@poe-platform/safe-bash 0.1.821 → 0.1.823

package/dist/safe-bash/command-chunks/{chunk-RHXV2KG5.js → chunk-EO3RYGUZ.js}

@@ -1,17 +1,23 @@
 import {
   createPythonPackageEnvironment,
-  pythonDocumentPackages
-} from "./chunk-R4NPYXQX.js";
+  createPythonPackageManifestStore,
+  openPythonPackageFile,
+  pythonDocumentPackages,
+  stagePythonPackage
+} from "./chunk-WDTWJFPK.js";
 import {
   pythonShellDispatchActive
 } from "./chunk-NHAG4DWL.js";
 import {
   PythonInvocationError,
   parsePythonInvocation
-} from "./chunk-5EFNQ6FY.js";
+} from "./chunk-64HIOP7Q.js";
 import {
   pythonLlmProvider
 } from "./chunk-YYRVGXJH.js";
+import {
+  createPythonExecutorPool
+} from "./chunk-GT27M77E.js";
 import {
   PythonFailure,
   isPythonFailureCategory,
@@ -107,45 +113,23 @@ function encodePythonReply(value, maxBytes) {
 }
 
 // packages/safe-bash-command-python/src/installation.ts
-var pythonInstallationHelp = `Usage: python -m pip install [-r FILE | --requirement FILE] PACKAGE ...
-Installs compatible wheels and dependencies using the configured Pyodide installer.
-PACKAGE is a package requirement or a canonical filesystem wheel path.
-Supported options: -r, --requirement, -h, --help, --.
-All other pip options and commands are unsupported, including --upgrade,
---force-reinstall, --no-index, --no-deps, --target, --user, --prefix, --root, --editable,
---index-url, --extra-index-url, --find-links, --trusted-host, --require-hashes,
---constraint, --dry-run, --quiet, --verbose and cache/build/configuration flags.
-Configure transport and integrity through the Python package SDK configuration.
+var pythonInstallationHelp = `Usage: python -m pip install [-r/--requirement FILE] [OPTIONS] PACKAGE ...
+       python -m pip uninstall [-y/--yes] PACKAGE ...
+Install options: --pre, -U/--upgrade, --force-reinstall, --no-cache-dir
+Compatible wheels; configure transport with the Python package SDK.
+Both accept -h/--help and --. Other pip operations are unsupported.
 `;
-function parsePythonInstallation(args) {
-  let pipArgs;
-  scan: for (let index = 0; index < args.length; index++) {
-    const option = args[index];
-    if (option === "--" || option === "-" || !option.startsWith("-") || option.startsWith("--")) return void 0;
-    for (let offset = 1; offset < option.length; offset++) {
-      const flag = option[offset];
-      if ("h?V".includes(flag)) return void 0;
-      if ("cmWX".includes(flag)) {
-        const operand = option.slice(offset + 1) || args[++index];
-        if (flag === "c") return void 0;
-        if (flag === "m") {
-          if (operand !== "pip") return void 0;
-          pipArgs = args.slice(index + 1);
-          break scan;
-        }
-        break;
-      }
-    }
-  }
-  if (!pipArgs) return void 0;
+function parsePythonInstallation(pipArgs) {
+  const controls = {};
   const packages = [];
   const requirements = [];
-  if (pipArgs.length === 0) return { packages, requirements, help: true };
-  if (pipArgs[0] === "--help" || pipArgs[0] === "-h") {
+  if (pipArgs.length === 0 || pipArgs[0] === "--help" || pipArgs[0] === "-h") {
     if (pipArgs.length > 1) throw new PythonInvocationError("unsupported pip option or argument after help: " + pipArgs[1]);
-    return { packages, requirements, help: true };
+    return { packages, requirements, controls, help: true };
   }
-  if (pipArgs[0] !== "install") throw new PythonInvocationError("unsupported pip command " + pipArgs[0]);
+  const uninstall = pipArgs[0] === "uninstall";
+  let yes = false;
+  if (!uninstall && pipArgs[0] !== "install") throw new PythonInvocationError("unsupported pip command " + pipArgs[0]);
   let operands = false;
   let help = false;
   for (let index = 1; index < pipArgs.length; index++) {
@@ -154,6 +138,14 @@ function parsePythonInstallation(args) {
       packages.push(option);
       continue;
     }
+    if (!uninstall && (option === "--pre" || option === "--no-cache-dir")) {
+      controls[option === "--pre" ? "pre" : "noCache"] = true;
+      continue;
+    }
+    if (!uninstall && (option === "-U" || option === "--upgrade" || option === "--force-reinstall")) {
+      controls[option === "--force-reinstall" ? "forceReinstall" : "upgrade"] = true;
+      continue;
+    }
     if (option === "--") {
       operands = true;
       continue;
@@ -162,7 +154,11 @@ function parsePythonInstallation(args) {
       help = true;
       continue;
     }
-    if (option === "-r" || option === "--requirement" || option.startsWith("--requirement=") || option.startsWith("-r")) {
+    if (uninstall && (option === "-y" || option === "--yes")) {
+      yes = true;
+      continue;
+    }
+    if (!uninstall && (option === "-r" || option === "--requirement" || option.startsWith("--requirement=") || option.startsWith("-r"))) {
       const path = option.startsWith("--requirement=") ? option.slice("--requirement=".length) : option !== "-r" && option.startsWith("-r") ? option.slice(2) : pipArgs[++index];
       if (!path || path.startsWith("-")) throw new PythonInvocationError(option + " requires a path");
       requirements.push(path);
@@ -170,18 +166,455 @@ function parsePythonInstallation(args) {
     }
     throw new PythonInvocationError("unsupported pip option " + option);
   }
-  if (!help && packages.length === 0 && requirements.length === 0) throw new PythonInvocationError("pip install requires at least one package or requirements file");
-  return { packages, requirements, help };
+  if (!help && packages.length === 0 && requirements.length === 0) throw new PythonInvocationError("pip " + pipArgs[0] + " requires at least one package or requirements file");
+  return { packages, requirements, help, controls, ...uninstall ? { uninstall, yes } : {} };
 }
 
 // packages/safe-bash-command-python/src/executor.ts
 import { readBytes, writeBytes } from "../../safe-bash-contracts/io.js";
 import { createOutputOperation } from "../../safe-bash-contracts/output.js";
-import { inheritYieldCheckpoint, yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { inheritYieldCheckpoint, yieldTurn as yieldTurn2 } from "../../safe-bash-contracts/yield.js";
 
-// packages/safe-bash-command-python/src/llm-functions-loader.ts
-import { createLlmSpool, createLlmToolRegistry } from "../../safe-bash-command-llm/index.js";
+// packages/safe-bash-command-python/src/llm-package-manager.ts
 import { toByteSource } from "../../safe-bash-contracts/index.js";
+function createPythonLlmPackageManager(options) {
+  if (!options.createExecutor || !options.environment || options.provisioning) throw new TypeError("LLM package management requires an asynchronous executor and a shared Python environment");
+  const planners = /* @__PURE__ */ new WeakMap();
+  const pool = createPythonExecutorPool({
+    createExecutor: options.createExecutor,
+    ...options.maxConcurrentWorkers === void 0 || options.maxConcurrentWorkers === Infinity ? {} : { maxConcurrentExecutors: options.maxConcurrentWorkers }
+  });
+  const configuration = { ...options, createExecutor: pool.createExecutor, createCapabilities(context) {
+    const capabilities = options.createCapabilities?.(context) ?? {};
+    if (capabilities.llm_packages) throw new Error("Python package capability is reserved");
+    const capability = planners.get(context.args);
+    return capability ? { ...capabilities, llm_packages: capability } : capabilities;
+  } };
+  const installer = createPythonExecutorCommands(configuration)[0];
+  const { environment: ignoredEnvironment, packages: ignoredPackages, requirements: ignoredRequirements, packageProfile: ignoredProfile, ...planning } = configuration;
+  const command = createPythonExecutorCommands(planning)[0];
+  return async ({ context, args }) => {
+    if (!Array.isArray(args) || !["install", "uninstall"].includes(args[0]) || args.some((value) => typeof value !== "string")) throw new TypeError("Invalid LLM package command");
+    context.signal.throwIfAborted();
+    let planned;
+    const { registerCleanup: ignoredCleanup, argumentValues: ignoredArguments, ...isolated } = context;
+    const invocation = { ...isolated, command: "python", args: ["-c", pythonLlmPackageProgram, ...args], stdin: toByteSource("") };
+    planners.set(invocation.args, { async call(value) {
+      if (planned || !Array.isArray(value) || value.some((item) => typeof item !== "string") || value[0] !== "pip" || value[1] !== args[0]) throw new Error("Invalid native LLM package request");
+      planned = value.slice(1);
+      return null;
+    } });
+    let result;
+    try {
+      result = await command.execute(invocation);
+    } finally {
+      planners.delete(invocation.args);
+    }
+    if (result.exitCode || !planned) return result;
+    context.signal.throwIfAborted();
+    return installer.execute({ ...isolated, command: "python", args: ["-m", "pip", ...planned] });
+  };
+}
+var pythonLlmPackageProgram = String.raw`
+import sys
+import safe_host
+import llm.cli
+
+def _safe_package_request(module, run_name):
