pi-background-tasks 2.5.0 → 2.6.0

package/BACKGROUND-TASKS-INSTRUCTIONS.md

@@ -46,7 +46,7 @@ Current authored ownership map:
 - Fusion runtime: `.pi/fusion/<session-id>-<pid>/<run-id>/` under the active project cwd.
 - Delegate artifacts: task-owned artifact directories referenced from task metadata/result packages.
 - Fusion model config: `fusion-models.json` under Pi's agent directory (`getAgentDir()`), not the project `.pi/tasks` tree.
-- Package entrypoints, in load order: `extensions/anthropic-attribution.ts`, then `extensions/background-tasks.ts`, via `package.json.pi.extensions`.
+- Published Pi entrypoints, in load order: `dist/extensions/anthropic-attribution.js`, then `dist/extensions/background-tasks.js`, via `package.json.pi.extensions`. Authoritative TypeScript remains under `extensions/` and `src/`; `npm run build:runtime` produces the shipped JavaScript closure.
 
 ---
 

package/README.md

@@ -17,7 +17,7 @@
 - **Run long work without blocking**: start named shell jobs, keep talking to Pi, and get durable completion notifications when they finish.
 - **Delegate context-aware investigation**: launch one route-pinned, inspect-only child Pi agent seeded with a frozen projection of the current conversation, then retrieve a hash-verified result.
 - **Combine model perspectives through fixed-purpose Fusion**: run three candidate children, blind evaluation, optional bounded evaluator repair, and merger for reasoning, investigation, targeted URL research, or validation review.
-- **Keep Anthropic subscription traffic attributed and compatible**: globally apply the package-owned Claude Code OAuth attribution, cache policy, and exact-match prompt sanitization to Anthropic routes without an external sanitizer dependency.
+- **Keep Anthropic subscription traffic attributed and compatible**: by default, apply the package-owned Claude Code OAuth attribution, cache policy, and exact-match prompt sanitization to parent Anthropic routes without an external sanitizer dependency; isolated package children retain mandatory attribution even when ambient parent attribution is disabled.
 
 <p align="center">
   <img src="docs/assets/architecture.svg" alt="Architecture diagram showing Pi session, background task registry, delegated child agent, and Fusion candidate/evaluator/merger flow" width="760">
@@ -27,42 +27,63 @@
 | Fact | Value |
 | --- | --- |
 | Package | `pi-background-tasks` |
-| Version | `2.5.0` |
+| Version | `2.6.0` |
 | Node engine | `>=22.19.0` |
-| Pi entrypoints | `./extensions/anthropic-attribution.ts`, `./extensions/background-tasks.ts` |
+| Pi entrypoints | `./dist/extensions/anthropic-attribution.js`, `./dist/extensions/background-tasks.js` |
 | Package image | [logo.png](https://raw.githubusercontent.com/ismailsaleekh/pi-background-tasks/main/logo.png) |
 <!-- pi-docs:end name="readme-package-facts" -->
 
 <!-- pi-docs:begin name="readme-public-surfaces" generator="scripts/docs/generate.mjs" -->
-| Surface kind | Count |
-| --- | --- |
-| command | 11 |
-| tool | 11 |
-| shortcut | 2 |
-| renderer | 2 |
-| eventbus | 1 |
-| workflow | 4 |
+| Surface kind | Configured variants | Available by default |
+| --- | --- | --- |
+| command | 11 | 11 |
+| tool | 11 | 11 |
+| shortcut | 3 | 2 |
+| renderer | 2 | 2 |
+| eventbus | 1 | 1 |
+| workflow | 4 | 4 |
 
 Public commands: `/bg`, `/bg-clear`, `/bg-tasks`, `/bg-update`, `/claude-cache`, `/fusion`, `/fusion-models`, `/jobs`, `/kill`, `/logs`, `/tasks`.
 
 Public tools: `bg_delegate`, `bg_kill`, `bg_logs`, `bg_result`, `bg_run`, `bg_run_pi_attested`, `bg_status`, `fusion_investigate`, `fusion_reason`, `fusion_research`, `fusion_validate`.
 
+### Configuration-dependent surfaces
+
+| Surface | Availability | Default |
+| --- | --- | --- |
+| `command:claude-cache` | `feature:attribution` | yes |
+| `command:fusion` | `feature:fusion` | yes |
+| `command:fusion-models` | `feature:fusion` | yes |
+| `tool:bg_delegate` | `feature:delegate` | yes |
+| `tool:bg_result` | `any(feature:delegate,feature:fusion)` | yes |
+| `tool:bg_run_pi_attested` | `feature:attested` | yes |
+| `tool:fusion_investigate` | `feature:fusion` | yes |
+| `tool:fusion_reason` | `feature:fusion` | yes |
+| `tool:fusion_research` | `feature:fusion` | yes |
+| `tool:fusion_validate` | `feature:fusion` | yes |
+| `shortcut:ctrl+alt+b` | `dock:ctrl+alt+b` | no |
+| `shortcut:shift+down` | `dock:shift+down` | yes |
+| `renderer:fusion-result` | `feature:fusion` | yes |
+| `workflow:investigate` | `feature:fusion` | yes |
+| `workflow:reason` | `feature:fusion` | yes |
+| `workflow:research` | `feature:fusion` | yes |
+| `workflow:validate` | `feature:fusion` | yes |
+
 Full owner map and generated contracts live in [docs/INDEX.md](docs/INDEX.md).
 <!-- pi-docs:end name="readme-public-surfaces" -->
 
-
-
+“Available by default” means after Pi has initialized extensions. Normal TUI/RPC/print/JSON modes do this; SDK embedders must provide a counted `bindExtensions()` binding and ensure post-reload binding. Bare `createAgentSession()` and empty/mode-only reload are blocked by the current public host lifecycle API. See [Getting started](docs/getting-started.md#sdk-embedding-requirement).
 
 ## Why use it?
 
 | You want to... | Use this package because... |
 |---|---|
-| Start a dev server, watch build, migration dry run, or long check | `bg_run` and `/bg` return immediately, write durable output files, show a footer dock, and notify on terminal state. |
+| Start a dev server, watch build, migration dry run, or long check | `bg_run` and `/bg` return immediately, write durable output files, show a footer dock, and notify on terminal state. Ordinary `isAgent:false` jobs can explicitly keep the same live execution across a real same-process reload. |
 | Let Pi keep working instead of sleeping or polling | Default `bg_run` completion delivery sends a durable terminal notification and can wake a follow-up turn. |
 | Ask a second agent to inspect the repo with the current conversation as context | `bg_delegate` starts one read/search/list child, isolated from ambient extensions by default; `bg_result` verifies the committed result before returning it. |
 | Compare model perspectives without exposing arbitrary parent context | Fusion children receive only the workflow input and fixed tool policy; no silent route substitution or fallback is used on delegate/Fusion paths. |
 | Produce local evidence for a direct Pi run | `bg_run_pi_attested` records local same-user-writable artifacts and hashes after a successful structured child Pi task. |
-| Use Anthropic subscription OAuth consistently | The globally loaded provider applies attribution and exact-match sanitization; `/claude-cache` shows or changes session cache retention. |
+| Use Anthropic subscription OAuth consistently | The default ambient provider applies attribution and exact-match sanitization; `/claude-cache` shows or changes session cache retention. Isolated package-owned Anthropic children always use the mandatory child entrypoint. |
 
 ## Install
 
@@ -97,9 +118,9 @@ Local paths are loaded from disk without copying; use the path to this package f
    /bg --name "Typecheck watch" npm run typecheck -- --watch
    ```
 
-   `/bg` starts a tracked shell task and returns the task id plus output path. User-launched `/bg` tasks notify in the UI but do not automatically wake a follow-up model turn.
+   `/bg` starts a tracked shell task and returns the task id plus output path. User-launched `/bg` tasks notify in the UI but do not automatically wake a follow-up model turn. Add one leading `--survive-reload` only when this ordinary shell process must keep running across a real same-process `/reload`; default tasks are still killed.
 
-3. Open the footer dock with **Shift↓** or list tasks:
+3. Open the footer dock with the default **Shift↓** binding or list tasks:
 
    ```text
    /jobs
@@ -135,13 +156,34 @@ Local paths are loaded from disk without copying; use the path to this package f
 
 More walkthrough detail: [Getting started](docs/getting-started.md).
 
