@north-light/cli 0.3.561 → 0.3.563

package/scripts/sandbox-start.mjs

@@ -0,0 +1,320 @@
+#!/usr/bin/env node
+// scripts/sandbox-start.mjs — `crtr-sandbox-start` (design-fleet, Wake call step 5.1–5.9; C-A2).
+//
+//   node sandbox-start.mjs              start: the node token arrives on stdin (the bootstrap pipes it), the rest in env
+//   node sandbox-start.mjs --wake <id>  signal the broker of execution <id> with SIGUSR1; exit 3 (no_broker) when none runs
+//
+// Plain node, no imports from dist/. A failing start prints `crtr-sandbox-start: failed <reason>` as its last
+// line (the runner's `status` reads it) and exits non-zero.
+import { spawn, spawnSync } from 'node:child_process';
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { existsSync, lstatSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+export const EXIT_NO_BROKER = 3;
+const here = dirname(fileURLToPath(import.meta.url));
+
+class StartFailure extends Error {
+  constructor(reason, detail) { super(detail ?? reason); this.reason = reason; }
+}
+
+/** Broker processes of this sandbox: `{pid, execution}` for each `broker-cli.js ... --epoch <execution> <node>` command line. */
+export function findBrokers(procRoot = '/proc') {
+  const out = [];
+  for (const name of readdirSync(procRoot)) {
+    if (!/^\d+$/.test(name)) continue;
+    let argv;
+    try { argv = readFileSync(join(procRoot, name, 'cmdline'), 'utf8').split('\0'); } catch { continue; }
+    const entry = argv.findIndex((a) => a.endsWith('broker-cli.js'));
+    if (entry < 0) continue;
+    const epoch = argv.indexOf('--epoch', entry);
+    if (epoch < 0 || argv[epoch + 1] === undefined) continue;
+    out.push({ pid: Number(name), execution: argv[epoch + 1], node: argv.filter((a) => a !== '').at(-1) });
+  }
+  return out;
+}
+
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+
+async function stopBroker(pid) {
+  try { process.kill(pid, 'SIGTERM'); } catch { return; }
+  for (let i = 0; i < 100; i++) {
+    await sleep(100);
+    try { process.kill(pid, 0); } catch { return; }
+  }
+  try { process.kill(pid, 'SIGKILL'); } catch { /* gone */ }
+}
+
+export function wake(executionId, brokers = findBrokers()) {
+  const found = brokers.find((b) => b.execution === executionId);
+  if (!found) return EXIT_NO_BROKER;
+  process.kill(found.pid, 'SIGUSR1');
+  return 0;
+}
+
+async function readStdin() {
+  const chunks = [];
+  for await (const chunk of process.stdin) chunks.push(chunk);
+  return Buffer.concat(chunks).toString('utf8').trim();
+}
+
+async function api(baseUrl, token, method, path, body) {
+  const response = await fetch(`${baseUrl.replace(/\/$/, '')}${path}`, {
+    method, headers: { authorization: `Bearer ${token}`, ...(body ? { 'content-type': 'application/json' } : {}) }, ...(body ? { body: JSON.stringify(body) } : {}),
+    signal: AbortSignal.timeout(30_000),
+  });
+  return response;
+}
+
+function run(command, args, options = {}) {
+  return spawnSync(command, args, { encoding: 'utf8', ...options });
+}
+
+/** Whether `path` lies inside `root` (both resolved). */
+export function within(root, path) {
+  const r = resolve(root) + sep;
+  return (resolve(path) + sep).startsWith(r);
+}
+
+/** Step 5.9: a daemon-side extension path under `dist/` maps into the installed release; any other path must already lie in the release or the agent dir. */
+export function mapExtension(path, release, agentDir) {
+  const marker = `${sep}dist${sep}`;
+  const at = path.lastIndexOf(marker);
+  if (at >= 0 && !within(release, path) && !within(agentDir, path)) {
+    const mapped = join(release, path.slice(at + 1));
+    if (existsSync(mapped)) return mapped;
+  }
+  if (!within(release, path) && !within(agentDir, path)) throw new StartFailure('extension_unavailable', `extension path ${path} lies outside the release and the agent dir`);
+  if (!existsSync(path)) throw new StartFailure('extension_unavailable', `extension ${path} does not exist`);
+  return path;
+}
+
+function lstatExists(path) {
+  try { lstatSync(path); return true; } catch { return false; }
+}
+
+function gitIn(cwd, args, timeoutMs) {
