@timurproko/a1 0.1.8-dev.235df0e → 0.1.8-dev.260

package/docs/manual-owned-ui-checkpoint.md

@@ -0,0 +1,78 @@
+# Manual owned-UI checkpoint
+
+This checkpoint is user-controlled. Tests and coding agents must not launch or focus a terminal, inject desktop input, resize windows, close applications, or clean up workstation processes.
+
+## Prepare an exact candidate
+
+For a checkout smoke test in Git Bash, build once and launch with `./scripts/dev` or `./scripts/dev pi`. Do not invoke `node scripts/development/dev-launch.mjs` or `node scripts/development/start-local.mjs` directly: that bypasses the color-preserving shell `exec` shape and can collapse the pinned 24-bit palette to Git Bash's 16 terminal colors. Run `node scripts/check-terminal-colour.mjs` first when color fidelity is in doubt; the first color block must differ from the terminal-palette cyan block.
+
+From the candidate checkout, pack once and install that tarball into a disposable prefix:
+
+```powershell
+npm ci
+npm run build
+npm pack --ignore-scripts --pack-destination .artifacts/manual-owned-ui
+npm install --prefix .artifacts/manual-owned-ui/install --ignore-scripts .artifacts/manual-owned-ui/<exact-tarball>.tgz
+```
+
+Use isolated A1 control state:
+
+```powershell
+$manualRoot = (Resolve-Path ".artifacts/manual-owned-ui").Path
+$env:A1_CONFIG_DIR = "$manualRoot\state\config"
+$env:A1_DATA_DIR = "$manualRoot\state\data"
+$env:A1_RUNTIME_DIR = "$manualRoot\state\runtime"
+$env:A1_DATABASE_PATH = "$manualRoot\state\data\control.sqlite3"
+```
+
+Run each installed launch form yourself:
+
+```powershell
+& ".artifacts/manual-owned-ui/install/node_modules/.bin/a1.cmd"
+& ".artifacts/manual-owned-ui/install/node_modules/.bin/a1.cmd" pi
+```
+
+Both commands use the same A1-owned rendering and input pipeline. Bare `a1` enables A1-owned screens. `a1 pi` withholds those screens and reads the ordinary Pi profile. Confirm that files created through `/settings`, `/login`, sessions, and resource directories remain under the selected profile root.
+
+Physical automation is not part of this repository baseline. Future certification tooling may run only on dedicated disposable workers or VMs with exclusive test desktops, never on this workstation.
+
+## Compare bare A1 with `a1 pi`
+
+Use the same terminal, working directory, dimensions, environment, and equivalent profile resources. Bare A1 and the comparison profile intentionally use separate profile roots.
+
+- [ ] Startup resources, logo, notices, spacing, editor, and footer match.
+- [ ] Text, Unicode, emoji, styles, cursor, and layout match.
+- [ ] Rapid typing has no visible delay or dropped or duplicated characters.
+- [ ] Ctrl+C, Ctrl+P, arrows, paste, focus, dialogs, mouse, and wheel behave correctly.
+- [ ] Selection, copy, clipboard, scrollback, and resize behave correctly.
+- [ ] Normal and error exits return a usable parent prompt.
+- [ ] Parent typing, cursor movement, Backspace, Delete, and submission work after exit.
+
+### Setting-controlled visual matrix
+
+Use equivalent values in bare A1 and the Pi comparison profile. Exercise both a wide frame and a narrow frame that forces wrapping/clipping.
+
+- [ ] `/settings`: selected cursor, label and value accent; unselected values muted; descriptions and hints dim; search uses `> ` with inverse cursor; scalar menus, numeric controls, warning-parts dialog, deferred notice, failed write, section spacing, clipping, and hidden-entry absence match their pinned semantic roles.
+- [ ] Transcript: toggle images and image width, thinking level/visibility, Mermaid mode, output padding, cache notices, warnings, auto-compaction, queue modes, command autocomplete, provider timeout/retry/error, and changelog collapse. Existing and streaming blocks must re-render without focus, selection, scroll, or queued-work loss.
+- [ ] Trust startup: from an undecided project, compare selected Trust/Do not trust rows, arrow navigation, Enter, Escape/Ctrl+C, clearing, cursor state, and restoration. No project extension/theme/prompt/skill may run before selection, and a fail-closed diagnostic must appear once on the restored parent rather than above a blank fullscreen frame.
+- [ ] Terminal lifecycle: toggle hardware cursor, clear-on-shrink, and terminal progress; resize smaller/larger; open/close selectors; select and copy transcript text; verify no duplicate rows, stale OSC progress, leaked mouse mode, misplaced cursor, or broken parent input.
+- [ ] Images: in Kitty or iTerm2 verify inline width and clipping; in Windows Terminal verify the textual fallback and absence of image protocol bytes without hiding `showImages`.
+- [ ] Fullscreen exit `transcript`: verify the parent is restored before styled user, assistant Markdown, thinking, tool, notice, warning, error, and spacing rows are printed. No overlay, draft, animation, scrollbar, or inline-image payload may appear.
+- [ ] Fullscreen exit `resume-hint`: verify only dim `To resume this session:` plus `a1 --session <compact-id>` is printed for the default directory. A custom directory must place quoted `--session-dir <dir>` before `--session`; the raw default `.jsonl` path must never print.
+
+Record acceptance with:
+
+```text
+A1 commit/tarball:
+Pi package: @earendil-works/pi-coding-agent 0.84.2
+OS/version:
+Terminal/version:
+Terminal dimensions (wide/narrow):
+Image protocol result:
+Settings values exercised:
+Outcome and any declared substitutions:
+```
+
+Report failures with bare-versus-comparison behavior, platform and terminal versions, exact command, dimensions, settings values, reproducibility, and optional manually captured evidence.
+
+For recovery, use `a1 pi`; do not use the removed `a1 ui` command. Manual acceptance can authorize an exact uncertified development preview after non-desktop gates pass. It does not certify stable presentation parity or platform support.

