pi-daddy 0.27.4 → 0.32.0

package/dist/definitions.js

@@ -1,164 +0,0 @@
-/**
- * Agent Skills (`SKILL.md`) as this package's definition format — ADR-0016.
- *
- * A subagent is a skill you spawn: the `SKILL.md` body becomes the child's system prompt
- * (`--append-system-prompt`) and `allowed-tools` becomes its capability ceiling, enforced through
- * `--tools`. That collapses a duplication `principal-pi-skills` already strains against, where
- * `plan`/`review`/`debug` exist twice — once as a skill and once as a subagent prompt — and are
- * generated from one contract precisely so the two cannot drift.
- *
- * **The spec's own words about `allowed-tools`:** *"a space-separated string of tools that are
- * pre-approved to run"*, marked **experimental**. Pre-approved, not enforced — the field declares intent
- * and blocks nothing, and implementations differ on whether they honour it at all. Turning that
- * declaration into something structural is this package's entire value here.
- *
- * **One inversion is deliberate and load-bearing.** In pi-subagents' frontmatter an absent `tools:` key
- * means *pi's full default toolset*, so an undeclared definition was the most powerful kind and any
- * parse failure produced a wildcard — the direction that caused R-28 and review finding F18. Here an
- * absent `allowed-tools` means **undeclared, therefore not spawnable**. A typo or an unreadable YAML
- * form now costs a refusal instead of a grant.
- */
-import { createHash } from "node:crypto";
-import { readFile } from "node:fs/promises";
-import { resolveSkillResources, skillResourceName } from "./skill-resources.js";
-import { CAPABILITY_NAMESPACE_PREFIXES } from "./capabilities.js";
-/**
- * Digest a definition's body.
- *
- * Over the **body alone**, deliberately: that is precisely the text the child receives, so a digest that
- * also covered the frontmatter would change when `description` was reworded and report an instruction
- * change that never happened. `allowed-tools` is already recorded in full on every record.
- */
-export function digestDefinition(definition) {
-    return {
-        name: definition.name,
-        source: definition.source,
-        sha256: createHash("sha256").update(definition.body, "utf8").digest("hex"),
-    };
-}
-/**
- * Read a `SKILL.md`.
- *
- * The frontmatter reader handles the subset these files use — `key: value`, block scalars (`>` / `|`),
- * and a one-level `metadata:` map. Anything it cannot read leaves the key **absent**, which for
- * `allowed-tools` means *undeclared* and therefore refused. That is the whole reason this parser can be
- * hand-rolled without the hazard its sibling in `agent-types.ts` carries.
- */
-export function parseSkillDefinition(source, text) {
-    const match = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
-    if (!match)
-        return null;
-    const fields = new Map();
-    const metadata = {};
-    const lines = match[1].split(/\r?\n/);
-    for (let i = 0; i < lines.length; i++) {
-        const kv = /^([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$/.exec(lines[i]);
-        if (!kv)
-            continue;
-        const [, key, rawValue] = kv;
-        const value = rawValue.trim();
-        // A folded/literal scalar: fold the indented continuation into one line. `principal-pi-skills`
-        // writes every description this way, and the sibling parser SKIPS these — which is safe there only
-        // because it never needs the value. Here a skipped `description` would be a missing required field.
-        if (value === ">" || value === "|") {
-            const parts = [];
-            for (let j = i + 1; j < lines.length; j++) {
-                if (!/^\s+\S/.test(lines[j]))
-                    break;
-                parts.push(lines[j].trim());
-                i = j;
-            }
-            fields.set(key, parts.join(" "));
-            continue;
-        }
-        // `metadata:` introduces a one-level map of string keys to string values (the spec's shape).
-        if (key === "metadata" && value === "") {
-            for (let j = i + 1; j < lines.length; j++) {
-                const item = /^\s+([A-Za-z_][A-Za-z0-9_-]*)\s*:\s*(.*)$/.exec(lines[j]);
-                if (!item)
-                    break;
-                metadata[item[1]] = item[2].trim().replace(/^["']|["']$/g, "");
-                i = j;
-            }
-            continue;
-        }
-        // A YAML collection/block we cannot parse is not an explicit empty ceiling.