+## Select capabilities and avoid shortcut conflicts
+
+The default remains the complete historical surface. To run only process tasks, set:
+
+```bash
+PI_BG_FEATURES=process pi
+```
+
+`PI_BG_FEATURES` accepts a strict unique comma-separated set from `process,delegate,fusion,attested,attribution`; `process` is mandatory. `bg_result` is derived and appears exactly once when delegate or Fusion is enabled. Disabled tools, commands, renderers, and ambient attribution are absent from registration and remain absent after reload.
+
+Choose the dock key independently:
+
+```bash
+PI_BG_DOCK_SHORTCUT=ctrl+alt+b pi  # avoid a Shift+Down owner
+PI_BG_DOCK_SHORTCUT=off pi         # use /tasks or /bg-tasks
+```
+
+Accepted values are exactly `shift+down` (default), `ctrl+alt+b`, and `off`. Invalid settings fail startup with `pi_bg_config_invalid`; they do not silently restore defaults. `/tasks`, `/bg-tasks`, and the separate `Ctrl+Alt+C` clear fallback remain available. These flags select functionality; they do not claim a cold-start performance improvement.
+
+Full contract: [Configuration](docs/operations/configuration.md) and [Shortcuts and dock](docs/reference/shortcuts-and-dock.md).
+
 ## Pick the right workflow
 
 | Workflow | Blocking? | Context | Tools/network/write boundary | Best for | Expected behavior |
 |---|---:|---|---|---|---|
 | Ordinary foreground Pi work | Yes | Full current session | Whatever tools the active session has | Short reads/edits/commands where you want live back-and-forth | Pi waits for the work before responding. |
-| `/bg` | No | No model child unless your command starts one | Runs your shell command; **not sandboxed** | User-started local commands, servers, watches | UI notification and footer tracking; `/bg` uses notification-only by default. |
-| `bg_run` | No | No model child unless command starts one | Runs your shell command; **not sandboxed** | Agent-started long commands | Returns task id/output path; defaults to notification plus automatic follow-up wake. For an Anthropic child `pi`, do not pass `--no-extensions` unless you also explicitly load this package's attribution extension. |
+| `/bg` | No | No model child unless your command starts one | Runs your shell command; **not sandboxed** | User-started local commands, servers, watches | UI notification and footer tracking; `/bg` uses notification-only by default. Optional `--survive-reload` is ordinary-shell-only. |
+| `bg_run` | No | No model child unless command starts one | Runs your shell command; **not sandboxed** | Agent-started long commands | Returns task id/output path; defaults to notification plus automatic follow-up wake. Optional `surviveReload:true` requires `isAgent:false`. For an Anthropic child `pi`, do not pass `--no-extensions` unless you also explicitly load this package's attribution extension. |
 | `bg_delegate` + `bg_result` | No launch; retrieval is point-in-time | Frozen visible conversation projection | Inspect-only child: read, grep, find, ls, artifact read; no shell, writes, network, recursion | Context-aware read-only investigation while parent continues | Launch returns immediately; result is committed by child and hash-verified by retrieval. |
 | `bg_run_pi_attested` | No | Prompt passed to one direct child Pi run | Direct `pi --mode json`; no shell command; writes requested report path | Evidence-oriented direct Pi task | Emits local attestation sidecar only after successful completion. |
 | `/fusion` / `fusion_reason` | Background launch; point-in-time `bg_result` retrieval | Versioned conversation projection plus prompt | Candidates/evaluator/repair/merger run with no tools | Self-contained reasoning and synthesis | Returns after durable preflight; three candidates → blind evaluator → optional bounded repair → merger. |
@@ -160,13 +202,14 @@ See [Choose a workflow](docs/choose-a-workflow.md) for a decision tree and trade
   "name": "Docs preview",
   "command": "npm run docs:dev",
   "isAgent": false,
-  "timeoutSeconds": 3600
+  "timeoutSeconds": 3600,
+  "surviveReload": true
 }
 ```
 
-Expected: returns immediately with a task id, PID when available, and `.pi/tasks/...output`. The command runs as an ordinary local shell command with your user permissions; it can invoke networked tools or paid services if the command itself does so.
+Expected: returns immediately with a task id, PID when available, and `.pi/tasks/...output`. Here the explicit flag retains that exact child/id/PID/nonce/path, launch policy, absolute timeout, and cumulative cap across a supported real reload. Omit it for compatible kill-on-reload behavior. New/resume/fork/clone/quit, hard crash, process restart, empty/mode-only SDK reload, and direct `AgentSession.dispose()` are not supported survival paths. The command runs as an ordinary local shell command with your user permissions; it can invoke networked tools or paid services if the command itself does so.
 
-If `bg_run` starts an Anthropic child `pi`, keep normal extension discovery enabled. Do not add `--no-extensions` unless the command also supplies this package's `extensions/anthropic-attribution.ts` via `-e`/`--extension`; `bg_run` does not rewrite arbitrary shell argv.
+If `bg_run` starts an Anthropic child `pi`, keep normal extension discovery enabled when ambient attribution is enabled. Do not add `--no-extensions` unless the command also supplies this package's always-on `extensions/anthropic-attribution-child.ts` via `-e`/`--extension`; `bg_run` does not rewrite arbitrary shell argv.
 
 ### `bg_delegate`: context-seeded read-only investigation
 
@@ -263,11 +306,11 @@ Use with `fusion_validate` for advisory read-only review.
   <img src="docs/assets/footer-dock.svg" alt="Illustration of the pi-background-tasks footer dock with running and completed tasks" width="760">
 </p>
 
-When tasks are running or unseen completions exist, the footer shows a compact `bg ...` segment. Press **Shift↓** to open the focused bottom dock. Use `/bg-clear` to acknowledge finished-task footer notices in any terminal.
+When tasks are running or unseen completions exist, the footer shows a compact `bg ...` segment. Press the configured **Shift↓** (default) or **Ctrl+Alt+B** binding to open the focused bottom dock, or use `/tasks` when the key is off. Use `/bg-clear` to acknowledge finished-task footer notices in any terminal.
 
 | Control | Action |
 |---|---|
-| `Shift↓` | Open the dock |
+| configured `Shift↓` / `Ctrl+Alt+B`, or `/tasks` | Open the dock |
 | `/bg-clear` | Clear finished-task notices |
 | `↑` / `↓`, `PageUp` / `PageDown` | Move through list or scroll output tail |
 | `Enter` / `→` | Inspect details |
@@ -299,7 +342,7 @@ Agent tasks launched through `pi -p ...` or `pi --mode json ...` and marked `isA
 - Shell jobs are tracked by the package, but they are not sandboxed. Treat commands as local processes with your permissions and credentials.
 - Delegate and Fusion child Pi processes are route-pinned where applicable; delegate/Fusion paths do not silently substitute routes.
 - Fusion uses direct child `pi --mode text` processes, not direct completion APIs. Frontier Fusion routes are admitted only through Pi Anthropic or Codex subscription OAuth; metered frontier API credentials are rejected before child creation.
-- Normal installations globally load the package-owned Claude Code OAuth attribution/sanitization provider for Anthropic sessions; non-Anthropic sessions are unchanged. Isolated Fusion, delegate, and attested Anthropic children load the same package entrypoint explicitly. It requests `ttl: "1h"` on system/tool/conversation cache breakpoints before serialization and preserves provider-reported `cacheWrite1h` evidence. Set `PI_CACHE_RETENTION=short|none|long` or use `/claude-cache` to choose explicitly; malformed attribution, policy, cache evidence, or non-OAuth credentials fail before transport. Provider usage is preserved verbatim, but subscription OAuth can report `cacheWrite1h = 0` even when a unique cache remains readable beyond five minutes; treat positive `cacheWrite1h` as definitive and zero as inconclusive on that channel. Anthropic budgeting follows the provider's 200K subscription policy.
+- Normal installations load a feature-aware ambient Claude Code OAuth attribution/sanitization entrypoint for parent Anthropic sessions; non-Anthropic sessions are unchanged. The default enables it, while omitting `attribution` removes its provider/hooks and `/claude-cache`. Isolated Fusion, delegate, and attested Anthropic children load the separate always-on child entrypoint explicitly before their guard/governor, regardless of that ambient flag. It requests `ttl: "1h"` on system/tool/conversation cache breakpoints before serialization and preserves provider-reported `cacheWrite1h` evidence. Set `PI_CACHE_RETENTION=short|none|long` or use `/claude-cache` when ambient attribution is enabled; malformed attribution, policy, cache evidence, or non-OAuth credentials fail before transport. Provider usage is preserved verbatim, but subscription OAuth can report `cacheWrite1h = 0` even when a unique cache remains readable beyond five minutes; treat positive `cacheWrite1h` as definitive and zero as inconclusive on that channel. Anthropic budgeting follows the provider's 200K subscription policy.
 - Fusion research fetches only caller-supplied public `http(s)` URLs with bounded retrieval. It is not web search and not a secret-exfiltration boundary.
 - Attestation sidecars are local, unsigned, same-user-writable evidence. They are useful for downstream local gates, but not cryptographic proof against local compromise, a compromised Pi binary, or a compromised provider.
 - Metadata, attestations, delegate/Fusion artifacts, and configuration replacements use write/fsync/rename durability patterns. Failed/cancelled stored Fusion runs also have a manifest-bound `failure-summary.json` containing bounded no-answer evidence metadata and artifact refs only; `bg_result` returns it as an answer-free typed terminal view after integrity checks. Ordinary task output is closed and drained before terminal publication but is not explicitly fsynced. POSIX directory entries are fsynced after atomic replacement; Windows lacks the same portable directory-entry crash-durability guarantee.
@@ -332,3 +375,5 @@ Operations are `capabilities`, `run`, `status`, `logs`, and `kill`. This is the
 ## Contributing
 
 Keep user-facing claims tied to source. If you change public schemas, command behavior, durability, model routing, or environment variables, update these package-local docs in the same change and run focused checks appropriate to the edit.
+
+For startup work, use `scripts/benchmark-cold-load.mjs` with an owned output/scratch root, explicit `--runtime source|compiled`, and at least 30 fresh-process samples; the exact command and interpretation rules are in [Testing operations](docs/operations/testing.md#cold-load-measurement-discipline). Its “cold” result means an empty JavaScript/Jiti module cache, not a flushed filesystem cache. It is distribution evidence, not a flaky CI threshold. Published Pi entrypoints use precompiled JavaScript; disabled delegate/Fusion/attribution lanes, the dock UI, and attested execution stay outside process-only static startup. Native-Windows and vendor compiled-Bun timing still require their own evidence.

package/TESTING.md

@@ -10,6 +10,14 @@ The historical monorepo extension standards are contextual background only; do n
 
 ## Current commands
 
+Compiled runtime build:
+
+```bash
+npm run build:runtime
+```
+
+This produces the published `dist/` JavaScript entrypoints and their complete deferred runtime closure from authoritative TypeScript. SDK/package/smoke/release scripts build it before exercising compiled distribution paths.
+
 Default gate:
 
