@selesai/code 0.13.40 → 0.14.3

package/dist/extensions/pi-subagents/src/runs/shared/readonly-session-evidence.ts

@@ -1,307 +0,0 @@
-/** Internal, opt-in factory evidence. No runner enables continuation through this module. */
-import { createHash } from "node:crypto";
-import { lstatSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { isDeepStrictEqual } from "node:util";
-import type { AgentSession, SessionEntry, SessionHeader } from "@selesai/code";
-import type { ChildSession, ChildSessionLaunch, PiCodingAgentModule } from "./child-session.ts";
-import { captureReadonlyChildDrain, isReadonlyChildHookProfile, isReadonlyChildSessionReporting, observeReadonlyChildHookDrain } from "./child-hooks.ts";
-
-type Runtime = Awaited<ReturnType<PiCodingAgentModule["ModelRuntime"]["create"]>>;
-type Model = NonNullable<AgentSession["model"]>;
-
-export interface SettledReadonlyEvidence {
-	readonly sessionFile: string;
-	readonly sessionId: string;
-	readonly leafId: string;
-	readonly provider: string;
-	readonly model: string;
-	readonly api: string;
-	readonly status: 429;
-	/** Complete active context, not the host's attempt-only event projection. */
-	readonly contextJson: string;
-	readonly completedToolResults: number;
-	readonly fileDigest: string;
-}
-
-const requested = new WeakMap<ChildSessionLaunch, SettledReadonlyEvidence | null>();
-const receipts = new WeakMap<ChildSession, SettledReadonlyEvidence>();
-// Opaque configured-provider continuity, never an implementation-origin attestation.
-const providers = new WeakMap<SettledReadonlyEvidence, object>();
-
-/** Internal integration seam: opt in before factory creation. Ordinary launches do no evidence I/O. */
-export function requestReadonlySessionEvidence(launch: ChildSessionLaunch, expected?: SettledReadonlyEvidence): void {
-	requested.set(launch, expected ?? null);
-}
-
-/** Only the default factory can produce a receipt; duck-typed fake child properties are ignored. */
-export function getReadonlySessionEvidence(child: ChildSession): SettledReadonlyEvidence | undefined {
-	return receipts.get(child);
-}
-
-function digest(bytes: string): string {
-	return createHash("sha256").update(bytes).digest("hex");
-}
-
-function absent(file: string): boolean {
-	try { lstatSync(file); return false; }
-	catch (error) { return (error as NodeJS.ErrnoException).code === "ENOENT"; }
-}
-
-function sameStored(disk: unknown, live: unknown): boolean {
-	// The SDK keeps optional undefined fields in memory which JSONL intentionally omits.
-	return isDeepStrictEqual(disk, JSON.parse(JSON.stringify(live)));
-}
-
-/** Must run before opening a retained file. Never repairs, truncates, or creates it. */
-export function validateReadonlySessionCheckpoint(evidence: SettledReadonlyEvidence): boolean {
-	if (!providers.has(evidence)) return false;
-	try { return digest(readFileSync(evidence.sessionFile, "utf8")) === evidence.fileDigest; }
-	catch { return false; }
-}
-
-function readHistory(file: string): { header: SessionHeader; entries: SessionEntry[]; bytes: string } {
-	const bytes = readFileSync(file, "utf8");
-	if (!bytes.endsWith("\n")) throw new Error("Incomplete session file");
-	const rows = bytes.slice(0, -1).split("\n").map((line) => JSON.parse(line));
-	const [header, ...entries] = rows;
-	if (header?.type !== "session" || header.version !== 3 || typeof header.id !== "string" || !header.id || typeof header.cwd !== "string" || !entries.length) throw new Error("Unsupported session header");
-	const ids = new Set<string>();
-	for (const entry of entries) {
-		if (!entry || typeof entry.id !== "string" || !entry.id || ids.has(entry.id) || typeof entry.type !== "string" || typeof entry.timestamp !== "string" || (entry.parentId !== null && !ids.has(entry.parentId))) throw new Error("Broken session chain");
-		ids.add(entry.id);
-	}
-	return { header, entries, bytes };
-}
-
-function activeMessages(branch: SessionEntry[]): AgentSession["messages"] {
-	const messages = branch.flatMap((entry) => {
-		if (entry.type === "message") return [entry.message];
-		// Compaction/branch summaries and custom context need their own proof; do not reconstruct them.
-		if (!["model_change", "thinking_level_change", "session_info", "label"].includes(entry.type)) throw new Error("Unsupported active context");
-		return [];
-	});
-	// Snapshot the persisted representation, not mutable SDK message references.
