@herbertgao/pi-extensions 2026.8.2 → 2026.8.4

package/node_modules/remote-pi/dist/session/agent_bridge.d.ts

@@ -0,0 +1,55 @@
+import type { AgentSession } from "@mariozechner/pi-coding-agent";
+import type { ClientMessage, ServerMessage } from "../protocol/types.js";
+/**
+ * Abstraction over the Noise-encrypted transport.
+ * Wave 3 plugs the real channel; tests use a mock.
+ */
+export interface PeerChannel {
+    send(msg: ServerMessage): void;
+}
+/**
+ * Minimal subset of BeforeToolCallContext consumed by the bridge.
+ * Shape-compatible with @mariozechner/pi-agent-core BeforeToolCallContext.
+ */
+export interface BridgeToolCallContext {
+    toolCall: {
+        toolCallId: string;
+        toolCall: {
+            name: string;
+            arguments: Record<string, unknown>;
+        };
+    };
+    args: unknown;
+}
+/**
+ * Bridges an AgentSession (Pi SDK) and a PeerChannel (remote app).
+ *
+ * Wire-up at session creation:
+ *   const bridge = new AgentBridge(session, channel)
+ *   // pass bridge.beforeToolCallHook to createAgentSession as beforeToolCall
+ *
+ * Then route incoming client messages:
+ *   channel.on('message', msg => bridge.onClientMessage(msg))
+ */
+export declare class AgentBridge {
+    private readonly session;
+    private readonly channel;
+    /** ID of the active user_message turn, used as in_reply_to for streaming. */
+    private currentTurnId;
+    /** Pending tool approvals keyed by tool_call_id. */
+    private readonly pendingApprovals;
+    private readonly unsubscribe;
+    constructor(session: AgentSession, channel: PeerChannel);
+    /**
+     * Pass this as `beforeToolCall` in createAgentSession options.
+     * Auto-approves whitelisted tools; pauses everything else for user approval.
+     */
+    readonly beforeToolCallHook: (ctx: BridgeToolCallContext, signal?: AbortSignal) => Promise<{
+        block?: boolean;
+        reason?: string;
+    } | undefined>;
+    onClientMessage(msg: ClientMessage): void;
+    dispose(): void;
+    private awaitApproval;
+    private onSessionEvent;
+}

package/node_modules/remote-pi/dist/session/agent_bridge.js

@@ -0,0 +1,146 @@
+import { decide } from "./tool_gate.js";
+const APPROVAL_TIMEOUT_MS = 60_000;
+// ── AgentBridge ───────────────────────────────────────────────────────────────
+/**
+ * Bridges an AgentSession (Pi SDK) and a PeerChannel (remote app).
+ *
+ * Wire-up at session creation:
+ *   const bridge = new AgentBridge(session, channel)
+ *   // pass bridge.beforeToolCallHook to createAgentSession as beforeToolCall
+ *
+ * Then route incoming client messages:
+ *   channel.on('message', msg => bridge.onClientMessage(msg))
+ */
+export class AgentBridge {
+    session;
+    channel;
+    /** ID of the active user_message turn, used as in_reply_to for streaming. */
+    currentTurnId = null;
+    /** Pending tool approvals keyed by tool_call_id. */
+    pendingApprovals = new Map();
+    unsubscribe;
+    constructor(session, channel) {
+        this.session = session;
+        this.channel = channel;
+        this.unsubscribe = session.subscribe(this.onSessionEvent.bind(this));
+    }
+    // ── beforeToolCall hook ────────────────────────────────────────────────────
+    /**
+     * Pass this as `beforeToolCall` in createAgentSession options.
+     * Auto-approves whitelisted tools; pauses everything else for user approval.