-        if (key === "allowed-tools" && value === "") {
-            const nextValue = lines.slice(i + 1).find(line => line.trim() !== "" && !/^\s*#/.test(line));
-            if (/^\s+\S/.test(nextValue ?? ""))
-                continue;
-        }
-        fields.set(key, value);
-    }
-    const description = fields.get("description");
-    if (description === undefined)
-        return null;
-    return {
-        // Identity comes from the PATH. ADR-0013 learned this the hard way on the other format: pi keys
-        // skills by their directory, so trusting a frontmatter `name` lets our view and the loader's
-        // disagree about which file a name refers to. The spec requires `name` to match the parent
-        // directory anyway, so a mismatch is the file's defect and not something to honour.
-        name: skillResourceName(source),
-        description,
-        allowedTools: fields.get("allowed-tools"),
-        metadata: Object.keys(metadata).length > 0 ? metadata : undefined,
-        body: text.slice(match[0].length).trim(),
-        source,
-    };
-}
-/**
- * Turn a definition's `allowed-tools` into a capability ceiling.
- *
- * Name mapping is **lowercasing and nothing else**, deliberately. A translation table from Claude
- * Code's names to pi's would have to decide what `Glob` means, and pi has no glob tool — so the table
- * would either invent a grant or quietly drop one. Lowercasing leaves `Glob` as `tool:glob`, which the
- * catalog then refuses as unknown, naming the actual problem to whoever wrote the file.
- */
-export function ceilingForDefinition(definition) {
-    const raw = definition.allowedTools;
-    if (raw === undefined)
-        return { capabilities: [], patterns: [], undeclared: true };
-    const capabilities = new Set();
-    const patterns = [];
-    // The spec says space-separated. Commas are tolerated because `Read, Grep` is what people type, and
-    // accepting them grants nothing extra — it only avoids a comma becoming part of a capability name.
-    for (const entry of raw.split(/[\s,]+/).filter((e) => e.length > 0)) {
-        if (entry.includes("(")) {
-            patterns.push(entry);
-            continue;
-        }
-        // Every namespaced id passes through untouched; only a BARE tool name gets the `tool:` prefix and the
-        // lowercasing. `workspace:` was missing here after ADR-0035 taught `normaliseCapability` about it, so a
-        // definition declaring `allowed-tools: workspace:prod` produced `tool:workspace:prod` — a capability
-        // that names nothing, refused as unknown, and dropped by `init` as "probably a typo or an attack". Two
-        // spellings of one grammar with this one wrong is R-28's shape; the list is now shared.
-        if (CAPABILITY_NAMESPACE_PREFIXES.some((prefix) => entry.startsWith(prefix))) {
-            capabilities.add(entry);
-            continue;
-        }
-        capabilities.add(`tool:${entry.toLowerCase()}`);
-    }
-    return { capabilities: [...capabilities].sort(), patterns, undeclared: false };
-}
-/**
- * Read definitions from Pi's enabled resources, including installed packages and local overrides.
- * Resolver precedence and filters are shared with the capability catalog; unregistered npm packages
- * are not runtime resources until legacy init explicitly scaffolds them.
- */
-export async function loadDefinitions(cwd) {
-    const definitions = new Map();
-    for (const { path } of (await resolveSkillResources(cwd)).skills) {
-        let text;
-        try {
-            text = await readFile(path, "utf8");
-        }
-        catch {
-            continue;
-        }
-        const parsed = parseSkillDefinition(path, text);
-        if (parsed && !definitions.has(parsed.name))
-            definitions.set(parsed.name, parsed);
-    }
-    return definitions;
-}
-//# sourceMappingURL=definitions.js.map

package/dist/definitions.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../src/definitions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,6BAA6B,EAAE,MAAM,mBAAmB,CAAC;AAkBlE;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,UAA2B;IAC1D,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;KAC3E,CAAC;AACJ,CAAC;AAgCD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,MAAM,KAAK,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IACzC,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACnE,IAAI,CAAC,EAAE;YAAE,SAAS;QAClB,MAAM,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAE9B,+FAA+F;QAC/F,mGAAmG;QACnG,oGAAoG;QACpG,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,GAAG,EAAE,CAAC;YACnC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;oBAAE,MAAM;gBACpC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC5B,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YACjC,SAAS;QACX,CAAC;QAED,6FAA6F;QAC7F,IAAI,GAAG,KAAK,UAAU,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACvC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,2CAA2C,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACxE,IAAI,CAAC,IAAI;oBAAE,MAAM;gBACjB,