String({ description: "One phase-sized task for the selected skill" }),
+    inputs: Type.Optional(Type.Array(Type.String(), { description: "Declared input paths relative to the Pipeline run" })),
+});
+function sandboxConfiguration() {
+    const sandbox = process.env.FOUNDRY_SANDBOX ?? "local";
+    if (sandbox !== "local" && sandbox !== "container") {
+        throw new Error("FOUNDRY_SANDBOX must be local or container");
+    }
+    const sandboxNetwork = process.env.FOUNDRY_SANDBOX_NETWORK ?? "bridge";
+    if (sandboxNetwork !== "bridge" && sandboxNetwork !== "none") {
+        throw new Error("FOUNDRY_SANDBOX_NETWORK must be bridge or none");
+    }
+    const credentialEnv = (process.env.FOUNDRY_SANDBOX_CREDENTIAL_ENV ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    return {
+        sandbox,
+        sandboxImage: process.env.FOUNDRY_SANDBOX_IMAGE,
+        sandboxNetwork,
+        credentialEnv,
+    };
+}
+const foundrySubagent = defineTool({
+    name: "foundry_subagent",
+    label: "Foundry subagent",
+    description: "Run exactly one named published Foundry skill in a fresh Pi worker. The caller chooses the skill and order.",
+    promptSnippet: "Run one named published Foundry skill in an isolated child session.",
+    executionMode: "sequential",
+    parameters: FoundrySubagentParams,
+    async execute(_toolCallId, params, signal, onUpdate, ctx) {
+        const skillsRoot = process.env.FOUNDRY_SKILLS_DIR;
+        if (!skillsRoot) {
+            return {
+                content: [{ type: "text", text: "FOUNDRY_SKILLS_DIR is not configured." }],
+                details: null,
+            };
+        }
+        try {
+            const sandbox = sandboxConfiguration();
+            const skillDir = resolveInstalledSkill(skillsRoot, params.skill);
+            const inputPaths = (params.inputs ?? []).map((input) => resolveDeclaredInput(ctx.cwd, input));
+            const runsRoot = path.resolve(process.env.FOUNDRY_RUNS_DIR ?? path.join(tmpdir(), "foundry-pi-runs"));
+            mkdirSync(runsRoot, { recursive: true });
+            const runDir = path.join(runsRoot, `${params.skill}-${randomUUID()}`);
+            const model = ctx.model;
+            if (!model)
+                throw new Error("the parent Pi session has no selected model");
+            let eventCount = 0;
+            const record = await runPiSkill({
+                skillDir,
+                prompt: params.task,
+                inputPaths,
+                runDir,
+                provider: model.provider,
+                model: model.id,
+                thinking: ctx.thinkingLevel,
+                timeoutMs: Number(process.env.FOUNDRY_WORKER_TIMEOUT_MS ?? 600_000),
+                ...sandbox,
+                signal,
+                onEvent: (event) => {
+                    eventCount += 1;
+                    onUpdate?.({
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    skill: params.skill,
+                                    status: "running",
+                                    event_count: eventCount,
+                                    last_event: event.type,
+                                }),
+                            },
+                        ],
+                        details: { skill: params.skill, event_count: eventCount, last_event: event.type },
+                    });
+                },
+            });
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            skill: params.skill,
+                            status: record.status,
+                            artifacts: record.artifacts,
+                            run_record: path.join(runDir, "run.json"),
+                            summary: record.final_output,
+                        }),
+                    },
+                ],
+                details: record,
+            };
+        }
+        catch (error) {
+            return {
+                content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+                details: null,
+            };
+        }
+    },
+});
+export default function foundryPiHarness(pi) {
+    pi.registerTool(foundrySubagent);
+}
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAqB,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAoB,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IACjF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAChG;CACF,CAAC,CAAC;AAEH,SAAS,oBAAoB;IAM3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC;IACvD,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,QAAQ,CAAC;IACvE,IAAI,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC;SACrE,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC/C,cAAc;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EACT,6GAA6G;IAC/G,aAAa,EAAE,qEAAqE;IACpF,aAAa,EAAE,YAAY;IAC3B,UAAU,EAAE,qBAAqB;IAEjC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;gBAC1E,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CACvE,CAAC;YACF,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC3E,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,UAAU;gBACV,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,QAAQ,EAAE,GAAG,CAAC,aAAa;gBAC3B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC;gBACnE,GAAG,OAAO;gBACV,MAAM;gBACN,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,UAAU,IAAI,CAAC,CAAC;oBAChB,QAAQ,EAAE,CAAC;wBACT,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oCACnB,MAAM,EAAE,SAAS;oCACjB,WAAW,EAAE,UAAU;oCACvB,UAAU,EAAE,KAAK,CAAC,IAAI;iCACvB,CAAC;6BACH;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE;qBAClF,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;4BACzC,OAAO,EAAE,MAAM,CAAC,YAAY;yBAC7B,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,MAAM;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAAC,EAAgB;IACvD,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { expectedArtifactsFromSkill, runPiSkill, sha256Path, type ArtifactResult, type ExpectedArtifact, type PiRunnerDependencies, type PiSkillRunRecord, type PiThinkingLevel, type RunPiSkillOptions, type RunStatus, type SandboxMode, type StagedInput, } from "./runner.js";
+export { buildDockerRunArgs, CONTAINER_FOUNDRY_VERSION_LABEL, CONTAINER_PI_VERSION_LABEL, CONTAINER_RPC_VERSION, CONTAINER_RPC_VERSION_LABEL, DEFAULT_CONTAINER_IMAGE, FOUNDRY_CLI_VERSION, inspectContainerImage, type ContainerImageResolution, type ContainerLaunchConfig, type ContainerMount, type ContainerNetworkPolicy, } from "./container.js";
+export { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+export { expectedArtifactsFromSkill, runPiSkill, sha256Path, } from "./runner.js";
