@goah/cli 0.13.0 → 0.13.2

package/dist/chunk-7E7V6OIU.js

@@ -0,0 +1,920 @@
+import { createRequire as __goahCreateRequire } from "node:module";
+const require = __goahCreateRequire(import.meta.url);
+import {
+  JsonCredentialStore,
+  builtinModels,
+  createPiModel,
+  defaultAuthFile,
+  modelCatalog,
+  providerCatalog
+} from "./chunk-6M3OOCKO.js";
+import {
+  assertTurnOutput
+} from "./chunk-TJON22J4.js";
+
+// node_modules/goah-runner-pi/dist/env-spec.js
+import { readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var ENV_REFERENCE_PREFIX = "env:";
+var OPTIONAL_ENV_REFERENCE_PREFIX = "env?:";
+function parseEnvFile(text) {
+  const values = {};
+  for (const rawLine of text.split("\n")) {
+    const line = rawLine.trim();
+    if (line === "" || line.startsWith("#"))
+      continue;
+    const equals = line.indexOf("=");
+    if (equals <= 0)
+      continue;
+    const key = line.slice(0, equals).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key))
+      continue;
+    let value = line.slice(equals + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2 || value.startsWith("'") && value.endsWith("'") && value.length >= 2)
+      value = value.slice(1, -1);
+    values[key] = value;
+  }
+  return values;
+}
+function readEnvFile(path) {
+  try {
+    return parseEnvFile(readFileSync(path, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function envFileChain(source) {
+  if (!source)
+    return [];
+  const files = [join(source.root, ".env"), join(homedir(), ".goah", ".env")];
+  const merged = {};
+  for (let index = files.length - 1; index >= 0; index -= 1)
+    Object.assign(merged, readEnvFile(files[index]));
+  return [merged];
+}
+function resolveEnvSpec(spec, source) {
+  if (!spec)
+    return {};
+  const [fileLayer] = envFileChain(source);
+  const resolved = {};
+  for (const [key, value] of Object.entries(spec)) {
+    if (value.startsWith(OPTIONAL_ENV_REFERENCE_PREFIX)) {
+      const name2 = value.slice(OPTIONAL_ENV_REFERENCE_PREFIX.length);
+      const optional = process.env[name2] ?? fileLayer?.[name2];
+      if (optional !== void 0)
+        resolved[key] = optional;
+      continue;
+    }
+    if (!value.startsWith(ENV_REFERENCE_PREFIX)) {
+      resolved[key] = value;
+      continue;
+    }
+    const name = value.slice(ENV_REFERENCE_PREFIX.length);
+    const fromProcess = process.env[name];
+    if (fromProcess !== void 0) {
+      resolved[key] = fromProcess;
+      continue;
+    }
+    const fromFile = fileLayer?.[name];
+    if (fromFile !== void 0) {
+      resolved[key] = fromFile;
+      continue;
+    }
+    throw new Error(`environment variable is missing: ${name} (set it in your shell, <workspace>/.env, or ~/.goah/.env)`);
+  }
+  return resolved;
+}
+
+// node_modules/goah-runner-pi/dist/configurator.js
+import { dirname, join as join2 } from "node:path";
+import { tmpdir } from "node:os";
+import { mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+
+// node_modules/goah-runner-pi/dist/index.js
+import { spawn } from "node:child_process";
+import { createInterface } from "node:readline";
+import { fileURLToPath } from "node:url";
+var PiRunnerAdapter = class {
+  driver;
+  constructor(driver) {
+    this.driver = driver;
+  }
+  prepare(request) {
+    let started = false;
+    let resolveResult;
+    const result = new Promise((resolve) => {
+      resolveResult = resolve;
+    });
+    return {
+      pid: null,
+      begin: () => {
+        if (started)
+          return;
+        started = true;
+        void this.#run(request).then(resolveResult, (error) => resolveResult({ outcome: "abnormal", reason: error instanceof Error ? error.message : String(error) }));
+      },
+      result,
+      terminate: async () => void 0
+    };
+  }
+  async terminateProcess(pid) {
+    await terminatePid(pid, 500);
+  }
+  async #run(request) {
+    const runnerSession = await this.driver.createRunnerSession(request);
+    try {
+      while (true) {
+        const step = await runnerSession.step();
+        for (const trace of step.trace ?? [])
+          request.emit(trace);
+        if (step.response)
+          return { outcome: "completed", response: step.response };
+        if (step.handoff) {
+          const validation = await request.rpc?.("goal.handoff.validate", { handoff: step.handoff.handoff, candidateMessage: step.handoff.response.content });
+          if (!validation)
+            return { outcome: "abnormal", reason: "Handoff validation is unavailable" };
+          request.emit({ type: "message.assistant.completed", data: { message: { id: `adapter:${request.execution.id}:handoff:${validation.attemptId}`, role: "assistant", content: [{ type: "text", text: step.handoff.response.content }], stopReason: "toolUse" }, commitState: "provisional" } });
+          if (!validation.accepted) {
+            if (validation.fatal)
+              return { outcome: "abnormal", reason: validation.issues.map((issue) => issue.message).join("; ") };
+            await runnerSession.feedback(validation);
+            request.emit({ type: "runner.handoff_rejected", data: { attemptId: validation.attemptId, issues: validation.issues } });
+            continue;
+          }
+          const output = { validationAttemptId: validation.attemptId, validationToken: validation.token, handoff: step.handoff.handoff };
+          assertTurnOutput(output);
+          return { outcome: "completed", response: step.handoff.response, handoff: output };
+        }
+        if (step.stopped)
+          return { outcome: "abnormal", reason: request.turn.goalCommitment ? "runner stopped without a readable response and valid handoff" : "runner stopped without a response" };
+      }
+    } catch (error) {
+      return { outcome: "abnormal", reason: error instanceof Error ? error.message : String(error) };