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;gBAC/D,CAAC,GAAG,CAAC,CAAC;YACR,CAAC;YACD,SAAS;QACX,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,KAAK,eAAe,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YAC5C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAC7F,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC;gBAAE,SAAS;QAC/C,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAE3C,OAAO;QACL,gGAAgG;QAChG,6FAA6F;QAC7F,2FAA2F;QAC3F,oFAAoF;QACpF,IAAI,EAAE,iBAAiB,CAAC,MAAM,CAAC;QAC/B,WAAW;QACX,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC;QACzC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACjE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;QACxC,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAA2B;IAC9D,MAAM,GAAG,GAAG,UAAU,CAAC,YAAY,CAAC;IACpC,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IAEnF,MAAM,YAAY,GAAG,IAAI,GAAG,EAAc,CAAC;IAC3C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,oGAAoG;IACpG,mGAAmG;IACnG,KAAK,MAAM,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,sGAAsG;QACtG,wGAAwG;QACxG,qGAAqG;QACrG,uGAAuG;QACvG,wFAAwF;QACxF,IAAI,6BAA6B,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAC7E,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACxB,SAAS;QACX,CAAC;QACD,YAAY,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAW;IAC/C,MAAM,WAAW,GAAG,IAAI,GAAG,EAA2B,CAAC;IACvD,KAAK,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;QACjE,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAChE,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC;YAAE,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACpF,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC"}

package/dist/delegate-types.d.ts

@@ -1,146 +0,0 @@
-/**
- * The shapes `planDelegation` consumes and produces. Split out of `./delegate.ts` only to stay under the
- * 400-line module ceiling this project enforces mechanically; `./delegate.ts` re-exports all three, so
- * "the delegate module" remains one import for every caller.
- */
-import type { Capability, ResolveResult } from "./resolve.ts";
-import type { DefinitionDigest, SkillDefinition } from "./definitions.ts";
-import type { InheritableApproval } from "./approval.ts";
-import type { Catalog } from "./catalog.ts";
-import type { ApprovalBinding, CorrelationMetadata } from "./correlation.ts";
-import type { StructuredRefusal } from "./refusals.ts";
-export interface DelegationRequest {
-    task: string;
-    /**
-     * Capabilities the delegator wants the child to hold.
-     *
-     * Optional since ADR-0016: prefer `agent`, which names an operator-authored definition. This form
-     * lets the MODEL choose the capability set, which is the weaker arrangement — it is still bounded by
-     * the session grant (ADR-0008), so it cannot escalate, but nothing about it was reviewed by a human.
-     */
-    tools?: string[];
-    /**
-     * Name of a `SKILL.md` definition to spawn (ADR-0016).
-     *
-     * When given, the definition's `allowed-tools` is the ceiling and its body is the child's system
-     * prompt. The model chooses only *which* definition and *what* task; the capability set is the
-     * operator's, written down in a file.
-     */
-    agent?: string;
-    model?: string;
-    provider?: string;
-    thinking?: string;
-    /** Optional external join metadata. It never participates in capability authority. */
-    correlation?: CorrelationMetadata;
-    /**
-     * Trusted binding scope, supplied by the caller that actually resolved and leased the
-     * workspace. Deliberately separate from `correlation`, whose values are a model-supplied
-     * claim: reading the workspace id out of correlation let a bound approval be spent outside
-     * the workspace it named (R-110).
-     */
-    boundWorkspaceId?: string;
-    boundContextId?: string;
-}
-export interface DelegationContext {
-    ownGrant: Capability[];
-    depth: number;
-    maxDepth: number;
-    gated: Capability[];
-    /**
-     * Approvals in force for this delegation, with subject and scope (ADR-0014).
-     *
-     * One source of truth for two different questions. The **gate check here** honours every entry,
-     * including `once` — that approval applies to *this* spawn, which is exactly what the human said yes
-     * to. What crosses to the CHILD is `inheritApprovals`, which drops `once` and keeps the subject, so
-     * the same list cannot silently authorise a subtree.
-     */
-    approved?: InheritableApproval[];
-    ledgerPath?: string;
-    /** Path to this extension, so a child granted `tool:delegate` can delegate in turn. */
-    extensionPath?: string;
-    /** Live capability catalog. When supplied, capabilities absent from it are refused as unknown. */
-    catalog?: Catalog;
-    /**
-     * Absolute path per skill NAME, from the catalog's `source` field (R-32).
-     *
-     * Without it every granted `skill:` capability is unresolvable and the delegation is refused, which
-     * is the correct direction: a caller that cannot say where a skill lives cannot honestly grant it.
