pi-daddy 0.28.0 → 0.32.1

package/dist/run-herdr.d.ts

@@ -1,119 +0,0 @@
-/**
- * Run a governed child in a herdr pane — ADR-0016 point 6.
- *
- * The second executor for the same plan. `runChild` spawns `pi` directly and captures its stdout;
- * `runHerdrPane` asks herdr to launch it in a visible, attachable terminal pane. `planSpawn` produces the
- * argv either way, so the grant is identical and only the *place it runs* differs.
- *
- * **Why go through herdr's CLI rather than the third-party `pi-herdr` extension.** That extension exposes
- * `agentArgs` and `env` as MODEL-facing tool parameters (R-30), which hands a model an argv array and the
- * environment variable the grant travels on. Here the model chooses a definition and a task; this package
- * builds the argv. Measured facts this relies on (`docs/probes/g16-herdr`):
- *
- *  - `herdr agent start … -- <args>` delivers argv **verbatim**, echoed back in the reply.
- *  - `--tools` is enforced inside a pane exactly as it is for a direct spawn; `--no-tools` yields none.
- *  - `herdr agent start` has **no `--env`**, but `tab create` / `pane split` do, and a pane's environment
- *    reaches the shell that launches the agent — verified by reading `$PI_GRANTS_GRANT` back out of a
- *    pane created with it. That is how the grant, depth and ledger path propagate on this path.
- *
- * **What a pane is not: a boundary.** It is a terminal. `--tools` remains the enforcement point, ADR-0012's
- * `bash` escape is unchanged, and a pane is *attachable by design*, so a human can type into a governed
- * child. Humans are not this project's threat model, but nothing here should be read as containing one.
- */
-import type { ChildRunResult } from "./run-child.ts";
-import { type HerdrExec } from "./herdr-cli.ts";
-import { type PollTarget } from "./herdr-poll.ts";
-/**
- * Re-exported so importers of the executor still reach the protocol at the name they always used.
- *
- * Deliberate rather than lazy: `test/run-herdr.test.ts` imports `HerdrExec` from here and must pass
- * **unmodified** across this extraction — that is the only available proof the move changed no behaviour.
- */
-export { type HerdrExec, parseReply } from "./herdr-cli.ts";
-/** Re-exported: `splitSystemPrompt` moved to `./herdr-stage.ts` under the ceiling, its tests import it here. */
-export { splitSystemPrompt, stageSystemPrompt } from "./herdr-stage.ts";
-/** Re-exported: the name rules moved to `./herdr-name.ts` under the ceiling; tests import them here. */
-export { uniqueAgentName } from "./herdr-name.ts";
-/** Re-exported after startup retry extraction; existing executor importers keep this public constant. */
-export { PANE_READY_POLL_MS } from "./herdr-start.ts";
-/**
- * Re-exported so `test/run-herdr.test.ts` and any importer keep reaching these where they always were.
- *
- * `POLL_INTERVAL_MS` and `newSuffix` moved to `./herdr-poll.ts` under the 400-line ceiling; the names are part
- * of this module's surface and moving a file should not move an export.
- */
-export { DEFAULT_SNAPSHOT_LINES, POLL_INTERVAL_MS, readPane, tailLines, waitForLifecycleBaseline, waitForSettled, type PollTarget } from "./herdr-poll.ts";
-export interface HerdrRunRequest {
-    /** `planSpawn` args **without** the prompt — see `prompt`. */
-    args: string[];
-    /**
-     * The task, delivered with `herdr agent prompt` rather than as an argv element.
-     *
-     * This is strictly safer than the direct-spawn path, which has to defend a model-authored string from
-     * pi's argv parser by prefixing a space (`neutralisePrompt`, `docs/probes/g1-argv`). Here the task never
-     * reaches argv at all, so there is no parser in front of it.
-     */
-    prompt: string;
-    /** Grant/depth/ledger variables. Set on the PANE, which the agent's shell inherits. */
-    env: Record<string, string>;
-    cwd: string;
-    /** Unique pane and agent name. */
-    name: string;
-    /** herdr workspace to create the tab in. Omitted lets herdr choose. */
-    workspace?: string;
-    signal?: AbortSignal;
-    timeoutMs?: number;
-    maxOutputBytes?: number;
-    /**
-     * Leave the pane open after the run so a human can read or resume it.
-     *
-     * Default **false**: a fan-out that leaks a pane per child fills the operator's workspace, and
-     * `docs/probes/g16-herdr` records that panes are not trivially closable once orphaned.
-     */
-    keepPane?: boolean;
-    exec?: HerdrExec;
-    /**
-     * The pane's last few lines, re-reported every poll — a SNAPSHOT the consumer REPLACES, not appends.
-     *
-     * **Display only**, exactly as in `runChild`: the child's answer is still the returned `text`. Unlike
-     * `runChild`'s `onOutput`, this is not a stream: `agent read` returns a snapshot of a bounded terminal, and
-     * the previous append-shaped design produced an 89,000× amplification once a pane scrolled or passed the
-     * output cap. See `tailLines` in `./herdr-poll.ts`.
