@sweny-ai/core 0.1.147 → 0.1.149

package/dist/harness/agents.d.ts

@@ -4,8 +4,12 @@
  * runs one agent under another's name. No runtime imports (the CLI config and
  * the harness factory share it).
  */
-export declare const SUPPORTED_AGENTS: readonly ["claude", "codex"];
+export declare const SUPPORTED_AGENTS: readonly ["claude", "codex", "pi"];
 export type SupportedAgent = (typeof SUPPORTED_AGENTS)[number];
-export declare function isSupportedAgent(id: string): id is SupportedAgent;
+/** `acp:<command>` (#416): any Agent Client Protocol agent, started with `<command>`. */
+export type AcpAgentId = `acp:${string}`;
+/** The command of an `acp:<command>` agent id (`"opencode acp"` for `acp:opencode acp`), or undefined when it is not one or the command is empty. */
+export declare function parseAcpAgent(id: string): string | undefined;
+export declare function isSupportedAgent(id: string): id is SupportedAgent | AcpAgentId;
 /** The error for an agent id with no adapter. */
 export declare function unsupportedAgentError(id: string): string;

package/dist/harness/agents.js

@@ -4,12 +4,19 @@
  * runs one agent under another's name. No runtime imports (the CLI config and
  * the harness factory share it).
  */
-export const SUPPORTED_AGENTS = ["claude", "codex"];
+export const SUPPORTED_AGENTS = ["claude", "codex", "pi"];
+/** The command of an `acp:<command>` agent id (`"opencode acp"` for `acp:opencode acp`), or undefined when it is not one or the command is empty. */
+export function parseAcpAgent(id) {
+    if (!id.startsWith("acp:"))
+        return undefined;
+    const command = id.slice("acp:".length).trim();
+    return command === "" ? undefined : command;
+}
 export function isSupportedAgent(id) {
-    return SUPPORTED_AGENTS.includes(id);
+    return SUPPORTED_AGENTS.includes(id) || parseAcpAgent(id) !== undefined;
 }
 /** The error for an agent id with no adapter. */
 export function unsupportedAgentError(id) {
     return (`Unsupported coding agent "${id}": supported agents are "claude" (headless Claude Code) ` +
-        `and "codex" (Codex CLI). Remove --agent / coding-agent-provider or set it to one of them.`);
+        `and "codex" (Codex CLI), or "pi" (pi coding agent, experimental). Remove --agent / coding-agent-provider or set it to one of them.`);
 }

