@josephyoung/pi-openviking 0.1.0

package/dist/standard.js

@@ -0,0 +1,87 @@
+import { createOpenVikingExtension, MemoryDelivery } from './host.js';
+import { createIsolatedToolsExtension } from './worker-tools.js';
+const statusLabels = {
+    queued: '等待处理', session_unknown: '正在核对', session_created: '处理中',
+    message_unknown: '正在核对', message_delivered: '处理中', commit_unknown: '正在核对',
+    processing: '处理中', ready: '已保存', failed: '保存失败', blocked: '需要处理', blocked_by_pause: '已被暂停阻止',
+};
+let launcherBinding;
+/** Only the trusted CLI bootstrap installs this binding, before pi loads extensions. */
+export function bindStandardHost(options, worker) {
+    if (launcherBinding)
+        throw new Error('DUPLICATE_STANDARD_MEMORY_HOST');
+    if (!worker)
+        throw new Error('MISSING_MEMORY_WORKER');
+    launcherBinding = { options, worker };
+}
+export default async function openViking(pi) {
+    if (!launcherBinding) {
+        pi.on('session_start', (_event, ctx) => {
+            ctx.ui.notify('长期记忆未启用：请通过受保护的 pi-openviking 启动入口运行。', 'info');
+        });
+        return;
+    }
+    const { options, worker } = launcherBinding;
+    // The memory gate verifies the very same worker that receives native tools.
+    await createIsolatedToolsExtension(worker)(pi);
+    await createOpenVikingExtension({ ...options, assertToolIsolation: () => worker.assertIsolated() })(pi);
+    const delivery = new MemoryDelivery({ store: options.stateStore, transport: options.client, maxPayloadBytes: options.policy.maxPayloadBytes });
+    pi.registerCommand('memory', {
+        description: '长期记忆：enable、pause、status、show。启用和自动采集分别授权。',
+        async handler(args, ctx) {
+            try {
+                const action = args.trim();
+                if (action === 'enable') {
+                    await worker.assertIsolated();
+                    if (!ctx.hasUI) {
+                        ctx.ui.notify('请在交互模式中确认启用长期记忆。', 'warning');
+                        return;
+                    }
+                    const accepted = await ctx.ui.confirm('启用长期记忆', '明确保存的事实将发送到已配置的记忆服务，并可在新聊天中召回。自动采集仍保持关闭；启用前的保存请求需重新确认。');
+                    if (!accepted)
+                        return;
+                    const state = await options.stateStore.read();
+                    if (!state.authorization.enabled)
+                        await delivery.enable(state.authorization.policyVersion);
+                    ctx.ui.notify('长期记忆已启用；自动采集未授权。请重新发起需要保存的事实。', 'info');
+                }
+                else if (action === 'pause') {
+                    await delivery.pause();
+                    ctx.ui.notify('长期记忆已暂停。未发送的保存不会在恢复后自动重放。', 'info');
+                }
+                else if (action === 'status') {
+                    const state = await options.stateStore.read();
+                    const recent = Object.values(state.operations).sort((a, b) => b.createdAt.localeCompare(a.createdAt)).slice(0, 20);
+                    const summary = [`长期记忆：${state.authorization.enabled ? '已启用' : '已暂停'}；自动采集：${state.authorization.automaticCollection ? '已授权' : '未授权'}`,
+                        ...recent.map(operation => `${statusLabels[operation.phase]} · ${operation.createdAt} · ${operation.id}`)];
+                    ctx.ui.notify(summary.join('\n'), 'info');
+                }
+                else if (action.startsWith('show ')) {
+                    const id = action.slice(5).trim();
+                    if (!/^[a-f0-9]{64}$/.test(id)) {
+                        ctx.ui.notify('保存记录不存在。', 'warning');
+                        return;
+                    }
+                    const operation = (await options.stateStore.read()).operations[id];
+                    if (!operation) {
+                        ctx.ui.notify('保存记录不存在。', 'warning');
+                        return;
+                    }
+                    const lines = [`状态：${statusLabels[operation.phase]}`, `时间：${operation.createdAt}`,
+                        `来源会话：${operation.source.sessionId}`];
+                    if (operation.phase === 'ready' && options.client.readMemory) {
+                        for (const uri of operation.memoryUris ?? [])
+                            lines.push(await options.client.readMemory(uri));
+                    }
+                    ctx.ui.notify(lines.join('\n'), 'info');
+                }
+                else {
+                    ctx.ui.notify('使用 /memory enable、/memory pause 、/memory status 或 /memory show <记录编号>。', 'info');
+                }
+            }
+            catch {
+                ctx.ui.notify('记忆操作暂时不可用；普通聊天可继续。', 'warning');
+            }
+        },
+    });
+}