+    } finally {
+      await runnerSession.close();
+    }
+  }
+};
+function piWorkerPath() {
+  return fileURLToPath(new URL("./pi-worker.js", import.meta.url));
+}
+function verificationWorkerPath() {
+  return fileURLToPath(new URL("./verification-worker.js", import.meta.url));
+}
+var ProcessRunner = class {
+  options;
+  isolation = "process";
+  constructor(options) {
+    this.options = options;
+  }
+  prepare(request) {
+    const explicit = this.options.envSpec ? resolveEnvSpec(this.options.envSpec, { root: this.options.cwd ?? process.cwd() }) : this.options.env;
+    const child = spawn(this.options.command, this.options.args ?? [], {
+      detached: process.platform !== "win32",
+      ...this.options.cwd ? { cwd: this.options.cwd } : {},
+      env: childEnvironment(explicit, this.options.inheritEnv)
+    });
+    let started = false;
+    let timedOut = false;
+    let messageResult = null;
+    let protocolError = null;
+    let stderr = "";
+    let timer;
+    let settled = false;
+    let resolveStartReady;
+    const startReady = new Promise((resolve) => {
+      resolveStartReady = resolve;
+    });
+    let resolveResult;
+    const pendingSteering = /* @__PURE__ */ new Map();
+    const result = new Promise((resolve) => {
+      resolveResult = resolve;
+    });
+    const settle = (value) => {
+      if (!settled) {
+        settled = true;
+        resolveResult(value);
+      }
+    };
+    child.stderr?.on("data", (chunk) => {
+      stderr = `${stderr}${chunk.toString()}`.slice(-65536);
+    });
+    let protocolLineBytes = 0;
+    child.stdout?.on("data", (chunk) => {
+      for (const byte of chunk) {
+        if (byte === 10)
+          protocolLineBytes = 0;
+        else if (++protocolLineBytes > 1e6 && !protocolError) {
+          protocolError = "runner protocol line exceeded 1 MB";
+          void terminate();
+          break;
+        }
+      }
+    });
+    const lines = createInterface({ input: child.stdout });
+    lines.on("line", (line) => {
+      if (protocolError)
+        return;
+      try {
+        const message = JSON.parse(line);
+        if (message.type === "trace")
+          request.emit(message.event);
+        else if (message.type === "steer_ack") {
+          const pending = pendingSteering.get(message.id);
+          if (pending) {
+            pendingSteering.delete(message.id);
+            clearTimeout(pending.timer);
+            if (message.accepted)
+              pending.resolve();
+            else
+              pending.reject(new Error("runner is no longer accepting steering messages"));
+          }
+        } else if (message.type === "rpc_request") {
+          void Promise.resolve(request.rpc?.(message.method, message.params) ?? Promise.reject(new Error("runner RPC is unavailable"))).then((result2) => child.stdin?.write(`${JSON.stringify({ type: "rpc_response", id: message.id, result: result2 })}
+`)).catch((error) => child.stdin?.write(`${JSON.stringify({ type: "rpc_response", id: message.id, error: error instanceof Error ? error.message : String(error) })}
+`));
+        } else
+          messageResult = message.result;
+      } catch (error) {
+        protocolError = error instanceof Error ? error.message : String(error);
+        void terminate();
+      }
+    });
+    child.once("error", (error) => {
+      resolveStartReady();
+      if (timer)
+        clearTimeout(timer);
+      settle({ outcome: "abnormal", reason: error.message });
+    });
+    child.once("close", (code, signal) => {
+      resolveStartReady();
+      for (const pending of pendingSteering.values()) {
+        clearTimeout(pending.timer);
+        pending.reject(new Error("runner closed before acknowledging the steering message"));
+      }
+      pendingSteering.clear();
+      if (timer)
+        clearTimeout(timer);
+      if (protocolError)
+        settle({ outcome: "abnormal", reason: `runner protocol error: ${protocolError}` });
+      else if (messageResult)
+        settle(messageResult);
+      else if (timedOut)
+        settle({ outcome: "abnormal", reason: "runner-specific timeout exceeded and process was killed" });
+      else
+        settle({ outcome: "abnormal", reason: stderr.trim() || `runner exited without a result (${code ?? signal ?? "unknown"})` });
+    });
+    const terminate = async () => {
+      if (child.pid)
+        await terminateOwnedChild(child, this.options.killGraceMs ?? 500);
+    };
+    return {
+      pid: child.pid ?? null,
+      begin: () => {
+        if (started)
+          return;
+        started = true;
+        void (async () => {
+          try {
+            const runtime = await this.options.prepareRuntime?.(request);
+            const serializable = { agent: request.agent, execution: request.execution, ...request.sourceWake ? { sourceWake: request.sourceWake } : {}, ...request.sourceWakeTriggers ? { sourceWakeTriggers: request.sourceWakeTriggers } : {}, turn: request.turn, context: request.context, ...runtime !== void 0 ? { runtime } : {} };
+            child.stdin?.write(`${JSON.stringify({ type: "start", request: serializable })}
+`);
+            resolveStartReady();
+            if (this.options.timeoutMs)
+              timer = setTimeout(() => {
+                timedOut = true;
+                void terminate();
+              }, this.options.timeoutMs);
+          } catch (error) {
+            protocolError = error instanceof Error ? error.message : String(error);
+            resolveStartReady();
+            await terminate();
+          }
+        })();
+      },
+      result,
+      ...this.options.steering ? { steer: async (message) => {
+        if (!started)
+          throw new Error("runner is not accepting steering messages");
+        await startReady;