+     */
+    beforeToolCallHook = async (ctx, signal) => {
+        const toolName = ctx.toolCall.toolCall.name;
+        const toolCallId = ctx.toolCall.toolCallId;
+        if (decide(toolName) === "auto") {
+            return undefined; // proceed immediately
+        }
+        // Needs user approval: emit tool_request and block until response
+        this.channel.send({
+            type: "tool_request",
+            tool_call_id: toolCallId,
+            tool: toolName,
+            args: ctx.args,
+        });
+        const decision = await this.awaitApproval(toolCallId, signal);
+        if (decision === "deny") {
+            // Cancel the whole turn — user denied execution
+            void this.session.abort();
+            return { block: true, reason: "denied by user" };
+        }
+        return undefined; // allow
+    };
+    // ── Incoming client messages ───────────────────────────────────────────────
+    onClientMessage(msg) {
+        switch (msg.type) {
+            case "user_message":
+                this.currentTurnId = msg.id;
+                void this.session.prompt(msg.text);
+                break;
+            case "approve_tool": {
+                const resolve = this.pendingApprovals.get(msg.tool_call_id);
+                if (resolve)
+                    resolve(msg.decision);
+                break;
+            }
+            case "cancel":
+                void this.session.abort();
+                this.channel.send({
+                    type: "cancelled",
+                    in_reply_to: msg.id,
+                    target_id: msg.target_id,
+                });
+                break;
+            case "ping":
+                this.channel.send({ type: "pong", in_reply_to: msg.id });
+                break;
+        }
+    }
+    // ── Cleanup ────────────────────────────────────────────────────────────────
+    dispose() {
+        this.unsubscribe();
+        for (const resolve of this.pendingApprovals.values()) {
+            resolve("deny");
+        }
+        this.pendingApprovals.clear();
+    }
+    // ── Private ────────────────────────────────────────────────────────────────
+    awaitApproval(toolCallId, signal) {
+        return new Promise((resolve) => {
+            let settled = false;
+            const settle = (d) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timer);
+                this.pendingApprovals.delete(toolCallId);
+                resolve(d);
+            };
+            // 60 s timeout → auto-deny + inform remote peer
+            const timer = setTimeout(() => {
+                this.channel.send({
+                    type: "error",
+                    code: "timeout",
+                    message: `tool approval timeout: ${toolCallId}`,
+                });
+                settle("deny");
+            }, APPROVAL_TIMEOUT_MS);
+            this.pendingApprovals.set(toolCallId, settle);
+            signal?.addEventListener("abort", () => settle("deny"), { once: true });
+        });
+    }
+    onSessionEvent(event) {
+        // ── text streaming ─────────────────────────────────────────────────────
+        if (event.type === "message_update" && this.currentTurnId !== null) {
+            const ae = event.assistantMessageEvent;
+            if (ae.type === "text_delta") {
+                this.channel.send({
+                    type: "agent_chunk",
+                    in_reply_to: this.currentTurnId,
+                    delta: ae.delta,
+                });
+            }
+        }
+        // ── tool result ────────────────────────────────────────────────────────
+        if (event.type === "tool_execution_end") {
+            const toolResult = event.isError
+                ? {
+                    type: "tool_result",
+                    tool_call_id: event.toolCallId,
+                    error: String(event.result),
+                }
+                : {
+                    type: "tool_result",
+                    tool_call_id: event.toolCallId,
+                    result: event.result,
+                };
+            this.channel.send(toolResult);
+        }
+        // ── turn complete ──────────────────────────────────────────────────────
+        if (event.type === "agent_end" && this.currentTurnId !== null) {
+            this.channel.send({ type: "agent_done", in_reply_to: this.currentTurnId });
+            this.currentTurnId = null;
+        }