package/dist/state-store.d.ts

@@ -0,0 +1,13 @@
+import { type Owner, type OwnerState, type StateStore } from './types.js';
+/** The directory must be outside tool access; permissions alone are not a sandbox. */
+export declare class FileStateStore implements StateStore {
+    #private;
+    readonly owner: Owner;
+    constructor(options: {
+        owner: Owner;
+        directory: string;
+        policyVersion: string;
+    });
+    read(): Promise<OwnerState>;
+    transact<T>(mutation: (state: OwnerState) => T): Promise<T>;
+}

package/dist/state-store.js

@@ -0,0 +1,146 @@
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, rename, rm } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { flock } from 'fs-ext';
+import { checkedOwner, sameOwner } from './types.js';
+async function lock(fd, operation) {
+    // Blocking flock consumes a libuv worker: enough waiting writers can starve
+    // the current holder's fsync. Nonblocking acquisition keeps that pool free.
+    for (;;) {
+        try {
+            await new Promise((accept, reject) => flock(fd, operation === 'ex' ? 'exnb' : 'un', error => error ? reject(error) : accept()));
+            return;
+        }
+        catch (error) {
+            if (operation !== 'ex' || !['EAGAIN', 'EWOULDBLOCK'].includes(error.code ?? ''))
+                throw error;
+            await new Promise(resolve => setTimeout(resolve, 10));
+        }
+    }
+}
+function verify(state, owner) {
+    if (state?.version !== 1 || !state.owner || !sameOwner(state.owner, owner)
+        || !Number.isSafeInteger(state.revision) || state.revision < 0
+        || !state.authorization || typeof state.authorization.enabled !== 'boolean'
+        || typeof state.authorization.automaticCollection !== 'boolean'
+        || !Number.isSafeInteger(state.authorization.epoch)
+        || !state.operations || Array.isArray(state.operations)) {
+        throw new Error('INVALID_MEMORY_STATE');
+    }
+    for (const [id, operation] of Object.entries(state.operations)) {
+        if (id !== operation.id || !operation.owner || !sameOwner(operation.owner, owner)) {
+            throw new Error('MEMORY_OWNER_MISMATCH');
+        }
+    }
+}
+/** The directory must be outside tool access; permissions alone are not a sandbox. */
+export class FileStateStore {
+    owner;
+    #directory;
+    #policyVersion;
+    constructor(options) {
+        this.owner = checkedOwner(options.owner);
+        this.#directory = resolve(options.directory);
+        if (!options.policyVersion)
+            throw new Error('MISSING_POLICY_VERSION');
+        this.#policyVersion = options.policyVersion;
+    }
+    async #prepare() {
+        // Do not follow a final-component symlink or relax an existing directory.
+        await mkdir(this.#directory, { mode: 0o700, recursive: true });
+        const metadata = await lstat(this.#directory);
+        if (!metadata.isDirectory() || metadata.isSymbolicLink()
+            || (metadata.mode & 0o077) !== 0
+            || metadata.uid !== process.getuid?.())
+            throw new Error('UNPROTECTED_MEMORY_STATE');
+    }
+    async #load() {
+        let file;
+        try {
+            file = await open(join(this.#directory, 'state.json'), constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (error) {
+            if (error.code !== 'ENOENT')
+                throw new Error('MEMORY_STATE_UNREADABLE');
+            return {
+                version: 1, owner: this.owner, revision: 0,
+                authorization: { enabled: false, automaticCollection: false, epoch: 0,
+                    effectiveAt: new Date().toISOString(), policyVersion: this.#policyVersion },
+                operations: {},
+            };
+        }
+        try {
+            const metadata = await file.stat();
+            if (!metadata.isFile() || (metadata.mode & 0o077) !== 0 || metadata.uid !== process.getuid?.()) {
+                throw new Error('UNPROTECTED_MEMORY_STATE');
+            }
+            const state = JSON.parse(await file.readFile('utf8'));
+            verify(state, this.owner);
+            return state;
+        }
+        finally {
+            await file.close();
+        }
+    }
+    async #write(state) {
+        verify(state, this.owner);
+        const temporary = join(this.#directory, `.state-${randomUUID()}`);
+        const file = await open(temporary, 'wx', 0o600);
+        try {
+            await file.writeFile(JSON.stringify(state));
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        try {
+            await rename(temporary, join(this.#directory, 'state.json'));
+            const directory = await open(this.#directory, constants.O_RDONLY);
+            try {
+                await directory.sync();
+            }
+            finally {
+                await directory.close();
+            }
+        }
+        finally {
+            await rm(temporary, { force: true });
+        }
+    }
+    async #locked(action) {
+        await this.#prepare();
+        const file = await open(join(this.#directory, 'state.lock'), constants.O_RDWR | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+        try {
+            const metadata = await file.stat();
+            if (!metadata.isFile() || (metadata.mode & 0o077) !== 0 || metadata.uid !== process.getuid?.()) {
+                throw new Error('UNPROTECTED_MEMORY_LOCK');
+            }
+            await lock(file.fd, 'ex');
+            try {
+                return await action();
+            }
+            finally {
+                await lock(file.fd, 'un');
+            }
+        }
+        finally {
+            await file.close();
+        }
+    }
+    read() {
+        return this.#locked(() => this.#load());
+    }
+    transact(mutation) {
+        return this.#locked(async () => {
+            const state = await this.#load();
+            const result = mutation(state);
+            if (result && typeof result.then === 'function') {
+                throw new Error('ASYNC_MEMORY_TRANSACTION');
+            }
+            state.revision++;
+            await this.#write(state);
+            return result;
+        });
+    }
+}