-     */
-    skillPaths?: Record<string, string>;
-    /** Let the child load `AGENTS.md` / `CLAUDE.md`. Default false — see `planSpawn`. */
-    contextFiles?: boolean;
-    /** Known `SKILL.md` definitions by name, for `DelegationRequest.agent` (ADR-0016). */
-    definitions?: Map<string, SkillDefinition>;
-    /**
-     * Build an INTERACTIVE plan — no `--print` — for an executor that drives the child after starting it.
-     *
-     * `runHerdrPane` requires this: `--print` makes pi process the prompt and exit, so it never reaches the
-     * interactive readiness `herdr agent start` waits for and the agent is never detected. Default is the
-     * non-interactive plan, because a governed child should not sit waiting for a human by accident.
-     */
-    interactive?: boolean;
-    /** Explicit host-owned pi persistence target; never model-facing and never enabled by archive observation. */
-    sessionFile?: string;
-    /**
-     * Total descendants this session may still create (`src/fanout.ts`). Split among children by the caller.
-     *
-     * Omitted means unbounded, which is the pre-fan-out behaviour and correct for a single blocking
-     * delegation — the accident that used to bound cardinality to one.
-     */
-    fanoutBudget?: number;
-    /** This session's ledger id, so a child's `parentId` names its real parent (F8). */
-    spawnId?: string;
-    /** Ledger id assigned to THIS child, distinguishing logical siblings (F8). */
-    childSpawnId?: string;
-    /** Unique identity assigned to THIS execution occurrence; never derive joins from childSpawnId. */
-    childExecutionId?: string;
-}
-export interface Delegation {
-    ok: boolean;
-    reason?: string;
-    /** Stable machine-readable refusal accompanying the unchanged human diagnostic. */
-    refusal?: StructuredRefusal;
-    args: string[];
-    /** Per-child environment — never merged into the parent's process.env. */
-    env: Record<string, string>;
-    effective: Capability[];
-    /**
-     * The result this plan was made from. **Required** (B-I3): while it was optional the extension
-     * guarded its ledger write with `if (ledgerPath && plan.result)`, silently dropping every refusal
-     * that returned before `resolve()` ran. The type is what keeps a new early exit auditable.
-     */
-    result: ResolveResult;
-    childDepth: number;
-    /**
-     * The capabilities this delegation asked for, whatever route named them.
-     *
-     * Carried on the plan rather than re-derived by the caller (the B-I3 lesson): with `agent`, the
-     * request names a DEFINITION and the capabilities come from its `allowed-tools`, so a ledger that
-     * read the tool parameters would record an empty request for every definition spawn.
-     */
-    requested: Capability[];
-    /** Ledger id for this child's readable logical position, if the caller assigned one (F8). */
-    childId?: string;
-    /** Unique identity for this occurrence, if the caller assigned one. */
-    executionId?: string;
-    /**
-     * Which operator-authored instructions this spawn used (ADR-0018).
-     *
-     * Absent for a `tools:`-style delegation, which has no definition and therefore no instructions to
-     * identify — and absent on an ADR-0017 authorisation refusal, which is decided before the file is read.
-     */
-    definitionDigest?: DefinitionDigest;
-    /** Trusted SHA-256 of the exact model-authored task. The task text itself is never stored. */
-    taskDigest: string;
-    /** Non-authoritative external join metadata, snapshotted at planning time. */
-    correlation?: CorrelationMetadata;
-    /** Exact approval scope, present when correlation/workspace context requested task-bound approval. */
-    approvalBinding?: ApprovalBinding;
-}
-/**
- * Plan a governed delegation. Pure: returns argv and env, spawns nothing.
- *
- * Fails closed on depth, on any requested capability the delegator does not hold, on gated capabilities
- * without approval, and on a grant that cannot narrow (a universal capability slipping through).
- */
-//# sourceMappingURL=delegate-types.d.ts.map

package/dist/delegate-types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegate-types.d.ts","sourceRoot":"","sources":["../src/delegate-types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC7E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAGvD,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,sFAAsF;IACtF,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,UAAU,EAAE,CAAC;IACpB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kGAAkG;IAClG,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACpC,qFAAqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,sFAAsF;IACtF,WAAW,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,8GAA8G;IAC9G,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,0EAA0E;IAC1E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB;;;;OAIG;IACH,MAAM,EAAE,aAAa,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,6FAA6F;IAC7F,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,8FAA8F;IAC9F,UAAU,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,mBAAmB,CAAC;IAClC,sGAAsG;IACtG,eAAe,CAAC,EAAE,eAAe,CAAC;CACnC;AAED;;;;;GAKG"}

package/dist/delegate-types.js

@@ -1,8 +0,0 @@
-export {};
-/**
- * Plan a governed delegation. Pure: returns argv and env, spawns nothing.