+    }
+}
+//# sourceMappingURL=agent_bridge.js.map

package/node_modules/remote-pi/dist/session/agent_bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent_bridge.js","sourceRoot":"","sources":["../../src/session/agent_bridge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AA2BxC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAEnC,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,MAAM,OAAO,WAAW;IACL,OAAO,CAAe;IACtB,OAAO,CAAc;IACtC,6EAA6E;IACrE,aAAa,GAAkB,IAAI,CAAC;IAC5C,oDAAoD;IACnC,gBAAgB,GAAG,IAAI,GAAG,EAGxC,CAAC;IACa,WAAW,CAAa;IAEzC,YAAY,OAAqB,EAAE,OAAoB;QACrD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,8EAA8E;IAE9E;;;OAGG;IACM,kBAAkB,GAAG,KAAK,EACjC,GAA0B,EAC1B,MAAoB,EACuC,EAAE;QAC7D,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAC5C,MAAM,UAAU,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC;QAE3C,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC,CAAC,sBAAsB;QAC1C,CAAC;QAED,kEAAkE;QAClE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;YAChB,IAAI,EAAE,cAAc;YACpB,YAAY,EAAE,UAAU;YACxB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,GAAG,CAAC,IAA+B;SAC1C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE9D,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACxB,gDAAgD;YAChD,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACnD,CAAC;QAED,OAAO,SAAS,CAAC,CAAC,QAAQ;IAC5B,CAAC,CAAC;IAEF,8EAA8E;IAE9E,eAAe,CAAC,GAAkB;QAChC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,cAAc;gBACjB,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,EAAE,CAAC;gBAC5B,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,MAAM;YAER,KAAK,cAAc,CAAC,CAAC,CAAC;gBACpB,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,OAAO;oBAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACnC,MAAM;YACR,CAAC;YAED,KAAK,QAAQ;gBACX,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;gBAC1B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,WAAW;oBACjB,WAAW,EAAE,GAAG,CAAC,EAAE;oBACnB,SAAS,EAAE,GAAG,CAAC,SAAS;iBACzB,CAAC,CAAC;gBACH,MAAM;YAER,KAAK,MAAM;gBACT,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;gBACzD,MAAM;QACV,CAAC;IACH,CAAC;IAED,8EAA8E;IAE9E,OAAO;QACL,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED,8EAA8E;IAEtE,aAAa,CACnB,UAAkB,EAClB,MAAoB;QAEpB,OAAO,IAAI,OAAO,CAAmB,CAAC,OAAO,EAAE,EAAE;YAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;YAEpB,MAAM,MAAM,GAAG,CAAC,CAAmB,EAAE,EAAE;gBACrC,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,KAAK,CAAC,CAAC;gBACpB,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;gBACzC,OAAO,CAAC,CAAC,CAAC,CAAC;YACb,CAAC,CAAC;YAEF,gDAAgD;YAChD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC5B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,0BAA0B,UAAU,EAAE;iBAChD,CAAC,CAAC;gBACH,MAAM,CAAC,MAAM,CAAC,CAAC;YACjB,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAExB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAE9C,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,KAAwB;QAC7C,0EAA0E;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACnE,MAAM,EAAE,GAAG,KAAK,CAAC,qBAAqB,CAAC;YACvC,IAAI,EAAE,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;oBAChB,IAAI,EAAE,aAAa;oBACnB,WAAW,EAAE,IAAI,CAAC,aAAa;oBAC/B,KAAK,EAAE,EAAE,CAAC,KAAK;iBAChB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,0EAA0E;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;YACxC,MAAM,UAAU,GAAkB,KAAK,CAAC,OAAO;gBAC7C,CAAC,CAAC;oBACE,IAAI,EAAE,aAAa;oBACnB,YAAY,EAAE,KAAK,CAAC,UAAU;oBAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;iBAC5B;gBACH,CAAC,CAAC;oBACE,IAAI,EAAE,aAAa;oBACnB,YAAY,EAAE,KAAK,CAAC,UAAU;oBAC9B,MAAM,EAAE,KAAK,CAAC,MAAiB;iBAChC,CAAC;YACN,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChC,CAAC;QAED,0EAA0E;QAC1E,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC5B,CAAC;IACH,CAAC;CACF"}

package/node_modules/remote-pi/dist/session/bridge.d.ts

@@ -0,0 +1,37 @@
+import type { Broker } from "./broker.js";
+import { BrokerRemote } from "./broker_remote.js";
+import { PiForwardClient } from "../transport/pi_forward_client.js";
+import type { RelayClient } from "../transport/relay_client.js";
+import { type MeshTopologySnapshot } from "../mesh/siblings.js";
+import type { Ed25519Keypair } from "../pairing/crypto.js";
+/**
+ * Cross-PC mesh bridge composition. Discovery finishes before either transport
+ * half is constructed, and the returned bridge stays dormant until its caller
+ * has re-checked lifecycle ownership and calls `activate()`.