-     *
-     * Exceptions are swallowed; a renderer must not be able to break a governed run.
-     */
-    onSnapshot?: (lines: string[]) => void;
-    /** Available pane snapshots only, not a structured session transcript. Never awaited. */
-    onObservation?: (bytes: Uint8Array) => void;
-    /** How many pane lines to report per poll. Defaults to `DEFAULT_SNAPSHOT_LINES`. */
-    snapshotLines?: number;
-    /**
-     * The pane id, reported as soon as `tab create` returns it.
-     *
-     * Separate from `onOutput` because it arrives once and arrives *early*: it is what lets the parent print a
-     * name a human can switch to **while the child is alive**, which is the whole point of the pane surviving.
-     */
-    onPane?: (paneId: string, agentName: string) => void;
-    /** Called only after agent start and prompt both succeed; pane creation alone is still `starting`. */
-    onRunning?: (paneId: string, agentName: string) => void;
-    /** Security hook for attaching a writer lease to the tab. Unlike display callbacks, errors fail the run. */
-    onTab?: (tabId: string) => void;
-    /** Optional observation, unlike the required lease hook above. */
-    onNativeTab?: (tabId: string) => void;
-    onSessionReference?: PollTarget["onSessionReference"];
-    /** Close even a settled pane before releasing a writer lease; no post-lease prompt may remain live. */
-    closeOnSettle?: boolean;
-    /** Poll cadence override. Exists so tests do not wait `POLL_INTERVAL_MS` per state transition. */
-    pollIntervalMs?: number;
-}
-export declare class HerdrWriterCloseError extends Error {
-    constructor(tabId: string);
-}
-/**
- * Run one governed child in a pane and return its output.
- *
- * Deliberately returns `ChildRunResult` — the same shape as `runChild` — so the extension can choose an
- * executor without knowing which one it got.
- */
-export declare function runHerdrPane(request: HerdrRunRequest): Promise<ChildRunResult>;
-//# sourceMappingURL=run-herdr.d.ts.map

package/dist/run-herdr.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-herdr.d.ts","sourceRoot":"","sources":["../src/run-herdr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGrD,OAAO,EAA2B,KAAK,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAuG,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAMvJ;;;;;GAKG;AACH,OAAO,EAAE,KAAK,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5D,gHAAgH;AAChH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACxE,wGAAwG;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE3J,MAAM,WAAW,eAAe;IAC9B,8DAA8D;IAC9D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;;;OAMG;IACH,MAAM,EAAE,MAAM,CAAC;IACf,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB;;;;;;;;;OASG;IACH,UAAU,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;IACvC,yFAAyF;IACzF,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC;IAC5C,oFAAoF;IACpF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACrD,sGAAsG;IACtG,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;IACxD,4GAA4G;IAC5G,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,kEAAkE;IAClE,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,kBAAkB,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,CAAC;IACtD,uGAAuG;IACvG,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kGAAkG;IAClG,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,KAAK,EAAE,MAAM;CAI1B;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CA2PpF"}

package/dist/run-herdr.js

@@ -1,335 +0,0 @@
-/**
- * Run a governed child in a herdr pane — ADR-0016 point 6.
- *
- * The second executor for the same plan. `runChild` spawns `pi` directly and captures its stdout;
- * `runHerdrPane` asks herdr to launch it in a visible, attachable terminal pane. `planSpawn` produces the
- * argv either way, so the grant is identical and only the *place it runs* differs.
- *
- * **Why go through herdr's CLI rather than the third-party `pi-herdr` extension.** That extension exposes
- * `agentArgs` and `env` as MODEL-facing tool parameters (R-30), which hands a model an argv array and the
- * environment variable the grant travels on. Here the model chooses a definition and a task; this package
- * builds the argv. Measured facts this relies on (`docs/probes/g16-herdr`):
- *
- *  - `herdr agent start … -- <args>` delivers argv **verbatim**, echoed back in the reply.
- *  - `--tools` is enforced inside a pane exactly as it is for a direct spawn; `--no-tools` yields none.
- *  - `herdr agent start` has **no `--env`**, but `tab create` / `pane split` do, and a pane's environment
- *    reaches the shell that launches the agent — verified by reading `$PI_GRANTS_GRANT` back out of a
- *    pane created with it. That is how the grant, depth and ledger path propagate on this path.
- *
- * **What a pane is not: a boundary.** It is a terminal. `--tools` remains the enforcement point, ADR-0012's
- * `bash` escape is unchanged, and a pane is *attachable by design*, so a human can type into a governed
- * child. Humans are not this project's threat model, but nothing here should be read as containing one.
