@noopolis/daimon 0.1.2 → 0.2.0

package/dist/pi/cliEngineSpawn.js

@@ -0,0 +1,164 @@
+import { spawn } from "node:child_process";
+import { trackCliChild } from "./cliProcess.js";
+import { cliChildEnvironment } from "./cliEnvironment.js";
+import { codexFilesystemRules } from "./codexFilesystemRules.js";
+export const GROK_STRICT_SANDBOX_PROFILE = "strict";
+export const renderGrokSandboxArgs = (commandArgs, profile) => [...assertSafeGrokCommandArgs(commandArgs), "--sandbox", profile];
+/**
+ * Codex's `--json` stream is unconditional: it is the only output shape that
+ * carries `turn.completed.usage`, and an unmetered Codex turn is one whose
+ * subscription cost is invisible. The guarded arguments make this Daimon's
+ * security and metering boundary rather than a caller-controlled format.
+ *
+ * `model`/`reasoningEffort` come from parsed, bounded organization-runtime
+ * config, but are rendered defensively anyway: each is emitted as a single
+ * `--flag=value` argv token (never a bare flag followed by a separate value
+ * token), so a value that itself looks like a flag (e.g. `--sandbox`) can
+ * never be parsed as a second, independent argument — the same shape already
+ * used below for `mcp_servers.daimon.url=`. Omitting both fields leaves Codex's
+ * model defaults unchanged.
+ *
+ * The per-wake MCP server is always enabled and required. Otherwise Codex can
+ * continue a normal turn with only built-in tools after MCP startup fails.
+ * Subscription apps and installed plugins are not caller-declared tools.
+ * Disable their discovery per invocation, including with strict config: the
+ * CLI's defaults can otherwise add them even when user config is ignored.
+ */
+export const renderCodexArgs = (options, cwd, endpoint, sandbox = options.codexSandbox?.mode ?? process.env.DAIMON_CODEX_SANDBOX ?? "danger-full-access") => {
+    const strictPolicy = options.codexSandbox;
+    if (strictPolicy !== undefined && (strictPolicy.mode !== "workspace-write" || strictPolicy.networkAccess !== false || strictPolicy.webSearch !== "disabled" || Object.keys(strictPolicy).length !== 3)) {
+        throw new Error("Codex sandbox policy is Daimon-owned and must be workspace-write with network and web search disabled");
+    }
+    const effectiveSandbox = strictPolicy?.mode ?? sandbox;
+    const profileName = "daimon-strict";
+    const policyArgs = strictPolicy === undefined ? [] : [
+        "--ignore-user-config",
+        "--ignore-rules",
+        "--strict-config",
+        "-c", "web_search=\"disabled\"",
+        "-c", `default_permissions=${JSON.stringify(profileName)}`,
+        "-c", renderCodexPermissionProfile(profileName, options.codexSandboxProtectedPaths ?? [], options.codexSandboxReadablePaths ?? [], cwd),
+        "-c", "approval_policy=\"never\"",
+        "-c", `mcp_servers={daimon={url=\"${endpoint}\",enabled=true,default_tools_approval_mode=\"approve\"}}`
+    ];
+    return [...assertSafeCodexCommandArgs(options.commandArgs, strictPolicy !== undefined), "exec", ...(strictPolicy === undefined ? ["--sandbox", effectiveSandbox] : []), ...policyArgs, "--skip-git-repo-check",
+        ...(options.model === undefined ? [] : [`--model=${options.model}`]),
+        ...(options.reasoningEffort === undefined ? [] : ["-c", `model_reasoning_effort=${options.reasoningEffort}`]),
+        "--color", "never", "--json", "-C", cwd,
+        "-c", `mcp_servers.daimon.url=${endpoint}`,
+        "-c", "features.apps=false", "-c", "features.plugins=false",
+        "-c", "mcp_servers.daimon.enabled=true",
+        "-c", "mcp_servers.daimon.required=true", "-"];
+};
+export const renderCodexPermissionProfile = (profileName, protectedPaths, readablePaths = [], workspacePath) => {
+    const filesystem = {
+        ":workspace_roots": { ".": "write" },
+        ...codexFilesystemRules(protectedPaths, readablePaths, workspacePath)
+    };
+    return `permissions=${tomlInline({ [profileName]: {
+            extends: ":workspace",
+            filesystem,
+            network: { enabled: false }
+        } })}`;
+};
+/**
+ * AGY's headless invocation.
+ *
+ * `--output-format stream-json` is unconditional: it is the only shape that
+ * carries `result.usage`, and an AGY turn that is not metered is an AGY turn
+ * whose subscription cost is invisible (see `agyHeadlessResult.ts`).
+ *
+ * `--dangerously-skip-permissions` is required for tools to work at all. AGY's
+ * default headless permission mode is `request-review`, and there is no
+ * reviewer inside a container, so a tool call can never be approved without it;
+ * the live probe that proved AGY's MCP tool calling ran with exactly this flag
+ * and reported `permission_mode: always-proceed`. Every Daimon CLI agent mounts
+ * at least the protected bash tool (`piHarness.ts`), so there is no AGY wake
+ * for which this is unnecessary and no conditional worth forking behavior over.
+ *
+ * SECURITY: the flag also auto-approves AGY's own ~50 built-in tools —