+export { buildDockerRunArgs, CONTAINER_FOUNDRY_VERSION_LABEL, CONTAINER_PI_VERSION_LABEL, CONTAINER_RPC_VERSION, CONTAINER_RPC_VERSION_LABEL, DEFAULT_CONTAINER_IMAGE, FOUNDRY_CLI_VERSION, inspectContainerImage, } from "./container.js";
+export { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,UAAU,GAUX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAKtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/runner.d.ts

@@ -0,0 +1,132 @@
+import { type JsonAgentSessionEvent, type RpcClientOptions, type RpcSessionState, type SessionStats } from "@earendil-works/pi-coding-agent";
+import { type ContainerImageResolution, type ContainerMount, type ContainerNetworkPolicy } from "./container.js";
+export type SandboxMode = "local" | "container";
+export type RunStatus = "passed" | "failed" | "error" | "timed_out" | "cancelled";
+export type PiThinkingLevel = "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max";
+export interface ExpectedArtifact {
+    id: string;
+    path: string;
+}
+export interface StagedInput {
+    source: string;
+    staged_path: string;
+    sha256: string;
+}
+export interface ArtifactResult {
+    id: string;
+    path: string;
+    status: "passed" | "present" | "missing" | "failed" | "error";
+    sha256?: string;
+    validator?: {
+        bin: string;
+        args: string[];
+        exit_code: number | null;
+        stdout_path: string;
+        stderr_path: string;
+        error?: string;
+    };
+}
+export interface PiSkillRunRecord {
+    run_schema_version: 1;
+    run_id: string;
+    status: RunStatus;
+    failure_kind?: "infrastructure" | "skill";
+    error?: string;
+    started_at: string;
+    finished_at: string;
+    duration_ms: number;
+    engine: {
+        name: "pi";
+        version: string;
+        provider: string;
+        requested_model: string;
+        requested_thinking?: PiThinkingLevel;
+        resolved_model?: string;
+    };
+    invocation: {
+        skill: string;
+        skill_path: string;
+        skill_sha256: string;
+        provenance_sha256?: string;
+        prompt_sha256: string;
+        explicit_activation: string;
+        tools: string[];
+        timeout_ms: number;
+        ambient_discovery_disabled: true;
+    };
+    sandbox: {
+        mode: "local";
+        security_boundary: false;
+        network_policy: "host";
+        credential_policy: "ambient-environment";
+        workdir: string;
+        agent_config_dir: string;
+    } | {
+        mode: "container";
+        security_boundary: true;
+        network_policy: ContainerNetworkPolicy;
+        credential_policy: "allowlisted-environment" | "none";
+        credential_env: string[];
+        workdir: "/workspace";
+        agent_config_dir: "/pi-agent";
+        image: ContainerImageResolution;
+        mounts: ContainerMount[];
+        container_name: string;
+    };
+    inputs: StagedInput[];
+    artifacts: ArtifactResult[];
+    usage?: {
+        input_tokens: number;
+        output_tokens: number;
+        cache_read_tokens: number;
+        cache_write_tokens: number;
+        total_tokens: number;
+        cost: number;
+        turns: number;
+        tool_calls: number;
+    };
+    final_output?: string;
+    trace_path: string;
+    stderr_path: string;
+}
+export interface RunPiSkillOptions {
+    skillDir: string;
+    prompt: string;
+    inputPaths?: string[];
+    expectedArtifacts?: ExpectedArtifact[];
+    runDir: string;
+    provider: string;
+    model: string;
+    thinking?: PiThinkingLevel;
+    timeoutMs?: number;
+    tools?: string[];
+    sandbox?: SandboxMode;
+    sandboxImage?: string;
+    sandboxNetwork?: ContainerNetworkPolicy;
+    credentialEnv?: string[];
+    dockerBin?: string;
+    signal?: AbortSignal;
+    onEvent?: (event: JsonAgentSessionEvent) => void;
+}
+interface PiClient {
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    abort(): Promise<void>;
+    onEvent(listener: (event: JsonAgentSessionEvent) => void): () => void;
+    promptAndWait(message: string, images?: never, timeout?: number): Promise<JsonAgentSessionEvent[]>;
+    getStderr(): string;
+    getState(): Promise<RpcSessionState>;
+    getSessionStats(): Promise<SessionStats>;
+    getLastAssistantText(): Promise<string | null>;
+}
+export interface PiRunnerDependencies {
+    createClient?: (options: RpcClientOptions) => PiClient;
+    inspectContainerImage?: (image: string, dockerBin: string) => ContainerImageResolution;
+    now?: () => Date;
+    id?: () => string;
+}
+export declare function sha256Path(filePath: string): string;
+export declare function expectedArtifactsFromSkill(skillDir: string): ExpectedArtifact[];
+export declare function runPiSkill(options: RunPiSkillOptions, dependencies?: PiRunnerDependencies): Promise<PiSkillRunRecord>;
+export {};
+//# sourceMappingURL=runner.d.ts.map

package/dist/runner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAgBA,OAAO,EAGL,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,EAClB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAGL,KAAK,wBAAwB,EAE7B,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC5B,MAAM,gBAAgB,CAAC;AAOxB,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,WAAW,CAAC;AAChD,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAClF,MAAM,MAAM,eAAe,GAAG,KAAK,GAAG,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,CAAC;AAE9F,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE;QACV,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,WAAW,EAAE,MAAM,CAAC;QACpB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;CACH;AAED,MAAM,WAAW,gBAAgB;IAC/B,kBAAkB,EAAE,CAAC,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,CAAC;IAClB,YAAY,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,IAAI,EAAE,IAAI,CAAC;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,eAAe,CAAC;QACrC,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,UAAU,EAAE;QACV,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;QAC5B,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB,UAAU,EAAE,MAAM,CAAC;QACnB,0BAA0B,EAAE,IAAI,CAAC;KAClC,CAAC;IACF,OAAO,EACH;QACE,IAAI,EAAE,OAAO,CAAC;QACd,iBAAiB,EAAE,KAAK,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;QACvB,iBAAiB,EAAE,qBAAqB,CAAC;QACzC,OAAO,EAAE,MAAM,CAAC;QAChB,gBAAgB,EAAE,MAAM,CAAC;KAC1B,GACD;QACE,IAAI,EAAE,WAAW,CAAC;QAClB,iBAAiB,EAAE,IAAI,CAAC;QACxB,cAAc,EAAE,sBAAsB,CAAC;QACvC,iBAAiB,EAAE,yBAAyB,GAAG,MAAM,CAAC;QACtD,cAAc,EAAE,MAAM,EAAE,CAAC;QACzB,OAAO,EAAE,YAAY,CAAC;QACtB,gBAAgB,EAAE,WAAW,CAAC;QAC9B,KAAK,EAAE,wBAAwB,CAAC;QAChC,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,cAAc,EAAE,MAAM,CAAC;KACxB,CAAC;IACN,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