bulkhead-runtime 0.1.0

package/dist/sandbox/rootfs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rootfs.js","sourceRoot":"","sources":["../../src/sandbox/rootfs.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAgB9B,MAAM,qBAAqB,GAAG;IAC5B,MAAM;IACN,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,mBAAmB;IACnB,UAAU;IACV,sBAAsB;IACtB,kBAAkB;IAClB,YAAY;IACZ,oBAAoB;IACpB,aAAa;IACb,YAAY;CACb,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,OAAsB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CACvB,EAAE,CAAC,MAAM,EAAE,EACX,iBAAiB,EACjB,OAAO,CAAC,SAAS,CAClB,CAAC;IAEF,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,SAAS;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/B,IAAI,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,SAAS,CAAC,YAAY,CAAC,CAAC;QAC1B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC;IAC5D,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAExE,MAAM,eAAe,GAAG,eAAe,EAAE,CAAC;IAC1C,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QACrD,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,MAAM,CAAC,IAAI,CAAC;QACV,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,MAAM,EAAE,QAAQ;QAChB,QAAQ,EAAE,KAAK;KAChB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5C,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACzC,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,QAAQ,GAAG,EAAE,CAAC;QAC9B,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;YACjD,SAAS,CAAC,SAAS,CAAC,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC3C,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACnD,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,IAAI,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;gBAC3B,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,CAAC;iBAAM,CAAC;gBACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9D,SAAS,CAAC,YAAY,CAAC,CAAC;YAC1B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO;QACP,MAAM;QACN,OAAO;YACL,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,MAAmB,EAAE,GAAW;IAChF,MAAM,KAAK,GAAa;QACtB,WAAW;QACX,QAAQ;QACR,EAAE;QACF,YAAY,OAAO,GAAG;QACtB,EAAE;QACF,6CAA6C;QAC7C,oCAAoC;QACpC,EAAE;KACH,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACnB,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/D,KAAK,CAAC,IAAI,CAAC,6BAA6B,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,iBAAiB,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,wDAAwD,CAAC,CAAC;IACrE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC5B,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACrC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,KAAK,CAAC,IAAI,CAAC,mEAAmE,CAAC,CAAC;IAChF,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC3C,KAAK,CAAC,IAAI,CAAC,4FAA4F,CAAC,CAAC;IACzG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC9C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACzC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,CAAS;IACzB,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QACH,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC"}

package/dist/sandbox/seccomp.d.ts

@@ -0,0 +1,13 @@
+export interface SeccompProfile {
+    defaultAction: "SCMP_ACT_ALLOW" | "SCMP_ACT_ERRNO" | "SCMP_ACT_KILL";
+    syscalls: SeccompRule[];
+}
+export interface SeccompRule {
+    names: string[];
+    action: "SCMP_ACT_ALLOW" | "SCMP_ACT_ERRNO" | "SCMP_ACT_KILL";
+}
+export declare function buildDefaultProfile(): SeccompProfile;
+export declare function buildRestrictedProfile(additionalAllowed?: string[]): SeccompProfile;
+export declare function writeSeccompProfile(profile: SeccompProfile, sandboxId: string): string;
+export declare function cleanupSeccompProfile(profilePath: string): void;
+//# sourceMappingURL=seccomp.d.ts.map

package/dist/sandbox/seccomp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp.d.ts","sourceRoot":"","sources":["../../src/sandbox/seccomp.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAC;IACrE,QAAQ,EAAE,WAAW,EAAE,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,EAAE,gBAAgB,GAAG,gBAAgB,GAAG,eAAe,CAAC;CAC/D;AA8ED,wBAAgB,mBAAmB,IAAI,cAAc,CAcpD;AAED,wBAAgB,sBAAsB,CACpC,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAC3B,cAAc,CAWhB;AAED,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,MAAM,GAChB,MAAM,CAMR;AAED,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAM/D"}

