@galaxy-foundry/gxwf-pi-harness 0.0.0 → 0.3.0

package/Dockerfile

@@ -0,0 +1,19 @@
+ARG NODE_IMAGE=node:22.19.0-bookworm-slim
+FROM ${NODE_IMAGE}
+
+ARG PI_VERSION=0.84.4
+ARG FOUNDRY_CLI_VERSION=0.1.0
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends bash ca-certificates git ripgrep \
+    && rm -rf /var/lib/apt/lists/*
+RUN npm install -g --ignore-scripts \
+    "@earendil-works/pi-coding-agent@${PI_VERSION}" \
+    "@galaxy-foundry/gxwf-foundry@${FOUNDRY_CLI_VERSION}"
+
+LABEL org.galaxyproject.foundry.pi-version="${PI_VERSION}" \
+      org.galaxyproject.foundry.cli-version="${FOUNDRY_CLI_VERSION}" \
+      org.galaxyproject.foundry.pi-rpc-version="1"
+
+WORKDIR /workspace
+ENTRYPOINT ["pi"]

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 Galaxy Project
+Copyright (c) 2026 John Chilton
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,5 +1,47 @@
 # @galaxy-foundry/gxwf-pi-harness
 
-Reserved bootstrap package for the Galaxy Workflow Foundry Pi evaluation harness.
+Pi-backed worker isolation for evaluating published Galaxy Workflow Foundry skills.
 
-The implementation will be published from [galaxyproject/foundry](https://github.com/galaxyproject/foundry) through npm trusted publishing.
+The package has two surfaces:
+
+- `runPiSkill()` starts one ephemeral Pi RPC worker with one explicitly loaded skill, a fresh configuration directory, staged declared inputs, and ambient resource discovery disabled.
+- `@galaxy-foundry/gxwf-pi-harness/extension` registers the constrained `foundry_subagent` tool used by a top-level Pipeline skill.
+
+The extension derives the worker's expected artifacts exclusively from the selected published cast's `_provenance.json`. The parent agent can choose the skill, task, and declared inputs, but cannot replace or suppress that artifact contract.
+
+Local mode is process and context isolation, not a security boundary. The trace CLI defaults each local run to a unique directory under the operating system's temporary directory, and both local and container workers load a dereferenced staged copy of the selected skill rather than its checkout path. An explicit `--run-dir` still overrides that diagnostic default.
+
+OpenAI subscription-backed diagnostics can opt into the Foundry-specific `pi-test-auth` store. Login, refresh, and logout use Pi's public authentication API; Foundry does not interpret or copy tokens. For each local run, the fresh Pi configuration temporarily links to the store's `auth.json`, then removes that link before retaining the run directory. Run records contain only the label `pi-test-auth`, never the store path or credential values.
+
+Container mode runs the whole Pi RPC worker inside a disposable Docker container. It mounts the staged skill bundle and copied declared inputs read-only, mounts only the run's output directory read-write, and uses tmpfs for Pi configuration and temporary files. The checkout itself is never mounted.
+
+Build the default image from the repository root:
+
+```sh
+npm run gxwf-pi-harness:container-build
+```
+
+The image pins Pi 0.84.4 and the `@galaxy-foundry/gxwf-foundry` CLI 0.1.0 required by the pilot `summarize-nextflow` skill. It carries compatibility labels for both runtimes that are checked before every run. A caller may use `--sandbox-image <ref>` for another locally available image with the same labels. The runner resolves the ref to an immutable image ID before launch and records that ID, any repository digests, every mount, the network policy, and the names—not values—of forwarded credential variables.
+
+Container provider access is explicit. Use `--sandbox-network bridge` and repeat `--credential-env <NAME>` for only the variables the provider needs. Use `--sandbox-network none` for credential-free probes. Run the Docker boundary test with `npm run gxwf-pi-harness:container-test`.
+
+The OAuth store is intentionally rejected in container mode. A whole-process container would require putting the refresh credential inside that worker boundary; use an allowlisted API-key environment variable there until the planned host-agent/tool-sandbox split is available.
+
+## Extension configuration
+
+- `FOUNDRY_SKILLS_DIR` — required path to the installed Foundry skills root.
+- `FOUNDRY_RUNS_DIR` — directory for child run records; defaults to a temporary directory.
+- `FOUNDRY_WORKER_TIMEOUT_MS` — child wall timeout; defaults to ten minutes.
+- `FOUNDRY_SANDBOX` — `local` (default) or `container`.
+- `FOUNDRY_SANDBOX_IMAGE` — optional compatible container image ref.
+- `FOUNDRY_SANDBOX_NETWORK` — `bridge` (default) or `none`.
+- `FOUNDRY_SANDBOX_CREDENTIAL_ENV` — comma-separated environment-variable allowlist.
+
+The trace-mode CLI also accepts `--thinking <level>` when an evaluation should pin Pi's
+reasoning level rather than use the model default.
+
+The extension accepts skill names, never arbitrary skill paths. It resolves each name as one direct child of `FOUNDRY_SKILLS_DIR` and starts the child through the same runner used by trace-mode callers.
+
+## License
+
+MIT.