,KAAK,CAAC,EAAE;QACN,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,kBAAkB,EAAE,MAAM,CAAC;QAC3B,YAAY,EAAE,MAAM,CAAC;QACrB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,iBAAiB,CAAC,EAAE,gBAAgB,EAAE,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,eAAe,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,OAAO,CAAC,EAAE,WAAW,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,cAAc,CAAC,EAAE,sBAAsB,CAAC;IACxC,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,CAAC;CAClD;AAED,UAAU,QAAQ;IAChB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC;IACtE,aAAa,CACX,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,KAAK,EACd,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAAC;IACpC,SAAS,IAAI,MAAM,CAAC;IACpB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IACrC,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACzC,oBAAoB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,QAAQ,CAAC;IACvD,qBAAqB,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,wBAAwB,CAAC;IACvF,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AA2CD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAanD;AAuND,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAU/E;AAED,wBAAsB,UAAU,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,YAAY,GAAE,oBAAyB,GACtC,OAAO,CAAC,gBAAgB,CAAC,CAkQ3B"}

package/dist/runner.js

@@ -0,0 +1,494 @@
+import { spawnSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { chmodSync, cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, realpathSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { RpcClient, VERSION as PI_VERSION, } from "@earendil-works/pi-coding-agent";
+import { DEFAULT_CONTAINER_IMAGE, inspectContainerImage, } from "./container.js";
+const DEFAULT_TOOLS = ["read", "write", "edit", "bash", "grep", "find", "ls"];
+const SUPPORTED_TOOLS = new Set([...DEFAULT_TOOLS, "powershell"]);
+const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+const ARTIFACT_ID = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+function sha256Text(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+function relativeRecordPath(runDir, filePath) {
+    return path.relative(runDir, filePath).split(path.sep).join("/");
+}
+function listTree(root, current = root) {
+    const entries = readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name));
+    const files = [];
+    for (const entry of entries) {
+        const fullPath = path.join(current, entry.name);
+        if (entry.isDirectory())
+            files.push(...listTree(root, fullPath));
+        else
+            files.push(path.relative(root, fullPath).split(path.sep).join("/"));
+    }
+    return files;
+}
+export function sha256Path(filePath) {
+    const resolved = realpathSync(filePath);
+    const stat = lstatSync(resolved);
+    if (stat.isFile())
+        return createHash("sha256").update(readFileSync(resolved)).digest("hex");
+    if (!stat.isDirectory())
+        throw new Error(`cannot hash unsupported path: ${filePath}`);
+    const hash = createHash("sha256");
+    for (const relative of listTree(resolved)) {
+        hash.update(relative);
+        hash.update("\0");
+        hash.update(readFileSync(path.join(resolved, relative)));
+        hash.update("\0");
+    }
+    return hash.digest("hex");
+}
+function readSkillName(skillDir) {
+    const skillPath = path.join(skillDir, "SKILL.md");
+    if (!existsSync(skillPath))
+        throw new Error(`${skillPath}: missing SKILL.md`);
+    const source = readFileSync(skillPath, "utf8");
+    const frontmatter = source.match(/^---\s*\n([\s\S]*?)\n---\s*\n/);
+    const name = frontmatter?.[1]?.match(/^name:\s*["']?([^\s"']+)["']?\s*$/m)?.[1];
+    if (!name || !SKILL_NAME.test(name))
+        throw new Error(`${skillPath}: invalid or missing skill name`);
+    return name;
+}
+function resolveWorkspacePath(workspace, relativePath) {
+    if (!relativePath || path.isAbsolute(relativePath)) {
+        throw new Error(`expected artifact path must be relative: ${relativePath}`);
+    }
+    const resolved = path.resolve(workspace, relativePath);
+    const relation = path.relative(workspace, resolved);
+    if (relation.startsWith("..") || path.isAbsolute(relation)) {
+        throw new Error(`path escapes worker directory: ${relativePath}`);
+    }
+    return resolved;
+}
+function makeReadOnly(filePath) {
+    const stat = lstatSync(filePath);
+    if (stat.isDirectory()) {
+        for (const entry of readdirSync(filePath))
+            makeReadOnly(path.join(filePath, entry));
+        chmodSync(filePath, 0o555);
+    }
+    else {
+        chmodSync(filePath, 0o444);
+    }
+}
+function stageInputs(inputPaths, inputsDir, stagedPrefix) {
+    if (inputPaths.length === 0)
+        return [];
+    mkdirSync(inputsDir);
+    const names = new Set();
+    return inputPaths.map((inputPath) => {
+        const source = realpathSync(inputPath);
+        const name = path.basename(source);
+        if (names.has(name))
+            throw new Error(`declared inputs share basename '${name}'`);
+        names.add(name);
+        const destination = path.join(inputsDir, name);
+        cpSync(source, destination, { recursive: true, dereference: true, force: false });
+        makeReadOnly(destination);
+        return {
+            source,
+            staged_path: `${stagedPrefix}/${name}`,
+            sha256: sha256Path(source),
+        };
+    });
+}
+function loadVerifyEntries(skillDir) {
+    const verifyPath = path.join(skillDir, "_verify.json");
+    if (!existsSync(verifyPath))
+        return new Map();
+    const manifest = JSON.parse(readFileSync(verifyPath, "utf8"));
+    if (manifest.verify_schema_version !== 1 || !Array.isArray(manifest.entries)) {
+        throw new Error(`${verifyPath}: invalid verify manifest`);
+    }
+    return new Map(manifest.entries.map((entry) => [entry.artifact_id, entry]));
+}
+function substituteArtifactPath(args, artifactPath) {
+    return args.length
+        ? args.map((arg) => arg.replaceAll("{artifact_path}", artifactPath))
+        : [artifactPath];
+}
+function validateArtifacts(expected, workspace, runDir, skillDir) {
+    const verify = loadVerifyEntries(skillDir);
+    const validationDir = path.join(runDir, "validation");
+    return expected.map((artifact) => {
+        if (!ARTIFACT_ID.test(artifact.id))
+            throw new Error(`invalid artifact id: ${artifact.id}`);
+        const artifactPath = resolveWorkspacePath(workspace, artifact.path);
+        const recordPath = path.relative(workspace, artifactPath).split(path.sep).join("/");
+        if (!existsSync(artifactPath))