package/dist/sandbox/seccomp.js

@@ -0,0 +1,120 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+import * as os from "node:os";
+const NODE_REQUIRED_SYSCALLS = [
+    "read", "write", "open", "close", "stat", "fstat", "lstat",
+    "poll", "lseek", "mmap", "mprotect", "munmap", "brk",
+    "rt_sigaction", "rt_sigprocmask", "rt_sigreturn", "ioctl",
+    "pread64", "pwrite64", "readv", "writev", "access",
+    "pipe", "select", "sched_yield", "mremap", "msync",
+    "mincore", "madvise", "shmget", "shmat", "shmctl",
+    "dup", "dup2", "pause", "nanosleep", "getitimer",
+    "alarm", "setitimer", "getpid", "sendfile",
+    "socket", "connect", "accept", "sendto", "recvfrom",
+    "sendmsg", "recvmsg", "shutdown", "bind", "listen",
+    "getsockname", "getpeername", "socketpair",
+    "setsockopt", "getsockopt",
+    "clone", "fork", "vfork", "execve",
+    "exit", "wait4", "kill", "uname",
+    "fcntl", "flock", "fsync", "fdatasync", "truncate", "ftruncate",
+    "getdents", "getcwd", "chdir", "fchdir",
+    "rename", "mkdir", "rmdir", "creat", "link", "unlink",
+    "symlink", "readlink", "chmod", "fchmod", "chown", "fchown",
+    "lchown", "umask", "gettimeofday", "getrlimit",
+    "getrusage", "sysinfo", "times", "getuid", "syslog",
+    "getgid", "setuid", "setgid", "geteuid", "getegid",
+    "setpgid", "getppid", "getpgrp", "setsid",
+    "setreuid", "setregid", "getgroups", "setgroups",
+    "setresuid", "getresuid", "setresgid", "getresgid",
+    "sigpending", "sigaltstack", "statfs", "fstatfs",
+    "arch_prctl", "set_tid_address", "set_robust_list",
+    "get_robust_list",
+    "futex", "sched_getaffinity",
+    "epoll_create", "epoll_ctl", "epoll_wait",
+    "epoll_create1", "epoll_pwait",
+    "eventfd", "eventfd2", "timerfd_create", "timerfd_settime",
+    "signalfd", "signalfd4",
+    "clock_gettime", "clock_getres", "clock_nanosleep",
+    "exit_group", "tgkill", "openat", "mkdirat",
+    "fchownat", "newfstatat", "unlinkat", "renameat",
+    "linkat", "symlinkat", "readlinkat", "fchmodat",
+    "faccessat", "pselect6", "ppoll",
+    "splice", "tee", "sync_file_range", "utimensat",
+    "fallocate", "accept4", "pipe2", "inotify_init1",
+    "preadv", "pwritev", "recvmmsg", "sendmmsg",
+    "getrandom", "memfd_create", "copy_file_range",
+    "statx", "rseq",
+    "close_range", "openat2", "pidfd_open",
+    "clone3", "faccessat2",
+    "process_mrelease", "futex_waitv",
+    "preadv2", "pwritev2",
+    "io_uring_setup", "io_uring_enter", "io_uring_register",
+    "mlock", "munlock",
+    "prctl", "capget", "capset",
+    "getdents64", "dup3",
+    "sched_setaffinity", "sched_getaffinity",
+];
+const BLOCKED_SYSCALLS = [
+    "ptrace",
+    "mount", "umount2",
+    "pivot_root", "chroot",
+    "reboot", "kexec_load", "kexec_file_load",
+    "init_module", "finit_module", "delete_module",
+    "acct",
+    "swapon", "swapoff",
+    "nfsservctl",
+    "personality",
+    "keyctl", "request_key", "add_key",
+    "bpf",
+    "userfaultfd",
+    "perf_event_open",
+    "lookup_dcookie",
+    "kcmp",
+    "process_vm_readv", "process_vm_writev",
+    "move_pages", "migrate_pages",
+    "mbind", "set_mempolicy", "get_mempolicy",
+    "unshare", "setns",
+];
+export function buildDefaultProfile() {
+    return {
+        defaultAction: "SCMP_ACT_ERRNO",
+        syscalls: [
+            {
+                names: NODE_REQUIRED_SYSCALLS,
+                action: "SCMP_ACT_ALLOW",
+            },
+            {
+                names: BLOCKED_SYSCALLS,
+                action: "SCMP_ACT_ERRNO",
+            },
+        ],
+    };
+}
+export function buildRestrictedProfile(additionalAllowed) {
+    const allowed = [...NODE_REQUIRED_SYSCALLS, ...(additionalAllowed ?? [])];
+    return {
+        defaultAction: "SCMP_ACT_KILL",
+        syscalls: [
+            {
+                names: allowed,
+                action: "SCMP_ACT_ALLOW",
+            },
+        ],
+    };
+}
+export function writeSeccompProfile(profile, sandboxId) {
+    const tmpDir = path.join(os.tmpdir(), "openclaw-seccomp");
+    fs.mkdirSync(tmpDir, { recursive: true });
+    const profilePath = path.join(tmpDir, `${sandboxId}.json`);
+    fs.writeFileSync(profilePath, JSON.stringify(profile, null, 2));
+    return profilePath;
+}
+export function cleanupSeccompProfile(profilePath) {
+    try {
+        fs.unlinkSync(profilePath);
+    }
+    catch {
+        // best effort
+    }
+}
+//# sourceMappingURL=seccomp.js.map