 ```bash
@@ -82,7 +90,7 @@ npm run pack:dry-run
 npm run test:compat
 ```
 
-Current smoke is `tsx scripts/smoke.ts`. It creates a temporary Pi agent/session directory, sets offline/telemetry-suppression environment variables, and runs the package entrypoint with `/jobs`.
+Current smoke builds the runtime and then runs `tsx scripts/smoke.ts`. It creates a temporary Pi agent/session directory, sets offline/telemetry-suppression environment variables, and runs the compiled package entrypoints with `/jobs`.
 
 `npm run smoke:large-context` is the Fusion context-policy evidence harness. It rebuilds the byte composition of the production failure (696,929 B tool results, 251,508 B tool arguments, 34,959 B user text, 24,733 B assistant text, 10,303 B thinking) as a real `SessionManager` branch, then prints:
 
@@ -183,6 +191,13 @@ CI=1
 
 Tests must not use the user's real `~/.pi/agent`.
 
+### Trustworthy package verification
+
+`test:type-safety` uses the TypeScript parser, not line regexes. Its direct adversarial corpus separates executable type escapes from comment prose and string/template/regex contents, while retaining compiler-recognized suppression comments and multiline/parenthesized assertion coverage. Parentheses and type-transparent `satisfies` wrappers cannot hide a directly nested assertion. Assertions split through an identifier are intentionally outside this syntactic rule so a separately validated `unknown` boundary is not banned; the gate does not claim whole-program type soundness.
+
+The package URL guard separates syntax-wide discovery of self-contained file-URL `pathname` hazards from finite flow-sensitive provenance at each use. Sequential overwrites replace prior provenance; feasible branches and distinct normal/break/continue/return/explicit-throw completions merge without discarding live states; and `finally` is inspected for every incoming completion. Static strings and static-head templates use the WHATWG URL parser's preprocessing and absolute-first behavior, including leading C0/space and TAB/CR/LF handling; proven absolute first values ignore bases, while `./` and `../` template heads use the explicit base. Direct/computed access and declaration, assignment, and statically known `for...of` destructuring are covered. Exact static keys distinguish lowercase `import.meta['url']` from uppercase intrinsic `globalThis['URL']`, while compiler-resolved parameter/local `globalThis` bindings stay controls. Any explicitly traced may-file branch is rejected. An unknown dynamic first value remains unknown but, when a base is explicit, also joins that base's possible provenance because it may be relative; known absolute HTTP(S) values remain non-file controls. Calls, implicit exceptions, interprocedural/later-closure effects, and heap/proxy mutation are not executed or inferred; this is a bounded source-policy guard, not complete JavaScript dataflow analysis.
+
+The local-tarball consumer test does not borrow a warm user npm cache or npm configuration. It first proves a truly empty isolated cache fails with `ENOTCACHED`, then archives the already-published files in the installed `turndown` production closure through the public portable `tar` API bundled with the active npm CLI, without invoking npm's directory-pack lifecycle. A task-owned package with executable `prepack`, `prepare`, and `postpack` hooks proves plain packing attempts lifecycle code, characterizes npm 10.9.3's unsafe `--ignore-scripts` prepare behavior versus npm 11.13.0, and then proves the fixture archive path runs no hook on either line. The installed source hashes and original script-bearing manifest bytes must remain unchanged. The resulting real closure is exposed through a temporary loopback-only registry to seed a separate empty task-owned cache. Every npm subprocess uses explicit task-owned user/global config, a task-owned project cwd with empty project config, `GIT_ALLOW_PROTOCOL=file`, and absolute filesystem operands. A no-request config probe demonstrates that a hostile scoped global/project registry would win without isolation but is absent from the effective preparation environment. After the registry is closed, consumer installation runs with `--offline`; the test checks exact Turndown/Domino versions and performs a real HTML-to-Markdown conversion to prove the transitive dependency loads. Missing registry inputs, failed cache preparation, lifecycle execution, source mutation, or missing runtime dependencies are hard failures.
 
 Fusion-specific targeted gates:
 
@@ -198,6 +213,31 @@ npm run test:agent-loop
 
 The Fusion SDK/RPC/scripted-provider tests install a deterministic fake child `pi` in a temp `PATH` from `tests/helpers/fusion-fake-pi.ts`. Parent Pi remains the real SDK/RPC runtime; only direct child `pi --mode text` calls with the package-owned private compact metadata extension are intercepted. SDK coverage proves the Fusion tools return after durable no-child preflight without waiting for delayed children, transfer cancellation ownership away from the completed tool call, remain tracked through status/dock/kill/notification, verify manifest-bound `result.json` plus `merged.md`, and attach complete usage on the first `bg_result` retrieval exactly once. The scripted provider proves launch → no-poll parent response → terminal wake → `bg_result` → verified answer. `PI_CODING_AGENT_DIR` is pointed at the temp agent directory so `fusion-models.json` is never read from the user's real global Pi directory. Fusion v1 public-surface coverage asserts exactly four tools (`fusion_reason`, `fusion_investigate`, `fusion_research`, `fusion_validate`), no public capability argument, retired-tool active-tool removal, `/fusion` mapping to reason/no-tool candidates, closed schemas with Google-compatible enum status, targeted URL fetch not search, URL exfiltration warnings, strict validation verification rules, historical v4 rendering without old-tool activation, and actionable migration errors for `fusion_validate({prompt})`. Fusion context coverage covers both reason conversation projection and clean-task non-interference invariants, including parent-sentinel absence from every clean downstream prompt/artifact and byte-identical clean inputs across unrelated parent sessions. `tests/unit/fusion-context-prompts.test.ts` verifies that a synthetic session carrying more than 1 MB of tool arguments/results still yields a small canonical input, that user and assistant text survive verbatim, that thinking and tool payloads never appear (including no head/tail/preview sentinel), that omission counts, byte totals, and hashes are exact and stable, that repeated construction is byte-identical, that the active Fusion tool leaf and sibling calls stay scope-excluded, that images remain marker-only or ledger-only with no raw base64 in child prompts, and that every retained source block receives exactly one disposition. `tests/unit/fusion-high-cardinality.test.ts` covers the receipt-cardinality regression: a session of many short interleaved tool events (rather than a few enormous results) pins per-receipt cost, proves the compact `omitted_activity` fields are the only model-facing ones, reconciles every receipt against the ledger through `projection_map`, and proves the whole workflow fits a real route budget. `tests/unit/fusion-budget.test.ts` covers stage budgets and stage-local refusal wording; orchestrator coverage derives terminal run progress from durable attempts after usage persistence so late evaluator/merge refusal reports completed, failed, cancelled, and not-started truth instead of claiming zero children. Each route reserves the larger of Fusion's output contract and the model's declared maximum output, the limiting model is selected by conservative byte capacity (including when it is the evaluator rather than a candidate), unknown or too-small capacities fail before spawn, boundary prompts pass at exactly the limit and fail one byte past it, the child system prompt counts as input, dense multi-byte UTF-8 cannot bypass byte accounting, and candidate, evaluator, evaluation-repair, and merger expansions are each rejected before their child is spawned with zero partial launches. `tests/unit/fusion-pi-child.test.ts` covers the post-launch `fusion-runtime-guard.v2` protocol, BUG-185 removal of live token/output-reservation admission, stable payload normalization, 550-request/600-tool limits enforced by child guards and parent-sealed evidence, the 32 MiB aggregate tool-result ceiling enforced at both boundaries, malformed or duplicate evidence rejection, typed parent errors, and failed audit sealing. `tests/unit/fusion-claude-cache.test.ts` pins native pre-serialization `ttl: "1h"` requests, explicit short/none/long policy, call-level compaction opt-out, model compatibility fallback, non-mutation, the four-breakpoint ceiling, subscription prompt-caching-scope beta idempotence, malformed-control refusal, and distinct `child_cache_policy_invalid` parent errors. Child argv tests pin the package attribution/sanitization → runtime-governor order; root attribution tests pin linked OAuth account/device/session metadata, all exact-match sanitizer variants, beta-resource request shape, cache surfaces, one-hour provider usage pricing, duplicate-owner suppression, and the 200K subscription policy. Compact/result usage tests preserve Anthropic `cacheWrite1h` and provider `reasoning` subsets, and child metadata binds each requested/effective payload observation plus JSON-rendered output accounting in `fusion-child-result.v4`. Live subscription-OAuth acceptance on 2026-08-04 proved cold writes plus exact-repeat reads on Sonnet 4.5 and Opus 5 while both reported `cacheWrite1h = 0`. Separate normal-spawn and exact Fusion-child Opus 5 controls—with unique prompts—still read their caches after 370 idle seconds; the Fusion control wrote and reread 9,922 tokens through the attribution/sanitization → governor path. Documentation therefore treats positive `cacheWrite1h` as definitive but zero as inconclusive on subscription OAuth; payload intent, provider itemization, and behavioral lifetime remain separate evidence. Terminal `fusion-child-settlement.v3` is published only at `agent_settled`; recovered non-final provider errors must be zero-content/zero-usage retry markers named by that settlement, and one non-final candidate `stop` is accepted only when it is a hash-bound oversized original immediately followed by a same-session replacement. Failed/cancelled Fusion coverage also verifies canonical manifest-bound `failure-summary.json` evidence with no stage-output bodies, truthful classifications/omission receipts, subordinate one-shot summary persistence after `writeError`, and typed answer-free `bg_result` terminal views that never claim usage or expose partial output. `tests/scripted-provider/fusion-output-recovery.test.ts` drives a real Pi print-mode process and proves one PID/session context, one queued continuation before settlement, tool removal on turn two, original-artifact preservation, and replacement-only stdout. Missing/duplicate/tampered/failed settlements or substantive error records remain fatal. `tests/scripted-provider/fusion-runtime-guard.test.ts` drives a real Pi agent loop through Pi's `openai-codex-responses` adapter against local HTTP and proves provider-payload transforms chain in load order and `ctx.abort()` prevents transport for the execution/cache-policy refusals that remain. `tests/package/typebox-compat.test.ts` pins the TypeBox posture and compiles nullable-array schemas. The release-only `npm run test:compat` packs the package, installs exact supported Pi versions, runs `/jobs`, runs `/fusion` through the installed package entrypoint with the fake child Pi, verifies five child invocations, verifies `/fusion-models` rejects non-TUI mode, requires each supported Pi line to declare terminal `agent_settled` and `before_provider_request`, verifies the installed Anthropic adapter exposes cache breakpoints plus long/tool compatibility controls, asserts the resolved `typebox` is Pi's bundled peer rather than a private or nested copy, and scans the installed package bytes for TypeBox APIs removed in the 1.3.x line. Pi 0.75.5 is intentionally unsupported because it lacks the terminal event required to seal a Fusion audit after retries and compaction. It then drives the current host Pi through a real RPC `fusion_reason` parent-agent loop, checks the persisted tool result carries the complete Pi `Usage.cost` object, invokes `get_session_stats` (the same aggregation boundary used by the TUI footer), reopens the durable session, and verifies identical token/cost totals. All parent and child inference remains deterministic and local.
 
+### D1 reload-survival gates
+
+D1 is opt-in ordinary-shell behavior. Run it with isolated roots and serial real lifecycle tests:
+
+```bash
+node node_modules/tsx/dist/cli.mjs --test --test-concurrency=1 \
+  tests/unit/reload-shell-owner.test.ts \
+  tests/unit/registry.test.ts \
+  tests/unit/extension-api.test.ts \
+  tests/unit/windows-taskkill.test.ts \
+  tests/unit/posix-invariance.test.ts
+node node_modules/tsx/dist/cli.mjs --test --test-concurrency=1 \
+  tests/sdk/reload-survival-sdk.test.ts \
+  tests/sdk/sdk.test.ts \
+  tests/sdk/lifecycle-sdk.test.ts \
+  tests/sdk/fusion-sdk.test.ts
+npm run test:component
+```
+
+The real SDK suite uses counted `AgentSession.reload()` and actual POSIX processes for same-child continuity, a deterministic nonzero loader gap, fresh status/log/kill and slash commands, repeated handoff, original timeout, shell-policy refresh, leader-exit plus TERM-ignoring descendant proof, default kill control, copied-JSON nonadoption, and actual runtime new/switch/fork/clone/dispose refusal. Owner/registry units pin structural global reuse, exact identity, two-phase claims, stale/conflict errors, fixed no-claim cleanup, admission commit, cumulative cap, publication attempts, retention/reentrancy inheritance, and injected Windows taskkill ownership. Permanent race cases additionally prove that failed post-spawn admission retains its real child authority until natural terminal settlement, a reentrant reload-detach emitter throw remains pending for fresh cumulative attempt two, and a child closing after the deadline stop wait releases the orphaned slot so a later activation can bind.
+
+`tests/windows/windows-integration.test.ts` remains the native qualification gate and deliberately fails off Windows. Mocked Windows branches do not count as native evidence. D1 remains blocked for Windows until native continuity, post-reload descendant kill, original timeout/cap, gap completion, helper/handle uniqueness, and no-claim tree cleanup all pass. Pi 0.84/0.86 empty or mode-only binding after reload and direct `AgentSession.dispose()` are permanent host-characterization cases, not passes; normal modes/counted binding and `AgentSessionRuntime.dispose()` are supported.
+
+Passing real-process cases contain no success-path rescue. A failure-only `finally` rescue must be disclosed if an assertion fails, and every fixture PID/group must be gone before its temporary root is removed.
+
 ## Coverage summary
 
 Implemented coverage includes:
@@ -213,7 +253,7 @@ Implemented coverage includes:
 - durability: `tests/unit/durable-fs.test.ts` covers the shared `src/core/durable-fs.ts` primitive used for metadata, event/stderr buffers, attestations, delegate/Fusion artifacts, and configuration — single-open write/sync/close ordering, exclusive `wx` temp creation at `0o600`, direct `w` writes with inherited mode, never reopening a pathname merely to flush it, temp ownership, primary-versus-cleanup error precedence, `renameCompleted` after a post-rename directory failure, the Windows directory-sync skip, atomic replacement, and fatal `fsync` failures. Ordinary task `.output` is a streaming file ended/drained before terminal metadata and is not explicitly fsynced. `tests/package/package.test.ts` mutation guards pin the durable-helper invariants
 - safety: kill, already-finished kill failure, timeout failure, spawn failure, low output-cap failure, multi-task shutdown cleanup, POSIX process-group kill fallback, Windows `taskkill /T` then `/T /F` tree termination with shared soft attempts, soft-abort-on-force, exit-128 race tolerance, loud force failures, no root-only fallback, SIGKILL escalation that terminates instead of re-arming (a SIGKILL never schedules a further escalation, and concurrent stop requests share exactly one escalation timer that is cleared on finalize), duplicate finalization/notification races, metadata/notification failure handling, and pruning
 - agent loop: deterministic scripted-provider coverage against `extensions/background-tasks.ts` for actual event-driven `bg_run` behavior. The provider observes the effective system prompt, public tool descriptions, and real launch receipt and deliberately emits the pre-fix `bg_status` poll if any contract layer is absent; the passing path proves one launch, no sleep/status/log polling, one durable terminal notification, and exactly one follow-up turn. It also covers notification-only `triggerOnCompletion:false`, `/bg` display-only behavior, `notifyOnCompletion:false`, failed-task notification error fields, and parent-model `fusion_reason` tool use followed by normal parent response
-- package: manifest, docs, ordered `pi.extensions`, exported `src/core/extension-api.ts`, registry-only production dependencies, peer dependency/import parity, packed runtime files/notices, tarball-install smoke, direct-completion import bans, test/helper/script/artifact exclusion, isolated offline npm installation, exact-version compatibility, and current-host persisted/replayed tool-usage safety
+- package: manifest, docs, ordered `pi.extensions`, exported `src/core/extension-api.ts`, registry-only production dependencies, peer dependency/import parity, packed runtime files/notices, tarball-install smoke, direct-completion import bans, test/helper/script/artifact exclusion, compiler-tree type-escape and file-URL provenance guards, explicitly prepared isolated offline npm installation with an empty-cache negative control and real transitive load, exact-version compatibility, and current-host persisted/replayed tool-usage safety
 
 ## PTY notes
 

package/TEST_PLAN.md

@@ -13,7 +13,7 @@ The table below remains the exhaustive acceptance source. Do not replace it with
 | Field | Value |
 |---|---|
 | Package | `pi-background-tasks` |
-| Extension entrypoints | `extensions/anthropic-attribution.ts`, `extensions/background-tasks.ts` |
+| Extension entrypoints | `dist/extensions/anthropic-attribution.js`, `dist/extensions/background-tasks.js` (compiled from authoritative `extensions/*.ts`) |
 | Public commands | `/bg`, `/jobs`, `/logs`, `/kill`, `/tasks`, `/bg-tasks`, `/bg-clear`, `/bg-update`, `/claude-cache`, `/fusion`, `/fusion-models` |
 | Public tools | `bg_run`, `bg_delegate`, `bg_result`, `bg_run_pi_attested`, `bg_status`, `bg_logs`, `bg_kill`, `fusion_reason`, `fusion_investigate`, `fusion_research`, `fusion_validate` |
 | Extension EventBus API | `pi-background-tasks:request:v1`, `pi-background-tasks:response:v1`, `pi-background-tasks:terminal:v1`; schemas exported from `src/core/extension-api.ts` |
@@ -28,6 +28,7 @@ The table below remains the exhaustive acceptance source. Do not replace it with
 | Gate | Command | Required in default `npm run test`? | Status |
 |---|---|---:|---|
 | Typecheck | `npm run typecheck` | yes | implemented |
+| Type safety | `npm run test:type-safety` | yes | implemented; compiler syntax-tree checks distinguish real top types, directly nested assertions through parentheses/`satisfies`, production non-null expressions, and compiler-recognized suppression comments from inert text; alias-separated assertions remain outside this syntactic rule |
