@skill-harness/adapters 0.12.0 → 0.14.0

package/dist/generated/work-v4/validation.js

@@ -0,0 +1,227 @@
+// GENERATED from pi-daddy 7c78769c47177b1972b09e1f5c5474ad44cd2cac by scripts/vendor-work-v4-reader.mjs. Do not hand-edit.
+import { isExecutionId } from "./execution-id.js";
+import { canonicalWorkJson, workDigest } from "./json.js";
+import { WorkInputError } from "./types.js";
+const kinds = ["scope", "goal", "node", "obligation", "artifact", "policy"];
+const fail = () => { throw new WorkInputError("WORK_SCHEMA_INVALID"); };
+function require(value) { if (!value)
+    fail(); }
+export function workObject(value) {
+    if (value === null || typeof value !== "object" || Array.isArray(value))
+        return fail();
+    return value;
+}
+function closed(value, keys) {
+    const object = workObject(value);
+    require(Object.keys(object).length === keys.length && keys.every(key => Object.hasOwn(object, key)));
+    return object;
+}
+function id(value) { require(typeof value === "string" && /^[A-Za-z0-9][A-Za-z0-9._:/@+\-]{0,127}$/.test(value)); }
+function digest(value) { require(typeof value === "string" && /^[0-9a-f]{64}$/.test(value)); }
+function integer(value) { require(typeof value === "number" && Number.isSafeInteger(value) && value >= 1); }
+function member(value, values) { require(typeof value === "string" && values.includes(value)); }
+function nullable(value, validate) { if (value !== null)
+    validate(value); }
+function reference(value, allowed = kinds) {
+    const ref = closed(value, ["kind", "id", "revision", "digest"]);
+    member(ref.kind, allowed);
+    id(ref.id);
+    integer(ref.revision);
+    digest(ref.digest);
+}
+function identity(value) {
+    const ref = closed(value, ["id", "digest"]);
+    id(ref.id);
+    digest(ref.digest);
+}
+function eventRef(value) {
+    const ref = closed(value, ["eventId", "digest"]);
+    id(ref.eventId);
+    digest(ref.digest);
+}
+/** Internal validation for the exact out-of-band selectedSnapshot shape; no authority is constructed. */
+export function validateWorkSelection(value) {
+    if (value === null)
+        return;
+    const selected = closed(value, ["snapshot", "event"]);
+    identity(selected.snapshot);
+    eventRef(selected.event);
+}
+function timestamp(value) {
+    require(typeof value === "string" && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}\.\d{3}Z$/.test(value));
+    require(!value.startsWith("0000") && Number.isFinite(Date.parse(value)) && new Date(value).toISOString() === value);
+}
+/** Builder sorts detached copies; reader refuses noncanonical sets instead of repairing them. */
+function set(value, validate, building, key = canonicalWorkJson) {
+    require(Array.isArray(value));
+    value.forEach(validate);
+    const keyed = value.map(item => ({ item, key: key(item) }));
+    const sorted = [...keyed].sort((a, b) => a.key < b.key ? -1 : a.key > b.key ? 1 : 0);
+    for (let i = 1; i < sorted.length; i++)
+        require(sorted[i - 1].key !== sorted[i].key);
+    if (building)
+        value.splice(0, value.length, ...sorted.map(entry => entry.item));
+    else
+        require(keyed.every((entry, i) => entry.key === sorted[i].key));
+}
+function ownKeys(keys, building) { return building ? keys : [...keys, "digest"]; }
+function revision(value, building) {
+    const r = closed(value, ownKeys(["kind", "id", "revision", "scopeId", "predecessor", "contentDigest",
+        "parent", "dependencies", "ownerId", "permittedEffects", "policy"], building));
+    member(r.kind, kinds);
+    id(r.id);
+    integer(r.revision);
+    id(r.scopeId);
+    id(r.ownerId);
+    digest(r.contentDigest);
+    nullable(r.predecessor, v => reference(v));
+    nullable(r.parent, v => reference(v));
+    nullable(r.policy, v => reference(v, ["policy"]));
+    set(r.dependencies, v => reference(v, ["obligation"]), building);
+    set(r.permittedEffects, id, building, v => v);
+    if (r.revision === 1)
+        require(r.predecessor === null);
+    else {
+        require(r.predecessor !== null);
+        const predecessor = workObject(r.predecessor);
+        require(predecessor.kind === r.kind && predecessor.id === r.id &&
+            predecessor.revision === r.revision - 1);
+    }