+        if (settled || protocolError || !child.stdin?.writable)
+          throw new Error("runner is not accepting steering messages");
+        const id = crypto.randomUUID();
+        await new Promise((resolve, reject) => {
+          const timer2 = setTimeout(() => {
+            pendingSteering.delete(id);
+            reject(new Error("runner did not acknowledge the steering message in time"));
+          }, this.options.steerAckTimeoutMs ?? 2e3);
+          timer2.unref();
+          pendingSteering.set(id, { resolve, reject, timer: timer2 });
+          child.stdin.write(`${JSON.stringify({ type: "steer", id, message })}
+`, (error) => {
+            if (error) {
+              const pending = pendingSteering.get(id);
+              if (pending)
+                clearTimeout(pending.timer);
+              pendingSteering.delete(id);
+              reject(error);
+            }
+          });
+        });
+      } } : {},
+      terminate
+    };
+  }
+  async terminateProcess(pid) {
+    await terminatePid(pid, this.options.killGraceMs ?? 500);
+  }
+};
+async function runProcessWorker(run) {
+  const parent = process.ppid;
+  const monitor = setInterval(() => {
+    if (process.ppid !== parent || !isAlive(parent))
+      process.exit(70);
+  }, 250);
+  monitor.unref();
+  const input = createInterface({ input: process.stdin });
+  const iterator = input[Symbol.asyncIterator]();
+  const first = await iterator.next();
+  if (first.done)
+    throw new Error("runner parent closed before start");
+  const start = JSON.parse(first.value);
+  if (start.type !== "start")
+    throw new Error("first runner message must be start");
+  const pending = /* @__PURE__ */ new Map();
+  const queuedSteering = [];
+  let steerListener;
+  const deliverSteer = (id, message) => {
+    let accepted = false;
+    try {
+      accepted = steerListener?.(message) === true;
+    } catch {
+    }
+    process.stdout.write(`${JSON.stringify({ type: "steer_ack", id, accepted })}
+`);
+  };
+  void (async () => {
+    for await (const line of { [Symbol.asyncIterator]: () => iterator }) {
+      const message = JSON.parse(line);
+      if (message.type === "steer") {
+        if (steerListener)
+          deliverSteer(message.id, message.message);
+        else
+          queuedSteering.push(message);
+        continue;
+      }
+      if (message.type !== "rpc_response")
+        continue;
+      const waiter = pending.get(message.id);
+      if (!waiter)
+        continue;
+      pending.delete(message.id);
+      if (message.error)
+        waiter.reject(new Error(message.error));
+      else
+        waiter.resolve(message.result ?? null);
+    }
+  })();
+  const rpc = (method, params) => new Promise((resolve, reject) => {
+    const id = crypto.randomUUID();
+    pending.set(id, { resolve, reject });
+    process.stdout.write(`${JSON.stringify({ type: "rpc_request", id, method, params })}
+`);
+  });
+  const controls = { onSteer: (listener) => {
+    steerListener = listener;
+    for (const message of queuedSteering.splice(0))
+      deliverSteer(message.id, message.message);
+  } };
+  const result = await run(start.request, (event) => process.stdout.write(`${JSON.stringify({ type: "trace", event })}
+`), rpc, controls);
+  process.stdout.write(`${JSON.stringify({ type: "result", result })}
+`);
+  input.close();
+  process.stdin.unref();
+  clearInterval(monitor);
+}
+async function terminateOwnedChild(child, graceMs) {
+  if (!child.pid || child.exitCode !== null || child.signalCode !== null)
+    return;
+  signalPid(child.pid, "SIGTERM");
+  await Promise.race([new Promise((resolve) => child.once("close", () => resolve())), delay(graceMs)]);
+  if (child.exitCode === null && child.signalCode === null) {
+    signalPid(child.pid, "SIGKILL");
+    await new Promise((resolve) => child.once("close", () => resolve()));
+  }
+}
+async function terminatePid(pid, graceMs) {
+  if (!isAlive(pid))
+    return;
+  signalPid(pid, "SIGTERM");
+  const deadline = Date.now() + graceMs;
+  while (isAlive(pid) && Date.now() < deadline)
+    await delay(25);
+  if (isAlive(pid))
+    signalPid(pid, "SIGKILL");
+  const killDeadline = Date.now() + graceMs;
+  while (isAlive(pid) && Date.now() < killDeadline)
+    await delay(25);
+  if (isAlive(pid))
+    throw new Error(`runner process ${pid} did not exit after SIGKILL`);
+}
+function signalPid(pid, signal) {
+  try {
+    process.kill(process.platform === "win32" ? pid : -pid, signal);
+  } catch {
+  }
+}
+function isAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function delay(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function childEnvironment(explicit = {}, inherited = []) {
+  const names = /* @__PURE__ */ new Set(["PATH", "TMPDIR", "TMP", "TEMP", "SYSTEMROOT", ...inherited]);
+  const env = {};
+  for (const name of names)
+    if (process.env[name] !== void 0)
+      env[name] = process.env[name];
+  return { ...env, ...explicit };
+}
+
+// node_modules/goah-runner-pi/dist/configurator.js
+function piRunnerConfigurator() {
+  return {
+    describe: () => ({ id: "pi", name: "Pi", description: "Direct multi-provider model runner", commands: [{ name: "model", description: "List or switch provider/model" }, { name: "auth", description: "Inspect, login, or logout provider credentials" }] }),
+    beginSetup: beginPiSetup,
+    setup: setupPi,
+    doctor: doctorPi,
+    summarize: summarizePi,
+    runCommand: runPiCommand
+  };
+}
+async function beginPiSetup(current, interaction) {
+  const before = current ? piConfig(current) : null;
+  const authFile = before?.authFile ?? defaultAuthFile();
+  const baseline = await readFile(authFile).catch((error) => error.code === "ENOENT" ? null : Promise.reject(error));
+  const stagingDirectory = await mkdtemp(join2(tmpdir(), "goah-auth-stage-"));
