anon-pi 0.2.0 → 0.4.0

package/Dockerfile.pi

@@ -1,14 +1,19 @@
 # A minimal image with `pi` (the Earendil Works coding agent) on PATH, for use as
-# anon-pi's ANON_PI_IMAGE. It follows the official upstream containerization
-# pattern (earendil-works/pi, packages/coding-agent/docs/containerization.md):
-# node:24-bookworm-slim + the official `@earendil-works/pi-coding-agent` npm
-# package, plus the handful of tools pi's built-in bash/grep/find expect.
+# anon-pi's ANON_PI_IMAGE. node:24-bookworm-slim + the official
+# `@earendil-works/pi-coding-agent` npm package + the tools pi's built-in
+# bash/grep/find expect.
 #
-# Note: unlike the upstream `Dockerfile.pi`, this image sets NO ENTRYPOINT and
-# NO config volume. anon-pi passes `pi` as the run command and copies just its
-# models.json into this image's ~/.pi/agent at start, so the image just needs
-# `pi` reachable on PATH. Anything else you want in the anon session (extensions,
-# skills, and their services) belongs HERE, in the image.
+# HOW anon-pi USES THIS IMAGE (stateful model):
+#   anon-pi mounts a PERSISTENT per-workdir host dir at the container's
+#   ~/.pi/agent, so pi's sessions/history/settings and any extensions you
+#   `pi install` persist across launches. On a FRESH home, anon-pi seeds it once
+#   from this image's STAGING dir (/opt/anon-pi-seed/agent) + your imported
+#   models.json, then stamps a marker and never overwrites again.
+#
+#   So image defaults (extensions, trust.json) go in the STAGING dir, NOT in
+#   ~/.pi/agent (which is the mount and would be shadowed). Set
+#   PI_CODING_AGENT_DIR to the staging dir while running `pi install` so the
+#   extension is recorded there.
 #
 # Build (pin a digest for reproducibility once pushed to a registry):
 #   podman build -t localhost/anon-pi-pi:latest -f Dockerfile.pi .
@@ -22,20 +27,25 @@ RUN apt-get update \
 # The official pi coding agent CLI (puts `pi` on PATH).
 RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 
+# The staging dir anon-pi promotes into a fresh home on first launch.
+ENV ANON_PI_STAGE=/opt/anon-pi-seed/agent
+RUN mkdir -p "$ANON_PI_STAGE"
+
+# Trust /work so pi does not prompt on the mounted project (staged, so it lands
+# in the persistent home on first launch; anon-pi never writes this for you).
+RUN printf '{"/work": true}\n' > "$ANON_PI_STAGE/trust.json"
+
 # --- Optional: extensions + skills (the capability layer) -------------------
-# Install extensions with `pi install` (it records them in settings), NOT a
-# global npm install. Uncomment what you want in the anon persona:
+# Install into the STAGING dir (PI_CODING_AGENT_DIR), so `pi install` records the
+# extension there and anon-pi promotes it into the persistent home on first
+# launch. After that you can `pi install` more from inside the session and it
+# persists. Uncomment what you want in the anon persona:
 #
-#   RUN pi install npm:pi-subagents
-#   RUN pi install npm:pi-plan-mode
+#   RUN PI_CODING_AGENT_DIR="$ANON_PI_STAGE" pi install npm:pi-subagents
+#   RUN PI_CODING_AGENT_DIR="$ANON_PI_STAGE" pi install npm:pi-plan-mode
 #
 # An extension that needs a running SERVICE (e.g. pi-webveil + a local SearXNG)
 # installs and configures that service in the image too. See the worked example
-# examples/Dockerfile.pi-webveil (SearXNG over a Unix socket, started by an
-# entrypoint that then execs anon-pi's command).
-#
-# Trust /work up front so pi does not prompt on every run (anon-pi never writes
-# this for you):
-#   RUN mkdir -p /root/.pi/agent && printf '{"/work": true}\n' > /root/.pi/agent/trust.json
+# examples/Dockerfile.pi-webveil.