 | Unit | `npm run test:unit` | yes | implemented |
 | SDK | `npm run test:sdk` | yes | implemented |
 | RPC | `npm run test:rpc` | yes | implemented |
@@ -65,7 +66,8 @@ SDK/RPC/scripted-provider/package/compatibility coverage asserts exactly four to
 
 | Feature | Public surface | Unit | SDK | RPC | Component | PTY | Package | Scripted provider | Notes |
 |---|---|---:|---:|---:|---:|---:|---:|---:|---|
-| Start background command from UI command | `/bg` | yes |  | yes |  | yes |  |  | Unit covers `--name` and `--agent`; RPC/PTY start real processes. |
+| Start background command from UI command | `/bg` | yes | D1 real lifecycle | yes |  | yes |  |  | Unit covers `--name`, `--agent`, one bare `--survive-reload`, `--` literal handling, duplicate/assignment refusal, and agent conflict; RPC/PTY start default real processes. D1 SDK invokes the real command across reload and fresh `/jobs`, `/logs`, `/kill`. |
+| Opt-in same-process ordinary shell reload survival (D1/#6) | `bg_run.surviveReload`, `/bg --survive-reload`, `reload-shell-owner.v1` | yes | yes | EventBus terminal only | rerun flag | default dock controls | source/docs payload |  | Default remains kill-on-reload. Unit pins structural process-global identity `(pid, exact session, real cwd)`, random nonces/generations, two-phase claim, stale/conflict/incompatible errors, admission commit, fixed deadline plus late-close slot release, failed-admission authority retention, copied-JSON/PID nonadoption, original timeout/cumulative cap/policy, reentrant-handoff cumulative R1 publication/notification state, POSIX proof, and injected Windows taskkill. Real counted SDK covers same child/id/PID/nonce/path/output over repeated `AgentSession.reload()`, nonzero gap completion, commands/tools, original timeout, policy refresh, leader-exit/TERM-ignoring descendant, and actual runtime new/switch/fork/clone/dispose kill. V1 request remains closed and cannot request survival; delegate/Fusion/managed/attested inputs refuse. Empty/mode-only SDK reload and direct `AgentSession.dispose()` are blocked upstream; crash/restart is unsupported. Native Windows closure requires six real cases and is not certified by mocks. |
 | List tasks | `/jobs` |  |  | yes |  |  |  |  | RPC asserts running and killed task rows. |
 | Show bounded logs | `/logs <id> [maxBytes]` | yes |  | yes |  |  |  |  | Unit covers bounded reads; RPC verifies output/path. |
 | Kill running task | `/kill <id>` |  | yes | yes |  |  |  |  | SDK tool and RPC slash command. |
@@ -77,7 +79,7 @@ SDK/RPC/scripted-provider/package/compatibility coverage asserts exactly four to
 | Stop task from LLM tool | `bg_kill` |  | yes |  |  |  |  |  | Covers running kill and already-finished loud failure. |
 | Fusion command background launch | `/fusion`, managed task, terminal notification, `bg_result` | yes | yes | yes |  | yes | yes |  | Core unit covers deterministic projection, child argv/stdin/metadata parsing, artifacts, pre-abort handling, and orchestration. SDK verifies `/fusion` returns after durable preflight, all five child invocations continue in the managed task, terminal notification is emitted without a parent rewrite, editor/cancel behavior remains correct, and malformed config launches zero children. RPC verifies command discovery, Unicode request preservation, background terminal delivery, no parent `agent_start`, editor protocol, malformed-config admission failure, child failure notification, and child isolation flags. |
 | Fusion v1 background result | `fusion_reason`, `fusion_investigate`, `fusion_research`, `fusion_validate`, `bg_result` | yes | yes |  |  | current-host stats/replay | yes | yes | Exactly four workflow tools remain registered; each returns a managed-task receipt after durable no-child preflight. `bg_result` verifies manifest-bound `result.json`/`merged.md`, never truncates, and attaches complete `Usage` exactly once. Failed/cancelled retrieval returns `delivery:"none"` and a closed no-answer view backed only by verified, bounded `failure-summary.json` metadata/refs; it cannot claim usage or expose partial text. SDK pins non-blocking launch under delayed children, tool-signal ownership handoff, clean-context isolation, failure coordinates, shutdown cancellation, and repeated-retrieval no-double-counting. Scripted-provider coverage proves no polling between launch and terminal wake. |
-| Global Anthropic attribution and sanitization | package-owned `extensions/anthropic-attribution.ts`, `/claude-cache`, isolated child `--extension` argv | yes |  |  |  |  | yes | local SSE + subscription handoff | Package discovery loads attribution before background tasks for every installation. Unit pins all three exact SPS-derived sanitization variants, non-Anthropic non-mutation, provider/session/account/device metadata, beta-resource transport, cache surfaces, one-hour pricing, the 200K subscription contract, and EventBus duplicate-owner suppression. BUG-192 coverage pins provider/api/model-aware Codex/ZAI signature removal, foreign-redacted omission, lineage-proven empty/redacted/non-BMP Claude replay, directional older-Claude→Fable 5.1 compatibility, long→short→long signature-epoch isolation plus stale-prefix/reverse denial, canonical collision-checked tool IDs, stable text-tool-result prefixes, deterministic repeated payloads, official Fable binding/cache-diagnostics betas, fail-before-network profile drift, one-shot hash-bound compaction epochs, one-hour controls, away/back model lanes, exact official HTTPS endpoint/no-redirect policy, strict error/EOF/`message_stop` SSE completion, and official $0.25/M cache-read accounting. BUG-193 coverage proves hookless compaction/branch-summary requests derive mandatory attribution from Pi's fresh request-scoped `options.sessionId`, retain zero cache markers, isolate concurrent IDs, expose an already-attributed payload to optional middleware exactly once, preserve a frozen ordinary-turn payload hash, and reject route, metadata, system-identity, cache-topology, and excess-breakpoint tampering before fetch. The stubbed-fetch no-network loop exercises the real custom transport without weakening its production endpoint policy; release evidence uses subscription OAuth only. Fusion Anthropic routes receive exactly two explicit extensions in order: global attribution/sanitization, then runtime governor. Delegate and attested Anthropic routes also load attribution explicitly because attribution cannot rely on ambient discovery; delegates do so in both isolated and ambient modes. Non-Anthropic argv does not resolve or add attribution. Missing bytes fail loudly; the package has no exotic/URL sanitizer dependency. The independent repo-local spawn extension is byte-parity tested but imports nothing from this package. |
+| Global Anthropic attribution and sanitization | package-owned compiled attribution entrypoint, `/claude-cache`, isolated child `--extension` argv | yes |  |  |  |  | yes | local SSE + subscription handoff | Package discovery loads attribution before background tasks for every installation. Unit pins all three exact SPS-derived sanitization variants, non-Anthropic non-mutation, provider/session/account/device metadata, beta-resource transport, cache surfaces, one-hour pricing, the 200K subscription contract, and EventBus duplicate-owner suppression. BUG-192 coverage pins provider/api/model-aware Codex/ZAI signature removal, foreign-redacted omission, lineage-proven empty/redacted/non-BMP Claude replay, directional older-Claude→Fable 5.1 compatibility, long→short→long signature-epoch isolation plus stale-prefix/reverse denial, canonical collision-checked tool IDs, stable text-tool-result prefixes, deterministic repeated payloads, official Fable binding/cache-diagnostics betas, fail-before-network profile drift, one-shot hash-bound compaction epochs, one-hour controls, away/back model lanes, exact official HTTPS endpoint/no-redirect policy, strict error/EOF/`message_stop` SSE completion, and official $0.25/M cache-read accounting. BUG-193 coverage proves hookless compaction/branch-summary requests derive mandatory attribution from Pi's fresh request-scoped `options.sessionId`, retain zero cache markers, isolate concurrent IDs, expose an already-attributed payload to optional middleware exactly once, preserve a frozen ordinary-turn payload hash, and reject route, metadata, system-identity, cache-topology, and excess-breakpoint tampering before fetch. The stubbed-fetch no-network loop exercises the real custom transport without weakening its production endpoint policy; release evidence uses subscription OAuth only. Fusion Anthropic routes receive exactly two explicit extensions in order: global attribution/sanitization, then runtime governor. Delegate and attested Anthropic routes also load attribution explicitly because attribution cannot rely on ambient discovery; delegates do so in both isolated and ambient modes. Non-Anthropic argv does not resolve or add attribution. Missing bytes fail loudly; the package has no exotic/URL sanitizer dependency. The independent repo-local spawn extension is byte-parity tested but imports nothing from this package. |
 | Fusion validation workflow | structured `fusion_validate`, workflow profiles, `fusion-manifest.v4`, `fusion-result.v5` | yes | yes |  |  |  | yes |  | Public validation rejects legacy `{prompt}` with a migration error, enforces non-empty `scope`/`acceptanceCriteria`, and loudly validates `verification` cross-fields (`provided` ↔ evidence, `not_run` ↔ reason). Core validate orchestration is clean/read-only/advisory, enforces source-finding accounting including singleton, duplicate, exclusion, and merger add/drop cases, and remains no build/test substitute claim. |