+  return run('git', args, { cwd, timeout: timeoutMs });
+}
+
+/** A short-lived credential relay for the start script's own git calls (the broker's relay does not exist until the script ends). It answers
+ *  only `POST /v1/environments/<id>/git-credential`, forwarding it to the control plane with the node token this process holds; the socket
+ *  lives in a private directory and the token is neither written to disk nor placed in any child's environment. */
+async function credentialRelay(apiUrl, token, environmentId) {
+  const dir = mkdtempSync(join(tmpdir(), 'crtr-credential-'));
+  const socketPath = join(dir, 'api.sock');
+  const route = `/v1/environments/${environmentId}/git-credential`;
+  const server = createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (c) => chunks.push(c));
+    req.on('end', async () => {
+      if (req.method !== 'POST' || req.url !== route) return void res.writeHead(404).end();
+      try {
+        const upstream = await api(apiUrl, token, 'POST', route, JSON.parse(Buffer.concat(chunks).toString('utf8')));
+        res.writeHead(upstream.status, { 'content-type': 'application/json' }).end(await upstream.text());
+      } catch (error) { res.writeHead(502).end(String(error?.message ?? error)); }
+    });
+  });
+  await new Promise((resolveListen, rejectListen) => { server.once('error', rejectListen); server.listen(socketPath, resolveListen); });
+  return { socketPath, close: async () => { await new Promise((r) => server.close(r)); rmSync(dir, { recursive: true, force: true }); } };
+}
+
+/** `git` in `cwd` without blocking the event loop (the credential relay must keep answering while it runs). */
+function gitAsync(cwd, args, timeoutMs, env) {
+  return new Promise((resolveGit) => {
+    const child = spawn('git', args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], timeout: timeoutMs });
+    let stderr = '';
+    child.stderr.on('data', (c) => { stderr += c; });
+    child.stdout.resume();
+    child.on('error', (error) => resolveGit({ status: 1, stderr: String(error?.message ?? error) }));
+    child.on('close', (status) => resolveGit({ status, stderr }));
+  });
+}
+
+async function start(env) {
+  const need = (name) => { const v = env[name]; if (!v) throw new StartFailure('bad_environment', `${name} is not set`); return v; };
+  const apiUrl = need('CRTR_API_URL');
+  const executionId = need('CRTR_EXECUTION_ID');
+  const releaseDir = realpathSync(env.CRTR_RELEASE_DIR ?? resolve(here, '..'));
+  // 5.1 token first; nothing is started or stopped before the control plane accepts it.
+  const token = env.CRTR_NODE_TOKEN ?? await readStdin();
+  if (!/^[A-Za-z0-9_-]{43}$/.test(token)) throw new StartFailure('token_missing', 'no node token on stdin');
+  let response;
+  try { response = await api(apiUrl, token, 'GET', `/v1/executions/${executionId}/start`); }
+  catch (error) { throw new StartFailure('bundle_unreachable', String(error?.message ?? error)); }
+  if (response.status === 401 || response.status === 403) throw new StartFailure('token_rejected', `the control plane answered ${response.status}`);
+  if (!response.ok) throw new StartFailure('bundle_failed', `the control plane answered ${response.status}`);
+  const bundle = await response.json();
+
+  // 5.2 a broker of this execution is signalled; a broker of another execution is stopped.
+  const brokers = findBrokers(env.CRTR_PROC_ROOT ?? '/proc').filter((b) => b.node === bundle.node.id);
+  if (brokers.some((b) => b.execution === executionId)) { wake(executionId, brokers); return null; }
+  for (const b of brokers) await stopBroker(b.pid);
+
+  const root = env.CRTR_HOME ?? '/var/lib/crtr';
+  const home = join(root, 'apps', bundle.node.app.replace(/^app:/, ''), 'home');
+  const agentDir = join(home, '.pi', 'agent');
+  const work = env.CRTR_WORK_DIR ?? '/work';
+  mkdirSync(agentDir, { recursive: true });
+  // The recipe image installs its pi packages into one agent dir of its own (RECIPE_PI_AGENT_DIR in image-build.ts); every app's agent dir links to
+  // that install, so the packages load whichever app the node runs in.