package/dist/harness/capabilities.d.ts

@@ -28,3 +28,61 @@ export declare const CLAUDE_CODE_CAPABILITIES: HarnessCapabilities;
  * - usage tokens only: `turn.completed.usage`; Codex reports no cost.
  */
 export declare const CODEX_CAPABILITIES: HarnessCapabilities;
+/**
+ * pi (`pi --mode rpc`), declared from the pi coding-agent docs and source at
+ * badlogic/pi-mono v0.99.2 (`packages/coding-agent/docs/{cli,rpc,rpc-commands,json,mcp,
+ * security,message-types}.md`, `src/core/agent-session.ts`, `src/extensions/mcp/`)
+ * and probed by the contract suite against the scripted fake:
+ * - structuredOutput prompt: pi has no output-schema flag; sweny prompts for
+ *   the JSON, parses and validates it.
+ * - toolTrace full: `tool_execution_start|end` events carry `toolCallId`,
+ *   `toolName`, `args`, `isError` for built-in and MCP tools alike.
+ * - builtinDeny shell-only, plus write, edit and subagent: `--exclude-tools` and
+ *   `--tools` take tool names (`bash`, `write`, `edit`), and `-ne` leaves no
+ *   extension, so no subagent tool exists. pi has no built-in net tool, so `net`
+ *   is not deniable as a class (`bash` can still curl): it degrades or, in
+ *   strict, refuses.
+ * - mcp home-isolation: MCP is a built-in extension that reads `mcp.json` from
+ *   `$PI_CODING_AGENT_DIR`. sweny points that at a scratch dir holding only the
+ *   generated `mcp.json`, and passes `-na` so a project `.pi/mcp.json` never loads.
+ * - sandbox none: "no built-in sandbox" (docs/security.md). The process wrapper
+ *   (sandbox-wrapper.ts) is the only containment; strict refuses without it.
+ * - readOnly tool-allowlist: `--tools read,grep,find,ls` plus sweny's own MCP
+ *   tools; no shell, write or edit tool exists in the run.
+ * - turnLimit watchdog: pi has no turn limit flag; sweny counts
+ *   `tool_execution_start` events and aborts.
+ * - usage tokens and cost: `get_session_stats` returns tokens and cost for the
+ *   session. Read once at the end, so `live` is false.
+ * - cancel rpc: the `abort` command, then SIGTERM and SIGKILL.
+ */
+export declare const PI_CAPABILITIES: HarnessCapabilities;
+/**
+ * Any ACP agent (`--agent acp:<command>`, #416), declared from the Agent
+ * Client Protocol schema v1.24.1 (agentclientprotocol/agent-client-protocol,
+ * `schema/v1/schema.json`, docs under `docs/protocol/v1/`) and probed by the
+ * contract suite against a scripted fake agent. ACP is the long-tail adapter:
+ * the protocol carries a prompt and a stream of updates, not sweny's opinions.
+ * - structuredOutput prompt: `PromptResponse` has only `stopReason`, so there
+ *   is no schema channel. sweny asks for the JSON in the prompt, parses it,
+ *   checks it and retries once.
+ * - toolTrace full: `tool_call` and `tool_call_update` session updates carry an
+ *   id, a kind, a status and (optionally) raw input and content.
+ * - builtinDeny none: the protocol has no tool allow or deny list. The only
+ *   hook is `session/request_permission`, which fires only when the agent
+ *   chooses to ask. sweny answers it by policy (best effort), but cannot
+ *   promise the agent asks, so nothing is declared.
+ * - mcp inject, exclusive none: `session/new` takes `mcpServers`, but whether
+ *   the agent also loads its own MCP config is agent-defined.
+ * - sandbox none: nothing in the protocol. The process wrapper (srt) is the
+ *   only containment, see sandbox-wrapper.ts.
+ * - readOnly none: modes are agent-defined. `policyGate` counts read-only as
+ *   enforced only with the wrapper's read-only mount.
+ * - turnLimit watchdog: no turn limit in the protocol; sweny counts tool calls.
+ * - usage costUsd only: `usage_update {used, size, cost?}` is the stable
+ *   usage. `used` and `size` are context window occupancy, not billed tokens,
+ *   so they are not mapped; `cost` (cumulative, ISO 4217 currency) is, when it
+ *   is USD. Per-turn token usage is behind an unstable flag.
+ * - cancel rpc: `session/cancel`, then kill.
+ * - resume false: sweny starts a fresh session per node.
+ */
+export declare const ACP_CAPABILITIES: HarnessCapabilities;