+  const stagingAuthFile = join2(stagingDirectory, "auth.json");
+  if (baseline)
+    await writeFile(stagingAuthFile, baseline, { mode: 384 });
+  let config;
+  try {
+    config = await setupPi(current, interaction, "full", stagingAuthFile);
+  } catch (error) {
+    await rm(stagingDirectory, { recursive: true, force: true });
+    throw error;
+  }
+  let state = "open";
+  let committed = null;
+  return {
+    config,
+    commit: async () => {
+      if (state === "committed")
+        return config && typeof config === "object" && !Array.isArray(config) ? { ...config, authFile } : config;
+      if (state === "rolled_back")
+        throw new Error("Runner setup transaction was already rolled back");
+      const staged = await readFile(stagingAuthFile).catch((error) => error.code === "ENOENT" ? null : Promise.reject(error));
+      try {
+        await new JsonCredentialStore(authFile).replaceFileIfUnchanged(baseline, staged);
+        committed = staged;
+        state = "committed";
+      } catch (error) {
+        state = "rolled_back";
+        await rm(stagingDirectory, { recursive: true, force: true });
+        throw error;
+      }
+      await rm(stagingDirectory, { recursive: true, force: true });
+      return config && typeof config === "object" && !Array.isArray(config) ? { ...config, authFile } : config;
+    },
+    rollback: async () => {
+      if (state === "rolled_back")
+        return;
+      if (state === "committed")
+        await new JsonCredentialStore(authFile).replaceFileIfUnchanged(committed, baseline);
+      state = "rolled_back";
+      await rm(stagingDirectory, { recursive: true, force: true });
+    }
+  };
+}
+function createPiProcessRunner(configValue, root) {
+  const config = piConfig(configValue);
+  createPiModel(config.provider, config.model, piEnvironment(config));
+  const privateEnv = piEnvironment(config);
+  return new ProcessRunner({
+    command: process.execPath,
+    args: [piWorkerPath()],
+    cwd: root,
+    steering: true,
+    envSpec: workerEnvironment(config),
+    prepareRuntime: async () => {
+      const resolved = resolveEnvSpec(privateEnv, { root });
+      const configured = createPiModel(config.provider, config.model, resolved);
+      const auth = await configured.models.getAuth(config.provider);
+      if (!auth && config.provider !== "faux" && !["ollama", "lm-studio", "llama.cpp"].includes(config.provider))
+        throw new Error(`No credentials for ${config.provider}. Run \`goah auth login ${config.provider}\` or configure ${config.apiKeyEnv ?? defaultApiKeyEnv(config.provider)}.`);
+      const authFile = config.authFile ?? defaultAuthFile();
+      return { ...auth?.auth ?? {}, protectedPaths: [.../* @__PURE__ */ new Set([dirname(defaultAuthFile()), dirname(authFile)])] };
+    }
+  });
+}
+async function setupPi(current, interaction, scope = "full", setupAuthFile = defaultAuthFile()) {
+  const legacyCredential = Boolean(current && typeof current === "object" && !Array.isArray(current) && typeof current.apiKeyEnv === "string" && !isShellIdentifier(current.apiKeyEnv));
+  const before = current ? piConfig(current) : null;
+  const providers = [...providerCatalog(), { id: "custom", name: "Custom endpoint", modelCount: 0, oauth: false, apiKey: true, local: false }, { id: "faux", name: "Offline demo", modelCount: 1, oauth: false, apiKey: false, local: true }];
+  const provider = await interaction.select({ title: "Choose a provider", description: "Search by company, provider ID, or capability.", progress: { current: 2, total: 5 }, choices: providers.map((entry) => ({ value: entry.id, label: entry.name, description: `${entry.id}${entry.oauth ? " \xB7 OAuth" : ""}${entry.local ? " \xB7 local" : ` \xB7 ${entry.modelCount} models`}` })) });
+  if (!provider)
+    return null;
+  const providerId = provider === "custom" ? await interaction.input({ title: "Custom provider", description: "A stable ID used only inside this Runner Profile.", prompt: "Provider ID", initial: before?.provider ?? "custom", progress: { current: 2, total: 5 } }) : provider;
+  if (!providerId)
+    return null;
+  const catalog = ["ollama", "lm-studio", "llama.cpp"].includes(providerId) ? await discoverLocalModels(providerId) : modelCatalog(providerId);
+  const selected = catalog.length ? await interaction.select({ title: "Choose a model", description: `${providerId} \xB7 search by model name or ID.`, progress: { current: 3, total: 5 }, choices: [...catalog.map((model2) => ({ value: model2.id, label: model2.name, description: `${model2.id} \xB7 ${Math.round(model2.contextWindow / 1e3)}k${model2.reasoning ? " \xB7 reasoning" : ""}` })), { value: "__custom__", label: "Custom model\u2026" }, { value: "__back__", label: "Back to providers" }] }) : "__custom__";
+  if (!selected)
+    return null;
+  if (selected === "__back__")
+    return setupPi(current, interaction, scope, setupAuthFile);
+  const model = selected === "__custom__" ? await interaction.input({ title: "Model ID", description: `Enter the model identifier accepted by ${providerId}.`, prompt: "Model", progress: { current: 3, total: 5 }, ...before?.provider === providerId ? { initial: before.model } : {} }) : selected;
+  if (!model)
+    return null;
+  const config = scope === "model" && before?.provider === providerId ? { ...before, model, authFile: before.authFile ?? setupAuthFile } : { provider: providerId, model, thinking: before?.thinking ?? (providerId === "faux" ? "off" : "medium"), authFile: scope === "full" ? setupAuthFile : before?.authFile ?? setupAuthFile, authMode: providerId === "faux" || ["ollama", "lm-studio", "llama.cpp"].includes(providerId) ? "local" : "unconfigured" };
+  const descriptor = providers.find((entry) => entry.id === provider);
