anon-pi 0.1.0

package/README.md

@@ -0,0 +1,117 @@
+# anon-pi
+
+Launch [pi](https://github.com/earendil-works/pi-mono) inside a [netcage](https://github.com/wighawag/netcage): all of pi's web and DNS egress is forced through a socks5h proxy (fail-closed, leak-proof), while ONE direct hole is opened to a local model on your LAN. Your pi config is seeded, per-workdir, onto the host; your canonical config is never touched by the container.
+
+anon-pi is a thin, opinionated launcher over `netcage run`. It is a separate package on purpose: netcage wraps any tool and stays tool-agnostic; anon-pi holds the pi-specific opinion.
+
+## Requirements
+
+- **Linux.** anon-pi inherits netcage's platform reality (network namespaces + nftables + rootless Podman). See [Platform](#platform).
+- **[`netcage`](https://github.com/wighawag/netcage)** on your `PATH`.
+- A running **socks5h proxy** (local Tor, `ssh -D`, ...).
+- A **container image with `pi` on its `PATH`** (you provide it via `ANON_PI_IMAGE`; see [Providing a pi image](#providing-a-pi-image)).
+
+## Install
+
+```sh
+npm i -g anon-pi
+# or run without installing:
+npx anon-pi
+```
+
+## Usage
+
+```sh
+anon-pi [WORKDIR]
+```
+
+- `WORKDIR` is the host folder pi works in (mounted at `/work`; pi's cwd). Defaults to the current directory. Files pi writes to `/work` land in this folder on the host.
+- The session config+state is keyed to this folder: re-running `anon-pi` on the same folder **resumes** the same pi config and history.
+
+```sh
+export ANON_PI_IMAGE=your/pi-image:tag
+export ANON_PI_LLM=192.168.1.150:8080     # your local model, reached directly
+export ANON_PI_PROXY=socks5h://127.0.0.1:9050
+
+anon-pi ./recon
+```
+
+You land in pi, inside the jail, cwd `/work` = `./recon`. pi's web/tool egress is anonymized through the proxy; the local model at `ANON_PI_LLM` is reachable directly; everything else is dropped if the proxy is down (fail-closed).
+
+## Environment
+
+| Var | Required | Default | Meaning |
+| --- | --- | --- | --- |
+| `ANON_PI_IMAGE` | yes | | container image with `pi` on `PATH` |
+| `ANON_PI_LLM` | yes | | RFC1918/link-local `IP[:port]` of the local model (the one direct hole) |
+| `ANON_PI_PROXY` | no | `socks5h://127.0.0.1:9050` | the socks5h proxy |
+| `ANON_PI_HOME` | no | `$XDG_CONFIG_HOME/anon-pi` or `~/.config/anon-pi` | anon-pi home |
+| `ANON_PI_CONFIG` | no | `<ANON_PI_HOME>/agent` | the canonical seed dir |
+| `ANON_PI_AGENT_MOUNT` | no | `/opt/pi-agent` | absolute container path pi's config is mounted at (see below) |
+
+## How it works
+
+1. **Seed (once per workdir).** The first time you use a workdir, anon-pi copies your canonical config (`~/.config/anon-pi/agent`) into a per-session dir `~/.config/anon-pi/sessions/<hash-of-workdir>/agent`. The canonical config is only ever READ; it is never mounted into the container, so pi in the jail cannot mutate it.
+2. **Mount.** The session config dir is mounted as pi's global config (`PI_CODING_AGENT_DIR=<mount>`, default `/opt/pi-agent`), and the workdir is mounted at `/work`.
+3. **Run.** anon-pi execs `netcage run --proxy <proxy> --allow-direct <ANON_PI_LLM> -it -v <workdir> -v <session>:<mount> -e PI_CODING_AGENT_DIR=<mount> <image> pi`.
+
+### Where pi's config is mounted (`ANON_PI_AGENT_MOUNT`)
+
+By default anon-pi mounts the seeded config at `/opt/pi-agent` and points pi there with `PI_CODING_AGENT_DIR`. This absolute, image-independent path is chosen so the podman mount target and pi's config dir agree without anon-pi having to guess your image's home directory.
+
+If you would rather pi's config live at its **standard** `~/.pi/agent` inside the container, set `ANON_PI_AGENT_MOUNT` to that home's **absolute** path, e.g. `ANON_PI_AGENT_MOUNT=/root/.pi/agent` for an image that runs as `root` (or `/home/<user>/.pi/agent` otherwise). The value must be absolute: podman does not expand `~`, and anon-pi rejects a `~`-relative or relative value rather than mounting it at a literal `~` directory. Both the mount target and `PI_CODING_AGENT_DIR` always stay in lockstep.