package/dist/harness/capabilities.js

@@ -50,3 +50,84 @@ export const CODEX_CAPABILITIES = {
     cancel: "kill",
     resume: false,
 };
+/**
+ * pi (`pi --mode rpc`), declared from the pi coding-agent docs and source at
+ * badlogic/pi-mono v0.99.2 (`packages/coding-agent/docs/{cli,rpc,rpc-commands,json,mcp,
+ * security,message-types}.md`, `src/core/agent-session.ts`, `src/extensions/mcp/`)
+ * and probed by the contract suite against the scripted fake:
+ * - structuredOutput prompt: pi has no output-schema flag; sweny prompts for
+ *   the JSON, parses and validates it.
+ * - toolTrace full: `tool_execution_start|end` events carry `toolCallId`,
+ *   `toolName`, `args`, `isError` for built-in and MCP tools alike.
+ * - builtinDeny shell-only, plus write, edit and subagent: `--exclude-tools` and
+ *   `--tools` take tool names (`bash`, `write`, `edit`), and `-ne` leaves no
+ *   extension, so no subagent tool exists. pi has no built-in net tool, so `net`
+ *   is not deniable as a class (`bash` can still curl): it degrades or, in
+ *   strict, refuses.
+ * - mcp home-isolation: MCP is a built-in extension that reads `mcp.json` from
+ *   `$PI_CODING_AGENT_DIR`. sweny points that at a scratch dir holding only the
+ *   generated `mcp.json`, and passes `-na` so a project `.pi/mcp.json` never loads.
+ * - sandbox none: "no built-in sandbox" (docs/security.md). The process wrapper
+ *   (sandbox-wrapper.ts) is the only containment; strict refuses without it.
+ * - readOnly tool-allowlist: `--tools read,grep,find,ls` plus sweny's own MCP
+ *   tools; no shell, write or edit tool exists in the run.
+ * - turnLimit watchdog: pi has no turn limit flag; sweny counts
+ *   `tool_execution_start` events and aborts.
+ * - usage tokens and cost: `get_session_stats` returns tokens and cost for the
+ *   session. Read once at the end, so `live` is false.
+ * - cancel rpc: the `abort` command, then SIGTERM and SIGKILL.
+ */
+export const PI_CAPABILITIES = {
+    structuredOutput: "prompt",
+    toolTrace: "full",
+    builtinDeny: "shell-only",
+    denyClasses: ["shell", "write", "edit", "subagent"],
+    mcp: { inject: true, exclusive: "home-isolation" },
+    sandbox: { fs: false, network: false },
+    readOnly: "tool-allowlist",
+    turnLimit: "watchdog",
+    usage: { tokens: true, costUsd: true, live: false },
+    cancel: "rpc",
+    resume: false,
+};
+/**
+ * Any ACP agent (`--agent acp:<command>`, #416), declared from the Agent
+ * Client Protocol schema v1.24.1 (agentclientprotocol/agent-client-protocol,
+ * `schema/v1/schema.json`, docs under `docs/protocol/v1/`) and probed by the
+ * contract suite against a scripted fake agent. ACP is the long-tail adapter:
+ * the protocol carries a prompt and a stream of updates, not sweny's opinions.
+ * - structuredOutput prompt: `PromptResponse` has only `stopReason`, so there
+ *   is no schema channel. sweny asks for the JSON in the prompt, parses it,
+ *   checks it and retries once.
+ * - toolTrace full: `tool_call` and `tool_call_update` session updates carry an
+ *   id, a kind, a status and (optionally) raw input and content.
+ * - builtinDeny none: the protocol has no tool allow or deny list. The only
+ *   hook is `session/request_permission`, which fires only when the agent
+ *   chooses to ask. sweny answers it by policy (best effort), but cannot
+ *   promise the agent asks, so nothing is declared.
+ * - mcp inject, exclusive none: `session/new` takes `mcpServers`, but whether
+ *   the agent also loads its own MCP config is agent-defined.
+ * - sandbox none: nothing in the protocol. The process wrapper (srt) is the
+ *   only containment, see sandbox-wrapper.ts.
+ * - readOnly none: modes are agent-defined. `policyGate` counts read-only as
+ *   enforced only with the wrapper's read-only mount.
+ * - turnLimit watchdog: no turn limit in the protocol; sweny counts tool calls.
+ * - usage costUsd only: `usage_update {used, size, cost?}` is the stable
+ *   usage. `used` and `size` are context window occupancy, not billed tokens,
+ *   so they are not mapped; `cost` (cumulative, ISO 4217 currency) is, when it
+ *   is USD. Per-turn token usage is behind an unstable flag.
+ * - cancel rpc: `session/cancel`, then kill.
+ * - resume false: sweny starts a fresh session per node.
+ */
+export const ACP_CAPABILITIES = {
+    structuredOutput: "prompt",
+    toolTrace: "full",
+    builtinDeny: "none",
+    mcp: { inject: true, exclusive: "none" },
+    sandbox: { fs: false, network: false },
+    readOnly: "none",
+    turnLimit: "watchdog",
+    usage: { tokens: false, costUsd: true, live: false },
+    cancel: "rpc",
+    resume: false,
+};