-	return JSON.parse(JSON.stringify(messages));
-}
-
-function completedResults(messages: AgentSession["messages"]): number {
-	const pending = new Map<string, string>();
-	const seen = new Set<string>();
-	let completed = 0;
-	for (const message of messages) {
-		if (message.role === "toolResult") {
-			if (typeof message.toolCallId !== "string" || !pending.has(message.toolCallId) || pending.get(message.toolCallId) !== message.toolName || !Array.isArray(message.content)) throw new Error("Unmatched tool result");
-			pending.delete(message.toolCallId);
-			if (!message.isError && message.content.length) completed++;
-		} else {
-			if (pending.size) throw new Error("Unresolved tool call");
-			if (message.role === "assistant") {
-				if (!Array.isArray(message.content)) throw new Error("Invalid assistant content");
-				for (const block of message.content) {
-					if (block.type !== "toolCall") continue;
-					if (!block.id || typeof block.id !== "string" || seen.has(block.id) || !["read", "ls"].includes(block.name)) throw new Error("Uncertified tool call");
-					seen.add(block.id);
-					pending.set(block.id, block.name);
-				}
-			} else if (message.role !== "user") throw new Error("Unsupported context message");
-		}
-	}
-	if (pending.size) throw new Error("Unresolved tool call");
-	return completed;
-}
-
-function eligibleLaunch(launch: ChildSessionLaunch): boolean {
-	const r = launch.runtime;
-	return launch.ambientExtensions === false && !launch.extensionPaths.length
-		&& isReadonlyChildSessionReporting(launch)
-		&& (!launch.hooks.length || (launch.storage.kind === "file" && isReadonlyChildHookProfile(launch.hooks, r)))
-		&& launch.tools !== undefined && launch.tools.every((tool) => tool === "read" || tool === "ls")
-		&& !r.toolBudget && !r.permissions && !r.childWatchdog && !r.watchdogStatus && !r.structuredOutput
-		&& !r.waitTool.enabled && !r.fanoutChild && !r.fast && !r.nestedRoute && !r.nestedParent && !r.runFanoutBudget
-		&& !r.supervisorChannelDir && !r.mcpDirectTools?.length;
-}
-
-export interface ReadonlyEvidenceObserver {
-	start(): void;
-	settled(): void;
-	invalidate(): void;
-	beforeShutdown(): void;
-	finish(child: ChildSession): void;
-}
-
-/** Called only on the explicit opt-in path, before SessionManager.open can permissively repair input. */
-export function prepareReadonlySessionEvidence(launch: ChildSessionLaunch): { loadingHooks(enabled: boolean): void; beforeOpen(): void; opened(manager: AgentSession["sessionManager"]): void; observe(pi: PiCodingAgentModule, runtime: Runtime, session: AgentSession): ReadonlyEvidenceObserver | undefined } | undefined {
-	if (!requested.has(launch)) return undefined;
-	const expected = requested.get(launch);
-	requested.delete(launch);
-	const deny = (): undefined => {
-		if (expected) throw new Error("Unsupported read-only continuation session");
-		return undefined;
-	};
-	const checkExpected = (): void => {
-		if (expected && (launch.storage.kind !== "file" || resolve(launch.storage.sessionFile) !== expected.sessionFile || !validateReadonlySessionCheckpoint(expected))) throw new Error("Read-only continuation checkpoint changed");
-	};
-	checkExpected();
-	if (!eligibleLaunch(launch) || launch.storage.kind !== "file") return deny();
-	const file = resolve(launch.storage.sessionFile);
-	// Only an initially absent *assigned exact file* may use SDK initialization.
-	// Empty files, dangling symlinks, inaccessible and corrupt inputs are not fresh.
-	let fresh = !expected && absent(file);
-	let initialHeader: SessionHeader | undefined;
-	try { if (!fresh) initialHeader = readHistory(file).header; }
-	catch { return deny(); }
-	const beforeOpen = (): void => {
-		checkExpected();
-		if (fresh) fresh = absent(file);
-	};
-	const opened = (manager: AgentSession["sessionManager"]): void => {
-		if (fresh && manager.getSessionFile() === file && manager.getEntries().length === 0 && manager.getLeafId() === null) {
-			// Capture the real SDK-generated identity immediately after open, before hooks.
-			initialHeader = JSON.parse(JSON.stringify(manager.getHeader()));
-		}
-	};
-	const observe = (pi: PiCodingAgentModule, runtime: Runtime, session: AgentSession): ReadonlyEvidenceObserver | undefined => {
-		const drainSettled = captureReadonlyChildDrain(launch.hooks);
-		// A deliberately tested capability floor, not an attestation of installed code origin.
-		if (!initialHeader || pi.VERSION !== "0.85.1" || !session.model || !session.agent.streamFunction) return deny();
-		const header = initialHeader;
-		const model = { ...session.model };
-		const provider = runtime.getProvider(model.provider);
-		if (expected && provider !== providers.get(expected)) return deny();
-		// Coverage is namespace/API plus the observed POST topology below, not builtin provider origin.