+            return { id: artifact.id, path: recordPath, status: "missing" };
+        const result = {
+            id: artifact.id,
+            path: recordPath,
+            status: "present",
+            sha256: sha256Path(artifactPath),
+        };
+        const entry = verify.get(artifact.id);
+        if (!entry)
+            return result;
+        mkdirSync(validationDir, { recursive: true });
+        const executed = spawnSync(entry.validator_bin, substituteArtifactPath(entry.args, artifactPath), { cwd: workspace, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+        const stdoutPath = path.join(validationDir, `${artifact.id}.stdout`);
+        const stderrPath = path.join(validationDir, `${artifact.id}.stderr`);
+        writeFileSync(stdoutPath, executed.stdout ?? "");
+        writeFileSync(stderrPath, executed.stderr ?? "");
+        result.status = executed.error ? "error" : executed.status === 0 ? "passed" : "failed";
+        result.validator = {
+            bin: entry.validator_bin,
+            args: substituteArtifactPath(entry.args, recordPath),
+            exit_code: typeof executed.status === "number" ? executed.status : null,
+            stdout_path: relativeRecordPath(runDir, stdoutPath),
+            stderr_path: relativeRecordPath(runDir, stderrPath),
+            error: executed.error?.message,
+        };
+        return result;
+    });
+}
+function isAgentFailure(events) {
+    return events.some((event) => {
+        if (event.type !== "message_end" || event.message.role !== "assistant")
+            return false;
+        return event.message.stopReason === "error" || event.message.stopReason === "aborted";
+    });
+}
+function invocationPrompt(skill, prompt, inputs) {
+    const inputNote = inputs.length
+        ? `\n\nDeclared inputs staged in this worker:\n${inputs.map((input) => `- ${input.staged_path}`).join("\n")}`
+        : "";
+    return `/skill:${skill}\n\n${prompt}${inputNote}`;
+}
+function prepareRunDirectory(runDir, sandbox) {
+    if (existsSync(runDir))
+        throw new Error(`run directory already exists: ${runDir}`);
+    mkdirSync(path.dirname(runDir), { recursive: true });
+    mkdirSync(runDir, { mode: 0o700 });
+    const workspace = path.join(runDir, "workspace");
+    mkdirSync(workspace);
+    const inputsDir = sandbox === "local" ? path.join(workspace, "inputs") : path.join(runDir, "inputs");
+    if (sandbox === "container")
+        return { workspace, inputsDir };
+    const agentDir = path.join(runDir, "pi-agent");
+    mkdirSync(agentDir);
+    return { workspace, agentDir, inputsDir };
+}
+function writeRecord(runDir, record) {
+    writeFileSync(path.join(runDir, "run.json"), `${JSON.stringify(record, null, 2)}\n`);
+}
+const ENVIRONMENT_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function resolveCredentialEnv(names) {
+    const unique = [...new Set(names)];
+    for (const name of unique) {
+        if (!ENVIRONMENT_NAME.test(name))
+            throw new Error(`invalid credential environment name: ${name}`);
+        if (process.env[name] === undefined) {
+            throw new Error(`credential environment variable is not set: ${name}`);
+        }
+    }
+    return unique.sort();
+}
+function containerMounts(skillDir, inputsDir, workspace, hasInputs) {
+    return [
+        {
+            type: "bind",
+            source: skillDir,
+            target: "/skill",
+            read_only: true,
+            purpose: "skill",
+        },
+        ...(hasInputs
+            ? [
+                {
+                    type: "bind",
+                    source: inputsDir,
+                    target: "/inputs",
+                    read_only: true,
+                    purpose: "inputs",
+                },
+            ]
+            : []),
+        {
+            type: "bind",
+            source: workspace,
+            target: "/workspace",
+            read_only: false,
+            purpose: "output",
+        },
+        {
+            type: "tmpfs",
+            target: "/pi-agent",
+            read_only: false,
+            purpose: "agent-config",
+        },
+        {
+            type: "tmpfs",
+            target: "/tmp",
+            read_only: false,
+            purpose: "temporary-files",
+        },
+    ];
+}
+export function expectedArtifactsFromSkill(skillDir) {
+    const provenancePath = path.join(skillDir, "_provenance.json");
+    if (!existsSync(provenancePath))
+        return [];
+    const provenance = JSON.parse(readFileSync(provenancePath, "utf8"));
+    const produces = provenance.artifacts?.produces ?? [];
+    return produces.flatMap((artifact) => typeof artifact.id === "string" && typeof artifact.default_filename === "string"
+        ? [{ id: artifact.id, path: artifact.default_filename }]
+        : []);
+}
+export async function runPiSkill(options, dependencies = {}) {
+    const now = dependencies.now ?? (() => new Date());
+    const runId = (dependencies.id ?? randomUUID)();
+    const started = now();
+    const runDir = path.resolve(options.runDir);
+    const skillDir = realpathSync(options.skillDir);
+    const sandbox = options.sandbox ?? "local";
+    const dockerBin = options.dockerBin ?? "docker";
+    const sandboxNetwork = options.sandboxNetwork ?? "bridge";
+    const timeoutMs = options.timeoutMs ?? 10 * 60 * 1000;
+    const tools = [...(options.tools ?? DEFAULT_TOOLS)];
+    if (sandbox !== "local" && sandbox !== "container") {
+        throw new Error(`unsupported sandbox mode: ${String(sandbox)}`);
+    }
+    if (sandboxNetwork !== "bridge" && sandboxNetwork !== "none") {
+        throw new Error(`unsupported container network policy: ${String(sandboxNetwork)}`);
+    }
+    if (sandbox === "local" && (options.sandboxImage || options.credentialEnv?.length)) {
+        throw new Error("container image and credential options require sandbox=container");
+    }
+    if (!options.provider.trim() || !options.model.trim()) {
+        throw new Error("provider and model are required");
+    }
+    if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) {
+        throw new Error("timeoutMs must be a positive finite number");
+    }
+    if (tools.length === 0 || tools.some((tool) => !SUPPORTED_TOOLS.has(tool))) {
+        throw new Error(`tools must be a non-empty subset of: ${[...SUPPORTED_TOOLS].join(", ")}`);
+    }
+    const credentialEnv = sandbox === "container" ? resolveCredentialEnv(options.credentialEnv ?? []) : [];
+    const image = sandbox === "container"
+        ? (dependencies.inspectContainerImage ?? inspectContainerImage)(options.sandboxImage ?? DEFAULT_CONTAINER_IMAGE, dockerBin)