package/docs/manual-pi-boundary-candidate.md

@@ -21,12 +21,11 @@ Use the exact generated filename if wildcard expansion is unavailable.
 1. **Bare owned UI:** run `& $Candidate`. Confirm startup, typing, submission, transcript streaming, selector focus, mouse/keyboard scrolling, and ordinary shutdown.
 2. **Extension surfaces:** in bare UI use `/reload`, then exercise configured extension notification, select, confirm, input, editor, replacement custom surface, and overlay custom surface. Confirm cancellation restores editor focus.
 3. **Vanilla oracle:** run `& $Candidate pi`. Confirm untouched Pi uses the ordinary `~/.pi/agent` profile and does not show owned-UI or workspace surfaces.
-4. **Isolated profile:** run `& $Candidate sandbox`. Confirm Pi uses `~/.a1/sandbox` and starts with project approval disabled for that run.
-5. **Resize and input:** while each mode is active, narrow and widen the terminal, enter Unicode and multiline text, use history/navigation keys, and scroll in both directions.
-6. **Shutdown:** exit normally, then repeat and use Ctrl+C during work. Confirm the parent prompt remains usable and no child remains attached.
-7. **Recovery:** after any owned-UI failure, run `& $Candidate pi`; confirm the vanilla oracle remains available. Restart bare UI and confirm its normal profile remains intact.
+4. **Resize and input:** while each mode is active, narrow and widen the terminal, enter Unicode and multiline text, use history/navigation keys, and scroll in both directions.
+5. **Shutdown:** exit normally, then repeat and use Ctrl+C during work. Confirm the parent prompt remains usable and no child remains attached.
+6. **Recovery:** after any owned-UI failure, run `& $Candidate pi`; confirm the vanilla oracle remains available. Restart bare UI and confirm its normal profile remains intact.
 
-Do not remove `~/.a1/agent`, `~/.pi/agent`, or `~/.a1/sandbox` during this checkpoint.
+Do not remove `~/.a1/agent` or `~/.pi/agent` during this checkpoint.
 
 ## Verdict recording
 

package/docs/manual-terminal-colour-check.md

@@ -29,9 +29,10 @@ leave the launch without a terminal on its input; the launcher says so and stops
 rather than opening a session that closes as it starts. Running `scripts/dev`
 from the shell is the direct path.
 
-A directly launched `node scripts/start-local.mjs` under Git Bash does not, and
-neither does a directly launched `node …/pi/dist/cli.js`: the collapse belongs to
-the launch, not to either application.
+A directly launched `node scripts/development/dev-launch.mjs` or
+`node scripts/development/start-local.mjs` under Git Bash does not, and neither
+does a directly launched `node …/pi/dist/cli.js`: the collapse belongs to the
+launch, not to either application.
 