-		const supported = (m: Model): boolean => m.provider === "baseten" && m.api === "openai-completions"
-			&& runtime.getProvider(m.provider) === provider
-			&& !runtime.getRegisteredNativeProvider(m.provider) && !runtime.getRegisteredProviderConfig(m.provider);
-		const allowed = launch.tools!.filter((name) => !launch.excludeTools?.includes(name)).sort();
-		const toolsMatch = (): boolean => {
-			const tools = session.getAllTools();
-			return isDeepStrictEqual(session.getActiveToolNames().sort(), allowed)
-				&& isDeepStrictEqual(tools.map((tool) => tool.name).sort(), allowed)
-				&& tools.every((tool) => tool.sourceInfo?.source === "builtin");
-		};
-		const idle = (): boolean => session.isIdle && !session.isRetrying && !session.agent.hasQueuedMessages()
-			&& session.agent.state.pendingToolCalls.size === 0 && !session.hasPendingBashMessages;
-		const continuity = (): boolean => eligibleLaunch(launch) && toolsMatch() && session.model !== undefined
-			&& session.model.id === model.id && session.model.provider === model.provider && session.model.api === model.api && supported(session.model);
-		const history = () => {
-			const disk = readHistory(file);
-			const manager = session.sessionManager;
-			const leaf = manager.getLeafId();
-			if (session.sessionFile !== file || session.sessionId !== header.id || !leaf || leaf !== disk.entries.at(-1)?.id
-				|| !isDeepStrictEqual(disk.header, header) || !sameStored(disk.header, manager.getHeader())
-				|| !sameStored(disk.entries, manager.getEntries())) throw new Error("Session checkpoint mismatch");
-			// The disk chain and live entries already agree; use the SDK's raw branch walk.
-			const messages = activeMessages(manager.getBranch());
-			if (!sameStored(messages, session.messages)) throw new Error("Incomplete active context");
-			return { ...disk, messages, leaf, completed: completedResults(messages) };
-		};
-		const startingHistory = () => {
-			// SDK defers persistence until its first assistant response. This exception
-			// is for the empty source baseline only; settlement always reads strict disk history.
-			if (fresh && absent(file)) {
-				const manager = session.sessionManager;
-				if (session.sessionFile !== file || session.sessionId !== header.id || !sameStored(header, manager.getHeader())
-					|| session.messages.length
-					|| manager.getEntries().some((entry) => !["model_change", "thinking_level_change", "session_info", "label"].includes(entry.type))) throw new Error("Fresh session initialization changed");
-				return { messages: [] as AgentSession["messages"], completed: 0 };
-			}
-			return history();
-		};
-		if (!provider || !eligibleLaunch(launch) || !supported(model) || !toolsMatch() || !idle()) return deny();
-		try {
-			const restored = startingHistory();
-			if (expected && (model.provider !== expected.provider || JSON.stringify(restored.messages) !== expected.contextJson)) throw new Error("Restored continuation context changed");
-		} catch (error) {
-			if (expected) throw error;
-			return undefined;
-		}
-		let invalid = false;
-		let phase: "new" | "running" | "settled" = "new";
-		let owner: ChildSession | undefined;
-		let baseline = 0;
-		let before: AgentSession["messages"] = [];
-		let inFlight = 0;
-		type Invocation = { status?: number; pending: number; ambiguous: boolean; result?: Awaited<ReturnType<Awaited<ReturnType<typeof session.agent.streamFunction>>["result"]>> };
-		let latest: Invocation | undefined;
-		const original = session.agent.streamFunction;
-		const wrapped: typeof original = async (m, context, options) => {
-			const invocation: Invocation = { pending: 0, ambiguous: false };
-			latest = invocation;
-			if (inFlight++ || phase !== "running" || !eligibleLaunch(launch) || !supported(m) || m.id !== model.id || !toolsMatch()) invalid = true;
-			if (expected && (!continuity() || session.agent.streamFunction !== wrapped)) invalid = true;
-			// The repository's older agent-core types omit this documented 0.85.1 request option.
-			const transport = (options as (typeof options & { fetch?: typeof fetch }))?.fetch ?? globalThis.fetch;
-			const observedFetch: typeof fetch = async (...args) => {
-				invocation.status = undefined; // Starting even a rejected retry invalidates any earlier 429.
-				if (invocation.pending++ || invocation.result) invocation.ambiguous = true;
-				try {
-					try {
-						const [input, init] = args;
-						const url = new URL(input instanceof Request ? input.url : String(input));
-						// Only the tested completions POST topology. Radius /messages and auxiliary requests deny.