package/dist/sandbox/seccomp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seccomp.js","sourceRoot":"","sources":["../../src/sandbox/seccomp.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAY9B,MAAM,sBAAsB,GAAG;IAC7B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO;IAC1D,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK;IACpD,cAAc,EAAE,gBAAgB,EAAE,cAAc,EAAE,OAAO;IACzD,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;IAClD,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO;IAClD,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACjD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW;IAChD,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU;IAC1C,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU;IACnD,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ;IAClD,aAAa,EAAE,aAAa,EAAE,YAAY;IAC1C,YAAY,EAAE,YAAY;IAC1B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ;IAClC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO;IAChC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW;IAC/D,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IACvC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ;IACrD,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3D,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,WAAW;IAC9C,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;IACnD,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS;IAClD,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ;IACzC,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW;IAChD,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW;IAClD,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS;IAChD,YAAY,EAAE,iBAAiB,EAAE,iBAAiB;IAClD,iBAAiB;IACjB,OAAO,EAAE,mBAAmB;IAC5B,cAAc,EAAE,WAAW,EAAE,YAAY;IACzC,eAAe,EAAE,aAAa;IAC9B,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,iBAAiB;IAC1D,UAAU,EAAE,WAAW;IACvB,eAAe,EAAE,cAAc,EAAE,iBAAiB;IAClD,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;IAC3C,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU;IAChD,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU;IAC/C,WAAW,EAAE,UAAU,EAAE,OAAO;IAChC,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW;IAC/C,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,eAAe;IAChD,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU;IAC3C,WAAW,EAAE,cAAc,EAAE,iBAAiB;IAC9C,OAAO,EAAE,MAAM;IACf,aAAa,EAAE,SAAS,EAAE,YAAY;IACtC,QAAQ,EAAE,YAAY;IACtB,kBAAkB,EAAE,aAAa;IACjC,SAAS,EAAE,UAAU;IACrB,gBAAgB,EAAE,gBAAgB,EAAE,mBAAmB;IACvD,OAAO,EAAE,SAAS;IAClB,OAAO,EAAE,QAAQ,EAAE,QAAQ;IAC3B,YAAY,EAAE,MAAM;IACpB,mBAAmB,EAAE,mBAAmB;CACzC,CAAC;AAEF,MAAM,gBAAgB,GAAG;IACvB,QAAQ;IACR,OAAO,EAAE,SAAS;IAClB,YAAY,EAAE,QAAQ;IACtB,QAAQ,EAAE,YAAY,EAAE,iBAAiB;IACzC,aAAa,EAAE,cAAc,EAAE,eAAe;IAC9C,MAAM;IACN,QAAQ,EAAE,SAAS;IACnB,YAAY;IACZ,aAAa;IACb,QAAQ,EAAE,aAAa,EAAE,SAAS;IAClC,KAAK;IACL,aAAa;IACb,iBAAiB;IACjB,gBAAgB;IAChB,MAAM;IACN,kBAAkB,EAAE,mBAAmB;IACvC,YAAY,EAAE,eAAe;IAC7B,OAAO,EAAE,eAAe,EAAE,eAAe;IACzC,SAAS,EAAE,OAAO;CACnB,CAAC;AAEF,MAAM,UAAU,mBAAmB;IACjC,OAAO;QACL,aAAa,EAAE,gBAAgB;QAC/B,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE,sBAAsB;gBAC7B,MAAM,EAAE,gBAAgB;aACzB;YACD;gBACE,KAAK,EAAE,gBAAgB;gBACvB,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,iBAA4B;IAE5B,MAAM,OAAO,GAAG,CAAC,GAAG,sBAAsB,EAAE,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,CAAC;IAC1E,OAAO;QACL,aAAa,EAAE,eAAe;QAC9B,QAAQ,EAAE;YACR;gBACE,KAAK,EAAE,OAAO;gBACd,MAAM,EAAE,gBAAgB;aACzB;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,OAAuB,EACvB,SAAiB;IAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAC1D,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,SAAS,OAAO,CAAC,CAAC;IAC3D,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC"}

