@goah/cli 0.11.5 → 0.13.0

package/node_modules/goah-runner-pi/dist/pi-worker.js

@@ -1,10 +1,12 @@
 import { spawn } from "node:child_process";
+import { existsSync, mkdtempSync, readdirSync, readFileSync, realpathSync, rmSync } from "node:fs";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
-import { dirname, resolve, sep } from "node:path";
+import { delimiter, dirname, join, resolve, sep } from "node:path";
+import { homedir, tmpdir } from "node:os";
 import { fileURLToPath } from "node:url";
 import { Agent } from "@earendil-works/pi-agent-core";
 import { fauxAssistantMessage, fauxText, fauxToolCall, Type } from "@earendil-works/pi-ai";
-import { SESSION_FORMAT_VERSION } from "goah-ledger-contract";
+import { TRANSCRIPT_FORMAT_VERSION } from "goah-ledger-contract";
 import { runProcessWorker } from "./index.js";
 import { createPiModel } from "./model-provider.js";
 export function compactMessages(messages, maxRecent = 8) {
@@ -19,7 +21,7 @@ export function compactMessages(messages, maxRecent = 8) {
     ];
 }
 export async function runPiWorker() {
-    await runProcessWorker(async (request, emit, rpc) => {
+    await runProcessWorker(async (request, emit, rpc, controls) => {
         const contextRecord = typeof request.context === "object" && request.context !== null && !Array.isArray(request.context) ? request.context : {};
         const legacyRequest = request.turn === undefined;
         const binding = request.turn?.goalBinding;
@@ -33,6 +35,7 @@ export async function runPiWorker() {
         const configured = createPiModel(provider, modelId);
         const { models } = configured;
         const privateAuth = request.runtime && typeof request.runtime === "object" && !Array.isArray(request.runtime) ? request.runtime : {};
+        const protectedPaths = Array.isArray(privateAuth.protectedPaths) ? privateAuth.protectedPaths.filter((value) => typeof value === "string").map((path) => resolve(path)) : [];
         const model = typeof privateAuth.baseUrl === "string" ? { ...configured.model, baseUrl: privateAuth.baseUrl } : configured.model;
         if (provider === "faux") {
             const faux = configured.faux;
@@ -43,21 +46,26 @@ export async function runPiWorker() {
                 const handoff = JSON.parse(process.env.GOAH_PI_FAUX_HANDOFF ?? "{}");
                 const current = contextRecord.workRecord && typeof contextRecord.workRecord === "object" && !Array.isArray(contextRecord.workRecord) ? contextRecord.workRecord : {};
                 const evidence = Array.isArray(contextRecord.sourceSeqs) ? contextRecord.sourceSeqs.filter((value) => typeof value === "number") : [];
-                const record = `# Current State\n\nFaux Goal work completed.\n\n# Observations\n\n${JSON.stringify(handoff.observations ?? [])}\n\n# Work Completed\n\n${JSON.stringify(handoff.results ?? [])}\n\n# Decisions\n\nRecord the scripted result from ${request.wake.id}.\n\n# Blockers\n\n${String(handoff.blocker ?? "None.")}\n\n# Next Steps\n\n${JSON.stringify(handoff.nextSteps ?? [])}\n`;
-                faux.setResponses([
-                    fauxAssistantMessage(fauxToolCall("work_record_update", { expectedRevision: Number(current.recordRevision ?? 0), content: record, reason: "record faux Goal progress", evidence: evidence.length ? [Math.max(...evidence)] : [] }), { stopReason: "toolUse" }),
-                    fauxAssistantMessage(fauxToolCall("handoff", handoff), { stopReason: "toolUse" }),
-                ]);
+                const outcome = ["progress", "waiting", "blocked", "completion_proposed"].includes(String(handoff.outcome)) ? String(handoff.outcome) : "progress";
+                const handoffEvidence = Array.isArray(handoff.evidence) && handoff.evidence.every((value) => typeof value === "number") ? handoff.evidence : evidence.length ? [Math.max(...evidence)] : [];
+                const record = `# Current State\n\nFaux Goal outcome: ${outcome}.\n\n# Observations\n\nSee the cited Ledger evidence.\n\n# Work Completed\n\nExecuted the scripted faux Goal turn.\n\n# Decisions\n\nRecord the scripted result from ${request.execution.id}.\n\n# Blockers\n\n${outcome === "blocked" ? "Blocked." : "None."}\n\n# Next Steps\n\nFollow the current Goal and explicit tools.\n`;
+                const finalResponse = fauxAssistantMessage([fauxText(String(handoff.message ?? `Goal work recorded with outcome ${outcome}.`)), fauxToolCall("handoff", { outcome, evidence: handoffEvidence })], { stopReason: "toolUse" });
+                const recordResponse = fauxAssistantMessage(fauxToolCall("work_record_update", { expectedRevision: Number(current.recordRevision ?? 0), content: record, reason: "record faux Goal progress", evidence: evidence.length ? [Math.max(...evidence)] : [] }), { stopReason: "toolUse" });
+                const fatalBatch = fauxAssistantMessage([fauxText("Stale completion attempt."), fauxToolCall("handoff", { outcome, evidence: handoffEvidence }), fauxToolCall("write", { path: "fatal.txt", content: "must not be written" })], { stopReason: "toolUse" });