+ */
+export interface AttachBridgeOptions {
+    /** The leader's local Broker (from SessionPeer.localBroker()). */
+    broker: Broker;
+    /** Live relay connection. Caller owns its lifecycle. */
+    relay: RelayClient;
+    /** Relay URL in http(s):// form — for standalone topology discovery. */
+    relayUrl: string;
+    /** This host's Ed25519 identity (machine Pi-key). */
+    keypair: Ed25519Keypair;
+    /** Retained Pi-produced topology. Supplying it bypasses discovery. */
+    topology?: MeshTopologySnapshot;
+    /** Standalone discovery deadline per mesh request. Defaults to 5 seconds. */
+    meshRequestTimeoutMs?: number;
+    /** Diagnostic logger. Defaults to a no-op (avoids TUI leaks). */
+    log?: (msg: string) => void;
+}
+export interface CrossPcBridge {
+    brokerRemote: BrokerRemote;
+    piForward: PiForwardClient;
+    topology: MeshTopologySnapshot;
+    /** Publish the already-built router exactly once. */
+    activate(): void;
+    /** Safe before or after activation; tears down both halves exactly once. */
+    detach(): void;
+}
+export declare function attachCrossPcBridge(opts: AttachBridgeOptions): Promise<CrossPcBridge>;

package/node_modules/remote-pi/dist/session/bridge.js

@@ -0,0 +1,130 @@
+import { BrokerRemote } from "./broker_remote.js";
+import { PiForwardClient } from "../transport/pi_forward_client.js";
+import { MeshClient } from "../mesh/client.js";
+import { buildTopologySnapshot, discoverTopology, } from "../mesh/siblings.js";
+import { canonicalizeEd25519PublicKey, encodeEd25519PublicKey, } from "../mesh/encoding.js";
+import { listOwnerPubkeys } from "../pairing/storage.js";
+function compareAscii(left, right) {
+    return left < right ? -1 : left > right ? 1 : 0;
+}
+function validateAlias(alias, field) {
+    if (typeof alias !== "string" || alias.length === 0 || alias.includes(":")) {
+        throw new Error(`mesh: ${field} is not a valid routing alias`);
+    }
+    return alias;
+}
+function validateLegacyPcLabel(label, field) {
+    if (typeof label !== "string" || label.length === 0) {
+        throw new Error(`mesh: ${field} is not a valid legacy PC label`);
+    }
+    return label;
+}
+function ownTopology(snapshot, expectedSelfPubkey) {
+    const selfPubkey = canonicalizeEd25519PublicKey(snapshot.self?.pcPubkey, "self public key");
+    if (selfPubkey !== expectedSelfPubkey) {
+        throw new Error("mesh: topology self public key does not match relay identity");
+    }
+    const selfLabel = validateAlias(snapshot.self.pcLabel, "self.pcLabel");
+    const selfLegacyPcLabel = validateLegacyPcLabel(snapshot.self.legacyPcLabel, "self.legacyPcLabel");
+    const self = Object.freeze({
+        pcLabel: selfLabel,
+        pcPubkey: selfPubkey,
+        legacyPcLabel: selfLegacyPcLabel,
+    });
+    const siblingKeys = new Set();
+    const siblingAliases = new Set();
+    const normalizedSiblings = [];
+    for (const [index, sibling] of snapshot.siblings.entries()) {
+        const pcPubkey = canonicalizeEd25519PublicKey(sibling.pcPubkey, `siblings[${index}].pcPubkey`);
+        if (pcPubkey === selfPubkey)
+            continue;
+        const pcLabel = validateAlias(sibling.pcLabel, `siblings[${index}].pcLabel`);
+        const legacyPcLabel = validateLegacyPcLabel(sibling.legacyPcLabel, `siblings[${index}].legacyPcLabel`);
+        if (pcLabel === selfLabel || siblingAliases.has(pcLabel)) {
+            throw new Error("mesh: duplicate sibling routing alias");
+        }
+        if (siblingKeys.has(pcPubkey)) {
+            throw new Error("mesh: duplicate sibling public key");
+        }
+        siblingAliases.add(pcLabel);
+        siblingKeys.add(pcPubkey);