package/dist/container-rpc-entry.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=container-rpc-entry.d.ts.map

package/dist/container-rpc-entry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-rpc-entry.d.ts","sourceRoot":"","sources":["../src/container-rpc-entry.ts"],"names":[],"mappings":""}

package/dist/container-rpc-entry.js

@@ -0,0 +1,37 @@
+import { spawn, spawnSync } from "node:child_process";
+import process from "node:process";
+import { buildDockerRunArgs } from "./container.js";
+const encoded = process.env.FOUNDRY_CONTAINER_LAUNCH_CONFIG;
+if (!encoded)
+    throw new Error("FOUNDRY_CONTAINER_LAUNCH_CONFIG is required");
+const config = JSON.parse(encoded);
+const args = buildDockerRunArgs(config, process.argv.slice(2));
+const child = spawn(config.docker_bin, args, { stdio: ["pipe", "pipe", "pipe"] });
+process.stdin.pipe(child.stdin);
+child.stdout.pipe(process.stdout);
+child.stderr.pipe(process.stderr);
+let stopping = false;
+function stop() {
+    if (stopping)
+        return;
+    stopping = true;
+    child.kill("SIGTERM");
+    spawnSync(config.docker_bin, ["container", "rm", "--force", config.container_name], {
+        stdio: "ignore",
+        timeout: 2_000,
+    });
+}
+process.once("SIGINT", stop);
+process.once("SIGTERM", stop);
+child.once("error", (error) => {
+    process.stderr.write(`Unable to start Docker worker: ${error.message}\n`);
+    process.stdin.unpipe(child.stdin);
+    process.stdin.pause();
+    process.exitCode = 1;
+});
+child.once("exit", (code, signal) => {
+    process.stdin.unpipe(child.stdin);
+    process.stdin.pause();
+    process.exitCode = code ?? (signal ? 1 : 0);
+});
+//# sourceMappingURL=container-rpc-entry.js.map

package/dist/container-rpc-entry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container-rpc-entry.js","sourceRoot":"","sources":["../src/container-rpc-entry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,kBAAkB,EAA8B,MAAM,gBAAgB,CAAC;AAEhF,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC;AAC5D,IAAI,CAAC,OAAO;IAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;AAC7E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA0B,CAAC;AAC5D,MAAM,IAAI,GAAG,kBAAkB,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AAElF,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAChC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAClC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAElC,IAAI,QAAQ,GAAG,KAAK,CAAC;AACrB,SAAS,IAAI;IACX,IAAI,QAAQ;QAAE,OAAO;IACrB,QAAQ,GAAG,IAAI,CAAC;IAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACtB,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE;QAClF,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,KAAK;KACf,CAAC,CAAC;AACL,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;AAC7B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC9B,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,KAAK,CAAC,OAAO,IAAI,CAAC,CAAC;IAC1E,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC;AACH,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;IAClC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACtB,OAAO,CAAC,QAAQ,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC,CAAC,CAAC"}