- */
-import { rm } from "node:fs/promises";
-import { runWithFinalizers } from "./finalization.js";
-import { DEFAULT_MAX_OUTPUT_BYTES, DEFAULT_TIMEOUT_MS } from "./run-child.js";
-import { MAX_OPEN_PANES, markPaneSettled, trackPane, trimOpenPanes, untrackPane } from "./pane-reaper.js";
-import { defaultExec, parseReply } from "./herdr-cli.js";
-import { FRESH_LIFECYCLE_TIMEOUT_MS, readPane, waitForLifecycleBaseline, waitForSettled, observeHerdrSession } from "./herdr-poll.js";
-import { stageSystemPrompt } from "./herdr-stage.js";
-import { uniqueAgentName } from "./herdr-name.js";
-import { bundledHerdrPiLifecycleExtension } from "./herdr-pi-lifecycle.js";
-import { startHerdrAgent } from "./herdr-start.js";
-/**
- * Re-exported so importers of the executor still reach the protocol at the name they always used.
- *
- * Deliberate rather than lazy: `test/run-herdr.test.ts` imports `HerdrExec` from here and must pass
- * **unmodified** across this extraction — that is the only available proof the move changed no behaviour.
- */
-export { parseReply } from "./herdr-cli.js";
-/** Re-exported: `splitSystemPrompt` moved to `./herdr-stage.ts` under the ceiling, its tests import it here. */
-export { splitSystemPrompt, stageSystemPrompt } from "./herdr-stage.js";
-/** Re-exported: the name rules moved to `./herdr-name.ts` under the ceiling; tests import them here. */
-export { uniqueAgentName } from "./herdr-name.js";
-/** Re-exported after startup retry extraction; existing executor importers keep this public constant. */
-export { PANE_READY_POLL_MS } from "./herdr-start.js";
-/**
- * Re-exported so `test/run-herdr.test.ts` and any importer keep reaching these where they always were.
- *
- * `POLL_INTERVAL_MS` and `newSuffix` moved to `./herdr-poll.ts` under the 400-line ceiling; the names are part
- * of this module's surface and moving a file should not move an export.
- */
-export { DEFAULT_SNAPSHOT_LINES, POLL_INTERVAL_MS, readPane, tailLines, waitForLifecycleBaseline, waitForSettled } from "./herdr-poll.js";
-export class HerdrWriterCloseError extends Error {
-    constructor(tabId) {
-        super(`herdr writer tab ${tabId} could not be closed; retaining its workspace lease`);
-        this.name = "HerdrWriterCloseError";
-    }
-}
-/**
- * Run one governed child in a pane and return its output.
- *
- * Deliberately returns `ChildRunResult` — the same shape as `runChild` — so the extension can choose an
- * executor without knowing which one it got.
- */
-export async function runHerdrPane(request) {
-    const exec = request.exec ?? defaultExec;
-    const timeoutMs = request.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-    const maxOutputBytes = request.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
-    const deadline = Date.now() + timeoutMs;
-    const empty = { code: null, text: "", truncated: false, timedOut: false, aborted: false };
-    // A-R3's rule, kept on this path too: checked BEFORE anything is created. An `AbortSignal` does not
-    // replay, so a check after the first `await` cannot see an abort that already happened — and we would
-    // have left a pane behind for a run that was never wanted.
-    if (request.signal?.aborted)
-        return { ...empty, aborted: true };
-    // `--print` makes pi process the prompt and exit, so it never reaches the interactive readiness that
-    // `herdr agent start` waits for — the agent is simply never detected. Found by the first end-to-end run,
-    // which failed inside herdr with an empty reply. Caught here instead, naming the flag, because a
-    // mismatch between a plan and its executor is a caller bug and should read like one.
-    if (request.args.includes("--print") || request.args.includes("-p")) {
-        return {
-            ...empty,
-            spawnError: "herdr needs an INTERACTIVE agent, but the plan contains --print, which makes pi exit immediately " +
-                "and never be detected. Build the plan with `print: false` for this executor.",
-        };
-    }
-    // A multi-line system prompt becomes a file; see `stageSystemPrompt`. Removed on every path that does not
-    // end up tracking a pane, because only a tracked pane's dir is reachable by a sweep.
-    const staged = await stageSystemPrompt(request.args);
-    if (staged.error)
-        return { ...empty, spawnError: staged.error };
-    const promptDir = staged.promptDir;
-    let lifecycleExtension;
-    try {
-        lifecycleExtension = bundledHerdrPiLifecycleExtension();
-    }
-    catch (error) {
-        if (promptDir)
-            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
-        return { ...empty, spawnError: String(error) };
-    }
-    // Pi's `--no-extensions` disables discovery, not this explicit, package-pinned lifecycle reporter. It
-    // registers no tools; pi's existing `--tools` allowlist remains the governed child surface.
-    const effectiveArgs = [...staged.args, "-e", lifecycleExtension];
-    const create = ["tab", "create", "--label", request.name, "--cwd", request.cwd];
-    if (request.workspace)
-        create.push("--workspace", request.workspace);
-    for (const [key, value] of Object.entries(request.env))
-        create.push("--env", `${key}=${value}`);
-    // The name herdr will actually know this agent by. Every later command in this function uses `agentName`,
-    // never `request.name`, which is only a base.