package/dist/sandbox/types.d.ts

@@ -0,0 +1,68 @@
+export interface SandboxConfig {
+    memoryLimitMb?: number;
+    cpuWeight?: number;
+    pidsLimit?: number;
+    networkIsolation?: boolean;
+    timeoutMs?: number;
+    readonlyRootfs?: boolean;
+    allowedSyscalls?: string[];
+    mountBinds?: MountBind[];
+}
+export interface MountBind {
+    source: string;
+    target: string;
+    readonly: boolean;
+}
+export interface SandboxCapabilities {
+    hasUserNamespace: boolean;
+    hasPidNamespace: boolean;
+    hasMountNamespace: boolean;
+    hasNetNamespace: boolean;
+    hasCgroupV2: boolean;
+    hasSeccomp: boolean;
+    hasUnshare: boolean;
+    platform: "linux" | "darwin" | "other";
+}
+export interface SandboxProcess {
+    pid: number;
+    stdin: NodeJS.WritableStream;
+    stdout: NodeJS.ReadableStream;
+    stderr: NodeJS.ReadableStream;
+    kill(): void;
+    waitForExit(): Promise<number>;
+}
+export interface SandboxManager {
+    capabilities(): Promise<SandboxCapabilities>;
+    spawn(options: SandboxSpawnOptions): Promise<SandboxProcess>;
+}
+export interface SandboxSpawnOptions {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+    cwd: string;
+    config: SandboxConfig;
+    /** Env keys to preserve after credential sanitization (e.g. the LLM provider API key) */
+    protectedKeys?: string[];
+    onStderr?: (data: string) => void;
+}
+export interface IpcMessage {
+    jsonrpc: "2.0";
+    id?: number | string;
+    method?: string;
+    params?: unknown;
+    result?: unknown;
+    error?: IpcError;
+}
+export interface IpcError {
+    code: number;
+    message: string;
+    data?: unknown;
+}
+export declare const IPC_ERROR_CODES: {
+    readonly PARSE_ERROR: -32700;
+    readonly INVALID_REQUEST: -32600;
+    readonly METHOD_NOT_FOUND: -32601;
+    readonly INVALID_PARAMS: -32602;
+    readonly INTERNAL_ERROR: -32603;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/sandbox/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,UAAU,CAAC,EAAE,SAAS,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,eAAe,EAAE,OAAO,CAAC;IACzB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,OAAO,CAAC;IACpB,QAAQ,EAAE,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC;IAC7B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IAC9B,IAAI,IAAI,IAAI,CAAC;IACb,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,YAAY,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC7C,KAAK,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC9D;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,aAAa,CAAC;IACtB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,QAAQ,CAAC;CAClB;AAED,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,eAAO,MAAM,eAAe;;;;;;CAMlB,CAAC"}

package/dist/sandbox/types.js

@@ -0,0 +1,8 @@
+export const IPC_ERROR_CODES = {
+    PARSE_ERROR: -32700,
+    INVALID_REQUEST: -32600,
+    METHOD_NOT_FOUND: -32601,
+    INVALID_PARAMS: -32602,
+    INTERNAL_ERROR: -32603,
+};
+//# sourceMappingURL=types.js.map

package/dist/sandbox/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/sandbox/types.ts"],"names":[],"mappings":"AAoEA,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,WAAW,EAAE,CAAC,KAAK;IACnB,eAAe,EAAE,CAAC,KAAK;IACvB,gBAAgB,EAAE,CAAC,KAAK;IACxB,cAAc,EAAE,CAAC,KAAK;IACtB,cAAc,EAAE,CAAC,KAAK;CACd,CAAC"}