 
 WORKDIR /work

package/README.md

@@ -45,18 +45,37 @@ You land in pi, inside the jail, cwd `/work` = `./recon`. pi's web/tool egress i
 | --- | --- | --- | --- |
 | `ANON_PI_IMAGE` | for run | | container image with `pi` on `PATH` |
 | `ANON_PI_LLM` | yes | | RFC1918/link-local `IP[:port]` of the local model (the one direct hole) |
-| `ANON_PI_PROXY` | no | `socks5h://127.0.0.1:9050` | the socks5h proxy |
+| `ANON_PI_PROXY` | yes | | the socks5h proxy (Tor/wireproxy/ssh -D). No default: it is what anonymizes |
+| `ANON_PI_EPHEMERAL` | no | (off) | set to `1` for a throwaway, non-persistent session |
 | `ANON_PI_HOME` | no | `$XDG_CONFIG_HOME/anon-pi` or `~/.config/anon-pi` | anon-pi home |
-| `ANON_PI_CONFIG` | no | `<ANON_PI_HOME>/agent` | the seed dir (holds `models.json`) |
+| `ANON_PI_CONFIG` | no | `<ANON_PI_HOME>/agent` | canonical seed dir (holds the imported `models.json`) |
 | `ANON_PI_SOURCE_MODELS` | no | `~/.pi/agent/models.json` | (`import`) the host `models.json` to read from |
 
 ## How it works
 
-1. **Seed = just `models.json`.** `anon-pi import` writes one file, `<ANON_PI_CONFIG>/models.json`, containing only the provider that serves your local model (see [Generating the seed](#generating-the-seed-anon-pi-import)). No auth for other providers, no sessions, no identity.
-2. **Mount read-only + copy in.** anon-pi mounts the seed read-only at `/anon-pi-seed` and, at start, **copies** `models.json` into the container's own `~/.pi/agent`. It does **not** mount over pi's config dir, so anything the image installed there (pi itself, extensions, skills) survives; the copy just adds your local model to it.
-3. **Run.** anon-pi execs `netcage run --proxy <proxy> --allow-direct <ANON_PI_LLM> -it -v <workdir> -v <seed>:/anon-pi-seed:ro <image> sh -c 'cp /anon-pi-seed/models.json ~/.pi/agent/ && exec pi'`.
+**Stateful by default.** anon-pi mounts a persistent per-workdir host dir at the container's `~/.pi/agent`, so pi's **sessions, history, settings (your model choice), and any extensions you `pi install`** all persist across launches. Re-running in the same folder resumes it. The state dir is `<ANON_PI_HOME>/state/<workdir>/agent`, named with pi's own readable path convention (e.g. `--home-me-proj--`), not a hash, so you can see which folder it belongs to and delete it to reset.
 
-pi has no default model set in the seed, so on start it auto-selects the first available model, your local one (it needs no real API key). Everything that runs, and everything that identifies you, lives in the **image**, not the seed (see below).
+1. **Mount the persistent home.** `-v <ANON_PI_HOME>/state/<workdir>/agent:/root/.pi/agent`. Everything pi writes there survives.
+2. **First-launch seed (only when the home is fresh).** anon-pi mounts the image's staged defaults and your imported `models.json`, and the container promotes them into the fresh home, then stamps a `.anon-pi-seed` marker. On later launches the marker is present, so nothing is re-copied and **your changes (added models, installed extensions) are never clobbered**.
+3. **Run.** `netcage run --proxy <proxy> --allow-direct <ANON_PI_LLM> -it -v <workdir> -v <state>:/root/.pi/agent [-v <models.json>:...:ro] <image> sh -c '<seed-if-fresh> && exec pi'`.
+
+pi auto-selects the first available model (your local one; it needs no real API key), so no default needs to be set. Services and default extensions live in the **image**; your state lives in the persistent home.