package/dist/container.d.ts

@@ -0,0 +1,33 @@
+export declare const FOUNDRY_CLI_VERSION = "0.1.0";
+export declare const DEFAULT_CONTAINER_IMAGE: string;
+export declare const CONTAINER_PI_VERSION_LABEL = "org.galaxyproject.foundry.pi-version";
+export declare const CONTAINER_FOUNDRY_VERSION_LABEL = "org.galaxyproject.foundry.cli-version";
+export declare const CONTAINER_RPC_VERSION_LABEL = "org.galaxyproject.foundry.pi-rpc-version";
+export declare const CONTAINER_RPC_VERSION = "1";
+export type ContainerNetworkPolicy = "bridge" | "none";
+export interface ContainerMount {
+    type: "bind" | "tmpfs";
+    source?: string;
+    target: string;
+    read_only: boolean;
+    purpose: "skill" | "inputs" | "output" | "agent-config" | "temporary-files";
+}
+export interface ContainerImageResolution {
+    requested: string;
+    resolved_id: string;
+    repo_digests: string[];
+    pi_version: string;
+    foundry_cli_version: string;
+}
+export interface ContainerLaunchConfig {
+    docker_bin: string;
+    container_name: string;
+    image_id: string;
+    network: ContainerNetworkPolicy;
+    credential_env: string[];
+    user?: string;
+    mounts: ContainerMount[];
+}
+export declare function inspectContainerImage(image: string, dockerBin?: string): ContainerImageResolution;
+export declare function buildDockerRunArgs(config: ContainerLaunchConfig, piArgs: string[]): string[];
+//# sourceMappingURL=container.d.ts.map

package/dist/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,mBAAmB,UAAU,CAAC;AAC3C,eAAO,MAAM,uBAAuB,QAAmF,CAAC;AACxH,eAAO,MAAM,0BAA0B,yCAAyC,CAAC;AACjF,eAAO,MAAM,+BAA+B,0CAA0C,CAAC;AACvF,eAAO,MAAM,2BAA2B,6CAA6C,CAAC;AACtF,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAEzC,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,cAAc,GAAG,iBAAiB,CAAC;CAC7E;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,sBAAsB,CAAC;IAChC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,cAAc,EAAE,CAAC;CAC1B;AAgBD,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,MAAM,EACb,SAAS,SAAW,GACnB,wBAAwB,CAwC1B;AAoBD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CA6B5F"}