+        normalizedSiblings.push(Object.freeze({ pcLabel, pcPubkey, legacyPcLabel }));
+    }
+    normalizedSiblings.sort((left, right) => compareAscii(left.pcPubkey, right.pcPubkey));
+    return Object.freeze({ self, siblings: Object.freeze(normalizedSiblings) });
+}
+async function discoverStandaloneTopology(opts) {
+    const silent = { warn: (_message) => { } };
+    try {
+        const owners = await listOwnerPubkeys();
+        return await discoverTopology({
+            client: new MeshClient(opts.relayUrl, {
+                ...(opts.meshRequestTimeoutMs !== undefined
+                    ? { requestTimeoutMs: opts.meshRequestTimeoutMs }
+                    : {}),
+            }),
+            ownerEpks: owners,
+            myPubkey: opts.keypair.publicKey,
+            log: silent,
+        });
+    }
+    catch {
+        return buildTopologySnapshot(opts.keypair.publicKey, []);
+    }
+}
+export async function attachCrossPcBridge(opts) {
+    const expectedSelfPubkey = encodeEd25519PublicKey(opts.keypair.publicKey, "relay public key");
+    const topology = ownTopology(opts.topology ?? await discoverStandaloneTopology(opts), expectedSelfPubkey);
+    // No Relay listeners exist until all standalone discovery has completed.
+    const piForward = new PiForwardClient(opts.relay);
+    let brokerRemote;
+    try {
+        brokerRemote = new BrokerRemote({
+            broker: opts.broker,
+            pi: piForward,
+            topology,
+            activateOnConstruct: false,
+            log: opts.log ?? (() => { }),
+        });
+    }
+    catch (error) {
+        piForward.detach();
+        throw error;
+    }
+    let state = "dormant";
+    return {
+        brokerRemote,
+        piForward,
+        topology,
+        activate() {
+            if (state !== "dormant")
+                return;
+            try {
+                brokerRemote.activate();
+                state = "active";
+            }
+            catch (error) {
+                state = "detached";
+                try {
+                    brokerRemote.detach();
+                }
+                finally {
+                    piForward.detach();
+                }
+                throw error;
+            }
+        },
+        detach() {
+            if (state === "detached")
+                return;
+            state = "detached";
+            try {
+                brokerRemote.detach();
+            }
+            finally {
+                piForward.detach();
+            }
+        },
+    };
+}
+//# sourceMappingURL=bridge.js.map

package/node_modules/remote-pi/dist/session/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../src/session/bridge.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAC/C,OAAO,EACL,qBAAqB,EACrB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,4BAA4B,EAC5B,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAoCzD,SAAS,YAAY,CAAC,IAAY,EAAE,KAAa;IAC/C,OAAO,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,KAAa;IAClD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,+BAA+B,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc,EAAE,KAAa;IAC1D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,SAAS,KAAK,iCAAiC,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAClB,QAA8B,EAC9B,kBAA0B;IAE1B,MAAM,UAAU,GAAG,4BAA4B,CAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,EACvB,iBAAiB,CAClB,CAAC;IACF,IAAI,UAAU,KAAK,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACvE,MAAM,iBAAiB,GAAG,qBAAqB,CAC7C,QAAQ,CAAC,IAAI,CAAC,aAAa,EAC3B,oBAAoB,CACrB,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC;QACzB,OAAO,EAAE,SAAS;QAClB,QAAQ,EAAE,UAAU;QACpB,aAAa,EAAE,iBAAiB;KACjC,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