 ## Checking a terminal
 

package/docs/repository-governance-live-acceptance.md

@@ -0,0 +1,77 @@
+# Repository governance live acceptance
+
+## Implementation lifecycle
+
+- PR #165 was manually squash-merged by `timurproko` from validated head
+  `45aab61c5e4568d3d26dc970f76e9ec86918f323` to `develop` commit
+  `e4cdc67555e9f25d03f251be19baa8fc446ac313`.
+- Cleanup run `33185942656` used trusted `develop` policy with `contents: write` only
+  and reported `already-absent`; the implementation branch remained absent.
+- The read-only live governance report matched every declared field after merge.
+
+## Acceptance defect and correction
+
+- Initial OpenSpec probe PR #166 automatically squash-merged validated head
+  `c30c0a091a6a6a727057befcdd775422988be382` to
+  `f8d60080cfd9925b33a19a5d40c707637ac00b08`, but GitHub suppressed the recursive
+  close-event workflow because integration was authored with `GITHUB_TOKEN`.
+- Its exact unchanged branch remained, proving the first implementation incomplete.
+  The branch was manually deleted only after its expected SHA and lack of an open PR
+  were reverified.
+- Corrective PR #167 was manually squash-merged from validated head
+  `3a09042386df2501accc1eec3b424b94ae84daa4` to
+  `e8d639985a811f01cd5daeb027db5069d1724596`. Cleanup run `33188206793`
+  succeeded with `already-absent`.
+
+## Automatic OpenSpec acceptance
+
+- PR #168 contained only `openspec/**` paths.
+- Development validation run `33188285639` passed for exact head
+  `6678d9237ca7c4109beaed0d97d5fb1183fe5f97` without product tests.
+- `github-actions` automatically squash-merged it to
+  `c2fa730a4b070f9f6717329c24158def5c766f11`.
+- Trusted documentation reconciliation run `33188329123` reported `deleted` for the
+  same expected head SHA, and the remote branch was verified absent.
+
+## Automatic root README acceptance
+
+- PR #169 changed only root `README.md`.
+- Development validation run `33188400573` passed for exact head
+  `165c5159031d80059c4d93c36c6d10113ec7ba8e` without product tests.
+- `github-actions` automatically squash-merged it to
+  `0180088a42b7cdacaf84ec66ff5a87be1a697155`.
+- Trusted documentation reconciliation run `33188434277` reported `deleted` for the
+  same expected head SHA, and the remote branch was verified absent.
+
+## Mixed-path manual acceptance
+
+PR #170 combined this evidence file outside the exact automatic allowlist with an
+OpenSpec task update. Development validation run `33188542485` passed for exact head
+`b95bdbf08ad6db76c5fab2bfca254026a3c4bcc1` without product tests. Auto-merge
+remained disabled and the pull request remained open and mergeable until `timurproko`
+manually squash-merged it to `6ab1e4d29b9edec8501bac774bc755e66240ea40`.
+Close-event cleanup run `33188616709` reported `already-absent`, and the remote branch
+was verified absent after the explicit merge.
+
+## Automatic maintained-documentation acceptance
+
+- Implementation PR #180 was manually squash-merged after required validation from
+  head `8f40bfaaa5e8410e77b1c9cc0667c62bc4c62d4b` to
+  `45a59a7b696d537a4dc8fe62000a60c20e504ab2`.
+- PR #181 changes only this maintained `docs/**` file and is the live acceptance
+  probe for the expanded allowlist.
+- Acceptance requires current-head documentation validation, automatic squash
+  integration without maintainer merge action, and exact-head remote branch cleanup.
+  Exact run and merge evidence is recorded with the completed OpenSpec change.
+
+## Advanced-ref refusal and final policy state
+
+The isolated mocked-GitHub fixture executed the production shared reconciler with
+expected SHA `1111111111111111111111111111111111111111` and advanced live SHA
+`2222222222222222222222222222222222222222`. It returned `refused` with reason
+`live branch advanced after merge` and issued zero DELETE requests. The bounded
+record is archived as `evidence/advanced-ref-refusal.json`.
+
+The final read-only live report matched all declared repository settings, Actions
+policy, security capabilities, environments, protected refs, complete rulesets, and
+workflow inventory with zero differences. No policy apply was run.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.1.8-dev.235df0e",
+  "version": "0.1.8-dev.260",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "packageManager": "npm@11.13.0",
@@ -8,10 +8,7 @@
     "a1": "bin/cli.js"
   },
   "imports": {
-    "#pi-tui": [
-      "./node_modules/@earendil-works/pi-coding-agent/node_modules/@earendil-works/pi-tui/dist/index.js",
-      "@earendil-works/pi-tui"
-    ]
+    "#pi-tui": "./bin/pi-tui.js"
   },
   "files": [
     "bin",
@@ -24,42 +21,52 @@
     "node": ">=22.19.0 <25"
   },
   "scripts": {
+    "postinstall": "node bin/sync-pi-tui-proxy.js",
     "clean": "node scripts/clean.mjs",
-    "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/build-process-guardian.mjs",
-    "build:process-guardian": "node scripts/build-process-guardian.mjs",
+    "build": "npm run clean && tsc -p tsconfig.build.json && node scripts/development/build-process-guardian.mjs && node scripts/release/generate-runtime-payload-inventory.mjs",
+    "build:process-guardian": "node scripts/development/build-process-guardian.mjs",
