@timurproko/a1 0.2.6-dev.727 → 0.2.6-dev.736

package/docs/architecture/boundaries.md

@@ -30,7 +30,7 @@ The owned Pi-backed surface is not an arbitrary-CLI terminal multiplexer. A feat
 - `prompt-suggestions`: opt-in bounded diagnostic snapshots of neutral suggestion lifecycle metadata. Composition supplies an explicit local destination; this feature never imports Pi, generates suggestions, stores conversation text, or owns the editor. See [prompt suggestion diagnostics](prompt-suggestions.md).
 - `storage`: SQLite migrations, prior-boot reconciliation, and plural launch-instance persistence. Legacy foreground rows are historical migration input and never authorize current ownership.
 - `supervisor`: endpoint identity, plural cohort ownership, per-instance reconciliation, and aggregate release shutdown coordination. It owns no terminal surface.
-- `pi-engine-adapter`, `pi-component-adapter`, and `pi-tui-runtime-adapter`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly.
+- `pi-engine-adapter`, `pi-component-adapter`, and `pi-tui-runtime-adapter`: isolate pinned Pi engine and presentation knowledge behind neutral contracts; product features do not import them directly. Inside the engine adapter, one process-level engine host owns what is process-wide (the HTTP dispatcher, the theme singletons, the one-time changelog and package-update announcements, the startup trace) and is the only place sessions are created, so every session id is unique per process.
 - `session-shell` (`src/app/session-shell`): the application layer that composes the feature owners, the UI foundations, and the three Pi adapters into the interactive session; only composition imports it. Its render root assembles semantic document and dock rows, while its focused viewport controller owns follow state, pointer routing, selection, and interaction timers. Owned-app route lifecycle belongs to the neutral `ui-apps` owner and is only hosted by the session shell.
 - release/update/bootstrap: package-derived immutable release identity, process-guardian integrity, cohort selection, durable update transactions, rollback, and dependency-light command entry. After an unsuccessful bare-A1 child exit, the bootstrap restores owned terminal modes; neither guardian emits terminal controls.
 - `terminal-cleanup`: bounded, idempotent emergency restoration and fatal-exit diagnostics for an explicitly owned terminal. It does not inspect commands, relay terminal input/output, or emulate terminal state. The owned UI installs its fatal boundary before terminal activation; packaged bootstrap and checkout launch provide the surviving-owner fallback. Fatal records retain at most ten 16 KiB records with trusted classifications and code locations, never prompts, attachments, raw input, credentials, or arbitrary exception messages.
@@ -43,6 +43,14 @@ The JavaScript product path has no PTY or terminal-emulator dependency. Reintrod
 
 `scripts/governance/check-architecture.mjs` enforces the structural parts of these boundaries. Cross-cutting rationale belongs here; implementation history belongs in Git and archived OpenSpec changes.
 
+## Multi-session limits of the pinned engine
+
+The engine host removes A1's own obstacles to several Pi sessions in one process, but three remain in the pinned Pi SDK and must be planned around, not discovered:
+
+- The extension cache is keyed by one working directory and cleared on reload (`core/extensions/loader.js`), so sessions in different directories reload each other's extensions.
+- `SettingsManager` writes under a lockfile but never re-reads the file, so a second in-memory copy goes stale after another session writes a setting (`core/settings-manager.js`). The host keeps the one process-wide effect, the HTTP dispatcher, consistent itself.
+- `AgentSessionRuntime.dispose()` releases the session but not the model runtime or the resource loader it was created with (`core/agent-session-runtime.js`), so a session's services outlive it until the process ends.
+
 ## Planned multi-agent boundaries
 
 The multi-agent workspace feature, its dependency-free contracts, the structured-agent runtime, and the Node side of the terminal-host protocol were removed from `develop` while the multi-agent plan is on hold; their last state is preserved on the `archive/multi-agent-workspace` branch. A future implementation starts from the current codebase rather than from that copy. The boundary rules below remain the design intent for that work.