+                faux.setResponses(process.env.GOAH_PI_FAUX_FATAL_BATCH === "1" ? [fatalBatch] : process.env.GOAH_PI_FAUX_HANDOFF_REPAIR === "1" ? [fauxAssistantMessage([fauxText("Premature completion attempt."), fauxToolCall("handoff", { outcome, evidence: handoffEvidence })], { stopReason: "toolUse" }), recordResponse, finalResponse] : [recordResponse, finalResponse]);
             }
             else if (!goalState.bound) {
                 faux.setResponses([fauxAssistantMessage([fauxText(process.env.GOAH_PI_FAUX_RESPONSE ?? "Hello from Goah.")])]);
             }
             else {
                 const handoff = JSON.parse(process.env.GOAH_PI_FAUX_HANDOFF ?? "{}");
-                faux.setResponses([fauxAssistantMessage(fauxToolCall("handoff", handoff), { stopReason: "toolUse" })]);
+                const { message, ...handoffData } = handoff;
+                faux.setResponses([fauxAssistantMessage([fauxText(String(message ?? "Goal work recorded.")), fauxToolCall("handoff", handoffData)], { stopReason: "toolUse" })]);
             }
         }
         let output = null;
+        let acceptedHandoff = null;
+        let revokedReason = "";
         let response = "";
         let responseFailure = "";
         let compactions = 0;
@@ -80,15 +88,19 @@ export async function runPiWorker() {
             : undefined;
         if (contextRecord.workRecord && typeof contextRecord.workRecord === "object" && !Array.isArray(contextRecord.workRecord) && typeof contextRecord.workRecord.recordRevision === "number")
             goalState.recordRevision = contextRecord.workRecord.recordRevision;
-        const tools = createTools(root, (value) => { output = value; }, rpc, request.wake.startedAt, capabilities, goalState);
+        const tools = createTools(root, (value) => { if (!acceptedHandoff || !sameHandoff(acceptedHandoff.handoff, value))
+            throw new Error("Handoff tool executed without accepted validation"); output = { validationAttemptId: acceptedHandoff.attemptId, validationToken: acceptedHandoff.token, handoff: value }; }, rpc, capabilities, goalState, protectedPaths);
         const contextPolicy = resolveContextPolicy(model.contextWindow, process.env);
-        emit({ type: "session.started", data: { formatVersion: SESSION_FORMAT_VERSION, provider, model: modelId, runner: "pi", contextWindowTokens: model.contextWindow, maxOutputTokensPerTurn: model.maxTokens } });
+        emit({ type: "transcript.started", data: { formatVersion: TRANSCRIPT_FORMAT_VERSION, provider, model: modelId, runner: "pi", contextWindowTokens: model.contextWindow, maxOutputTokensPerTurn: model.maxTokens } });
         const suppliedPrompt = typeof contextRecord.systemPrompt === "string" ? contextRecord.systemPrompt : undefined;
         const activeContext = typeof contextRecord.text === "string" ? contextRecord.text : JSON.stringify(request.context);
         const sourceSeqs = Array.isArray(contextRecord.sourceSeqs) ? contextRecord.sourceSeqs.filter((value) => Number.isInteger(value)) : [];
+        const basePrompt = process.env.GOAH_PI_SYSTEM_PROMPT ?? suppliedPrompt ?? (request.turn?.source.kind === "human" ? "You are Goah's primary Agent. Respond naturally to the Human." : `You are Goah Agent ${request.agent}. Inspect the supplied context and respond appropriately.`);
         const systemPrompt = goalState.bound
-            ? `${process.env.GOAH_PI_SYSTEM_PROMPT ?? suppliedPrompt ?? "You are a goal-oriented worker."}\nYou must finish by calling handoff exactly once. Treat the supplied context as authoritative.`
-            : `${process.env.GOAH_PI_SYSTEM_PROMPT ?? suppliedPrompt ?? "You are Goah's primary Agent."}\nRespond normally to the Human. Do not create a Goal for routine single-turn work. When the Human expresses a durable Goal, call create_goal; after create_goal, work_on_goal, or a Root resume succeeds with a Goal binding, update the Goal Work Record and finish by calling handoff. Treat the supplied context as authoritative.`;
+            ? `${basePrompt}\nThis Turn is Goal-bound. You must update its Work Record, write a concise human-readable assistant message describing what happened, and call handoff exactly once with only machine-readable outcome and evidence. The message and Handoff are separate outputs. Treat the supplied context as authoritative.`
+            : request.turn?.source.kind === "human"
+                ? `${basePrompt}\nThis Human Turn starts without a Goal binding. Finish with an ordinary response unless a Goal tool establishes a binding during this Turn; after a binding is established, update that Goal's Work Record, write a concise human-readable assistant message, and call handoff exactly once with separate machine-readable outcome and evidence. Treat the supplied context as authoritative.`
+                : `${basePrompt}\nThis Turn has no Goal binding. Finish with an ordinary response and do not call handoff. Treat the supplied context as authoritative.`;
         const agent = new Agent({
             initialState: {
                 systemPrompt,
@@ -129,9 +141,33 @@ export async function runPiWorker() {
                 }
                 return view;
             },
-            shouldStopAfterTurn: () => output !== null,
+            beforeToolCall: async ({ assistantMessage, toolCall, args }) => { if (revokedReason)