+    const noDependencies = r.dependencies.length === 0;
+    if (r.kind === "scope")
+        require(r.scopeId === r.id && r.parent === null && noDependencies && r.policy === null);
+    if (r.kind === "artifact" || r.kind === "policy") {
+        require(r.parent === null && noDependencies && r.policy === null && r.permittedEffects.length === 0);
+    }
+    if (r.kind === "goal" || r.kind === "node" || r.kind === "obligation") {
+        reference(r.parent, r.kind === "goal" ? ["scope", "goal"] : ["goal", "node"]);
+        if (r.kind === "obligation")
+            reference(r.policy, ["policy"]);
+        else
+            require(noDependencies && r.policy === null);
+    }
+    if (!building)
+        digest(r.digest);
+}
+function obligationBinding(value) {
+    const b = closed(value, ["intent", "obligation", "artifact", "policy"]);
+    reference(b.intent, ["goal", "node"]);
+    reference(b.obligation, ["obligation"]);
+    nullable(b.artifact, v => reference(v, ["artifact"]));
+    reference(b.policy, ["policy"]);
+}
+function snapshot(value, building) {
+    const s = closed(value, ownKeys(["snapshotId", "scope", "revisions", "bindings"], building));
+    id(s.snapshotId);
+    reference(s.scope, ["scope"]);
+    set(s.revisions, v => reference(v, kinds.filter(k => k !== "scope")), building);
+    set(s.bindings, obligationBinding, building, v => canonicalWorkJson(workObject(v).obligation));
+    if (!building)
+        digest(s.digest);
+    // Inventory/ancestor/predecessor resolution requires the complete event snapshot, not a guessed head.
+}
+function occurrence(value) {
+    const p = closed(value, ["scope", "obligation", "executionId", "parentExecutionId", "childId", "variantId",
+        "artifact", "provenance", "state", "labels"]);
+    reference(p.scope, ["scope"]);
+    reference(p.obligation, ["obligation"]);
+    require(isExecutionId(p.executionId));
+    require(p.parentExecutionId === null || isExecutionId(p.parentExecutionId));
+    require(p.executionId !== p.parentExecutionId);
+    nullable(p.childId, id);
+    nullable(p.variantId, id);
+    nullable(p.artifact, v => reference(v, ["artifact"]));
+    member(p.provenance, ["declared", "observed"]);
+    member(p.state, ["unknown", "starting", "running", "completed", "failed"]);
+    const labels = closed(p.labels, ["sessionId", "branchLeafId", "toolCallId", "taskId", "workspaceId",
+        "definitionDigest", "configurationDigest", "modelId", "effortId"]);
+    for (const [key, value] of Object.entries(labels))
+        nullable(value, key.endsWith("Digest") ? digest : id);
+}
+function evidence(value) {
+    const e = closed(value, ["id", "digest", "event"]);
+    id(e.id);
+    digest(e.digest);
+    nullable(e.event, eventRef);
+}
+function acceptance(value, building) {
+    const p = closed(value, ["authorityId", "binding"]);
+    id(p.authorityId);
+    acceptanceBinding(p.binding, building);
+}
+function acceptanceBinding(value, building) {
+    const b = closed(value, ["snapshot", "scope", "intent", "obligation", "artifact", "artifactDigest", "policy", "evidence"]);
+    identity(b.snapshot);
+    reference(b.scope, ["scope"]);
+    reference(b.intent, ["goal", "node"]);
+    reference(b.obligation, ["obligation"]);
+    reference(b.artifact, ["artifact"]);
+    digest(b.artifactDigest);
+    reference(b.policy, ["policy"]);
+    set(b.evidence, evidence, building);
+    require(b.evidence.length > 0);
+}
+/** Validate a detached host context. Receipt/availability order and duplicate deliveries have no priority. */
+export function validateWorkContext(value) {
+    const c = closed(value, ["selectedSnapshot", "authority"]);
+    validateWorkSelection(c.selectedSnapshot);
+    if (c.authority === null)
+        return;
+    const a = closed(c.authority, ["snapshot", "decisions", "availability"]);
+    identity(a.snapshot);
+    require(Array.isArray(a.decisions));
+    require(Array.isArray(a.availability));
+    for (const value of a.decisions) {
+        const d = closed(value, ["receiptId", "authorityId", "claim", "binding", "decision"]);
+        id(d.receiptId);
+        id(d.authorityId);
+        eventRef(d.claim);
+        acceptanceBinding(d.binding, false);