package/docs/architecture/project-structure.md

@@ -18,13 +18,14 @@ src/
     prompt-history/                profile-isolated prompt retention and bounded SQLite worker lifecycle
     prompt-suggestions/            opt-in bounded metadata capture and local diagnostic snapshots
   contracts/
-    agent-engine/                  dependency-free agent engine, session, package, and capability ports
+    agent-engine/                  dependency-free agent settings and package contracts
     owned-ui/                      dependency-free owned-session and extension UI contracts
     presentation/                  dependency-free component, terminal, and runtime ports
   integrations/
     pi/
       components/                  pinned Pi component and theme adaptation
       engine/                      pinned Pi engine, settings, resource, package, and workflow integration
+      session-presenters/          pinned Pi selectors and transcript renderers built from engine objects
       tui-runtime/                 neutral presentation runtime over pinned Pi TUI
   foundation/
     launch-guardian/               authenticated launch-instance coordination
@@ -42,7 +43,7 @@ src/
 
 Each directory owner exposes `index.ts`, which lists its named exports; `export *` is rejected there so a public contract is readable in one place. Imports within one owner may use private files. Imports crossing owners must use the provider's public entry and follow the dependency DAG declared by `PROJECT_OWNERS`. Two exceptions exist: `src/composition` is the dependency-injection root and may reach past any public entry, and a module on the eager startup path may import a leaf of a provider whose public entry is a prohibited startup entry (`PROHIBITED_STARTUP_ENTRIES` in `startup-graph-policy.mjs`), because loading that barrel would pull the provider's whole graph into startup. `product-identity` is the sole exception to the directory-entry convention because its public entry is `src/product-identity.ts`.
 
-Three layer boundaries hold regardless of the DAG: `src/contracts/*` import nothing outside their own contract; `src/ui/components` imports only contracts; only `src/integrations/pi/*` and the shipped `bin/` entries import the pinned Pi packages. The session shell under `src/app` is the application layer: it may import the contracts, the UI foundations, the three Pi adapters, and the feature owners, and only composition imports it.
+Three layer boundaries hold regardless of the DAG: `src/contracts/*` import nothing outside their own contract; `src/ui/components` imports only contracts; only `src/integrations/pi/*` and the shipped `bin/` entries import the pinned Pi packages. The session shell under `src/app` is the application layer: it may import the contracts, the UI foundations, the three Pi adapters, and the feature owners, and only composition imports it. The shell never holds a Pi engine object: selectors and transcript renderers built from one live in `src/integrations/pi/session-presenters`, the only owner besides composition that may import both the engine and the component adapters, and the shell opens them through the `OwnedUiSessionPresenters` contract.
 
 `src/cli` contains command policy but delegates runtime work. `src/composition` is the concrete dependency-injection boundary: it may know both neutral contracts and Pi implementations, while product features receive vendor-neutral ports. Foundation modules never import product features. Pi package knowledge remains inside the Pi adapter owners.
 