package/dist/container.js

@@ -0,0 +1,101 @@
+import { spawnSync } from "node:child_process";
+import { VERSION as PI_VERSION } from "@earendil-works/pi-coding-agent";
+export const FOUNDRY_CLI_VERSION = "0.1.0";
+export const DEFAULT_CONTAINER_IMAGE = `galaxy-foundry/gxwf-pi-harness:pi-${PI_VERSION}-foundry-${FOUNDRY_CLI_VERSION}`;
+export const CONTAINER_PI_VERSION_LABEL = "org.galaxyproject.foundry.pi-version";
+export const CONTAINER_FOUNDRY_VERSION_LABEL = "org.galaxyproject.foundry.cli-version";
+export const CONTAINER_RPC_VERSION_LABEL = "org.galaxyproject.foundry.pi-rpc-version";
+export const CONTAINER_RPC_VERSION = "1";
+function dockerFailure(command, stderr) {
+    const detail = stderr?.trim();
+    return new Error(`Docker ${command.join(" ")} failed${detail ? `: ${detail}` : ""}. ` +
+        `Build the default image with "npm run gxwf-pi-harness:container-build" or supply --sandbox-image.`);
+}
+export function inspectContainerImage(image, dockerBin = "docker") {
+    if (!image.trim())
+        throw new Error("container image must not be empty");
+    const command = ["image", "inspect", image];
+    const inspected = spawnSync(dockerBin, command, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (inspected.error)
+        throw inspected.error;
+    if (inspected.status !== 0)
+        throw dockerFailure(command, inspected.stderr);
+    const parsed = JSON.parse(inspected.stdout);
+    if (!Array.isArray(parsed) || parsed.length !== 1) {
+        throw new Error(`Docker returned an invalid image inspection for ${image}`);
+    }
+    const record = parsed[0];
+    if (typeof record.Id !== "string" || !record.Id.startsWith("sha256:")) {
+        throw new Error(`Docker image ${image} has no immutable sha256 image id`);
+    }
+    const labels = record.Config?.Labels ?? {};
+    const imagePiVersion = labels?.[CONTAINER_PI_VERSION_LABEL];
+    const foundryCliVersion = labels?.[CONTAINER_FOUNDRY_VERSION_LABEL];
+    const rpcVersion = labels?.[CONTAINER_RPC_VERSION_LABEL];
+    if (imagePiVersion !== PI_VERSION ||
+        foundryCliVersion !== FOUNDRY_CLI_VERSION ||
+        rpcVersion !== CONTAINER_RPC_VERSION) {
+        throw new Error(`Docker image ${image} is not a compatible Foundry Pi worker ` +
+            `(expected Pi ${PI_VERSION}, Foundry CLI ${FOUNDRY_CLI_VERSION}, and RPC contract ${CONTAINER_RPC_VERSION})`);
+    }
+    return {
+        requested: image,
+        resolved_id: record.Id,
+        repo_digests: Array.isArray(record.RepoDigests)
+            ? record.RepoDigests.filter((value) => typeof value === "string")
+            : [],
+        pi_version: imagePiVersion,
+        foundry_cli_version: foundryCliVersion,
+    };
+}
+function bindMountArgument(mount) {
+    if (!mount.source)
+        throw new Error(`bind mount ${mount.target} has no source`);
+    if (mount.source.includes(",")) {
+        throw new Error(`Docker bind mount source cannot contain a comma: ${mount.source}`);
+    }
+    return [
+        "type=bind",
+        `src=${mount.source}`,
+        `dst=${mount.target}`,
+        ...(mount.read_only ? ["readonly", "bind-recursive=disabled"] : []),
+    ].join(",");
+}
+function tmpfsArgument(mount) {
+    const size = mount.purpose === "agent-config" ? "64m" : "128m";
+    return `${mount.target}:rw,nosuid,nodev,size=${size},mode=1777`;
+}
+export function buildDockerRunArgs(config, piArgs) {
+    const args = [
+        "run",
+        "--rm",
+        "--interactive",
+        "--pull=never",
+        "--name",
+        config.container_name,
+        "--init",
+        "--read-only",
+        "--cap-drop=ALL",
+        "--security-opt=no-new-privileges",
+        "--pids-limit=256",
+        `--network=${config.network}`,
+        "--workdir=/workspace",
+    ];
+    if (config.user)
+        args.push(`--user=${config.user}`);
+    for (const mount of config.mounts) {
+        if (mount.type === "bind")
+            args.push("--mount", bindMountArgument(mount));
+        else
+            args.push("--tmpfs", tmpfsArgument(mount));
+    }
+    args.push("--env=HOME=/tmp", "--env=PI_CODING_AGENT_DIR=/pi-agent", "--env=PI_SKIP_VERSION_CHECK=1");
+    for (const name of config.credential_env)
+        args.push("--env", name);
+    args.push(config.image_id, ...piArgs);
+    return args;
+}
+//# sourceMappingURL=container.js.map