+  const recipeAgent = join(root, 'recipe-pi-agent');
+  for (const tree of ['npm', 'git']) {
+    const source = join(recipeAgent, tree);
+    const target = join(agentDir, tree);
+    if (!existsSync(source)) continue;
+    if (!lstatExists(target)) symlinkSync(source, target);
+    else if (!lstatSync(target).isSymbolicLink() || readlinkSync(target) !== source) throw new StartFailure('recipe_packages_unavailable', `${target} exists and is not the recipe image's ${source}`);
+  }
+
+  // 5.4 git: the credential helper, and the identity only when the bundle carries one.
+  const gitEnv = { ...env, HOME: home };
+  const gitConfig = (key, value) => run('git', ['config', '--global', key, value], { env: gitEnv });
+  gitConfig('credential.https://github.com.helper', join(releaseDir, 'scripts', 'git-credential-crtr'));
+  if (bundle.git_identity) { gitConfig('user.name', bundle.git_identity.name); gitConfig('user.email', bundle.git_identity.email); }
+
+  // 5.5 plugins, once per revision.
+  const marker = join(work, '.crtr', 'plugins-revision');
+  const have = existsSync(marker) ? readFileSync(marker, 'utf8').trim() : null;
+  if (have !== String(bundle.plugins_revision) && bundle.plugins.length > 0) {
+    const crtr = join(releaseDir, 'bin', 'crtr');
+    const pluginEnv = { ...gitEnv, NPM_CONFIG_PREFIX: join(home, '.npm-global'), CRTR_HOME: root, CRTR_NO_AUTO_INIT: '1' };
+    const crtrRun = (args) => run(process.execPath, [crtr, ...args], { env: pluginEnv, timeout: 300_000 });
+    const detail = (r) => (r.stderr || r.stdout || '').slice(0, 300);
+    // A plugin of a marketplace is installed as `<marketplace name>/<plugin>`; the bundle names only the marketplace's url and ref, so the name is what
+    // `pkg market add` reports. Adding re-clones, so a marketplace added once per start is current. A plugin already installed (an earlier revision) is
+    // removed first, since install refuses an installed name.
+    const marketplaces = new Map();
+    for (const plugin of bundle.plugins) {
+      if ('path' in plugin.source) throw new StartFailure('plugin_source_unreachable', `${plugin.name}: its source is ${plugin.source.path} on the machine that registered it, which a sandbox cannot read`);
+      const { url, ref } = plugin.source.marketplace;
+      if (!url) throw new StartFailure('plugin_source_unreachable', `${plugin.name}: its marketplace has no url`);
+      const key = `${url}\0${ref ?? ''}`;
+      if (!marketplaces.has(key)) {
+        const added = crtrRun(['--json', 'pkg', 'market', 'add', url, ...(ref ? ['--ref', ref] : []), '--scope', 'user']);
+        let name;
+        try { name = JSON.parse(added.stdout).name; } catch { /* reported below */ }
+        if (added.status !== 0 || typeof name !== 'string') throw new StartFailure('plugin_install_failed', `${plugin.name}: marketplace ${url}: ${detail(added)}`);
+        marketplaces.set(key, name);
+      }
+      const removed = crtrRun(['pkg', 'plugin', 'remove', plugin.name, '--scope', 'user']);
+      if (removed.status !== 0 && !/not found/i.test(removed.stderr + removed.stdout)) throw new StartFailure('plugin_install_failed', `${plugin.name}: remove: ${detail(removed)}`);
+      const installed = crtrRun(['pkg', 'plugin', 'install', `${marketplaces.get(key)}/${plugin.name}`, '--scope', 'user']);
+      if (installed.status !== 0) throw new StartFailure('plugin_install_failed', `${plugin.name}: ${detail(installed)}`);
+    }
+  }
+  if (have !== String(bundle.plugins_revision)) { mkdirSync(dirname(marker), { recursive: true }); writeFileSync(marker, String(bundle.plugins_revision)); }
+
+  // 5.6 fetch only, never clone and never move a working tree; a failure is recorded and the start continues. The fetch reaches a private
+  // repository through the credential helper, over a relay of this process (see credentialRelay) because the broker's does not exist yet.