+  if (!descriptor.local && provider !== "faux") {
+    if (scope === "model") {
+      const authenticated = await requireAuthentication(config, descriptor, interaction, legacyCredential);
+      if (authenticated === "back")
+        return setupPi(current, interaction, scope, setupAuthFile);
+      Object.assign(config, authenticated);
+    } else {
+      const auth = await configureAuthentication(providerId, descriptor, config.authFile, interaction, legacyCredential);
+      if (auth === "back")
+        return setupPi(current, interaction, scope, setupAuthFile);
+      Object.assign(config, auth);
+    }
+  }
+  if (["ollama", "lm-studio", "llama.cpp"].includes(provider)) {
+    const baseUrl = await interaction.input({ title: "Local endpoint", prompt: "OpenAI-compatible base URL", initial: localBaseUrl(provider), progress: { current: 4, total: 5 } });
+    if (baseUrl)
+      config.baseUrl = baseUrl;
+    config.contextWindowTokens = positive(await interaction.input({ title: "Context window", prompt: "Tokens", initial: "128000", progress: { current: 4, total: 5 } }), 128e3);
+    config.maxOutputTokens = positive(await interaction.input({ title: "Max output", prompt: "Tokens", initial: "16384", progress: { current: 4, total: 5 } }), 16384);
+  }
+  if (provider === "custom") {
+    const baseUrl = await interaction.input({ title: "Custom endpoint", prompt: "Base URL", progress: { current: 4, total: 5 } });
+    if (!baseUrl)
+      return null;
+    config.baseUrl = baseUrl;
+    const api = await interaction.select({ title: "Wire API", progress: { current: 4, total: 5 }, choices: [{ value: "openai-completions", label: "OpenAI Chat Completions" }, { value: "openai-responses", label: "OpenAI Responses" }, { value: "anthropic-messages", label: "Anthropic Messages" }] });
+    if (!api)
+      return null;
+    config.api = api;
+    config.contextWindowTokens = positive(await interaction.input({ title: "Context window", prompt: "Tokens", initial: "128000", progress: { current: 4, total: 5 } }), 128e3);
+    config.maxOutputTokens = positive(await interaction.input({ title: "Max output", prompt: "Tokens", initial: "16384", progress: { current: 4, total: 5 } }), 16384);
+  }
+  return config;
+}
+async function configureAuthentication(provider, descriptor, authFile, interaction, legacyCredential, allowLater = true, allowEnvironment = true) {
+  const store = new JsonCredentialStore(authFile);
+  const existing = await store.read(provider);
+  const choices = [
+    ...existing ? [{ value: "existing", label: "Use saved credentials", description: existing.type === "oauth" ? "OAuth session" : "Stored API key" }] : [],
+    ...descriptor.oauth ? [{ value: "oauth", label: "Sign in with OAuth", description: "Opens the provider login flow" }] : [],
+    ...descriptor.apiKey ? [{ value: "key", label: "Paste an API key", description: "Stored privately and masked while typing" }] : [],
+    ...allowEnvironment ? [{ value: "env", label: "Use an environment variable", description: `Default: ${defaultApiKeyEnv(provider)}` }] : [],
+    ...allowLater ? [{ value: "later", label: "Configure later", description: "Save now; runs will remain blocked" }] : [],
+    { value: "back", label: "Back to providers" }
+  ];
+  const description = legacyCredential ? "A pasted key was found in the old environment-variable field. It will be removed from config; rotate that key, then authenticate again here." : "Choose how this runner should authenticate. Secrets never enter goah.config.json.";
+  const choice = await interaction.select({ title: "Authentication", description, progress: { current: 4, total: 5 }, choices });
+  if (!choice || choice === "back")
+    return "back";
+  if (choice === "existing")
+    return { authMode: existing?.type === "oauth" ? "oauth" : "stored-key" };
+  if (choice === "oauth") {
+    await oauthLogin(provider, authFile, interaction);
+    return { authMode: "oauth" };
+  }
+  if (choice === "key") {
+    const key = await interaction.input({ title: "API key", description: "The value is masked and saved only in the Runner credential store.", prompt: "Paste key", secret: true, progress: { current: 4, total: 5 } });
+    if (!key)
+      return "back";
+    await store.modify(provider, async () => ({ type: "api_key", key }));
+    return { authMode: "stored-key" };
+  }
+  if (choice === "env") {
+    const name = await interaction.input({ title: "Environment variable", description: "Enter a variable name, not the key itself.", prompt: "Variable", initial: defaultApiKeyEnv(provider), progress: { current: 4, total: 5 } });
+    if (!name)
+      return "back";
+    if (!isShellIdentifier(name))
+      throw new Error("Environment variable names use letters, numbers, and underscores, and cannot contain an API key. Choose \u201CPaste an API key\u201D for a secret value.");
+    return { authMode: "environment", apiKeyEnv: name };
+  }
+  return { authMode: "unconfigured" };
+}
+async function requireAuthentication(config, descriptor, interaction, legacyCredential = false) {
+  if (descriptor.local || config.provider === "faux" || ["ollama", "lm-studio", "llama.cpp"].includes(config.provider)) {
+    const local = { ...config, authMode: "local" };
+    delete local.apiKeyEnv;
+    return local;
+  }
+  const authFile = config.authFile ?? defaultAuthFile();
+  const stored = await new JsonCredentialStore(authFile).read(config.provider);
+  if (stored) {
+    const saved = { ...config, authFile, authMode: stored.type === "oauth" ? "oauth" : "stored-key" };
+    delete saved.apiKeyEnv;
+    return saved;
+  }
+  if (environmentAuthenticationAvailable(config))
+    return { ...config, authFile, authMode: "environment", apiKeyEnv: config.apiKeyEnv ?? defaultApiKeyEnv(config.provider) };