+                return { block: true, reason: `Turn authority was revoked: ${revokedReason}`, terminate: true }; if (toolCall.name !== "handoff")
+                return; acceptedHandoff = null; output = null; const handoff = args; try {
+                const result = await rpc("goal.handoff.validate", { handoff, candidateMessage: assistantResponseText(assistantMessage) });
+                if (result.accepted) {
+                    acceptedHandoff = { attemptId: result.attemptId, token: result.token, handoff };
+                    return;
+                }
+                const reason = result.issues.map((issue) => `- ${issue.message}`).join("\n");
+                if (result.fatal)
+                    revokedReason = reason;
+                return { block: true, reason: `Handoff was not accepted:\n${reason}`, terminate: result.fatal };
+            }
+            catch (error) {
+                revokedReason = error instanceof Error ? error.message : String(error);
+                return { block: true, reason: `Handoff validation could not continue: ${revokedReason}`, terminate: true };
+            } },
+            shouldStopAfterTurn: () => output !== null || Boolean(revokedReason),
             toolExecution: "sequential",
         });
+        let acceptingSteering = true;
+        controls.onSteer((message) => {
+            if (!acceptingSteering)
+                return false;
+            agent.steer({ role: "user", content: message, timestamp: Date.now() });
+            return true;
+        });
         agent.subscribe((event) => {
             if (event.type === "turn_start")
                 emit({ type: "turn.started", data: {} });
@@ -139,7 +175,7 @@ export async function runPiWorker() {
                 const id = idFor(event.message);
                 if (!emittedUsers.has(id)) {
                     emittedUsers.add(id);
-                    emit({ type: "message.user", data: { message: sessionMessage(event.message, id) } });
+                    emit({ type: "message.user", data: { message: transcriptMessage(event.message, id) } });
                 }
             }
             else if (event.type === "message_update") {
@@ -149,7 +185,8 @@ export async function runPiWorker() {
                 response = assistantResponseText(event.message);
                 if ((event.message.stopReason === "error" || event.message.stopReason === "aborted") && event.message.errorMessage)
                     responseFailure = event.message.errorMessage;
-                emit({ type: "message.assistant.completed", data: { message: sessionMessage(event.message, idFor(event.message)) } });
+                const handoffIntent = hasAgentToolCall(event.message, "handoff");
+                emit({ type: "message.assistant.completed", data: { message: transcriptMessage(event.message, idFor(event.message)), ...(handoffIntent ? { completionIntent: "handoff", commitState: "provisional" } : { completionIntent: "ordinary", commitState: "committed" }) } });
             }
             else if (event.type === "tool_execution_start")
                 emit({ type: "tool.called", data: { callId: event.toolCallId, name: event.toolName, arguments: JSON.parse(JSON.stringify(event.args)) } });
@@ -157,16 +194,26 @@ export async function runPiWorker() {
                 emit({ type: "tool.completed", data: { callId: event.toolCallId, messageId: `tool:${event.toolCallId}`, name: event.toolName, result: JSON.parse(JSON.stringify(event.result)), isError: event.isError } });
             else if (event.type === "turn_end")
                 emit({ type: "turn.completed", data: {} });
-            else if (event.type === "agent_end")
-                emit({ type: "session.completed", data: {} });
         });
-        await agent.prompt(`Wake started at: ${request.wake.startedAt ?? "unknown"}\n\n${activeContext}\n\nRunner root: ${root}. Manage local files directly when the goal requires them.`);
+        const abortAgent = () => agent.abort();
+        process.once("SIGTERM", abortAgent);
+        process.once("SIGINT", abortAgent);
+        try {
+            await agent.prompt(`Turn started at: ${request.execution.startedAt}\n\n${activeContext}\n\nRunner root: ${root}. Manage local files directly when the goal requires them.`);
+        }
+        finally {
+            acceptingSteering = false;
+            process.off("SIGTERM", abortAgent);
+            process.off("SIGINT", abortAgent);
+        }
+        if (revokedReason)
+            return { outcome: "abnormal", reason: revokedReason };
         if (!goalState.bound)
             return response ? { outcome: "response", response: { content: response } } : { outcome: "abnormal", reason: responseFailure || "Pi worker exited without a response" };
         if (responseFailure)
             return { outcome: "abnormal", reason: responseFailure };
         if (!output)
-            return { outcome: "abnormal", reason: "Pi worker exited without a valid handoff" };
+            return { outcome: "abnormal", reason: "Pi worker exited without an accepted Handoff" };
         return { outcome: "handoff", output };
     });
 }
@@ -185,32 +232,23 @@ function isJson(value) {
         return value.every(isJson);