package/dist/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../src/container.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAExE,MAAM,CAAC,MAAM,mBAAmB,GAAG,OAAO,CAAC;AAC3C,MAAM,CAAC,MAAM,uBAAuB,GAAG,qCAAqC,UAAU,YAAY,mBAAmB,EAAE,CAAC;AACxH,MAAM,CAAC,MAAM,0BAA0B,GAAG,sCAAsC,CAAC;AACjF,MAAM,CAAC,MAAM,+BAA+B,GAAG,uCAAuC,CAAC;AACvF,MAAM,CAAC,MAAM,2BAA2B,GAAG,0CAA0C,CAAC;AACtF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAoCzC,SAAS,aAAa,CAAC,OAAiB,EAAE,MAAiC;IACzE,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,IAAI,KAAK,CACd,UAAU,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI;QAClE,mGAAmG,CACtG,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,KAAa,EACb,SAAS,GAAG,QAAQ;IAEpB,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,OAAO,EAAE;QAC9C,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,SAAS,CAAC,KAAK;QAAE,MAAM,SAAS,CAAC,KAAK,CAAC;IAC3C,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,aAAa,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAY,CAAC;IACvD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAuB,CAAC;IAC/C,IAAI,OAAO,MAAM,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,mCAAmC,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;IAC3C,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,0BAA0B,CAAC,CAAC;IAC5D,MAAM,iBAAiB,GAAG,MAAM,EAAE,CAAC,+BAA+B,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,2BAA2B,CAAC,CAAC;IACzD,IACE,cAAc,KAAK,UAAU;QAC7B,iBAAiB,KAAK,mBAAmB;QACzC,UAAU,KAAK,qBAAqB,EACpC,CAAC;QACD,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,yCAAyC;YAC5D,gBAAgB,UAAU,iBAAiB,mBAAmB,sBAAsB,qBAAqB,GAAG,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,MAAM,CAAC,EAAE;QACtB,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YAC7C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;YAClF,CAAC,CAAC,EAAE;QACN,UAAU,EAAE,cAAc;QAC1B,mBAAmB,EAAE,iBAAiB;KACvC,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAqB;IAC9C,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,CAAC,MAAM,gBAAgB,CAAC,CAAC;IAC/E,IAAI,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,oDAAoD,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO;QACL,WAAW;QACX,OAAO,KAAK,CAAC,MAAM,EAAE;QACrB,OAAO,KAAK,CAAC,MAAM,EAAE;QACrB,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACpE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CAAC,KAAqB;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,KAAK,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IAC/D,OAAO,GAAG,KAAK,CAAC,MAAM,yBAAyB,IAAI,YAAY,CAAC;AAClE,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAA6B,EAAE,MAAgB;IAChF,MAAM,IAAI,GAAG;QACX,KAAK;QACL,MAAM;QACN,eAAe;QACf,cAAc;QACd,QAAQ;QACR,MAAM,CAAC,cAAc;QACrB,QAAQ;QACR,aAAa;QACb,gBAAgB;QAChB,kCAAkC;QAClC,kBAAkB;QAClB,aAAa,MAAM,CAAC,OAAO,EAAE;QAC7B,sBAAsB;KACvB,CAAC;IACF,IAAI,MAAM,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,CAAC,UAAU,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACpD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM;YAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC;;YACrE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,CAAC,IAAI,CACP,iBAAiB,EACjB,qCAAqC,EACrC,+BAA+B,CAChC,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,cAAc;QAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACnE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/extension.d.ts

@@ -0,0 +1,3 @@
+import { type ExtensionAPI } from "@earendil-works/pi-coding-agent";
+export default function foundryPiHarness(pi: ExtensionAPI): void;
+//# sourceMappingURL=extension.d.ts.map

package/dist/extension.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.d.ts","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAMA,OAAO,EAAc,KAAK,YAAY,EAAE,MAAM,iCAAiC,CAAC;AA0HhF,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAAC,EAAE,EAAE,YAAY,GAAG,IAAI,CAE/D"}