+ * `run_command`, `write_to_file`, the browser tools — none of which Daimon
+ * mediates. Inside the container that is the exposure Codex already has
+ * (`--sandbox danger-full-access`), but unlike Grok there is no kernel-enforced
+ * per-agent profile confining it to this agent's own workspace and runtime
+ * home. `DAIMON_AGY_SANDBOX=1` opts into AGY's own terminal-restricting
+ * sandbox; it is off by default only because its interaction with the MCP
+ * transport could not be verified without spending the operator's subscription
+ * quota, and shipping an unverified default that silently disables every tool
+ * would be worse than shipping the exposure with this note on it.
+ */
+export const renderAgyArgs = (options, prompt, sandbox = process.env.DAIMON_AGY_SANDBOX === "1") => [
+    ...assertSafeAgyCommandArgs(options.commandArgs),
+    "--print", prompt,
+    "--output-format", "stream-json",
+    "--dangerously-skip-permissions",
+    ...(sandbox ? ["--sandbox"] : []),
+    ...(options.timeoutMs === undefined ? [] : ["--print-timeout", `${options.timeoutMs}ms`])
+];
+export const spawnEngine = (options, prompt, input, endpoint, wakeId) => {
+    const command = options.command ?? options.engine;
+    const env = cliChildEnvironment([
+        ...(options.redactedEnvironmentNames ?? []),
+        ...(input.daimonSecretEnvironmentNames ?? [])
+    ], input.runtimeHomePath, {
+        dbusSessionBusAddress: options.engine === "agy" ? options.dbusSessionBusAddress : undefined,
+        engine: options.engine,
+        executablePath: options.command,
+        engineHomePath: options.engineHomePath,
+        wakeId
+    });
+    if (options.engine === "codex") {
+        const child = trackCliChild(spawn(command, renderCodexArgs(options, input.cwd, endpoint), { cwd: input.cwd, env, detached: process.platform !== "win32", stdio: ["pipe", "pipe", "pipe"] }));
+        child.stdin.on("error", () => undefined);
+        child.stdin.write(prompt);
+        child.stdin.end();
+        return child;
+    }
+    // Production supplies a Daimon-owned custom profile whose enforcement and
+    // explicit realm/peer denies are verified before every Grok process.
+    const args = options.engine === "grok"
+        ? [...renderGrokSandboxArgs(options.commandArgs, options.grokSandboxProfile ?? GROK_STRICT_SANDBOX_PROFILE), "--always-approve", "--no-subagents", "--single", prompt, "--no-memory", "--disable-web-search", "--cwd", input.cwd,
+            "--output-format", "streaming-messages-json"]
+        : renderAgyArgs(options, prompt);
+    return trackCliChild(spawn(command, args, { cwd: input.cwd, env, detached: process.platform !== "win32", stdio: ["ignore", "pipe", "pipe"] }));
+};
+/**
+ * AGY's output format, permission mode, sandbox, and session continuity are
+ * Daimon-owned, exactly as Grok's sandbox and approval flags are. A caller
+ * cannot re-open the permission boundary, silence the metering stream, or turn
+ * a per-wake cold process into a resumed conversation through `commandArgs`.
+ */
+const assertSafeAgyCommandArgs = (args) => {
+    const values = args ?? [];
+    if (values.some((value) => /^(?:--dangerously-skip-permissions|--sandbox|--output-format|--print|--prompt|--prompt-interactive|--mode|--continue|--conversation|-p|-i|-c)(?:=|$)/u.test(value))) {
+        throw new Error("AGY security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+/** Caller arguments cannot reopen Codex's sandbox, output, cwd, or config boundary. */
+const assertSafeCodexCommandArgs = (args, strictPolicy = false) => {
+    const values = args ?? [];
+    const pattern = /^(?:--json|--sandbox|--dangerously-bypass-approvals-and-sandbox|--output-last-message|--config|--ignore-user-config|--ignore-rules|--skip-git-repo-check|--color|--cd|--enable|-c|-C)(?:=|$)/u;
+    const strictPattern = /^(?:--strict-config|--profile|-p|-P|--permissions-profile|--enable|--disable|--add-dir|--search)(?:=|$)|^(?:default_permissions|permissions)(?:=|\.)/u;
+    if (values.some((value) => pattern.test(value) || (strictPolicy && strictPattern.test(value)))) {
+        throw new Error("Codex security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+const assertSafeGrokCommandArgs = (args) => {
+    const values = args ?? [];
+    if (values.some((value) => /^(?:--sandbox|--always-approve|--permission-mode|--leader-socket)(?:=|$)/u.test(value))) {
+        throw new Error("Grok security-boundary arguments are Daimon-owned");
+    }
+    return values;
+};
+function tomlInline(value) {
+    if (typeof value === "string")
+        return JSON.stringify(value);
+    if (typeof value === "boolean")
+        return value ? "true" : "false";
+    if (value !== null && typeof value === "object" && !Array.isArray(value)) {
+        return `{${Object.entries(value).map(([key, entry]) => `${JSON.stringify(key)}=${tomlInline(entry)}`).join(",")}}`;
+    }
+    throw new Error("unsupported Codex permission profile value");
+}