-						if (init?.method !== "POST" || !url.pathname.endsWith("/chat/completions") || typeof init.body !== "string") invocation.ambiguous = true;
-					} catch { invocation.ambiguous = true; }
-					const response = await transport(...args);
-					invocation.status = response.status;
-					return response;
-				} catch (error) {
-					invocation.status = undefined;
-					throw error;
-				} finally { invocation.pending--; }
-			};
-			try {
-				// Guarded continuations must veto known changes before entering configured SDK dispatch.
-				if (expected && invalid) throw new Error("Read-only continuation changed before dispatch");
-				const stream = await original.call(session.agent, m, context, { ...options, fetch: observedFetch });
-				// Observe result without consuming or replacing the event stream.
-				void stream.result().then((result) => {
-					invocation.result = result;
-					inFlight--;
-				}, () => { invalid = true; inFlight--; });
-				return stream;
-			} catch (error) { invalid = true; inFlight--; throw error; }
-		};
-		session.agent.streamFunction = wrapped;
-		return {
-			start() {
-				if (owner) receipts.delete(owner);
-				if (phase !== "new" || !idle()) invalid = true;
-				if (expected && (!continuity() || session.agent.streamFunction !== wrapped)) invalid = true;
-				phase = "running";
-				latest = undefined;
-				try {
-					const h = startingHistory(); baseline = h.completed; before = h.messages;
-					if (expected && JSON.stringify(h.messages) !== expected.contextJson) invalid = true;
-				} catch { invalid = true; }
-				if (expected && invalid) throw new Error("Read-only continuation changed before prompt");
-			},
-			settled() { phase = "settled"; },
-			invalidate() { invalid = true; if (owner) receipts.delete(owner); },
-			beforeShutdown() {
-				// Only the identity-certified prompt runtime may finalize owned acknowledgements.
-				if (!launch.hooks.length || !continuity()) invalid = true;
-			},
-			finish(child) {
-				owner = child;
-				if (!drainSettled()) return;
-				if (invalid || child.detached || child.shutDown || phase !== "settled" || inFlight || !eligibleLaunch(launch) || !idle() || !supported(model) || !toolsMatch() || session.agent.streamFunction !== wrapped
-					|| session.model?.id !== model.id || session.model.provider !== model.provider || session.model.api !== model.api) return;
-				const invocation = latest;
-				const terminal = invocation?.result;
-				if (!invocation || invocation.ambiguous || invocation.pending || invocation.status !== 429 || terminal?.stopReason !== "error"
-					|| terminal.content.length || terminal.provider !== model.provider || terminal.model !== model.id || terminal.api !== model.api) return;
-				try {
-					const h = history();
-					if (h.completed <= baseline || !isDeepStrictEqual(h.messages.slice(0, before.length), before) || !sameStored(h.messages.at(-1), terminal)) return;
-					const receipt: SettledReadonlyEvidence = Object.freeze({ sessionFile: file, sessionId: session.sessionId, leafId: h.leaf,
-						provider: model.provider, model: model.id, api: model.api, status: 429, contextJson: JSON.stringify(h.messages),
-						completedToolResults: h.completed, fileDigest: digest(h.bytes) });
-					providers.set(receipt, provider);
-					receipts.set(child, receipt);
-				} catch { /* Strict checkpoint failures only deny evidence; never repair storage. */ }
-			},
-		};
-	};
-	return { beforeOpen, opened, observe, loadingHooks: (enabled) => observeReadonlyChildHookDrain(launch.hooks, enabled, file) };
-}

package/dist/extensions/pi-subagents/src/runs/shared/task-intent.ts

@@ -1,211 +0,0 @@
-/**
- * Shared task mutation-intent classifier.
- *
- * Single authority for reading a task's wording, answering two different
- * questions from one prohibition analysis:
- *
- * - `classifyTaskMutationIntent` / `expectsImplementationMutation`: does the
- *   task REQUIRE file changes? Consumed by the completion mutation guard,
- *   which blocks completion, so its vocabulary is deliberately narrow.
- * - `taskMayMutate`: COULD the task plausibly change files? Consumed by
- *   acceptance level inference, which only raises evidence gates, so its
- *   vocabulary is deliberately broad (any bare write verb).
- *
- * Explicit read-only wording ("do not modify", "review only") is a task-level
- * intent only when no write imperative survives outside those phrases. A task
- * like "Do not modify tests; implement the fix" is an implementation task with
- * a scoped constraint, not a read-only task.