+        member(d.decision, ["accept", "reject"]);
+    }
+    for (const value of a.availability) {
+        const row = closed(value, ["kind", "id", "digest", "available"]);
+        member(row.kind, ["artifact", "evidence"]);
+        id(row.id);
+        digest(row.digest);
+        require(typeof row.available === "boolean");
+    }
+}
+function ownDigest(object, building) {
+    const { digest: supplied, ...body } = object;
+    const computed = workDigest(body);
+    if (building)
+        object.digest = computed;
+    else if (supplied !== computed)
+        throw new WorkInputError("WORK_DIGEST_MISMATCH");
+}
+/** All closed shapes/domain checks finish before any own digest is computed or verified. */
+export function validateWorkEvent(value, building = false) {
+    const e = workObject(value);
+    if (e.ledgerVersion !== 4)
+        throw new WorkInputError("WORK_VERSION_UNSUPPORTED");
+    closed(e, ownKeys(["ledgerVersion", "event", "eventId", "ts", "payload"], building));
+    member(e.event, ["work_revision", "work_snapshot", "work_occurrence", "work_acceptance"]);
+    id(e.eventId);
+    timestamp(e.ts);
+    let nested;
+    if (e.event === "work_revision") {
+        nested = workObject(closed(e.payload, ["revision"]).revision);
+        revision(nested, building);
+    }
+    else if (e.event === "work_snapshot") {
+        nested = workObject(closed(e.payload, ["snapshot"]).snapshot);
+        snapshot(nested, building);
+    }
+    else if (e.event === "work_occurrence")
+        occurrence(e.payload);
+    else
+        acceptance(e.payload, building);
+    if (!building)
+        digest(e.digest);
+    if (nested)
+        ownDigest(nested, building);
+    ownDigest(e, building);
+    return e;
+}
+//# sourceMappingURL=validation.js.map

package/dist/index.d.ts

@@ -1,3 +1,4 @@
+export * from './producer-product.js';
 import type { HarnessAdapter } from "@skill-harness/core";
 import { piAdapter } from "./pi.js";
 export declare function getAdapter(name: string): HarnessAdapter;
@@ -5,3 +6,24 @@ export { piAdapter };
 export * from "./prompt-provenance.js";
 export * from "./trajectory.js";
 export * from "./pi-daddy-ledger-v3.js";
+export * from "./evidence-archive.js";
+export * from "./archive-checkpoint.js";
+export * from "./archive-policy.js";
+export * from "./execution-retention-archive.js";
+export * from "./work-candidates.js";
+export * from "./work-case-archive.js";
+export * from "./work-signal-observation.js";
+export * from "./work-signal-cases.js";
+export * from "./work-case-review.js";
+export * from "./archive-read-capability.js";
+export * from "./archived-work.js";
+export * from "./blind-intervention.js";
+export * from "./archive-observer.js";
+export * from "./weekly-investigation.js";
+export * from "./intervention-run.js";
+export * from "./principal-payload-port.js";
+export * from "./reviewed-archive-export.js";
+export * from "./archive-access.js";
+export * from "./archive-facts.js";
+export * from "./trust-lifecycle.js";
+export * from "./producer-review.js";

package/dist/index.js

@@ -1,3 +1,4 @@
+export * from './producer-product.js';
 import { piAdapter } from "./pi.js";
 /**
  * Registered harnesses. pi is the only one (per project scope). The interface
@@ -17,4 +18,25 @@ export { piAdapter };
 export * from "./prompt-provenance.js";
 export * from "./trajectory.js";
 export * from "./pi-daddy-ledger-v3.js";
+export * from "./evidence-archive.js";
+export * from "./archive-checkpoint.js";
+export * from "./archive-policy.js";
+export * from "./execution-retention-archive.js";
+export * from "./work-candidates.js";
+export * from "./work-case-archive.js";
+export * from "./work-signal-observation.js";
+export * from "./work-signal-cases.js";
+export * from "./work-case-review.js";
+export * from "./archive-read-capability.js";
+export * from "./archived-work.js";
+export * from "./blind-intervention.js";
+export * from "./archive-observer.js";
+export * from "./weekly-investigation.js";
+export * from "./intervention-run.js";
+export * from "./principal-payload-port.js";
+export * from "./reviewed-archive-export.js";
+export * from "./archive-access.js";
+export * from "./archive-facts.js";
+export * from "./trust-lifecycle.js";