+
+### Ephemeral (throwaway) sessions
+
+For a clean, no-local-trace session, pass `--ephemeral` (or `ANON_PI_EPHEMERAL=1`): anon-pi mounts **no writable state** at all. pi writes to the container's own filesystem, which netcage runs with `--rm`, so it is destroyed when the container exits. Nothing writable ever touches a host path (only the read-only `models.json` seed is mounted), there is no cleanup step, and nothing is left behind even if anon-pi is killed.
+
+```sh
+anon-pi --ephemeral ./scratch
+```
+
+### Reset a session
+
+Delete its state home; the next launch re-seeds:
+
+```sh
+rm -rf ~/.config/anon-pi/state/<workdir-slug>/agent
+```
 
 ## Providing a pi image
 
@@ -95,30 +114,30 @@ RUN npm install -g --ignore-scripts @earendil-works/pi-coding-agent
 WORKDIR /work
 ```
 
-Because anon-pi copies `models.json` **into** the image's own `~/.pi/agent` rather than replacing it, extensions installed in the image stay active in the anon session.
+Install image defaults into the **staging dir** (`PI_CODING_AGENT_DIR=/opt/anon-pi-seed/agent pi install ...`), NOT `~/.pi/agent`: anon-pi mounts a persistent home over `~/.pi/agent`, and promotes the staging dir into it on a fresh launch. Anything you then `pi install` *inside* a session also persists (it is written to the mounted home). See the `Dockerfile.pi` comments for the exact `pi install` form.
 
-A worked example ships in this package: [`examples/Dockerfile.pi-webveil`](examples/Dockerfile.pi-webveil) builds pi + the `pi-webveil` extension + a local SearXNG (over a Unix socket, `http-socket` so webveil's `unix:` baseUrl can speak HTTP to it, JSON API on, limiter off), started by an entrypoint that then execs anon-pi's command. Note the anonymity subtlety it documents: SearXNG's own crawl is anonymized here **because netcage forces every process's egress through the proxy**, so webveil's plain `egress: direct` is correct in-jail (the usual "local SearXNG leaks your IP" caveat does not apply).
+A worked example ships in this package: [`examples/Dockerfile.pi-webveil`](examples/Dockerfile.pi-webveil) builds pi + the `pi-webveil` extension (staged) + a local SearXNG (over a Unix socket, `http-socket` so webveil's `unix:` baseUrl can speak HTTP to it, JSON API on, limiter off), started by an entrypoint that then execs anon-pi's seed-then-pi command. Note the anonymity subtlety it documents: SearXNG's own crawl is anonymized here **because netcage forces every process's egress through the proxy**, so webveil's plain `egress: direct` is correct in-jail (the usual "local SearXNG leaks your IP" caveat does not apply).
 
 ## Generating the seed (`anon-pi import`)
 
-anon-pi **never** copies your real pi config. Instead, `anon-pi import` synthesizes a minimal seed from your local model:
+anon-pi **never** copies your real pi config. Instead, `anon-pi import` synthesizes a minimal `models.json` from your local model:
 
 ```sh
 export ANON_PI_LLM=192.168.1.150:8080
 anon-pi import
 ```
 
-It reads your host `~/.pi/agent/models.json` (override with `ANON_PI_SOURCE_MODELS`), finds the provider whose `baseUrl` serves `ANON_PI_LLM` (matched on host:port, so `192.168.1.150:8080` matches `http://192.168.1.150:8080/v1`), and writes **just that provider** to `<ANON_PI_CONFIG>/models.json`. Everything else, your paid providers and their API keys, your sessions, your trust list, your extensions, is left behind on the host.
+It reads your host `~/.pi/agent/models.json` (override with `ANON_PI_SOURCE_MODELS`), finds the provider whose `baseUrl` serves `ANON_PI_LLM` (matched on host:port, so `192.168.1.150:8080` matches `http://192.168.1.150:8080/v1`), and writes **just that provider** to `<ANON_PI_CONFIG>/models.json`. Everything else, your paid providers and their API keys, your sessions, your trust list, is left behind on the host.