     return Boolean(value && typeof value === "object" && Object.values(value).every(isJson));
 }
-function sessionMessage(message, id) {
+function transcriptMessage(message, id) {
     const value = JSON.parse(JSON.stringify(message));
     const role = message.role === "assistant" ? "assistant" : message.role === "user" ? "user" : "tool";
     return { id, role, content: (value.content ?? value), ...(value.usage !== undefined ? { usage: value.usage } : {}), ...(typeof value.stopReason === "string" ? { stopReason: value.stopReason } : {}), ...(typeof value.errorMessage === "string" ? { errorMessage: value.errorMessage } : {}) };
 }
-function createTools(root, handoff, rpc, wakeStartedAt, capabilities, goalState) {
+function createTools(root, handoff, rpc, capabilities, goalState, protectedPaths = []) {
     const handoffTool = {
         name: "handoff",
         label: "Handoff",
-        description: "Record a structured handoff and end the wake.",
+        description: "Record a structured handoff and end the Goal-bound Turn.",
         parameters: Type.Object({
-            observations: Type.Optional(Type.Array(Type.String())),
-            results: Type.Optional(Type.Array(Type.String())),
-            nextSteps: Type.Optional(Type.Array(Type.String())),
-            blocker: Type.Optional(Type.String()),
-            material: Type.Optional(Type.Boolean()),
-            outcome: Type.Optional(Type.Union([Type.Literal("progress"), Type.Literal("waiting"), Type.Literal("blocked"), Type.Literal("completion_proposed")])),
-            evidence: Type.Optional(Type.Array(Type.Number())),
-            nextWakeAt: Type.Optional(Type.String()),
+            outcome: Type.Union([Type.Literal("progress"), Type.Literal("waiting"), Type.Literal("blocked"), Type.Literal("completion_proposed")]),
+            evidence: Type.Array(Type.Number()),
         }),
         execute: async (_id, params) => {
             const input = params;
-            const compact = goalState.binding && goalState.recordRevision !== undefined
-                ? { goalId: goalState.binding.goalId, goalRevision: goalState.binding.goalRevision, recordRevision: goalState.recordRevision, outcome: input.outcome ?? (input.blocker ? "blocked" : input.material ? "completion_proposed" : "progress"), evidence: input.evidence ?? [] }
-                : null;
-            const value = { handoff: compact ?? { observations: input.observations ?? [], results: input.results ?? [], nextSteps: input.nextSteps ?? [], ...(input.blocker ? { blocker: input.blocker } : {}), ...(input.material === true ? { material: true } : {}) }, mail: [], nextWakeAt: validateNextWakeAt(input.nextWakeAt, wakeStartedAt) };
+            const value = { outcome: input.outcome, evidence: input.evidence };
             handoff(value);
             return { content: [{ type: "text", text: "handoff recorded" }], details: value, terminate: true };
         },
@@ -229,19 +267,19 @@ function createTools(root, handoff, rpc, wakeStartedAt, capabilities, goalState)
     const readTool = {
         name: "read", label: "Read", description: "Read a UTF-8 file inside the current working directory.",
         parameters: Type.Object({ path: Type.String() }),
-        execute: async (_id, params) => { const input = params; return { content: [{ type: "text", text: await readFile(scoped(root, input.path), "utf8") }], details: {} }; },
+        execute: async (_id, params) => { const input = params; return { content: [{ type: "text", text: await readFile(scopedRunnerPath(root, input.path, protectedPaths), "utf8") }], details: {} }; },
     };
     const writeTool = {
         name: "write", label: "Write", description: "Create or replace a UTF-8 file inside the current working directory.",
         parameters: Type.Object({ path: Type.String(), content: Type.String() }),
-        execute: async (_id, params) => { const input = params; const path = scoped(root, input.path); await mkdir(dirname(path), { recursive: true }); await writeFile(path, input.content); return { content: [{ type: "text", text: "written" }], details: {} }; },
+        execute: async (_id, params) => { const input = params; const path = scopedRunnerPath(root, input.path, protectedPaths); await mkdir(dirname(path), { recursive: true }); await writeFile(path, input.content); return { content: [{ type: "text", text: "written" }], details: {} }; },
     };
     const editTool = {
         name: "edit", label: "Edit", description: "Replace one exact text occurrence in a UTF-8 file inside the current working directory.",
         parameters: Type.Object({ path: Type.String(), oldText: Type.String(), newText: Type.String() }),
         execute: async (_id, params) => {
             const input = params;
-            const path = scoped(root, input.path);
+            const path = scopedRunnerPath(root, input.path, protectedPaths);
             const source = await readFile(path, "utf8");
             const first = source.indexOf(input.oldText);
             if (first < 0)
@@ -254,9 +292,9 @@ function createTools(root, handoff, rpc, wakeStartedAt, capabilities, goalState)
     };
     const bashTool = {
         name: "bash", label: "Bash",