     "typecheck": "tsgo -p tsconfig.json --noEmit",
-    "check:architecture": "node scripts/check-architecture.mjs && node scripts/product-identifier-policy.mjs --check && node scripts/check-product-identity-boundaries.mjs && node scripts/check-package-identity.mjs && node scripts/check-pinned-pi-source-ledger.mjs && node scripts/check-terminal-host-provenance.mjs",
-    "check:customization-ready": "node scripts/check-owned-ui-customization-prerequisites.mjs",
-    "check:deprecated": "node scripts/check-deprecated-dependencies.mjs",
+    "check:architecture": "node scripts/governance/check-architecture.mjs && node scripts/governance/product-identifier-policy.mjs --check && node scripts/governance/check-product-identity-boundaries.mjs && node scripts/governance/check-package-identity.mjs && node scripts/governance/check-pinned-pi-source-ledger.mjs && node scripts/governance/check-terminal-host-provenance.mjs",
+    "check:code-documentation": "node scripts/governance/check-code-documentation.mjs --mode full",
+    "check:code-documentation:changed": "node scripts/release/run-changed-documentation.mjs",
+    "select:validation-impact": "node scripts/release/select-validation-impact.mjs",
+    "check:customization-ready": "node scripts/governance/check-owned-ui-customization-prerequisites.mjs",
+    "check:deprecated": "node scripts/governance/check-deprecated-dependencies.mjs",
+    "check:docs-governance": "node scripts/governance/check-docs-governance.mjs",
+    "check:repository-governance": "node scripts/governance/check-github-repository-governance.mjs --check",
     "branches:prune": "node scripts/prune-merged-branches.mjs",
     "check": "npm run test:fast",
-    "release": "node scripts/release.mjs",
+    "develop": "node scripts/development/develop.mjs",
+    "release": "node scripts/release/release.mjs",
     "test": "npm run test:fast",
-    "test:fast": "node scripts/run-validation-tier.mjs typecheck fast",
-    "test:scope": "node scripts/run-validation-tier.mjs",
-    "test:full": "node scripts/run-validation-tier.mjs full-release",
-    "test:release": "node scripts/run-release-gates.mjs",
-    "test:terminal-host": "node scripts/run-terminal-host-probe.mjs",
-    "test:pi-engine-conformance": "vitest run test/foundation/pi-engine-adapter/conformance.test.ts test/foundation/pi-engine-adapter/runtime-integration.test.ts test/foundation/pi-engine-adapter/session-integration.test.ts",
-    "report:pi-engine-conformance": "npm run build --silent && node scripts/run-pi-engine-conformance.mjs",
+    "test:fast": "node scripts/release/run-validation-tier.mjs typecheck documentation-changed fast",
+    "test:scope": "node scripts/release/run-validation-tier.mjs",
+    "test:full": "node scripts/release/run-validation-tier.mjs full-release",
+    "test:release": "node scripts/release/run-release-gates.mjs",
+    "test:terminal-host": "node scripts/development/run-terminal-host-probe.mjs",
+    "test:pi-engine-conformance": "vitest run test/integrations/pi/engine/conformance.test.ts test/integrations/pi/engine/runtime-integration.test.ts test/integrations/pi/engine/session-integration.test.ts",
+    "report:pi-engine-conformance": "npm run build --silent && node scripts/pi/run-pi-engine-conformance.mjs",
+    "report:rendering-stability": "tsx scripts/pi/report-rendering-stability.ts",
+    "report:input-responsiveness": "tsx scripts/pi/report-input-responsiveness.ts",
     "sync:pi-ui": "npm run update:pi-component-parity && npm run update:pi-event-frame-parity && npm run update:pi-settings-metadata",
-    "update:pi-component-parity": "tsx scripts/update-pi-component-parity.ts",
-    "update:pi-event-frame-parity": "tsx scripts/update-pi-event-frame-parity.ts",
-    "proof:terminal-host": "node scripts/run-terminal-host.mjs",
-    "start": "npm run build && node scripts/dev-launch.mjs",
-    "start:pi": "npm run build && node scripts/dev-launch.mjs pi",
-    "start:sandbox": "npm run build && node scripts/dev-launch.mjs sandbox",
-    "prepack": "node scripts/prepack-gate.mjs",
+    "update:pi-component-parity": "tsx scripts/pi/update-pi-component-parity.ts",
+    "update:pi-event-frame-parity": "tsx scripts/pi/update-pi-event-frame-parity.ts",
+    "proof:terminal-host": "node scripts/development/run-terminal-host.mjs",
+    "start": "npm run build && node scripts/development/dev-launch.mjs",
+    "start:pi": "npm run build && node scripts/development/dev-launch.mjs pi",
+    "prepack": "node scripts/release/prepack-gate.mjs",
     "prepublishOnly": "npm run test:release",
     "prepare": "npm run build",
-    "update:pi-settings-metadata": "node scripts/update-pi-settings-metadata.mjs"
+    "update:pi-settings-metadata": "node scripts/pi/update-pi-settings-metadata.mjs"
   },
   "dependencies": {
     "@earendil-works/pi-coding-agent": "0.84.2",
     "@earendil-works/pi-tui": "0.84.2",
+    "chalk": "5.6.2",
     "cross-spawn": "7.0.6",
     "grok-mermaid": "0.2.2",
-    "semver": "7.8.5"
+    "semver": "7.8.5",
+    "undici": "8.9.0"
   },
   "devDependencies": {
     "@types/cross-spawn": "6.0.6",
@@ -87,5 +94,8 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "optionalDependencies": {
+    "@mariozechner/clipboard": "^0.3.9"
   }
 }