- *
- * Fails closed on depth, on any requested capability the delegator does not hold, on gated capabilities
- * without approval, and on a grant that cannot narrow (a universal capability slipping through).
- */
-//# sourceMappingURL=delegate-types.js.map

package/dist/delegate-types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegate-types.js","sourceRoot":"","sources":["../src/delegate-types.ts"],"names":[],"mappings":";AAgJA;;;;;GAKG"}

package/dist/delegate.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"delegate.d.ts","sourceRoot":"","sources":["../src/delegate.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAgBH,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAelH,OAAO,KAAK,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE5F,YAAY,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAE5F,wBAAgB,cAAc,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,iBAAiB,GAAG,UAAU,CA8S7F"}

package/dist/delegate.js

@@ -1,305 +0,0 @@
-/**
- * Governed delegation planning. Owning the spawn makes the grant an argument; each child receives its own
- * environment, and `tool:delegate` determines whether it is a delegator or a leaf.
- */
-import { planSpawn } from "./spawn.js";
-import { ceilingForDefinition, digestDefinition } from "./definitions.js";
-import { assertNarrowing } from "./resolve.js";
-import { checkRoutingAuthority, checkWorkspaceWildcardRequest } from "./routing-authority.js";
-import { DELEGATE_CAPABILITY, agentCapability, maySpawnDefinition, normaliseCapability, } from "./capabilities.js";
-// Re-exported so the split stays internal: `delegate.ts` has been the import site for these since 0.6.0 and
-// four modules plus the test suite name it. Moving the definitions without moving the door would be churn
-// charged to every caller for a line count they did not cause.
-export { DELEGATE_CAPABILITY, agentCapability, maySpawnDefinition, normaliseCapability } from "./capabilities.js";
-import { ENV_APPROVED, ENV_DEPTH, ENV_EXECUTION_ID, ENV_FANOUT, ENV_GATED, ENV_GRANT, ENV_LEDGER, ENV_MAX_DEPTH, ENV_PARENT_ID, inheritableGrant, } from "./propagation.js";
-import { inheritApprovals } from "./approval.js";
-import { suggestForUnknown, unknownCapabilities } from "./catalog.js";
-import { GovernanceRefusal, refusal } from "./refusals.js";
-import { digestTask, normaliseCorrelation, } from "./correlation.js";
-import { resolveDelegationApproval } from "./delegation-approval.js";
-import { assertCapabilitiesArePropagatable } from "./capabilities.js";
-export function planDelegation(request, ctx) {
-    const childDepth = ctx.depth + 1;
-    const denied = (plan, code) => plan.reason ? { ...plan, refusal: refusal(code, plan.reason) } : plan;
-    // G6 / B-I3: every refusal carries a result, including the four below that return before `resolve()`
-    // is ever called. The extension guarded its ledger write with `if (ledgerPath && plan.result)`, so
-    // those four governance decisions — disabled, too deep, no task, unknown capability — were never
-    // audited at all. An empty result is the honest record: nothing was resolved, and that is the fact.
-    // Bounded/whitelisted correlation is a REFUSAL, not an exception escaping the planner. It is reachable
-    // from a model-facing tool parameter on all three delegation tools, and throwing from here produced a
-    // governed refusal with no code and no ledger line at all — the ledger file was never even created
-    // (R-112). Caught here so it becomes an ordinary recorded decision.
-    let correlation;
-    let correlationRefused;
-    try {
-        correlation = normaliseCorrelation(request.correlation);
-    }
-    catch (error) {
-        correlationRefused = error instanceof GovernanceRefusal
-            ? { code: error.code, message: error.message, ...(error.details ? { details: error.details } : {}) }
-            : refusal("CORRELATION_INVALID", String(error instanceof Error ? error.message : error));
-    }
-    const taskDigest = digestTask(request.task ?? "");
-    const empty = {
-        ok: false,
-        args: [],
-        env: {},
-        effective: [],
-        childDepth,
-        requested: [],
-        taskDigest,
-        ...(correlation ? { correlation } : {}),
-        result: { effective: [], denied: [], clipped: [], gatedBlocked: [], universal: [], subsumedBy: [] },
-    };
-    if (correlationRefused) {
-        return { ...empty, reason: correlationRefused.message, refusal: correlationRefused };
-    }
-    if (ctx.maxDepth <= 0) {
-        return denied({ ...empty, reason: "delegation is disabled (maxDepth 0)" }, "DEPTH_EXCEEDED");
-    }
-    if (childDepth > ctx.maxDepth) {
-        return denied({ ...empty, reason: `delegation depth limit reached (${ctx.maxDepth})` }, "DEPTH_EXCEEDED");
-    }
-    if (!request.task?.trim())
-        return denied({ ...empty, reason: "a delegation needs a task" }, "TASK_MISSING");
-    // ADR-0035's routing guards live in `routing-authority.ts` with their rationale; both are checked here,
-    // before anything is said about the target, because they are governance questions about the SESSION.