-    const agentName = uniqueAgentName(request.name);
-    const created = parseReply(await exec(create));
-    if (created.error) {
-        // **The staged prompt is removed here too.** This path returned without touching it, and nothing tracked it,
-        // so neither sweep could ever reach it — a permanent `/tmp/grants-herdr-*` per failed `tab create`. Measured
-        // by a reviewer, who also found leftovers from earlier runs already sitting in `/tmp`. It is the most likely
-        // failure on a machine where herdr is not running, i.e. the common case.
-        if (promptDir)
-            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
-        return { ...empty, spawnError: `herdr tab create failed: ${created.error}` };
-    }
-    const rootPane = (created.result?.root_pane ?? {});
-    const paneId = rootPane.pane_id;
-    const tabId = rootPane.tab_id;
-    if (tabId) {
-        try {
-            request.onNativeTab?.(tabId);
-        }
-        catch { /* observation only */ }
-    }
-    // **Tracked BEFORE the pane-id check, not after.** A tab can exist from the moment this reply is parsed,
-    // so registering later leaves a window — one herdr round-trip wide — in which a killed process orphans a
-    // tab nothing would reap. The normal path had no such window and the error path did, which is backwards:
-    // the error path is the one more likely to be taken while something is already going wrong.
-    if (tabId && request.keepPane && promptDir) {
-        // `keepPane` keeps the PANE, and the staged prompt with it — a human inspecting the pane may want to see
-        // what the child was told. Registered `settled` so the trim never touches it, but registered nonetheless so
-        // the `exit` sweep can remove the temp dir rather than leaving one per kept pane forever. Measured: this
-        // path leaked a `/tmp/grants-herdr-*` that neither sweep could reach.
-        trackPane({ tab: tabId, name: agentName, promptDir, settled: true, keepTab: true });
-    }
-    if (tabId && !request.keepPane)
-        trackPane({ tab: tabId, name: agentName, promptDir });
-    // Attach before the first post-create await. If the parent dies after this point, the independent lock
-    // helper closes the tab before releasing the writer lease.
-    if (request.onTab) {
-        try {
-            if (!tabId)
-                throw new Error("herdr returned no tab id for writer-lease attachment");
-            request.onTab(tabId);
-        }
-        catch (error) {
-            if (tabId && !request.keepPane) {
-                const closed = await exec(["tab", "close", tabId]).catch(() => undefined);
-                if (closed === undefined || parseReply(closed).error)
-                    throw new HerdrWriterCloseError(tabId);
-            }
-            return { ...empty, spawnError: `workspace writer lease could not attach to herdr tab (${String(error)})` };
-        }
-    }
-    if (tabId && !request.keepPane) {
-        // ADR-0032: panes now live until `agent_settled`, so they accumulate across one agent run — and a plain
-        // blocking `delegate` spends nothing from the fan-out budget, so the count is otherwise unbounded. Trimmed
-        // here rather than at settle time so the bound holds DURING a long run, not only after it.
-        const dropped = await trimOpenPanes(exec);
-        if (dropped.length > 0 && request.onSnapshot) {
-            try {
-                request.onSnapshot([
-                    `[grants] closed ${dropped.length} older pane(s) to stay within the ${MAX_OPEN_PANES}-pane limit: ` +
-                        dropped.join(", "),
-                ]);
-            }
-            catch {
-                /* display only */
-            }
-        }
-    }
-    if (!paneId) {
-        // The tab may exist even though the reply carried no pane id, and this return used to be BEFORE
-        // `cleanup` was defined — so the one path where herdr half-succeeded was the one that leaked a tab.
-        if (tabId && !request.keepPane) {
-            const reply = await exec(["tab", "close", tabId]).catch(() => undefined);
-            // Same rule as `cleanup`: untrack only what is provably gone, so a close herdr refused stays the
-            // reaper's problem rather than being dropped on the assumption that it worked.
-            if (reply === undefined || parseReply(reply).error) {
-                if (request.closeOnSettle)
-                    throw new HerdrWriterCloseError(tabId);
-            }
-            else {
-                untrackPane(tabId);
-            }
-        }
-        // There is no agent in this pane to ask, so the staged prompt has no reader — remove it. Kept only under
-        // `keepPane`, where the operator asked to inspect whatever exists.
-        if (promptDir && !request.keepPane)
-            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
-        return { ...empty, spawnError: "herdr tab create returned no pane id" };
-    }
-    /**
-     * End this call. **A child that did not settle has its tab closed, because that is the only way to stop it.**
-     *
-     * ADR-0032 keeps a pane alive past its tool call so a human can read it. The original version of that also
-     * called `herdr agent stop` and claimed *"the agent is still stopped here… what survives is a terminal, not a
-     * running descendant."* **`herdr agent stop` does not exist.** Measured against herdr 0.7.5: the `agent`
-     * subcommands are `list get read send-keys prompt rename focus wait attach start explain`, and `agent stop`
-     * prints the usage banner and exits 0 — which `defaultExec` reports as a success, so nothing ever noticed.