+export * from "./producer-review.js";
 //# sourceMappingURL=index.js.map

package/dist/installed-review-session.d.ts

@@ -0,0 +1,28 @@
+import type { CodexSdkBinding } from './codex-sdk-transport.js';
+export interface InstalledReviewSession {
+    version: 'installed-review-session-v1';
+    root: string;
+    runRoot: string;
+    resources: {
+        kind: string;
+        path: string;
+        sha256: string;
+    }[];
+    subjectId: string;
+    judgeId: string;
+}
+export type ReviewRole = 'subject' | 'judge';
+/** Narrow exception for TWO named, isolated installed resources. Never a general .pi pin waiver. */
+export declare function validateInstalledReviewSession(p: InstalledReviewSession): void;
+export declare function installedDelivery(p: InstalledReviewSession, role: ReviewRole): string;
+export declare const installedBase: (p: InstalledReviewSession, role: ReviewRole, base: string) => string;
+export declare const installedInstructions: (p: InstalledReviewSession, role: ReviewRole, base: string) => string;
+/** Compare actual post-extension context; timestamps are not provider input. Nothing is dropped from the wire. */
+export declare function assertInstalledContext(c: any, instructions: string, input: string): string;
+export interface InstalledReviewSessions {
+    sessionSha256: string;
+    bind(role: ReviewRole, base: string, raw: CodexSdkBinding, record: (v: Record<string, unknown>) => void): CodexSdkBinding;
+}
+/** SDK is the pinned, installed public SDK module. No SDK/auth import occurs during preparation.
+ * This is a per-role adapter for the existing producer exchange, not another budget or retry engine. */
+export declare function createInstalledReviewSessions(raw: InstalledReviewSession, sdk: any): InstalledReviewSessions;

package/dist/installed-review-session.js

@@ -0,0 +1,166 @@
+import { readFileSync, realpathSync, lstatSync, mkdirSync, existsSync } from 'node:fs';
+import { isAbsolute, resolve, join, dirname } from 'node:path';
+import { createHash } from 'node:crypto';
+import { isDeepStrictEqual } from 'node:util';
+import { learningHash, learningCopy } from './learning-journal.js';
+const hash = (s) => createHash('sha256').update(s).digest('hex');
+function closed(v, keys) { if (!v || Array.isArray(v) || Object.keys(v).sort().join() !== keys.sort().join())
+    throw Error('closed installed review required'); }
+function canonical(p) { if (typeof p !== 'string' || !isAbsolute(p) || resolve(p) !== p || realpathSync(p) !== p)
+    throw Error('installed resource canonical path required'); }
+/** Narrow exception for TWO named, isolated installed resources. Never a general .pi pin waiver. */
+export function validateInstalledReviewSession(p) {
+    closed(p, ['version', 'root', 'runRoot', 'resources', 'subjectId', 'judgeId']);
+    if (p.version !== 'installed-review-session-v1' || p.root.split('/').includes('.pi') || p.runRoot.split('/').includes('.pi') || p.root !== join(dirname(p.runRoot), 'installed') || !isAbsolute(p.runRoot) || resolve(p.runRoot) !== p.runRoot)
+        throw Error('isolated installed roots required');
+    canonical(p.root);
+    canonical(dirname(p.runRoot));
+    if (!/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(p.subjectId) || !/^[a-f0-9]{8}(?:-[a-f0-9]{4}){3}-[a-f0-9]{12}$/.test(p.judgeId) || p.subjectId === p.judgeId)
+        throw Error('distinct installed role identities required');
+    if (!Array.isArray(p.resources) || p.resources.length !== 4 || p.resources.map(r => r.kind).join() !== 'skill,prompt,extension,extension' || new Set(p.resources.map(r => r.path)).size !== 4)
+        throw Error('exact installed resources required');
+    const selected = [join(p.root, '.pi/skills/review/SKILL.md'), join(p.root, '.pi/agents/principal-review.md')];
+    p.resources.forEach((r, i) => { closed(r, ['kind', 'path', 'sha256']); canonical(r.path); if (i < 2 ? r.path !== selected[i] : r.path.split('/').includes('.pi'))
+        throw Error('forbidden installed resource path'); const st = lstatSync(r.path); if (!st.isFile() || st.size > (i < 2 ? 16384 : 8 * 1024 * 1024) || !/^[a-f0-9]{64}$/.test(r.sha256) || hash(readFileSync(r.path)) !== r.sha256)
+        throw Error('installed resource pin mismatch'); });
+}