package/dist/tool-worker-entry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/tool-worker-entry.js

@@ -0,0 +1,83 @@
+// Internal executable. Its arguments come only from the trusted bootstrap.
+import { pathToFileURL } from 'node:url';
+const [workspace, piEntry, limitText] = process.argv.slice(2);
+const maxResultBytes = Number(limitText);
+if (!process.send || process.getuid?.() === 0 || !workspace || !piEntry || !Number.isSafeInteger(maxResultBytes)) {
+    throw new Error('INVALID_TOOL_WORKER_START');
+}
+const pi = await import(pathToFileURL(piEntry).href);
+const definitions = [pi.createReadToolDefinition(workspace), pi.createWriteToolDefinition(workspace),
+    pi.createEditToolDefinition(workspace), pi.createBashToolDefinition(workspace), pi.createGrepToolDefinition(workspace),
+    pi.createFindToolDefinition(workspace), pi.createLsToolDefinition(workspace)];
+const tools = new Map(definitions.map(tool => [tool.name, tool]));
+const running = new Map();
+const send = (value) => { if (process.connected)
+    process.send(value, () => { }); };
+process.on('disconnect', () => { for (const controller of running.values())
+    controller.abort(); process.exit(0); });
+process.on('message', async (message) => {
+    if (!message || typeof message !== 'object')
+        return;
+    const request = message;
+    if (request.type === 'shutdown') {
+        for (const controller of running.values())
+            controller.abort();
+        process.disconnect?.();
+        return;
+    }
+    if (typeof request.id !== 'string')
+        return;
+    const id = request.id;
+    if (request.type === 'cancel') {
+        running.get(id)?.abort();
+        return;
+    }
+    if (request.type !== 'execute' || typeof request.name !== 'string' || !request.parameters
+        || typeof request.parameters !== 'object' || Array.isArray(request.parameters) || running.has(id))
+        return;
+    const tool = tools.get(request.name);
+    if (!tool && request.name !== 'user_bash') {
+        send({ type: 'error', id });
+        return;
+    }
+    const controller = new AbortController();
+    running.set(id, controller);
+    try {
+        // Native definitions do not consume extension context. No host callback,
+        // credentials, mutable environment or arbitrary function crosses this IPC.
+        if (request.name === 'user_bash') {
+            const parameters = request.parameters;
+            if (typeof parameters.command !== 'string')
+                throw new Error('INVALID_SHELL_COMMAND');
+            const value = await pi.createLocalBashOperations().exec(parameters.command, workspace, {
+                signal: controller.signal,
+                timeout: typeof parameters.timeout === 'number' ? parameters.timeout : undefined,
+                onData(data) {
+                    const value = { data: data.toString('base64') };
+                    const update = { type: 'update', id, value };
+                    if (Buffer.byteLength(JSON.stringify(update)) <= maxResultBytes)
+                        send(update);
+                },
+            });
+            send({ type: 'result', id, value });
+            return;
+        }
+        const value = await tool.execute(id, request.parameters, controller.signal, update => {
+            const result = { type: 'update', id, value: update };
+            if (Buffer.byteLength(JSON.stringify(result)) <= maxResultBytes)
+                send(result);
+        }, undefined);
+        const result = { type: 'result', id, value };
+        if (Buffer.byteLength(JSON.stringify(result)) > maxResultBytes)
+            send({ type: 'error', id });
+        else
+            send(result);
+    }
+    catch {
+        send({ type: 'error', id });
+    }
+    finally {
+        running.delete(id);
+    }
+});
+send({ type: 'ready', uid: process.getuid?.(), gid: process.getgid?.() });