package/dist/pi/cliEnvironment.d.ts

@@ -0,0 +1,12 @@
+type CliEnvironmentIntent = Readonly<{
+    dbusSessionBusAddress?: string;
+    engine?: "codex" | "grok" | "agy";
+    executablePath?: string;
+    engineHomePath?: string;
+    wakeId?: string;
+}>;
+export declare const DAIMON_WAKE_ID_ENV: "DAIMON_WAKE_ID";
+/** Build a positive child environment; agent CLIs never inherit host secrets. */
+export declare const cliChildEnvironment: (_redactedNames: readonly string[], runtimeHomePath?: string, intent?: CliEnvironmentIntent) => NodeJS.ProcessEnv;
+export {};
+//# sourceMappingURL=cliEnvironment.d.ts.map

package/dist/pi/cliEnvironment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliEnvironment.d.ts","sourceRoot":"","sources":["../../src/pi/cliEnvironment.ts"],"names":[],"mappings":"AAEA,KAAK,oBAAoB,GAAG,QAAQ,CAAC;IACnC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,MAAM,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;IAClC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC,CAAC;AAEH,eAAO,MAAM,kBAAkB,EAAG,gBAAyB,CAAC;AAE5D,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,GAC9B,gBAAgB,SAAS,MAAM,EAAE,EAAE,kBAAkB,MAAM,EAAE,SAAQ,oBAAyB,KAC7F,MAAM,CAAC,UA2BT,CAAC"}

package/dist/pi/cliEnvironment.js

@@ -0,0 +1,32 @@
+import path from "node:path";
+export const DAIMON_WAKE_ID_ENV = "DAIMON_WAKE_ID";
+/** Build a positive child environment; agent CLIs never inherit host secrets. */
+export const cliChildEnvironment = (_redactedNames, runtimeHomePath, intent = {}) => {
+    if (runtimeHomePath === undefined) {
+        // This legacy branch is only used by the standalone Pi helpers, which do
+        // not claim production organization-runtime isolation.
+        return { PATH: process.env.PATH, LANG: process.env.LANG ?? "C", LC_ALL: process.env.LC_ALL ?? "C", TZ: process.env.TZ ?? "UTC" };
+    }
+    const engine = intent.engine;
+    const engineVariable = engine === "codex" ? "CODEX_HOME" : engine === "grok" ? "GROK_HOME" : engine === "agy" ? "ANTIGRAVITY_CLI_HOME" : undefined;
+    const engineHome = intent.engineHomePath;
+    const keyringBus = engine === "agy" ? localSecretServiceBus(intent.dbusSessionBusAddress) : undefined;
+    return {
+        // The executable is pinned absolutely. PATH remains only for a trusted
+        // interpreter in a local shebang (and never selects the engine itself).
+        PATH: intent.executablePath === undefined ? process.env.PATH : `${path.dirname(intent.executablePath)}${path.delimiter}${path.dirname(process.execPath)}`,
+        LANG: process.env.LANG ?? "C",
+        LC_ALL: process.env.LC_ALL ?? "C",
+        TZ: process.env.TZ ?? "UTC",
+        HOME: runtimeHomePath,
+        XDG_CONFIG_HOME: `${runtimeHomePath}/.config`,
+        XDG_DATA_HOME: `${runtimeHomePath}/.local/share`,
+        XDG_STATE_HOME: `${runtimeHomePath}/.local/state`,
+        XDG_CACHE_HOME: `${runtimeHomePath}/.cache`,
+        TMPDIR: `${runtimeHomePath}/.tmp`,
+        ...(engineVariable === undefined || engineHome === undefined ? {} : { [engineVariable]: engineHome }),
+        ...(keyringBus === undefined ? {} : { DBUS_SESSION_BUS_ADDRESS: keyringBus }),
+        ...(intent.wakeId === undefined ? {} : { [DAIMON_WAKE_ID_ENV]: intent.wakeId })
+    };
+};
+const localSecretServiceBus = (value) => value !== undefined && /^unix:(?:path|abstract)=[^;,\r\n]+$/u.test(value) ? value : undefined;