package/docs/architecture/ui-reference-provenance.md

@@ -42,7 +42,7 @@ its own `core` facade layer; A1 is a product, so the port adapts imports and kee
 | `pi-engine/session-integration.ts` and `pi-components/shell-footer-status.ts` — steering queue | pinned Pi interactive mode `onSubmit` and `updatePendingMessagesDisplay` | Steering/follow-up uses `prompt(..., { streamingBehavior })`, allowing Pi to emit the accepted user row, while remaining steering rows preserve Pi's opening spacer, dim `Steering:` labels, dequeue hint, and order before `Working`. |
 | `ui-components/list-view.ts`, `dialog-panel.ts`, `value-menu.ts`, and `features/owned-ui/settings-app.ts` — setting presentation | pinned Pi `SettingsSelectorComponent`, Pi TUI `SettingsList`, `SelectList`, and `Input` at `0.84.2` | Cursor and selected label accents, unselected muted values, the 30-column label cap, dialog styling, notices, and narrow-width geometry retain pinned semantics. Scalar-menu placement and input remain shared, while the muted, hover-brightened selected value, A1/Agent grouping, pointer steppers, explicit `/` search, ruled shared input, shortcut-derived status hints, suppressed selected descriptions, `scrollbarSpeed`-driven wheel movement, a list rail that follows `scrollbarAppearance` and `scrollbarStyle` with transcript-style hover and drag, `Ctrl+Home`/`Ctrl+End` boundary jumps, and the dark floating menu with lighter active row and effective-value check mark are declared product-owned differences. Independent row evidence: `test/features/owned-ui/pinned-settings-presentation-parity.test.ts`; owned interaction evidence: `test/features/owned-ui/settings-app.test.ts`, `test/ui/components/value-menu.test.ts`, and `test/composition/settings-route-host.test.ts`. |
 | `features/owned-ui/project-trust-prompt.ts` — pre-resource selector | pinned Pi `cli/startup-ui.ts`, `cli/project-trust.ts`, and `core/project-trust.ts` at commit `914cf1472e715297caa30db4b9535d534a9eb718` | Uses a fixed, dependency-bounded A1 startup selector rather than importing private CLI modules. It preserves selected-option accent, navigation/accept/reject/cancel semantics, fail-closed behavior, raw-mode restoration, clearing, cursor restoration, and parent-screen restoration before diagnostics. |
-| `session-shell/session-shell-root.ts` and `session-shell.ts` — fullscreen exit | pinned Pi `InteractiveMode.formatResumeCommand()` and shutdown output at commit `914cf1472e715297caa30db4b9535d534a9eb718` | Re-renders authoritative transcript components with semantic SGR intact, excludes inline-image control payloads and fullscreen-only chrome, restores the terminal first, then emits pinned dim `To resume this session:` wording with `a1`, compact session id, and conditional quoted `--session-dir`. |
+| `session-shell/session-shell-root.ts`, `session-shell.ts`, and `shell-host.ts` — fullscreen exit | pinned Pi `InteractiveMode.formatResumeCommand()` and shutdown output at commit `914cf1472e715297caa30db4b9535d534a9eb718` | Re-renders authoritative transcript components with semantic SGR intact, excludes inline-image control payloads and fullscreen-only chrome, restores the terminal first, then emits pinned dim `To resume this session:` wording with `a1`, compact session id, and conditional quoted `--session-dir`. |
 | `pi-tui-runtime/input-presentation-coordinator.ts` and custom-viewport dock reuse | pinned Pi TUI `TuiBase` input dispatch and immediate-render pending guard at `0.84.2` | Preserves each original terminal delivery and invokes the existing Pi handlers exactly once in order. Bare A1 alone drains finite-grammar text/edit/navigation bursts in one immediate event-loop opportunity so Pi's existing pending guard paints the newest state once; effectful, unknown, protocol, paste, and extension-owned input remains an immediate barrier. Geometry-stable dock frames reuse A1's established transcript viewport, while uncertain geometry and replacement-surface damage still fail closed. Independent evidence is under `test/support/input-responsiveness/`. |
 | `test/features/owned-ui/pi-raw-terminal-parity.ts` — parity normalization | pinned Pi public components/runtime at `0.84.2` | Only synchronized-output envelopes, absolute hyperlink targets, declared product/path substitutions, and nondeterministic timing may normalize. SGR roles/reset boundaries, rows, cursor operations, clearing, restoration, and write order remain authoritative; A1-generated JSON captures are diagnostics and cannot serve as pinned evidence. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@timurproko/a1",
-  "version": "0.2.6-dev.727",
+  "version": "0.2.6-dev.736",
   "description": "Standalone terminal workspace for supervised native and managed agents",
   "type": "module",
   "privateLaunchContract": "neutral-launch-v1",