-    const routing = checkRoutingAuthority(request.boundWorkspaceId, ctx.ownGrant);
-    if (routing) {
-        return denied({
-            ...empty,
-            ...(routing.denied ? { requested: routing.denied, result: { ...empty.result, denied: routing.denied } } : {}),
-            reason: routing.reason,
-        }, routing.code);
-    }
-    // ADR-0016. A named definition replaces the model's tool list with an operator-authored ceiling.
-    let requested;
-    let systemPrompt;
-    let definitionDigest;
-    /** The definition being spawned, hoisted so the gate below can name its authorising id (ADR-0024). */
-    let spawned;
-    if (request.agent) {
-        const definition = ctx.definitions?.get(request.agent);
-        spawned = definition;
-        // No fallback, deliberately. pi-subagents resolves an unknown type to `general-purpose`, whose
-        // omitted tool list means EVERY tool — so a typo there granted the full surface. An unknown name
-        // here is simply an error.
-        if (!definition) {
-            const known = [...(ctx.definitions?.keys() ?? [])].sort();
-            return denied({
-                ...empty,
-                reason: `unknown agent "${request.agent}"` +
-                    (known.length > 0 ? ` — known definitions: ${known.join(", ")}` : " — no definitions were found"),
-            }, "UNKNOWN_DEFINITION");
-        }
-        // ADR-0017: authorisation comes BEFORE anything is said about the file. Which definitions this
-        // session may spawn is a governance question about the SESSION; whether the file declares its tools
-        // properly is a diagnostic about the DEFINITION, and answering the second one first would report a
-        // malformed-file error to a caller who was never allowed to spawn it either way.
-        //
-        // Recorded as a denial rather than a bare refusal, deliberately: `denied` is the escalation signal
-        // ADR-0008 designates, and asking to run a definition this session was not granted IS an attempt to
-        // exceed the grant. A refusal that left `denied` empty would keep it out of every audit query.
-        if (!maySpawnDefinition(ctx.ownGrant, definition.name)) {
-            const authorising = agentCapability(definition.name);
-            const held = ctx.ownGrant.filter((c) => c.startsWith("agent:")).sort();
-            return denied({
-                ...empty,
-                requested: [authorising],
-                result: { ...empty.result, denied: [authorising] },
-                reason: `cannot spawn "${definition.name}" — this session does not hold ${authorising} ` +
-                    `(the definition lives at ${definition.source}). ` +
-                    (held.length > 0
-                        ? `It may spawn: ${held.join(", ")}.`
-                        : `It may spawn no definitions at all; add ${authorising} to its grant to allow this one.`),
-            }, "DEFINITION_NOT_AUTHORIZED");
-        }
-        // ADR-0018. Recorded from here on — after authorisation, because the digest is a fact about a file
-        // this caller was allowed to read, and before every remaining outcome, because a spawn refused for a
-        // malformed declaration is still a spawn of THIS version of the definition.
-        //
-        // Assigned into `empty`, which every subsequent refusal spreads. That is the R-28 discipline applied
-        // to a record field rather than an argument: instead of eight `definitionDigest` spellings that a
-        // ninth return could forget, there is one, and forgetting it is not expressible. The success return
-        // does not spread `empty`, so it names the field explicitly.