package/dist/pi/cliMcpRegistration.d.ts

@@ -0,0 +1,61 @@
+import { type ChildProcess } from "node:child_process";
+/**
+ * Per-wake MCP endpoint registration for the CLI engines that cannot take the
+ * endpoint on their own command line.
+ *
+ * Codex takes `-c mcp_servers.daimon.url=<endpoint>` per invocation and needs
+ * nothing here. AGY is config-file driven, so Daimon registers the ephemeral
+ * endpoint before the turn and removes it afterwards through its own `mcp
+ * add`/`mcp remove` subcommands. Grok no longer uses this path: its project
+ * scope is ignored in untrusted workspaces on 1.0.34, so its endpoint is written
+ * into the agent's Daimon-owned GROK_HOME (`grokHomeMcpRegistration.ts`).
+ *
+ * The registration is deliberately performed by the engine CLI rather than by
+ * writing its config file directly: the file format belongs to the engine, and
+ * a format change absorbed by `mcp add` would silently disable every tool if
+ * Daimon hand-wrote it instead.
+ */
+export type CliMcpRegistration = Readonly<{
+    close: () => Promise<void>;
+}>;
+export type CliMcpRegistrationInput = Readonly<{
+    addArgs: readonly string[];
+    command: string;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    failureClassifier?: (diagnostic: string) => Error | undefined;
+    onChild: (child: ChildProcess) => void;
+    onChildSettled: (child: ChildProcess) => void;
+    removeArgs: readonly string[];
+    secretValues: readonly string[];
+    verify?: () => Promise<void>;
+}>;
+/**
+ * Registers the endpoint, returning a single-shot remover.
+ *
+ * `verify` is the caller's production authority (the Grok sandbox profile
+ * check); it runs before both the add and the remove so a registration can
+ * never be issued against an unverified engine.
+ */
+export declare const registerCliMcpServer: (input: CliMcpRegistrationInput) => Promise<CliMcpRegistration>;
+/** The MCP server name every CLI engine registers Daimon's per-wake endpoint under. */
+export declare const DAIMON_MCP_SERVER_NAME: "daimon";
+/**
+ * `agy mcp add --type http <name> <url>`.
+ *
+ * AGY has no per-invocation MCP flag, so this writes into the config file AGY
+ * reads at `$HOME/.gemini/config/mcp_config.json`. That is safe to do per wake
+ * because Daimon already gives every AGY agent its own `HOME`
+ * (`runtimeHomePath`, see `cliChildEnvironment`): two agents in one
+ * organization cannot collide, and a developer's real `~/.gemini` is never on
+ * the path a runtime child sees. `add` is an upsert, so a stale entry left by a
+ * crashed wake is replaced rather than duplicated.
+ *
+ * No `--header` is passed: Daimon's tool endpoint is an unauthenticated
+ * loopback listener on an ephemeral port, exactly as Codex and Grok receive it.
+ * Adding a bearer header here would put a secret in `argv` and in a file on the
+ * agent's durable runtime home for no gain.
+ */
+export declare const renderAgyMcpAddArgs: (commandArgs: readonly string[] | undefined, endpoint: string) => string[];
+export declare const renderAgyMcpRemoveArgs: (commandArgs: readonly string[] | undefined) => string[];
+//# sourceMappingURL=cliMcpRegistration.d.ts.map