 | Fusion context boundaries | canonical input `fusion-input.v5`, reason `context-omission-ledger.json`, clean-task inputs | yes | yes | yes |  |  | yes |  | Unit covers reason/session projection for a >1 MB synthetic tool-heavy session, verbatim user/assistant text, thinking exclusion, zero tool-payload preview bytes, exact and stable omission counts/byte totals/hashes, compact tuple round-trip, receipt-to-ledger reconciliation, active-tool-call-leaf and sibling-call exclusion, and byte-identical repeated construction. Clean-task tests assert investigate/research/validate inputs omit parent system prompt, conversation projection, and omission ledger, stay byte-identical across unrelated parent sessions, and keep parent sentinels out of every clean downstream prompt and artifact. SDK/RPC verify clean validate stdin has no `conversation_projection` or transcript while `/fusion`/reason preserve the projected-conversation path. |
 | Fusion stage budgets | `budget-plan.json` (v4 per-stage forecasts), typed `prompt_budget_exceeded_forecast` / `prompt_budget_exceeded_measured` | yes |  |  |  |  |  |  | Unit covers stage-local launch-refusal wording plus terminal progress derived from durable attempts and persisted usage, so late evaluator/repair/merger budget failures report completed, failed, cancelled, and not-started run truth. Unit also covers the per-family affine estimator, additive segment accounting, multibyte 1.0-token/byte charging, unknown-provider floor visibility, per-route reservation of `max(Fusion output contract, model maximum output)`, byte-capacity route selection, scope guards for small windows, input-only fatal preflight versus warning-only reservations, rejection of unknown/zero/negative/too-small context windows, boundary accept at exactly the limit and reject one byte past, the child system prompt counted as input, per-stage forecasts built from the real prompt builders against each stage's own route, reservation warnings, breach-detector artifacts, safe prompts completing all five calls, persisted route/plan snapshots including negative slack on fatal rejection, and the reproduced 1 MB failure shape now fitting the smallest configured budget. Errors carry stage, measured size, allowed size, limiting model, estimator source, and remediation in both structured detail and message text. |
@@ -124,8 +126,9 @@ SDK/RPC/scripted-provider/package/compatibility coverage asserts exactly four to
 | Output cap kills task | `PI_BG_MAX_OUTPUT_BYTES` |  |  | yes |  |  |  |  | RPC runs with a low cap and asserts failed status/log notice. |
 | Shutdown cleanup | `session_shutdown` | yes | yes |  |  |  |  |  | SDK asserts multiple running tasks become killed; registry tests cover shared stop/wait behavior. |
 | Process lifecycle/races | registry core | yes | yes | yes |  | yes |  | yes | Unit tests cover POSIX process-group fallback, Windows `taskkill /T` then `/T /F` tree termination, SIGKILL escalation, duplicate finalization/notification races, notification/metadata failures, pruning, malformed telemetry, split telemetry chunks, large telemetry records above the old 16KiB buffer, and wrapped-agent transcript/telemetry separation with split-chunk and trailing-partial flush; SDK/RPC cover runtime spawn/timeout/output-cap/shutdown; scripted provider covers wakeup integration. |
+| Compiler/source safety guards | package TypeScript and file-URL path handling |  |  |  |  |  | yes |  | TypeScript compiler trees reject actual explicit `any` types, directly nested assertions through multiline/parenthesized/`satisfies` wrappers, production non-null expressions, and recognized `@ts-ignore`/`@ts-expect-error`/`@ts-nocheck` comments while allowing inert comment/string/template/regex text. Alias-separated assertions are intentionally outside the direct-syntax rule, preserving validated `unknown` boundaries without claiming whole-program soundness. The URL guard separates syntax-wide self-contained hazards from finite flow provenance, with distinct normal/break/continue/return/explicit-throw completions and `finally` processing. It uses WHATWG preprocessing/absolute-first classification for static strings and static-head templates; `./`/`../` heads use explicit bases, while proven absolute first values ignore them. It covers inline/variable/import-meta provenance, constructor/object/`pathToFileURL` aliases, exact lowercase `import.meta['url']` versus uppercase intrinsic `globalThis['URL']` keys, computed pathname keys, declaration/assignment/statically known `for...of` destructuring, and Windows drive/UNC fixtures; and retains any explicitly traced may-file branch. Unknown dynamic first values remain unknown but join an explicit base as a possible relative branch; known absolute HTTP(S), definite overwrites, and compiler-resolved shadowed `URL`/`globalThis` bindings are controls. Calls, implicit exceptions, interprocedural/later-closure effects, and heap/proxy mutation are documented limits; no source-file allowlist suppresses findings. |
 | Package manifest | `package.json` |  |  |  |  |  | yes |  | Keywords, ordered `pi.extensions`, files/notices, registry-only production dependencies, local smoke/compat scripts, and direct-completion import bans. |
-| Pack contents | `npm pack --dry-run`, `npm run test:pnpm-pack` |  |  |  |  |  | yes |  | Runtime files and third-party notice included; tests, fake child helpers, release-only scripts, artifacts, nested tarballs, and `node_modules` excluded. Default npm tarball install uses isolated HOME/XDG/npm cache and offline peer-ignore installation. Linux CI separately installs the tarball with pnpm 11.18.0 and `blockExoticSubdeps: true`. |
+| Pack contents | `npm pack --dry-run`, `npm run test:pnpm-pack` |  |  |  |  |  | yes |  | Runtime files and third-party notice included; tests, fake child helpers, release-only scripts, artifacts, nested tarballs, and `node_modules` excluded. Default npm tarball coverage proves an empty cache fails loudly, then seeds a separate empty task-owned cache only from a loopback registry built from lifecycle-free portable archives of the real installed Turndown/Domino production closure. A task-owned executable `prepack`/`prepare`/`postpack` sentinel pins npm 10.9.3's unsafe `--ignore-scripts` prepare behavior and npm 11.13.0's denial, proves the fixture path executes zero hooks, preserves script-bearing manifest bytes, and leaves source hashes unchanged. Every npm subprocess uses explicit task-owned user/global config, an isolated project cwd/config, `GIT_ALLOW_PROTOCOL=file`, and absolute archive/pack/install operands; a config-only hostile scoped-registry control performs no request. The registry is closed before `--offline` install, and Turndown executes with its Domino transitive dependency. Linux CI separately installs the tarball with pnpm 11.18.0 and `blockExoticSubdeps: true`. |
 | Maintainer docs gateway | `BACKGROUND-TASKS-INSTRUCTIONS.md` | docs focused |  |  |  |  |  |  | Gateway requires INDEX → read-before-edit → owning-doc navigation, records current docs generate/verify/attestation workflow, preserves subscription-only frontier routing, parent/child tool separation, durability/integrity, and no self-certification. Logo reference is package-local (`docs/assets/logo.svg`) when the asset-owner file is present. |
 | Shared architecture/API/runtime/operations docs | `docs/api`, `docs/concepts`, `docs/subsystems`, `docs/reference`, `docs/operations` | docs focused |  |  |  |  |  |  | The active docs engine validates frontmatter, package-local links/reference links, INDEX reachability, exact behavioral source ownership, generated runtime contracts, deterministic generated regions, and manifest freshness. Semantic receipt state is reported by default and enforced only by the optional strict attestation command. Unsupported extraction and legacy placeholders fail closed. |
 | Package maintenance version/tag wording | `PUBLISHING.md`, `docs/operations/releasing.md` | docs focused |  |  |  |  |  |  | Release commands derive `VERSION` from `package.json`; observed git tags stop at `v0.6.0`, so git install/tag certification is separate from npm publishing and no nonexistent v1 tag is advertised. |

package/dist/extensions/anthropic-attribution-child.js

@@ -0,0 +1,4 @@
+// Always-on safety entrypoint for package-owned isolated Anthropic children.
+// Ambient parent capability selection must never disable this extension.
+export { default } from '../src/core/anthropic-attribution.js';
+//# sourceMappingURL=anthropic-attribution-child.js.map

package/dist/extensions/anthropic-attribution-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-attribution-child.js","sourceRoot":"","sources":["../../extensions/anthropic-attribution-child.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,yEAAyE;AACzE,OAAO,EAAE,OAAO,EAAE,MAAM,sCAAsC,CAAC","sourcesContent":["// Always-on safety entrypoint for package-owned isolated Anthropic children.\n// Ambient parent capability selection must never disable this extension.\nexport { default } from '../src/core/anthropic-attribution.js';\n"]}

package/dist/extensions/anthropic-attribution.js

@@ -0,0 +1,107 @@
+import { parseBackgroundTasksConfig } from '../src/core/config.js';
+const ANTHROPIC_PROVIDER = 'anthropic';
+function captureProviderSnapshot(registry) {
+    const effective = registry.getProvider(ANTHROPIC_PROVIDER);
+    if (effective === undefined) {
+        throw new Error('pi_anthropic_attribution_unsupported: the host exposes no effective anthropic provider to preserve');
+    }
+    return {
+        effective,
+        legacy: registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER),
+        native: registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER),
+    };
+}
+function confirmProviderInstallation(registry, before) {
+    const token = registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER);
+    const native = registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER);
+    const effective = registry.getProvider(ANTHROPIC_PROVIDER);
+    // The accepted duplicate-owner protocol returned without registering anything.