- */
-
-const REVIEW_ONLY_PATTERNS = [
-	/\breview only\b/i,
-	/\bsuggest fixes only\b/i,
-	/\bonly return findings\b/i,
-	/\breturn findings only\b/i,
-];
-
-const REVIEWER_REQUIRED_EDIT_PATTERNS = [
-	/\bmust\s+(?:edit|modify|change|fix|patch|apply|implement)\b/i,
-	/\brequired\s+to\s+(?:edit|modify|change|fix|patch|apply|implement)\b/i,
-	/(?:^|[.!?\n]\s*)implement\s+(?:the\s+)?(?:approved|requested|specified|file|code|source|fix(?:es)?|changes?)\b/i,
-	/\bregardless\s+of\s+findings\b/i,
-	/\balways\s+(?:edit|modify|change|fix|patch|apply|implement)\b/i,
-	/\bapply\s+(?:the\s+)?fix(?:es)?\s+directly\b/i,
-	/\bmake\s+(?:the\s+)?code\s+changes\b/i,
-];
-
-// The prohibition's object ends at punctuation, a serialized line separator,
-// or a coordinating word (but/and/then), so a follow-on clause like "but
-// implement the fix" stays in the text for write-intent testing instead of
-// being swallowed as the object.
-// Accept serialized line separators too: workflow prompts can carry literal
-// `\\n`/`\\r\\n` between clauses instead of decoded newlines.
-const NO_EDIT_PROHIBITION_PATTERN = /(?:\b|\\(?:r\\n|n))(?:do not|don't|must not)\s+(?:edit|modify|write(?:\s+to)?|touch|change)\b((?:(?!\b(?:but|and|then)\b|\\(?:r\\n|n))[^.;,:!?\n–—-])*)/gi;
-const COORDINATED_NO_EDIT_PROHIBITION_PATTERN = /(?:\b|\\(?:r\\n|n))(?:do not|don't|must not)\s+((?=(?:(?!\\(?:r\\n|n))[^.;:!?\n–—-])*\b(?:and|or)\s+(?:edit|modify|write(?:\s+to)?|touch|change)\b)(?:(?!\\(?:r\\n|n))[^.;:!?\n–—-])*?\b(?:and|or)\s+(?:edit|modify|write(?:\s+to)?|touch|change)\b(?:(?!\b(?:but|and|then)\b|\\(?:r\\n|n))[^.;,:!?\n–—-])*)/gi;
-
-/** Objects of a no-edit prohibition that mean "the codebase in general" rather than a named scope. */
-const GENERIC_PROHIBITION_OBJECT = /^\s*(?:(?:any|all|the|these|those|your|our|existing|project|product|source|sources|config|configs|repo|repository)[\s/,-]*)*(?:files?|code|codebase|sources?|anything|repo(?:sitory)?)?\s*$/i;
-const SCOPED_PROHIBITION_CONTINUATION = /^(?:\\(?:r\\n|n)|\r?\n)\s*(?:in|inside|under|within|outside|except|other\s+than|besides)\b/i;
-const OUTPUT_INSTRUCTION_CONTINUATION = /^(?:\\(?:r\\n|n)|\r?\n)\s*(?:in|inside|within)\s+(?:(?:(?:your|the)\s+)(?:final\s+)?|final\s+)(?:output|response|report|answer|reply|message|summary|findings?|analysis|recommendations?)(?:\s*\/\s*(?:output|response|report|answer|reply|message|summary|findings?|analysis|recommendations?))*\b(?![\\/])/i;
-
-function hasScopedProhibitionContinuation(text: string): boolean {
-	return SCOPED_PROHIBITION_CONTINUATION.test(text) && !OUTPUT_INSTRUCTION_CONTINUATION.test(text);
-}
-
-const SCOPED_NO_EDIT_CONSTRAINT_PATTERNS = [
-	/\bdo not edit files?\s+outside\b/i,
-	/\bdo not edit\s+outside\b/i,
-	/\bdo not edit\s+unrelated files?\b/i,
-	/\bdo not change\s+unrelated files?\b/i,
-	/\bdo not modify\s+unrelated files?\b/i,
-];
-
-const NO_TOOL_INTENT_PATTERNS = [
-	/\bno tools? needed\b/i,
-	/\bno tools? required\b/i,
-	/\bwithout using tools\b/i,
-	/\bdo not use tools\b/i,
-	/\bdon't use tools\b/i,
-];
-
-const READ_ONLY_DELIVERABLE_PATTERNS = [
-	/\b(?:draft|write|compose|prepare|produce)\s+(?:(?:a|an|the)\s+)?(?:github\s+)?(?:issue|bug report|issue draft|issue body|proposal|plan|report|summary|findings?|analysis|recommendations?)\b/i,
-	/\b(?:issue|bug report)\s+(?:draft|body|template)\b/i,
-	/\b(?:return|provide|produce)\s+(?:text|markdown|answer|findings?|recommendations?)\s+only\b/i,
-];
-
-const RESEARCH_AGENT_PATTERNS = [
-	/\binvestigate\b/i,
-	/\bscout\b/i,
-	/\bresearch(?:er)?\b/i,
-];
-
-// Review/severity vocabulary like "must-fix items" or "should-fix tests" is not
-// the verb. Rather than dash-guarding every pattern (which would also suppress
-// CLI flags like "--fix" and genuine clause-level dashes like "branch—fix it"),
-// strip the known severity compounds (must|should|needs + dash + verb) from the
-// task text before matching. Dash coverage: ASCII hyphen + U+2010..U+2015.