+export function installedDelivery(p, role) {
+    return role === 'subject' ? '\n\n<installed-review-instructions>\n' + p.resources.slice(0, 2).map(r => new TextDecoder('utf8', { fatal: true }).decode(readFileSync(r.path))).join('\n\n') + '\n</installed-review-instructions>' : '\n\nAdvisory judgement only; this session cannot authorize adoption or acceptance.';
+}
+export const installedBase = (p, role, base) => base + '\nCurrent working directory: ' + join(p.runRoot, role) + '\n';
+export const installedInstructions = (p, role, base) => installedBase(p, role, base) + installedDelivery(p, role);
+function messageText(m) {
+    if (!m || m.role !== 'user' || (m.timestamp !== undefined && (!Number.isSafeInteger(m.timestamp) || m.timestamp < 0)) || Object.keys(m).some(k => !['role', 'content', 'timestamp'].includes(k)))
+        throw Error('installed user context required');
+    if (typeof m.content === 'string')
+        return m.content;
+    if (!Array.isArray(m.content) || m.content.length !== 1 || !isDeepStrictEqual(Object.keys(m.content[0]).sort(), ['text', 'type']) || m.content[0].type !== 'text' || typeof m.content[0].text !== 'string')
+        throw Error('installed text-only context required');
+    return m.content[0].text;
+}
+/** Compare actual post-extension context; timestamps are not provider input. Nothing is dropped from the wire. */
+export function assertInstalledContext(c, instructions, input) {
+    if (!c || Object.keys(c).some(k => !['systemPrompt', 'messages', 'tools'].includes(k)) || c.systemPrompt !== instructions || !Array.isArray(c.messages) || c.messages.length !== 1 || messageText(c.messages[0]) !== input || (c.tools !== undefined && (!Array.isArray(c.tools) || c.tools.length)))
+        throw Error('installed effective context changed/tools/history');
+    if (Buffer.byteLength(instructions) + Buffer.byteLength(input) > 65536)
+        throw Error('installed context byte bound');
+    return learningHash({ systemPrompt: c.systemPrompt, messages: [{ role: 'user', content: input }], tools: [] });
+}
+/** SDK is the pinned, installed public SDK module. No SDK/auth import occurs during preparation.
+ * This is a per-role adapter for the existing producer exchange, not another budget or retry engine. */
+export function createInstalledReviewSessions(raw, sdk) {
+    const p = learningCopy(raw);
+    validateInstalledReviewSession(p);
+    p.resources.forEach(Object.freeze);
+    Object.freeze(p.resources);
+    Object.freeze(p);
+    const used = new Set();
+    return { sessionSha256: learningHash(p), bind(role, base, raw, record) {
+            if (used.has(role))
+                throw Error('installed role reused');
+            used.add(role);
+            return { model: raw.model, stream: (_model, seed, options) => ({ result: async () => {
+                        let session, closedSession = false, violation, invocations = 0, before = 0, contexts = 0, payloads = 0, sdkResult;
+                        const ensure = () => { options.signal.throwIfAborted(); if (closedSession || violation)
+                            throw violation ?? Error('installed session closed'); };
+                        const refuse = (message) => { violation = Error(message); throw violation; };
+                        const input = messageText(seed.messages[0]), instructions = installedInstructions(p, role, base), cwd = join(p.runRoot, role), agentDir = join(cwd, 'agent');
+                        assertInstalledContext(seed, instructions, input);
+                        const envKeys = Object.keys(process.env).filter(k => k.startsWith('PI_GRANTS_') || k === 'PI_CODING_AGENT_DIR'), saved = Object.fromEntries(envKeys.map(k => [k, process.env[k]]));
+                        for (const k of envKeys)
+                            delete process.env[k];
+                        process.env.PI_CODING_AGENT_DIR = agentDir;
+                        process.env.PI_GRANTS_HERDR = '0';
+                        process.env.PI_GRANTS_GRANT = 'tool:read';
+                        let abortReject = () => { };
+                        const aborted = new Promise((_, reject) => { abortReject = reject; });