-     * `docs/probes/g16-herdr/README.md` asserted it worked, in a *How to rerun* block that was never run.
-     *
-     * So there is exactly one kill available: closing the tab. That forces the distinction below.
-     *
-     *  - **Settled cleanly** (`idle`/`done`/`blocked` with an advanced counter): the child has answered and is
-     *    sitting idle. Its pane stays, which is the whole feature, and the `agent_settled` sweep reaps it.
-     *  - **Anything else** — a timeout, an abort, a failed start, a failed prompt, an unreadable pane: the child
-     *    may still be **working, with its grant**, after its tool call has already returned a result. Leaving
-     *    that running is a governance failure, not an untidy workspace, so the tab is closed here and now.
-     *
-     * `keepPane` is the operator overriding the whole question, and it is honoured either way: nothing is tracked
-     * and nothing is closed, which is what "keep this pane for me to inspect" has to mean.
-     */
-    const cleanup = async (settledCleanly) => {
-        if (request.keepPane)
-            return;
-        if (settledCleanly && !request.closeOnSettle)
-            return;
-        if (!tabId)
-            return;
-        const reply = await exec(["tab", "close", tabId]).catch(() => undefined);
-        // Untracked only if provably closed — R-62's rule. A writer close failure must retain the lease;
-        // otherwise a still-promptable pane can overlap the successor admitted by a clean release.
-        if (reply === undefined || parseReply(reply).error) {
-            if (request.closeOnSettle)
-                throw new HerdrWriterCloseError(tabId);
-            return;
-        }
-        untrackPane(tabId);
-        if (promptDir)
-            await rm(promptDir, { recursive: true, force: true }).catch(() => undefined);
-    };
-    // ADR-0032: the pane exists and has a name, so tell the caller NOW. A pane id that arrives with the result is
-    // useless — the point is switching to a child while it is still working. Guarded because a renderer must not
-    // be able to strand a pane we have already created.
-    if (request.onPane) {
-        try {
-            request.onPane(paneId, agentName);
-        }
-        catch {
-            /* display only */
-        }
-    }
-    // Set only on the one path where the child answered and stopped working. Everything else — including an
-    // early `return` from a failed start or prompt — leaves it false, so `cleanup` closes the tab.
-    let settledCleanly = false;
-    return runWithFinalizers(async () => {
-        const started = await startHerdrAgent(exec, agentName, paneId, effectiveArgs, deadline);
-        if (started.error)
-            return { ...empty, spawnError: `herdr agent start failed: ${started.error}` };
-        // The bundled reporter queues its initial idle state asynchronously. Establish its native-authority
-        // baseline before prompting, otherwise that initial report could advance the counter after prompt and
-        // be mistaken for settlement.
-        const baseline = await waitForLifecycleBaseline(exec, { ...request, name: agentName, nativePaneId: paneId }, Math.min(deadline, Date.now() + FRESH_LIFECYCLE_TIMEOUT_MS));
-        if (baseline.aborted)
-            return { ...empty, aborted: true };
-        if (baseline.spawnError || baseline.before === undefined)
-            return { ...empty, spawnError: baseline.spawnError ?? "Herdr lifecycle baseline is unavailable" };
-        observeHerdrSession(started.result?.agent, paneId, request.onSessionReference);
-        const prompted = parseReply(await exec(["agent", "prompt", agentName, request.prompt]));
-        if (prompted.error)
-            return { ...empty, spawnError: `herdr agent prompt failed: ${prompted.error}` };
-        if (request.onRunning) {
-            try {
-                request.onRunning(paneId, agentName);
-            }
-            catch {
-                /* display/observation only */
-            }
-        }
-        const settled = await waitForSettled(exec, { ...request, name: agentName, nativePaneId: paneId }, baseline.before, deadline, maxOutputBytes);
-        if (settled.aborted || settled.timedOut) {
-            // Still read: a timed-out child usually produced something, and a partial answer labelled partial is
-            // more useful than none. R-03's rule — a missing result must never look like an empty one.
-            const partial = await readPane(exec, agentName, maxOutputBytes);
-            if (!partial.readFailed) {
-                try {
-                    request.onObservation?.(Buffer.from(partial.text));
-                }
-                catch { /* observation only */ }
-            }
-            return { ...empty, ...settled, text: partial.readFailed ? "" : partial.text, truncated: partial.truncated };
-        }
-        if (settled.spawnError)
-            return { ...empty, spawnError: settled.spawnError };
-        const out = await readPane(exec, agentName, maxOutputBytes);
-        // **A failed read is a failed spawn, not an empty answer.** This branch used to return `readPane`'s own
-        // diagnostic as `text` with `code: 0`, so the orchestrator received
-        // `[grants] could not read the agent pane: …` **as the sub-agent's report** — R-03 exactly, and measured.
-        // The child may well have done its work; what we cannot do is claim to know what it said.