IACtC,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,MAAM,kBAAkB,GAIlB,EAAE,CAAC;IACT,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAC3D,MAAM,QAAQ,GAAG,4BAA4B,CAC3C,OAAO,CAAC,QAAQ,EAChB,YAAY,KAAK,YAAY,CAC9B,CAAC;QACF,IAAI,QAAQ,KAAK,UAAU;YAAE,SAAS;QACtC,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,KAAK,WAAW,CAAC,CAAC;QAC7E,MAAM,aAAa,GAAG,qBAAqB,CACzC,OAAO,CAAC,aAAa,EACrB,YAAY,KAAK,iBAAiB,CACnC,CAAC;QACF,IAAI,OAAO,KAAK,SAAS,IAAI,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5B,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IACD,kBAAkB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,0BAA0B,CACvC,IAAyB;IAEzB,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,CAAC,QAAgB,EAAQ,EAAE,GAAsC,CAAC,EAAE,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACxC,OAAO,MAAM,gBAAgB,CAAC;YAC5B,MAAM,EAAE,IAAI,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACpC,GAAG,CAAC,IAAI,CAAC,oBAAoB,KAAK,SAAS;oBACzC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC;YACF,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;YAChC,GAAG,EAAE,MAAM;SACZ,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyB;IAEzB,MAAM,kBAAkB,GAAG,sBAAsB,CAC/C,IAAI,CAAC,OAAO,CAAC,SAAS,EACtB,kBAAkB,CACnB,CAAC;IACF,MAAM,QAAQ,GAAG,WAAW,CAC1B,IAAI,CAAC,QAAQ,IAAI,MAAM,0BAA0B,CAAC,IAAI,CAAC,EACvD,kBAAkB,CACnB,CAAC;IAEF,yEAAyE;IACzE,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,YAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,YAAY,GAAG,IAAI,YAAY,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,EAAE,EAAE,SAAS;YACb,QAAQ;YACR,mBAAmB,EAAE,KAAK;YAC1B,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,GAAS,EAAE,GAAE,CAAC,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,SAAS,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,KAAK,GAAsC,SAAS,CAAC;IACzD,OAAO;QACL,YAAY;QACZ,SAAS;QACT,QAAQ;QACR,QAAQ;YACN,IAAI,KAAK,KAAK,SAAS;gBAAE,OAAO;YAChC,IAAI,CAAC;gBACH,YAAY,CAAC,QAAQ,EAAE,CAAC;gBACxB,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,KAAK,GAAG,UAAU,CAAC;gBACnB,IAAI,CAAC;oBACH,YAAY,CAAC,MAAM,EAAE,CAAC;gBACxB,CAAC;wBAAS,CAAC;oBACT,SAAS,CAAC,MAAM,EAAE,CAAC;gBACrB,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM;YACJ,IAAI,KAAK,KAAK,UAAU;gBAAE,OAAO;YACjC,KAAK,GAAG,UAAU,CAAC;YACnB,IAAI,CAAC;gBACH,YAAY,CAAC,MAAM,EAAE,CAAC;YACxB,CAAC;oBAAS,CAAC;gBACT,SAAS,CAAC,MAAM,EAAE,CAAC;YACrB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/remote-pi/dist/session/broker.d.ts

@@ -0,0 +1,189 @@
+import type { Server } from "node:net";
+import { type Envelope } from "./envelope.js";
+/**
+ * Structured view of one mesh peer (plan/38). The `address` is the canonical
+ * routing key; the other fields let a client group/label peers WITHOUT parsing
+ * the address string. `pc` is undefined for local peers (filled cross-PC in
+ * Fase 2). Returned by `list_peers` as `peers_detailed`.
+ */
+export interface PeerInfo {
+    /** Cross-PC label; undefined for a local peer. */
+    pc?: string;
+    /** Working directory (realpath). Empty string for a legacy peer (no cwd). */
+    cwd: string;
+    /** Clean leaf name (carries a `#N` only on a same-(cwd,name) collision). */
+    name: string;
+    /** Canonical address — the broker's Map key and the `to`/`from` on the wire. */
+    address: string;
+}
+/**
+ * THE sole encoder of a peer address (plan/38): `[<pc>:]<cwd>@<nome>`.
+ *
+ * - `cwd` present → `<cwd>@<nome>` (the `@` separates name from path so a `/`
+ *   in the path never confuses lookup, which is exact-match anyway).
+ * - `cwd` empty (legacy peer that sent no cwd) → `address == name`, preserving
+ *   pre-plan/38 behavior so a mixed mesh keeps routing.
+ * - `pc` present (cross-PC, Fase 2) → prefixed `<pc>:`.