+        : undefined;
+    const skill = readSkillName(skillDir);
+    const expectedArtifacts = options.expectedArtifacts ?? expectedArtifactsFromSkill(skillDir);
+    loadVerifyEntries(skillDir);
+    const { workspace, agentDir, inputsDir } = prepareRunDirectory(runDir, sandbox);
+    const workerSkillDir = path.join(runDir, "skill");
+    cpSync(skillDir, workerSkillDir, {
+        recursive: true,
+        dereference: true,
+        force: false,
+    });
+    makeReadOnly(workerSkillDir);
+    for (const artifact of expectedArtifacts) {
+        if (!ARTIFACT_ID.test(artifact.id))
+            throw new Error(`invalid artifact id: ${artifact.id}`);
+        resolveWorkspacePath(workspace, artifact.path);
+    }
+    const inputPaths = options.inputPaths ?? [];
+    const inputs = stageInputs(inputPaths, inputsDir, sandbox === "container" ? "/inputs" : "inputs");
+    const prompt = invocationPrompt(skill, options.prompt, inputs);
+    const tracePath = path.join(runDir, "trace.jsonl");
+    const stderrPath = path.join(runDir, "stderr.log");
+    writeFileSync(tracePath, "");
+    writeFileSync(stderrPath, "");
+    const provenancePath = path.join(skillDir, "_provenance.json");
+    const mounts = sandbox === "container"
+        ? containerMounts(workerSkillDir, inputsDir, workspace, inputPaths.length > 0)
+        : undefined;
+    const containerName = `foundry-pi-${runId.toLowerCase()}`;
+    const baseRecord = {
+        run_schema_version: 1,
+        run_id: runId,
+        started_at: started.toISOString(),
+        engine: {
+            name: "pi",
+            version: PI_VERSION,
+            provider: options.provider,
+            requested_model: options.model,
+            requested_thinking: options.thinking,
+        },
+        invocation: {
+            skill,
+            skill_path: skillDir,
+            skill_sha256: sha256Path(skillDir),
+            provenance_sha256: existsSync(provenancePath) ? sha256Path(provenancePath) : undefined,
+            prompt_sha256: sha256Text(prompt),
+            explicit_activation: `/skill:${skill}`,
+            tools,
+            timeout_ms: timeoutMs,
+            ambient_discovery_disabled: true,
+        },
+        sandbox: sandbox === "container"
+            ? {
+                mode: "container",
+                security_boundary: true,
+                network_policy: sandboxNetwork,
+                credential_policy: credentialEnv.length
+                    ? "allowlisted-environment"
+                    : "none",
+                credential_env: credentialEnv,
+                workdir: "/workspace",
+                agent_config_dir: "/pi-agent",
+                image: image,
+                mounts: mounts,
+                container_name: containerName,
+            }
+            : {
+                mode: "local",
+                security_boundary: false,
+                network_policy: "host",
+                credential_policy: "ambient-environment",
+                workdir: relativeRecordPath(runDir, workspace),
+                agent_config_dir: relativeRecordPath(runDir, agentDir),
+            },
+        inputs,
+        trace_path: relativeRecordPath(runDir, tracePath),
+        stderr_path: relativeRecordPath(runDir, stderrPath),
+    };
+    const cliPath = sandbox === "container"
+        ? fileURLToPath(new URL("./container-rpc-entry.js", import.meta.url))
+        : fileURLToPath(import.meta.resolve("@earendil-works/pi-coding-agent/rpc-entry"));
+    const launchConfig = sandbox === "container"
+        ? {
+            docker_bin: dockerBin,
+            container_name: containerName,
+            image_id: image.resolved_id,
+            network: sandboxNetwork,
+            credential_env: credentialEnv,
+            user: typeof process.getuid === "function" && typeof process.getgid === "function"
+                ? `${process.getuid()}:${process.getgid()}`
+                : undefined,
+            mounts: mounts,
+        }
+        : undefined;
+    const clientOptions = {
+        cliPath,
+        cwd: workspace,
+        env: sandbox === "container"
+            ? { FOUNDRY_CONTAINER_LAUNCH_CONFIG: JSON.stringify(launchConfig) }
+            : { PI_CODING_AGENT_DIR: agentDir },
+        provider: options.provider,
+        model: options.model,
+        args: [
+            "--no-session",
+            "--no-context-files",
+            "--no-extensions",
+            "--no-prompt-templates",
+            "--no-skills",
+            "--skill",
+            sandbox === "container" ? "/skill" : workerSkillDir,
+            "--tools",
+            tools.join(","),
+            ...(options.thinking ? ["--thinking", options.thinking] : []),
+        ],
+    };
+    const client = (dependencies.createClient ?? ((value) => new RpcClient(value)))(clientOptions);
+    const events = [];
+    let state;
+    let stats;
+    let finalOutput;
+    let status;
+    let failureKind;
+    let error;
+    let timedOut = false;
+    let cancelled = false;
+    const unsubscribe = client.onEvent((event) => {
+        events.push(event);
+        writeFileSync(tracePath, `${JSON.stringify(event)}\n`, { flag: "a" });
+        options.onEvent?.(event);
+    });
+    const abort = () => {
+        cancelled = !timedOut;
+        void client.abort().catch(() => undefined);
+    };
+    options.signal?.addEventListener("abort", abort, { once: true });
+    try {
+        await client.start();
+        let timer;
+        const timeout = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                timedOut = true;
+                void client.abort().catch(() => undefined);
+                reject(new Error(`Pi worker exceeded wall timeout of ${timeoutMs}ms`));
+            }, timeoutMs);
+        });
+        try {
+            await Promise.race([client.promptAndWait(prompt, undefined, timeoutMs), timeout]);
+            if (options.signal?.aborted)
+                throw new Error("Pi worker was cancelled");
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+        state = await client.getState();
+        stats = await client.getSessionStats();
+        finalOutput = (await client.getLastAssistantText()) ?? undefined;
+        const artifacts = validateArtifacts(expectedArtifacts, workspace, runDir, skillDir);
+        const artifactFailure = artifacts.some((artifact) => ["missing", "failed", "error"].includes(artifact.status));
+        const agentFailure = isAgentFailure(events);
+        status = artifactFailure || agentFailure ? "failed" : "passed";
+        if (status === "failed")