+    if module != 'pip' or run_name != '__main__':
+        raise RuntimeError('Unexpected LLM package entrypoint')
+    safe_host.call('llm_packages', list(sys.argv))
+
+llm.cli.run_module = _safe_package_request
+llm.cli.cli.main(args=sys.argv[1:], prog_name='llm')
+`;
+
+// packages/safe-bash-command-python/src/llm-plugin-setup.ts
+var pythonLlmPluginSetup = /* @__PURE__ */ (() => String.raw`
+def load_plugins(request):
+ import llm.plugins as manager
+ manager.load_plugins()
+ if request['plugins']:
+  original = (manager.DEFAULT_PLUGINS, manager.LLM_LOAD_PLUGINS, manager._loaded)
+  try:
+   manager.DEFAULT_PLUGINS = ()
+   manager.LLM_LOAD_PLUGINS = ','.join(request['plugins'])
+   manager._loaded = False
+   manager.load_plugins()
+  finally:
+   manager.DEFAULT_PLUGINS, manager.LLM_LOAD_PLUGINS, manager._loaded = original
+`)();
+
+// packages/safe-bash-command-python/src/llm-json-loader.ts
+import { LlmLoaderLookupError } from "../../safe-bash-command-llm/index.js";
+import { toByteSource as toByteSource2 } from "../../safe-bash-contracts/index.js";
+function createPythonLlmJsonLoader(options, capabilityName, program, label) {
+  if (!options.createExecutor) throw new TypeError(`Python ${label} loading requires an asynchronous executor`);
+  if (options.plugins !== void 0 && (!Array.isArray(options.plugins) || options.plugins.some((name) => typeof name !== "string" || !name || name !== name.trim() || name.includes(",")))) throw new TypeError(`Python ${label} plugins must be explicit distribution names`);
+  const plugins = Object.freeze([...options.plugins ?? []]), capabilities = /* @__PURE__ */ new WeakMap();
+  const command = createPythonExecutorCommands({ ...options, createCapabilities(context) {
+    const provided = options.createCapabilities?.(context) ?? {};
+    if (provided[capabilityName]) throw new Error(`Python ${label} capability is reserved`);
+    const capability = capabilities.get(context.args);
+    if (!capability) throw new Error(`Unknown Python ${label} invocation`);
+    return { ...provided, [capabilityName]: capability };
+  } })[0];
+  return async (request, context, admitBytes) => {
+    if (!context) throw new TypeError(`Python ${label} loading requires caller context`);
+    const { maxBytes, signal } = context;
+    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new RangeError(`Invalid Python ${label} byte limit`);
+    signal.throwIfAborted();
+    let size = 0, done = false, failure;
+    const chunks = [];
+    const invocation = { ...context, command: "python", args: ["-c", program], signal, env: context.env ?? {}, stdin: toByteSource2(""), stdout: context.stdout ?? { async write() {
+    } }, stderr: context.stderr ?? { async write() {
+    } } };
+    capabilities.set(invocation.args, { async call(input) {
+      try {
+        signal.throwIfAborted();
+        if (!input || typeof input !== "object" || Array.isArray(input) || done) throw new TypeError(`Invalid Python ${label} message`);
+        const message = input;
+        if (message.op === "request") return { ...request, plugins };
+        if (message.op === "missing" || message.op === "lookup" || message.op === "error") {
+          failure ??= message.op === "error" ? new Error(String(message.message)) : new LlmLoaderLookupError(String(message.message));
+          done = true;
+          return null;
+        }
+        if (message.op === "done") {
+          done = true;
+          return null;
+        }
+        if (message.op !== "text" || typeof message.text !== "string" || message.text.length > 8192) throw new TypeError(`Invalid Python ${label} text window`);
+        const bytes = new TextEncoder().encode(message.text).length;
+        if (bytes > 16384) throw new TypeError(`Invalid Python ${label} text window`);
+        if (bytes > maxBytes - size) throw new RangeError(`Python ${label} byte limit exceeded`);
+        admitBytes?.(bytes);
+        size += bytes;
+        if (bytes) chunks.push(message.text);
+        return null;
+      } catch (error) {
+        failure ??= error;
+        throw error;
+      }
+    } });
+    try {
+      const result = await command.execute(invocation);
+      signal.throwIfAborted();
+      if (failure) throw failure;
+      if (result.exitCode) throw new Error(`Python ${label} interpreter exited with status ${result.exitCode}`);
+      if (!done) throw new Error(`Python ${label} interpreter returned no result`);
+      return JSON.parse(chunks.join(""));
+    } finally {
+      capabilities.delete(invocation.args);
+    }
+  };
+}
+
+// packages/safe-bash-command-python/src/llm-template-loader.ts
+function createPythonLlmTemplateLoader(options, prefix) {
+  if (typeof prefix !== "string" || !prefix) throw new TypeError("Python template loader requires a prefix");
+  const load = createPythonLlmJsonLoader(options, "llm_templates", pythonLlmTemplateProgram, "template");
+  return async (value, signal, context) => {
+    if (!context) throw new TypeError("Python template loading requires caller context");
+    if (typeof value !== "string") throw new TypeError("Python template input must be a string");
+    const template = await load({ prefix, value }, { ...context, signal });
+    if (!template || typeof template !== "object" || Array.isArray(template) || typeof template.name !== "string") throw new TypeError("Invalid native Python template");
+    return template;
+  };
+}
+var pythonLlmTemplateProgram = /* @__PURE__ */ (() => String.raw`
+import json, llm, safe_host
+
+${pythonLlmPluginSetup}
+
+def send(op, **fields):
+ return safe_host.call('llm_templates', dict(op=op, **fields))
+
+def main():
+ request = send('request')
+ try:
+  load_plugins(request)
+  loaders = llm.get_template_loaders()
+ except Exception as error:
+  send('lookup', message=str(error))
+  return
+ if request['prefix'] not in loaders:
+  send('missing', message='Unknown template prefix: ' + request['prefix'])
+  return
+ template = loaders[request['prefix']](request['value'])
+ encoder = json.JSONEncoder(ensure_ascii=False, separators=(',', ':'))
+ for part in encoder.iterencode(template.model_dump(exclude_none=True)):
+  for offset in range(0, len(part), 4096): send('text', text=part[offset:offset + 4096])
+ send('done')
+try:
+ main()
+except Exception as error:
+ send('error', message=str(error))
+`)();
+
+// packages/safe-bash-command-python/src/llm-fragment-loader.ts
+import { createLlmSpool, createLlmUrlSource, LlmLoaderLookupError as LlmLoaderLookupError2 } from "../../safe-bash-command-llm/index.js";
+import { toByteSource as toByteSource3 } from "../../safe-bash-contracts/index.js";
+function deferred() {
+  let resolve, reject;
+  const promise = new Promise((yes, no) => {
+    resolve = yes;
+    reject = no;
+  });
+  void promise.catch(() => {
+  });
+  return { promise, resolve, reject };
+}
+function createPythonLlmFragmentLoader(options, prefix) {
+  if (!options.createExecutor) throw new TypeError("Python fragment loading requires an asynchronous executor");
+  if (typeof prefix !== "string" || !prefix) throw new TypeError("Python fragment loader requires a prefix");
+  if (options.plugins !== void 0 && (!Array.isArray(options.plugins) || options.plugins.some((name) => typeof name !== "string" || !name || name !== name.trim() || name.includes(",")))) throw new TypeError("Python fragment plugins must be explicit distribution names");
+  const plugins = Object.freeze([...options.plugins ?? []]), capabilities = /* @__PURE__ */ new WeakMap();
+  const command = createPythonExecutorCommands({ ...options, createCapabilities(context) {
+    const provided = options.createCapabilities?.(context) ?? {};
+    if (provided.llm_fragments) throw new Error("Python fragment capability is reserved");
+    const capability = capabilities.get(context.args);
+    if (!capability) throw new Error("Unknown Python fragment invocation");
+    return { ...provided, llm_fragments: capability };
+  } })[0];
+  return async function* (value, context) {
+    if (typeof value !== "string") throw new TypeError("Python fragment input must be a string");
+    const { fs, cwd, maxBytes } = context;
+    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new RangeError("Invalid Python fragment byte limit");
+    const controller = new AbortController(), signal = AbortSignal.any([context.signal, controller.signal]);
+    signal.throwIfAborted();
+    let ready = deferred(), resume;
+    let current, spool, closed = false, bytes = 0;
+    const sources = /* @__PURE__ */ new Set();
+    const admit = (size) => {
+      if (size > maxBytes - bytes) throw new RangeError("Python fragment byte limit exceeded");
+      bytes += size;
+    };
+    const fail = (error) => {
+      ready.reject(error);
+      resume?.resolve(false);
+      controller.abort(error);
+    };
+    const aborted = () => {
+      ready.reject(signal.reason);
+      resume?.resolve(false);
+    };
+    signal.addEventListener("abort", aborted, { once: true });