+                        const abort = () => { closedSession = true; void session?.abort().catch((e) => { violation = e; }); abortReject(Error('installed session deadline')); };
+                        options.signal.addEventListener('abort', abort, { once: true });
+                        try {
+                            return await Promise.race([aborted, (async () => {
+                                    ensure();
+                                    validateInstalledReviewSession(p);
+                                    if (existsSync(cwd))
+                                        refuse('installed role occurrence already consumed');
+                                    mkdirSync(cwd, { mode: 0o700 });
+                                    mkdirSync(agentDir, { mode: 0o700 });
+                                    const settings = sdk.SettingsManager.inMemory({ packages: [], compaction: { enabled: false }, retry: { enabled: false, maxRetries: 0 }, providerRetry: { maxRetries: 0 }, blockImages: true });
+                                    const loader = new sdk.DefaultResourceLoader({ cwd, agentDir, settingsManager: settings, noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true,
+                                        additionalExtensionPaths: p.resources.slice(2).map(r => r.path), additionalSkillPaths: role === 'subject' ? [p.resources[0].path] : [], additionalPromptTemplatePaths: role === 'subject' ? [p.resources[1].path] : [],
+                                        agentsFilesOverride: () => ({ agentsFiles: [] }), systemPromptOverride: () => base, appendSystemPromptOverride: () => '',
+                                        extensionFactories: [{ name: 'installed-review-v1', factory: (pi) => {
+                                                    pi.on('before_agent_start', (event) => { ensure(); validateInstalledReviewSession(p); record({ type: 'session-before-agent-observed', role, systemMatches: event.systemPrompt === installedBase(p, role, base), promptMatches: event.prompt === input, systemSha256: hash(event.systemPrompt), expectedSystemSha256: hash(installedBase(p, role, base)) }); if (++before !== 1 || event.systemPrompt !== installedBase(p, role, base) || event.prompt !== input)
+                                                        refuse('installed before-agent context changed'); record({ type: 'session-before-agent', role, sessionId: p[role === 'subject' ? 'subjectId' : 'judgeId'], resources: p.resources.slice(0, 2).map(r => r.sha256), delivery: role === 'subject' }); return { systemPrompt: event.systemPrompt + installedDelivery(p, role) }; });
+                                                    pi.on('context', (event) => { ensure(); if (++contexts !== 1 || event.messages.length !== 1 || messageText(event.messages[0]) !== input)
+                                                        refuse('installed context continuation/changed'); record({ type: 'session-context-hook', role, messages: 1 }); return { messages: event.messages }; });
+                                                    pi.on('before_provider_request', () => { ensure(); if (++payloads !== 1)
+                                                        refuse('installed provider request repeated'); record({ type: 'session-provider-hook', role }); });
+                                                } }] });
+                                    await loader.reload();
+                                    ensure();
+                                    const loaded = loader.getExtensions();
+                                    if (loaded.errors.length || loaded.extensions.length !== 3 || p.resources.slice(2).some(r => !loaded.extensions.some((e) => (e.resolvedPath ?? e.path) === r.path)))
+                                        refuse('installed extensions not loaded');
+                                    if (role === 'subject' && (loader.getSkills().skills.length !== 1 || loader.getSkills().skills[0].filePath !== p.resources[0].path || loader.getPrompts().prompts.length !== 1 || loader.getPrompts().prompts[0].filePath !== p.resources[1].path))
+                                        refuse('installed selected resources not loaded');
+                                    // All ModelRuntime storage is fresh/private; only an INVALID SDK stand-in is ever supplied.