package/dist/tool-worker.d.ts

@@ -0,0 +1,27 @@
+export declare const nativeToolNames: readonly ["read", "write", "edit", "bash", "grep", "find", "ls"];
+export type NativeToolName = typeof nativeToolNames[number];
+export type WorkerOperationName = NativeToolName | 'user_bash';
+export interface WorkerOptions {
+    workspace: string;
+    /** Protected installation's package.json; never supplied by the model. */
+    piPackageContext: string;
+    /** Trusted util-linux setpriv executable, used to make privilege gain irreversible. */
+    privilegeGuard: string;
+    workerUid: number;
+    workerGid: number;
+    hostUid: number;
+    path: string;
+    startupTimeoutMs: number;
+    operationTimeoutMs: number;
+    maxConcurrentOperations: number;
+    maxResultBytes: number;
+}
+/** Bootstrap while privileged; drop host privileges before enabling memory. */
+export declare class NativeToolWorker {
+    #private;
+    constructor(options: WorkerOptions);
+    get workspace(): string;
+    assertIsolated(): Promise<void>;
+    execute(name: WorkerOperationName, parameters: Record<string, unknown>, signal?: AbortSignal, onUpdate?: (value: unknown) => void): Promise<unknown>;
+    close(): void;
+}

package/dist/tool-worker.js

@@ -0,0 +1,160 @@
+import { spawn } from 'node:child_process';
+import { readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
+import { dirname, join, resolve, isAbsolute } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { randomUUID } from 'node:crypto';
+export const nativeToolNames = ['read', 'write', 'edit', 'bash', 'grep', 'find', 'ls'];
+/** Bootstrap while privileged; drop host privileges before enabling memory. */
+export class NativeToolWorker {
+    #child;
+    #options;
+    #pending = new Map();
+    #ready;
+    #closed = false;
+    constructor(options) {
+        if (process.platform !== 'linux' || process.getuid?.() !== 0 || !isAbsolute(options.privilegeGuard)
+            || ![options.workerUid, options.workerGid, options.hostUid].every(id => Number.isSafeInteger(id) && id > 0)
+            || options.workerUid === options.hostUid
+            || ![options.startupTimeoutMs, options.operationTimeoutMs, options.maxConcurrentOperations, options.maxResultBytes]
+                .every(value => Number.isSafeInteger(value) && value > 0)) {
+            throw new Error('INVALID_MEMORY_WORKER_PROFILE');
+        }
+        this.#options = { ...options };
+        // pi publishes an import-only export; CommonJS require.resolve cannot
+        // select it. Resolve the fixed peer's declared public ESM entry explicitly.
+        const piRoot = join(dirname(options.piPackageContext), 'node_modules/@earendil-works/pi-coding-agent');
+        const manifest = JSON.parse(readFileSync(join(piRoot, 'package.json'), 'utf8'));
+        const entry = manifest.exports?.['.']?.import;
+        const extensionManifest = JSON.parse(readFileSync(fileURLToPath(new URL('../package.json', import.meta.url)), 'utf8'));
+        const expectedPeer = extensionManifest.peerDependencies?.['@earendil-works/pi-coding-agent'];
+        if (!/^\d+\.\d+\.\d+$/.test(expectedPeer ?? '') || manifest.version !== expectedPeer
+            || typeof entry !== 'string' || !entry.startsWith('./')) {
+            throw new Error('UNSUPPORTED_MEMORY_WORKER_PI');
+        }
+        const piEntry = resolve(piRoot, entry);
+        // Clear supplementary bootstrap groups before creating the worker. The
+        // eventual host also retains no supplementary groups from root startup.
+        process.setgroups([]);
+        this.#child = spawn(options.privilegeGuard, ['--no-new-privs', '--', process.execPath, fileURLToPath(new URL('./tool-worker-entry.js', import.meta.url)),
+            options.workspace, piEntry, String(options.maxResultBytes)], {
+            cwd: options.workspace, uid: options.workerUid, gid: options.workerGid,
+            env: { PATH: options.path, HOME: options.workspace, LANG: 'C.UTF-8' },
+            stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+        });
+        this.#ready = new Promise((resolve, reject) => {
+            const timer = setTimeout(() => { this.close(); reject(new Error('MEMORY_WORKER_START_TIMEOUT')); }, options.startupTimeoutMs);
+            const failed = () => { clearTimeout(timer); reject(new Error('MEMORY_WORKER_UNAVAILABLE')); };
+            this.#child.once('error', failed);
+            this.#child.once('exit', failed);
+            this.#child.on('message', message => {
+                if (!message || typeof message !== 'object')
+                    return;
+                const result = message;
+                if (result.type === 'ready') {
+                    if (result.uid !== options.workerUid || result.gid !== options.workerGid) {