package/dist/harness/index.d.ts

@@ -4,6 +4,8 @@
  */
 import { ClaudeCodeHarness, type ClaudeCodeHarnessOptions } from "./claude-code.js";
 import { CodexHarness, type CodexHarnessOptions } from "./codex.js";
+import { AcpHarness, type AcpHarnessOptions } from "./acp.js";
+import { PiHarness, type PiHarnessOptions } from "./pi.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessId, HarnessInfo, HarnessRunRequest, HarnessRunResult, NodePolicy, PolicyGateResult, PolicyWrappers, ToolClass, } from "./types.js";
 export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
@@ -13,10 +15,14 @@ export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export type { ClaudeCodeHarnessOptions } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
 export type { CodexHarnessOptions } from "./codex.js";
+export { AcpHarness, ACP_CAPABILITIES, ACP_PROTOCOL_VERSION } from "./acp.js";
+export type { AcpHarnessOptions } from "./acp.js";
+export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
+export type { PiHarnessOptions } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
 export type { ToolBridge, ToolBridgeOptions } from "./tool-bridge/server.js";
-export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
-export type { SupportedAgent } from "./agents.js";
+export { SUPPORTED_AGENTS, isSupportedAgent, parseAcpAgent, unsupportedAgentError } from "./agents.js";
+export type { AcpAgentId, SupportedAgent } from "./agents.js";
 /**
  * Build the harness for an agent id. `claude` is the historical `--agent` /
  * `coding-agent-provider` value and means the same as `claude-code`.
@@ -24,4 +30,6 @@ export type { SupportedAgent } from "./agents.js";
  */
 export declare function createHarness(id: "claude" | "claude-code", opts?: ClaudeCodeHarnessOptions): ClaudeCodeHarness;
 export declare function createHarness(id: "codex", opts?: CodexHarnessOptions): CodexHarness;
-export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions): ClaudeCodeHarness | CodexHarness;
+export declare function createHarness(id: "pi", opts?: PiHarnessOptions): PiHarness;
+export declare function createHarness(id: `acp:${string}`, opts?: AcpHarnessOptions): AcpHarness;
+export declare function createHarness(id: string, opts?: ClaudeCodeHarnessOptions & CodexHarnessOptions & PiHarnessOptions & AcpHarnessOptions): ClaudeCodeHarness | CodexHarness | PiHarness | AcpHarness;

package/dist/harness/index.js

@@ -4,21 +4,30 @@
  */
 import { ClaudeCodeHarness } from "./claude-code.js";
 import { CodexHarness } from "./codex.js";
-import { unsupportedAgentError } from "./agents.js";
+import { AcpHarness } from "./acp.js";
+import { PiHarness } from "./pi.js";
+import { parseAcpAgent, unsupportedAgentError } from "./agents.js";
 export { claudeCompat, asClaude } from "./compat.js";
 export { policyGate, nativeDenyClasses, resolveHarnessPolicy, isToolClass, TOOL_CLASSES } from "./policy.js";
 export { ask, evaluate, buildAskPrompt, buildEvaluatePrompt } from "./prompts.js";
 export { ClaudeCodeHarness, CLAUDE_CODE_CAPABILITIES } from "./claude-code.js";
 export { CodexHarness, CODEX_CAPABILITIES, MIN_CODEX_VERSION } from "./codex.js";
+export { AcpHarness, ACP_CAPABILITIES, ACP_PROTOCOL_VERSION } from "./acp.js";
+export { PiHarness, PI_CAPABILITIES, MIN_PI_VERSION } from "./pi.js";
 export { startToolBridge } from "./tool-bridge/server.js";
-export { SUPPORTED_AGENTS, isSupportedAgent, unsupportedAgentError } from "./agents.js";
+export { SUPPORTED_AGENTS, isSupportedAgent, parseAcpAgent, unsupportedAgentError } from "./agents.js";
 export function createHarness(id, opts = {}) {
+    // `acp:<command>` (#416): any ACP agent. An empty command is an error, not a fallback.
+    if (id.startsWith("acp:"))
+        return new AcpHarness({ ...opts, acpCommand: parseAcpAgent(id) ?? "" });
     switch (id) {
         case "claude":
         case "claude-code":
             return new ClaudeCodeHarness(opts);
         case "codex":
             return new CodexHarness(opts);
+        case "pi":
+            return new PiHarness(opts);
         default:
             throw new Error(unsupportedAgentError(id));
     }