-        description: "Run a shell command inside the local runner root. The command's process group is killed after the timeout; declare timeoutMs explicitly for builds, installs, or deployment waits that need longer.",
+        description: "Run a sandboxed shell command inside the local runner root. Goah credential/control state is masked. If protected state shares the root, use the write tool to create new top-level paths. The command's process group is killed after timeout.",
         parameters: Type.Object({ command: Type.String(), timeoutMs: Type.Optional(Type.Number()) }), executionMode: "sequential",
-        execute: async (_id, params, signal) => runBashCommand(root, params, signal),
+        execute: async (_id, params, signal) => runBashCommand(root, params, signal, protectedPaths),
     };
     return [readTool, writeTool, editTool, bashTool, ...rpcTools, handoffTool];
 }
@@ -267,23 +305,42 @@ export function bashTimeoutMs(requested, env = process.env) {
     return Number.isFinite(value) && value > 0 ? Math.min(value, BASH_TIMEOUT_HARD_CAP_MS) : fallback;
 }
 /** Shell execution with a process-group timeout: a hung command becomes a model-visible tool error instead of a stalled wake. */
-export async function runBashCommand(root, input, signal) {
+export async function runBashCommand(root, input, signal, protectedPaths = []) {
     const timeoutMs = bashTimeoutMs(input.timeoutMs);
-    const child = spawn("/bin/sh", ["-lc", input.command], { cwd: root, env: toolEnvironment(), detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
+    const sandboxTemp = mkdtempSync(join(tmpdir(), "goah-bash-"));
+    const launch = sandboxedShell(input.command, root, protectedPaths, sandboxTemp);
+    if (!launch) {
+        if (sandboxTemp)
+            rmSync(sandboxTemp, { recursive: true, force: true });
+        return { content: [{ type: "text", text: "Bash is unavailable because this platform cannot isolate Goah credential and control state." }], details: { command: input.command }, isError: true };
+    }
+    const child = spawn(launch.command, launch.args, { cwd: root, env: toolEnvironment(sandboxTemp), detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "";
     let stderr = "";
     let timedOut = false;
     let outputOverflow = false;
-    child.stdout?.on("data", (chunk) => { stdout += chunk.toString(); if (stdout.length > 1_000_000)
-        outputOverflow = true; });
-    child.stderr?.on("data", (chunk) => { stderr += chunk.toString(); if (stderr.length > 1_000_000)
-        outputOverflow = true; });
     const killGroup = () => { if (child.pid) {
         try {
             process.kill(process.platform === "win32" ? child.pid : -child.pid, "SIGKILL");
         }
         catch { }
     } };
+    const appendOutput = (channel, chunk) => {
+        if (outputOverflow)
+            return;
+        const text = chunk.toString();
+        const remaining = Math.max(0, 1_000_000 - stdout.length - stderr.length);
+        if (channel === "stdout")
+            stdout += text.slice(0, remaining);
+        else
+            stderr += text.slice(0, remaining);
+        if (text.length > remaining) {
+            outputOverflow = true;
+            killGroup();
+        }
+    };
+    child.stdout?.on("data", (chunk) => appendOutput("stdout", chunk));
+    child.stderr?.on("data", (chunk) => appendOutput("stderr", chunk));
     const timer = setTimeout(() => { timedOut = true; killGroup(); }, timeoutMs);
     const onAbort = () => killGroup();
     signal?.addEventListener("abort", onAbort, { once: true });
@@ -292,29 +349,22 @@ export async function runBashCommand(root, input, signal) {
         child.once("close", (code, signalName) => resolve({ code, signal: signalName }));
     });
     try {
-        if (outputOverflow)
-            killGroup();
         const result = await close;
         if (timedOut)
             return { content: [{ type: "text", text: `Command timed out after ${timeoutMs}ms and its process group was killed. Declare a larger timeoutMs for long-running commands.` }], details: { command: input.command, timedOutAfterMs: timeoutMs }, isError: true };
         if (signal?.aborted)
             return { content: [{ type: "text", text: "Command aborted with the wake." }], details: { command: input.command }, isError: true };
-        return { content: [{ type: "text", text: `${stdout}${stderr}`.slice(-50_000) }], details: { command: input.command, exitCode: result.code, signal: result.signal, ...(outputOverflow ? { outputOverflow: true } : {}) }, ...(outputOverflow ? { isError: true } : {}) };
+        killGroup();
+        const failed = outputOverflow || result.code !== 0 || result.signal !== null;
+        return { content: [{ type: "text", text: `${stdout}${stderr}`.slice(-50_000) }], details: { command: input.command, exitCode: result.code, signal: result.signal, ...(outputOverflow ? { outputOverflow: true } : {}) }, ...(failed ? { isError: true } : {}) };
     }
     finally {
         clearTimeout(timer);
         signal?.removeEventListener("abort", onAbort);
+        if (sandboxTemp)
+            rmSync(sandboxTemp, { recursive: true, force: true });
     }
 }