package/dist/sandbox/worker.d.ts

@@ -0,0 +1,12 @@
+export interface WorkerConfig {
+    workspaceDir: string;
+    sessionsDir: string;
+    sessionId: string;
+    message: string;
+    model: string;
+    provider: string;
+    systemPrompt?: string;
+    enableCodingTools: boolean;
+}
+export declare function startWorker(): Promise<void>;
+//# sourceMappingURL=worker.d.ts.map

package/dist/sandbox/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../src/sandbox/worker.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAsB,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAgFjD"}

package/dist/sandbox/worker.js

@@ -0,0 +1,84 @@
+import { createIpcPeer } from "./ipc.js";
+import { createProxyTools } from "./proxy-tools.js";
+export async function startWorker() {
+    const config = readWorkerConfig();
+    if (!config) {
+        process.exit(1);
+    }
+    const peer = createIpcPeer(process.stdin, process.stdout);
+    peer.handle("agent.run", async (params) => {
+        const runParams = (params ?? {});
+        const message = runParams.message ?? config.message;
+        const model = runParams.model ?? config.model;
+        const provider = runParams.provider ?? config.provider;
+        const systemPrompt = runParams.systemPrompt ?? config.systemPrompt;
+        const sessionId = runParams.sessionId ?? config.sessionId;
+        try {
+            const { createAgentSession, SessionManager, codingTools, } = await import("@mariozechner/pi-coding-agent");
+            const { getModel } = await import("@mariozechner/pi-ai");
+            const resolvedModel = getModel(provider, model);
+            const sessionManager = SessionManager.create(config.workspaceDir, config.sessionsDir);
+            const proxyTools = createProxyTools(peer);
+            const tools = config.enableCodingTools
+                ? [...codingTools]
+                : [];
+            const { session } = await createAgentSession({
+                cwd: config.workspaceDir,
+                model: resolvedModel,
+                tools,
+                customTools: proxyTools,
+                sessionManager,
+            });
+            await session.sendUserMessage(message);
+            const messages = session.messages;
+            let responseText = "";
+            for (let i = messages.length - 1; i >= 0; i--) {
+                const msg = messages[i];
+                if (msg.role === "assistant" && Array.isArray(msg.content)) {
+                    responseText = msg.content
+                        .filter((block) => block.type === "text")
+                        .map((block) => block.text ?? "")
+                        .join("");
+                    break;
+                }
+            }
+            return { response: responseText, sessionId };
+        }
+        catch (err) {
+            return { error: String(err) };
+        }
+    });
+    peer.start();
+    process.on("SIGTERM", () => {
+        peer.stop();
+        process.exit(0);
+    });
+    process.on("SIGINT", () => {
+        peer.stop();
+        process.exit(0);
+    });
+}
+function readWorkerConfig() {
+    const configJson = process.env["SANDBOX_WORKER_CONFIG"];
+    if (!configJson) {
+        process.stderr.write("SANDBOX_WORKER_CONFIG env var not set\n");
+        return null;
+    }
+    try {
+        return JSON.parse(configJson);
+    }
+    catch {
+        process.stderr.write("Failed to parse SANDBOX_WORKER_CONFIG\n");
+        return null;
+    }
+}
+const isDirectRun = process.argv[1] &&
+    (import.meta.url.endsWith(process.argv[1]) ||
+        import.meta.url.endsWith(process.argv[1].replace(/\.ts$/, ".js")));
+if (isDirectRun) {
+    startWorker().catch((err) => {
+        process.stderr.write(`Worker failed: ${err}\n`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=worker.js.map