+
+That file **seeds a fresh session home** (it is copied in on first launch). Models you later add *inside* pi persist in the session home and are never clobbered by import. To change what a fresh home seeds, re-run `anon-pi import --force`; to apply it to an existing session, reset that session (delete its state home).
 
 - If no provider matches `ANON_PI_LLM`, it errors and lists the providers it did find.
 - If the matched provider carries a real-looking `apiKey` (not `none`/`ollama`/empty), it warns but proceeds (for a local model this is usually fine).
-- It refuses to overwrite an existing seed unless you pass `--force`.
-
-To reseed (e.g. after changing your local model), re-run `anon-pi import --force`.
+- It refuses to overwrite the canonical seed unless you pass `--force`.
 
 ## Trusting `/work`
 
-pi treats a mounted project as untrusted until approved. For a smooth start, have the **image** trust `/work` (bake a `trust.json` mapping `/work` to `true` into the image's `~/.pi/agent`), or approve once inside a session. anon-pi does not synthesize pi's `trust.json`; it belongs in the image, alongside the extensions.
+pi treats a mounted project as untrusted until approved. The shipped Dockerfiles stage a `trust.json` trusting `/work` (in `/opt/anon-pi-seed/agent`), which is promoted into the session home on first launch, so you are not prompted. You can also approve once inside a session; it persists.
 
 ## Overriding the config per workdir
 

package/dist/anon-pi.d.ts

@@ -1,28 +1,48 @@
 /** The container path the workdir is mounted at (pi's cwd). */
 export declare const CONTAINER_WORKDIR = "/work";
 /**
- * Where the seed (just models.json) is mounted read-only in the container. The
- * run command copies models.json FROM here INTO the container's own
- * ~/.pi/agent, so it LAYERS onto the image's config (extensions/skills the image
- * installed survive) instead of replacing it. This is why we mount+copy rather
- * than mount-as-agent-dir: mounting over ~/.pi/agent would shadow the image's
- * extensions.
+ * The container path pi uses as its config+state home. anon-pi mounts a
+ * PERSISTENT host dir here (Model B), so everything pi writes, sessions,
+ * history, settings (your model choice), `pi install`ed extensions, downloaded
+ * bin/fd, survives across launches. Statefulness is the default; --ephemeral
+ * mounts a throwaway dir here instead.
  */
-export declare const CONTAINER_SEED_DIR = "/anon-pi-seed";
+export declare const CONTAINER_AGENT_DIR = "/root/.pi/agent";
 /**
- * The container command: copy the seeded models.json into pi's own config dir
- * (creating it if absent), then exec pi. `$HOME/.pi/agent` is pi's default
- * config dir when PI_CODING_AGENT_DIR is unset, i.e. exactly where the image
- * installed pi + any extensions, so the copy augments rather than shadows.
+ * Where the image STAGES its first-launch defaults (extensions + trust.json).
+ * NOT the agent dir, so it never conflicts with the persistent mount. The
+ * entrypoint promotes these into the mounted agent dir only when the home is
+ * FRESH (Model C seed-if-fresh).
  */
-export declare const CONTAINER_RUN_CMD: string;
-/** The single file the seed carries: pi's model/provider registry. */
+export declare const CONTAINER_STAGE_DIR = "/opt/anon-pi-seed/agent";
+/**
+ * Where anon-pi mounts the canonical models.json (from `import`) read-only, so
+ * the first-launch seed can copy it into the fresh home alongside the image's
+ * staged defaults. Read-only: the container never writes back to the host seed.