package/dist/contracts/agent-engine/model.d.ts

@@ -1,78 +0,0 @@
-import type { AgentMessage } from "./domain.js";
-export declare const AGENT_ENGINE_CONTRACT_VERSION: 1;
-export type AgentSessionId = string;
-export type AgentCommandId = string;
-export type AgentEventSequence = number;
-export type AgentSessionLifecycle = "starting" | "ready" | "busy" | "stopping" | "stopped" | "failed";
-export type AgentCommandCapability = "prompt" | "steer" | "follow-up" | "abort" | "retry" | "compact" | "bash" | "replace-session";
-export type AgentEventCapability = "lifecycle" | "content" | "command-outcome" | "snapshot-invalidated" | "diagnostic";
-export interface AgentCapabilityContract {
-    readonly contractVersion: typeof AGENT_ENGINE_CONTRACT_VERSION;
-    readonly commands: readonly AgentCommandCapability[];
-    readonly events: readonly AgentEventCapability[];
-    readonly snapshots: {
-        readonly supported: boolean;
-        readonly maxBytes: number;
-    };
-}
-interface AgentCommandEnvelope {
-    readonly contractVersion: typeof AGENT_ENGINE_CONTRACT_VERSION;
-    readonly commandId: AgentCommandId;
-    readonly sessionId: AgentSessionId;
-}
-export type AgentCommand = (AgentCommandEnvelope & {
-    readonly type: "prompt" | "steer" | "follow-up";
-    readonly text: string;
-}) | (AgentCommandEnvelope & {
-    readonly type: "abort" | "retry" | "compact";
-}) | (AgentCommandEnvelope & {
-    readonly type: "bash";
-    readonly command: string;
-}) | (AgentCommandEnvelope & {
-    readonly type: "replace-session";
-    readonly source: {
-        readonly kind: "new";
-    } | {
-        readonly kind: "resume";
-        readonly sessionPath: string;
-    };
-});
-export type AgentCommandOutcome = "accepted" | "completed" | "rejected" | "failed" | "cancelled";
-interface AgentEventEnvelope {
-    readonly contractVersion: typeof AGENT_ENGINE_CONTRACT_VERSION;
-    readonly sessionId: AgentSessionId;
-    readonly sequence: AgentEventSequence;
-}
-export type AgentEvent = (AgentEventEnvelope & {
-    readonly type: "lifecycle";
-    readonly lifecycle: AgentSessionLifecycle;
-    readonly reason: string | null;
-}) | (AgentEventEnvelope & {
-    readonly type: "content";
-    readonly content: AgentMessage;
-}) | (AgentEventEnvelope & {
-    readonly type: "command-outcome";
-    readonly commandId: AgentCommandId;
-    readonly outcome: AgentCommandOutcome;
-    readonly diagnostic: string | null;
-}) | (AgentEventEnvelope & {
-    readonly type: "snapshot-invalidated";
-    readonly expectedRevision: number;
-}) | (AgentEventEnvelope & {
-    readonly type: "diagnostic";
-    readonly code: string;
-    readonly message: string;
-    readonly recoverable: boolean;
-});
-export interface AgentSnapshot {
-    readonly contractVersion: typeof AGENT_ENGINE_CONTRACT_VERSION;
-    readonly snapshotId: string;
-    readonly sessionId: AgentSessionId;
-    readonly revision: number;
-    readonly sequence: AgentEventSequence;
-    readonly lifecycle: AgentSessionLifecycle;
-    readonly content: readonly AgentMessage[];
-    readonly activeCommandIds: readonly AgentCommandId[];
-    readonly capabilities: AgentCapabilityContract;
-}
-export {};

package/dist/contracts/agent-engine/model.js

@@ -1 +0,0 @@
-export const AGENT_ENGINE_CONTRACT_VERSION = 1;

package/dist/contracts/agent-engine/ports.d.ts

@@ -1,18 +0,0 @@
-import type { AgentCapabilityContract, AgentCommand, AgentCommandOutcome, AgentEvent, AgentSessionId, AgentSessionLifecycle, AgentSnapshot } from "./model.js";
-export interface AgentSessionPort {
-    readonly sessionId: AgentSessionId;
-    readonly lifecycle: AgentSessionLifecycle;
-    readonly capabilities: AgentCapabilityContract;
-    execute(command: AgentCommand): Promise<AgentCommandOutcome>;
-    subscribe(listener: (event: AgentEvent) => void): () => void;
-    snapshot(): Promise<AgentSnapshot>;
-    dispose(): Promise<void>;
-}
-export interface AgentEnginePort {
-    readonly capabilities: AgentCapabilityContract;
-    createSession(input: {
-        readonly sessionId: AgentSessionId;
-        readonly cwd: string;
-    }): Promise<AgentSessionPort>;
-    dispose(): Promise<void>;
-}

package/dist/contracts/agent-engine/serialization.d.ts

@@ -1,7 +0,0 @@
-import type { AgentCapabilityContract, AgentCommand, AgentEvent, AgentSnapshot } from "./model.js";
-export declare function encodeAgentCommand(command: AgentCommand, capabilities?: AgentCapabilityContract): string;
-export declare function decodeAgentCommand(source: string, capabilities?: AgentCapabilityContract): AgentCommand;
-export declare function encodeAgentEvent(event: AgentEvent, capabilities?: AgentCapabilityContract): string;
-export declare function decodeAgentEvent(source: string, capabilities?: AgentCapabilityContract): AgentEvent;
-export declare function encodeAgentSnapshot(snapshot: AgentSnapshot): string;
-export declare function decodeAgentSnapshot(source: string): AgentSnapshot;