+ *
+ * Does NOT sanitize — callers sanitize the `name` once (see `sanitizeMeshName`)
+ * before composing, so an already-appended `#N` collision suffix survives.
+ * Everyone else ECHOES `peer.address` verbatim; only the broker composes.
+ */
+export declare function composeAddress(parts: {
+    pc?: string;
+    cwd: string;
+    name: string;
+}): string;
+/**
+ * Sanitize a requested mesh name to a safe leaf while PRESERVING a trailing
+ * `#N` collision suffix (which the cwd-lock or a prior assignment may have
+ * added — `sanitizeSegment` alone would mangle `#`→`-`). The base is run through
+ * `sanitizeSegment` (af66d04); an unusable base (empty / reserved keyword) falls
+ * back to `"agent"`.
+ */
+export declare function sanitizeMeshName(raw: string): string;
+/**
+ * Broker hosted by the session leader. Accepts UDS connections, maintains a
+ * `name → connection` map, routes envelopes per the `to` field, and appends
+ * each routed message to an `audit.jsonl` log.
+ *
+ * Auto-suffix on name collision: when a peer registers a name already taken,
+ * the broker assigns `<name>#N` and returns it in the register ack.
+ *
+ * ## ACK protocol (plan/25 Wave 0; reliable delivery per plan/34)
+ *
+ * For **unicast non-broker** envelopes the broker synchronously emits an ACK
+ * envelope back to the sender once it has delivered:
+ *
+ *   - target online → deliver envelope, ACK `received`
+ *   - no such peer  → silent drop (sender times out)
+ *
+ * plan/34 removed the busy-drop: a message that arrives while the target is
+ * mid-turn is **always delivered**, never dropped. The Pi harness
+ * (`sendMessage(triggerTurn:true)`) enqueues mid-turn messages and processes
+ * them in the upcoming turn, so the broker needs no busy gate or mailbox.
+ * Consequently `busy` is no longer a possible ACK status for unicast new
+ * work — the sender always gets `received`. (Turn-lifecycle / working
+ * indicators live in `index.ts` via room_meta over the relay, not here.)
+ *
+ * Broadcast/multicast/broker-addressed envelopes are not ACKed (no single
+ * authoritative recipient or no semantic match). The audit log carries the
+ * ACK status (`received | denied | none`) per envelope.
+ */
+export interface BrokerOptions {
+    server: Server;
+    auditPath?: string;
+    /** Optional callback invoked after each successful route (testing/observability). */
+    onRouted?: (env: Envelope, deliveredTo: string[]) => void;
+}
+/**
+ * Hook the broker calls before doing local routing, so cross-PC prefixes
+ * (`<pc_label>:<peer_name>`) can be handed off to a remote forwarder
+ * without baking transport knowledge into the broker. Wave C (plan/25)
+ * wires `broker_remote.ts` here.
+ */
+export interface RemoteRouter {
+    /**
+     * Try to claim responsibility for routing this envelope cross-PC.
+     * Returns true if claimed (broker MUST NOT also deliver locally). Returns
+     * false if the envelope should fall through to local routing — e.g., the
+     * prefix matches the local `pc_label`, the prefix is not a known remote
+     * label (backward-compat for local names containing `:`), or there's no
+     * prefix at all.