package/dist/src/cli/capabilities.d.ts

@@ -1,15 +0,0 @@
-/**
- * `pi` and `sandbox` exist to compare A1 against pinned Pi and to try resources
- * against an isolated profile. Both are development instruments rather than
- * product, so a stable release does not carry them: what a released `a1` exposes
- * is the product plus its maintenance and package commands.
- *
- * Which build this is comes from its own version. A prerelease version is a
- * `next`-channel build, which is where that work happens; a release version is
- * not. Nothing to configure, and no way for a released build to be talked into it.
- */
-export interface CliCapabilities {
-    readonly developmentProfiles: boolean;
-}
-export declare function cliCapabilities(version: string): CliCapabilities;
-export declare function isPrereleaseVersion(version: string): boolean;

package/dist/src/cli/dispatch.js

@@ -1,177 +0,0 @@
-import { interactiveLaunchIntent } from "../features/launch/index.js";
-import { PRODUCT_TEXT } from "../product-identity.js";
-export function cliUsage(capabilities) {
-    return PRODUCT_TEXT.usage([
-        "",
-        ...(capabilities.developmentProfiles ? ["pi", "sandbox"] : []),
-        "version",
-        "update [self|--models]",
-        "update:next",
-        "update:<commit>",
-        "pi install <source>",
-        "pi remove <source>",
-        "pi list",
-        "pi update [--extensions|<source>]",
-    ]);
-}
-const PROFILE_WORDS = new Set(["pi", "sandbox"]);
-export async function dispatchCli(arguments_, handlers, output, capabilities) {
-    const command = parseCliCommand(arguments_, capabilities);
-    if (command.kind === "error") {
-        output.stderr(`${command.message}\n${cliUsage(capabilities)}\n`);
-        return 2;
-    }
-    if (command.kind === "launch")
-        return await handlers.launch(interactiveLaunchIntent(command.profileId));
-    if (command.kind === "version")
-        return await handlers.version();
-    if (command.kind === "packages")
-        return await handlers.packages(command.request);
-    return await handlers.update(command.channel, command.target);
-}
-export function parseCliCommand(arguments_, capabilities) {
-    if (arguments_.length === 0)
-        return { kind: "launch", profileId: "a1" };
-    const [command, ...rest] = arguments_;
-    if (command === "pi") {
-        if (rest.length > 0)
-            return parsePiPackageCommand(rest);
-        if (capabilities.developmentProfiles)
-            return { kind: "launch", profileId: "pi" };
-    }
-    if (capabilities.developmentProfiles && command === "sandbox") {
-        return withoutArguments(rest, { kind: "launch", profileId: command });
-    }
-    if (command === "version")
-        return withoutArguments(rest, { kind: "version" });
-    if (command !== undefined && command.startsWith("update:"))
-        return parseColonUpdate(command.slice("update:".length), rest);
-    if (command === "update")
-        return parseUpdate(rest);
-    if (command === "install" || command === "remove" || command === "uninstall" || command === "list") {
-        return packageNamespaceRejection(command, rest.join(" ") || undefined);
-    }
-    if (command === "ui")
-        return { kind: "error", message: `The ui subcommand was removed; run bare ${PRODUCT_TEXT.commandName} for the owned UI.` };
-    if (command === "agent")
-        return { kind: "error", message: `Bare ${PRODUCT_TEXT.commandName} is the ${PRODUCT_TEXT.displayName} agent experience; there is no agent subcommand.` };
-    return { kind: "error", message: PRODUCT_TEXT.diagnostic(`received an unknown command: ${command ?? ""}`) };
-}
-/**
- * What follows the colon says which build to move to. `next` is the newest
- * preview; anything else names one outright, by the commit it was built from or by
- * its full version — a preview is published as `<version>-dev.<commit>`, so the
- * commit alone is enough to find it.
- */
-function parseColonUpdate(suffix, rest) {
-    if (rest.length > 0)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic("update takes what to move to after the colon, and nothing else.") };
-    if (suffix === "next")
-        return { kind: "update", channel: "next" };
-    if (suffix.length === 0)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`update: needs a preview after the colon, as in ${PRODUCT_TEXT.commandName} update:next.`) };
-    if (!/^[0-9a-z][0-9a-z.+-]*$/i.test(suffix)) {
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`received an unusable preview: ${suffix}`) };
-    }
-    return { kind: "update", channel: "next", target: suffix };
-}
-/**
- * Top-level `update` owns A1 itself and A1's model catalogs. Extension package
- * maintenance lives under the `pi` compatibility namespace, while updating the