+    const retire = async (source) => {
+      try {
+        await source.dispose();
+      } finally {
+        sources.delete(source);
+      }
+    };
+    const dispatch = async (input) => {
+      signal.throwIfAborted();
+      if (!input || typeof input !== "object" || Array.isArray(input)) throw new TypeError("Invalid Python fragment message");
+      const message = input;
+      if (message.op === "request") return { prefix, value, plugins };
+      if (message.op === "missing" || message.op === "lookup") throw new LlmLoaderLookupError2(String(message.message));
+      if (message.op === "error") throw new Error(String(message.message));
+      if (message.op === "begin") {
+        if (current || resume) throw new Error("Python fragment already active");
+        if (message.type !== "text" && message.type !== "attachment") throw new TypeError("Invalid Python fragment type");
+        if (message.type === "attachment" && (typeof message.mimeType !== "string" || typeof message.id !== "string")) throw new TypeError("Invalid Python fragment metadata");
+        let source;
+        if (message.url !== void 0) {
+          if (message.type !== "attachment" || typeof message.url !== "string" || !context.capabilities?.fetch) throw new TypeError("Attachment URL loading is not configured");
+          source = createLlmUrlSource({ url: message.url, fetch: context.capabilities.fetch, signal, maxBytes: maxBytes - bytes, admitBytes: admit });
+        } else {
+          const owned = await createLlmSpool(fs, cwd, signal, "input");
+          spool = owned;
+          source = { bytes: owned.replay(), dispose: () => owned.close() };
+        }
+        sources.add(source);
+        current = message.type === "text" ? { type: "text", source: { ...source, normalizeNewlines: false } } : { type: "attachment", source, mimeType: message.mimeType, id: message.id };
+        sources.delete(source);
+        sources.add(current.source);
+        return null;
+      }
+      if (!current) throw new Error("No active Python fragment");
+      if (message.op === "text" || message.op === "bytes") {
+        if (!spool) throw new Error("Remote Python fragments cannot accept inline bytes");
+        let chunk;
+        if (message.op === "text") {
+          if (current.type !== "text" || typeof message.text !== "string" || message.text.length > 8192) throw new TypeError("Invalid Python fragment text window");
+          chunk = new TextEncoder().encode(message.text);
+          if (chunk.length > 16384) throw new TypeError("Invalid Python fragment text window");
+        } else {
+          if (current.type !== "attachment" || !Array.isArray(message.bytes) || message.bytes.length > 4096 || message.bytes.some((byte) => typeof byte !== "number" || !Number.isInteger(byte) || byte < 0 || byte > 255)) throw new TypeError("Invalid Python fragment byte window");
+          chunk = Uint8Array.from(message.bytes);
+        }
+        admit(chunk.length);
+        await spool.write(chunk);
+        return null;
+      }
+      if (message.op === "end") {
+        const continuation = resume = deferred();
+        ready.resolve(current);
+        return continuation.promise;
+      }
+      throw new TypeError("Invalid Python fragment operation");
+    };
+    const invocation = { ...context, command: "python", args: ["-c", pythonLlmFragmentProgram], fs, cwd, signal, env: context.env ?? {}, stdin: toByteSource3(""), stdout: context.stdout ?? { async write() {
+    } }, stderr: context.stderr ?? { async write() {
+    } } };
+    capabilities.set(invocation.args, { async call(input) {
+      try {
+        return await dispatch(input);
+      } catch (error) {
+        fail(error);
+        throw error;
+      }
+    } });
+    const running = Promise.resolve().then(() => command.execute(invocation)).then((result) => {
+      if (closed) return;
+      if (result.exitCode) fail(new Error(`Python fragment interpreter exited with status ${result.exitCode}`));
+      else ready.resolve(void 0);
+    }, (error) => {
+      if (!closed) fail(error);
+    });
+    let closing;
+    const close = () => closing ??= (async () => {
+      closed = true;
+      resume?.resolve(false);
+      controller.abort(new Error("Python fragment session closed"));
+      await running;
+      capabilities.delete(invocation.args);
+      signal.removeEventListener("abort", aborted);
+      await Promise.all([...sources].map(retire));
+    })();
+    context.registerCleanup?.(close);
+    try {
+      while (true) {
+        const fragment = await ready.promise;
+        if (!fragment) break;
+        let advance = false;
+        try {
+          yield fragment;
+          advance = true;
+        } finally {
+          await retire(fragment.source);
+          current = void 0;
+          spool = void 0;
+          ready = deferred();
+          const continuation = resume;
+          resume = void 0;
+          continuation?.resolve(advance);
+        }
+      }
+    } finally {
+      await close();
+    }
+  };
+}
+var pythonLlmFragmentProgram = /* @__PURE__ */ (() => String.raw`
+import hashlib, llm, safe_host
+from llm_safe_host import _attachment_type
+
+${pythonLlmPluginSetup}
+
+def send(op, **fields):
+ return safe_host.call('llm_fragments', dict(op=op, **fields))
+
+def emit_attachment(value):
+ mime = _attachment_type(value)
+ if not value.content and value.path:
+  with open(value.path, 'rb') as source:
+   if value._id is None:
+    digest = hashlib.sha256()
+    for chunk in iter(lambda: source.read(4096), b''): digest.update(chunk)
+    value._id = digest.hexdigest()
+    source.seek(0)
+   send('begin', type='attachment', mimeType=mime, id=value.id())
+   for chunk in iter(lambda: source.read(4096), b''): send('bytes', bytes=list(chunk))
+ elif not value.content and value.url:
+  send('begin', type='attachment', mimeType=mime, id=value.id(), url=value.url)
+ else:
+  send('begin', type='attachment', mimeType=mime, id=value.id())
+  content = memoryview(value.content or b'')
+  for offset in range(0, len(content), 4096): send('bytes', bytes=list(content[offset:offset + 4096]))
+
+def main():
+ request = send('request')
+ try:
+  load_plugins(request)
+  loaders = llm.get_fragment_loaders()
+ except Exception as error:
+  send('lookup', message=str(error))
+  return
+ if request['prefix'] not in loaders:
+  send('missing', message='Unknown fragment prefix: ' + request['prefix'])
+  return
+ result = loaders[request['prefix']](request['value'])
+ if not isinstance(result, list): result = [result]
+ for value in result:
+  if isinstance(value, llm.Attachment): emit_attachment(value)
+  elif isinstance(value, str):
+   send('begin', type='text')
+   for offset in range(0, len(value), 4096): send('text', text=value[offset:offset + 4096])
+  else: raise TypeError('Fragment loader must return text or attachments')
+  if not send('end'): return
+try:
+ main()
+except Exception as error:
+ send('error', message=str(error))
+`)();
+
+// packages/safe-bash-command-python/src/llm-loader-discovery.ts
+function createPythonLlmLoaderProvider(options) {
+  const discover = createPythonLlmLoaderDiscovery(options), configured = { ...options, plugins: Object.freeze([...options.plugins ?? []]) };
+  return { discover, fragments: createPythonLlmFragmentLoader.bind(null, configured), templates: createPythonLlmTemplateLoader.bind(null, configured) };
+}
+function createPythonLlmLoaderDiscovery(options) {
+  const load = createPythonLlmJsonLoader(options, "llm_loaders", pythonLlmLoaderDiscoveryProgram, "loader discovery");
+  const configured = { ...options, plugins: Object.freeze([...options.plugins ?? []]) };
+  return async (context) => {
+    if (context.kind !== void 0 && context.kind !== "fragments" && context.kind !== "templates") throw new TypeError("Invalid native loader discovery kind");
+    const result = await load(context.kind === void 0 ? {} : { kind: context.kind }, context, context.admitBytes);
+    if (!result || typeof result !== "object" || Array.isArray(result)) throw new TypeError("Invalid native loader discovery");
+    function loaders(entries, create) {
+      if (!Array.isArray(entries)) throw new TypeError("Invalid native loader discovery");
+      const values = /* @__PURE__ */ new Map();
+      for (const entry of entries) {
+        if (!Array.isArray(entry) || entry.length !== 2 || typeof entry[0] !== "string" || !entry[0] || values.has(entry[0]) || entry[1] !== null && typeof entry[1] !== "string") throw new TypeError("Invalid native loader registration");
+        const loader = create(configured, entry[0]);
+        if (entry[1] !== null) Object.defineProperty(loader, "description", { value: entry[1], enumerable: true });
+        values.set(entry[0], loader);
+      }
+      return values;
+    }
+    const data = result;
+    return { fragmentLoaders: loaders(data.fragments, createPythonLlmFragmentLoader), templateLoaders: loaders(data.templates, createPythonLlmTemplateLoader) };