package/dist/pi/cliMcpRegistration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliMcpRegistration.d.ts","sourceRoot":"","sources":["../../src/pi/cliMcpRegistration.ts"],"names":[],"mappings":"AAAA,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAK9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAAC;AAE1E,MAAM,MAAM,uBAAuB,GAAG,QAAQ,CAAC;IAC7C,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,iBAAiB,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,KAAK,GAAG,SAAS,CAAC;IAC9D,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IACvC,cAAc,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC;IAC9C,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC,CAAC;AAsCH;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,GAC/B,OAAO,uBAAuB,KAC7B,OAAO,CAAC,kBAAkB,CAU5B,CAAC;AAEF,uFAAuF;AACvF,eAAO,MAAM,sBAAsB,EAAG,QAAiB,CAAC;AAExD;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,SAAS,MAAM,EAAE,GAAG,SAAS,EAAE,UAAU,MAAM,KAAG,MAAM,EACb,CAAC;AAE7F,eAAO,MAAM,sBAAsB,GAAI,aAAa,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,EACvB,CAAC"}

package/dist/pi/cliMcpRegistration.js

@@ -0,0 +1,75 @@
+import { spawn } from "node:child_process";
+import { readChild } from "./cliChildOutput.js";
+import { terminateChild, trackCliChild } from "./cliProcess.js";
+/**
+ * `swept` decides whether the session's dispose path may kill this child.
+ *
+ * The *add* is swept: a dispose that arrives while the endpoint is still being
+ * registered should tear that child down with everything else. The *remove* is
+ * deliberately not, because dispose is precisely the caller that is waiting on
+ * it to finish — sweeping it makes the session terminate the cleanup it is
+ * awaiting, and the resulting `CLI engine exited SIGTERM` is then reported as a
+ * failed `stop()` for a wake that was cancelled on purpose. It stays bounded
+ * without the sweep: `readChild`'s 30s deadline aborts and terminates it, and
+ * `trackCliChild` still owns it for process exit.
+ */
+const runRegistrationCommand = async (input, args, swept) => {
+    const child = trackCliChild(spawn(input.command, args, {
+        cwd: input.cwd,
+        env: input.env,
+        detached: process.platform !== "win32",
+        stdio: ["ignore", "pipe", "pipe"]
+    }));
+    if (swept)
+        input.onChild(child);
+    try {
+        await readChild(child, 30_000, input.secretValues, {
+            ...(input.failureClassifier === undefined ? {} : { failureClassifier: input.failureClassifier })
+        });
+    }
+    finally {
+        // An engine CLI may let an auxiliary process outlive its leader. Do not
+        // release the tracked setup child until its detached group is quiescent.
+        await terminateChild(child);
+        if (swept)
+            input.onChildSettled(child);
+    }
+};
+/**
+ * Registers the endpoint, returning a single-shot remover.
+ *
+ * `verify` is the caller's production authority (the Grok sandbox profile
+ * check); it runs before both the add and the remove so a registration can
+ * never be issued against an unverified engine.
+ */
+export const registerCliMcpServer = async (input) => {
+    await input.verify?.();
+    await runRegistrationCommand(input, input.addArgs, true);
+    let closePromise;
+    return {
+        close: () => closePromise ??= (async () => {
+            await input.verify?.();
+            await runRegistrationCommand(input, input.removeArgs, false);
+        })()
+    };
+};
+/** The MCP server name every CLI engine registers Daimon's per-wake endpoint under. */
+export const DAIMON_MCP_SERVER_NAME = "daimon";
+/**
+ * `agy mcp add --type http <name> <url>`.
+ *
+ * AGY has no per-invocation MCP flag, so this writes into the config file AGY
+ * reads at `$HOME/.gemini/config/mcp_config.json`. That is safe to do per wake
+ * because Daimon already gives every AGY agent its own `HOME`
+ * (`runtimeHomePath`, see `cliChildEnvironment`): two agents in one
+ * organization cannot collide, and a developer's real `~/.gemini` is never on
+ * the path a runtime child sees. `add` is an upsert, so a stale entry left by a
+ * crashed wake is replaced rather than duplicated.
+ *
+ * No `--header` is passed: Daimon's tool endpoint is an unauthenticated
+ * loopback listener on an ephemeral port, exactly as Codex and Grok receive it.
+ * Adding a bearer header here would put a secret in `argv` and in a file on the
+ * agent's durable runtime home for no gain.
+ */
+export const renderAgyMcpAddArgs = (commandArgs, endpoint) => [...(commandArgs ?? []), "mcp", "add", "--type", "http", DAIMON_MCP_SERVER_NAME, endpoint];
+export const renderAgyMcpRemoveArgs = (commandArgs) => [...(commandArgs ?? []), "mcp", "remove", DAIMON_MCP_SERVER_NAME];