package/dist/extension.js

@@ -0,0 +1,116 @@
+import { randomUUID } from "node:crypto";
+import { mkdirSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { Type } from "@earendil-works/pi-ai";
+import { defineTool } from "@earendil-works/pi-coding-agent";
+import { runPiSkill } from "./runner.js";
+import { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+const FoundrySubagentParams = Type.Object({
+    skill: Type.String({ description: "Published Foundry skill name" }),
+    task: Type.String({ description: "One phase-sized task for the selected skill" }),
+    inputs: Type.Optional(Type.Array(Type.String(), { description: "Declared input paths relative to the Pipeline run" })),
+});
+function sandboxConfiguration() {
+    const sandbox = process.env.FOUNDRY_SANDBOX ?? "local";
+    if (sandbox !== "local" && sandbox !== "container") {
+        throw new Error("FOUNDRY_SANDBOX must be local or container");
+    }
+    const sandboxNetwork = process.env.FOUNDRY_SANDBOX_NETWORK ?? "bridge";
+    if (sandboxNetwork !== "bridge" && sandboxNetwork !== "none") {
+        throw new Error("FOUNDRY_SANDBOX_NETWORK must be bridge or none");
+    }
+    const credentialEnv = (process.env.FOUNDRY_SANDBOX_CREDENTIAL_ENV ?? "")
+        .split(",")
+        .map((value) => value.trim())
+        .filter(Boolean);
+    return {
+        sandbox,
+        sandboxImage: process.env.FOUNDRY_SANDBOX_IMAGE,
+        sandboxNetwork,
+        credentialEnv,
+    };
+}
+const foundrySubagent = defineTool({
+    name: "foundry_subagent",
+    label: "Foundry subagent",
+    description: "Run exactly one named published Foundry skill in a fresh Pi worker. The caller chooses the skill and order.",
+    promptSnippet: "Run one named published Foundry skill in an isolated child session.",
+    executionMode: "sequential",
+    parameters: FoundrySubagentParams,
+    async execute(_toolCallId, params, signal, onUpdate, ctx) {
+        const skillsRoot = process.env.FOUNDRY_SKILLS_DIR;
+        if (!skillsRoot) {
+            return {
+                content: [{ type: "text", text: "FOUNDRY_SKILLS_DIR is not configured." }],
+                details: null,
+            };
+        }
+        try {
+            const sandbox = sandboxConfiguration();
+            const skillDir = resolveInstalledSkill(skillsRoot, params.skill);
+            const inputPaths = (params.inputs ?? []).map((input) => resolveDeclaredInput(ctx.cwd, input));
+            const runsRoot = path.resolve(process.env.FOUNDRY_RUNS_DIR ?? path.join(tmpdir(), "foundry-pi-runs"));
+            mkdirSync(runsRoot, { recursive: true });
+            const runDir = path.join(runsRoot, `${params.skill}-${randomUUID()}`);
+            const model = ctx.model;
+            if (!model)
+                throw new Error("the parent Pi session has no selected model");
+            let eventCount = 0;
+            const record = await runPiSkill({
+                skillDir,
+                prompt: params.task,
+                inputPaths,
+                runDir,
+                provider: model.provider,
+                model: model.id,
+                thinking: ctx.thinkingLevel,
+                timeoutMs: Number(process.env.FOUNDRY_WORKER_TIMEOUT_MS ?? 600_000),
+                ...sandbox,
+                signal,
+                onEvent: (event) => {
+                    eventCount += 1;
+                    onUpdate?.({
+                        content: [
+                            {
+                                type: "text",
+                                text: JSON.stringify({
+                                    skill: params.skill,
+                                    status: "running",
+                                    event_count: eventCount,
+                                    last_event: event.type,
+                                }),
+                            },
+                        ],
+                        details: { skill: params.skill, event_count: eventCount, last_event: event.type },
+                    });
+                },
+            });
+            return {
+                content: [
+                    {
+                        type: "text",
+                        text: JSON.stringify({
+                            skill: params.skill,
+                            status: record.status,
+                            artifacts: record.artifacts,
+                            run_record: path.join(runDir, "run.json"),
+                            summary: record.final_output,
+                        }),
+                    },
+                ],
+                details: record,
+            };
+        }
+        catch (error) {
+            return {
+                content: [{ type: "text", text: error instanceof Error ? error.message : String(error) }],
+                details: null,
+            };
+        }
+    },
+});
+export default function foundryPiHarness(pi) {
+    pi.registerTool(foundrySubagent);
+}
+//# sourceMappingURL=extension.js.map