+  };
+}
+var pythonLlmLoaderDiscoveryProgram = /* @__PURE__ */ (() => String.raw`
+import json, llm, safe_host
+
+${pythonLlmPluginSetup}
+
+def send(op, **fields):
+ return safe_host.call('llm_loaders', dict(op=op, **fields))
+
+def main():
+ request = send('request')
+ load_plugins(request)
+ encoder = json.JSONEncoder(ensure_ascii=False, separators=(',', ':'))
+ kind = request.get('kind')
+ result = dict(fragments=[] if kind == 'templates' else [(prefix, loader.__doc__) for prefix, loader in llm.get_fragment_loaders().items()],
+               templates=[] if kind == 'fragments' else [(prefix, loader.__doc__) for prefix, loader in llm.get_template_loaders().items()])
+ for part in encoder.iterencode(result):
+  for offset in range(0, len(part), 4096): send('text', text=part[offset:offset + 4096])
+ send('done')
+try:
+ main()
+except Exception as error:
+ send('error', message=str(error))
+`)();
+
+// packages/safe-bash-command-python/src/llm-functions-loader.ts
+import { createLlmSpool as createLlmSpool2, createLlmToolRegistry } from "../../safe-bash-command-llm/index.js";
+import { toByteSource as toByteSource4 } from "../../safe-bash-contracts/index.js";
 
 // packages/safe-bash-command-python/src/llm-functions-program.ts
 var pythonLlmFunctionsProgram = /* @__PURE__ */ (() => String.raw`
@@ -248,6 +681,20 @@ async def main():
     discovery = selection.get("discovery", False)
     tools = []
     try:
+        requested_plugins = selection.get("plugins", [])
+        if requested_plugins:
+            import llm.plugins as plugin_manager
+            plugin_manager.load_plugins()
+            original = (plugin_manager.DEFAULT_PLUGINS, plugin_manager.LLM_LOAD_PLUGINS, plugin_manager._loaded)
+            try:
+                # Reuse native explicit-distribution loading. The host's tooling
+                # registration guard and ambient-entrypoint prohibition stay active.
+                plugin_manager.DEFAULT_PLUGINS = ()
+                plugin_manager.LLM_LOAD_PLUGINS = ",".join(requested_plugins)
+                plugin_manager._loaded = False
+                plugin_manager.load_plugins()
+            finally:
+                plugin_manager.DEFAULT_PLUGINS, plugin_manager.LLM_LOAD_PLUGINS, plugin_manager._loaded = original
         plugin_query = selection.get("pluginQuery")
         if plugin_query is not None:
             plugins = get_plugins(plugin_query["all"])
@@ -356,7 +803,7 @@ asyncio.run(main())
 `)();
 
 // packages/safe-bash-command-python/src/llm-functions-loader.ts
-function deferred() {
+function deferred2() {
   let resolve, reject;
   const promise = new Promise((yes, no) => {
     resolve = yes;
@@ -370,6 +817,8 @@ function record(value) {
 }
 function createPythonLlmToolLoader(options) {
   if (!options.createExecutor) throw new TypeError("Python tool loading requires an asynchronous executor");
+  if (options.plugins !== void 0 && (!Array.isArray(options.plugins) || options.plugins.some((name) => typeof name !== "string" || !name || name !== name.trim() || name.includes(",")))) throw new TypeError("Python tool plugins must be explicit distribution names");
+  const pluginNames = Object.freeze([...options.plugins ?? []]);
   const capabilitiesByArguments = /* @__PURE__ */ new WeakMap();
   const command = createPythonExecutorCommands({ ...options, createCapabilities: (current) => {
     const capabilities = options.createCapabilities?.(current) ?? {};
@@ -387,7 +836,7 @@ function createPythonLlmToolLoader(options) {
     const controller = new AbortController();
     const runtimeController = new AbortController();
     const signal = AbortSignal.any([context.signal, controller.signal]);
-    const ready = deferred();
+    const ready = deferred2();
     const tools = [];
     const toolboxes = [];
     let plugins;
@@ -395,7 +844,7 @@ function createPythonLlmToolLoader(options) {
     const jobs = /* @__PURE__ */ new Map();
     const queue = [];
     let waiter;
-    let serial = 0, controls = 0, loaded = false, initializationFailed = false, closed = false, closing;
+    let serial3 = 0, controls = 0, loaded = false, initializationFailed = false, closed = false, closing;
     const encoder = new TextEncoder();
     const fail = (error) => {
       ready.reject(error);
@@ -411,7 +860,7 @@ function createPythonLlmToolLoader(options) {
     const aborted = () => fail(signal.reason);
     signal.addEventListener("abort", aborted, { once: true });
     const spool = async () => {
-      const value = await createLlmSpool(context.fs, context.cwd, signal);
+      const value = await createLlmSpool2(context.fs, context.cwd, signal);
       spools.add(value);
       if (closed || signal.aborted) {
         await value.close();
@@ -438,7 +887,7 @@ function createPythonLlmToolLoader(options) {
       try {
         output = await spool();
         callContext.signal.throwIfAborted();
-        const result = deferred(), id = ++serial;
+        const result = deferred2(), id = ++serial3;
         jobs.set(id, { result, output, attachments: [], files: /* @__PURE__ */ new Map(), bytes: 0, limit: Math.min(callContext.maxBytes, maxOutputBytes) });
         const request = { id, ...fields };
         if (waiter) {
@@ -464,7 +913,7 @@ function createPythonLlmToolLoader(options) {
       const message = record(value);
       if (message.op !== "next" && message.op !== "failed") signal.throwIfAborted();
       if (message.op === "definitions") return [...definitions];
-      if (message.op === "selection") return { names: [...toolNames], discovery, ...pluginQuery ? { pluginQuery: { all: pluginQuery.all, hooks: [...pluginQuery.hooks] } } : {} };
+      if (message.op === "selection") return { names: [...toolNames], discovery, ...pluginNames.length ? { plugins: [...pluginNames] } : {}, ...pluginQuery ? { pluginQuery: { all: pluginQuery.all, hooks: [...pluginQuery.hooks] } } : {} };
       if (message.op === "admit") {
         if (typeof message.size !== "number" || !Number.isSafeInteger(message.size) || message.size < 0) throw new TypeError("Invalid Python definition byte count");
         controls += message.size;
@@ -541,7 +990,7 @@ function createPythonLlmToolLoader(options) {
         if (signal.aborted) return { cancel: true };
         if (!loaded || waiter) throw new Error("Invalid Python tool request queue");
         if (queue.length) return queue.shift();
-        waiter = deferred();
+        waiter = deferred2();
         return waiter.promise;
       }
       if (typeof message.id !== "number") throw new TypeError("Invalid Python tool call identity");
@@ -604,7 +1053,7 @@ function createPythonLlmToolLoader(options) {
       }
     } };
     const { registerCleanup: ignoredParentCleanup, ...isolatedContext } = context;
-    const invocation = { ...isolatedContext, signal: runtimeController.signal, command: "python", args: ["-c", pythonLlmFunctionsProgram], stdin: toByteSource("") };
+    const invocation = { ...isolatedContext, signal: runtimeController.signal, command: "python", args: ["-c", pythonLlmFunctionsProgram], stdin: toByteSource4("") };
     capabilitiesByArguments.set(invocation.args, capability);
     const running = Promise.resolve().then(() => command.execute(invocation)).then(
       (result) => {
@@ -644,6 +1093,352 @@ function createPythonLlmToolLoader(options) {
   };
 }
 
+// packages/safe-bash-command-python/src/build-environment.ts
+function createPythonBuildEnvironment(options = {}) {
+  const manifestStore = createPythonPackageManifestStore({ maxEntries: 1, ...options.maxManifestBytes === void 0 ? {} : { maxBytes: options.maxManifestBytes } });
+  const isolated = { ...options, manifestStore, scope: "build" };
+  delete isolated.requirements;
+  delete isolated.requirementFiles;
+  delete isolated.profile;
+  const environment = createPythonPackageEnvironment(isolated);
+  let disposing;
+  return { ...environment, dispose() {
+    return disposing ??= environment.dispose().finally(() => manifestStore.dispose());
+  } };
+}
+
+// packages/safe-bash-command-python/src/build-dependencies.ts
+import { toByteSource as toByteSource6 } from "../../safe-bash-contracts/index.js";
+
+// packages/safe-bash-command-python/src/build-backend.ts
+import { toByteSource as toByteSource5 } from "../../safe-bash-contracts/index.js";
+function createPythonBuildBackend(options) {
+  if (!options.createExecutor || !options.environment || options.provisioning) throw new TypeError("Python build hooks require an asynchronous executor and explicit environment");
+  const capabilities = /* @__PURE__ */ new WeakMap();
+  const environment = options.environment;
+  const command = createPythonExecutorCommands({ ...options, environment: { ...environment, async prepare(context) {
+    return { ...await environment.prepare(context), bootstrap: true };
+  } }, createCapabilities(context) {
+    const provided = options.createCapabilities?.(context) ?? {};