-const SEVERITY_COMPOUND_PATTERN = /\b(?:must|should|needs)[\-\u2010-\u2015](?:fix|edit|update|add|remove|replace|create|apply|make|do|implement|modify|delete|patch)\b/gi;
-
-function stripSeverityCompounds(task: string): string {
-	return task.replace(SEVERITY_COMPOUND_PATTERN, " ");
-}
-export { stripSeverityCompounds };
-
-const FIX_OR_PATCH_IMPLEMENTATION_PATTERN = /\b(?:fix|patch)\s+(?:(?:it|this|that|them|each|any|all|these|those)\b|(?:(?:a|an|the|any|all)\s+)?(?:(?:failing|failed|broken|flaky|red|cold|start|current|existing|reported|approved|known|regression|unit|integration|e2e|source|typescript|type-?script|ts|type-?check|compiler)\s+)*(?:bug|defect|issues?|problems?|failures?|regressions?|tests?|errors?|items?|typos?|code|source|implementation|component|function|module|class|method|logic|file|files|readme|docs?|changelog|package\.json|config|manifest|extension|prompt|command|lint(?:ing)?|build|ci|type-?check|type\s+checking)\b)/i;
-
-const WORKER_IMPLEMENTATION_PATTERNS = [
-	/\b(?:implement|edit|modify|refactor|delete)\b/i,
-	FIX_OR_PATCH_IMPLEMENTATION_PATTERN,
-	/\b(?:update|add|remove|replace|create)\b(?!\s+(?:(?:a|an|the)\s+)?(?:report|summary|findings?)(?:\b|$))/i,
-	/\bapply\s+(?:the\s+)?(?:(?:suggested|proposed|recommended)\s+)?(?:changes?|fix(?:es)?|patch)\b/i,
-	/\bmake\s+(?:the\s+)?changes\b/i,
-	/\bdo those fixes\b/i,
-];
-
-const GENERAL_IMPLEMENTATION_PATTERNS = [
-	/\b(?:implement|edit|modify|refactor)\b/i,
-	FIX_OR_PATCH_IMPLEMENTATION_PATTERN,
-	/\bapply\s+(?:the\s+)?(?:(?:suggested|proposed|recommended)\s+)?(?:changes?|fix(?:es)?|patch)\b/i,
-	/\bmake\s+(?:the\s+)?changes\b/i,
-	/\bdo those fixes\b/i,
-	/\b(?:update|add|remove|replace|delete|create)\s+(?:the\s+)?(?:file|files|code|source|implementation|test|tests|component|function|module|class|method|logic|import|imports|readme|docs?|changelog|package\.json|config|manifest|extension|prompt|command)\b/i,
-];
-
-export type TaskMutationIntent = { kind: "implementation" } | { kind: "read-only" } | { kind: "unknown" };
-
-function stripFrameworkInstructions(task: string): string {
-	return task
-		.split("\n")
-		.filter((line) => !/^\s*\[(?:Write to|Read from):/i.test(line))
-		.filter((line) => !/^\s*(?:Create and maintain progress at:|Update progress at:|\*\*Output:\*\*|Write your findings to(?: exactly this path)?:|Return the complete artifact in your final response\.|The runtime will persist it to exactly this path:|Do not call contact_supervisor merely because no write-capable tool is available\.|This path is authoritative for this run\.|Ignore any other output filename or output path mentioned elsewhere)/i.test(line))
-		.join("\n");
-}
-
-function stripPatterns(task: string, patterns: RegExp[]): string {
-	let stripped = task;
-	for (const pattern of patterns) {
-		const flags = pattern.flags.includes("g") ? pattern.flags : `${pattern.flags}g`;
-		stripped = stripped.replace(new RegExp(pattern.source, flags), " ");
-	}
-	return stripped;
-}
-
-interface NoEditProhibitionAnalysis {
-	/** True when any prohibition (or review-only/no-tool wording) is present. */
-	present: boolean;
-	/** True when a prohibition covers files/code in general; such wording wins over write verbs. */
-	blanket: boolean;
-	/** Task text with prohibition phrases and their objects removed, for write-intent testing. */
-	strippedText: string;
-}
-
-function analyzeNoEditProhibitions(taskText: string): NoEditProhibitionAnalysis {
-	let present = REVIEW_ONLY_PATTERNS.some((pattern) => pattern.test(taskText))
-		|| NO_TOOL_INTENT_PATTERNS.some((pattern) => pattern.test(taskText));
-	let blanket = present;
-	let strippedText = stripPatterns(taskText, [...REVIEW_ONLY_PATTERNS, ...NO_TOOL_INTENT_PATTERNS]);
-	const stripNoEditProhibition = (match: string, object: string, offset: number, source: string): string => {
-		present = true;
-		if (GENERIC_PROHIBITION_OBJECT.test(object) && !hasScopedProhibitionContinuation(source.slice(offset + match.length))) blanket = true;
-		return " ";
-	};
-	strippedText = strippedText.replace(new RegExp(COORDINATED_NO_EDIT_PROHIBITION_PATTERN.source, COORDINATED_NO_EDIT_PROHIBITION_PATTERN.flags), stripNoEditProhibition);
-	strippedText = strippedText.replace(new RegExp(NO_EDIT_PROHIBITION_PATTERN.source, NO_EDIT_PROHIBITION_PATTERN.flags), stripNoEditProhibition);
-	// Restore boundaries after stripping a prohibition from serialized prompts.