-export function validateNextWakeAt(value, wakeStartedAt) {
-    if (value === undefined)
-        return null;
-    const next = Date.parse(value);
-    const started = wakeStartedAt === null ? Number.NaN : Date.parse(wakeStartedAt);
-    if (!Number.isFinite(next) || !Number.isFinite(started) || next <= started)
-        throw new Error("nextWakeAt must be a valid time later than the current wake start");
-    return new Date(next).toISOString();
-}
 export function resolveContextPolicy(contextWindowTokens, env) {
     if (!Number.isInteger(contextWindowTokens) || contextWindowTokens <= 0)
         throw new Error("model context window is missing");
@@ -356,17 +406,14 @@ function createRpcTools(rpc, allowed, onResult) {
     const definitions = [
         ["ledger.search", tool("ledger_search", "Search durable ledger facts.", "ledger.search", Type.Object({ query: Type.String(), limit: Type.Optional(Type.Number()) }))],
         ["memory.append", tool("memory_append", "Append a durable working-memory note that is injected into your future wakes. Record procedural knowledge, active hypotheses, and abandoned approaches with the reason; keep notes concise.", "memory.append", Type.Object({ note: Type.String() }))],
-        ["mail.send", tool("send_mail", "Send a durable message to another agent or human.", "mail.send", Type.Object({ to: Type.String(), level: Type.Union([Type.Literal("fyi"), Type.Literal("decision"), Type.Literal("emergency")]), body: Type.Any() }))],
+        ["mail.send", tool("send_mail", "Send durable Mail to another Goal owner. goalId is required and routes the Mail into that owner's Goal Turn. Human communication must use request_human.", "mail.send", Type.Object({ to: Type.String(), goalId: Type.String(), level: Type.Union([Type.Literal("fyi"), Type.Literal("decision"), Type.Literal("emergency")]), body: Type.Any() }))],
         ["schedule.set", tool("schedule_wake", "Schedule this agent's next wake.", "schedule.set", Type.Object({ at: Type.String(), reason: Type.String() }))],
-        ["action.submit", tool("submit_action", "Submit a gated external action with evidence.", "action.submit", Type.Object({ id: Type.String(), kind: Type.String(), connector: Type.String(), payload: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
-        ["audit.ack", tool("ack_audit_advice", "Acknowledge audit advice after incorporating it.", "audit.ack", Type.Object({ actionId: Type.String() }))],
-        ["audit.write", tool("write_audit_advice", "Write audit advice for an action.", "audit.write", Type.Object({ actionId: Type.String(), body: Type.Any(), evidence: Type.Array(Type.Number()) }))],
         ["team.list", tool("team_list", "Read the ledger-derived team roster and liveness state.", "team.list", Type.Object({}))],
         ["goal.get", tool("get_goal", "Read the Goal bound to this Turn, or null when the Turn is unbound.", "goal.get", Type.Object({}))],
         ["goal.create", tool("create_goal", "Create a Root Goal from durable Human intent and bind this Turn. Do not use for greetings, questions, or routine single-turn work.", "goal.create", Type.Object({ objective: Type.String(), id: Type.Optional(Type.String()) }))],
         ["goal.work", tool("work_on_goal", "Bind this Human Turn to an existing active Goal owned by this Agent.", "goal.work", Type.Object({ goalId: Type.String() }))],
-        ["goal.delegate", tool("delegate_goal", "Atomically create a Child Goal with observation and verification methods, its Work Record, decision brief, and initial Wake.", "goal.delegate", Type.Object({ id: Type.String(), parentGoalId: Type.String(), childGoal: Type.Object({ id: Type.String(), objective: Type.String(), observationMethod: Type.String(), verificationMethod: Type.String(), owner: Type.String() }), brief: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
-        ["goal.reassign", tool("reassign_goal", "Atomically transfer a child goal, notify both owners, and queue the new owner.", "goal.reassign", Type.Object({ id: Type.String(), goalId: Type.String(), newOwner: Type.String(), brief: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
+        ["goal.delegate", tool("delegate_goal", "Atomically create a Child Goal with observation and verification methods, its Work Record, decision brief, and initial Wake.", "goal.delegate", Type.Object({ id: Type.String(), parentGoalId: Type.String(), expectedParentRevision: Type.Number(), childGoal: Type.Object({ id: Type.String(), objective: Type.String(), observationMethod: Type.String(), verificationMethod: Type.String(), owner: Type.String() }), brief: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
+        ["goal.reassign", tool("reassign_goal", "Atomically transfer a child goal, notify both owners, and queue the new owner.", "goal.reassign", Type.Object({ id: Type.String(), goalId: Type.String(), expectedGoalRevision: Type.Number(), newOwner: Type.String(), brief: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
         ["goal.revise", tool("revise_goal", "Revise a Child Goal objective, observation method, and verification method as one new revision.", "goal.revise", Type.Object({ goalId: Type.String(), objective: Type.String(), observationMethod: Type.String(), verificationMethod: Type.String(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
