@odla-ai/cli 0.16.3 → 0.16.5

package/dist/index.d.cts

@@ -46,8 +46,10 @@ interface PreparedCodeLocalSource {
 /** Freeze the local Git tree and exact commit base before any approval request. */
 declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
 
-/** Immutable, release-owned Pi adapter. No registry credential enters it. */
-declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:2a52a1c8eed66ad167e7bccab4d603ed8fcd75c42dddfb320083436ed89b7c9c";
+/** Release-owned Pi adapter bundled into the CLI. `prepareCodeImages` hashes
+ * the exact bundle and builds a content-addressed local image; no registry
+ * credential enters the terminal connection. */
+declare const CODE_PI_IMAGE = "odla-ai/pi-agent:embedded";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -64,6 +66,14 @@ interface CodeBuildRule {
  * this once their owner-visible registration contract exists. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
+type CodeImageCommandRunner = (command: string, args: readonly string[], stdio: "inherit" | "ignore") => Promise<void>;
+type EmbeddedPiImageBuilder = (engine: CodeContainerEngine, image: string, run: CodeImageCommandRunner) => Promise<void>;
+type EmbeddedPiImageNamer = () => Promise<string>;
+/** Build the CLI-embedded Pi adapter and pull each immutable recipe image
+ * before an owner is asked to approve the terminal. Runtime attempts never
+ * pull, and fail closed if a prepared image disappears. */
+declare function prepareCodeImages(engine: CodeContainerEngine, images: readonly string[], run?: CodeImageCommandRunner, buildEmbedded?: EmbeddedPiImageBuilder, nameEmbedded?: EmbeddedPiImageNamer): Promise<readonly string[]>;
+
 /** Supported local isolation engines for an odla Code host runtime. */
 type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
@@ -78,6 +88,7 @@ interface CodeHostCapabilities {
     images: {
         ready: true;
         pi: string;
+        piSource: "cli_embedded";
         recipes: Array<{
             id: string;
             image: string;
@@ -113,7 +124,7 @@ interface CodeConnectOptions {
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
     readGitHead?: (cwd: string) => Promise<string>;
-    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<void>;
+    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<readonly string[]>;
     prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
@@ -132,6 +143,7 @@ interface CodeRuntimeInput {
         trustedBaseDir: string;
         sourceDir: string;
     };
+    piImage?: string;
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -978,4 +990,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.d.ts

@@ -46,8 +46,10 @@ interface PreparedCodeLocalSource {
 /** Freeze the local Git tree and exact commit base before any approval request. */
 declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
 
-/** Immutable, release-owned Pi adapter. No registry credential enters it. */
-declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:2a52a1c8eed66ad167e7bccab4d603ed8fcd75c42dddfb320083436ed89b7c9c";
+/** Release-owned Pi adapter bundled into the CLI. `prepareCodeImages` hashes
+ * the exact bundle and builds a content-addressed local image; no registry
+ * credential enters the terminal connection. */
+declare const CODE_PI_IMAGE = "odla-ai/pi-agent:embedded";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -64,6 +66,14 @@ interface CodeBuildRule {
  * this once their owner-visible registration contract exists. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
+type CodeImageCommandRunner = (command: string, args: readonly string[], stdio: "inherit" | "ignore") => Promise<void>;
+type EmbeddedPiImageBuilder = (engine: CodeContainerEngine, image: string, run: CodeImageCommandRunner) => Promise<void>;
+type EmbeddedPiImageNamer = () => Promise<string>;
+/** Build the CLI-embedded Pi adapter and pull each immutable recipe image
+ * before an owner is asked to approve the terminal. Runtime attempts never
+ * pull, and fail closed if a prepared image disappears. */
+declare function prepareCodeImages(engine: CodeContainerEngine, images: readonly string[], run?: CodeImageCommandRunner, buildEmbedded?: EmbeddedPiImageBuilder, nameEmbedded?: EmbeddedPiImageNamer): Promise<readonly string[]>;
+
 /** Supported local isolation engines for an odla Code host runtime. */
 type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
@@ -78,6 +88,7 @@ interface CodeHostCapabilities {
     images: {
         ready: true;
         pi: string;
+        piSource: "cli_embedded";
         recipes: Array<{
             id: string;
             image: string;
@@ -113,7 +124,7 @@ interface CodeConnectOptions {
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
     readGitHead?: (cwd: string) => Promise<string>;
-    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<void>;
+    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<readonly string[]>;
     prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
@@ -132,6 +143,7 @@ interface CodeRuntimeInput {
         trustedBaseDir: string;
         sourceDir: string;
     };
+    piImage?: string;
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -978,4 +990,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.js

@@ -30,6 +30,7 @@ import {
   isTerminalHostedSecurityStatus,
   listGitHubSecuritySources,
   listHostedSecurityJobs,
+  prepareCodeImages,
   printCapabilities,
   provision,
   redactSecrets,
@@ -42,7 +43,7 @@ import {
   secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
-} from "./chunk-YWC7F5T3.js";
+} from "./chunk-GLY5BN6D.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,
@@ -74,6 +75,7 @@ export {
   isTerminalHostedSecurityStatus,
   listGitHubSecuritySources,
   listHostedSecurityJobs,
+  prepareCodeImages,
   printCapabilities,
   provision,
   redactSecrets,