+ */
+export declare const CONTAINER_MODELS_SEED = "/anon-pi-seed/models.json";
+/** Marker file written into the agent dir after seeding; holds the seed version. */
+export declare const SEED_MARKER = ".anon-pi-seed";
+/** The single file the host-side seed carries: pi's model/provider registry. */
 export declare const MODELS_FILE = "models.json";
+/**
+ * containerRunCmd builds the container command: on a FRESH home (no seed
+ * marker), promote the image's staged defaults + the mounted models.json into
+ * the persistent agent dir and stamp the marker; then exec pi. On a seeded home
+ * it does nothing but exec pi, so pi's persisted state (incl. anything you
+ * `pi install`ed or models pi added) is used as-is and NEVER clobbered.
+ *
+ * seedVersion is written into the marker so a future image can re-seed changed
+ * defaults on a version bump; v1 only seeds when the marker is absent.
+ */
+export declare function containerRunCmd(seedVersion: string): string;
+/** The seed version anon-pi stamps when it seeds a fresh home (bump to re-seed). */
+export declare const SEED_VERSION = "1";
 /** Inputs resolved from the environment + argv, injected so this stays pure. */
 export interface AnonPiEnv {
     /** $HOME (or an override) used to derive default paths. */
     home: string;
-    /** socks5h proxy URL. Default socks5h://127.0.0.1:9050. */
+    /** socks5h proxy URL. REQUIRED (no default: the proxy is what anonymizes). */
     proxy?: string;
     /** The anon-pi home dir. Default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi. */
     anonPiHome?: string;
@@ -41,17 +61,34 @@ export interface AnonPiEnv {
      * `Dockerfile.pi`.
      */
     dockerfilePath?: string;
+    /**
+     * Absolute path to the shipped examples/Dockerfile.pi-webveil (pi + pi-webveil
+     * + SearXNG), used to make the missing-image error mention the fuller build.
+     */
+    webveilDockerfilePath?: string;
     /** `import` source models.json override (ANON_PI_SOURCE_MODELS). */
     sourceModels?: string;
     /** The host pi agent dir override (PI_CODING_AGENT_DIR), used to find models.json. */
     piAgentDir?: string;
+    /** When true, use a throwaway state home (no persistence). Default false. */
+    ephemeral?: boolean;
+    /** The seed version anon-pi stamps into a fresh home. Default SEED_VERSION. */
+    seedVersion?: string;
 }
 /** The fully-resolved run plan cli.ts executes. */
 export interface RunPlan {
     /** Absolute workdir on the host (mounted at /work). */
     workdir: string;
-    /** The seed dir on the host (holds models.json), mounted read-only at /anon-pi-seed. */
+    /**
+     * The PERSISTENT per-workdir state dir on the host, mounted at the container's
+     * ~/.pi/agent. Everything pi writes here survives. For --ephemeral this is a
+     * throwaway path cli.ts creates + discards.
+     */
+    stateDir: string;
+    /** The canonical host models.json (from `import`) mounted read-only for the seed, or '' if absent. */
     configSeed: string;
+    /** True when this workdir has no state yet (fresh home; the seed will run). */
+    fresh: boolean;
     /** The argv passed to `netcage` (after the `netcage` program name). */
     netcageArgs: string[];
 }
@@ -60,8 +97,25 @@ export declare class AnonPiError extends Error {
 }
 /** Resolve the anon-pi home dir (holds the seed). */
 export declare function resolveAnonPiHome(env: AnonPiEnv): string;
-/** The seed dir (holds models.json), mounted read-only into the container. */
+/**
+ * The CANONICAL host seed dir holding models.json (written by `anon-pi import`).
+ * Mounted read-only so the first-launch seed can copy models.json into a fresh
+ * persistent home. Workdir-independent (import does not need a workdir).