package/dist/harness/parse.d.ts

@@ -47,3 +47,15 @@ export declare function summarizeToolError(parsed: unknown): string;
  * non-conforming model answer is at least attributable.
  */
 export declare function tryParseJSON(text: string, outputSchema?: JSONSchema, logger?: Pick<Logger, "warn">, label?: string): Record<string, unknown>;
+/**
+ * Lightweight structural check of a parsed object against a JSON Schema.
+ *
+ * Deliberately shallow: it verifies `required` keys are present and that the
+ * top-level `type` and each declared property `type` match. It does NOT do
+ * full JSON Schema validation (no `$ref`, `oneOf`, formats, nested arrays).
+ * The contract here is "flag an obviously non-conforming object" so a mismatch
+ * is logged rather than silently accepted; it is not a validation gate.
+ *
+ * Returns a list of human-readable problems; empty means no detected mismatch.
+ */
+export declare function schemaMismatches(value: unknown, schema: JSONSchema): string[];

package/dist/harness/parse.js

@@ -195,7 +195,7 @@ export function tryParseJSON(text, outputSchema, logger, label = "Claude") {
  *
  * Returns a list of human-readable problems; empty means no detected mismatch.
  */
-function schemaMismatches(value, schema) {
+export function schemaMismatches(value, schema) {
     const problems = [];
     const s = schema;
     if (s.type === "object" || s.properties || s.required) {