-        if (out.readFailed) {
-            return {
-                ...empty,
-                spawnError: `the child settled but its pane could not be read (${out.readFailed}), so its answer is unknown. ` +
-                    `The work may have been done — check pane ${paneId} if it is still open.`,
-            };
-        }
-        try {
-            request.onObservation?.(Buffer.from(out.text));
-        }
-        catch { /* observation only */ }
-        settledCleanly = true;
-        // The trim may now reclaim this pane if the cap is exceeded. Until this point it must not: closing the tab
-        // kills the child, and the child was still working.
-        if (tabId)
-            markPaneSettled(tabId);
-        return {
-            code: settled.status === "blocked" ? 1 : 0,
-            // `truncated` is returned in the result too, but it was never SAID on this path, so a model received a
-            // tail with no indication that a head existed. The direct executor has always flagged it; a delegation
-            // that silently drops the first megabyte of an answer is the same defect wearing the other executor.
-            text: [
-                out.truncated ? `[grants] this pane exceeded the output cap; only its most recent output is below.\n` : "",
-                out.text,
-                settled.status === "blocked"
-                    ? `\n\n[grants] this agent is BLOCKED waiting for a human in pane ${paneId}.`
-                    : "",
-            ].join(""),
-            truncated: out.truncated,
-            timedOut: false,
-            aborted: false,
-        };
-    }, [{
-            label: "herdr pane finalizer failed",
-            run: () => cleanup(settledCleanly),
-        }]);
-}
-//# sourceMappingURL=run-herdr.js.map

package/dist/run-herdr.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-herdr.js","sourceRoot":"","sources":["../src/run-herdr.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,SAAS,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,UAAU,EAAkB,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,0BAA0B,EAAE,QAAQ,EAAE,wBAAwB,EAAE,cAAc,EAAE,mBAAmB,EAAmB,MAAM,iBAAiB,CAAC;AACvJ,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;GAKG;AACH,OAAO,EAAkB,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5D,gHAAgH;AAChH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACxE,wGAAwG;AACxG,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAClD,yGAAyG;AACzG,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD;;;;;GAKG;AACH,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,QAAQ,EAAE,SAAS,EAAE,wBAAwB,EAAE,cAAc,EAAmB,MAAM,iBAAiB,CAAC;AAmE3J,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,KAAa;QACvB,KAAK,CAAC,oBAAoB,KAAK,qDAAqD,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAwB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,kBAAkB,CAAC;IAC1D,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,wBAAwB,CAAC;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,MAAM,KAAK,GAAmB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE1G,oGAAoG;IACpG,sGAAsG;IACtG,2DAA2D;IAC3D,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAEhE,qGAAqG;IACrG,yGAAyG;IACzG,iGAAiG;IACjG,qFAAqF;IACrF,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,OAAO;YACL,GAAG,KAAK;YACR,UAAU,EACR,mGAAmG;gBACnG,8EAA8E;SACjF,CAAC;IACJ,CAAC;IAED,0GAA0G;IAC1G,qFAAqF;IACrF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK;QAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAChE,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IACnC,IAAI,kBAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,kBAAkB,GAAG,gCAAgC,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;IACjD,CAAC;IACD,sGAAsG;IACtG,4FAA4F;IAC5F,MAAM,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAEjE,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAEhG,0GAA0G;IAC1G,8CAA8C;IAC9C,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,6GAA6G;QAC7G,6GAA6G;QAC7G,6GAA6G;QAC7G,yEAAyE;QACzE,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5F,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,4BAA4B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;IAC/E,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,IAAI,EAAE,CAA0C,CAAC;IAC5F,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;IAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC9B,IAAI,KAAK,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;IAAC,CAAC;IACrF,yGAAyG;IACzG,yGAAyG;IACzG,yGAAyG;IACzG,4FAA4F;IAC5F,IAAI,KAAK,IAAI,OAAO,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC3C,yGAAyG;QACzG,4GAA4G;QAC5G,yGAAyG;QACzG,sEAAsE;QACtE,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;QAAE,SAAS,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC;IAEtF,uGAAuG;IACvG,2DAA2D;IAC3D,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;YACpF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1E,IAAI,MAAM,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK;oBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,yDAAyD,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;QAC7G,CAAC;IACH,CAAC;IAED,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC/B,wGAAwG;QACxG,2GAA2G;QAC3G,2FAA2F;QAC3F,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACH,OAAO,CAAC,UAAU,CAAC;oBACjB,mBAAmB,OAAO,CAAC,MAAM,qCAAqC,cAAc,eAAe;wBACjG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;iBACrB,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,kBAAkB;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,gGAAgG;QAChG,oGAAoG;QACpG,IAAI,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACzE,iGAAiG;YACjG,+EAA+E;YAC/E,