+            failureKind = "skill";
+        const finished = now();
+        const record = {
+            ...baseRecord,
+            status,
+            failure_kind: failureKind,
+            finished_at: finished.toISOString(),
+            duration_ms: finished.getTime() - started.getTime(),
+            engine: {
+                ...baseRecord.engine,
+                resolved_model: state?.model ? `${state.model.provider}/${state.model.id}` : undefined,
+            },
+            artifacts,
+            usage: stats
+                ? {
+                    input_tokens: stats.tokens.input,
+                    output_tokens: stats.tokens.output,
+                    cache_read_tokens: stats.tokens.cacheRead,
+                    cache_write_tokens: stats.tokens.cacheWrite,
+                    total_tokens: stats.tokens.total,
+                    cost: stats.cost,
+                    turns: stats.assistantMessages,
+                    tool_calls: stats.toolCalls,
+                }
+                : undefined,
+            final_output: finalOutput,
+        };
+        writeRecord(runDir, record);
+        return record;
+    }
+    catch (caught) {
+        error = caught instanceof Error ? caught.message : String(caught);
+        status = timedOut ? "timed_out" : cancelled || options.signal?.aborted ? "cancelled" : "error";
+        failureKind = status === "error" ? "infrastructure" : undefined;
+        const artifacts = validateArtifacts(expectedArtifacts, workspace, runDir, skillDir);
+        const finished = now();
+        const record = {
+            ...baseRecord,
+            status,
+            failure_kind: failureKind,
+            error,
+            finished_at: finished.toISOString(),
+            duration_ms: finished.getTime() - started.getTime(),
+            artifacts,
+        };
+        writeRecord(runDir, record);
+        return record;
+    }
+    finally {
+        options.signal?.removeEventListener("abort", abort);
+        unsubscribe();
+        await client.stop().catch(() => undefined);
+        writeFileSync(stderrPath, client.getStderr());
+    }
+}
+//# sourceMappingURL=runner.js.map

package/dist/runner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner.js","sourceRoot":"","sources":["../src/runner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,SAAS,EACT,MAAM,EACN,UAAU,EACV,SAAS,EACT,SAAS,EACT,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EACL,SAAS,EACT,OAAO,IAAI,UAAU,GAKtB,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,uBAAuB,EACvB,qBAAqB,GAKtB,MAAM,gBAAgB,CAAC;AAExB,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,aAAa,EAAE,YAAY,CAAC,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAChD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AAiKjD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,QAAgB;IAC1D,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAO,GAAG,IAAI;IAC5C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAC1E,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAC7B,CAAC;IACF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;;YAC5D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB;IACzC,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtB,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC5B,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,oBAAoB,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,oCAAoC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChF,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,iCAAiC,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,oBAAoB,CAAC,SAAiB,EAAE,YAAoB;IACnE,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,YAAY,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,kCAAkC,YAAY,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB;IACpC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,QAAQ,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QACpF,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;SAAM,CAAC;QACN,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,UAAoB,EACpB,SAAiB,EACjB,YAAkC;IAElC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,OAAO,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,GAAG,CAAC,CAAC;QACjF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,EAAE,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,YAAY,CAAC,WAAW,CAAC,CAAC;QAC1B,OAAO;YACL,MAAM;YACN,WAAW,EAAE,GAAG,YAAY,IAAI,IAAI,EAAE;YACtC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;SAC3B,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IACvD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,GAAG,EAAE,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAmB,CAAC;IAChF,IAAI,QAAQ,CAAC,qBAAqB,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,2BAA2B,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAc,EAAE,YAAoB;IAClE,OAAO,IAAI,CAAC,MAAM;QAChB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CACxB,QAA4B,EAC5B,SAAiB,EACjB,MAAc,EACd,QAAgB;IAEhB,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACtD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC/B,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,MAAM,YAAY,GAAG,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpF,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/F,MAAM,MAAM,GAAmB;YAC7B,EAAE,EAAE,QAAQ,CAAC,EAAE;YACf,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,UAAU,CAAC,YAAY,CAAC;SACjC,CAAC;QACF,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,OAAO,MAAM,CAAC;QAC1B,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CACxB,KAAK,CAAC,aAAa,EACnB,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,YAAY,CAAC,EAChD,EAAE,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACxE,CAAC;QACF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,GAAG,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;QACrE,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjD,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,CAAC,SAAS,GAAG;YACjB,GAAG,EAAE,KAAK,CAAC,aAAa;YACxB,IAAI,EAAE,sBAAsB,CAAC,KAAK,CAAC,IAAI,EAAE,UAAU,CAAC;YACpD,SAAS,EAAE,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI;YACvE,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;YACnD,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;YACnD,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,OAAO;SAC/B,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,MAA+B;IACrD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3B,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,KAAK,WAAW;YAAE,OAAO,KAAK,CAAC;QACrF,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;IACxF,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,MAAc,EAAE,MAAqB;IAC5E,