         ["goal.pause", tool("pause_goal", "Pause a child goal and suppress queued motion.", "goal.pause", Type.Object({ goalId: Type.String() }))],
         ["goal.resume", tool("resume_goal", "Resume a Goal. A direct Human Root resume binds the current Turn; Child Goal resume requires an already bound parent Turn.", "goal.resume", Type.Object({ goalId: Type.String() }))],
@@ -378,23 +425,125 @@ function createRpcTools(rpc, allowed, onResult) {
         ["work_record.diff", tool("work_record_diff", "Compare two revisions of a Goal Work Record.", "work_record.diff", Type.Object({ goalId: Type.Optional(Type.String()), fromRevision: Type.Number(), toRevision: Type.Number() }))],
         ["work_record.search", tool("work_record_search", "Search every Goal Work Record.", "work_record.search", Type.Object({ query: Type.String(), limit: Type.Optional(Type.Number()) }))],
         ["work_record.update", tool("work_record_update", "Create the next version of the Work Record bound to this Turn with Ledger evidence.", "work_record.update", Type.Object({ expectedRevision: Type.Number(), content: Type.String(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
-        ["goal.put", tool("put_goal", "Create or update a goal using parent-layer authority.", "goal.put", Type.Object({ goal: Type.Any() }))],
+        ["goal.put", tool("put_goal", "Create or update a Goal through the authoritative goal.changed protocol using parent-layer authority.", "goal.put", Type.Object({ goal: Type.Any(), reason: Type.String(), evidence: Type.Array(Type.Number()) }))],
     ];
     return definitions.filter(([capability]) => !allowed || allowed.has(capability)).map(([, value]) => value);
 }
-function scoped(root, path) {
-    const resolved = resolve(root, path);
-    if (resolved !== root && !resolved.startsWith(`${root}${sep}`))
+export function scopedRunnerPath(root, path, protectedPaths = []) {
+    const resolved = canonicalPath(resolve(root, path));
+    const canonicalRoot = canonicalPath(root);
+    if (resolved !== canonicalRoot && !resolved.startsWith(`${canonicalRoot}${sep}`))
         throw new Error("path escapes runner root");
+    if (protectedPaths.map(canonicalPath).some((privatePath) => resolved === privatePath || resolved.startsWith(`${privatePath}${sep}`)))
+        throw new Error("path is protected Goah state");
     return resolved;
 }
-function toolEnvironment() {
+function sandboxedShell(command, root, protectedPaths, sandboxTemp) {
+    if (process.platform === "darwin" && existsSync("/usr/bin/sandbox-exec")) {
+        const workspacePaths = sandboxWorkspacePaths(canonicalPath(root), protectedPaths.map(canonicalPath));
+        const workspaceAncestors = pathAncestors(canonicalPath(root));
+        const toolchains = toolchainReadPaths(canonicalPath(root));
+        const readableAncestors = toolchains.flatMap(pathAncestors);
+        const readable = ["/System", "/usr", "/bin", "/sbin", "/Library", "/etc", "/dev", "/private/etc", "/private/var/select", "/Applications", ...toolchains, ...workspacePaths, ...(sandboxTemp ? [sandboxTemp] : [])].filter(existsSync).map(canonicalPath);
+        const writable = [...workspacePaths, ...(sandboxTemp ? [sandboxTemp] : []), "/dev"].map(canonicalPath);
+        const rules = ["(version 1)", "(deny default)", "(import \"system.sb\")", "(allow process*)", "(allow signal)", "(allow network*)", "(allow sysctl-read)", "(allow mach-lookup)", ...[...new Set([...workspaceAncestors, ...readableAncestors])].map((path) => `(allow file-read* (literal ${JSON.stringify(path)}))`), ...readable.map((path) => `(allow file-read* (subpath ${JSON.stringify(path)}))`), ...writable.map((path) => `(allow file-write* (subpath ${JSON.stringify(path)}))`), ...protectedPaths.map(canonicalPath).map((path) => `(deny file-read* file-write* (subpath ${JSON.stringify(path)}))`)];
+        return { command: "/usr/bin/sandbox-exec", args: ["-p", rules.join(" "), "/bin/sh", "-lc", command] };
+    }
+    if (process.platform === "linux") {
+        const bwrap = ["/usr/bin/bwrap", "/bin/bwrap"].find(existsSync);
+        if (bwrap) {
+            const canonicalRoot = canonicalPath(root);
+            if (["/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"].some((path) => canonicalRoot === path || canonicalRoot.startsWith(`${path}${sep}`)))
+                return null;
+            return { command: bwrap, args: linuxSandboxArgs(command, canonicalRoot, protectedPaths, sandboxTemp) };
+        }
+    }
+    return null;
+}
+export function linuxSandboxArgs(command, root, protectedPaths, sandboxTemp) {
+    const canonicalRoot = canonicalPath(root);
+    const workspacePaths = sandboxWorkspacePaths(canonicalRoot, protectedPaths.map(canonicalPath));
+    const systemPaths = ["/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"].filter(existsSync).flatMap((path) => ["--ro-bind", path, path]);
+    const mounted = ["/tmp", "/usr", "/bin", "/sbin", "/lib", "/lib64", "/etc"];
+    const toolchains = toolchainReadPaths(canonicalRoot).filter((path) => !mounted.some((base) => path === base || path.startsWith(`${base}${sep}`)) && path !== canonicalRoot && !path.startsWith(`${canonicalRoot}${sep}`));