+    if (token === before.legacy && native === before.native && effective === before.effective) {
+        return undefined;
+    }
+    if (token === undefined ||
+        token === before.legacy ||
+        native !== undefined ||
+        effective === undefined ||
+        effective === before.effective ||
+        token.streamSimple === before.legacy?.streamSimple) {
+        throw new Error('pi_anthropic_attribution_install_failed: host provider registration did not install the package transport atomically');
+    }
+    return { registry, before, token };
+}
+function sameConfigValues(left, right) {
+    const leftKeys = Object.keys(left).sort();
+    const rightKeys = Object.keys(right).sort();
+    return (leftKeys.length === rightKeys.length &&
+        leftKeys.every((key, index) => key === rightKeys[index] && Object.is(Reflect.get(left, key), Reflect.get(right, key))));
+}
+function restoreProviderInstallation(installation) {
+    const { registry, before, token } = installation;
+    if (registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER) !== token ||
+        registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER) !== undefined) {
+        // A later owner replaced this exact installation. It owns teardown now.
+        return;
+    }
+    if (before.native !== undefined) {
+        registry.registerProvider(before.native);
+    }
+    else if (before.legacy !== undefined) {
+        // Native replacement removes only the still-current package legacy layer. Reapplying
+        // the prior legacy snapshot then starts from an empty legacy layer, so package-only
+        // fields cannot leak through ModelRuntime's documented merge semantics.
+        registry.registerProvider(before.effective);
+        registry.registerProvider(ANTHROPIC_PROVIDER, before.legacy);
+    }
+    else {
+        // The exact package token and absence of a later native owner were proven above.
+        // Public unregister is therefore owner-conditional here: it removes only this
+        // still-current package layer and restores the captured built-in source absence.
+        registry.unregisterProvider(ANTHROPIC_PROVIDER);
+    }
+    const restoredConfig = registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER);
+    const restoredNative = registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER);
+    const restoredEffective = registry.getProvider(ANTHROPIC_PROVIDER);
+    const restoredIds = registry.getRegisteredProviderIds();
+    const registrationRestored = before.legacy !== undefined
+        ? restoredNative === undefined &&
+            restoredConfig !== undefined &&
+            sameConfigValues(restoredConfig, before.legacy)
+        : restoredConfig === undefined &&
+            (before.native !== undefined
+                ? restoredNative === before.native
+                : restoredNative === undefined);
+    const streamIdentityRestored = before.legacy !== undefined
+        ? restoredConfig?.streamSimple === before.legacy.streamSimple
+        : restoredEffective?.streamSimple === before.effective.streamSimple;
+    const effectiveIdentityRestored = before.legacy !== undefined || restoredEffective === before.effective;
+    const registeredIdRestored = before.legacy !== undefined || before.native !== undefined
+        ? restoredIds.includes(ANTHROPIC_PROVIDER)
+        : !restoredIds.includes(ANTHROPIC_PROVIDER);
+    if (!registrationRestored ||
+        restoredEffective === undefined ||
+        !streamIdentityRestored ||
+        !effectiveIdentityRestored ||
+        !registeredIdRestored) {
+        throw new Error('pi_anthropic_attribution_restore_failed: the preexisting host provider was not restored by identity');
+    }
+}
+export default async function ambientAnthropicAttribution(pi) {
+    const config = parseBackgroundTasksConfig();
+    if (config.features.attribution) {
+        const { default: spawnAnthropicAttribution } = await import('../src/core/anthropic-attribution.js');
+        let installation;
+        pi.on('session_start', (_event, context) => {
+            const registry = context.modelRegistry;
+            const before = captureProviderSnapshot(registry);
+            spawnAnthropicAttribution(pi);
+            installation = confirmProviderInstallation(registry, before) ?? installation;
+        });
+        pi.on('session_shutdown', () => {
+            const current = installation;
+            installation = undefined;
+            if (current !== undefined)
+                restoreProviderInstallation(current);
+        });
+    }
+}
+//# sourceMappingURL=anthropic-attribution.js.map

package/dist/extensions/anthropic-attribution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-attribution.js","sourceRoot":"","sources":["../../extensions/anthropic-attribution.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,kBAAkB,GAAG,WAAW,CAAC;AAsBvC,SAAS,uBAAuB,CAAC,QAAuB;IACtD,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAC3D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,OAAO;QACL,SAAS;QACT,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;QAChE,MAAM,EAAE,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,QAAuB,EACvB,MAAwB;IAExB,MAAM,KAAK,GAAG,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IAE3D,+EAA+E;IAC/E,IAAI,KAAK,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,SAAS,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1F,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IACE,KAAK,KAAK,SAAS;QACnB,KAAK,KAAK,MAAM,CAAC,MAAM;QACvB,MAAM,KAAK,SAAS;QACpB,SAAS,KAAK,SAAS;QACvB,SAAS,KAAK,MAAM,CAAC,SAAS;QAC9B,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,MAAM,EAAE,YAAY,EAClD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sHAAsH,CACvH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CACvB,IAA8B,EAC9B,KAA+B;IAE/B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5C,OAAO,CACL,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM;QACpC,QAAQ,CAAC,KAAK,CACZ,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CACb,GAAG,KAAK,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CACzF,CACF,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,YAAkC;IACrE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC;IACjD,IACE,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,KAAK,KAAK;QAClE,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,KAAK,SAAS,EACtE,CAAC;QACD,wEAAwE;QACxE,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC3C,CAAC;SAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QACvC,qFAAqF;QACrF,oFAAoF;QACpF,wEAAwE;QACxE,QAAQ,CAAC,gBAAgB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC5C,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;SAAM,CAAC;QACN,iFAAiF;QACjF,8EAA8E;QAC9E,iFAAiF;QACjF,QAAQ,CAAC,kBAAkB,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;IAED,MAAM,cAAc,GAAG,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC;IAChF,MAAM,cAAc,GAAG,QAAQ,CAAC,2BAA2B,CAAC,kBAAkB,CAAC,CAAC;IAChF,MAAM,iBAAiB,GAAG,QAAQ,CAAC,WAAW,CAAC,kBAAkB,CAAC,CAAC;IACnE,MAAM,WAAW,GAAG,QAAQ,CAAC,wBAAwB,EAAE,CAAC;IACxD,MAAM,oBAAoB,GACxB,MAAM,CAAC,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,cAAc,KAAK,SAAS;YAC5B,gBAAgB,CAAC,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC;QACjD,CAAC,CAAC,cAAc,KAAK,SAAS;YAC5B,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS;gBAC1B,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC,MAAM;gBAClC,CAAC,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC;IACxC,MAAM,sBAAsB,GAC1B,MAAM,CAAC,MAAM,KAAK,SAAS;QACzB,CAAC,CAAC,cAAc,EAAE,YAAY,KAAK,MAAM,CAAC,MAAM,CAAC,YAAY;QAC7D,CAAC,CAAC,iBAAiB,EAAE,YAAY,KAAK,MAAM,CAAC,SAAS,CAAC,YAAY,CAAC;IACxE,MAAM,yBAAyB,GAC7B,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,iBAAiB,KAAK,MAAM,CAAC,SAAS,CAAC;IACxE,MAAM,oBAAoB,GACxB,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACxD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QAC1C,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAChD,IACE,CAAC,oBAAoB;QACrB,iBAAiB,KAAK,SAAS;QAC/B,CAAC,sBAAsB;QACvB,CAAC,yBAAyB;QAC1B,CAAC,oBAAoB,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,OAAO,CAAC,KAAK,UAAU,2BAA2B,CAAC,EAAmB;IAC3E,MAAM,MAAM,GAAG,0BAA0B,EAAE,CAAC;IAC5C,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,EAAE,OAAO,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CACzD,sCAAsC,CACvC,CAAC;QACF,IAAI,YAA8C,CAAC;QACnD,EAAE,CAAC,EAAE,CAAC,eAAe,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;YACzC,MAAM,QAAQ,GAAI,OAAqC,CAAC,aAAa,CAAC;YACtE,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;YACjD,yBAAyB,CAAC,EAAE,CAAC,CAAC;YAC9B,YAAY,GAAG,2BAA2B,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,YAAY,CAAC;QAC/E,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,GAAG,EAAE;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC;YAC7B,YAAY,GAAG,SAAS,CAAC;YACzB,IAAI,OAAO,KAAK,SAAS;gBAAE,2BAA2B,CAAC,OAAO,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC","sourcesContent":["import type { Provider } from '@earendil-works/pi-ai';\nimport type { ModelRegistry } from '@earendil-works/pi-coding-agent';\nimport type { PiContextLike, PiExtensionHost } from '../src/core/anthropic-attribution.js';\nimport { parseBackgroundTasksConfig } from '../src/core/config.js';\n\nconst ANTHROPIC_PROVIDER = 'anthropic';\n\ntype RegisteredProviderConfig = NonNullable<\n  ReturnType<ModelRegistry['getRegisteredProviderConfig']>\n>;\n\ninterface AmbientAttributionContext extends PiContextLike {\n  readonly modelRegistry: ModelRegistry;\n}\n\ninterface ProviderSnapshot {\n  readonly effective: Provider;\n  readonly legacy: RegisteredProviderConfig | undefined;\n  readonly native: Provider | undefined;\n}\n\ninterface ProviderInstallation {\n  readonly registry: ModelRegistry;\n  readonly before: ProviderSnapshot;\n  readonly token: RegisteredProviderConfig;\n}\n\nfunction captureProviderSnapshot(registry: ModelRegistry): ProviderSnapshot {\n  const effective = registry.getProvider(ANTHROPIC_PROVIDER);\n  if (effective === undefined) {\n    throw new Error(\n      'pi_anthropic_attribution_unsupported: the host exposes no effective anthropic provider to preserve',\n    );\n  }\n  return {\n    effective,\n    legacy: registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER),\n    native: registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER),\n  };\n}\n\nfunction confirmProviderInstallation(\n  registry: ModelRegistry,\n  before: ProviderSnapshot,\n): ProviderInstallation | undefined {\n  const token = registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER);\n  const native = registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER);\n  const effective = registry.getProvider(ANTHROPIC_PROVIDER);\n\n  // The accepted duplicate-owner protocol returned without registering anything.