package/dist/sandbox/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../src/sandbox/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAapD,MAAM,CAAC,KAAK,UAAU,WAAW;IAC/B,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAE1D,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,SAAS,GAAG,CAAC,MAAM,IAAI,EAAE,CAA0B,CAAC;QAC1D,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QACpD,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QAC9C,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;QACvD,MAAM,YAAY,GAAG,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,YAAY,CAAC;QACnE,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;QAE1D,IAAI,CAAC;YACH,MAAM,EACJ,kBAAkB,EAClB,cAAc,EACd,WAAW,GACZ,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;YAClD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAC;YAEzD,MAAM,aAAa,GAAG,QAAQ,CAC5B,QAA0C,EAC1C,KAAc,CACf,CAAC;YAEF,MAAM,cAAc,GAAG,cAAc,CAAC,MAAM,CAC1C,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,CACnB,CAAC;YAEF,MAAM,UAAU,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAE1C,MAAM,KAAK,GAAG,MAAM,CAAC,iBAAiB;gBACpC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC;gBAClB,CAAC,CAAC,EAAE,CAAC;YAEP,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,kBAAkB,CAAC;gBAC3C,GAAG,EAAE,MAAM,CAAC,YAAY;gBACxB,KAAK,EAAE,aAAa;gBACpB,KAAK;gBACL,WAAW,EAAE,UAAiF;gBAC9F,cAAc;aACf,CAAC,CAAC;YAEH,MAAM,OAAO,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;YAEvC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;YAClC,IAAI,YAAY,GAAG,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC9C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;gBACxB,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3D,YAAY,GAAG,GAAG,CAAC,OAAO;yBACvB,MAAM,CAAC,CAAC,KAAuB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC;yBAC1D,GAAG,CAAC,CAAC,KAAsC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;yBACjE,IAAI,CAAC,EAAE,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;YAED,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,KAAK,EAAE,CAAC;IAEb,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,UAAU,CAAiB,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACf,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;AAEvE,IAAI,WAAW,EAAE,CAAC;IAChB,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/sessions/index.d.ts

@@ -0,0 +1,2 @@
+export { type SessionEntry, type SessionStore, loadSessionStore, saveSessionStore, getOrCreateSession, updateSession, getSessionStorePath, } from "./store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/sessions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/sessions/index.js

@@ -0,0 +1,2 @@
+export { loadSessionStore, saveSessionStore, getOrCreateSession, updateSession, getSessionStorePath, } from "./store.js";
+//# sourceMappingURL=index.js.map

package/dist/sessions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sessions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,aAAa,EACb,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/sessions/store.d.ts

@@ -0,0 +1,17 @@
+export interface SessionEntry {
+    id: string;
+    agentId?: string;
+    model?: string;
+    createdAt: string;
+    updatedAt: string;
+    metadata?: Record<string, unknown>;
+}
+export interface SessionStore {
+    entries: Record<string, SessionEntry>;
+}
+export declare function getSessionStorePath(stateDir: string): string;
+export declare function loadSessionStore(stateDir: string): SessionStore;
+export declare function saveSessionStore(stateDir: string, store: SessionStore): void;
+export declare function getOrCreateSession(stateDir: string, sessionId: string, defaults?: Partial<SessionEntry>): SessionEntry;
+export declare function updateSession(stateDir: string, sessionId: string, update: Partial<SessionEntry>): void;
+//# sourceMappingURL=store.d.ts.map

package/dist/sessions/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACvC;AAED,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAQ/D;AAED,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,GAClB,IAAI,CAIN;AAED,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,GAC/B,YAAY,CAed;AAED,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,OAAO,CAAC,YAAY,CAAC,GAC5B,IAAI,CAWN"}

package/dist/sessions/store.js

@@ -0,0 +1,48 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function getSessionStorePath(stateDir) {
+    return path.join(stateDir, "sessions.json");
+}
+export function loadSessionStore(stateDir) {
+    const filePath = getSessionStorePath(stateDir);
+    try {
+        const raw = fs.readFileSync(filePath, "utf-8");
+        return JSON.parse(raw);
+    }
+    catch {
+        return { entries: {} };
+    }
+}
+export function saveSessionStore(stateDir, store) {
+    const filePath = getSessionStorePath(stateDir);
+    fs.mkdirSync(path.dirname(filePath), { recursive: true });
+    fs.writeFileSync(filePath, JSON.stringify(store, null, 2));
+}
+export function getOrCreateSession(stateDir, sessionId, defaults) {
+    const store = loadSessionStore(stateDir);
+    if (store.entries[sessionId]) {
+        return store.entries[sessionId];
+    }
+    const entry = {
+        id: sessionId,
+        createdAt: new Date().toISOString(),
+        updatedAt: new Date().toISOString(),
+        ...defaults,
+    };
+    store.entries[sessionId] = entry;
+    saveSessionStore(stateDir, store);
+    return entry;
+}
+export function updateSession(stateDir, sessionId, update) {
+    const store = loadSessionStore(stateDir);
+    const existing = store.entries[sessionId];
+    if (!existing)
+        return;
+    store.entries[sessionId] = {
+        ...existing,
+        ...update,
+        updatedAt: new Date().toISOString(),
+    };
+    saveSessionStore(stateDir, store);
+}
+//# sourceMappingURL=store.js.map