+                        this.close();
+                        failed();
+                        return;
+                    }
+                    clearTimeout(timer);
+                    resolve();
+                    return;
+                }
+                if (typeof result.id !== 'string')
+                    return;
+                const pending = this.#pending.get(result.id);
+                if (!pending)
+                    return;
+                if (result.type === 'update') {
+                    try {
+                        if (Buffer.byteLength(JSON.stringify(result)) > options.maxResultBytes)
+                            throw new Error('WORKER_UPDATE_LIMIT');
+                        pending.onUpdate?.(result.value);
+                    }
+                    catch {
+                        this.#pending.delete(result.id);
+                        pending.cleanup();
+                        if (this.#child.connected)
+                            this.#child.send({ type: 'cancel', id: result.id }, () => { });
+                        pending.reject(new Error('MEMORY_WORKER_UPDATE_FAILED'));
+                    }
+                    return;
+                }
+                this.#pending.delete(result.id);
+                pending.cleanup();
+                if (Buffer.byteLength(JSON.stringify(result)) > options.maxResultBytes)
+                    pending.reject(new Error('MEMORY_WORKER_RESULT_LIMIT'));
+                else if (result.type === 'result')
+                    pending.resolve(result.value);
+                else
+                    pending.reject(new Error('MEMORY_WORKER_TOOL_FAILED'));
+            });
+        });
+        // A bootstrap caller may still be preparing the host before awaiting ready.
+        void this.#ready.catch(() => { });
+        const disconnected = () => {
+            this.#closed = true;
+            for (const pending of this.#pending.values()) {
+                pending.cleanup();
+                pending.reject(new Error('MEMORY_WORKER_UNAVAILABLE'));
+            }
+            this.#pending.clear();
+        };
+        this.#child.once('exit', disconnected);
+        this.#child.once('error', disconnected);
+        this.#child.once('disconnect', disconnected);
+    }
+    get workspace() { return this.#options.workspace; }
+    async assertIsolated() {
+        await this.#ready;
+        if (this.#closed || !this.#child.connected || process.getuid?.() !== this.#options.hostUid) {
+            throw new Error('MEMORY_WORKER_UNAVAILABLE');
+        }
+        // Independently inspect kernel identity, not a self-reported config flag.
+        const status = await readFile(`/proc/${this.#child.pid}/status`, 'utf8');
+        if (!/^NoNewPrivs:\s+1$/m.test(status))
+            throw new Error('MEMORY_WORKER_PRIVILEGE_GAIN_ALLOWED');
+        const uids = /^Uid:\s+(\d+)\s+(\d+)\s+(\d+)\s+(\d+)$/m.exec(status);
+        if (!uids || uids.slice(1).some(uid => Number(uid) !== this.#options.workerUid))
+            throw new Error('MEMORY_WORKER_IDENTITY_MISMATCH');
+    }
+    async execute(name, parameters, signal, onUpdate) {
+        await this.assertIsolated();
+        if (!(name === 'user_bash' || nativeToolNames.includes(name)) || this.#pending.size >= this.#options.maxConcurrentOperations) {
+            throw new Error('MEMORY_WORKER_REQUEST_LIMIT');
+        }
+        signal?.throwIfAborted();
+        const id = randomUUID();
+        return new Promise((resolve, reject) => {
+            const cancel = () => {
+                if (!this.#pending.delete(id))
+                    return;
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', cancel);
+                if (this.#child.connected)
+                    this.#child.send({ type: 'cancel', id }, () => { });
+                reject(new Error('MEMORY_WORKER_CANCELLED'));
+            };
+            const timer = setTimeout(cancel, this.#options.operationTimeoutMs);
+            this.#pending.set(id, { resolve, reject, onUpdate, cleanup: () => {
+                    clearTimeout(timer);
+                    signal?.removeEventListener('abort', cancel);
+                } });
+            signal?.addEventListener('abort', cancel, { once: true });
+            this.#child.send({ type: 'execute', id, name, parameters }, error => {
+                if (!error)
+                    return;
+                const pending = this.#pending.get(id);
+                this.#pending.delete(id);
+                pending?.cleanup();
+                pending?.reject(new Error('MEMORY_WORKER_UNAVAILABLE'));
+            });
+        });
+    }
+    close() {
+        if (this.#child.connected)
+            this.#child.send({ type: 'shutdown' }, () => { });
+        this.#closed = true;
+    }
+}