package/dist/extension.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extension.js","sourceRoot":"","sources":["../src/extension.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAqB,MAAM,iCAAiC,CAAC;AAEhF,OAAO,EAAE,UAAU,EAAoB,MAAM,aAAa,CAAC;AAE3D,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEpF,MAAM,qBAAqB,GAAG,IAAI,CAAC,MAAM,CAAC;IACxC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IACnE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IACjF,MAAM,EAAE,IAAI,CAAC,QAAQ,CACnB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC,CAChG;CACF,CAAC,CAAC;AAEH,SAAS,oBAAoB;IAM3B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC;IACvD,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,QAAQ,CAAC;IACvE,IAAI,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACpE,CAAC;IACD,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC;SACrE,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,OAAO;QACL,OAAO;QACP,YAAY,EAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC/C,cAAc;QACd,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,eAAe,GAAG,UAAU,CAAC;IACjC,IAAI,EAAE,kBAAkB;IACxB,KAAK,EAAE,kBAAkB;IACzB,WAAW,EACT,6GAA6G;IAC/G,aAAa,EAAE,qEAAqE;IACpF,aAAa,EAAE,YAAY;IAC3B,UAAU,EAAE,qBAAqB;IAEjC,KAAK,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG;QACtD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAClD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC;gBAC1E,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YACjE,MAAM,UAAU,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9F,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAC3B,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CACvE,CAAC;YACF,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,EAAE,EAAE,CAAC,CAAC;YACtE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;YACxB,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YAC3E,IAAI,UAAU,GAAG,CAAC,CAAC;YACnB,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC;gBAC9B,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,IAAI;gBACnB,UAAU;gBACV,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,KAAK,EAAE,KAAK,CAAC,EAAE;gBACf,QAAQ,EAAE,GAAG,CAAC,aAAa;gBAC3B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,OAAO,CAAC;gBACnE,GAAG,OAAO;gBACV,MAAM;gBACN,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;oBACjB,UAAU,IAAI,CAAC,CAAC;oBAChB,QAAQ,EAAE,CAAC;wBACT,OAAO,EAAE;4BACP;gCACE,IAAI,EAAE,MAAM;gCACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oCACnB,KAAK,EAAE,MAAM,CAAC,KAAK;oCACnB,MAAM,EAAE,SAAS;oCACjB,WAAW,EAAE,UAAU;oCACvB,UAAU,EAAE,KAAK,CAAC,IAAI;iCACvB,CAAC;6BACH;yBACF;wBACD,OAAO,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,CAAC,IAAI,EAAE;qBAClF,CAAC,CAAC;gBACL,CAAC;aACF,CAAC,CAAC;YACH,OAAO;gBACL,OAAO,EAAE;oBACP;wBACE,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;4BACnB,KAAK,EAAE,MAAM,CAAC,KAAK;4BACnB,MAAM,EAAE,MAAM,CAAC,MAAM;4BACrB,SAAS,EAAE,MAAM,CAAC,SAAS;4BAC3B,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC;4BACzC,OAAO,EAAE,MAAM,CAAC,YAAY;yBAC7B,CAAC;qBACH;iBACF;gBACD,OAAO,EAAE,MAAM;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;gBACzF,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;IACH,CAAC;CACF,CAAC,CAAC;AAEH,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAAC,EAAgB;IACvD,EAAE,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC;AACnC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+export { expectedArtifactsFromSkill, runPiSkill, sha256Path, type ArtifactResult, type ExpectedArtifact, type PiRunnerDependencies, type PiSkillRunRecord, type PiThinkingLevel, type RunPiSkillOptions, type RunStatus, type SandboxMode, type StagedInput, } from "./runner.js";
+export { buildDockerRunArgs, CONTAINER_FOUNDRY_VERSION_LABEL, CONTAINER_PI_VERSION_LABEL, CONTAINER_RPC_VERSION, CONTAINER_RPC_VERSION_LABEL, DEFAULT_CONTAINER_IMAGE, FOUNDRY_CLI_VERSION, inspectContainerImage, type ContainerImageResolution, type ContainerLaunchConfig, type ContainerMount, type ContainerNetworkPolicy, } from "./container.js";
+export { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+export { createPiTestAuthInteraction, defaultPiTestAuthDir, inspectPiTestAuth, PI_TEST_AUTH_PROVIDER, PiTestAuthManager, piTestAuthPath, type PiTestAuthInteractionOptions, type PiTestAuthLoginMethod, type PiTestAuthLoginOptions, type PiTestAuthStatus, } from "./pi-test-auth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACd,KAAK,WAAW,EAChB,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,sBAAsB,GAC5B,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,EACd,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,gBAAgB,GACtB,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { expectedArtifactsFromSkill, runPiSkill, sha256Path, } from "./runner.js";
+export { buildDockerRunArgs, CONTAINER_FOUNDRY_VERSION_LABEL, CONTAINER_PI_VERSION_LABEL, CONTAINER_RPC_VERSION, CONTAINER_RPC_VERSION_LABEL, DEFAULT_CONTAINER_IMAGE, FOUNDRY_CLI_VERSION, inspectContainerImage, } from "./container.js";
+export { resolveDeclaredInput, resolveInstalledSkill } from "./skill-resolution.js";
+export { createPiTestAuthInteraction, defaultPiTestAuthDir, inspectPiTestAuth, PI_TEST_AUTH_PROVIDER, PiTestAuthManager, piTestAuthPath, } from "./pi-test-auth.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,UAAU,EACV,UAAU,GAUX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,kBAAkB,EAClB,+BAA+B,EAC/B,0BAA0B,EAC1B,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,GAKtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AACpF,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,EACrB,iBAAiB,EACjB,cAAc,GAKf,MAAM,mBAAmB,CAAC"}