package/dist/pi/cliProcess.d.ts

@@ -0,0 +1,7 @@
+import type { ChildProcess } from "node:child_process";
+export declare class CliProcessCleanupError extends Error {
+    constructor(operation: string, cause?: unknown);
+}
+export declare const trackCliChild: (child: ChildProcess) => ChildProcess;
+export declare const terminateChild: (child: ChildProcess) => Promise<void>;
+//# sourceMappingURL=cliProcess.d.ts.map

package/dist/pi/cliProcess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cliProcess.d.ts","sourceRoot":"","sources":["../../src/pi/cliProcess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAQvD,qBAAa,sBAAuB,SAAQ,KAAK;gBAC5B,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAItD;AAED,eAAO,MAAM,aAAa,GAAI,OAAO,YAAY,KAAG,YAanD,CAAC;AA8FF,eAAO,MAAM,cAAc,GAAU,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAqBtE,CAAC"}

package/dist/pi/cliProcess.js

@@ -0,0 +1,132 @@
+import { readdir, readFile } from "node:fs/promises";
+const childStates = new WeakMap();
+const delay = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds));
+export class CliProcessCleanupError extends Error {
+    constructor(operation, cause) {
+        super(`CLI process cleanup failed while ${operation}`, { cause });
+        this.name = "CliProcessCleanupError";
+    }
+}
+export const trackCliChild = (child) => {
+    if (childStates.has(child))
+        return child;
+    let resolveClose;
+    // Keep the process group id at spawn time. `child.pid` is no longer a useful
+    // source of truth after the leader exits while one of its descendants lives.
+    const state = {
+        closed: false,
+        close: new Promise((resolve) => { resolveClose = resolve; }),
+        ...(process.platform === "win32" || child.pid === undefined ? {} : { pgid: child.pid })
+    };
+    child.once("close", () => { state.closed = true; resolveClose(); });
+    childStates.set(child, state);
+    return child;
+};
+const groupExists = (pgid) => {
+    try {
+        process.kill(-pgid, 0);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        throw new CliProcessCleanupError(`inspecting process group ${pgid}`, error);
+    }
+};
+const parseLinuxProcessState = (stat) => {
+    const commandEnd = stat.lastIndexOf(")");
+    if (commandEnd < 0)
+        return undefined;
+    const fields = stat.slice(commandEnd + 1).trim().split(/\s+/u);
+    const group = Number(fields[2]);
+    return fields.length >= 3 && Number.isInteger(group) ? { state: fields[0], group } : undefined;
+};
+const linuxGroupScan = async (pgid, procRoot = "/proc") => {
+    let entries;
+    try {
+        entries = await readdir(procRoot);
+    }
+    catch {
+        return "unknown";
+    }
+    for (const entry of entries) {
+        if (!/^\d+$/u.test(entry))
+            continue;
+        try {
+            const processState = parseLinuxProcessState(await readFile(`${procRoot}/${entry}/stat`, "utf8"));
+            if (processState?.group !== pgid)
+                continue;
+            if (processState.state !== "Z" && processState.state !== "X")
+                return "live";
+        }
+        catch (error) {
+            // ENOENT is the process exiting mid-scan, which is exactly what settling
+            // looks like; anything else means the snapshot cannot be trusted.
+            if (error.code !== "ENOENT")
+                return "unknown";
+        }
+    }
+    return "settled";
+};
+const groupSettled = async (pgid) => {
+    if (!groupExists(pgid))
+        return true;
+    if (process.platform !== "linux")
+        return false;
+    return await linuxGroupScan(pgid) === "settled";
+};
+const signalGroup = (pgid, signal) => {
+    try {
+        process.kill(-pgid, signal);
+        return true;
+    }
+    catch (error) {
+        if (error.code === "ESRCH")
+            return false;
+        throw new CliProcessCleanupError(`signaling process group ${pgid}`, error);
+    }
+};
+const waitForGroupSettled = async (pgid, milliseconds) => {
+    const deadline = Date.now() + milliseconds;
+    while (true) {
+        try {
+            if (await groupSettled(pgid))
+                return true;
+        }
+        catch (error) {
+            // EPERM is not evidence that a group is settled. Keep waiting for
+            // ESRCH or, on Linux, a /proc snapshot containing only exited zombies.
+            if (!isPermissionError(error) || Date.now() >= deadline)
+                throw error;
+        }
+        if (Date.now() >= deadline)
+            return false;
+        await delay(10);
+    }
+};
+const isPermissionError = (error) => error instanceof CliProcessCleanupError
+    && error.cause?.code === "EPERM";
+export const terminateChild = async (child) => {
+    trackCliChild(child);
+    const state = childStates.get(child);
+    const pgid = state.pgid;
+    if (pgid !== undefined && !await groupSettled(pgid)) {
+        if (signalGroup(pgid, "SIGTERM") && !await waitForGroupSettled(pgid, 1_000)) {
+            signalGroup(pgid, "SIGKILL");
+            if (!await waitForGroupSettled(pgid, 1_000)) {
+                throw new CliProcessCleanupError(`waiting for process group ${pgid} to exit`);
+            }
+        }
+    }
+    else if (child.exitCode === null && child.signalCode === null) {
+        child.kill("SIGTERM");
+    }
+    // A `close` event proves that Node released its pipes. ESRCH, or a Linux
+    // process-group snapshot containing only exited zombies, proves that no
+    // detached descendant can still execute. Both are required for success.
+    if (!state.closed)
+        await state.close;
+    if (pgid !== undefined && !await groupSettled(pgid)) {
+        throw new CliProcessCleanupError(`waiting for process group ${pgid} to exit`);
+    }
+};