package/dist/sessions/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/sessions/store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,KAAmB;IAEnB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC/C,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAAgB,EAChB,SAAiB,EACjB,QAAgC;IAEhC,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,KAAK,GAAiB;QAC1B,EAAE,EAAE,SAAS;QACb,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,GAAG,QAAQ;KACZ,CAAC;IACF,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;IACjC,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,QAAgB,EAChB,SAAiB,EACjB,MAA6B;IAE7B,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC1C,IAAI,CAAC,QAAQ;QAAE,OAAO;IAEtB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG;QACzB,GAAG,QAAQ;QACX,GAAG,MAAM;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,gBAAgB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/skills/enablement.d.ts

@@ -0,0 +1,10 @@
+import type { SkillRegistry, SkillRegistryEntry } from "./registry.js";
+export interface SkillEnablement {
+    enable(skillId: string): boolean;
+    disable(skillId: string): boolean;
+    isEnabled(skillId: string): boolean;
+    listEnabled(): SkillRegistryEntry[];
+    listEnabledIds(): string[];
+}
+export declare function createSkillEnablement(workspaceDir: string, registry: SkillRegistry): SkillEnablement;
+//# sourceMappingURL=enablement.d.ts.map

package/dist/skills/enablement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enablement.d.ts","sourceRoot":"","sources":["../../src/skills/enablement.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEvE,MAAM,WAAW,eAAe;IAC9B,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACjC,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAClC,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACpC,WAAW,IAAI,kBAAkB,EAAE,CAAC;IACpC,cAAc,IAAI,MAAM,EAAE,CAAC;CAC5B;AAMD,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,aAAa,GACtB,eAAe,CAmDjB"}

package/dist/skills/enablement.js

@@ -0,0 +1,52 @@
+import * as fs from "node:fs";
+import * as path from "node:path";
+export function createSkillEnablement(workspaceDir, registry) {
+    const filePath = path.join(workspaceDir, "enabled-skills.json");
+    function loadState() {
+        try {
+            const raw = fs.readFileSync(filePath, "utf-8");
+            return JSON.parse(raw);
+        }
+        catch {
+            return { enabledSkills: [] };
+        }
+    }
+    function saveState(state) {
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, JSON.stringify(state, null, 2));
+    }
+    return {
+        enable(skillId) {
+            if (!registry.get(skillId))
+                return false;
+            const state = loadState();
+            if (state.enabledSkills.includes(skillId))
+                return true;
+            state.enabledSkills.push(skillId);
+            saveState(state);
+            return true;
+        },
+        disable(skillId) {
+            const state = loadState();
+            const idx = state.enabledSkills.indexOf(skillId);
+            if (idx === -1)
+                return false;
+            state.enabledSkills.splice(idx, 1);
+            saveState(state);
+            return true;
+        },
+        isEnabled(skillId) {
+            return loadState().enabledSkills.includes(skillId);
+        },
+        listEnabled() {
+            const state = loadState();
+            return state.enabledSkills
+                .map((id) => registry.get(id))
+                .filter((e) => e !== undefined);
+        },
+        listEnabledIds() {
+            return loadState().enabledSkills;
+        },
+    };
+}
+//# sourceMappingURL=enablement.js.map

package/dist/skills/enablement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enablement.js","sourceRoot":"","sources":["../../src/skills/enablement.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAelC,MAAM,UAAU,qBAAqB,CACnC,YAAoB,EACpB,QAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,qBAAqB,CAAC,CAAC;IAEhE,SAAS,SAAS;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAoB,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,KAAsB;QACvC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,MAAM,CAAC,OAAO;YACZ,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,IAAI,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvD,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAClC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,CAAC,OAAO;YACb,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjD,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7B,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACnC,SAAS,CAAC,KAAK,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,SAAS,CAAC,OAAO;YACf,OAAO,SAAS,EAAE,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACrD,CAAC;QAED,WAAW;YACT,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,aAAa;iBACvB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;iBAC7B,MAAM,CAAC,CAAC,CAAC,EAA2B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,cAAc;YACZ,OAAO,SAAS,EAAE,CAAC,aAAa,CAAC;QACnC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/skills/index.d.ts