+  const auth = await configureAuthentication(config.provider, descriptor, authFile, interaction, legacyCredential, false, true);
+  if (auth === "back")
+    return "back";
+  const next = { ...config, ...auth, authFile };
+  if (auth.authMode !== "environment")
+    delete next.apiKeyEnv;
+  if (next.authMode === "environment" && !environmentAuthenticationAvailable(next))
+    throw new Error(`Environment variable ${next.apiKeyEnv ?? defaultApiKeyEnv(next.provider)} is not set. Set it first or choose \u201CPaste an API key\u201D.`);
+  return next;
+}
+function environmentAuthenticationAvailable(config) {
+  const key = config.api ? "GOAH_PI_API_KEY" : defaultApiKeyEnv(config.provider);
+  try {
+    return Boolean(resolveEnvSpec(piEnvironment(config), { root: process.cwd() })[key]);
+  } catch {
+    return false;
+  }
+}
+async function doctorPi(value, context) {
+  const config = piConfig(value);
+  const env = resolveEnvSpec(piEnvironment(config), { root: context?.root ?? process.cwd() });
+  const configured = createPiModel(config.provider, config.model, env);
+  const auth = config.provider === "faux" || ["ollama", "lm-studio", "llama.cpp"].includes(config.provider) ? { source: "local" } : await configured.models.getAuth(config.provider);
+  const sandbox = bashSandboxCapability();
+  const sandboxSmoke = sandbox.available ? await (await import("./pi-worker.js")).runBashCommand(context?.root ?? process.cwd(), { command: "node --version && npm --version && git --version", timeoutMs: 15e3 }, void 0, [dirname(defaultAuthFile())]) : null;
+  const sandboxReady = sandbox.available && sandboxSmoke?.isError !== true;
+  return [
+    { ok: true, name: "model", detail: `${config.provider}/${config.model} \xB7 context ${configured.model.contextWindow} \xB7 output ${configured.model.maxTokens}` },
+    { ok: Boolean(auth), name: "auth", detail: auth?.source ?? `No credentials for ${config.provider}; use runner auth login or configure ${config.apiKeyEnv ?? defaultApiKeyEnv(config.provider)}` },
+    { ok: sandboxReady, name: "bash-sandbox", detail: sandboxReady ? `${sandbox.detail} \xB7 node/npm/git ready` : sandboxSmoke?.content[0]?.text.trim() || sandbox.detail }
+  ];
+}
+function summarizePi(value) {
+  const config = piConfig(value);
+  const auth = config.authMode === "environment" ? `Environment \xB7 ${config.apiKeyEnv ?? defaultApiKeyEnv(config.provider)}` : config.authMode === "local" ? "Local \xB7 no credentials" : "Managed separately \xB7 use auth status";
+  return [
+    { label: "Runner", value: "Pi" },
+    { label: "Provider", value: config.provider },
+    { label: "Model", value: config.model },
+    { label: "Thinking", value: config.thinking ?? "off" },
+    { label: "Authentication", value: auth },
+    { label: "Bash sandbox", value: bashSandboxDescription() },
+    ...config.baseUrl ? [{ label: "Endpoint", value: config.baseUrl }] : []
+  ];
+}
+function bashSandboxDescription() {
+  return bashSandboxCapability().detail;
+}
+function bashSandboxCapability() {
+  if (process.platform === "darwin")
+    return existsSync("/usr/bin/sandbox-exec") ? { available: true, detail: "sandbox-exec" } : { available: false, detail: "unavailable \u2014 Bash fails closed" };
+  if (process.platform === "linux")
+    return ["/usr/bin/bwrap", "/bin/bwrap"].some(existsSync) ? { available: true, detail: "bubblewrap" } : { available: false, detail: "unavailable \u2014 install bubblewrap; Bash fails closed" };
+  return { available: false, detail: "unavailable on this platform \u2014 Bash fails closed" };
+}
+async function runPiCommand(command, args, value, interaction) {
+  const config = piConfig(value);
+  if (command === "model") {
+    if (!args.length) {
+      const selected = await setupPi(value, interaction, "model", config.authFile ?? defaultAuthFile());
+      return selected === null ? { output: ["No change."] } : { config: selected, output: [`Pi target changed to ${piConfig(selected).provider}/${piConfig(selected).model}`] };
+    }
+    if (args[0] === "list") {
+      const provider2 = args[1] ?? config.provider;
+      if (provider2 === "faux")
+        return { output: [`faux/${config.provider === "faux" ? config.model : "faux-goah"}`] };
+      if (provider2 === config.provider && config.baseUrl && !providerCatalog().some((entry) => entry.id === provider2))
+        return { output: [`${provider2}/${config.model}`] };
+      const models = ["ollama", "lm-studio", "llama.cpp"].includes(provider2) ? await discoverLocalModels(provider2) : modelCatalog(provider2);
+      return { output: models.map((model2) => `${provider2}/${model2.id}`) };
+    }
+    const explicitProvider = args[0] === "use";
+    const target = explicitProvider ? args[1] : args[0];
+    if (!target)
+      throw new Error("usage: goah model use PROVIDER/MODEL");
+    const slash = target.indexOf("/");
+    if (explicitProvider && slash <= 0)
+      throw new Error("usage: goah model use PROVIDER/MODEL");
+    const provider = explicitProvider ? target.slice(0, slash) : slash > 0 && providerCatalog().some((entry) => entry.id === target.slice(0, slash)) ? target.slice(0, slash) : config.provider;
+    const model = explicitProvider || provider !== config.provider || slash >= 0 ? target.slice(slash + 1) : target;
+    const knownProvider = provider === "faux" || providerCatalog().some((entry) => entry.id === provider);
+    if (provider !== config.provider && !knownProvider)
+      throw new Error(`Unknown provider: ${provider}. Use \`goah model\` to configure a custom endpoint.`);
+    const existing = provider === config.provider || provider === "faux" || ["ollama", "lm-studio", "llama.cpp"].includes(provider) ? void 0 : await new JsonCredentialStore(config.authFile ?? defaultAuthFile()).read(provider);