package/dist/harness/pi.d.ts

@@ -0,0 +1,202 @@
+/**
+ * pi harness (#415): runs a node on the pi coding agent (bring any model)
+ * through `pi --mode rpc`.
+ *
+ * Interfaces used, all read from badlogic/pi-mono at v0.99.2
+ * (`packages/coding-agent`, now also published as earendil-works/pi):
+ * - `docs/cli.md`: `--mode rpc`, `--no-session`, `--tools` (allowlist over
+ *   built-in, extension and MCP tools), `--exclude-tools`, `--no-tools`,
+ *   `--no-extensions` with explicit `-e builtin:mcp`, `--no-context-files`,
+ *   `--no-skills`, `--no-prompt-templates`, `--no-themes`, `--no-approve`,
+ *   `--model`, `--append-system-prompt`.
+ * - `docs/rpc.md`, `docs/rpc-commands.md`: JSONL framing on LF only, the
+ *   `prompt`, `abort` and `get_session_stats` commands, `agent_settled`.
+ * - `docs/json.md`, `docs/message-types.md`: `message_end` (assistant message
+ *   with `stopReason` and `errorMessage`), `tool_execution_start|end`,
+ *   `auto_retry_end`.
+ * - `docs/mcp.md`, `src/extensions/mcp/`: `mcp.json` in `$PI_CODING_AGENT_DIR`,
+ *   `exposure: "direct"` so tools are declared to the model, `${VAR}` in
+ *   `env`, tool names `mcp__<server>__<tool>`.
+ * - `docs/security.md`: "no built-in sandbox", so the whole process runs
+ *   inside the sweny process wrapper (sandbox-wrapper.ts) and strict refuses
+ *   without it.
+ * - `src/core/agent-session.ts` `_refreshToolRegistry`: a `--tools` allowlist
+ *   filters every registered tool, MCP tools included, by exact name.
+ *
+ * Every sweny opinion in the pi column of the enforcement matrix is enforced
+ * natively, kept by sweny (wrapper, tool bridge, prompt + parse + validate,
+ * watchdog), reported in `degraded`, or refused under strict policy by
+ * `policyGate`. Nothing is dropped silently.
+ */
+import type { Logger, McpServerConfig, NodeUsage, ToolContext, Tool } from "../types.js";
+import { type SandboxMode } from "../agent-env.js";
+import type { AgentHarness, HarnessCapabilities, HarnessCompleteRequest, HarnessInfo, HarnessRunRequest, HarnessRunResult, ToolClass } from "./types.js";
+import { PI_CAPABILITIES } from "./capabilities.js";
+import { type HarnessPolicyMode } from "./policy.js";
+import { type SandboxWrapper } from "./sandbox-wrapper.js";
+export { PI_CAPABILITIES };
+/**
+ * Oldest pi this adapter is written against. The docs and source were read at
+ * v0.99.2; older releases are unverified, so they are refused.
+ */
+export declare const MIN_PI_VERSION = "0.99.2";
+/** Name of the MCP server that carries sweny's skill tools (the tool bridge). */
+export declare const PI_BRIDGE_SERVER = "sweny-core";
+/**
+ * Hosts pi itself needs through the sandbox wrapper: the API host of every
+ * provider whose key is in the env, and of the provider named in `--model`
+ * (`provider/id`). Other providers (custom endpoints in `models.json`, cloud
+ * providers) are added with `SWENY_SANDBOX_ALLOWED_DOMAINS`.
+ */
+export declare function piBackendHosts(env?: Record<string, string | undefined>, model?: string): string[];
+export interface PiHarnessOptions {
+    /** Model passed to `--model`. Free text (`provider/id`, `id:thinking`); sweny has no model opinion. */
+    model?: string;
+    /** Tool-call budget the watchdog enforces when a node sets no `max_turns` (default: 20). */
+    maxTurns?: number;
+    /** Working directory (default: process.cwd()). */
+    cwd?: string;
+    logger?: Logger;
+    /** Default tool context for standalone usage (not via the executor). */
+    defaultContext?: ToolContext;
+    /** Catalog defaults, overridden by per-run skill servers and explicit mcpServers. */
+    defaultMcpServers?: Record<string, McpServerConfig>;
+    /** Explicit external MCP servers, overriding defaults and per-run skill servers. */
+    mcpServers?: Record<string, McpServerConfig>;
+    /** Extra env var names passed through (see agent-env.ts). Default: `SWENY_ENV_PASSTHROUGH`. */
+    envPassthrough?: string[];
+    /** Scope the pi env to the allowlist. Default: `SWENY_ENV_SCOPE`, else on in CI. */
+    envScope?: boolean;
+    /**
+     * Process sandbox mode (`SWENY_SANDBOX`): `strict` refuses the node without
+     * the process wrapper, `auto` wraps when a wrapper is available and otherwise
+     * degrades, `off` never wraps. Default: `SWENY_SANDBOX`, else `auto` in CI
+     * and `off` locally.
+     */
+    sandbox?: SandboxMode;
+    /**
+     * The host's process sandbox wrapper (#360 step 2). `undefined` = detect
+     * srt once per process; `null` = none (test seam).
+     */
+    sandboxWrapper?: SandboxWrapper | null;
+    /** `strict` refuses a node with unenforceable opinions. Default: {@link resolveHarnessPolicy}. */
+    policy?: HarnessPolicyMode;
+    /** The pi CLI. Default: `SWENY_PI_PATH`, else `pi` on PATH. Test seam for the fake. */
+    piCommand?: {
+        command: string;
+        args: string[];
+    };