@@ -0,0 +1,4 @@
+export { loadWorkspaceSkills, type Skill, type SkillSnapshot, } from "./loader.js";
+export { createSkillRegistry, type SkillRegistry, type SkillRegistryEntry, } from "./registry.js";
+export { createSkillEnablement, type SkillEnablement, } from "./enablement.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/skills/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,EACnB,KAAK,KAAK,EACV,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,EACnB,KAAK,aAAa,EAClB,KAAK,kBAAkB,GACxB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,EACrB,KAAK,eAAe,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/skills/index.js

@@ -0,0 +1,4 @@
+export { loadWorkspaceSkills, } from "./loader.js";
+export { createSkillRegistry, } from "./registry.js";
+export { createSkillEnablement, } from "./enablement.js";
+//# sourceMappingURL=index.js.map

package/dist/skills/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/skills/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,mBAAmB,GAGpB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,mBAAmB,GAGpB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,qBAAqB,GAEtB,MAAM,iBAAiB,CAAC"}

package/dist/skills/loader.d.ts

@@ -0,0 +1,8 @@
+import { type Skill } from "@mariozechner/pi-coding-agent";
+export { type Skill };
+export interface SkillSnapshot {
+    skills: Skill[];
+    promptText: string;
+}
+export declare function loadWorkspaceSkills(workspaceDir: string): SkillSnapshot;
+//# sourceMappingURL=loader.d.ts.map

package/dist/skills/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/skills/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,KAAK,EACX,MAAM,+BAA+B,CAAC;AAEvC,OAAO,EAAE,KAAK,KAAK,EAAE,CAAC;AAEtB,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,KAAK,EAAE,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,MAAM,GAAG,aAAa,CAKvE"}

package/dist/skills/loader.js

@@ -0,0 +1,8 @@
+import { loadSkillsFromDir, formatSkillsForPrompt, } from "@mariozechner/pi-coding-agent";
+export function loadWorkspaceSkills(workspaceDir) {
+    const result = loadSkillsFromDir({ dir: workspaceDir, source: "workspace" });
+    const skills = result.skills ?? [];
+    const promptText = formatSkillsForPrompt(skills);
+    return { skills, promptText };
+}
+//# sourceMappingURL=loader.js.map

package/dist/skills/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/skills/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAEtB,MAAM,+BAA+B,CAAC;AASvC,MAAM,UAAU,mBAAmB,CAAC,YAAoB;IACtD,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,GAAG,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;IACnC,MAAM,UAAU,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChC,CAAC"}

package/dist/skills/registry.d.ts

@@ -0,0 +1,19 @@
+import { type Skill } from "@mariozechner/pi-coding-agent";
+export interface SkillRegistryEntry {
+    id: string;
+    name: string;
+    description: string;
+    path: string;
+}
+export interface SkillRegistry {
+    list(): SkillRegistryEntry[];
+    get(skillId: string): SkillRegistryEntry | undefined;
+    register(skillPath: string): SkillRegistryEntry;
+    unregister(skillId: string): boolean;
+    loadSkills(skillIds?: string[]): {
+        skills: Skill[];
+        promptText: string;
+    };
+}
+export declare function createSkillRegistry(skillsDir: string): SkillRegistry;
+//# sourceMappingURL=registry.d.ts.map

package/dist/skills/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/skills/registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,KAAK,EACX,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,IAAI,kBAAkB,EAAE,CAAC;IAC7B,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,kBAAkB,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,kBAAkB,CAAC;IAChD,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IACrC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,GAAG;QAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAC1E;AAED,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,aAAa,CA8GpE"}