+    if (provided.python_build) throw new Error("Python build capability is reserved");
+    const capability = capabilities.get(context.args);
+    if (!capability) throw new Error("Unknown Python build invocation");
+    return { ...provided, python_build: capability };
+  } })[0];
+  return async function run(input, context) {
+    context.signal.throwIfAborted();
+    const { maxBytes } = context;
+    if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new RangeError("Invalid Python build metadata limit");
+    if (!input || !["read_build_system", "check_build_requirements", "get_requires_for_build_wheel", "build_wheel"].includes(input.hook) || typeof input.source !== "string" || !input.source) throw new TypeError("Invalid Python build hook request");
+    if (input.hook === "check_build_requirements") {
+      if ([input.requirements, input.installed].some((values) => !Array.isArray(values) || values.some((value) => typeof value !== "string"))) throw new TypeError("Invalid Python build requirements request");
+    } else if (input.hook === "read_build_system") {
+      if (input.name !== void 0 && typeof input.name !== "string" || input.usePep517 !== void 0 && typeof input.usePep517 !== "boolean") throw new TypeError("Invalid Python build system request");
+    } else {
+      if (typeof input.backend !== "string" || !input.backend || input.backendPath !== void 0 && (!Array.isArray(input.backendPath) || input.backendPath.some((path) => typeof path !== "string")) || input.hook === "build_wheel" && (typeof input.wheelDirectory !== "string" || !input.wheelDirectory || input.metadataDirectory !== void 0 && typeof input.metadataDirectory !== "string")) throw new TypeError("Invalid Python build hook request");
+      if (input.configSettings !== void 0 && (!input.configSettings || typeof input.configSettings !== "object" || Array.isArray(input.configSettings) || Object.values(input.configSettings).some((value) => typeof value !== "string" && (!Array.isArray(value) || value.some((item) => typeof item !== "string"))))) throw new TypeError("Invalid Python build configuration");
+    }
+    const request = structuredClone(input.hook === "read_build_system" ? { ...input, maxBytes: maxBytes === Infinity ? null : maxBytes } : input);
+    let done = false, size = 0, failure;
+    const chunks = [];
+    const invocation = { ...context, command: "python", args: ["-c", pythonBuildBackendProgram], stdin: toByteSource5("") };
+    capabilities.set(invocation.args, { async call(value) {
+      try {
+        context.signal.throwIfAborted();
+        if (!value || typeof value !== "object" || Array.isArray(value) || done) throw new TypeError("Invalid Python build message");
+        const message = value;
+        if (message.op === "request") return request;
+        if (message.op === "error") {
+          if (typeof message.type !== "string" || typeof message.message !== "string") throw new TypeError("Invalid Python build failure");
+          failure ??= Object.assign(new Error(message.message), { name: message.type });
+          done = true;
+          return null;
+        }
+        if (message.op === "done") {
+          done = true;
+          return null;
+        }
+        if (message.op !== "text" || typeof message.text !== "string" || message.text.length > 8192) throw new TypeError("Invalid Python build metadata window");
+        const bytes = new TextEncoder().encode(message.text).length;
+        if (bytes > 16384 || bytes > maxBytes - size) throw new RangeError("Python build metadata limit exceeded");
+        size += bytes;
+        if (bytes) chunks.push(message.text);
+        return null;
+      } catch (error) {
+        failure ??= error;
+        throw error;
+      }
+    } });
+    try {
+      const result = await command.execute(invocation);
+      context.signal.throwIfAborted();
+      if (failure) throw failure;
+      if (result.exitCode) throw new Error(`Python build interpreter exited with status ${result.exitCode}`);
+      if (!done) throw new Error("Python build interpreter returned no result");
+      const value = JSON.parse(chunks.join(""));
+      if (request.hook === "check_build_requirements") {
+        const result2 = value;
+        if (!result2 || !Array.isArray(result2.missing) || result2.missing.some((value2) => typeof value2 !== "string") || !Array.isArray(result2.conflicting) || result2.conflicting.some((pair) => !Array.isArray(pair) || pair.length !== 2 || pair.some((value2) => typeof value2 !== "string"))) throw new TypeError("Invalid Python build requirement status");
+      } else if (request.hook === "read_build_system") {
+        if (value !== null) {
+          if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("Invalid Python build system");
+          const details = value;
+          if (typeof details.backend !== "string" || !details.backend || ["requires", "check", "backendPath"].some((key) => !Array.isArray(details[key]) || details[key].some((item) => typeof item !== "string"))) throw new TypeError("Invalid Python build system");
+        }
+      } else if (request.hook === "build_wheel") {
+        if (typeof value !== "string" || !value.endsWith(".whl") || value.includes("/") || value.includes("\\") || value.includes("\0")) throw new TypeError("Invalid Python build wheel filename");
+      } else if (!Array.isArray(value) || value.some((item) => typeof item !== "string")) throw new TypeError("Invalid Python build requirements");
+      return value;
+    } finally {
+      capabilities.delete(invocation.args);
+    }
+  };
+}
+var pythonBuildBackendProgram = /* @__PURE__ */ (() => String.raw`
+import importlib, json, os, sys, safe_host
+
+def send(op, **fields):
+ return safe_host.call('python_build', dict(op=op, **fields))
+
+def parse_build_requirement(value):
+ from urllib.parse import urlparse, urlunparse
+ from micropip._vendored.packaging.src.packaging.requirements import Requirement, InvalidRequirement
+ requirement = Requirement(value)
+ if requirement.url:
+  url = urlparse(requirement.url)
+  if (url.scheme == 'file' and urlunparse(url) != requirement.url) or (url.scheme != 'file' and not (url.scheme and url.netloc)): raise InvalidRequirement(value)
+ return requirement
+
+def check_build_requirements(request):
+ from importlib.metadata import distribution, PackageNotFoundError
+ from micropip._vendored.packaging.src.packaging.utils import canonicalize_name
+ from micropip._vendored.packaging.src.packaging.version import Version
+ installed = {canonicalize_name(name) for name in request['installed']}
+ conflicting, missing = set(), set()
+ for value in request['requirements']:
+  requirement = parse_build_requirement(value)
+  if canonicalize_name(requirement.name) not in installed:
+   missing.add(value)
+   continue
+  try: version = Version(distribution(requirement.name).version)
+  except PackageNotFoundError:
+   missing.add(value)
+   continue
+  if version not in requirement.specifier: conflicting.add((requirement.name + '==' + str(version), value))
+ return dict(conflicting=sorted(conflicting), missing=sorted(missing))
+
+def read_build_system(request):
+ import tomllib
+ from micropip._vendored.packaging.src.packaging.requirements import InvalidRequirement
+ class InstallationError(Exception): pass
+ source = request['source']
+ filename = os.path.join(source, 'pyproject.toml')
+ has_project, has_setup = os.path.isfile(filename), os.path.isfile(os.path.join(source, 'setup.py'))
+ system = None
+ if has_project:
+  limit = request['maxBytes']
+  with open(filename, 'rb') as stream: raw = stream.read() if limit is None else stream.read(limit + 1)
+  if limit is not None and len(raw) > limit: raise ValueError('Python build configuration limit exceeded')
+  system = tomllib.loads(raw.decode('utf-8')).get('build-system')
+ selected = request.get('usePep517')
+ if has_project and not has_setup:
+  if selected is False: raise InstallationError('Disabling PEP 517 processing is invalid: project does not have a setup.py')
+  selected = True
+ elif system and 'build-backend' in system:
+  if selected is False: raise InstallationError('Disabling PEP 517 processing is invalid: project specifies a build backend of {} in pyproject.toml'.format(system['build-backend']))
+  selected = True
+ elif selected is None: selected = has_project
+ if not selected: return None
+ defaults = ['setuptools>=40.8.0', 'wheel']
+ if system is None: system = {'requires': defaults, 'build-backend': 'setuptools.build_meta:__legacy__'}
+ def invalid(reason):
+  raise InstallationError('{} has a pyproject.toml file that does not comply with PEP 518: {}'.format(request.get('name', source), reason))
+ if 'requires' not in system: invalid("it has a 'build-system' table but not 'build-system.requires' which is mandatory in the table")
+ requirements = system['requires']
+ if not isinstance(requirements, list) or not all(isinstance(value, str) for value in requirements): invalid("'build-system.requires' is not a list of strings.")