-        definitionDigest = digestDefinition(definition);
-        Object.assign(empty, { definitionDigest });
-        const ceiling = ceilingForDefinition(definition);
-        if (ceiling.undeclared) {
-            return denied({
-                ...empty,
-                reason: `agent "${definition.name}" declares no \`allowed-tools\`, so it cannot be spawned — add one ` +
-                    `to ${definition.source}. An undeclared capability set is treated as NONE, never as everything.`,
-            }, "UNDECLARED_TOOLS");
-        }
-        if (ceiling.patterns.length > 0) {
-            return denied({
-                ...empty,
-                reason: `agent "${definition.name}" restricts a tool with a pattern (${ceiling.patterns.join(", ")}), ` +
-                    `which pi's --tools cannot express — it matches whole tool names only. Granting the bare tool ` +
-                    `would widen the declaration and dropping it would silently narrow, so neither is done.`,
-            }, "CEILING_PATTERNS_UNRESOLVED");
-        }
-        requested = ceiling.capabilities;
-        systemPrompt = definition.body;
-    }
-    else {
-        requested = (request.tools ?? []).map(normaliseCapability);
-    }
-    // Unknown is reported before denied, and separately: "does not exist here" and "you lack authority"
-    // have different causes and different fixes. Collapsing them hides typos and stale grants.
-    if (ctx.catalog) {
-        const unknown = unknownCapabilities(requested, ctx.catalog);
-        if (unknown.length > 0) {
-            // Name the likely intent where there is one. `ceilingForDefinition` refuses to TRANSLATE names
-            // (lowercasing and no more), so an author who wrote Claude Code's `Glob` gets `tool:glob` and a
-            // refusal — correct, and previously unhelpful, because pi's equivalent is `find` and no amount of
-            // staring at "not present in this session's catalog" says so. The hint changes nothing about the
-            // refusal; it just stops the author having to guess which of nine built-ins was meant.
-            const hints = unknown
-                .map((c) => {
-                const s = suggestForUnknown(c, ctx.catalog);
-                return s === null ? null : `${c} → did you mean ${s}?`;
-            })
-                .filter((h) => h !== null);
-            return denied({
-                ...empty,
-                requested,
-                reason: `unknown capabilit${unknown.length === 1 ? "y" : "ies"}: ${unknown.join(", ")} — not present in ` +
-                    `this session's catalog (typo, or an uninstalled package?)` +
-                    (hints.length > 0 ? ` — ${hints.join("; ")}` : ""),
-            }, "UNKNOWN_TOOL");
-        }
-    }
-    // See `checkWorkspaceWildcardRequest`: refused for a HOLDER (the ledger must not record authority the
-    // child will not receive), and left to `resolve()` for anyone else, so the probe lands in `denied`.
-    const wildcardRequest = checkWorkspaceWildcardRequest(requested, ctx.ownGrant);
-    if (wildcardRequest) {
-        return denied({ ...empty, requested, reason: wildcardRequest.reason }, wildcardRequest.code);
-    }
-    const { result, approvalBinding, bindingMismatch } = resolveDelegationApproval({
-        task: request.task,
-        agent: request.agent,
-        boundWorkspaceId: request.boundWorkspaceId,
-        boundContextId: request.boundContextId,
-        requested,
-        parentGrant: ctx.ownGrant,
-        gated: ctx.gated,
-        approved: ctx.approved,
-        spawned,
-        definitionDigest,
-        correlation,
-        parentId: ctx.spawnId ?? `d${ctx.depth}`,
-    });
-    if (approvalBinding)
-        Object.assign(empty, { approvalBinding });
-    if (result.denied.length > 0) {
-        return denied({
-            ...empty,
-            requested,
-            result,
-            reason: `cannot grant ${result.denied.join(", ")} — this session does not hold it (capability escalation blocked)`,
-        }, "CAPABILITY_ESCALATION");
-    }
-    // ADR-0011: narrowing is checked BEFORE the gate, and the order is load-bearing rather than
-    // stylistic. `assertNarrowing` refuses regardless of approval, so with the old order this returned
-    // "requires explicit approval" for a delegation that could never be approved — telling the operator
-    // to go and find a human who cannot help. `shouldSeekApproval` now also refuses to prompt in this
-    // case; this reordering makes the reported *reason* agree with what actually blocks the spawn.
-    try {
-        assertNarrowing(result);
-    }
-    catch (error) {
-        // ADR-0011's narrowing invariant is the hardest rule this package enforces, and it was the one
-        // refusal an external controller could not identify by code (R-109).