+    const next = provider === config.provider ? { ...config, model } : { provider, model, thinking: config.thinking ?? (provider === "faux" ? "off" : "medium"), authFile: config.authFile ?? defaultAuthFile(), authMode: provider === "faux" || ["ollama", "lm-studio", "llama.cpp"].includes(provider) ? "local" : existing?.type === "oauth" ? "oauth" : existing ? "stored-key" : "unconfigured" };
+    createPiModel(provider, model, piEnvironment(next));
+    const descriptor = providerCatalog().find((entry) => entry.id === provider) ?? { id: provider, name: provider, oauth: false, apiKey: true, local: false, modelCount: 0 };
+    const authenticated = await requireAuthentication(next, descriptor, interaction);
+    if (authenticated === "back")
+      return { output: ["No change."] };
+    return { config: authenticated, output: [`Pi target changed to ${provider}/${model}`] };
+  }
+  if (command === "auth") {
+    const authFile = config.authFile ?? defaultAuthFile();
+    const store = new JsonCredentialStore(authFile);
+    const catalog = providerCatalog();
+    if (!catalog.some((entry) => entry.id === config.provider))
+      catalog.unshift({ id: config.provider, name: config.provider === "faux" ? "Offline demo" : config.provider, oauth: false, apiKey: config.provider !== "faux", local: config.provider === "faux", modelCount: config.provider === "faux" ? 1 : 0 });
+    const storedProviders = await store.list();
+    for (const stored of storedProviders)
+      if (!catalog.some((entry) => entry.id === stored.providerId))
+        catalog.push({ id: stored.providerId, name: stored.providerId, oauth: stored.type === "oauth", apiKey: stored.type === "api_key", local: false, modelCount: 0 });
+    let action = args[0];
+    if (!action)
+      action = await interaction.select({ title: "Authentication", description: "Credentials are stored by the Pi Runner, outside workspace config.", choices: [{ value: "login", label: "Add or sign in", description: "OAuth, API key, or environment variable" }, { value: "logout", label: "Sign out or remove", description: "Remove stored credentials" }, { value: "status", label: "View status", description: "Inspect configured providers" }] }) ?? "cancel";
+    if (action === "cancel")
+      return { output: ["No change."] };
+    if (action === "add")
+      action = "login";
+    if (action === "remove")
+      action = "logout";
+    let provider = args[1];
+    if (!provider && (action === "login" || action === "logout")) {
+      const saved = new Set(storedProviders.map((item) => item.providerId));
+      const choices = catalog.filter((entry) => action === "login" ? !entry.local : saved.has(entry.id)).map((entry) => ({ value: entry.id, label: entry.name, description: `${entry.id}${saved.has(entry.id) ? " \xB7 signed in" : entry.oauth ? " \xB7 OAuth available" : " \xB7 API key"}` }));
+      if (!choices.length)
+        return { output: ["No stored credentials."] };
+      provider = await interaction.select({ title: action === "login" ? "Sign in to a provider" : "Sign out of a provider", choices }) ?? void 0;
+      if (!provider)
+        return { output: ["No change."] };
+    }
+    provider ??= config.provider;
+    const descriptor = catalog.find((item) => item.id === provider);
+    if (!descriptor)
+      throw new Error(`Unknown provider: ${provider}`);
+    if (action === "status" || action === "list") {
+      const saved = new Set(storedProviders.map((item) => item.providerId));
+      const rows = catalog.filter((item) => action === "list" || item.id === provider).map((item) => `${saved.has(item.id) || item.id === config.provider && config.authMode === "environment" ? "\u2713" : "\xB7"} ${item.id}${item.id === config.provider && config.authMode === "environment" ? ` \xB7 env:${config.apiKeyEnv ?? defaultApiKeyEnv(item.id)}` : item.oauth ? " \xB7 OAuth available" : ""}`);
+      return { output: rows.length ? rows : ["No configured credentials."] };
+    }
+    if (action === "login") {
+      if (descriptor.local)
+        return { output: [`${provider} is local and does not require authentication.`] };
+      const auth = await stagedProviderMutation(authFile, provider, (staged) => configureAuthentication(provider, descriptor, staged, interaction, false, false, provider === config.provider));
+      if (auth === "back")
+        return { output: ["No change."] };
+      return { ...provider === config.provider ? { config: { ...config, ...auth, ...auth.authMode === "environment" ? {} : { apiKeyEnv: void 0 } } } : {}, output: [`Authentication configured for ${provider}`] };
+    }
+    if (action === "logout") {
+      if (descriptor.local)
+        return { output: [`${provider} is local and does not use stored credentials.`] };
+      const storedCredential = await store.read(provider);
+      if (!storedCredential && provider === config.provider && config.authMode === "environment")
+        return { output: [`${provider} uses ${config.apiKeyEnv ?? defaultApiKeyEnv(provider)} from your environment; unset it in your shell to sign out.`] };
+      await stagedProviderMutation(authFile, provider, async (staged) => {
+        await new JsonCredentialStore(staged).delete(provider);
+      });
+      return { ...provider === config.provider && config.authMode !== "environment" ? { config: { ...config, authMode: "unconfigured", apiKeyEnv: void 0 } } : {}, output: [`Removed stored credentials for ${provider}. Environment variables, if set, remain available to the provider.`] };
+    }
+    throw new Error(`Unknown Pi auth command: ${action}`);
+  }
+  throw new Error(`Unknown Pi runner command: ${command}`);
+}
+async function stagedProviderMutation(path, provider, operation) {
+  const real = new JsonCredentialStore(path);
+  const before = await real.read(provider);
+  const directory = await mkdtemp(join2(tmpdir(), "goah-auth-command-"));