package/dist/pi/cliSession.d.ts

@@ -1,46 +1,106 @@
-import type { ChildProcess } from "node:child_process";
 import type { ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { TurnUsageOutcome } from "../runtime/turnUsageLedger.js";
+import { type AgyTurnUsage } from "./agyHeadlessResult.js";
+import { type CodexTurnUsage } from "./codexHeadlessResult.js";
 import type { PiSessionLike } from "./piAgentHandle.js";
 import type { PiSessionFactoryInput } from "./piHarness.js";
 export type CliEngineKind = "agy" | "codex" | "grok";
+/**
+ * The per-wake tool-call bound for AGY, and the one place it is decided.
+ *
+ * Codex and Grok leave this `undefined` — their only bound is the wake
+ * deadline. AGY does not get that treatment, for a measured reason: its
+ * terminal usage frame is the *sum* over the turn's model steps, and each tool
+ * step resends the whole context. The live capture is 13,796 total tokens for a
+ * tool-free turn and 45,381 for a turn with a single call against an
+ * empty-schema tool — one call roughly triples the wake. An unbounded loop on
+ * the one engine whose subscription quota is currently the operator's only
+ * working credential is a cost hazard, not a capability.
+ *
+ * 16 is chosen so a realistic wake is never truncated (read a few declared MCP
+ * tools, then send one or two Moltnet messages) while the worst case is bounded
+ * at roughly a quarter-million tokens instead of "whatever fits in 180s". The
+ * bound degrades gracefully rather than failing the wake: exceeding it returns
+ * `McpToolTurnLimitError` to the model as a tool *error*, so the agent can still
+ * finish its turn and reply.
+ */
+export declare const AGY_MAX_TOOL_TURNS = 16;
+export { DAIMON_CODEX_WAKE_TIMEOUT_MS_ENV, DAIMON_CODEX_WAKE_TOKEN_CEILING_ENV, DAIMON_ENGINE_WAKE_TIMEOUT_MS_ENV, DAIMON_ENGINE_WAKE_TOKEN_CEILING_ENV, DEFAULT_CODEX_WAKE_TIMEOUT_MS, DEFAULT_CODEX_WAKE_TOKEN_CEILING, resolveCodexWakeTimeoutMs, resolveCodexWakeTokenCeiling, resolveEngineWakeLimitOverrides } from "./engineWakeLimits.js";
 export type CliEngineOptions = {
     readonly commandArgs?: readonly string[];
     readonly command?: string;
-    readonly maxToolTurns: number;
+    /** Internal production authority: rechecked immediately before each child. */
+    readonly verifyExecutable?: () => Promise<void>;
+    readonly verifyRuntimePaths?: () => Promise<void>;
+    readonly engineHomePath?: string;
+    readonly maxToolTurns?: number;
     readonly onToolsMounted?: (tools: readonly ToolDefinition[]) => void;
-    readonly timeoutMs: number;
+    readonly timeoutMs?: number;
+    /** Daimon-owned identity envelope prepended exactly once to every wake. */
+    readonly identityPrompt?: string;
     readonly redactedEnvironmentNames?: readonly string[];
+    /** Internal secret-file authority used only for exact reply redaction. */
+    readonly credentialSecretValues?: () => Promise<readonly string[]>;
+    /** Internal production boundary; confirms the custom kernel profile before every Grok process. */
+    readonly verifyGrokSandbox?: () => Promise<void>;
+    readonly grokSandboxProfile?: string;
+    readonly grokBrokerTurn?: (prompt: string, mcpEndpoint: string, signal: AbortSignal) => Promise<string>;
+    /** Codex only: kills the child and fails the wake once a turn's own reported usage reaches this. */
+    readonly codexTokenCeiling?: number;
+    /** Codex only: pinned model name, rendered as `--model=<value>`. Omitted, Codex resolves its own default. */
+    readonly model?: string;
+    /** Codex only: pinned `model_reasoning_effort`, rendered as `-c model_reasoning_effort=<value>`. */
+    readonly reasoningEffort?: string;
+    readonly codexSandbox?: {
+        readonly mode: "workspace-write";
+        readonly networkAccess: false;
+        readonly webSearch: "disabled";