package/dist/contracts/agent-engine/serialization.js

@@ -1,58 +0,0 @@
-import { assertAgentCommand, assertAgentEvent, assertAgentSnapshot } from "./validation.js";
-const MAX_ENVELOPE_BYTES = 1024 * 1024;
-export function encodeAgentCommand(command, capabilities) {
-    assertAgentCommand(command, capabilities);
-    return encode(command);
-}
-export function decodeAgentCommand(source, capabilities) {
-    const value = decode(source);
-    assertAgentCommand(value, capabilities);
-    return value;
-}
-export function encodeAgentEvent(event, capabilities) {
-    assertAgentEvent(event, capabilities);
-    return encode(event);
-}
-export function decodeAgentEvent(source, capabilities) {
-    const value = decode(source);
-    assertAgentEvent(value, capabilities);
-    return value;
-}
-export function encodeAgentSnapshot(snapshot) {
-    assertAgentSnapshot(snapshot);
-    const encoded = encode(snapshot);
-    if (Buffer.byteLength(encoded, "utf8") > snapshot.capabilities.snapshots.maxBytes)
-        throw new RangeError("agent snapshot exceeds negotiated byte limit");
-    return encoded;
-}
-export function decodeAgentSnapshot(source) {
-    const value = decode(source);
-    assertAgentSnapshot(value);
-    if (Buffer.byteLength(source, "utf8") > value.capabilities.snapshots.maxBytes)
-        throw new RangeError("agent snapshot exceeds negotiated byte limit");
-    return value;
-}
-function encode(value) {
-    let encoded;
-    try {
-        encoded = JSON.stringify(value);
-    }
-    catch (error) {
-        throw new TypeError("agent contract value must be JSON serializable", { cause: error });
-    }
-    if (encoded === undefined)
-        throw new TypeError("agent contract value must be JSON serializable");
-    if (Buffer.byteLength(encoded, "utf8") > MAX_ENVELOPE_BYTES)
-        throw new RangeError("agent contract envelope exceeds its byte limit");
-    return encoded;
-}
-function decode(source) {
-    if (typeof source !== "string" || Buffer.byteLength(source, "utf8") > MAX_ENVELOPE_BYTES)
-        throw new RangeError("agent contract envelope exceeds its byte limit");
-    try {
-        return JSON.parse(source);
-    }
-    catch (error) {
-        throw new TypeError("agent contract envelope is invalid JSON", { cause: error });
-    }
-}

package/dist/contracts/agent-engine/validation.d.ts

@@ -1,5 +0,0 @@
-import { type AgentCapabilityContract, type AgentCommand, type AgentEvent, type AgentSnapshot } from "./model.js";
-export declare function assertAgentCapabilityContract(value: AgentCapabilityContract): void;
-export declare function assertAgentCommand(command: AgentCommand, capabilities?: AgentCapabilityContract): void;
-export declare function assertAgentEvent(event: AgentEvent, capabilities?: AgentCapabilityContract): void;
-export declare function assertAgentSnapshot(snapshot: AgentSnapshot): void;