\n  if (token === before.legacy && native === before.native && effective === before.effective) {\n    return undefined;\n  }\n\n  if (\n    token === undefined ||\n    token === before.legacy ||\n    native !== undefined ||\n    effective === undefined ||\n    effective === before.effective ||\n    token.streamSimple === before.legacy?.streamSimple\n  ) {\n    throw new Error(\n      'pi_anthropic_attribution_install_failed: host provider registration did not install the package transport atomically',\n    );\n  }\n\n  return { registry, before, token };\n}\n\nfunction sameConfigValues(\n  left: RegisteredProviderConfig,\n  right: RegisteredProviderConfig,\n): boolean {\n  const leftKeys = Object.keys(left).sort();\n  const rightKeys = Object.keys(right).sort();\n  return (\n    leftKeys.length === rightKeys.length &&\n    leftKeys.every(\n      (key, index) =>\n        key === rightKeys[index] && Object.is(Reflect.get(left, key), Reflect.get(right, key)),\n    )\n  );\n}\n\nfunction restoreProviderInstallation(installation: ProviderInstallation): void {\n  const { registry, before, token } = installation;\n  if (\n    registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER) !== token ||\n    registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER) !== undefined\n  ) {\n    // A later owner replaced this exact installation. It owns teardown now.\n    return;\n  }\n\n  if (before.native !== undefined) {\n    registry.registerProvider(before.native);\n  } else if (before.legacy !== undefined) {\n    // Native replacement removes only the still-current package legacy layer. Reapplying\n    // the prior legacy snapshot then starts from an empty legacy layer, so package-only\n    // fields cannot leak through ModelRuntime's documented merge semantics.\n    registry.registerProvider(before.effective);\n    registry.registerProvider(ANTHROPIC_PROVIDER, before.legacy);\n  } else {\n    // The exact package token and absence of a later native owner were proven above.\n    // Public unregister is therefore owner-conditional here: it removes only this\n    // still-current package layer and restores the captured built-in source absence.\n    registry.unregisterProvider(ANTHROPIC_PROVIDER);\n  }\n\n  const restoredConfig = registry.getRegisteredProviderConfig(ANTHROPIC_PROVIDER);\n  const restoredNative = registry.getRegisteredNativeProvider(ANTHROPIC_PROVIDER);\n  const restoredEffective = registry.getProvider(ANTHROPIC_PROVIDER);\n  const restoredIds = registry.getRegisteredProviderIds();\n  const registrationRestored =\n    before.legacy !== undefined\n      ? restoredNative === undefined &&\n        restoredConfig !== undefined &&\n        sameConfigValues(restoredConfig, before.legacy)\n      : restoredConfig === undefined &&\n        (before.native !== undefined\n          ? restoredNative === before.native\n          : restoredNative === undefined);\n  const streamIdentityRestored =\n    before.legacy !== undefined\n      ? restoredConfig?.streamSimple === before.legacy.streamSimple\n      : restoredEffective?.streamSimple === before.effective.streamSimple;\n  const effectiveIdentityRestored =\n    before.legacy !== undefined || restoredEffective === before.effective;\n  const registeredIdRestored =\n    before.legacy !== undefined || before.native !== undefined\n      ? restoredIds.includes(ANTHROPIC_PROVIDER)\n      : !restoredIds.includes(ANTHROPIC_PROVIDER);\n  if (\n    !registrationRestored ||\n    restoredEffective === undefined ||\n    !streamIdentityRestored ||\n    !effectiveIdentityRestored ||\n    !registeredIdRestored\n  ) {\n    throw new Error(\n      'pi_anthropic_attribution_restore_failed: the preexisting host provider was not restored by identity',\n    );\n  }\n}\n\nexport default async function ambientAnthropicAttribution(pi: PiExtensionHost): Promise<void> {\n  const config = parseBackgroundTasksConfig();\n  if (config.features.attribution) {\n    const { default: spawnAnthropicAttribution } = await import(\n      '../src/core/anthropic-attribution.js'\n    );\n    let installation: ProviderInstallation | undefined;\n    pi.on('session_start', (_event, context) => {\n      const registry = (context as AmbientAttributionContext).modelRegistry;\n      const before = captureProviderSnapshot(registry);\n      spawnAnthropicAttribution(pi);\n      installation = confirmProviderInstallation(registry, before) ?? installation;\n    });\n    pi.on('session_shutdown', () => {\n      const current = installation;\n      installation = undefined;\n      if (current !== undefined) restoreProviderInstallation(current);\n    });\n  }\n}\n"]}

package/dist/extensions/background-tasks.js

@@ -0,0 +1,2 @@
+export { default } from '../src/extension.js';
+//# sourceMappingURL=background-tasks.js.map

package/dist/extensions/background-tasks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"background-tasks.js","sourceRoot":"","sources":["../../extensions/background-tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC","sourcesContent":["export { default } from '../src/extension.js';\n"]}

package/dist/extensions/delegate-child.js

@@ -0,0 +1,2 @@
+export { default } from '../src/delegate-child-extension.js';
+//# sourceMappingURL=delegate-child.js.map

package/dist/extensions/delegate-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegate-child.js","sourceRoot":"","sources":["../../extensions/delegate-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC","sourcesContent":["export { default } from '../src/delegate-child-extension.js';\n"]}

package/dist/extensions/fusion-child.js

@@ -0,0 +1,2 @@
+export { default } from '../src/fusion-child-extension.js';
+//# sourceMappingURL=fusion-child.js.map

package/dist/extensions/fusion-child.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fusion-child.js","sourceRoot":"","sources":["../../extensions/fusion-child.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC","sourcesContent":["export { default } from '../src/fusion-child-extension.js';\n"]}

package/dist/package.json

@@ -0,0 +1,5 @@
+{
+  "name": "pi-background-tasks",
+  "version": "2.6.0",
+  "type": "module"
+}

package/dist/src/core/anthropic-attribution-path.js

@@ -0,0 +1,24 @@
+import { existsSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+/**
+ * Resolve the package-owned always-on Anthropic child attribution extension.
+ *
+ * Package-owned child Pi processes disable ambient extension discovery, so they
+ * must explicitly load this safety entrypoint. It deliberately bypasses the
+ * independently selectable ambient parent capability. Keeping path resolution
+ * in one module prevents Fusion, delegation, and attested runs from deriving
+ * different package paths.
+ */
+export function resolveAnthropicAttributionExtensionPath(moduleUrl = import.meta.url, pathExists = existsSync) {
+    const modulePath = fileURLToPath(moduleUrl);
+    const extension = modulePath.endsWith('.ts')
+        ? 'anthropic-attribution-child.ts'
+        : 'anthropic-attribution-child.js';
+    const candidate = resolve(dirname(modulePath), '../../extensions', extension);
+    if (!pathExists(candidate)) {
+        throw new Error(`Anthropic attribution extension is missing: ${candidate}`);
+    }
+    return candidate;
+}
+//# sourceMappingURL=anthropic-attribution-path.js.map

package/dist/src/core/anthropic-attribution-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-attribution-path.js","sourceRoot":"","sources":["../../../src/core/anthropic-attribution-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,UAAU,wCAAwC,CACtD,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAC3B,aAAwC,UAAU;IAElD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,gCAAgC;QAClC,CAAC,CAAC,gCAAgC,CAAC;IACrC,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;IAC9E,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,+CAA+C,SAAS,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC","sourcesContent":["import { existsSync } from 'node:fs';\nimport { dirname, resolve } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\n/**\n * Resolve the package-owned always-on Anthropic child attribution extension.\n *\n * Package-owned child Pi processes disable ambient extension discovery, so they\n * must explicitly load this safety entrypoint. It deliberately bypasses the\n * independently selectable ambient parent capability. Keeping path resolution\n * in one module prevents Fusion, delegation, and attested runs from deriving\n * different package paths.\n */\nexport function resolveAnthropicAttributionExtensionPath(\n  moduleUrl = import.meta.url,\n  pathExists: (path: string) => boolean = existsSync,\n): string {\n  const modulePath = fileURLToPath(moduleUrl);\n  const extension = modulePath.endsWith('.ts')\n    ? 'anthropic-attribution-child.ts'\n    : 'anthropic-attribution-child.js';\n  const candidate = resolve(dirname(modulePath), '../../extensions', extension);\n  if (!pathExists(candidate)) {\n    throw new Error(`Anthropic attribution extension is missing: ${candidate}`);\n  }\n  return candidate;\n}\n"]}