-        return denied({ ...empty, requested, result, reason: String(error instanceof Error ? error.message : error) }, "NARROWING_VIOLATED");
-    }
-    if (result.gatedBlocked.length > 0) {
-        const code = bindingMismatch ? "APPROVAL_SCOPE_MISMATCH" : "GATED_UNAPPROVED";
-        const suffix = bindingMismatch ? " (an approval exists, but its task/workspace/context scope does not match)" : "";
-        return denied({ ...empty, requested, result, reason: `${result.gatedBlocked.join(", ")} requires explicit approval${suffix}` }, code);
-    }
-    const canSubDelegate = result.effective.includes(DELEGATE_CAPABILITY);
-    const plan = planSpawn({
-        effective: result.effective,
-        prompt: request.task,
-        model: request.model,
-        provider: request.provider,
-        thinking: request.thinking,
-        skillPaths: ctx.skillPaths,
-        contextFiles: ctx.contextFiles,
-        systemPrompt,
-        sessionFile: ctx.sessionFile,
-        print: ctx.interactive ? false : undefined,
-    });
-    // R-32. A `skill:` capability the catalog cannot place is refused rather than dropped. Dropping it
-    // would hand back a child whose grant claims a skill it does not have — the ledger would record a
-    // capability that never reached the process, which is precisely the kind of lie an audit trail must
-    // not contain. `unknownCapabilities` above catches names absent from the catalog entirely; this
-    // catches one that is known but whose path we could not resolve, which is a different fault.
-    if (plan.unresolvedSkills.length > 0) {
-        return denied({
-            ...empty,
-            requested,
-            result,
-            reason: `cannot locate ${plan.unresolvedSkills.join(", ")} on disk — granted but unresolvable, so the ` +
-                `child would silently lack it`,
-        }, "DEFINITION_UNREADABLE");
-    }
-    // A child may only delegate further if it was granted the capability AND has the extension to do it.
-    const args = [...plan.args];
-    if (canSubDelegate && ctx.extensionPath) {
-        // `-e` loads even under `--no-extensions`, which planSpawn sets — that is precisely why the
-        // extension is added explicitly here and nowhere else.
-        args.splice(args.length - 1, 0, "-e", ctx.extensionPath);
-    }
-    // `inheritableGrant`, not `result.effective` directly: this is the path a DELEGATED child's grant
-    // actually travels, and the "held but never inherited" rule for `tool:*` and `workspace:*` was enforced
-    // only in `childEnv`. A parent holding `workspace:*` could request it for its child and this line handed
-    // it over, so the rule ADR-0035 advertises held by accident — masked downstream rather than enforced
-    // here. One spelling of the rule, called from both paths.
-    const inheritable = inheritableGrant(result.effective);
-    const env = {
-        [ENV_GRANT]: (assertCapabilitiesArePropagatable(inheritable), inheritable.join(",")),
-        [ENV_DEPTH]: String(childDepth),
-        [ENV_MAX_DEPTH]: String(ctx.maxDepth),
-    };
-    // The child's own share of the subtree budget, and its identity. Both attenuate downward like depth: a
-    // child can never be handed more budget than its parent had left, so the total bound holds across
-    // process boundaries with no shared state.
-    if (ctx.fanoutBudget !== undefined)
-        env[ENV_FANOUT] = String(ctx.fanoutBudget);
-    if (ctx.childSpawnId)
-        env[ENV_PARENT_ID] = ctx.childSpawnId;
-    if (ctx.childExecutionId)
-        env[ENV_EXECUTION_ID] = ctx.childExecutionId;
-    if (ctx.gated.length > 0)
-        env[ENV_GATED] = ctx.gated.join(",");
-    // Approvals ride down with the grant, but only ever for what this child actually received — so
-    // `approved ⊆ grant` holds at every level (ADR-0010). Written even when empty, so this object states
-    // the child's approval set outright rather than leaving it to whatever the caller merges over; see
-    // `mergeChildEnv`, which is what actually stops the parent's value leaking through.
-    // Clamped to what the child actually INHERITS, not to what it was granted. The two differ only for a
-    // non-inheritable wildcard, and passing down an approval for a capability the child does not hold would
-    // leave banked authority with nothing to spend it on — `childEnv` clamps to `inheritable` for the same
-    // reason on the other path.
-    env[ENV_APPROVED] = inheritApprovals(ctx.approved ?? [], inheritable).join(",");
-    if (ctx.ledgerPath)
-        env[ENV_LEDGER] = ctx.ledgerPath;
-    return {
-        ok: true,
-        args,
-        env,
-        effective: result.effective,
-        result,
-        childDepth,
-        requested,
-        childId: ctx.childSpawnId,
-        executionId: ctx.childExecutionId,
-        taskDigest,
-        ...(correlation ? { correlation } : {}),
-        ...(approvalBinding ? { approvalBinding } : {}),
-        ...(definitionDigest ? { definitionDigest } : {}),
-    };
-}
-//# sourceMappingURL=delegate.js.map