+  const stagedPath = join2(directory, "auth.json");
+  const raw = await readFile(path).catch((error) => error.code === "ENOENT" ? null : Promise.reject(error));
+  if (raw)
+    await writeFile(stagedPath, raw, { mode: 384 });
+  try {
+    const value = await operation(stagedPath);
+    const after = await new JsonCredentialStore(stagedPath).read(provider);
+    if (JSON.stringify(before) !== JSON.stringify(after))
+      await real.replaceProviderIfUnchanged(provider, before, after);
+    return value;
+  } finally {
+    await rm(directory, { recursive: true, force: true });
+  }
+}
+async function oauthLogin(providerId, authFile, interaction) {
+  const models = builtinModels({ credentials: new JsonCredentialStore(authFile) });
+  const provider = models.getProvider(providerId);
+  if (!provider?.auth.oauth)
+    throw new Error(`${providerId} does not provide OAuth login.`);
+  await models.login(providerId, "oauth", {
+    prompt: (prompt) => authPrompt(prompt, interaction),
+    notify: (event) => authEvent(event, interaction)
+  });
+}
+async function authPrompt(prompt, interaction) {
+  if (prompt.type === "select") {
+    const answer2 = await interaction.select({ title: "Authentication", description: prompt.message, choices: prompt.options.map((option) => ({ value: option.id, label: option.label, ...option.description ? { description: option.description } : {} })) });
+    if (!answer2)
+      throw new Error("Authentication cancelled.");
+    return answer2;
+  }
+  const answer = await interaction.input({ title: "Authentication", prompt: prompt.message, ...prompt.placeholder ? { initial: prompt.placeholder } : {} });
+  if (answer === null)
+    throw new Error("Authentication cancelled.");
+  return answer;
+}
+function authEvent(event, interaction) {
+  if (event.type === "auth_url") {
+    interaction.notify(`${event.instructions ?? "Complete sign-in in your browser."}
+${event.url}`);
+    interaction.openUrl?.(event.url);
+  } else if (event.type === "device_code") {
+    interaction.notify(`Open ${event.verificationUri} and enter ${event.userCode}`);
+    interaction.openUrl?.(event.verificationUri);
+  } else
+    interaction.notify(event.message);
+}
+function piConfig(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("Pi runner configuration is missing.");
+  const config = { ...value };
+  if (!config.provider || !config.model)
+    throw new Error("Pi runner requires provider and model. Run `goah runner setup`.");
+  if (config.apiKeyEnv && !isShellIdentifier(config.apiKeyEnv))
+    delete config.apiKeyEnv;
+  if (!config.authMode)
+    config.authMode = ["faux", "ollama", "lm-studio", "llama.cpp"].includes(config.provider) ? "local" : config.apiKeyEnv ? "environment" : "unconfigured";
+  return config;
+}
+function piEnvironment(config) {
+  const env = { GOAH_PI_PROVIDER: config.provider, GOAH_PI_MODEL: config.model, GOAH_PI_AUTH_FILE: config.authFile ?? defaultAuthFile() };
+  if (config.provider === "faux")
+    env.GOAH_PI_FAUX_HANDOFF = JSON.stringify(config.fauxHandoff ?? { outcome: "progress" });
+  if (config.provider !== "faux" && !["ollama", "lm-studio", "llama.cpp"].includes(config.provider)) {
+    const key = config.api ? "GOAH_PI_API_KEY" : defaultApiKeyEnv(config.provider);
+    env[key] = `env?:${config.apiKeyEnv ?? defaultApiKeyEnv(config.provider)}`;
+  }
+  if (config.baseUrl)
+    env.GOAH_PI_BASE_URL = config.baseUrl;
+  if (config.api)
+    env.GOAH_PI_API = config.api;
+  if (config.contextWindowTokens)
+    env.GOAH_PI_CONTEXT_WINDOW_TOKENS = String(config.contextWindowTokens);
+  if (config.maxOutputTokens)
+    env.GOAH_PI_MAX_OUTPUT_TOKENS = String(config.maxOutputTokens);
+  return env;
+}
+function workerEnvironment(config) {
+  const env = piEnvironment(config);
+  for (const key of Object.keys(env))
+    if (key.endsWith("API_KEY") || env[key]?.startsWith("env?:") || env[key]?.startsWith("env:"))
+      delete env[key];
+  env.GOAH_PI_AUTH_FILE = "";
+  return env;
+}
+function defaultApiKeyEnv(provider) {
+  const map = { anthropic: "ANTHROPIC_API_KEY", openai: "OPENAI_API_KEY", google: "GEMINI_API_KEY", openrouter: "OPENROUTER_API_KEY", xai: "XAI_API_KEY", groq: "GROQ_API_KEY", mistral: "MISTRAL_API_KEY", deepseek: "DEEPSEEK_API_KEY", nvidia: "NVIDIA_API_KEY", "github-copilot": "COPILOT_GITHUB_TOKEN", "kimi-coding": "KIMI_API_KEY" };
+  return map[provider] ?? `${provider.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}_API_KEY`;
+}
+function isShellIdentifier(value) {
+  return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
+}
+function localBaseUrl(provider) {
+  return provider === "ollama" ? "http://127.0.0.1:11434/v1" : provider === "lm-studio" ? "http://127.0.0.1:1234/v1" : "http://127.0.0.1:8080/v1";
+}
+function positive(value, fallback) {
+  const parsed = Number(value);
+  return Number.isInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+async function discoverLocalModels(provider) {
+  const base = localBaseUrl(provider);
+  const url = provider === "ollama" ? `${base.replace(/\/v1\/?$/, "")}/api/tags` : `${base.replace(/\/$/, "")}/models`;
+  try {
+    const response = await fetch(url, { signal: AbortSignal.timeout(1500) });
+    if (!response.ok)
+      return [];
+    const body = await response.json();
+    const ids = provider === "ollama" ? (body.models ?? []).map((item) => item.name) : (body.data ?? []).map((item) => item.id);
+    return ids.filter((id) => Boolean(id)).map((id) => ({ provider, id, name: id, contextWindow: 128e3, maxTokens: 16384, reasoning: false }));
+  } catch {
+    return [];
+  }
+}
+
+export {
+  resolveEnvSpec,
+  piRunnerConfigurator,
+  createPiProcessRunner,
+  piConfig,
+  piEnvironment,
+  PiRunnerAdapter,
+  piWorkerPath,
+  verificationWorkerPath,
+  ProcessRunner,
+  runProcessWorker
+};