+ */
 export declare function resolveConfigSeed(env: AnonPiEnv): string;
+/**
+ * Encode an absolute path into a directory name using pi's OWN convention (see
+ * pi coding-agent session-manager: `--${cwd without leading slash, / \ : -> -}--`),
+ * so an anon-pi state dir is readable and matches pi's mental model (no opaque
+ * hash). e.g. /home/u/dev/x -> --home-u-dev-x--
+ */
+export declare function pathSlug(absPath: string): string;
+/**
+ * The persistent per-workdir state dir on the host (mounted at the container's
+ * ~/.pi/agent). Keyed by the workdir via pi's path-slug convention:
+ *   <anonPiHome>/state/<slug>/agent
+ */
+export declare function stateAgentDir(env: AnonPiEnv, absWorkdir: string): string;
 /**
  * Normalise a proxy-less host:port key from an ANON_PI_LLM value or a provider
  * baseUrl, so `192.168.1.150:8080` matches `http://192.168.1.150:8080/v1`.
@@ -110,15 +164,25 @@ export declare function resolveSourceModelsPath(env: AnonPiEnv): string;
 /**
  * Build the run plan from the environment + the (optional) workdir arg. PURE: it
  * resolves paths and composes the netcage argv, performing NO filesystem writes
- * or spawns. It THROWS AnonPiError for the hard preconditions (missing image,
- * missing llm, missing seed models.json) so the required inputs fail loud.
+ * or spawns. It THROWS AnonPiError for the required inputs (image, llm, proxy).
  *
- * The seed (models.json) is mounted READ-ONLY at /anon-pi-seed and copied into
- * the container's own ~/.pi/agent by the run command, so it LAYERS onto the
- * image's config (image-installed extensions/skills survive) rather than
- * shadowing it.
+ * Statefulness (Model B): a persistent per-workdir host dir is mounted at the
+ * container's ~/.pi/agent, so pi's sessions/history/settings/extensions persist.
+ * First-launch seed (Model C): when that home is FRESH, the container run
+ * command promotes the image's staged defaults + the imported models.json into
+ * it and stamps a marker; thereafter pi OWNS the home and nothing is clobbered.
+ *
+ * `modelsSeedExists` reports whether the canonical import models.json exists (so
+ * it is mounted for the seed); `stateExists` reports whether this workdir's
+ * state home already exists (so `fresh` is known).
+ *
+ * --ephemeral mounts NO writable state: pi writes to the container's own
+ * filesystem, which netcage runs with `--rm`, so it is destroyed when the
+ * container exits. Nothing writable ever touches a host path; there is no
+ * cleanup and no leftover-on-crash. (The read-only models.json seed is still
+ * mounted; it is a single file anon-pi never writes to.)
  */
-export declare function buildRunPlan(env: AnonPiEnv, workdirArg: string | undefined, seedModelsExists: (modelsJsonPath: string) => boolean): RunPlan;
+export declare function buildRunPlan(env: AnonPiEnv, workdirArg: string | undefined, modelsSeedExists: (modelsJsonPath: string) => boolean, stateExists: (stateDir: string) => boolean): RunPlan;
 /**
  * Absolute path to the Dockerfile.pi that ships with anon-pi, resolved from this
  * module's location (package root, one level up from dist/anon-pi.js), or
@@ -126,8 +190,13 @@ export declare function buildRunPlan(env: AnonPiEnv, workdirArg: string | undefi
  * build command concrete.
  */
 export declare function shippedDockerfilePath(): string | undefined;
+/**
+ * Absolute path to the fuller pi-webveil + SearXNG example that ships with
+ * anon-pi (examples/Dockerfile.pi-webveil), or undefined if not found.