+
+## Providing a pi image
+
+anon-pi does not ship or default an image: you set `ANON_PI_IMAGE` to an image that has the `pi` CLI on its `PATH`. pi's maintainers do not publish an official prebuilt image, so the reputable path is to **build a small one from the upstream-documented recipe** (which installs the official [`@earendil-works/pi-coding-agent`](https://www.npmjs.com/package/@earendil-works/pi-coding-agent) npm package, no third-party image to trust).
+
+A ready `Dockerfile.pi` ships in this package (adapted from pi's own [containerization docs](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/containerization.md)):
+
+```sh
+# from wherever this package's Dockerfile.pi is (e.g. node_modules/anon-pi)
+podman build -t localhost/anon-pi-pi:latest -f Dockerfile.pi .
+export ANON_PI_IMAGE=localhost/anon-pi-pi:latest
+```
+
+The image only needs `pi` reachable on `PATH`. anon-pi passes `pi` as the run command and mounts pi's config itself, so the image needs **no `ENTRYPOINT` and no config volume** (unlike pi's upstream `Dockerfile.pi`, which is written for running pi directly).
+
+A community image also exists ([`gni/pi-coding-agent-container`](https://github.com/gni/pi-coding-agent-container)); it is third-party and unvetted, so review it yourself before trusting it with your (anonymized) credentials.
+
+## Populating the seed
+
+anon-pi **never** populates the canonical config for you (it will not silently copy your real identity into the anon config). Create it yourself:
+
+```sh
+mkdir -p ~/.config/anon-pi/agent
+cp -a ~/.pi/agent/. ~/.config/anon-pi/agent/
+# then remove anything you do NOT want in the anonymized identity
+```
+
+Put the pi config you want anon sessions to use here: anonymously-created accounts / API keys, the models and skills you want, and a **`trust.json` that trusts `/work`** so pi does not prompt about the (mounted) project on every run. anon-pi does not synthesize pi's `trust.json`; getting a valid one into the seed is your responsibility (copy it from a pi setup where `/work` is trusted, or approve once inside a session and it persists in the session dir).
+
+## Reseed
+
+Reseed is a manual step: delete the session dir and the next run re-seeds it.
+
+```sh
+rm -rf ~/.config/anon-pi/sessions/<hash>/agent
+```
+
+## Overriding the config per workdir
+
+The seeded config is pi's **global** in the container. pi also supports a **project-local** config at `<cwd>/.pi/`, which layers on top of the global. Since your workdir is pi's cwd (`/work`), you can drop a `/work/.pi/` (i.e. `<workdir>/.pi/`) into the folder to override the global for that folder only. anon-pi does nothing special for this; it is pi's normal project-over-global layering. (Make sure your seed's `trust.json` trusts `/work` so the override is honored without a prompt.)
+
+## Platform
+
+anon-pi is **Linux-only**, because netcage's jail is built on Linux kernel primitives (network namespaces, nftables, `/dev/net/tun`, rootless Podman + pasta). There is no native macOS/Windows jail.
+
+On macOS/Windows, Podman runs inside a Linux VM (`podman machine`), so netcage (and anon-pi) can run **inside that VM**. Two caveats matter for anon-pi:
+
+- **`--allow-direct` to a LAN model is VM-boundary-sensitive.** "Directly over the LAN" means the *VM's* NIC, not your Mac/Windows host LAN, so a model at an RFC1918 address on the host network may not be directly reachable from inside the VM the way it is on bare Linux.
+- **Host-loopback proxy reachback** (`ssh -D`/Tor on the host's `127.0.0.1`) is the host loopback, not the VM's.
+
+Treat non-Linux as best-effort-via-VM, not supported.
+
+## License
+
+[AGPL-3.0-only](./LICENSE)

package/dist/anon-pi.d.ts

@@ -0,0 +1,89 @@
+/** The container path the workdir is mounted at (pi's cwd). */
+export declare const CONTAINER_WORKDIR = "/work";
+/**
+ * The DEFAULT container path the seeded pi config is mounted at (the pi global).
+ * Absolute and image-independent: both podman (the -v target) and pi (the
+ * PI_CODING_AGENT_DIR env) agree on it with no home-resolution guessing. A user
+ * who knows their image's home can override it (ANON_PI_AGENT_MOUNT) to the
+ * standard `~/.pi/agent` location, e.g. /root/.pi/agent for a root image.