+    /**
+     * A `models.json` (custom providers and models) copied into pi's scratch
+     * agent dir. Default: `SWENY_PI_MODELS_JSON`. Without it pi sees only its
+     * built-in model catalog; the operator's own `~/.pi/agent` is never read.
+     */
+    modelsFile?: string;
+    /** Shim command override for the tool bridge (test seam). */
+    toolBridgeShim?: {
+        command: string;
+        args: string[];
+    };
+    /** How long to wait for pi to stop after the `abort` command before SIGTERM (default: 3000 ms). */
+    abortGraceMs?: number;
+    /** Grace period between SIGTERM and SIGKILL when stopping pi (default: 2000 ms). */
+    killGraceMs?: number;
+    /** How long to wait for `get_session_stats` after the run settles (default: 5000 ms). */
+    statsTimeoutMs?: number;
+}
+/**
+ * Split `disallowed_tools` names into portable classes pi can act on, pi tools
+ * it can exclude by name, and the names it has no tool for.
+ */
+export declare function translateDenyNames(names?: readonly string[]): {
+    classes: ToolClass[];
+    piTools: string[];
+    unknown: string[];
+};
+/** The name pi registers an MCP tool under (`src/extensions/mcp/tools.ts` createMcpToolName). */
+export declare function piMcpToolName(server: string, tool: string, isTaken?: (name: string) => boolean): string;
+/** pi registered names of the bridge's tools, and the way back to the sweny names. */
+export declare function bridgeToolNames(tools: readonly Tool[]): {
+    names: string[];
+    back: Map<string, string>;
+};
+/**
+ * `mcp.json` entries for the external servers. Returns what pi cannot load
+ * (reported in `degraded`). Values using pi's `!command` or `${VAR}` syntax are
+ * refused, so a sweny config value can never run a command inside pi.
+ */
+export declare function piMcpServers(servers: Record<string, McpServerConfig>): {
+    entries: Record<string, Record<string, unknown>>;
+    unsupported: string[];
+};
+/**
+ * `get_session_stats` data onto NodeUsage. pi reports 0 for what a provider did
+ * not report (and for a model it has no price for), so only positive values are
+ * kept: absent stays absent, never a guessed 0 or a fake free run.
+ */
+export declare function mapStats(data: unknown): NodeUsage | undefined;
+export declare class PiHarness implements AgentHarness {
+    readonly id: "pi";
+    readonly capabilities: HarnessCapabilities;
+    /**
+     * Empty on purpose: judges use the model pi would use anyway. Leaving this
+     * undefined would fall back to the Claude judge model, which pi may not have.
+     */
+    readonly defaultJudgeModel = "";
+    readonly logger: Logger;
+    private model;
+    private maxTurns;
+    private cwd;
+    private defaultContext;
+    private mcpServers;
+    private defaultMcpServers;
+    private envPassthrough;
+    private envScope;
+    private sandboxMode;
+    private sandboxWrapper;
+    private policyMode;
+    private piCommand;
+    private modelsFile;
+    private toolBridgeShim;
+    private abortGraceMs;
+    private killGraceMs;
+    private statsTimeoutMs;
+    private egressWarned;
+    private preflightResult;
+    private version;
+    constructor(opts?: PiHarnessOptions);
+    info(): HarnessInfo;
+    /** `pi --version`, checked against {@link MIN_PI_VERSION}. Cached per instance. */
+    preflight(): Promise<{
+        ok: true;
+        version: string;
+    } | {
+        ok: false;
+        reason: string;
+    }>;
+    /** Env for the pi process: scoped like Claude Code's, with pi's provider credentials instead of Anthropic's. */
+    private buildEnv;
+    /** The node policy after `disallowed_tools` names are translated into pi classes. */
+    private compilePolicy;
+    /** argv shared by run() and complete(); the prompt travels as an RPC command, never in argv. */
+    private baseArgs;
+    /** Spawn pi in rpc mode, send the prompt, and read events until it settles and exits. */
+    private exec;
+    /** Write pi's scratch agent dir: generated `mcp.json` only (plus an operator-supplied `models.json`). */
+    private writeAgentDir;
+    /**
+     * Run a node. The gate runs first: in strict mode a node whose opinions pi
+     * cannot honor is refused before pi starts. pi has no native sandbox, so the
+     * whole process runs inside the host's process sandbox wrapper (#360 step 2)
+     * when the sandbox mode is not off; `SWENY_SANDBOX=strict` refuses without one.
+     */
+    run(req: HarnessRunRequest): Promise<HarnessRunResult>;
+    /** Map one rpc outcome onto a NodeResult with Claude Code's semantics. */
+    private toResult;
+    /**
+     * One completion: no tools (`--no-tools`), no MCP, no extensions, an empty
+     * scratch agent dir. Nothing can act, so no process wrapper is needed.
+     * null when it failed (callers fail closed).
+     */
+    complete(req: HarnessCompleteRequest): Promise<string | null>;
+}