+ for value in requirements:
+  try:
+   parse_build_requirement(value)
+  except InvalidRequirement: invalid("'build-system.requires' contains an invalid requirement: {!r}".format(value))
+ backend = system.get('build-backend')
+ return dict(requires=requirements, backend=backend if backend is not None else 'setuptools.build_meta:__legacy__', check=defaults if backend is None else [], backendPath=system.get('backend-path', []))
+
+def main():
+ request = send('request')
+ if request['hook'] == 'read_build_system': return read_build_system(request)
+ if request['hook'] == 'check_build_requirements': return check_build_requirements(request)
+ source = os.path.realpath(request['source'])
+ wheel_directory = os.path.abspath(request['wheelDirectory']) if request['hook'] == 'build_wheel' else None
+ metadata_directory = os.path.abspath(request['metadataDirectory']) if request.get('metadataDirectory') is not None else None
+ os.chdir(source)
+ paths = []
+ for entry in request.get('backendPath', []):
+  if os.path.isabs(entry): raise ValueError('paths must be relative')
+  path = os.path.realpath(os.path.join(source, entry))
+  if os.path.commonpath([source, path]) != source: raise ValueError('paths must be inside source tree')
+  paths.append(path)
+ sys.path[:0] = paths
+ module, _, attributes = request['backend'].partition(':')
+ backend = importlib.import_module(module)
+ if paths and not any(os.path.commonpath([os.path.realpath(backend.__file__), path]) == path for path in paths):
+  raise ValueError('Backend was not loaded from backend-path')
+ if attributes:
+  for name in attributes.split('.'): backend = getattr(backend, name)
+ settings = request.get('configSettings')
+ if request['hook'] == 'get_requires_for_build_wheel':
+  try: hook = backend.get_requires_for_build_wheel
+  except AttributeError: result = []
+  else: result = hook(settings)
+ else:
+  result = backend.build_wheel(wheel_directory, settings, metadata_directory)
+ return result
+
+try:
+ result = main()
+ encoder = json.JSONEncoder(ensure_ascii=False, separators=(',', ':'))
+ for part in encoder.iterencode(result):
+  for offset in range(0, len(part), 4096): send('text', text=part[offset:offset + 4096])
+ send('done')
+except Exception as error:
+ send('error', type=type(error).__name__, message=str(error))
+`)();
+
+// packages/safe-bash-command-python/src/build-dependencies.ts
+function createPythonBuildDependencies(options) {
+  const isolated = { ...options };
+  for (const key of ["packages", "requirements", "packageProfile", "provisioning"]) Reflect.deleteProperty(isolated, key);
+  const hook = createPythonBuildBackend(isolated), command = createPythonExecutorCommands(isolated)[0];
+  return async (input, caller) => {
+    const context = { ...caller };
+    context.signal.throwIfAborted();
+    const request = structuredClone(input), { source, buildSystem, configSettings } = request;
+    if (typeof source !== "string" || !source || request.name !== void 0 && typeof request.name !== "string" || !buildSystem || typeof buildSystem.backend !== "string" || !buildSystem.backend || [buildSystem.requires, buildSystem.check, buildSystem.backendPath].some((values) => !Array.isArray(values) || values.some((value) => typeof value !== "string"))) throw new TypeError("Invalid Python build dependency request");
+    if (configSettings !== void 0 && (!configSettings || typeof configSettings !== "object" || Array.isArray(configSettings) || Object.values(configSettings).some((value) => typeof value !== "string" && (!Array.isArray(value) || value.some((item) => typeof item !== "string"))))) throw new TypeError("Invalid Python build configuration");
+    if (context.maxBytes !== Infinity && (!Number.isSafeInteger(context.maxBytes) || context.maxBytes < 0)) throw new RangeError("Invalid Python build metadata limit");
+    const install = async (requirements2) => {
+      if (!requirements2.length) return;
+      const result = await command.execute({ ...context, command: "python", args: ["-m", "pip", "install", "--", ...requirements2], stdin: toByteSource6("") });
+      context.signal.throwIfAborted();
+      if (result.exitCode) throw new Error("Python build dependency installation exited with status " + result.exitCode);
+    };
+    const check = async (requirements2, against) => {
+      if (!requirements2.length) return [];
+      const receipt = await isolated.environment.prepare(context);
+      let installed;
+      try {
+        if (!receipt.records && receipt.restore?.length) throw new Error("Python build dependency checks require an installed metadata manifest");
+        installed = receipt.records?.map((record2) => record2[0]) ?? [];
+      } finally {
+        await isolated.environment.finish(receipt);
+      }
+      const status = await hook({ hook: "check_build_requirements", source, requirements: requirements2, installed }, context);
+      if (status.conflicting.length) throw Object.assign(new Error("Some build dependencies for " + (request.name ?? source) + " conflict with " + against + ": " + [...status.conflicting].sort(([a, b], [c, d]) => a < c ? -1 : a > c ? 1 : b < d ? -1 : b > d ? 1 : 0).map(([installed2, wanted]) => installed2 + " is incompatible with " + wanted).join(", ") + "."), { name: "InstallationError" });
+      return status.missing;
+    };
+    await install(buildSystem.requires);
+    const missing = await check(buildSystem.check, "PEP 517/518 supported requirements");
+    if (missing.length) await context.stderr.write(new TextEncoder().encode("Missing build requirements in pyproject.toml for " + (request.name ?? source) + ".\nThe project does not specify a build backend, and pip cannot fall back to setuptools without " + missing.map((value) => "'" + value + "'").join(" and ") + ".\n"));
+    const requirements = await hook({ hook: "get_requires_for_build_wheel", source, backend: buildSystem.backend, backendPath: buildSystem.backendPath, ...configSettings === void 0 ? {} : { configSettings } }, context);
+    await install(await check(requirements, "the backend dependencies"));
+  };
+}
+
+// packages/safe-bash-command-python/src/source-snapshot.ts
+import { compareIdentity } from "@poe-platform/safe-fs/core";
+import { FsError as FsError2 } from "../../safe-bash-contracts/index.js";
+import { resolvePath } from "../../safe-bash-contracts/path.js";
+import { yieldTurn } from "../../safe-bash-contracts/yield.js";
+import { admitCopySource, admitCopyDestination, copyCheckedSource } from "../../safe-bash-io-engine/commands/copy-source.js";
+var serial = 0;
+async function createPythonSourceSnapshot(source, directory, context) {
+  const { fs, signal } = context, settings = { signal };
+  signal.throwIfAborted();
+  if (!fs.iterateDirectory) throw new Error("Python source snapshots require lazy directory enumeration");
+  const origin = await fs.realpath(resolvePath(context.cwd, source), settings);
+  const parentPath = await fs.realpath(resolvePath(context.cwd, directory), settings);
+  const capabilities = await fs.capabilitiesFor?.(parentPath, settings) ?? fs.capabilities;
+  if (!fs.prepareDirectory || !fs.removeTreeConditional || !fs.confineExtraction || !capabilities.atomicTreeRemoval) throw new Error("Python source snapshots require confined writes, conditional directory creation and tree removal");
+  const original = await fs.stat(origin, settings), parent = await fs.stat(parentPath, settings);
+  if (original.type !== "directory" || parent.type !== "directory") throw new FsError2("ENOTDIR", { path: origin });
+  let path = "", owned;
+  for (let attempt = 0; attempt < 16; attempt++) {
+    path = resolvePath(parentPath, ".python-source-" + ++serial);
+    try {
+      owned = await fs.prepareDirectory(path, { parent, expected: null, mode: 448, signal });
+      break;
+    } catch (error) {