+    const destinations = [canonicalRoot, ...toolchains].flatMap((path) => pathAncestors(path).slice(1)).filter((path) => !mounted.some((base) => path === base || path.startsWith(`${base}${sep}`)));
+    const directories = [...new Set(destinations)].sort((left, right) => left.length - right.length).flatMap((path) => ["--dir", path]);
+    return ["--die-with-parent", "--unshare-all", "--share-net", ...systemPaths, "--dev", "/dev", "--proc", "/proc", "--tmpfs", "/tmp", ...(sandboxTemp ? ["--dir", canonicalPath(sandboxTemp)] : []), ...directories, ...toolchains.flatMap((path) => ["--ro-bind", path, path]), ...workspacePaths.flatMap((path) => ["--bind", path, path]), "--chdir", canonicalRoot, "/bin/sh", "-lc", command];
+}
+function toolchainReadPaths(root) {
+    const executable = canonicalPath(process.execPath);
+    const pathEntries = (process.env.PATH ?? "").split(delimiter).filter(Boolean).map((path) => resolve(path));
+    const prefixes = ["/opt/homebrew", "/usr/local"].filter((prefix) => executable.startsWith(`${prefix}${sep}`) || pathEntries.some((path) => path.startsWith(`${prefix}${sep}`)));
+    const home = canonicalPath(homedir());
+    const managedHomeRuntime = [join(home, ".nvm", "versions", "node"), join(home, ".asdf", "installs", "node"), join(home, ".volta", "tools", "image", "node")].find((prefix) => executable.startsWith(`${prefix}${sep}`));
+    const runtimeRoot = prefixes.length ? [] : managedHomeRuntime ? [executable.slice(0, executable.indexOf(`${sep}bin${sep}`, managedHomeRuntime.length))] : [dirname(executable)];
+    return [...new Set([...prefixes, ...runtimeRoot])].filter((path) => path !== root && !path.startsWith(`${root}${sep}`));
+}
+export function sandboxWorkspacePaths(root, protectedPaths) {
+    if (!protectedPaths.some((path) => path === root || path.startsWith(`${root}${sep}`)))
+        return [root];
+    return [...new Set(readdirSync(root).flatMap((name) => { try {
+            return [canonicalPath(join(root, name))];
+        }
+        catch {
+            return [];
+        } }))]
+        .filter((candidate) => candidate !== root && candidate.startsWith(`${root}${sep}`))
+        .filter((candidate) => !protectedPaths.some((path) => path === candidate || path.startsWith(`${candidate}${sep}`) || candidate.startsWith(`${path}${sep}`)));
+}
+function canonicalPath(path) {
+    let current = resolve(path);
+    const suffix = [];
+    while (!existsSync(current)) {
+        const parent = dirname(current);
+        if (parent === current)
+            break;
+        suffix.unshift(current.slice(parent.length + 1));
+        current = parent;
+    }
+    return resolve(realpathSync(current), ...suffix);
+}
+function pathAncestors(path) {
+    const values = [];
+    let current = resolve(path);
+    while (true) {
+        values.unshift(current);
+        const parent = dirname(current);
+        if (parent === current)
+            return values;
+        current = parent;
+    }
+}
+function toolEnvironment(sandboxTemp = null) {
     const env = {};
     for (const name of ["PATH", "HOME", "TMPDIR", "TMP", "TEMP", "LANG", "LC_ALL", "SHELL", "TERM", "USER"])
         if (process.env[name] !== undefined)
             env[name] = process.env[name];
+    if (sandboxTemp) {
+        env.TMPDIR = sandboxTemp;
+        env.TMP = sandboxTemp;
+        env.TEMP = sandboxTemp;
+    }
+    if (process.platform === "darwin") {
+        const developer = ["/Library/Developer/CommandLineTools", "/Applications/Xcode.app/Contents/Developer"].find(existsSync);
+        if (developer)
+            env.DEVELOPER_DIR = developer;
+    }
+    Object.assign(env, gitIdentityEnvironment());
     return env;
 }
+function gitIdentityEnvironment() {
+    try {
+        const source = readFileSync(join(homedir(), ".gitconfig"), "utf8");
+        const user = source.match(/^\[user\]\s*\n((?:[ \t].*(?:\n|$))*)/m)?.[1] ?? "";
+        const name = user.match(/^\s*name\s*=\s*(.+)$/m)?.[1]?.trim();
+        const email = user.match(/^\s*email\s*=\s*(.+)$/m)?.[1]?.trim();
+        return { ...(name ? { GIT_AUTHOR_NAME: name, GIT_COMMITTER_NAME: name } : {}), ...(email ? { GIT_AUTHOR_EMAIL: email, GIT_COMMITTER_EMAIL: email } : {}), GIT_CONFIG_GLOBAL: "/dev/null" };
+    }
+    catch {
+        return { GIT_CONFIG_GLOBAL: "/dev/null" };
+    }
+}
 function estimateMessages(messages) { return Math.ceil(JSON.stringify(messages).length / 4); }
 function integerSetting(value, fallback) {
     if (value === undefined)
@@ -423,6 +572,8 @@ export function assistantResponseText(message) {
         .join("\n")
         .trim();
 }
+function sameHandoff(left, right) { return left.outcome === right.outcome && left.evidence.length === right.evidence.length && left.evidence.every((value, index) => value === right.evidence[index]); }
+function hasAgentToolCall(message, name) { return message.role === "assistant" && message.content.some((item) => item.type === "toolCall" && item.name === name); }
 if (process.argv[1] && resolve(process.argv[1]) === resolve(fileURLToPath(import.meta.url)))
     await runPiWorker();
 //# sourceMappingURL=pi-worker.js.map