+  const fetchFailures = [];
+  const cloned = (bundle.recipe?.repositories ?? []).filter((repo) => existsSync(join(work, repo.name, '.git')));
+  if (cloned.length > 0) {
+    const environment = bundle.node.environment_id;
+    const relay = environment ? await credentialRelay(apiUrl, token, environment) : null;
+    const fetchEnv = { ...gitEnv, GIT_TERMINAL_PROMPT: '0', ...(relay ? { CRTR_API_SOCKET: relay.socketPath, CRTR_ENVIRONMENT_ID: environment } : {}) };
+    delete fetchEnv.CRTR_NODE_TOKEN;
+    try {
+      for (const repo of cloned) {
+        const r = await gitAsync(join(work, repo.name), ['fetch', '--prune'], 60_000, fetchEnv);
+        if (r.status !== 0) fetchFailures.push({ repository: repo.name, error: r.stderr.slice(0, 300) });
+      }
+    } finally { await relay?.close(); }
+  }
+
+  // 5.7 the managed worktree request (D102): the node's branch in the recipe repository's one clone, never a second checkout.
+  const worktree = bundle.launch.worktree;
+  if (worktree) {
+    const dir = join(work, worktree.repository);
+    if (!existsSync(join(dir, '.git'))) throw new StartFailure('cwd_missing', `${dir} holds no clone of ${worktree.repository}`);
+    const current = gitIn(dir, ['symbolic-ref', '--short', '-q', 'HEAD'], 10_000).stdout?.trim();
+    if (current !== worktree.branch) {
+      const exists = gitIn(dir, ['rev-parse', '--verify', '-q', `refs/heads/${worktree.branch}`], 10_000).status === 0;
+      const r = gitIn(dir, exists ? ['switch', worktree.branch] : ['switch', '-c', worktree.branch, worktree.base], 30_000);
+      if (r.status !== 0) throw new StartFailure('worktree_failed', `${worktree.branch}: ${(r.stderr || '').slice(0, 300)}`);
+    }
+  }
+
+  // 5.7 directories and the cwd.
+  const cwd = bundle.node.cwd;
+  if (!existsSync(cwd)) {
+    const inside = (bundle.recipe?.repositories ?? []).some((repo) => within(join(work, repo.name), cwd));
+    if (inside) throw new StartFailure('cwd_missing', `${cwd} lies in a repository that was never cloned`);
+    mkdirSync(cwd, { recursive: true });
+  }
+  const nodeId = bundle.node.id;
+  const environmentId = bundle.node.environment_id;
+  if (environmentId) writeFileSync(join(root, 'environment-id'), environmentId);
+  const appRoot = join(root, 'apps', bundle.node.app.replace(/^app:/, ''));
+  const runDir = join(env.CRTR_RUN_ROOT ?? '/run/crtr', 'nodes', nodeId);
+  for (const dir of ['context', 'reports', 'attachments', 'worktree'].map((d) => join(appRoot, 'nodes', nodeId, d))
+    .concat([join(root, 'runtime', 'nodes', nodeId, 'job'), join(runDir, 'job')])) mkdirSync(dir, { recursive: true });
+
+  // 5.8 the broker's local inputs.
+  const launch = bundle.launch;
+  const brokerEntry = join(releaseDir, 'dist', 'core', 'runtime', 'broker-cli.js');
+  const argv = [...launch.argv];
+  for (let i = 0; i < argv.length; i++) if (argv[i] === '-e') argv[i + 1] = mapExtension(argv[i + 1], releaseDir, agentDir);
+  // As host.ts does: the scopes file exists only when the recipe's env names one, holding `scopes ?? []`.
+  const scopesFile = launch.env?.CRTR_SCOPES_FILE !== undefined ? join(runDir, 'scopes.json') : null;
+  if (scopesFile) writeFileSync(scopesFile, JSON.stringify(launch.scopes ?? []));
+  const models = launch.models;
+  if (models) writeFileSync(join(agentDir, 'models.json'), `${JSON.stringify(models, null, 2)}\n`);
+  writeFileSync(join(runDir, 'broker-launch.json'), JSON.stringify({ ...launch, argv }));
+  const settingsPath = join(agentDir, 'settings.json');
+  const builtin = join(releaseDir, 'dist', 'builtin-pi-packages', 'pi-crtr-extensions');
+  let settings = {};
+  if (existsSync(settingsPath)) settings = JSON.parse(readFileSync(settingsPath, 'utf8'));
+  const packages = Array.isArray(settings.packages) ? settings.packages : [];
+  if (!packages.includes(builtin)) packages.push(builtin);
+  const recipeSettings = join(recipeAgent, 'settings.json');
+  if (existsSync(recipeSettings)) {
+    for (const entry of JSON.parse(readFileSync(recipeSettings, 'utf8')).packages ?? []) {
+      if (!packages.some((have) => JSON.stringify(have) === JSON.stringify(entry))) packages.push(entry);
+    }
+  }
+  writeFileSync(settingsPath, `${JSON.stringify({ ...settings, packages })}\n`);
+
+  // 5.9 the broker, with the token on fd 3 and not in its environment.