+ */
+export declare const DEFAULT_CONTAINER_AGENT_DIR = "/opt/pi-agent";
+/** The pi env var that overrides its config dir (see pi config.ts getAgentDir). */
+export declare const PI_AGENT_DIR_ENV = "PI_CODING_AGENT_DIR";
+/** Inputs resolved from the environment + argv, injected so this stays pure. */
+export interface AnonPiEnv {
+    /** $HOME (or an override) used to derive default paths. */
+    home: string;
+    /** socks5h proxy URL. Default socks5h://127.0.0.1:9050. */
+    proxy?: string;
+    /** The anon-pi home dir. Default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi. */
+    anonPiHome?: string;
+    /** Override the canonical seed dir. Default <anonPiHome>/agent. */
+    configSeed?: string;
+    /** The container image that has `pi` on PATH. REQUIRED. */
+    image?: string;
+    /** The RFC1918/link-local IP[:port] of the local model. REQUIRED. */
+    llmDirect?: string;
+    /** XDG_CONFIG_HOME, if set (used to derive the default anon-pi home). */
+    xdgConfigHome?: string;
+    /**
+     * The ABSOLUTE container path to mount the seeded config at (and point pi's
+     * PI_CODING_AGENT_DIR at). Default /opt/pi-agent. Set it to your image's real
+     * `~/.pi/agent` (e.g. /root/.pi/agent) if you want the standard location.
+     * MUST be absolute: podman does not expand `~`, so a `~`-relative value would
+     * be mounted literally. Rejected if it starts with `~` or is not absolute.
+     */
+    agentMount?: string;
+}
+/** The fully-resolved run plan cli.ts executes. */
+export interface RunPlan {
+    /** Absolute workdir on the host (mounted at /work). */
+    workdir: string;
+    /** The per-session seeded config dir on the host (mounted as the pi global). */
+    sessionAgentDir: string;
+    /** The canonical seed dir to copy FROM (read-only by convention). */
+    configSeed: string;
+    /** The absolute container path the session config is mounted at (== pi's config dir). */
+    agentMount: string;
+    /** True iff the session dir does not exist yet and must be seeded from configSeed. */
+    needsSeed: boolean;
+    /** The argv passed to `netcage` (after the `netcage` program name). */
+    netcageArgs: string[];
+}
+/** A user-facing error whose message is meant to be printed verbatim (no stack). */
+export declare class AnonPiError extends Error {
+}
+/**
+ * Resolve the container agent-mount path: ANON_PI_AGENT_MOUNT or the default.
+ * It MUST be an absolute container path, because it is BOTH the podman `-v`
+ * target AND pi's PI_CODING_AGENT_DIR, and podman (unlike pi) does not expand
+ * `~`. A `~`-relative or relative value is rejected loudly rather than silently
+ * mounted at a literal `~` directory or a cwd-relative path.
+ */
+export declare function resolveAgentMount(env: AnonPiEnv): string;
+/** Resolve the anon-pi home dir (holds the canonical seed + per-session state). */
+export declare function resolveAnonPiHome(env: AnonPiEnv): string;
+/** The canonical seed dir (copied FROM, never mounted). */
+export declare function resolveConfigSeed(env: AnonPiEnv): string;
+/**
+ * Session id = a stable short hash of the ABSOLUTE workdir path, so re-running
+ * anon-pi on the same folder resumes the same session config+state, and moving
+ * the folder starts a new session (documented, accepted).
+ */
+export declare function sessionId(absWorkdir: string): string;
+/** The per-session seeded config dir on the host for a given workdir. */
+export declare function sessionAgentDir(env: AnonPiEnv, absWorkdir: string): string;
+/**
+ * Build the run plan from the environment + the (optional) workdir arg. PURE: it
+ * resolves paths and composes the netcage argv, and reports whether a seed copy
+ * is needed, but performs NO filesystem writes or spawns. It THROWS AnonPiError
+ * for the two hard preconditions (missing image, missing llm) so the required
+ * inputs fail loud; the missing-SEED check is left to cli.ts (it needs a real
+ * `existsSync`), but `needsSeed` is derived from the injected `seedExists`.