- * pinned Pi runtime remains impossible.
- */
-function parseUpdate(rest) {
-    if (rest.length === 0)
-        return { kind: "update", channel: "stable" };
-    if (rest.length > 1)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic("update accepts one target.") };
-    const [target] = rest;
-    if (target === "self")
-        return { kind: "update", channel: "stable" };
-    if (target === "pi") {
-        return {
-            kind: "error",
-            message: PRODUCT_TEXT.diagnostic(`pins the Pi version it was certified against; run ${PRODUCT_TEXT.commandName} update to move ${PRODUCT_TEXT.displayName} itself.`),
-        };
-    }
-    if (target === "next" || target === "stable") {
-        const form = target === "next" ? `${PRODUCT_TEXT.commandName} update:next` : `${PRODUCT_TEXT.commandName} update`;
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`selects a release channel with a colon; run ${form}.`) };
-    }
-    if (target === "--models")
-        return { kind: "packages", request: { verb: "refresh-models", source: null } };
-    if (target === "--extensions" || (target !== undefined && !target.startsWith("-"))) {
-        return packageNamespaceRejection("update", target === "--extensions" ? "--extensions" : target);
-    }
-    return unknownOption(target ?? "", "update");
-}
-function parsePiPackageCommand(arguments_) {
-    const [verb, ...rest] = arguments_;
-    if (verb === "install" || verb === "remove" || verb === "uninstall") {
-        return parseSourceCommand(verb === "install" ? "install" : "remove", rest);
-    }
-    if (verb === "list")
-        return withoutArguments(rest, { kind: "packages", request: { verb: "list", source: null } });
-    if (verb === "update")
-        return parsePiPackageUpdate(rest);
-    return { kind: "error", message: PRODUCT_TEXT.diagnostic(`received an unknown pi package command: ${verb ?? ""}`) };
-}
-function parsePiPackageUpdate(rest) {
-    if (rest.length === 0) {
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`pi update needs --extensions or a package source.`) };
-    }
-    if (rest.length > 1)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic("pi update accepts one target.") };
-    const [target] = rest;
-    if (target === "--extensions")
-        return { kind: "packages", request: { verb: "update", source: null } };
-    if (target === "--models") {
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`refreshes its model catalogs at the top level; run ${PRODUCT_TEXT.commandName} update --models.`) };
-    }
-    if (target === undefined || target.startsWith("-"))
-        return unknownOption(target ?? "", "pi update");
-    if (PROFILE_WORDS.has(target))
-        return profileRejection("update");
-    return { kind: "packages", request: { verb: "update", source: target } };
-}
-function parseSourceCommand(verb, rest) {
-    const flag = rest.find(argument => argument.startsWith("-"));
-    if (flag !== undefined)
-        return unknownOption(flag, verb);
-    if (rest.length === 0)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`${verb} requires a package source.`) };
-    if (rest.length > 1)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`${verb} accepts one package source.`) };
-    const [source] = rest;
-    if (source === undefined)
-        return { kind: "error", message: PRODUCT_TEXT.diagnostic(`${verb} requires a package source.`) };
-    if (PROFILE_WORDS.has(source))
-        return profileRejection(verb);
-    return { kind: "packages", request: { verb, source } };
-}
-function withoutArguments(rest, command) {
-    if (rest.length === 0)
-        return command;
-    const [argument] = rest;
-    if (argument !== undefined && (PROFILE_WORDS.has(argument) || argument.startsWith("--profile")))
-        return profileRejection("list");
-    return { kind: "error", message: PRODUCT_TEXT.diagnostic("commands do not accept additional arguments.") };
-}
-function packageNamespaceRejection(verb, target) {
-    const suffix = target === undefined ? "" : ` ${target}`;
-    return {
-        kind: "error",
-        message: PRODUCT_TEXT.diagnostic(`manages extension packages under its pi namespace; run ${PRODUCT_TEXT.commandName} pi ${verb}${suffix}.`),
-    };
-}
-function profileRejection(verb) {
-    return {
-        kind: "error",
-        message: PRODUCT_TEXT.diagnostic(`manages packages in its own profile, so ${verb} takes no profile; Pi manages Pi's own profile.`),
-    };
-}
-function unknownOption(option, verb) {
-    if (option.startsWith("--profile"))
-        return profileRejection(verb);
-    return { kind: "error", message: PRODUCT_TEXT.diagnostic(`received an unknown option for ${verb}: ${option}`) };
-}