+                                    const standIn = { type: 'oauth', access: options.apiKey, refresh: 'fixture.invalid', expires: Date.now() + 3600000, accountId: 'fixture-no-account' };
+                                    const credentials = { read: async (id) => id === 'openai-codex' ? standIn : undefined, list: async () => [{ providerId: 'openai-codex', type: 'oauth' }], modify: async () => refuse('installed credential mutation/refresh forbidden'), delete: async () => refuse('installed credential deletion forbidden') };
+                                    const runtime = await sdk.ModelRuntime.create({ credentials, modelsPath: join(agentDir, 'models.json'), modelsStorePath: join(agentDir, 'models-store.json'), allowModelNetwork: false });
+                                    ensure();
+                                    ({ session } = await sdk.createAgentSession({ cwd, agentDir, model: raw.model, modelRuntime: runtime, settingsManager: settings, resourceLoader: loader, sessionManager: sdk.SessionManager.inMemory(cwd, { id: p[role === 'subject' ? 'subjectId' : 'judgeId'] }), noTools: 'all', thinkingLevel: 'low' }));
+                                    if (closedSession || options.signal.aborted)
+                                        session.dispose();
+                                    ensure();
+                                    session.extensionRunner.onError((e) => { violation ??= Error('installed extension error: ' + e.event); });
+                                    session.agent.streamFunction = async (model, actual, opts) => {
+                                        ensure();
+                                        if (++invocations !== 1 || before !== 1 || contexts !== 1 || session.sessionId !== p[role === 'subject' ? 'subjectId' : 'judgeId'] || session.sessionFile !== undefined || model.id !== raw.model.id || model.provider !== raw.model.provider || model.api !== raw.model.api || model.baseUrl !== raw.model.baseUrl || session.getActiveToolNames().length)
+                                            refuse('installed SDK invocation/model/tools bound');
+                                        validateInstalledReviewSession(p);
+                                        const contextSha256 = assertInstalledContext(actual, instructions, input);
+                                        record({ type: 'session-sdk-invoked', role, sessionId: session.sessionId, contextSha256, sessionSha256: learningHash(p), tools: [] });
+                                        const result = raw.stream(model, actual, { ...opts, ...options, onPayload: async (payload) => { ensure(); validateInstalledReviewSession(p); const processed = await opts.onPayload(payload, model); ensure(); if (payloads !== 1)
+                                                refuse('installed provider hook missing'); return options.onPayload(processed); }, onResponse: opts.onResponse });
+                                        sdkResult = result.result();
+                                        return result;
+                                    };
+                                    await session.bindExtensions({ mode: 'print', uiContext: { ...session.extensionRunner.createContext().ui, notify: (_message, type) => { if (type === 'error' || type === 'warning')
+                                                violation = Error('installed startup warning/error'); } } });
+                                    ensure();
+                                    if (session.extensionRunner.hasHandlers('before_provider_headers'))
+                                        refuse('undeclared installed header transformation');
+                                    if (session.sessionId !== p[role === 'subject' ? 'subjectId' : 'judgeId'] || session.messages.length || session.getActiveToolNames().length)
+                                        refuse('installed session identity/history/tools');
+                                    record({ type: 'session-bound', role, sessionId: session.sessionId, extensions: p.resources.slice(2), commands: session.extensionRunner.getRegisteredCommands().map((c) => c.name), history: 0, tools: [] });
+                                    await session.prompt(input, { expandPromptTemplates: false });
+                                    ensure();
+                                    if (invocations !== 1 || before !== 1 || contexts !== 1 || payloads !== 1 || session.sessionId !== p[role === 'subject' ? 'subjectId' : 'judgeId'] || session.sessionFile !== undefined || !sdkResult || session.messages.length !== 2 || session.getActiveToolNames().length)
+                                        refuse('installed awaited prompt/continuation mismatch');
+                                    const result = await sdkResult;
+                                    ensure();
+                                    if (!isDeepStrictEqual(session.messages[1], result))
+                                        refuse('installed session final differs from SDK result');
+                                    record({ type: 'session-prompt-completed', role, sessionId: session.sessionId, actualSdkCalls: invocations, beforeAgentHooks: before, contextHooks: contexts, providerHooks: payloads });
+                                    return result;
+                                })()]);
+                        }
+                        catch (error) {
+                            record({ type: 'session-refused', role, reason: violation?.message ?? 'installed SDK/session exception', before, contexts, payloads, invocations });
+                            throw error;
+                        }
+                        finally {
+                            closedSession = true;
+                            options.signal.removeEventListener('abort', abort);
+                            session?.dispose();
+                            for (const k of Object.keys(process.env))
+                                if (k.startsWith('PI_GRANTS_') || k === 'PI_CODING_AGENT_DIR')
+                                    delete process.env[k];
+                            for (const [k, v] of Object.entries(saved))
+                                if (v !== undefined)
+                                    process.env[k] = v;
+                        }
+                    } }) };
+        } };
+}
+//# sourceMappingURL=installed-review-session.js.map