package/dist/types.d.ts

@@ -0,0 +1,52 @@
+export interface Owner {
+    readonly accountId: string;
+    readonly userId: string;
+}
+export interface Authorization {
+    enabled: boolean;
+    automaticCollection: boolean;
+    epoch: number;
+    effectiveAt: string;
+    policyVersion: string;
+}
+export type DeliveryPhase = 'queued' | 'session_unknown' | 'session_created' | 'message_unknown' | 'message_delivered' | 'commit_unknown' | 'processing' | 'ready' | 'failed' | 'blocked_by_pause' | 'blocked';
+export interface Source {
+    sessionId: string;
+    entryId: string;
+    branchId: string;
+    contentVersion: string;
+}
+export interface Operation {
+    id: string;
+    owner: Owner;
+    scope: string | null;
+    source: Source;
+    kind: 'explicit';
+    authorizationEpoch: number;
+    createdAt: string;
+    updatedAt: string;
+    phase: DeliveryPhase;
+    remoteSessionId: string;
+    payload?: string;
+    taskId?: string;
+    archiveId?: string;
+    memoryUris?: string[];
+    errorCode?: string;
+    deliveryAttempts?: number;
+    nextAttemptAt?: number;
+}
+export interface OwnerState {
+    version: 1;
+    owner: Owner;
+    revision: number;
+    authorization: Authorization;
+    operations: Record<string, Operation>;
+}
+export interface StateStore {
+    readonly owner: Owner;
+    read(): Promise<OwnerState>;
+    /** Synchronous mutation, serialized across processes and committed before return. */
+    transact<T>(mutation: (state: OwnerState) => T): Promise<T>;
+}
+export declare function checkedOwner(owner: Owner): Owner;
+export declare function sameOwner(a: Owner, b: Owner): boolean;

package/dist/types.js

@@ -0,0 +1,9 @@
+export function checkedOwner(owner) {
+    if (!owner || ![owner.accountId, owner.userId].every(id => typeof id === 'string' && /^[A-Za-z0-9_-]{1,128}$/.test(id))) {
+        throw new Error('INVALID_MEMORY_OWNER');
+    }
+    return Object.freeze({ accountId: owner.accountId, userId: owner.userId });
+}
+export function sameOwner(a, b) {
+    return a.accountId === b.accountId && a.userId === b.userId;
+}