+      signal.throwIfAborted();
+      if (!(error instanceof FsError2) || !["EEXIST", "EAGAIN"].includes(error.code)) throw error;
+    }
+  }
+  if (!owned) throw new Error("Python source snapshot names exhausted");
+  let disposing;
+  const snapshot = { path, dispose() {
+    return disposing ??= (async () => {
+      const current = await fs.lstat(path);
+      if (compareIdentity(owned, current) !== "same") throw new Error("Python source snapshot identity changed");
+      await fs.removeTreeConditional(path, { parent, expected: current });
+    })();
+  } };
+  try {
+    const destination = await fs.confineExtraction([path], settings);
+    if (compareIdentity(owned, await fs.lstat(path, settings)) !== "same") throw new Error("Python source snapshot identity changed");
+    let activeCleanup;
+    context.registerCleanup?.(() => activeCleanup?.());
+    const copyContext = { ...context, registerCleanup(cleanup) {
+      activeCleanup = cleanup;
+    }, fs: new Proxy(destination, { get(target, key) {
+      const owner = key === "openReadFile" ? fs : target, value = Reflect.get(owner, key);
+      return typeof value === "function" ? value.bind(owner) : value;
+    } }) };
+    const metadata = async (from, to, expected) => {
+      const current = await fs.lstat(from, settings);
+      if (compareIdentity(expected, current) !== "same") throw new Error("Python source identity changed while copying");
+      if (destination.chmod) await destination.chmod(to, current.mode & 4095, settings);
+      if (destination.utimes) await destination.utimes(to, current.atimeMs, current.mtimeMs, settings);
+    };
+    const copy = async (from, to, expected) => {
+      signal.throwIfAborted();
+      if (expected.type === "symlink") {
+        if (!destination.symlink || !fs.readlink) throw new Error("Python source snapshots require symlink support");
+        const target = await fs.readlink(from, settings);
+        if (compareIdentity(expected, await fs.lstat(from, settings)) !== "same") throw new Error("Python source identity changed while copying");
+        await destination.symlink(target, to, settings);
+        return;
+      }
+      if (expected.type === "file") {
+        await admitCopySource(context, from);
+        await admitCopyDestination(copyContext, to, true);
+        try {
+          await copyCheckedSource(copyContext, from, to, expected, true);
+        } finally {
+          activeCleanup = void 0;
+        }
+      } else if (expected.type === "directory") {
+        if (to !== path) await destination.mkdir(to, { mode: 448, signal });
+        for await (const entry of fs.iterateDirectory(from, settings)) {
+          await yieldTurn(signal);
+          if (!entry.name || entry.name === "." || entry.name === ".." || entry.name.includes("/") || entry.name.includes("\0")) throw new Error("Invalid Python source directory entry");
+          const child = resolvePath(from, entry.name);
+          if (child === path || from === origin && [".tox", ".nox"].includes(entry.name)) continue;
+          await copy(child, resolvePath(to, entry.name), await fs.lstat(child, settings));
+        }
+      } else throw new Error("Unsupported Python source entry: " + from);
+      await metadata(from, to, expected);
+    };
+    await copy(origin, path, original);
+    signal.throwIfAborted();
+    return snapshot;
+  } catch (error) {
+    try {
+      await snapshot.dispose();
+    } catch (cleanup) {
+      throw new AggregateError([error, cleanup], "Python source snapshot cleanup failed");
+    }
+    throw error;
+  }
+}
+
 // packages/safe-bash-command-python/src/llm-manifest.ts
 var pythonLlmManifest = {
   "llm": "0.27.1",
@@ -1008,6 +1803,151 @@ del _install_safe_llm_import
   }
 }
 
+// packages/safe-bash-command-python/src/build-wheel.ts
+import { FsError as FsError3 } from "../../safe-bash-contracts/index.js";
+import { resolvePath as resolvePath2, basename } from "../../safe-bash-contracts/path.js";
+async function publishPythonBuildWheel(source, directory, maxBytes, context) {
+  const { fs, signal } = context, settings = { signal };
+  signal.throwIfAborted();
+  if (maxBytes !== Infinity && (!Number.isSafeInteger(maxBytes) || maxBytes < 0)) throw new RangeError("Invalid Python wheel size limit");
+  const filename = basename(source);
+  if (!filename.endsWith(".whl") || filename.includes("\\") || filename.includes("\0")) throw new TypeError("Invalid Python build wheel filename");
+  const root = await fs.realpath(resolvePath2(context.cwd, directory), settings);
+  const caps = await fs.capabilitiesFor?.(root, settings) ?? fs.capabilities;
+  if (!fs.confineExtraction || !fs.prepareDirectory || !caps.retainedStagingWrite || !caps.retainedStagingCleanup || !caps.retainedRead || !caps.atomicFileStaging) throw new Error("Python wheel publication requires confined retained atomic staging");
+  const artifact = await openPythonPackageFile(context, resolvePath2(context.cwd, source), maxBytes);
+  if (!artifact) throw new Error("Python wheel publication requires retained source reads");
+  let reading;
+  try {
+    const confined = await fs.confineExtraction([root], settings);
+    const destination = new Proxy(confined, { get(target, key) {
+      const owner = key === "openReadFile" ? fs : target, value = Reflect.get(owner, key);
+      return typeof value === "function" ? value.bind(owner) : value;
+    } });
+    const parent = await destination.stat(root, settings), path = resolvePath2(root, artifact.key);
+    try {
+      await destination.prepareDirectory(path, { parent, expected: null, mode: 448, signal });
+    } catch (error) {
+      if (!(error instanceof FsError3) || !["EEXIST", "EAGAIN"].includes(error.code)) throw error;
+    }
+    if ((await destination.lstat(path, settings)).type !== "directory") throw new Error("Python wheel publication directory changed");
+    const output = resolvePath2(path, filename);
+    const body = async function* () {
+      for (let offset = 0; offset < artifact.size; ) {
+        const bytes = await (reading = artifact.read(offset, 65536));
+        offset += bytes.length;
+        yield bytes;
+      }
+    };
+    const published = await stagePythonPackage({ ...context, fs: destination }, path, body(), maxBytes, () => {
+    }, (key) => {
+      if (key !== artifact.key) throw new Error("Built Python wheel integrity mismatch");
+    }, () => output);
+    if (!published) throw new Error("Python wheel publication requires retained atomic staging");
+    try {
+      return { url: "file://" + output.split("/").map(encodeURIComponent).join("/"), digest: published.key, size: published.size };
+    } finally {
+      await published.close();
+    }
+  } finally {
+    try {
+      await reading?.catch(() => {
+      });
+    } finally {
+      await artifact.close();
+    }
+  }
+}
+
+// packages/safe-bash-command-python/src/source-environment.ts
+import { compareIdentity as compareIdentity2 } from "@poe-platform/safe-fs/core";
+import { FsError as FsError4, toByteSource as toByteSource7 } from "../../safe-bash-contracts/index.js";
+import { resolvePath as resolvePath3 } from "../../safe-bash-contracts/path.js";
+var serial2 = 0;
+function createPythonSourcePackageEnvironment(options, build) {
+  if (options.prepareRequirements || !build.python.createExecutor || !build.directory) throw new TypeError("Source packages require an asynchronous build executor and caller storage");
+  const prepareRequirement = async (requirement, context) => {
+    const { fs, signal } = context, settings = { signal };
+    let source = requirement;
+    if (source.startsWith("file:")) {
+      const url = new URL(source);
+      if (url.host && url.host !== "localhost") return requirement;
+      source = decodeURIComponent(url.pathname);
+    } else if (source.includes("://")) return requirement;