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;gBACnD,IAAI,OAAO,CAAC,aAAa;oBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YACpE,CAAC;iBAAM,CAAC;gBACN,WAAW,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QACD,yGAAyG;QACzG,mEAAmE;QACnE,IAAI,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACjH,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,sCAAsC,EAAE,CAAC;IAC1E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,MAAM,OAAO,GAAG,KAAK,EAAE,cAAuB,EAAE,EAAE;QAChD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO;QAC7B,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,aAAa;YAAE,OAAO;QACrD,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,iGAAiG;QACjG,2FAA2F;QAC3F,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC;YACnD,IAAI,OAAO,CAAC,aAAa;gBAAE,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,IAAI,SAAS;YAAE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9F,CAAC,CAAC;IAEF,8GAA8G;IAC9G,6GAA6G;IAC7G,oDAAoD;IACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,kBAAkB;QACpB,CAAC;IACH,CAAC;IAED,wGAAwG;IACxG,+FAA+F;IAC/F,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,OAAO,iBAAiB,CAAC,KAAK,IAAI,EAAE;QAClC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACxF,IAAI,OAAO,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,6BAA6B,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAEjG,oGAAoG;QACpG,sGAAsG;QACtG,8BAA8B;QAC9B,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,EACJ,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EACrD,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,0BAA0B,CAAC,CAC5D,CAAC;QACF,IAAI,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACzD,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,IAAI,yCAAyC,EAAE,CAAC;QAC5J,mBAAmB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAE/E,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACxF,IAAI,QAAQ,CAAC,KAAK;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,8BAA8B,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC;QACpG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;QAC7I,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACxC,qGAAqG;YACrG,2FAA2F;YAC3F,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;YAChE,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;YAAC,CAAC;YACzH,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9G,CAAC;QACD,IAAI,OAAO,CAAC,UAAU;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC;QAE5E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;QAC5D,wGAAwG;QACxG,oEAAoE;QACpE,0GAA0G;QAC1G,0FAA0F;QAC1F,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,OAAO;gBACL,GAAG,KAAK;gBACR,UAAU,EACR,qDAAqD,GAAG,CAAC,UAAU,+BAA+B;oBAClG,4CAA4C,MAAM,uBAAuB;aAC5E,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;QACxF,cAAc,GAAG,IAAI,CAAC;QACtB,2GAA2G;QAC3G,oDAAoD;QACpD,IAAI,KAAK;YAAE,eAAe,CAAC,KAAK,CAAC,CAAC;QAClC,OAAO;YACL,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1C,uGAAuG;YACvG,uGAAuG;YACvG,qGAAqG;YACrG,IAAI,EAAE;gBACJ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,qFAAqF,CAAC,CAAC,CAAC,EAAE;gBAC1G,GAAG,CAAC,IAAI;gBACR,OAAO,CAAC,MAAM,KAAK,SAAS;oBAC1B,CAAC,CAAC,kEAAkE,MAAM,GAAG;oBAC7E,CAAC,CAAC,EAAE;aACP,CAAC,IAAI,CAAC,EAAE,CAAC;YACV,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,KAAK;SACf,CAAC;IACJ,CAAC,EAAE,CAAC;YACF,KAAK,EAAE,6BAA6B;YACpC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,cAAc,CAAC;SACnC,CAAC,CAAC,CAAC;AACN,CAAC"}

package/dist/skill-packages.d.ts

@@ -1,116 +0,0 @@
-/**
- * Setup discovers enabled Pi resources in place through its package resolver. Configured packages
- * are never copied into another autoload root. For legacy npm installs unregistered with Pi only,
- * the explicit package.json pi.skills declaration remains a scaffold source (ADR-0074).
- * Names, ceilings and bytes are checked before they can enter the generated shell grant.
- */
-import { type SkillDefinition } from "./definitions.ts";
-import { isSafeCapability } from "./capabilities.ts";
-export interface DiscoveredSkill {
-    definition: SkillDefinition;
-    /** The file verbatim. `init` copies it rather than regenerating it, so nothing is lost in a round trip. */
-    text: string;
-    path: string;
-    /** Already enabled by Pi; setup must reference it rather than making a competing copy. */
-    referenced?: boolean;
-}
-/** Why a declared skill was refused before it could be planned. Each has a different fix. */
-export type RefusalReason = 
-/** The name cannot be a capability id, a line in a sourced file, or a path segment. */
-"unsafe-name"
-/** A declared `allowed-tools` entry cannot be one either — R-78, the sibling of R-77. */
- | "unsafe-capability"
-/** The declaration claims `tool:*` or `agent:*`: root authority, which a package may not hand itself. */
- | "wildcard"
-/** The bytes are not valid UTF-8, so "copied verbatim" could not be honoured. */
- | "not-utf8";
-export interface RefusedSkill {
-    /** The `pi.skills` entry or the definition name, whichever the operator can act on. */
-    subject: string;
-    reason: RefusalReason;
-    /** The offending id(s), when the reason names any. */
-    detail: string[];
-}
-export interface SkillPackage {
-    name: string;
-    version: string;
-    /** Paths `pi.skills` named that could not be read as a `SKILL.md`, so the report can say so out loud. */
-    unreadable: string[];
-    /** Skills refused for a reason that would otherwise reach a generated file. Never silently dropped. */
-    refused: RefusedSkill[];
-    skills: DiscoveredSkill[];
-}
-/**
- * May this definition's name be written into a capability id, a shell file and a path?
