pi.lock 0.0.0-stage → 0.1.0

package/README.md

@@ -1,3 +1,184 @@
-# Temporary Holding Version
+# pi.lock
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Use the same Pi agent from a local terminal, RPC, or the SDK with the same configuration, instructions, skills, extensions, and tools. Deploy and roll it back with Git.
+
+Supported Pi version: **1.3.0** (verified as the npm `latest` release on 2026-10-18). Requires Node.js **22.19.0+**.
+
+pi.lock uses Pi's native `.pi/settings.json`, `SYSTEM.md`, `extensions/`, `skills/`, `prompts/`, TUI, and RPC protocol. The main addition is `pi-lock lock`, which captures a tuned agent. Use the project-local `pi-lock` command in place of `pi`; import `createAgentSession` from `pi.lock` in the SDK.
+
+## Name and package
+
+The project is named **pi.lock**. One npm package provides both its CLI and SDK:
+
+| Purpose | Name |
+|---|---|
+| Project name | pi.lock |
+| Agent lockfile | `pi.lock` |
+| npm package and SDK import | `pi.lock` |
+| CLI command | `pi-lock` |
+| Local snapshots, credentials, and sessions | `.pi-lock/` (excluded from Git) |
+
+The current version is `0.1.0`. Install the published package with `npm install pi.lock`. The CLI command remains `pi-lock`.
+
+## Try it without an API key
+
+Run these commands from the source checkout:
+
+```sh
+npm ci
+npm run build
+node dist/cli.js --project examples/demo lock
+node dist/cli.js --project examples/demo -p /hello
+node dist/cli.js --project examples/demo
+```
+
+The last command opens Pi's native TUI. The demo uses a deterministic local provider and an echo tool; it makes no model-service requests. It also includes a skill and a `/hello` prompt template.
+
+## Use it in your project
+
+Install the npm package as a project dependency:
+
+```sh
+npm install pi.lock
+npx --no-install pi-lock init --provider deepseek --model deepseek-chat
+```
+
+If your project already has `.pi/settings.json`, keep it and skip `init`.
+
+Set the API-key environment variable for your provider. For example, DeepSeek uses `DEEPSEEK_API_KEY`. After changing `.pi/SYSTEM.md`, skills, or extensions, tune the agent in development mode:
+
+```sh
+npx --no-install pi-lock --dev
+```
+
+Development mode supports Pi's `/model`, `/settings`, and `/reload` commands. Behavior settings are written to this agent's `.pi/settings.json`. Restart the development session after changing provider definitions.
+
+When you are done tuning, lock the agent and run it in the default frozen mode:
+
+```sh
+npx --no-install pi-lock lock
+npx --no-install pi-lock
+npx --no-install pi-lock -p "Help me with this task"
+npx --no-install pi-lock --mode rpc
+```
+
+Frozen mode is the default. Changes to files, missing dependencies, model changes, and tool-schema differences produce explicit errors. The runtime does not supplement resources from global configuration, switch models, or update dependencies automatically. Use `--dev` to make changes, then run `lock` again.
+
+## SDK: the same agent
+
+```ts
+import { createAgentSession } from "pi.lock";
+
+const agent = await createAgentSession({
+  projectRoot: "/app/my-agent", // Contains .pi/ and pi.lock
+  cwd: "/data/current-task",  // Working directory for the agent's task
+  apiKey: process.env.DEEPSEEK_API_KEY,
+});
+
+try {
+  await agent.session.prompt("Help me with this task");
+  console.log(agent.session.getLastAssistantText());
+  console.log(agent.agentDigest);
+} finally {
+  await agent.dispose();
+}
+```
+
+When run from the agent project directory, you can omit both `projectRoot` and `cwd`. `projectRoot` selects the agent definition; `cwd` selects the task data location. Instructions and `.pi` configuration in the working directory or its parents are not merged into an explicitly selected agent.
+
+The returned `session` is Pi's `AgentSession`, with native streaming events, cancellation, and history support. `agent.runtime` provides `newSession()`, `fork()`, and `switchSession()`. After replacing a session, read the current session through `agent.session` and subscribe to its events again. `agent.dispose()` runs extension cleanup and releases the session.
+
+To manage history yourself, pass Pi's native `SessionManager`:
+
+```ts
+import { createAgentSession, SessionManager } from "pi.lock";
+
+const agent = await createAgentSession({
+  projectRoot: "/app/my-agent",
+  cwd: "/data/current-task",
+  sessionManager: SessionManager.inMemory("/data/current-task"),
+});
+```
+
+The SDK also accepts `credentials` (Pi's native `CredentialStore`), `env` (named credential bindings), `uiContext`, `sessionFile`, and `sessionDir`. Model, tool, and resource configuration lives in `.pi`; the SDK does not have a second configuration surface. Unsupported behavior overrides return an error.