+ */
+export declare function buildRunPlan(env: AnonPiEnv, workdirArg: string | undefined, seedExists: (dir: string) => boolean, sessionExists: (dir: string) => boolean): RunPlan;
+/** Read the AnonPiEnv from a process env map (kept separate so tests inject one). */
+export declare function envFromProcess(penv: Record<string, string | undefined>): AnonPiEnv;
+/** The --help text (kept here so it is covered by the same module). */
+export declare const HELP = "anon-pi - launch pi inside a netcage (anonymized egress + one direct local model)\n\nUSAGE\n  anon-pi [WORKDIR]\n\n  WORKDIR   the host folder pi works in (mounted at /work). Defaults to the\n            current directory. The session config+state is keyed to this folder.\n\nWHAT IT DOES\n  Seeds a per-workdir writable copy of your canonical anon-pi config into\n  ~/.config/anon-pi/sessions/<hash>/agent, mounts it as pi's global config\n  (PI_CODING_AGENT_DIR=<mount>, default /opt/pi-agent), mounts WORKDIR at\n  /work, opens ONE direct hole to your local model, and runs pi with all other\n  egress forced through the socks5h proxy, fail-closed. Requires `netcage`.\n\nENVIRONMENT\n  ANON_PI_IMAGE   (required) image with `pi` on PATH\n  ANON_PI_LLM     (required) RFC1918/link-local IP[:port] of the local model\n  ANON_PI_PROXY   socks5h URL (default socks5h://127.0.0.1:9050)\n  ANON_PI_HOME    anon-pi home (default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi)\n  ANON_PI_CONFIG  canonical seed dir (default <ANON_PI_HOME>/agent)\n  ANON_PI_AGENT_MOUNT  absolute container path for pi's config (default\n                  /opt/pi-agent; set to your image's ~/.pi/agent, e.g. /root/.pi/agent)\n\nRESEED\n  Reseed is manual: delete the session dir, e.g.\n    rm -rf ~/.config/anon-pi/sessions/<hash>/agent\n  and the next run re-seeds it from the canonical config.\n\nPLATFORM\n  Linux only (via netcage's netns/nft jail). On macOS/Windows it works only\n  inside a Linux VM, where --allow-direct to a LAN model is VM-boundary-sensitive.\n";
+//# sourceMappingURL=anon-pi.d.ts.map

package/dist/anon-pi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anon-pi.d.ts","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAwBA,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAE3D,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,wBAAwB,CAAC;AAEtD,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACvB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,eAAe,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;IACnB,yFAAyF;IACzF,UAAU,EAAE,MAAM,CAAC;IACnB,sFAAsF;IACtF,SAAS,EAAE,OAAO,CAAC;IACnB,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,oFAAoF;AACpF,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAiBxD;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAOxD;AAED,2DAA2D;AAC3D,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,yEAAyE;AACzE,wBAAgB,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAO1E;AAED;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAC3B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,UAAU,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,EACpC,aAAa,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GACrC,OAAO,CAiET;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,SAAS,CAWX;AAED,uEAAuE;AACvE,eAAO,MAAM,IAAI,khDAgChB,CAAC"}

package/dist/anon-pi.js

@@ -0,0 +1,192 @@
+// anon-pi: the PURE logic (no process spawning, no interactive I/O) so every
+// decision is unit-testable. cli.ts wires this to the real filesystem + spawn.
+//
+// What anon-pi does (settled design):
+//   - ALWAYS seed a per-workdir writable copy of the canonical anon-pi config
+//     (~/.config/anon-pi/agent) into a per-session dir keyed by the workdir, and
+//     mount THAT as the container's pi global (PI_CODING_AGENT_DIR). The
+//     canonical config is only ever READ (at seed time), never mounted, so the
+//     container cannot mutate it.
+//   - Mount the workdir separately at /work (pi's cwd; the user's files land on
+//     the host). A user-supplied /work/.pi/ override is just pi's own
+//     project-over-global layering; anon-pi neither creates nor requires it.
+//   - Open exactly ONE direct hole (--allow-direct <ANON_PI_LLM>) so pi can reach
+//     a local model while all other egress stays forced through the proxy.
+//   - NEVER auto-populate the canonical seed: if it is absent, error and tell the
+//     user to populate it (their anon accounts / chosen skills / a valid
+//     trust.json that trusts /work). anon-pi does not synthesize pi's trust.json.
+//   - Session identity = the ABSOLUTE workdir path (hashed). Same folder resumes
+//     the same session config+state; reseed is manual (delete the session dir).
+import { createHash } from 'node:crypto';
+import { homedir } from 'node:os';
+import { isAbsolute, join, resolve } from 'node:path';
+/** The container path the workdir is mounted at (pi's cwd). */
+export const CONTAINER_WORKDIR = '/work';
+/**
+ * The DEFAULT container path the seeded pi config is mounted at (the pi global).
+ * Absolute and image-independent: both podman (the -v target) and pi (the
+ * PI_CODING_AGENT_DIR env) agree on it with no home-resolution guessing. A user
+ * who knows their image's home can override it (ANON_PI_AGENT_MOUNT) to the
+ * standard `~/.pi/agent` location, e.g. /root/.pi/agent for a root image.
+ */
+export const DEFAULT_CONTAINER_AGENT_DIR = '/opt/pi-agent';
+/** The pi env var that overrides its config dir (see pi config.ts getAgentDir). */
+export const PI_AGENT_DIR_ENV = 'PI_CODING_AGENT_DIR';
+const DEFAULT_PROXY = 'socks5h://127.0.0.1:9050';
+/** A user-facing error whose message is meant to be printed verbatim (no stack). */
+export class AnonPiError extends Error {
+}
+/**
+ * Resolve the container agent-mount path: ANON_PI_AGENT_MOUNT or the default.
+ * It MUST be an absolute container path, because it is BOTH the podman `-v`
+ * target AND pi's PI_CODING_AGENT_DIR, and podman (unlike pi) does not expand
+ * `~`. A `~`-relative or relative value is rejected loudly rather than silently
+ * mounted at a literal `~` directory or a cwd-relative path.