+    };
+    /** Internal production boundary: absolute host paths denied to Codex model-run local commands. */
+    readonly codexSandboxProtectedPaths?: readonly string[];
+    /** Internal production boundary: own non-secret runtime paths a strict Codex turn may read. */
+    readonly codexSandboxReadablePaths?: readonly string[];
+    /**
+     * Advisory per-turn metering sink for the engines whose headless stream
+     * reports token usage and that do not run behind the Grok engine broker
+     * (which meters its own turns). It never fails a turn that published.
+     *
+     * `outcome` says whether the wake this usage belongs to went on to succeed.
+     * A failed wake spends real money, so it is metered exactly like a
+     * successful one and the reader tells them apart by this field rather than
+     * by the row's absence.
+     */
+    readonly onTurnUsage?: (usage: AgyTurnUsage | CodexTurnUsage, outcome: TurnUsageOutcome) => Promise<void>;
+    /**
+     * Codex only: advisory per-model-request instrumentation, called once per
+     * wake with the thread id Codex announced on `thread.started`.
+     *
+     * The usage ledger's row is one sum per wake and cannot distinguish a cold
+     * prefix replayed per request from a context that grows per request. The
+     * per-request detail exists in the rollout Codex already writes for this
+     * thread; the thread id is the only thing that identifies *which* rollout,
+     * which is why it is carried out of the stream rather than inferred from
+     * whichever file on disk is newest. Errors here never reach the wake.
+     */
+    readonly onCodexTurnRequests?: (threadId: string) => Promise<void>;
 } & ({
     readonly engine: "codex" | "grok";
 } | {
-    /** AGY has no MCP client. Selecting this state explicitly permits tool-free participation. */
+    readonly dbusSessionBusAddress?: string;
     readonly engine: "agy";
-    readonly toolAccess: "none";
 });
-type SessionInput = {
+export type CliSessionInput = {
     readonly cwd: string;
     readonly customTools?: ToolDefinition[];
     readonly daimonSecretEnvironmentNames?: readonly string[];
+    readonly runtimeHomePath?: string;
 };
-export declare const readChild: (child: ChildProcess, timeoutMs: number, secretValues: readonly string[]) => Promise<string>;
-export declare const renderCodexArgs: (options: Pick<CliEngineOptions, "commandArgs">, cwd: string, endpoint: string | undefined, sandbox?: string) => string[];
-export declare const spawnEngine: (options: CliEngineOptions, prompt: string, input: SessionInput, endpoint: string | undefined) => ChildProcess;
+export declare const prepareCliRuntimeHome: (runtimeHomePath: string | undefined) => Promise<void>;
+export { terminateChild } from "./cliProcess.js";
+export { CLI_ENGINE_MAX_DIAGNOSTIC_BYTES, CLI_ENGINE_MAX_OUTPUT_BYTES, readChild } from "./cliChildOutput.js";
 export declare const createCliSessionFactory: (options: CliEngineOptions) => (input: PiSessionFactoryInput) => Promise<{
     session: PiSessionLike;
 }>;
-export interface EngineRunResult {
-    readonly durationMs: number;
-    readonly outputChars: number;
-    readonly promptChars: number;
-    readonly text: string;
-}
-export declare const runEngineDetailed: (engine: CliEngineKind, prompt: string, paths: {
-    readonly workspacePath: string;
-    readonly runtimeHomePath?: string;
-}) => Promise<EngineRunResult>;
-export declare const runEngine: (engine: CliEngineKind, prompt: string, paths: {
-    readonly workspacePath: string;
-    readonly runtimeHomePath?: string;
-}) => Promise<string>;
-export {};
+export { runEngine, runEngineDetailed, type EngineRunResult } from "./cliEngineRun.js";
+export { renderAgyArgs, renderCodexArgs, spawnEngine } from "./cliEngineSpawn.js";
 //# sourceMappingURL=cliSession.d.ts.map