package/dist/src/cli/version-stats.js

@@ -1,72 +0,0 @@
-import { spawn } from "node:child_process";
-import { readFile } from "node:fs/promises";
-import { resolve } from "node:path";
-import crossSpawn from "cross-spawn";
-import { valid as validSemver } from "semver";
-import { PRODUCT_TEXT } from "../product-identity.js";
-const defaultOutput = {
-    stdout(message) { process.stdout.write(message); },
-    stderr(message) { process.stderr.write(message); },
-};
-export async function runVersionStats(options) {
-    const output = options.output ?? defaultOutput;
-    const runner = options.runner ?? createVersionProcessRunner();
-    let installed;
-    try {
-        const manifest = JSON.parse(await readFile(resolve(options.packageRoot, "package.json"), "utf8"));
-        installed = parseVersion(manifest.version, "installed package");
-    }
-    catch (error) {
-        output.stderr(`${PRODUCT_TEXT.diagnostic(`could not read its installed version: ${message(error)}`)}\n`);
-        return 1;
-    }
-    const remote = await queryDistTags(runner);
-    output.stdout(`Installed: ${installed}\nRelease:   ${remote.release ?? "unavailable"}\nNext:      ${remote.next ?? "unavailable"}\n`);
-    if (remote.error)
-        output.stderr(`${PRODUCT_TEXT.diagnostic(`could not resolve npm dist-tags: ${remote.error}`)}\n`);
-    return 0;
-}
-async function queryDistTags(runner) {
-    let result;
-    try {
-        result = await runner("npm", ["view", PRODUCT_TEXT.packageName, "dist-tags", "--json"]);
-    }
-    catch (error) {
-        return unavailable(message(error));
-    }
-    if (result.code !== 0)
-        return unavailable(`npm exited with status ${result.code ?? "unknown"}`);
-    try {
-        const metadata = JSON.parse(result.stdout);
-        if (typeof metadata !== "object" || metadata === null || Array.isArray(metadata))
-            throw new TypeError("npm returned a non-object dist-tags value");
-        const tags = metadata;
-        const release = parseVersion(tags.latest, "npm latest");
-        const next = tags.next === undefined ? null : parseVersion(tags.next, "npm next");
-        return { release, next, error: null };
-    }
-    catch (error) {
-        return unavailable(message(error));
-    }
-}
-function unavailable(error) {
-    return { release: null, next: null, error };
-}
-function createVersionProcessRunner() {
-    return async (command, arguments_) => await new Promise((resolvePromise, rejectPromise) => {
-        const child = process.platform === "win32"
-            ? crossSpawn(command, [...arguments_], { stdio: ["ignore", "pipe", "ignore"] })
-            : spawn(command, [...arguments_], { stdio: ["ignore", "pipe", "ignore"] });
-        const stdout = [];
-        child.stdout?.on("data", chunk => stdout.push(Buffer.from(chunk)));
-        child.once("error", rejectPromise);
-        child.once("close", code => resolvePromise({ code, stdout: Buffer.concat(stdout).toString("utf8") }));
-    });
-}
-function parseVersion(value, source) {
-    const parsed = typeof value === "string" ? validSemver(value) : null;
-    if (!parsed)
-        throw new Error(`${source} did not provide a valid semantic version`);
-    return parsed;
-}
-function message(error) { return error instanceof Error ? error.message : String(error); }