-	strippedText = strippedText.replace(/\\(?:r\\n|n)/g, "\n");
-	return { present, blanket, strippedText };
-}
-
-function taskHasReadOnlyDeliverable(taskText: string): boolean {
-	return READ_ONLY_DELIVERABLE_PATTERNS.some((pattern) => pattern.test(taskText));
-}
-
-function isReviewerStyleAgent(agent: string): boolean {
-	return /\b(?:advisor|reviewer|oracle)\b/i.test(agent);
-}
-
-function hasImplementationIntent(agent: string, taskText: string): boolean {
-	if (isReviewerStyleAgent(agent)) return REVIEWER_REQUIRED_EDIT_PATTERNS.some((pattern) => pattern.test(taskText));
-	if (agent === "worker") return WORKER_IMPLEMENTATION_PATTERNS.some((pattern) => pattern.test(taskText));
-	return GENERAL_IMPLEMENTATION_PATTERNS.some((pattern) => pattern.test(taskText));
-}
-
-export function classifyTaskMutationIntent(agent: string, task: string): TaskMutationIntent {
-	const taskText = stripSeverityCompounds(stripFrameworkInstructions(task));
-	const taskTextWithoutScopedConstraints = stripPatterns(taskText, SCOPED_NO_EDIT_CONSTRAINT_PATTERNS);
-	const prohibitions = analyzeNoEditProhibitions(taskTextWithoutScopedConstraints);
-	if (prohibitions.present) {
-		if (prohibitions.blanket) return { kind: "read-only" };
-		return hasImplementationIntent(agent, prohibitions.strippedText) ? { kind: "implementation" } : { kind: "read-only" };
-	}
-
-	if (RESEARCH_AGENT_PATTERNS.some((pattern) => pattern.test(agent))) return { kind: "read-only" };
-	if (hasImplementationIntent(agent, taskText)) return { kind: "implementation" };
-	if (isReviewerStyleAgent(agent)) return { kind: "read-only" };
-	return taskHasReadOnlyDeliverable(taskTextWithoutScopedConstraints) ? { kind: "read-only" } : { kind: "unknown" };
-}
-
-export function expectsImplementationMutation(agent: string, task: string): boolean {
-	return classifyTaskMutationIntent(agent, task).kind === "implementation";
-}
-
-/** Bare write verbs that make a task write-capable for acceptance inference.
- * Severity compounds ("must-fix items") are stripped before matching, so they
- * are not write imperatives, while CLI flags ("--fix", "-w"), clause-level
- * dashes ("branch—fix it"), and hyphenated imperatives ("hot-fix the bug")
- * all stay write-capable. */
-const MAY_MUTATE_VERB_PATTERN = /\b(?:fix|implement|update|write|edit|modify|migrate|delete|remove|refactor|commit)\b/i;
-
-/**
- * Whether the task could plausibly change files. Blanket prohibitions win;
- * write verbs inside a scoped prohibition's object or a read-only deliverable
- * phrase ("write a summary report") do not count; any other bare write verb
- * does.
- */
-export function taskMayMutate(task: string): boolean {
-	const taskText = stripPatterns(stripSeverityCompounds(stripFrameworkInstructions(task)), SCOPED_NO_EDIT_CONSTRAINT_PATTERNS);
-	const prohibitions = analyzeNoEditProhibitions(taskText);
-	if (prohibitions.blanket) return false;
-	return MAY_MUTATE_VERB_PATTERN.test(stripPatterns(prohibitions.strippedText, READ_ONLY_DELIVERABLE_PATTERNS));
-}

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/bun/cli.d.ts

@@ -1,3 +0,0 @@
-#!/usr/bin/env node
-export {};
-//# sourceMappingURL=cli.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/bun/register-bedrock.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=register-bedrock.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/bun/restore-sandbox-env.d.ts

@@ -1,17 +0,0 @@
-/**
- * Workaround for https://github.com/oven-sh/bun/issues/27802
- *
- * Bun compiled binaries have an empty `process.env` when running inside
- * sandbox environments (e.g. nono on Linux/macOS). On Linux we can recover
- * the environment from `/proc/self/environ`.