package/dist/pi-test-auth.d.ts

@@ -0,0 +1,45 @@
+import { type AuthInteraction, type AuthPrompt } from "@earendil-works/pi-ai";
+export declare const PI_TEST_AUTH_PROVIDER = "openai-codex";
+export type PiTestAuthLoginMethod = "browser" | "device_code";
+export interface PiTestAuthStatus {
+    auth_dir: string;
+    provider: typeof PI_TEST_AUTH_PROVIDER;
+    configured: boolean;
+    type?: "oauth" | "api_key";
+    account_id?: string;
+    expires_at?: string;
+    problem?: string;
+}
+export interface PiTestAuthLoginOptions {
+    loginMethod: PiTestAuthLoginMethod;
+    openBrowser: boolean;
+}
+export interface PiTestAuthInteractionOptions extends PiTestAuthLoginOptions {
+    write?: (message: string) => void;
+    openExternal?: (url: string) => void;
+    ask?: (prompt: AuthPrompt) => Promise<string>;
+}
+interface PiTestAuthRuntime {
+    login(providerId: string, type: "oauth", interaction: AuthInteraction): Promise<unknown>;
+    logout(providerId: string): Promise<void>;
+}
+interface PiTestAuthManagerDependencies {
+    createRuntime?: (options: {
+        authPath: string;
+        refreshOnCreate: false;
+    }) => Promise<PiTestAuthRuntime>;
+}
+export declare function defaultPiTestAuthDir(env?: NodeJS.ProcessEnv, home?: string): string;
+export declare function piTestAuthPath(authDir?: string): string;
+export declare function inspectPiTestAuth(authDir?: string): PiTestAuthStatus;
+export declare function createPiTestAuthInteraction(options: PiTestAuthInteractionOptions): AuthInteraction;
+export declare class PiTestAuthManager {
+    readonly authDir: string;
+    private readonly createRuntime;
+    constructor(authDir?: string, dependencies?: PiTestAuthManagerDependencies);
+    status(): PiTestAuthStatus;
+    login(options: PiTestAuthLoginOptions): Promise<PiTestAuthStatus>;
+    logout(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=pi-test-auth.d.ts.map

package/dist/pi-test-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pi-test-auth.d.ts","sourceRoot":"","sources":["../src/pi-test-auth.ts"],"names":[],"mappings":"AAOA,OAAO,EAAkB,KAAK,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAG9F,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,aAAa,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,OAAO,qBAAqB,CAAC;IACvC,UAAU,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,qBAAqB,CAAC;IACnC,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,4BAA6B,SAAQ,sBAAsB;IAC1E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACrC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC/C;AAED,UAAU,iBAAiB;IACzB,KAAK,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzF,MAAM,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,UAAU,6BAA6B;IACrC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE;QACxB,QAAQ,EAAE,MAAM,CAAC;QACjB,eAAe,EAAE,KAAK,CAAC;KACxB,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;CAClC;AAED,wBAAgB,oBAAoB,CAClC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,SAAY,GACf,MAAM,CAMR;AAED,wBAAgB,cAAc,CAAC,OAAO,SAAyB,GAAG,MAAM,CAEvE;AAED,wBAAgB,iBAAiB,CAAC,OAAO,SAAyB,GAAG,gBAAgB,CA6EpF;AA6BD,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,4BAA4B,GACpC,eAAe,CAgCjB;AAED,qBAAa,iBAAiB;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA8D;gBAEhF,OAAO,SAAyB,EAAE,YAAY,GAAE,6BAAkC;IAK9F,MAAM,IAAI,gBAAgB;IAIpB,KAAK,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAUjE,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ9B"}