+ */
+export declare function shippedWebveilDockerfilePath(): string | undefined;
 /** Read the AnonPiEnv from a process env map (kept separate so tests inject one). */
 export declare function envFromProcess(penv: Record<string, string | undefined>): AnonPiEnv;
 /** The --help text (kept here so it is covered by the same module). */
-export declare const HELP = "anon-pi - launch pi inside a netcage (anonymized egress + one direct local model)\n\nUSAGE\n  anon-pi [WORKDIR]     launch pi jailed, working in WORKDIR (default: cwd)\n  anon-pi import        write the seed models.json from your local model\n\n  WORKDIR   the host folder pi works in (mounted at /work; pi's cwd). Files pi\n            writes there land on the host.\n\nWHAT IT DOES\n  Runs pi inside netcage with all web/DNS egress forced through the socks5h\n  proxy (fail-closed) and ONE direct hole to your local model (ANON_PI_LLM).\n  The seed models.json is mounted read-only and COPIED into the container's own\n  ~/.pi/agent at start, so it layers onto the image's config: extensions and\n  skills you baked into the image survive. Requires `netcage`.\n\nimport\n  Reads your host ~/.pi/agent/models.json, picks the provider whose baseUrl\n  serves ANON_PI_LLM, and writes JUST that provider to the seed\n  (<ANON_PI_CONFIG>/models.json). No other provider's API keys, no sessions, no\n  identity. Re-run with --force to overwrite an existing seed.\n\nENVIRONMENT\n  ANON_PI_IMAGE   (required for run) image with `pi` on PATH. No image yet?\n                  Running anon-pi without it prints a ready-to-build\n                  Dockerfile.pi recipe; see the README (Providing a pi image).\n  ANON_PI_LLM     (required) RFC1918/link-local IP[:port] of the local model\n  ANON_PI_PROXY   socks5h URL (default socks5h://127.0.0.1:9050)\n  ANON_PI_HOME    anon-pi home (default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi)\n  ANON_PI_CONFIG  seed dir holding models.json (default <ANON_PI_HOME>/agent)\n  ANON_PI_SOURCE_MODELS  (import) host models.json to read (default ~/.pi/agent/models.json)\n\nRESEED\n  anon-pi import --force  regenerates the seed models.json.\n\nPLATFORM\n  Linux only (via netcage's netns/nft jail). On macOS/Windows it works only\n  inside a Linux VM, where --allow-direct to a LAN model is VM-boundary-sensitive.\n";
+export declare const HELP = "anon-pi - launch pi inside a netcage (anonymized egress + one direct local model)\n\nUSAGE\n  anon-pi [WORKDIR]     launch pi jailed, working in WORKDIR (default: cwd)\n  anon-pi import        seed models.json from your local model\n\n  WORKDIR   the host folder pi works in (mounted at /work; pi's cwd). Files pi\n            writes there land on the host.\n\nWHAT IT DOES\n  Runs pi inside netcage with all web/DNS egress forced through the socks5h\n  proxy (fail-closed) and ONE direct hole to your local model (ANON_PI_LLM).\n\n  STATEFUL by default: a persistent per-workdir home\n  (<ANON_PI_HOME>/state/<workdir>/agent) is mounted at the container's\n  ~/.pi/agent, so your conversations, history, settings (model choice), and any\n  extensions you `pi install` persist across launches. Re-running in the same\n  folder resumes it. On a FRESH home, the image's staged defaults (extensions,\n  trust) and your imported models.json are seeded in once; after that pi owns the\n  home and nothing is overwritten. Requires `netcage`.\n\n  --ephemeral (or ANON_PI_EPHEMERAL=1): mount NO writable state; pi writes to the\n  container's own --rm layer, gone on exit. Nothing writable touches the host,\n  no cleanup, no leftover-on-crash.\n\n  --fresh: delete this workdir's persistent state home first, so the (possibly\n  rebuilt) image's defaults + your imported models.json are re-seeded. Use it\n  after rebuilding your image to pick up new extensions/config.\n\nimport\n  Reads your host ~/.pi/agent/models.json, picks the provider whose baseUrl\n  serves ANON_PI_LLM, and writes JUST that provider to the canonical seed\n  (<ANON_PI_CONFIG>/models.json). No other provider's API keys, no sessions, no\n  identity. It SEEDS a fresh home; models you later add inside pi persist and are\n  never clobbered. Re-run with --force to overwrite the canonical seed.\n\nENVIRONMENT\n  ANON_PI_IMAGE   (required for run) image with `pi` on PATH. No image yet?\n                  Running anon-pi without it prints a ready-to-build\n                  Dockerfile.pi recipe; see the README (Providing a pi image).