+  const brokerEnv = { ...env, ...launch.env, HOME: home, PI_CODING_AGENT_DIR: agentDir, CRTR_HOME: root, CRTR_RUNTIME_HOME: join(root, 'runtime'),
+    CRTR_FRONT_DOOR: '1', CRTR_EXECUTION_ID: executionId, CRTR_API_URL: apiUrl, CRTR_NO_AUTO_INIT: '1',
+    CRTR_PLUGINS_REVISION: String(bundle.plugins_revision), ...(environmentId ? { CRTR_ENVIRONMENT_ID: environmentId } : {}), ...(scopesFile ? { CRTR_SCOPES_FILE: scopesFile } : {}),
+    PATH: `${join(releaseDir, 'bin')}:${env.PATH ?? '/usr/local/bin:/usr/bin:/bin'}` };
+  for (const name of ['CRTR_NODE_TOKEN', 'CRTR_RELEASE_URL', 'CRTR_RELEASE_SHA256']) delete brokerEnv[name];
+  const child = spawn(process.execPath, [brokerEntry, '--canvas-home', join(root, 'runtime'), '--epoch', executionId, nodeId],
+    { cwd, env: brokerEnv, stdio: ['ignore', 'inherit', 'inherit', 'pipe'] });
+  child.stdio[3].end(token);
+  const exited = new Promise((resolveExit) => child.on('exit', (code, signal) => resolveExit(code ?? (signal ? 128 : 1))));
+  for (const sig of ['SIGTERM', 'SIGINT']) process.on(sig, () => child.kill(sig));
+  // The failure is a node log record (`POST /v1/nodes/:id/records/log`, the route a broker's events use); a refused post goes to the process log (`bl logs`).
+  for (const failure of fetchFailures) {
+    const record = JSON.stringify({ v: 1, ts: new Date().toISOString(), level: 'warn', event: 'sandbox.fetch.failed', component: 'broker', operation_id: randomBytes(16).toString('hex'), node_id: nodeId, fields: failure });
+    try {
+      const posted = await api(apiUrl, token, 'POST', `/v1/nodes/${nodeId}/records/log`, { record, expected_execution_id: executionId });
+      if (!posted.ok) throw new Error(`the control plane answered ${posted.status}`);
+    } catch (error) { console.error(`sandbox.fetch.failed ${record} (not recorded: ${error?.message ?? error})`); }
+  }
+  return await exited;
+}
+
+if (process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2);
+  try {
+    if (args[0] === '--wake') {
+      if (!args[1]) throw new StartFailure('bad_arguments', '--wake needs an execution id');
+      const code = wake(args[1], findBrokers(process.env.CRTR_PROC_ROOT ?? '/proc'));
+      if (code === EXIT_NO_BROKER) console.error('crtr-sandbox-start: failed no_broker');
+      process.exit(code);
+    }
+    const code = await start(process.env);
+    process.exit(code ?? 0);
+  } catch (error) {
+    const reason = error instanceof StartFailure ? error.reason : 'start_failed';
+    console.error(`crtr-sandbox-start: ${error.message}`);
+    console.error(`crtr-sandbox-start: failed ${reason}`);
+    process.exit(1);
+  }
+}

package/dist/builtin-pi-packages/pi-crtr-extensions/extensions/provider-rotation.d.ts

@@ -1,78 +0,0 @@
-import type { ExtensionAPI, ExtensionContext } from '@earendil-works/pi-coding-agent';
-import { type AssistantMessageEventStream, type TranscriptContext, type Model, type SimpleStreamOptions } from '@earendil-works/pi-ai';
-import { type ManagedProviderId, type SubscriptionCredential } from '../../../core/subscription-state.js';
-export interface ProviderRotationOptions {
-    modelIntent?: string;
-    nodeCwd?: string;
-    profileId?: string;
-}
-type ProviderErrorClassification = {
-    kind: "rate_limit" | "transient" | "fatal";
-    status?: number;
-    reason: string;
-    hadRetryAfterHeader: boolean;
-    /** Cooldown this classification imposes regardless of any Retry-After header. */
-    cooldownMs?: number;
-};
-type ProviderClassificationPolicy = {
-    rotateOnAuth: boolean;
-};
-/** Test seam for the policy mapping over the shared recognition signal. */
-export declare function __classifyProviderErrorForTest(error: unknown, observed?: {
-    status?: number;
-    retryAfterMs?: number;
-}, policy?: ProviderClassificationPolicy): ProviderErrorClassification;
-declare function defaultSleep(ms: number): Promise<void>;