package/dist/contracts/agent-engine/validation.js

@@ -1,128 +0,0 @@
-import { AGENT_ENGINE_CONTRACT_VERSION, } from "./model.js";
-import { assertAgentMessage } from "./domain-validation.js";
-const COMMANDS = new Set(["prompt", "steer", "follow-up", "abort", "retry", "compact", "bash", "replace-session"]);
-const EVENTS = new Set(["lifecycle", "content", "command-outcome", "snapshot-invalidated", "diagnostic"]);
-const LIFECYCLES = new Set(["starting", "ready", "busy", "stopping", "stopped", "failed"]);
-const OUTCOMES = new Set(["accepted", "completed", "rejected", "failed", "cancelled"]);
-const MAX_TEXT_BYTES = 256 * 1024;
-const MAX_COLLECTION = 10_000;
-export function assertAgentCapabilityContract(value) {
-    assertVersion(value.contractVersion);
-    assertUniqueEnum(value.commands, COMMANDS, "agent command capabilities");
-    assertUniqueEnum(value.events, EVENTS, "agent event capabilities");
-    if (typeof value.snapshots?.supported !== "boolean" || !Number.isSafeInteger(value.snapshots.maxBytes) || value.snapshots.maxBytes < 1024) {
-        throw new TypeError("agent snapshot capability is invalid");
-    }
-}
-export function assertAgentCommand(command, capabilities) {
-    assertVersion(command.contractVersion);
-    assertId(command.commandId, "agent command id");
-    assertId(command.sessionId, "agent command session id");
-    if (!COMMANDS.has(command.type))
-        throw new TypeError("agent command type is unknown");
-    if (capabilities !== undefined) {
-        assertAgentCapabilityContract(capabilities);
-        if (!capabilities.commands.includes(command.type))
-            throw new TypeError(`agent command capability is unavailable: ${command.type}`);
-    }
-    if (command.type === "prompt" || command.type === "steer" || command.type === "follow-up")
-        assertText(command.text, "agent command text");
-    if (command.type === "bash")
-        assertText(command.command, "agent bash command");
-    if (command.type === "replace-session" && command.source.kind === "resume")
-        assertText(command.source.sessionPath, "agent resume path");
-}
-export function assertAgentEvent(event, capabilities) {
-    assertVersion(event.contractVersion);
-    assertId(event.sessionId, "agent event session id");
-    assertNonNegative(event.sequence, "agent event sequence");
-    if (!EVENTS.has(event.type))
-        throw new TypeError("agent event type is unknown");
-    if (capabilities !== undefined) {
-        assertAgentCapabilityContract(capabilities);
-        if (!capabilities.events.includes(event.type))
-            throw new TypeError(`agent event capability is unavailable: ${event.type}`);
-    }
-    switch (event.type) {
-        case "lifecycle":
-            if (!LIFECYCLES.has(event.lifecycle))
-                throw new TypeError("agent lifecycle is invalid");
-            if (event.reason !== null)
-                assertText(event.reason, "agent lifecycle reason");
-            return;
-        case "content":
-            assertAgentMessage(event.content);
-            return;
-        case "command-outcome":
-            assertId(event.commandId, "agent outcome command id");
-            if (!OUTCOMES.has(event.outcome))
-                throw new TypeError("agent command outcome is invalid");
-            if (event.diagnostic !== null)
-                assertText(event.diagnostic, "agent outcome diagnostic");
-            return;
-        case "snapshot-invalidated":
-            assertNonNegative(event.expectedRevision, "agent expected snapshot revision");
-            return;
-        case "diagnostic":
-            assertId(event.code, "agent diagnostic code");
-            assertText(event.message, "agent diagnostic message");
-            if (typeof event.recoverable !== "boolean")
-                throw new TypeError("agent diagnostic recovery flag is invalid");
-    }
-}
-export function assertAgentSnapshot(snapshot) {
-    assertVersion(snapshot.contractVersion);
-    assertId(snapshot.snapshotId, "agent snapshot id");
-    assertId(snapshot.sessionId, "agent snapshot session id");
-    assertNonNegative(snapshot.revision, "agent snapshot revision");
-    assertNonNegative(snapshot.sequence, "agent snapshot sequence");
-    if (!LIFECYCLES.has(snapshot.lifecycle))
-        throw new TypeError("agent snapshot lifecycle is invalid");
-    assertAgentCapabilityContract(snapshot.capabilities);
-    if (!Array.isArray(snapshot.content) || snapshot.content.length > MAX_COLLECTION)
-        throw new RangeError("agent snapshot content collection is invalid");
-    for (const content of snapshot.content)
-        assertAgentEvent({ contractVersion: AGENT_ENGINE_CONTRACT_VERSION, sessionId: snapshot.sessionId, sequence: snapshot.sequence, type: "content", content });
-    if (!Array.isArray(snapshot.activeCommandIds) || snapshot.activeCommandIds.length > MAX_COLLECTION)
-        throw new RangeError("agent active command collection is invalid");
-    const ids = new Set();
-    for (const id of snapshot.activeCommandIds) {
-        assertId(id, "agent active command id");
-        if (ids.has(id))
-            throw new TypeError(`duplicate agent active command id: ${id}`);
-        ids.add(id);
-    }
-}
-function assertVersion(version) {
-    if (version !== AGENT_ENGINE_CONTRACT_VERSION)
-        throw new TypeError("unsupported agent engine contract version");
-}
-function assertUniqueEnum(values, allowed, label) {
-    if (!Array.isArray(values))
-        throw new TypeError(`${label} must be an array`);
-    const unique = new Set();
-    for (const value of values) {
-        if (!allowed.has(value))
-            throw new TypeError(`${label} contains an unknown value: ${String(value)}`);
-        if (unique.has(value))
-            throw new TypeError(`${label} contains a duplicate value: ${String(value)}`);
-        unique.add(value);
-    }
-}
-function assertId(value, label) {
-    if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(value))
-        throw new TypeError(`${label} is invalid`);
-}
-function assertText(value, label) {
-    if (typeof value !== "string" || value.length === 0)
-        throw new TypeError(`${label} is invalid`);
-    assertPossiblyEmptyText(value, label);
-}
-function assertPossiblyEmptyText(value, label) {
-    if (typeof value !== "string" || Buffer.byteLength(value, "utf8") > MAX_TEXT_BYTES)
-        throw new RangeError(`${label} exceeds its byte limit`);
-}
-function assertNonNegative(value, label) {
-    if (!Number.isSafeInteger(value) || value < 0)
-        throw new TypeError(`${label} is invalid`);
-}