\n  ANON_PI_LLM     (required) RFC1918/link-local IP[:port] of the local model\n  ANON_PI_PROXY   (required) socks5h URL of your proxy (Tor/wireproxy/ssh -D).\n                  No default: the proxy is what anonymizes, so it is never guessed.\n  ANON_PI_EPHEMERAL  set to 1 for a throwaway (non-persistent) session\n  ANON_PI_HOME    anon-pi home (default $XDG_CONFIG_HOME/anon-pi or ~/.config/anon-pi)\n  ANON_PI_CONFIG  canonical seed dir holding models.json (default <ANON_PI_HOME>/agent)\n  ANON_PI_SOURCE_MODELS  (import) host models.json to read (default ~/.pi/agent/models.json)\n\nRESET A SESSION\n  anon-pi --fresh [WORKDIR]   drop the session home and re-seed on this launch.\n  Or delete it by hand: rm -rf <ANON_PI_HOME>/state/<workdir-slug>/agent\n\nPLATFORM\n  Linux only (via netcage's netns/nft jail). On macOS/Windows it works only\n  inside a Linux VM, where --allow-direct to a LAN model is VM-boundary-sensitive.\n";
 //# sourceMappingURL=anon-pi.d.ts.map

package/dist/anon-pi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"anon-pi.d.ts","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAyBA,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,kBAAkB,CAAC;AAElD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,QAGpB,CAAC;AAEX,sEAAsE;AACtE,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACvB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,wFAAwF;IACxF,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAID,oFAAoF;AACpF,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAOxD;AAED,8EAA8E;AAC9E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAGxD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC5B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,eAAe,EAAE,OAAO,CAAC;CACzB;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CACjC,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,MAAM,GACf,YAAY,CAkCd;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAS9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAC3B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,GACnD,OAAO,CA+ET;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAc1D;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,SAAS,CAaX;AAED,uEAAuE;AACvE,eAAO,MAAM,IAAI,o6DAsChB,CAAC"}
+{"version":3,"file":"anon-pi.d.ts","sourceRoot":"","sources":["../src/anon-pi.ts"],"names":[],"mappings":"AAyBA,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAEzC;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,4BAA4B,CAAC;AAE7D;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AAEjE,oFAAoF;AACpF,eAAO,MAAM,WAAW,kBAAkB,CAAC;AAE3C,gFAAgF;AAChF,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAc3D;AAED,oFAAoF;AACpF,eAAO,MAAM,YAAY,MAAM,CAAC;AAEhC,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACzB,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mFAAmF;IACnF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sFAAsF;IACtF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,mDAAmD;AACnD,MAAM,WAAW,OAAO;IACvB,uDAAuD;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IACjB,sGAAsG;IACtG,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAC;IACf,uEAAuE;IACvE,WAAW,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,oFAAoF;AACpF,qBAAa,WAAY,SAAQ,KAAK;CAAG;AAEzC,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAOxD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAGxD;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED;;;GAGG;AACH,MAAM,WAAW,UAAU;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;IACnB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrB;AAED,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACrB;AAED,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC5B,iDAAiD;IACjD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,MAAM,EAAE,YAAY,CAAC;IACrB,6EAA6E;IAC7E,eAAe,EAAE,OAAO,CAAC;CACzB;AAKD;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CACjC,UAAU,EAAE,YAAY,EACxB,SAAS,EAAE,MAAM,GACf,YAAY,CAkCd;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAS9D;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAC3B,GAAG,EAAE,SAAS,EACd,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,gBAAgB,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,EACrD,WAAW,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,GACxC,OAAO,CAoHT;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,SAAS,CAE1D;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,IAAI,MAAM,GAAG,SAAS,CAEjE;AAmBD,qFAAqF;AACrF,wBAAgB,cAAc,CAC7B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,SAAS,CAeX;AASD,uEAAuE;AACvE,eAAO,MAAM,IAAI,o+FAuDhB,CAAC"}