package/dist/worker-tools.d.ts

@@ -0,0 +1,8 @@
+import { type ToolDefinition, type ExtensionFactory, type BashOperations } from '@earendil-works/pi-coding-agent';
+import type { NativeToolWorker } from './tool-worker.js';
+export type IsolatedToolExecutor = Pick<NativeToolWorker, 'workspace' | 'execute' | 'assertIsolated'>;
+/** Preserve pi schemas, normalization and rendering; replace every execution function. */
+export declare function createIsolatedToolDefinitions(worker: IsolatedToolExecutor): ToolDefinition[];
+/** Interactive ! / !! commands must use the same worker as model Bash calls. */
+export declare function createIsolatedBashOperations(worker: IsolatedToolExecutor): BashOperations;
+export declare function createIsolatedToolsExtension(worker: IsolatedToolExecutor): ExtensionFactory;

package/dist/worker-tools.js

@@ -0,0 +1,64 @@
+import { createReadToolDefinition, createWriteToolDefinition, createEditToolDefinition, createBashToolDefinition, createGrepToolDefinition, createFindToolDefinition, createLsToolDefinition, } from '@earendil-works/pi-coding-agent';
+import { resolve } from 'node:path';
+function toolResult(value) {
+    if (!value || typeof value !== 'object')
+        throw new Error('INVALID_WORKER_TOOL_RESULT');
+    const content = value.content;
+    if (!Array.isArray(content) || !content.every(item => item && typeof item === 'object'
+        && ((item.type === 'text' && typeof item.text === 'string')
+            || (item.type === 'image' && typeof item.data === 'string' && typeof item.mimeType === 'string')))) {
+        throw new Error('INVALID_WORKER_TOOL_RESULT');
+    }
+    return value;
+}
+function checkWorkspace(worker, cwd) {
+    if (resolve(cwd) !== resolve(worker.workspace))
+        throw new Error('MEMORY_WORKER_WORKSPACE_MISMATCH');
+}
+/** Preserve pi schemas, normalization and rendering; replace every execution function. */
+export function createIsolatedToolDefinitions(worker) {
+    const cwd = worker.workspace;
+    const definitions = [createReadToolDefinition(cwd), createWriteToolDefinition(cwd), createEditToolDefinition(cwd),
+        createBashToolDefinition(cwd), createGrepToolDefinition(cwd), createFindToolDefinition(cwd), createLsToolDefinition(cwd)];
+    return definitions.map(definition => ({ ...definition,
+        async execute(_callId, parameters, signal, onUpdate, context) {
+            checkWorkspace(worker, context.cwd);
+            if (!parameters || typeof parameters !== 'object' || Array.isArray(parameters))
+                throw new Error('INVALID_WORKER_TOOL_ARGUMENTS');
+            await worker.assertIsolated();
+            return toolResult(await worker.execute(definition.name, parameters, signal, update => onUpdate?.(toolResult(update))));
+        },
+    }));
+}
+/** Interactive ! / !! commands must use the same worker as model Bash calls. */
+export function createIsolatedBashOperations(worker) {
+    return {
+        async exec(command, cwd, options) {
+            checkWorkspace(worker, cwd);
+            await worker.assertIsolated();
+            // Never copy options.env from the privileged host into the worker.
+            const result = await worker.execute('user_bash', { command, timeout: options.timeout }, options.signal, update => {
+                if (!update || typeof update !== 'object' || typeof update.data !== 'string') {
+                    throw new Error('INVALID_WORKER_SHELL_UPDATE');
+                }
+                options.onData(Buffer.from(update.data, 'base64'));
+            });
+            const exitCode = result && typeof result === 'object' ? result.exitCode : undefined;
+            if (exitCode !== null && !Number.isInteger(exitCode))
+                throw new Error('INVALID_WORKER_SHELL_RESULT');
+            return { exitCode: exitCode };
+        },
+    };
+}
+export function createIsolatedToolsExtension(worker) {
+    const definitions = createIsolatedToolDefinitions(worker);
+    const operations = createIsolatedBashOperations(worker);
+    return pi => {
+        for (const definition of definitions)
+            pi.registerTool(definition);
+        pi.on('user_bash', event => {
+            checkWorkspace(worker, event.cwd);
+            return { operations };
+        });
+    };
+}