package/dist/integrations/pi/components/upstream/theme/system-theme.d.ts

@@ -1,61 +0,0 @@
-/**
- * Provenance: @earendil-works/pi-coding-agent 1.1.0 (MIT), commit abe508e1b89912adde45528136c3221eb69acdd7,
- * packages/coding-agent/src/modes/interactive/theme/system-theme.ts.
- * Modifications: Copied the system palette generator with ESM import remapping and strict
- * indexed-access assertions; A1 retains explicit owned theme selection.
- * Deviations: none.
- */
-/**
- * The `system` theme: pi's colors derived from the terminal's own theme.
- *
- * Every token belongs to a color family (its hue) and has contrast rules: it must reach a contrast level
- * on the background and on the panels it is drawn on. Hue and saturation come from the terminal's palette
- * color for the family's ANSI slot, or from the family's own hue when the terminal reports no palette.
- * Lightness comes from the rules alone. Colors are built in OKHSL, whose saturation is relative to the
- * sRGB gamut, and fade toward gray near black and white. A palette color never gains OKLCH chroma when it
- * moves to another lightness, so pastel palettes stay pastel.
- *
- * A contrast level is a target-lightness curve: the OKLab lightness a token needs, given the lightness of
- * the surface below it. The curves were fitted to the reference theme design from the "Pi themes: system
- * and light/dark" review. On dark backgrounds they aim for nearly fixed lightness; on light backgrounds the
- * required difference grows as the background darkens.
- *
- * Depending on what the terminal reports, the theme is generated in one of three tiers:
- * - background and palette: hues from the palette, lightness from the background;
- * - background only: the families' own hues, lightness from the background;
- * - nothing: ANSI palette indices and the default colors, which the terminal renders itself.
- */
-import { type RgbColor } from "@earendil-works/pi-tui";
-import type { ThemeAppearance, ThemeColor, ThemeToken } from "./theme.js";
-export declare const SYSTEM_THEME_NAME = "system";
-export interface SystemThemeInput {
-    foreground?: RgbColor;
-    background?: RgbColor;
-    /** ANSI colors 0-15. */
-    palette?: RgbColor[];
-    /** Saturation multiplier from 0 (grayscale) to 1. The first frame renders in grayscale until colors arrive. */
-    saturation?: number;
-    /** Appearance when the terminal did not report its background, e.g. from its light/dark report or COLORFGBG. */
-    appearanceHint?: ThemeAppearance;
-}
-export interface SystemThemeColors {
-    /** Hex colors, ANSI palette indices, or "" for the terminal default. */
-    colors: Record<ThemeToken, string | number>;
-    /** Foreground tokens rendered faint (SGR 2), for terminals that did not report colors. */
-    dim: ThemeColor[];
-    appearance: ThemeAppearance | undefined;
-}
-/** WCAG 2 relative luminance. */
-export declare function relativeLuminance({ r, g, b }: RgbColor): number;
-/** WCAG 2 contrast ratio, 1-21. */
-export declare function wcagContrast(first: RgbColor, second: RgbColor): number;
-/**
- * Whether a terminal is dark or light, from its reported colors: the direction of its own foreground
- * when text can be readable that way, otherwise dark when white text has more contrast on the
- * background than black text.
- */
-export declare function terminalAppearance(background: RgbColor, foreground?: RgbColor): ThemeAppearance;
-/**
- * Generate the system theme's colors from the terminal's reported colors.
- */
-export declare function generateSystemThemeColors(input: SystemThemeInput): SystemThemeColors;