+ */
+export function resolveAgentMount(env) {
+    const raw = env.agentMount && env.agentMount.trim() !== ''
+        ? env.agentMount.trim()
+        : DEFAULT_CONTAINER_AGENT_DIR;
+    if (raw.startsWith('~')) {
+        throw new AnonPiError(`anon-pi: ANON_PI_AGENT_MOUNT must be an ABSOLUTE container path, not \`${raw}\`. ` +
+            'podman does not expand `~`; use the concrete home, e.g. /root/.pi/agent.');
+    }
+    if (!raw.startsWith('/')) {
+        throw new AnonPiError(`anon-pi: ANON_PI_AGENT_MOUNT must be an ABSOLUTE container path, not \`${raw}\` (it is both the mount target and pi's config dir).`);
+    }
+    return raw;
+}
+/** Resolve the anon-pi home dir (holds the canonical seed + per-session state). */
+export function resolveAnonPiHome(env) {
+    if (env.anonPiHome)
+        return resolve(env.anonPiHome);
+    const base = env.xdgConfigHome && env.xdgConfigHome.trim() !== ''
+        ? env.xdgConfigHome
+        : join(env.home, '.config');
+    return join(base, 'anon-pi');
+}
+/** The canonical seed dir (copied FROM, never mounted). */
+export function resolveConfigSeed(env) {
+    if (env.configSeed)
+        return resolve(env.configSeed);
+    return join(resolveAnonPiHome(env), 'agent');
+}
+/**
+ * Session id = a stable short hash of the ABSOLUTE workdir path, so re-running
+ * anon-pi on the same folder resumes the same session config+state, and moving
+ * the folder starts a new session (documented, accepted).
+ */
+export function sessionId(absWorkdir) {
+    return createHash('sha256').update(absWorkdir).digest('hex').slice(0, 16);
+}
+/** The per-session seeded config dir on the host for a given workdir. */
+export function sessionAgentDir(env, absWorkdir) {
+    return join(resolveAnonPiHome(env), 'sessions', sessionId(absWorkdir), 'agent');
+}
+/**
+ * Build the run plan from the environment + the (optional) workdir arg. PURE: it
+ * resolves paths and composes the netcage argv, and reports whether a seed copy
+ * is needed, but performs NO filesystem writes or spawns. It THROWS AnonPiError
+ * for the two hard preconditions (missing image, missing llm) so the required
+ * inputs fail loud; the missing-SEED check is left to cli.ts (it needs a real
+ * `existsSync`), but `needsSeed` is derived from the injected `seedExists`.
+ */
+export function buildRunPlan(env, workdirArg, seedExists, sessionExists) {
+    if (!env.image || env.image.trim() === '') {
+        throw new AnonPiError('anon-pi: set ANON_PI_IMAGE to a container image that has `pi` on its PATH (e.g. ANON_PI_IMAGE=your/pi-image:tag).');
+    }
+    if (!env.llmDirect || env.llmDirect.trim() === '') {
+        throw new AnonPiError('anon-pi: set ANON_PI_LLM to the RFC1918/link-local IP[:port] of the local model pi should reach directly (e.g. ANON_PI_LLM=192.168.1.150:8080). All other egress stays forced through the proxy.');
+    }
+    const home = env.home;
+    if (!home || home.trim() === '') {
+        throw new AnonPiError('anon-pi: could not resolve HOME.');
+    }
+    const raw = workdirArg && workdirArg.trim() !== '' ? workdirArg : process.cwd();
+    const workdir = isAbsolute(raw) ? raw : resolve(raw);
+    const configSeed = resolveConfigSeed(env);
+    if (!seedExists(configSeed)) {
+        throw new AnonPiError(`anon-pi: canonical config not found at ${configSeed}.\n` +
+            'anon-pi never populates it for you. Create it yourself with the pi config you want\n' +
+            '(anon accounts, chosen models/skills, and a trust.json that trusts /work), e.g.:\n' +
+            `  mkdir -p ${configSeed}\n` +
+            `  cp -a ~/.pi/agent/. ${configSeed}/    # then remove any identity you do not want anonymized\n` +
+            'See the README (Populating the seed) for the trust.json requirement.');
+    }
+    const sessionDir = sessionAgentDir(env, workdir);
+    const needsSeed = !sessionExists(sessionDir);
+    const agentMount = resolveAgentMount(env);
+    const proxy = env.proxy && env.proxy.trim() !== '' ? env.proxy : DEFAULT_PROXY;
+    const netcageArgs = [
+        'run',
+        '--proxy',
+        proxy,
+        '--allow-direct',
+        env.llmDirect,
+        '-it',
+        '-v',
+        workdir, // netcage defaults a target-less -v to /work and cwd to /work
+        '-v',
+        `${sessionDir}:${agentMount}`,
+        '-e',
+        `${PI_AGENT_DIR_ENV}=${agentMount}`,
+        env.image,
+        'pi',
+    ];
+    return {
+        workdir,
+        sessionAgentDir: sessionDir,
+        configSeed,
+        agentMount,
+        needsSeed,
+        netcageArgs,
+    };
+}
+/** Read the AnonPiEnv from a process env map (kept separate so tests inject one). */
+export function envFromProcess(penv) {
+    return {
+        home: penv.HOME ?? homedir(),
+        proxy: penv.ANON_PI_PROXY,
+        anonPiHome: penv.ANON_PI_HOME,
+        configSeed: penv.ANON_PI_CONFIG,
+        image: penv.ANON_PI_IMAGE,
+        llmDirect: penv.ANON_PI_LLM,
+        xdgConfigHome: penv.XDG_CONFIG_HOME,
+        agentMount: penv.ANON_PI_AGENT_MOUNT,
+    };
+}
+/** The --help text (kept here so it is covered by the same module). */
+export const HELP = `anon-pi - launch pi inside a netcage (anonymized egress + one direct local model)
+
+USAGE
+  anon-pi [WORKDIR]
+
+  WORKDIR   the host folder pi works in (mounted at /work). Defaults to the
+            current directory. The session config+state is keyed to this folder.