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM;QAC7B,CAAC,CAAC,+CAA+C,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC7G,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,UAAU,KAAK,OAAO,MAAM,GAAG,SAAS,EAAE,CAAC;AACpD,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAc,EACd,OAAoB;IAEpB,IAAI,UAAU,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,EAAE,CAAC,CAAC;IACnF,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACjD,SAAS,CAAC,SAAS,CAAC,CAAC;IACrB,MAAM,SAAS,GACb,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrF,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/C,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AAC5C,CAAC;AAED,SAAS,WAAW,CAAC,MAAc,EAAE,MAAwB;IAC3D,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AAEpD,SAAS,oBAAoB,CAAC,KAAe;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,+CAA+C,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,eAAe,CACtB,QAAgB,EAChB,SAAiB,EACjB,SAAiB,EACjB,SAAkB;IAElB,OAAO;QACL;YACE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,IAAI;YACf,OAAO,EAAE,OAAO;SACjB;QACD,GAAG,CAAC,SAAS;YACX,CAAC,CAAC;gBACE;oBACE,IAAI,EAAE,MAAe;oBACrB,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,IAAI;oBACf,OAAO,EAAE,QAAiB;iBAC3B;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP;YACE,IAAI,EAAE,MAAM;YACZ,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,YAAY;YACpB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,QAAQ;SAClB;QACD;YACE,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,cAAc;SACxB;QACD;YACE,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,iBAAiB;SAC3B;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,QAAgB;IACzD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAAE,OAAO,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,MAAM,CAAC,CAAuB,CAAC;IAC1F,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,IAAI,EAAE,CAAC;IACtD,OAAO,QAAQ,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CACnC,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;QAC9E,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,EAAE,CAAC;QACxD,CAAC,CAAC,EAAE,CACP,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B,EAC1B,eAAqC,EAAE;IAEvC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;IAChD,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC;IACtB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,QAAQ,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IACtD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,aAAa,CAAC,CAAC,CAAC;IACpD,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,yCAAyC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,CAAC;QACnF,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,GAAG,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7F,CAAC;IACD,MAAM,aAAa,GACjB,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,KAAK,GACT,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC,CAAC,YAAY,CAAC,qBAAqB,IAAI,qBAAqB,CAAC,CAC3D,OAAO,CAAC,YAAY,IAAI,uBAAuB,EAC/C,SAAS,CACV;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,0BAA0B,CAAC,QAAQ,CAAC,CAAC;IAC5F,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC5B,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,CAAC,QAAQ,EAAE,cAAc,EAAE;QAC/B,SAAS,EAAE,IAAI;QACf,WAAW,EAAE,IAAI;QACjB,KAAK,EAAE,KAAK;KACb,CAAC,CAAC;IACH,YAAY,CAAC,cAAc,CAAC,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3F,oBAAoB,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;IAC5C,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,EAAE,SAAS,EAAE,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACnD,aAAa,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC7B,aAAa,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAE9B,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC/D,MAAM,MAAM,GACV,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC,eAAe,CAAC,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC9E,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,aAAa,GAAG,cAAc,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,kBAAkB,EAAE,CAAU;QAC9B,MAAM,EAAE,KAAK;QACb,UAAU,EAAE,OAAO,CAAC,WAAW,EAAE;QACjC,MAAM,EAAE;YACN,IAAI,EAAE,IAAa;YACnB,OAAO,EAAE,UAAU;YACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,eAAe,EAAE,OAAO,CAAC,KAAK;YAC9B,kBAAkB,EAAE,OAAO,CAAC,QAAQ;SACrC;QACD,UAAU,EAAE;YACV,KAAK;YACL,UAAU,EAAE,QAAQ;YACpB,YAAY,EAAE,UAAU,CAAC,QAAQ,CAAC;YAClC,iBAAiB,EAAE,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;YACtF,aAAa,EAAE,UAAU,CAAC,MAAM,CAAC;YACjC,mBAAmB,EAAE,UAAU,KAAK,EAAE;YACtC,KAAK;YACL,UAAU,EAAE,SAAS;YACrB,0BAA0B,EAAE,IAAa;SAC1C;QACD,OAAO,EACL,OAAO,KAAK,WAAW;YACrB,CAAC,CAAC;gBACE,IAAI,EAAE,WAAoB;gBAC1B,iBAAiB,EAAE,IAAa;gBAChC,cAAc,EAAE,cAAc;gBAC9B,iBAAiB,EAAE,aAAa,CAAC,MAAM;oBACrC,CAAC,CAAE,yBAAmC;oBACtC,CAAC,CAAE,MAAgB;gBACrB,cAAc,EAAE,aAAa;gBAC7B,OAAO,EAAE,YAAqB;gBAC9B,gBAAgB,EAAE,WAAoB;gBACtC,KAAK,EAAE,KAAM;gBACb,MAAM,EAAE,MAAO;gBACf,cAAc,EAAE,aAAa;aAC9B;YACH,CAAC,CAAC;gBACE,IAAI,EAAE,OAAgB;gBACtB,iBAAiB,EAAE,KAAc;gBACjC,cAAc,EAAE,MAAe;gBAC/B,iBAAiB,EAAE,qBAA8B;gBACjD,OAAO,EAAE,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;gBAC9C,gBAAgB,EAAE,kBAAkB,CAAC,MAAM,EAAE,QAAS,CAAC;aACxD;QACP,MAAM;QACN,UAAU,EAAE,kBAAkB,CAAC,MAAM,EAAE,SAAS,CAAC;QACjD,WAAW,EAAE,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC;KACpD,CAAC;IAEF,MAAM,OAAO,GACX,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,0BAA0B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,CAAC;IACtF,MAAM,YAAY,GAChB,OAAO,KAAK,WAAW;QACrB,CAAC,CAAC;YACE,UAAU,EAAE,SAAS;YACrB,cAAc,EAAE,aAAa;YAC7B,QAAQ,EAAE,KAAM,CAAC,WAAW;YAC5B,OAAO,EAAE,cAAc;YACvB,cAAc,EAAE,aAAa;YAC7B,IAAI,EACF,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU;gBAC1E,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,MAAM,EAAE,EAAE;gBAC3C,CAAC,CAAC,SAAS;YACf,MAAM,EAAE,MAAO;SAChB;QACH,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,aAAa,GAAqB;QACtC,OAAO;QACP,GAAG,EAAE,SAAS;QACd,GAAG,EACD,OAAO,KAAK,WAAW;YACrB,CAAC,CAAC,EAAE,+BAA+B,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;YACnE,CAAC,CAAC,EAAE,mBAAmB,EAAE,QAAS,EAAE;QACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,IAAI,EAAE;YACJ,cAAc;YACd,oBAAoB;YACpB,iBAAiB;YACjB,uBAAuB;YACvB,aAAa;YACb,SAAS;YACT,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,cAAc;YACnD,SAAS;YACT,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC;YACf,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SAC9D;KACF,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAC/F,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,KAAkC,CAAC;IACvC,IAAI,KAA+B,CAAC;IACpC,IAAI,WAA+B,CAAC;IACpC,IAAI,MAAiB,CAAC;IACtB,IAAI,WAA6C,CAAC;IAClD,IAAI,KAAyB,CAAC;IAC9B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,SAAS,GAAG,KAAK,CAAC;IAEtB