+    source = resolvePath3(context.cwd, source);
+    try {
+      if ((await fs.stat(source, settings)).type !== "directory") return requirement;
+    } catch (error) {
+      if (error instanceof FsError4 && error.code === "ENOENT") return requirement;
+      throw error;
+    }
+    if (!context.stdout || !context.stderr || !context.env) throw new TypeError("Source package preparation requires command output and environment context");
+    if (!fs.prepareDirectory || !fs.removeTreeConditional || !fs.confineExtraction) throw new Error("Source packages require conditional caller storage");
+    const root = await fs.realpath(resolvePath3(context.cwd, build.directory), settings), parent = await fs.stat(root, settings);
+    const caps = await fs.capabilitiesFor?.(root, settings) ?? fs.capabilities;
+    if (!caps.atomicTreeRemoval) throw new Error("Source packages require conditional tree cleanup");
+    let path = "", owned;
+    for (let attempt = 0; attempt < 16; attempt++) {
+      path = resolvePath3(root, ".python-build-" + ++serial2);
+      try {
+        owned = await fs.prepareDirectory(path, { parent, expected: null, mode: 448, signal });
+        break;
+      } catch (error) {
+        if (!(error instanceof FsError4) || !["EEXIST", "EAGAIN"].includes(error.code)) throw error;
+        signal.throwIfAborted();
+      }
+    }
+    if (!owned) throw new Error("Python build directory names exhausted");
+    const environment = createPythonBuildEnvironment(options);
+    let cleaning;
+    const remove = async () => {
+      const current = await fs.lstat(path);
+      if (compareIdentity2(owned, current) !== "same") throw new Error("Python build directory identity changed");
+      await fs.removeTreeConditional(path, { parent, expected: current });
+    };
+    const cleanup = () => cleaning ??= (async () => {
+      try {
+        await environment.dispose();
+      } finally {
+        await remove();
+      }
+    })();
+    try {
+      const confined = await fs.confineExtraction([path], settings);
+      if (compareIdentity2(owned, await fs.lstat(path, settings)) !== "same") throw new Error("Python build directory identity changed");
+      const staging = new Proxy(confined, { get(target, key) {
+        const owner = ["stat", "lstat", "realpath", "openReadFile", "iterateDirectory", "readlink", "confineExtraction", "removeTreeConditional"].includes(String(key)) ? fs : target, value = Reflect.get(owner, key);
+        return typeof value === "function" ? value.bind(owner) : value;
+      } });
+      const command = { ...context, env: context.env, stdout: context.stdout, stderr: context.stderr, command: "python", args: [], stdin: toByteSource7("") };
+      const snapshot = await createPythonSourceSnapshot(source, path, { ...command, fs: staging });
+      const wheelDirectory = resolvePath3(path, "wheels");
+      await confined.mkdir(wheelDirectory, settings);
+      const configuration = { ...build.python, environment }, hook = createPythonBuildBackend(configuration), hookContext = { ...command, maxBytes: options.maxMetadataBytes ?? Infinity };
+      const buildSystem = await hook({ hook: "read_build_system", source: snapshot.path }, hookContext);
+      if (!buildSystem) throw new Error("Legacy setup.py source installation is not yet available");
+      await createPythonBuildDependencies(configuration)({ source: snapshot.path, buildSystem }, hookContext);
+      const filename = await hook({ hook: "build_wheel", source: snapshot.path, backend: buildSystem.backend, backendPath: buildSystem.backendPath, wheelDirectory }, hookContext);
+      const published = await publishPythonBuildWheel(resolvePath3(wheelDirectory, filename), root, options.maxDownloadBytes ?? Infinity, context);
+      await cleanup();
+      return published.url;
+    } catch (error) {
+      try {
+        await cleanup();
+      } catch (retirement) {
+        if (retirement === error) throw error;
+        throw new AggregateError([error, retirement], "Python source build cleanup failed");
+      }
+      throw error;
+    }
+  };
+  return createPythonPackageEnvironment({ ...options, async prepareRequirements(requirements, context) {
+    const resolved = [];
+    for (const requirement of new Set(requirements)) resolved.push(await prepareRequirement(requirement, context));
+    return resolved;
+  } });
+}
+
 // packages/safe-bash-command-python/src/executor.ts
 var PythonInputChunkError = class extends RangeError {
 };
@@ -1035,8 +1975,8 @@ function createPythonExecutorCommands(options) {
     }
     let installation;
     try {
-      parsePythonInvocation(context.args, context.env);
-      installation = parsePythonInstallation(context.args);
+      const invocation = parsePythonInvocation(context.args, context.env);
+      installation = invocation.module?.name === "pip" ? parsePythonInstallation(invocation.module.args) : void 0;
     } catch (error) {
       if (!(error instanceof PythonInvocationError)) throw error;
       await writeBytes(context.stderr, new TextEncoder().encode("python: " + error.message + "\n"), context.signal);
@@ -1099,7 +2039,7 @@ function createPythonExecutorCommands(options) {
         const results = await Promise.allSettled([subscription, termination, filesystemRetirement, hostBridge?.close(), stdoutOperation?.close(), stderrOperation?.close(), ...pending]);
         await input.return?.(void 0);
         fragment = void 0;
-        if (packages) environment.finish(packages);
+        if (packages) results.push(...await Promise.allSettled([Promise.resolve().then(() => environment.finish(packages))]));
         if (results[1]?.status === "fulfilled" && admitted) {
           activeWorkers--;
           admitted = false;
@@ -1149,7 +2089,7 @@ function createPythonExecutorCommands(options) {
           if (!Number.isSafeInteger(length) || length < 1 || length > maxTransferBytes) throw new RangeError("Invalid Python input request");
           let pulls = 0;
           while (!fragment || offset === fragment.length) {
-            if (++pulls % 128 === 0) await yieldTurn(signal);
+            if (++pulls % 128 === 0) await yieldTurn2(signal);
             const next = await input.next();
             if (next.done) return [];
             inputBytes += next.value.length;
@@ -1185,10 +2125,11 @@ function createPythonExecutorCommands(options) {
       }
       options.onProgress?.({ phase: "initializing", command: context.command });
       const preparation = environment.prepare({
-        fs: context.fs,
-        cwd: context.cwd,
+        ...context,
         signal,
-        requirements: [...options.packages ?? [], ...options.packageProfile ? pythonDocumentPackages : [], ...installation?.packages ?? []],
+        ...installation?.controls,
+        ...installation?.uninstall ? { uninstall: { packages: installation.packages, yes: !!installation.yes } } : {},
+        requirements: [...options.packages ?? [], ...options.packageProfile ? pythonDocumentPackages : [], ...installation?.uninstall ? [] : installation?.packages ?? []],
         requirementFiles: [...options.requirements ?? [], ...installation?.requirements ?? []]
       }).then((value) => {
         packages = value;
@@ -1458,9 +2399,20 @@ function pythonExecutorCommands(options) {
 }
 
 export {
+  createPythonLlmPackageManager,
+  createPythonLlmTemplateLoader,
+  createPythonLlmFragmentLoader,
+  createPythonLlmLoaderProvider,
+  createPythonLlmLoaderDiscovery,
   createPythonLlmToolLoader,
+  createPythonBuildEnvironment,
+  createPythonBuildBackend,
+  createPythonBuildDependencies,
+  createPythonSourceSnapshot,
   pythonLlmPackages,
   installPythonLlmPackages,
+  publishPythonBuildWheel,
+  createPythonSourcePackageEnvironment,
   createPythonExecutorCommands,
   pythonExecutorCommands
 };