+
+WHAT IT DOES
+  Seeds a per-workdir writable copy of your canonical anon-pi config into
+  ~/.config/anon-pi/sessions/<hash>/agent, mounts it as pi's global config
+  (${PI_AGENT_DIR_ENV}=<mount>, default ${DEFAULT_CONTAINER_AGENT_DIR}), mounts WORKDIR at
+  ${CONTAINER_WORKDIR}, opens ONE direct hole to your local model, and runs pi with all other
+  egress forced through the socks5h proxy, fail-closed. Requires \`netcage\`.
+
+ENVIRONMENT
+  ANON_PI_IMAGE   (required) image with \`pi\` on PATH
+  ANON_PI_LLM     (required) RFC1918/link-local IP[:port] of the local model
+  ANON_PI_PROXY   socks5h URL (default ${DEFAULT_PROXY})
+  ANON_PI_HOME    anon-pi home (default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi)
+  ANON_PI_CONFIG  canonical seed dir (default <ANON_PI_HOME>/agent)
+  ANON_PI_AGENT_MOUNT  absolute container path for pi's config (default
+                  ${DEFAULT_CONTAINER_AGENT_DIR}; set to your image's ~/.pi/agent, e.g. /root/.pi/agent)
+
+RESEED
+  Reseed is manual: delete the session dir, e.g.
+    rm -rf ~/.config/anon-pi/sessions/<hash>/agent
+  and the next run re-seeds it from the canonical config.
+
+PLATFORM
+  Linux only (via netcage's netns/nft jail). On macOS/Windows it works only
+  inside a Linux VM, where --allow-direct to a LAN model is VM-boundary-sensitive.
+`;
+//# sourceMappingURL=anon-pi.js.map

package/dist/anon-pi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anon-pi.js","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,EAAE;AACF,sCAAsC;AACtC,8EAA8E;AAC9E,iFAAiF;AACjF,yEAAyE;AACzE,+EAA+E;AAC/E,kCAAkC;AAClC,gFAAgF;AAChF,sEAAsE;AACtE,6EAA6E;AAC7E,kFAAkF;AAClF,2EAA2E;AAC3E,kFAAkF;AAClF,yEAAyE;AACzE,kFAAkF;AAClF,iFAAiF;AACjF,gFAAgF;AAEhF,OAAO,EAAC,UAAU,EAAC,MAAM,aAAa,CAAC;AACvC,OAAO,EAAC,OAAO,EAAC,MAAM,SAAS,CAAC;AAChC,OAAO,EAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAC,MAAM,WAAW,CAAC;AAEpD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,eAAe,CAAC;AAE3D,mFAAmF;AACnF,MAAM,CAAC,MAAM,gBAAgB,GAAG,qBAAqB,CAAC;AA4CtD,MAAM,aAAa,GAAG,0BAA0B,CAAC;AAEjD,oFAAoF;AACpF,MAAM,OAAO,WAAY,SAAQ,KAAK;CAAG;AAEzC;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,MAAM,GAAG,GACR,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE;QAC7C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE;QACvB,CAAC,CAAC,2BAA2B,CAAC;IAChC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,WAAW,CACpB,0EAA0E,GAAG,MAAM;YAClF,0EAA0E,CAC3E,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,WAAW,CACpB,0EAA0E,GAAG,uDAAuD,CACpI,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,IAAI,GACT,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE;QACnD,CAAC,CAAC,GAAG,CAAC,aAAa;QACnB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AAC9B,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,iBAAiB,CAAC,GAAc;IAC/C,IAAI,GAAG,CAAC,UAAU;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC;AAC9C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,UAAkB;IACjE,OAAO,IAAI,CACV,iBAAiB,CAAC,GAAG,CAAC,EACtB,UAAU,EACV,SAAS,CAAC,UAAU,CAAC,EACrB,OAAO,CACP,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAC3B,GAAc,EACd,UAA8B,EAC9B,UAAoC,EACpC,aAAuC;IAEvC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC3C,MAAM,IAAI,WAAW,CACpB,mHAAmH,CACnH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,WAAW,CACpB,kMAAkM,CAClM,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC;IACtB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACjC,MAAM,IAAI,WAAW,CAAC,kCAAkC,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,GAAG,GACR,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IACrE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAErD,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,WAAW,CACpB,0CAA0C,UAAU,KAAK;YACxD,sFAAsF;YACtF,oFAAoF;YACpF,cAAc,UAAU,IAAI;YAC5B,yBAAyB,UAAU,8DAA8D;YACjG,sEAAsE,CACvE,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,SAAS,GAAG,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;IAE7C,MAAM,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,KAAK,GACV,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IAElE,MAAM,WAAW,GAAG;QACnB,KAAK;QACL,SAAS;QACT,KAAK;QACL,gBAAgB;QAChB,GAAG,CAAC,SAAS;QACb,KAAK;QACL,IAAI;QACJ,OAAO,EAAE,8DAA8D;QACvE,IAAI;QACJ,GAAG,UAAU,IAAI,UAAU,EAAE;QAC7B,IAAI;QACJ,GAAG,gBAAgB,IAAI,UAAU,EAAE;QACnC,GAAG,CAAC,KAAK;QACT,IAAI;KACJ,CAAC;IAEF,OAAO;QACN,OAAO;QACP,eAAe,EAAE,UAAU;QAC3B,UAAU;QACV,UAAU;QACV,SAAS;QACT,WAAW;KACX,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,cAAc,CAC7B,IAAwC;IAExC,OAAO;QACN,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,OAAO,EAAE;QAC5B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,UAAU,EAAE,IAAI,CAAC,YAAY;QAC7B,UAAU,EAAE,IAAI,CAAC,cAAc;QAC/B,KAAK,EAAE,IAAI,CAAC,aAAa;QACzB,SAAS,EAAE,IAAI,CAAC,WAAW;QAC3B,aAAa,EAAE,IAAI,CAAC,eAAe;QACnC,UAAU,EAAE,IAAI,CAAC,mBAAmB;KACpC,CAAC;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,MAAM,IAAI,GAAG;;;;;;;;;;;KAWf,gBAAgB,qBAAqB,2BAA2B;IACjE,iBAAiB;;;;;;yCAMoB,aAAa;;;;oBAIlC,2BAA2B;;;;;;;;;;CAU9C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":""}

package/dist/cli.js

@@ -0,0 +1,76 @@
+#!/usr/bin/env node
+// anon-pi CLI: resolve the run plan (pure), do the one filesystem side-effect
+// (seed the session config if absent), then exec `netcage run ...` with inherited
+// stdio so the interactive pi session (-it) passes through the terminal cleanly.
+import { cpSync, existsSync, mkdirSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { dirname } from 'node:path';
+import { AnonPiError, buildRunPlan, envFromProcess, HELP } from './anon-pi.js';
+function main(argv) {
+    const args = argv.slice(2);
+    if (args.includes('--help') || args.includes('-h')) {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    // The only positional is the optional workdir. Reject stray flags so a typo
+    // (e.g. --allow-direct) is not silently swallowed: anon-pi owns the netcage
+    // argv, extra flags are not passed through.
+    const positionals = args.filter((a) => !a.startsWith('-'));
+    const flags = args.filter((a) => a.startsWith('-'));
+    if (flags.length > 0) {
+        process.stderr.write(`anon-pi: unknown option(s): ${flags.join(' ')}\nRun \`anon-pi --help\`.\n`);
+        return 2;
+    }
+    if (positionals.length > 1) {
+        process.stderr.write('anon-pi: too many arguments (expected at most one WORKDIR).\nRun `anon-pi --help`.\n');
+        return 2;
+    }
+    const env = envFromProcess(process.env);
+    let plan;
+    try {
+        plan = buildRunPlan(env, positionals[0], existsSync, existsSync);
+    }
+    catch (e) {
+        if (e instanceof AnonPiError) {
+            process.stderr.write(e.message + '\n');
+            return 1;
+        }
+        throw e;
+    }
+    // Fail loud if netcage is not installed, before we mutate anything.
+    if (!hasNetcage()) {
+        process.stderr.write('anon-pi: `netcage` not found on PATH. anon-pi is a launcher for netcage; install it first\n' +
+            '(https://github.com/wighawag/netcage). Linux only.\n');
+        return 1;
+    }
+    // The one side-effect: seed the per-session config from the canonical seed the
+    // FIRST time this workdir is used. Reuse-if-present, seed-if-absent.
+    if (plan.needsSeed) {
+        mkdirSync(dirname(plan.sessionAgentDir), { recursive: true });
+        cpSync(plan.configSeed, plan.sessionAgentDir, { recursive: true });
+        process.stderr.write(`anon-pi: seeded session config -> ${plan.sessionAgentDir}\n`);
+    }
+    // Ensure the workdir exists (a fresh named folder is fine).