- *
- * Keep this in sync with getBunSandboxEnvValue() in
- * packages/ai/src/utils/provider-env.ts. The ai package duplicates the lookup
- * for direct consumers that do not go through this coding-agent entrypoint.
- */
-/**
- * Restore environment variables from `/proc/self/environ` when running
- * inside a sandbox where Bun's `process.env` is empty.
- */
-export declare function restoreSandboxEnv(): void;
-//# sourceMappingURL=restore-sandbox-env.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/cli/args.d.ts

@@ -1,57 +0,0 @@
-/**
- * CLI argument parsing and help display
- */
-import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
-import type { ExtensionFlag } from "../core/extensions/types.ts";
-export type Mode = "text" | "json" | "rpc";
-export interface Args {
-    provider?: string;
-    model?: string;
-    apiKey?: string;
-    systemPrompt?: string;
-    appendSystemPrompt?: string[];
-    thinking?: ThinkingLevel;
-    continue?: boolean;
-    resume?: boolean;
-    help?: boolean;
-    version?: boolean;
-    mode?: Mode;
-    name?: string;
-    noSession?: boolean;
-    session?: string;
-    sessionId?: string;
-    fork?: string;
-    sessionDir?: string;
-    models?: string[];
-    tools?: string[];
-    excludeTools?: string[];
-    noTools?: boolean;
-    noBuiltinTools?: boolean;
-    extensions?: string[];
-    noExtensions?: boolean;
-    print?: boolean;
-    export?: string;
-    noSkills?: boolean;
-    skills?: string[];
-    promptTemplates?: string[];
-    noPromptTemplates?: boolean;
-    themes?: string[];
-    noThemes?: boolean;
-    noContextFiles?: boolean;
-    listModels?: string | true;
-    offline?: boolean;
-    verbose?: boolean;
-    projectTrustOverride?: boolean;
-    messages: string[];
-    fileArgs: string[];
-    /** Unknown flags (potentially extension flags) - map of flag name to value */
-    unknownFlags: Map<string, boolean | string>;
-    diagnostics: Array<{
-        type: "warning" | "error";
-        message: string;
-    }>;
-}
-export declare function isValidThinkingLevel(level: string): level is ThinkingLevel;
-export declare function parseArgs(args: string[]): Args;
-export declare function printHelp(extensionFlags?: ExtensionFlag[]): void;
-//# sourceMappingURL=args.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/cli/config-selector.d.ts

@@ -1,16 +0,0 @@
-/**
- * TUI config selector for `pi config` command
- */
-import type { SettingsManager } from "../core/settings-manager.ts";
-import { type ScopedResolvedPaths } from "../modes/interactive/components/config-selector.ts";
-export interface ConfigSelectorOptions {
-    resolvedPaths: ScopedResolvedPaths;
-    settingsManager: SettingsManager;
-    cwd: string;
-    agentDir: string;
-    writeScope: "global" | "project";
-    projectModeAvailable: boolean;
-}
-/** Show TUI config selector and return when closed */
-export declare function selectConfig(options: ConfigSelectorOptions): Promise<void>;
-//# sourceMappingURL=config-selector.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/cli/file-processor.d.ts

@@ -1,15 +0,0 @@
-/**
- * Process @file CLI arguments into text content and image attachments
- */
-import type { ImageContent } from "@earendil-works/pi-ai";
-export interface ProcessedFiles {
-    text: string;
-    images: ImageContent[];
-}
-export interface ProcessFileOptions {
-    /** Whether to auto-resize images to 2000x2000 max. Default: true */
-    autoResizeImages?: boolean;
-}
-/** Process @file arguments into text content and image attachments */
-export declare function processFileArguments(fileArgs: string[], options?: ProcessFileOptions): Promise<ProcessedFiles>;
-//# sourceMappingURL=file-processor.d.ts.map

package/dist/extensions/pi-subagents/test/fixtures/pi-coding-agent-shim/dist/cli/initial-message.d.ts

@@ -1,18 +0,0 @@
-import type { ImageContent } from "@earendil-works/pi-ai";
-import type { Args } from "./args.ts";
-export interface InitialMessageInput {
-    parsed: Args;
-    fileText?: string;
-    fileImages?: ImageContent[];
-    stdinContent?: string;
-}
-export interface InitialMessageResult {
-    initialMessage?: string;
-    initialImages?: ImageContent[];
-}
-/**
- * Combine stdin content, @file text, and the first CLI message into a single
- * initial prompt for non-interactive mode.
- */
-export declare function buildInitialMessage({ parsed, fileText, fileImages, stdinContent }: InitialMessageInput): InitialMessageResult;
-//# sourceMappingURL=initial-message.d.ts.map