- *
- * **Measured before it was written, and it was a defect in this module's first version (R-77).** A
- * definition's identity is its directory name, and `init` interpolates that name into three places at once:
- * `agent:<name>` inside a **comma-separated** `PI_GRANTS_GRANT`, a `.pi/grants.env` an operator **sources**,
- * and the path it writes the copy to. An installed package with a directory called `a,tool:bash` produced
- *
- * ```
- * export PI_GRANTS_GRANT="agent:a,tool:bash,tool:delegate,tool:read"
- * ```
- *
- * — `tool:bash` in an operator's grant, declared by nobody. A quote character reaches a file that gets
- * `source`d, and a name of `..` writes outside `.pi/skills/`. One rule closes all three, and it is
- * deliberately a **whitelist**: the safe set here is small and the unsafe set is the rest of Unicode.
- *
- * The first character must be alphanumeric, so `..` and dotfiles are refused along with everything else.
- */
-export declare function isSafeName(name: string): boolean;
-/**
- * May this DECLARED capability id be written into the generated grant? — R-78.
- *
- * **R-77's other half, and the reason a whitelist beats a blocklist twice.** R-77 was closed on the name
- * channel; the `allowed-tools` *value* travels to the identical interpolation site and was unchecked, so a
- * package declaring
- *
- * ```yaml
- * allowed-tools: Read,ext:x";touch /tmp/pwned;PI_GRANTS_GRANT="
- * ```
- *
- * produced a `.pi/grants.env` that executed arbitrary code the moment the operator ran the `source` line
- * `init` itself prints. Reproduced end to end before this existed. `ceilingForDefinition` passes `ext:`,
- * `skill:` and `agent:` entries through **as written** by design (a translation table would invent or drop
- * grants), which is right for the enforcement path — the catalog refuses what it does not know — and is
- * exactly why the check has to be here, at the boundary that *generates* rather than the one that enforces.
- *
- * The grammar is the one `docs/SPEC.md` documents: `tool:<name>`, `skill:<name>`, `agent:<name>`,
- * `workspace:<id>`, and `ext:<pkg>/<tool>` where `<pkg>` may be npm-scoped. No wildcards — those are refused
- * separately and loudly, because "you tried to grant yourself everything" is a different fact from "that is
- * not a name".
- *
- * `workspace:` was absent until 2026-08-21, so the boundary that GENERATES grants could not emit the one
- * capability ADR-0035's breaking change made mandatory: a package needing to route was reported as declaring
- * something that "is not a name". A namespace has to be added here as well as to the enforcing path, and
- * that is the whole lesson of the review this came out of.
- */
-export { isSafeCapability };
-/** Read one installed package, if it declares skills. `null` means "not a skill package", not an error. */
-export declare function readSkillPackage(packageDir: string): Promise<SkillPackage | null>;
-/**
- * Every installed package under `<cwd>/node_modules` that declares `pi.skills`, sorted by name.
- *
- * Top level and one scope deep, which is what npm's layout has. Nothing recurses into a dependency's own
- * `node_modules`: a transitive skill package is not something an operator asked to install definitions
- * from, and scaffolding one into their project would be a surprise wearing a helpful face.
- */
-/**
- * Every place a pi package can be installed, most specific first (R-75).
- *
- * **Two roots, because pi has two install paths and only one of them is `npm install`.** `pi install
- * npm:principal-pi-skills` — the documented, pi-native way, and the only one that registers the package so
- * pi will auto-load its extension — puts it in `$PI_CODING_AGENT_DIR/npm/node_modules`, and leaves the
- * project without a `node_modules` at all. Searching only `<cwd>/node_modules` therefore found **nothing**
- * for an operator who followed pi's own instructions, and said "install principal-pi-skills" to somebody
- * who just had.
- *
- * Measured, in a fresh `PI_CODING_AGENT_DIR` with an empty project: `pi install` populates the agent root
- * and creates no project root.
- *
- * Project first when both exist, because a package pinned in the repository is the one the team agreed on.
- */
-export declare function skillPackageRoots(cwd: string): string[];
-export declare function discoverSkillPackages(cwd: string): Promise<SkillPackage[]>;
-//# sourceMappingURL=skill-packages.d.ts.map

package/dist/skill-packages.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"skill-packages.d.ts","sourceRoot":"","sources":["../src/skill-packages.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAIpG,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa;AACvB,uFAAuF;AACrF,aAAa;AACf,yFAAyF;GACvF,mBAAmB;AACrB,yGAAyG;GACvG,UAAU;AACZ,iFAAiF;GAC/E,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uGAAuG;IACvG,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,EAAE,gBAAgB,EAAE,CAAC;AA+D5B,2GAA2G;AAC3G,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAkCvF;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGvD;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA0DhF"}