+    mkdirSync(plan.workdir, { recursive: true });
+    // Hand off to netcage with inherited stdio so -it is a real interactive TTY.
+    const res = spawnSync('netcage', plan.netcageArgs, { stdio: 'inherit' });
+    if (res.error) {
+        process.stderr.write(`anon-pi: failed to run netcage: ${res.error.message}\n`);
+        return 1;
+    }
+    // Propagate netcage's exit code (which itself propagates the tool's).
+    return res.status ?? 1;
+}
+function hasNetcage() {
+    const which = spawnSync(process.platform === 'win32' ? 'where' : 'command', ['-v', 'netcage'], {
+        stdio: 'ignore',
+        shell: process.platform !== 'win32',
+    });
+    if (which.status === 0)
+        return true;
+    // Fallback: try running it harmlessly.
+    const probe = spawnSync('netcage', ['--help'], { stdio: 'ignore' });
+    return !probe.error;
+}
+process.exit(main(process.argv));
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,8EAA8E;AAC9E,kFAAkF;AAClF,iFAAiF;AAEjF,OAAO,EAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAC,MAAM,SAAS,CAAC;AACtD,OAAO,EAAC,SAAS,EAAC,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAC,OAAO,EAAC,MAAM,WAAW,CAAC;AAClC,OAAO,EAAC,WAAW,EAAE,YAAY,EAAE,cAAc,EAAE,IAAI,EAAC,MAAM,cAAc,CAAC;AAE7E,SAAS,IAAI,CAAC,IAAc;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,CAAC,CAAC;IACV,CAAC;IAED,4EAA4E;IAC5E,4EAA4E;IAC5E,4CAA4C;IAC5C,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,+BAA+B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,6BAA6B,CAC3E,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,sFAAsF,CACtF,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACJ,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;IAClE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACZ,IAAI,CAAC,YAAY,WAAW,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;YACvC,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,CAAC,CAAC;IACT,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,UAAU,EAAE,EAAE,CAAC;QACnB,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,6FAA6F;YAC5F,sDAAsD,CACvD,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IAED,+EAA+E;IAC/E,qEAAqE;IACrE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;QACjE,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,qCAAqC,IAAI,CAAC,eAAe,IAAI,CAC7D,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAC,SAAS,EAAE,IAAI,EAAC,CAAC,CAAC;IAE3C,6EAA6E;IAC7E,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,EAAE,EAAC,KAAK,EAAE,SAAS,EAAC,CAAC,CAAC;IACvE,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,mCAAmC,GAAG,CAAC,KAAK,CAAC,OAAO,IAAI,CACxD,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;IACD,sEAAsE;IACtE,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,SAAS,UAAU;IAClB,MAAM,KAAK,GAAG,SAAS,CACtB,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAClD,CAAC,IAAI,EAAE,SAAS,CAAC,EACjB;QACC,KAAK,EAAE,QAAQ;QACf,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;KACnC,CACD,CAAC;IACF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,uCAAuC;IACvC,MAAM,KAAK,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAC,KAAK,EAAE,QAAQ,EAAC,CAAC,CAAC;IAClE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;AACrB,CAAC;AAED,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './anon-pi.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,cAAc,CAAC"}

package/dist/index.js

@@ -0,0 +1,4 @@
+// Programmatic entry: the pure planning logic is reusable/testable. The CLI is
+// dist/cli.js (the `anon-pi` bin); this index is the library surface.
+export * from './anon-pi.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,sEAAsE;AACtE,cAAc,cAAc,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "anon-pi",
+  "version": "0.1.0",
+  "description": "Launch pi inside a netcage: anonymized web egress through a socks5h proxy, one direct hole for a local model, seeded pi config on the host.",
+  "license": "AGPL-3.0-only",
+  "keywords": [
+    "pi",
+    "netcage",
+    "anonymity",
+    "socks5h",
+    "tor",
+    "proxy",
+    "privacy",
+    "cli",
+    "agent"
+  ],
+  "homepage": "https://github.com/wighawag/anon-pi#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wighawag/anon-pi.git",
+    "directory": "packages/anon-pi"
+  },
+  "bugs": {
+    "url": "https://github.com/wighawag/anon-pi/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "bin": {
+    "anon-pi": "./dist/cli.js"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "src",
+    "LICENSE",
+    "Dockerfile.pi"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {},
+  "devDependencies": {
+    "@types/node": "^25.2.0",
+    "as-soon": "^0.1.5",
+    "tsx": "^4.21.0",
+    "typescript": "^5.3.3",
+    "vitest": "^4.0.18"
+  },
+  "scripts": {
+    "build": "tsc",
+    "dev": "as-soon -w src pnpm build",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  }
+}