-/** Test-only seam: override the sleep implementation used for in-place/wait-out retries. Pass undefined to restore the default. */
-export declare function __setSleepForTest(fn: typeof defaultSleep | undefined): void;
-export declare const POISONED_TRANSPORT_PASS_LIMIT = 2;
-declare function defaultTerminatePoisonedProcess(tried: string): Promise<boolean>;
-/** Test-only seam: override poisoned-process self-termination. Pass undefined to restore the default. */
-export declare function __setTerminatePoisonedProcessForTest(fn: typeof defaultTerminatePoisonedProcess | undefined): void;
-/** Test-only seam for the bounded, non-fatal subscription bookkeeping path. */
-export declare function __recordSubscriptionMutationForTest(description: string, mutate: () => Promise<unknown>): Promise<boolean>;
-type RefreshedCredential = {
-    refresh: string;
-    access: string;
-    expires: number;
-    clientId?: string;
-};
-type LoginCredential = {
-    refresh: string;
-    access: string;
-    expires: number;
-    accountId?: string;
-    clientId?: string;
-};
-type ResolvedCredential = SubscriptionCredential & {
-    access: string;
-};
-type RefreshForProvider = (providerId: ManagedProviderId, refreshToken: string, signal?: AbortSignal, clientId?: string) => Promise<RefreshedCredential>;
-/** Test-only seam: override the per-provider refresh function. Pass undefined to restore the default. */
-export declare function __setRefreshForProviderForTest(fn: RefreshForProvider | undefined): void;
-/** Test-only seam: exercises the real `refreshCredentialIfNeeded` (including its locked refresh
- * transaction) without duplicating its logic. */
-export declare function __refreshCredentialIfNeededForTest(providerId: ManagedProviderId, credential: SubscriptionCredential, signal?: AbortSignal): Promise<ResolvedCredential>;
-declare function defaultLoginForProvider(providerId: ManagedProviderId, ctx: ExtensionContext): Promise<LoginCredential>;
-/** Test-only seam: override the per-provider login function. Pass undefined to restore the default. */
-export declare function __setLoginForProviderForTest(fn: typeof defaultLoginForProvider | undefined): void;
-declare function defaultStreamForProvider(model: Model<any>, context: TranscriptContext, options: SimpleStreamOptions | undefined): AssistantMessageEventStream;
-/** Test-only seam: override the per-provider stream factory. Pass undefined to restore the default. */
-export declare function __setStreamForProviderForTest(fn: typeof defaultStreamForProvider | undefined): void;
-/**
- * pi-ai races the manual-code-paste dialog against its loopback callback server. When the
- * callback supplies a code, the manual-input promise can remain pending, so `run` receives:
- *  - `readCode`, a `ctx.ui.input` wrapper with an AbortSignal. Aborting it removes the pending
- *    broker entry and emits an `extension_ui_dismiss` frame for exactly that dialog.
- *  - `dismissManual`, which aborts the signal at the post-code `onProgress` boundary before
- *    the token exchange completes. `onProgress` is emitted only after a code is available, so
- *    dismissing then cannot close a dialog the user still needs; `finally` covers paths without
- *    progress, and repeated AbortController calls are inert.
- *
- * `undefined` from `readCode` means cancellation or timeout. It throws so OAuth ends directly
- * instead of opening a second paste-only dialog.
- */
-export declare function loginWithManualInputCleanup<T>(ctx: ExtensionContext, run: (readCode: (title: string, placeholder: string) => Promise<string>, dismissManual: () => void) => Promise<T>): Promise<T>;
-export declare function createProviderRotationExtension(options?: ProviderRotationOptions): (pi: ExtensionAPI) => Promise<void>;
-declare const defaultProviderRotationExtension: (pi: ExtensionAPI) => Promise<void>;
-export default defaultProviderRotationExtension;