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,aAAa,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACtE,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,GAAS,EAAE;QACvB,SAAS,GAAG,CAAC,QAAQ,CAAC;QACtB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,IAAI,KAAgD,CAAC;QACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;YAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBACtB,QAAQ,GAAG,IAAI,CAAC;gBAChB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC3C,MAAM,CAAC,IAAI,KAAK,CAAC,sCAAsC,SAAS,IAAI,CAAC,CAAC,CAAC;YACzE,CAAC,EAAE,SAAS,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;YAClF,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAC1E,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACjC,CAAC;QACD,KAAK,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;QAChC,KAAK,GAAG,MAAM,MAAM,CAAC,eAAe,EAAE,CAAC;QACvC,WAAW,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,EAAE,CAAC,IAAI,SAAS,CAAC;QACjE,MAAM,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpF,MAAM,eAAe,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAClD,CAAC,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CACzD,CAAC;QACF,MAAM,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;QAC5C,MAAM,GAAG,eAAe,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC/D,IAAI,MAAM,KAAK,QAAQ;YAAE,WAAW,GAAG,OAAO,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAqB;YAC/B,GAAG,UAAU;YACb,MAAM;YACN,YAAY,EAAE,WAAW;YACzB,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YACnD,MAAM,EAAE;gBACN,GAAG,UAAU,CAAC,MAAM;gBACpB,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS;aACvF;YACD,SAAS;YACT,KAAK,EAAE,KAAK;gBACV,CAAC,CAAC;oBACE,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBAChC,aAAa,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM;oBAClC,iBAAiB,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS;oBACzC,kBAAkB,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU;oBAC3C,YAAY,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK;oBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,KAAK,EAAE,KAAK,CAAC,iBAAiB;oBAC9B,UAAU,EAAE,KAAK,CAAC,SAAS;iBAC5B;gBACH,CAAC,CAAC,SAAS;YACb,YAAY,EAAE,WAAW;SAC1B,CAAC;QACF,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,MAAM,EAAE,CAAC;QAChB,KAAK,GAAG,MAAM,YAAY,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;QAC/F,WAAW,GAAG,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;QAChE,MAAM,SAAS,GAAG,iBAAiB,CAAC,iBAAiB,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpF,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAqB;YAC/B,GAAG,UAAU;YACb,MAAM;YACN,YAAY,EAAE,WAAW;YACzB,KAAK;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE;YACnC,WAAW,EAAE,QAAQ,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,OAAO,EAAE;YACnD,SAAS;SACV,CAAC;QACF,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACpD,WAAW,EAAE,CAAC;QACd,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3C,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/skill-resolution.d.ts

@@ -0,0 +1,3 @@
+export declare function resolveInstalledSkill(skillsRoot: string, skill: string): string;
+export declare function resolveDeclaredInput(cwd: string, input: string): string;
+//# sourceMappingURL=skill-resolution.d.ts.map

package/dist/skill-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolution.d.ts","sourceRoot":"","sources":["../src/skill-resolution.ts"],"names":[],"mappings":"AAKA,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQ/E;AAED,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAUvE"}

package/dist/skill-resolution.js

@@ -0,0 +1,25 @@
+import { realpathSync } from "node:fs";
+import path from "node:path";
+const SKILL_NAME = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+export function resolveInstalledSkill(skillsRoot, skill) {
+    if (!SKILL_NAME.test(skill))
+        throw new Error(`invalid Foundry skill name: ${skill}`);
+    const root = realpathSync(skillsRoot);
+    const resolved = realpathSync(path.join(root, skill));
+    if (path.dirname(resolved) !== root) {
+        throw new Error(`Foundry skill resolves outside installed skill root: ${skill}`);
+    }
+    return resolved;
+}
+export function resolveDeclaredInput(cwd, input) {
+    if (path.isAbsolute(input))
+        throw new Error(`declared input must be relative to the run: ${input}`);
+    const root = realpathSync(cwd);
+    const resolved = realpathSync(path.resolve(root, input));
+    const relation = path.relative(root, resolved);
+    if (relation.startsWith("..") || path.isAbsolute(relation)) {
+        throw new Error(`declared input escapes the Pipeline run directory: ${input}`);
+    }
+    return resolved;
+}
+//# sourceMappingURL=skill-resolution.js.map

package/dist/skill-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolution.js","sourceRoot":"","sources":["../src/skill-resolution.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAEhD,MAAM,UAAU,qBAAqB,CAAC,UAAkB,EAAE,KAAa;IACrE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,KAAK,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACtD,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wDAAwD,KAAK,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,KAAa;IAC7D,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,EAAE,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,9 +1,21 @@
 {
   "name": "@galaxy-foundry/gxwf-pi-harness",
-  "version": "0.0.0",
-  "description": "Reserved bootstrap package for the Galaxy Workflow Foundry Pi evaluation harness.",
+  "version": "0.1.0",
+  "description": "Pi-backed isolated worker runner and extension for testing Galaxy Workflow Foundry skills.",
   "type": "module",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./extension": {
+      "types": "./dist/extension.d.ts",
+      "import": "./dist/extension.js"
+    }
+  },
   "files": [
+    "dist",
+    "Dockerfile",
     "README.md",
     "LICENSE"
   ],
@@ -15,5 +27,37 @@
   "publishConfig": {
     "access": "public"
   },
-  "license": "MIT"
-}
+  "keywords": [
+    "pi-package",
+    "galaxy",
+    "foundry",
+    "pi",
+    "agent",
+    "evaluation"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@earendil-works/pi-ai": "0.84.4",
+    "@earendil-works/pi-coding-agent": "0.84.4"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "^5.7.0",
+    "vitest": "^4.1.10"
+  },
+  "engines": {
+    "node": ">=22.19"
+  },
+  "pi": {
+    "extensions": [
+      "./dist/extension.js"
+    ]
+  },
+  "scripts": {
+    "build": "tsc",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "test:container": "pnpm build && FOUNDRY_TEST_CONTAINER=1 vitest run test/container-docker.test.ts",
+    "test:watch": "vitest"
+  }
+}