+     */
+    tryRouteOutbound(env: Envelope): boolean;
+    /** Aggregated remote peer addresses (`<pc_label>:<cwd>@<nome>`) for the
+     *  `list_peers` reply's `peers` (string) field. Empty when nothing known. */
+    listRemotePeers(): string[];
+    /** Structured remote roster (plan/38 Fase 2): one `PeerInfo` per cross-PC
+     *  peer with `pc` filled (the sibling label), `cwd`/`name` from the sibling's
+     *  inventory, and `address` prefixed `<pc>:<cwd>@<nome>`. Powers the
+     *  `peers_detailed` half of `list_peers` so clients group by `pc`/`cwd`
+     *  without parsing. Empty when nothing known. */
+    listRemotePeerInfos(): PeerInfo[];
+}
+export interface ConditionalRemoteRouterHost {
+    clearRemoteRouter(expected: RemoteRouter): void;
+}
+/** Local outcome of a cross-PC envelope injection. broker_remote uses this
+ *  to construct the ACK envelope it sends back via the relay. plan/34: `busy`
+ *  is gone — injection always delivers when the peer exists. */
+export type RemoteInjectStatus = "received" | "denied";
+export declare class Broker {
+    private readonly peers;
+    private readonly auditPath?;
+    private readonly onRouted?;
+    private readonly server;
+    /** Plan/25 Wave C: optional handoff for cross-PC routing. Null = local only. */
+    private remoteRouter;
+    constructor(opts: BrokerOptions);
+    /** Attach (or detach with null) a cross-PC router. Idempotent. */
+    setRemoteRouter(router: RemoteRouter | null): void;
+    /** Clear only when the caller still owns the active router slot. */
+    clearRemoteRouter(expected: RemoteRouter): void;
+    /**
+     * Plan/25 Wave C entry point: deliver an envelope that arrived from a
+     * remote PC (via relay forward) into the local UDS mesh. Skips the
+     * `force from = conn.name` rule (that defense is anti-spoof for local
+     * peers; cross-PC has its own defense via the relay's verified `from_pc`).
+     *
+     * Returns the ACK status so the caller (broker_remote) can pack and
+     * forward an ACK envelope back across the relay:
+     *   - `received` — target exists, envelope delivered (plan/34: always
+     *     delivered when the peer is online — the Pi harness enqueues mid-turn
+     *     messages, so there is no busy-drop)
+     *   - `denied` — no such local peer (or write failed) — caller maps to
+     *     transport_error or denied ACK as it sees fit
+     */
+    injectFromRemote(env: Envelope): RemoteInjectStatus;
+    /** Peers currently registered. Snapshot, safe to read. */
+    peerNames(): string[];
+    close(): Promise<void>;
+    private _handleConnection;
+    private _onData;
+    private _handleLine;
+    private _handleRegister;
+    /**
+     * Answer a read-only `list_peers` request from an UNREGISTERED connection
+     * (the `remote-pi peers` CLI probe). Returns true when the line was such a
+     * probe — the reply is written and the connection stays unregistered: no
+     * name assigned, no `peer_joined`/`peer_left` broadcast, no sibling push, so
+     * querying the roster from the shell never perturbs the mesh. Returns false
+     * (not a probe) so the caller falls through to the register handshake.
+     */
+    private _tryObserverProbe;
+    /** Local UDS peer names plus cross-PC `<pc>:<peer>` entries from the remote
+     *  router (empty when no bridge). Shared by the registered `list_peers`
+     *  handler and the unregistered observer probe. */
+    private _allPeerNames;
+    /** Structured roster of LOCAL UDS peers (plan/38): one `PeerInfo` each, no
+     *  `pc` (they're on this machine). Public so the cross-PC router
+     *  (`broker_remote`) can read the authoritative local inventory directly to
+     *  push to siblings — no `list_peers` round-trip, no stale cache. */
+    localPeerInfos(): PeerInfo[];
+    /** Structured roster (plan/38): local peers (no `pc`) + cross-PC peers with
+     *  `pc`/`cwd`/`name` filled by the remote router (Fase 2). */
+    private _allPeerInfos;
+    /**
+     * Resolve a free `(name, address)` for a register, keyed by **(cwd, name)**
+     * (plan/38): the collision check is on the composed ADDRESS, so a name only
+     * collides with another peer in the SAME cwd. `#N` is appended to the name
+     * (matching the cwd-lock's suffix scheme) until the address is free; for a
+     * legacy peer (cwd "") the address is the name, preserving global-name `#N`.
+     */
+    private _identityForRegister;
+    private _dropPeerAt;
+    private _onClose;
+    private _route;
+    private _resolveTargets;
+    /**
+     * Writes an ACK envelope to the original sender's socket. Synchronous —
+     * the caller is inside `_route` and must keep busy-check/busy-set atomic.
+     * Broker → sender: `from="broker"`, `to=env.from`, `re=env.id`,
+     * `body={type:"ack", status, target}`.
+     */
+    private _sendAckToSender;
+    private _handleBrokerMessage;
+    private _broadcastSystem;
+    private _appendAudit;
+}