package/dist/src/composition/index.d.ts

@@ -1,48 +0,0 @@
-import { type AgentEnginePort } from "../foundation/agent-engine-contracts/index.js";
-import { type PiEngineAdapter } from "../foundation/pi-engine-adapter/index.js";
-import { type OwnedUiApplicationPort, type PresentationComponentPort, type PresentationRuntimePort, type PresentationTerminalPort } from "../foundation/presentation-contracts/index.js";
-import { OwnedUiSettingsSession } from "../foundation/owned-ui-settings/index.js";
-import type { UiRouteHost } from "../foundation/pi-owned-ui-integration/index.js";
-export interface ProcessCompositionOptions {
-    readonly cwd?: string;
-    readonly sessionId?: string;
-    readonly engine?: AgentEnginePort;
-    readonly presentationFactory?: (root: PresentationComponentPort, terminal: PresentationTerminalPort) => PresentationRuntimePort;
-    readonly createPiAdapter?: () => Promise<PiEngineAdapter>;
-}
-export interface OwnedUiCompositionOptions {
-    readonly cwd?: string;
-    readonly terminal?: PresentationTerminalPort;
-    readonly createPiAdapter?: () => Promise<PiEngineAdapter>;
-    /**
-     * A1 profile whose settings this session reads and writes. Omitted keeps the
-     * session settings-free, which is what the pinned comparison paths use.
-     */
-    readonly profileId?: string;
-    /**
-     * Whether A1's own surfaces are reachable. Withheld for the rendering parity
-     * comparison, which measures this composition against pinned Pi and so must
-     * present Pi's interface and nothing of A1's own. It is the same composition
-     * either way: a parity run built beside the product would measure itself.
-     */
-    readonly ownedSurfaces?: "on" | "off";
-}
-export interface OwnedUiComposition {
-    readonly application: OwnedUiApplicationPort;
-    /** Present when a profile was supplied, so the caller can resolve settings before start. */
-    readonly settings: OwnedUiSettingsSession | null;
-}
-export declare function composeOwnedUiApplication(options?: OwnedUiCompositionOptions): Promise<OwnedUiApplicationPort>;
-export declare function composeOwnedUi(options?: OwnedUiCompositionOptions): Promise<OwnedUiComposition>;
-export interface ProcessComposition {
-    readonly engine: AgentEnginePort;
-    createPresentation(root: PresentationComponentPort, terminal: PresentationTerminalPort): PresentationRuntimePort;
-    dispose(): Promise<void>;
-}
-export declare function composeProcess(options?: ProcessCompositionOptions): Promise<ProcessComposition>;
-/**
- * Registers the A1-owned screens and adapts the app host to the shell's route
- * seam. The shell mounts whatever surface it is handed and forwards keys; it
- * never learns what an app is.
- */
-export declare function createOwnedRouteHost(settings: OwnedUiSettingsSession): UiRouteHost;