+
+## Project files and local state
+
+```text
+my-agent/
+├── .pi/
+│   ├── settings.json
+│   ├── SYSTEM.md
+│   ├── models.json             # Optional: native Pi custom-provider definitions
+│   ├── mcp.json                # Optional: native Pi MCP configuration
+│   ├── extensions/
+│   ├── skills/
+│   └── prompts/
+├── pi.lock                    # Commit to Git
+├── package.json               # Commit when using npm dependencies
+├── package-lock.json          # Commit when using npm dependencies
+└── .pi-lock/                  # Created automatically; excluded from Git
+    ├── releases/<digest>/     # Immutable code and resource snapshots
+    └── state/                 # Local sessions, TUI state, and CLI credentials
+```
+
+The project root's `AGENTS.md` or `AGENTS.override.md` and project-local `.agents/skills/` are included in the lock. Parent directories, `~/.pi`, and `~/.agents` are not searched.
+
+`pi.lock` records the resource inventory and load order, file hashes, npm dependency versions and integrity, model metadata, tool schemas, the initialized configuration fingerprint, and fingerprints for the Pi/pi-lock runtime code. Managed paths are relative to the project root.
+
+The CLI's `/login` stores credentials in `.pi-lock/state/auth.json`. SDK applications can inject their own credential store. Credentials and sessions are not written to the lockfile. Do not copy a user-level `auth.json`, `models-store.json`, or entire sessions directory into `.pi`.
+
+## Deployment and rollback
+
+Commit `.pi/`, `pi.lock`, and the npm manifests and lockfiles you use. A recommended approach is to deploy each Git commit into its own directory:
+
+```sh
+npm ci
+npx --no-install pi-lock sync --frozen
+npx --no-install pi-lock verify
+```
+
+You do not need `npm ci` if the agent has no additional npm dependencies. `sync --frozen` restores npm-locked dependencies in the project root and `.pi/npm/`, then verifies the agent without rewriting `pi.lock`.
+
+To roll back, restore the earlier Git commit and the matching pi-lock npm package version, then start that runtime. New sessions use that version. Older sessions carry their own `agentDigest` and are explicitly rejected if the version does not match. A running runtime continues to use its own snapshot, so a Git checkout change cannot mix another version's skills into it.
+
+Keep each release's dependency packages or a reproducible source for them. A lockfile cannot recover a package that has been removed from its remote source. Local npm tarballs must also be stored and committed within the project.
+
+Inspect the current lock:
+
+```sh
+npx --no-install pi-lock inspect
+```
+
+## Extensions, npm packages, and MCP
+
+The standard Pi TypeScript/JavaScript extension API remains unchanged. Relative helper imports for local extensions are included in the snapshot. Install external npm dependencies in the current project and pin them with an npm lockfile. Pi host packages and TypeBox use the same host instance instead of being duplicated. TypeScript compilation caches are disabled, and path mappings from another project's `tsconfig` are not read.
+
+Use the `packages` declaration in `.pi/settings.json` to load local resource packages, packages in the project's `node_modules`, or packages installed by `pi install -l` into `.pi/npm/node_modules`. Pi package manifests, globs, and resource filters are supported. If you specify a version, it must match the exact installed version; you can also omit the version and let `pi.lock` record the installed version.
+
+Vendor Git-based resource packages into the project or distribute them as npm packages pinned by integrity. The first release does not manage Pi's remote Git package installer. External symlinks, global npm packages, and API keys generated by shell commands are not part of frozen execution.
+
+MCP uses `mcpServers` from `.pi/mcp.json`. It supports stdio and Streamable HTTP, with direct, codemode, deferred, and hidden tool exposure. Tool-call adaptation, codemode, and `tool_search` use Pi 1.3.0 implementations. Server instructions, capabilities, and tool schemas are recorded at lock time and checked at startup and when making requests.
+
+Stdio MCP servers must use `node` or a project-relative executable; relative script paths in their configuration are included in the snapshot. Put any additional runner in the project dependencies. HTTP authentication uses explicit `${VARIABLE}` bindings. The first release does not read global MCP OAuth credentials automatically. A stdio child process receives only the configured environment variables and the Node executable's PATH; it does not inherit the entire user environment. Use `${WORKSPACE}` in arguments for the task directory and `${AGENT_ROOT}` for the current resource snapshot.
+
+## Guarantees and compatibility boundaries
+
+- Resource discovery uses only the locked inventory and supported entry points. The original global `pi` command and SDK do not automatically recognize `pi.lock`; use this project's CLI or SDK entry points.
+- Extensions that read user directories, dynamically import arbitrary external code, or change business logic based on `ctx.mode` need adaptation. pi-lock checks initialized configuration and rejects detectable differences, but it is not an OS sandbox for arbitrary JavaScript. Direct mutation of Pi internals by an SDK host is also outside the freeze contract.
+- Task files, session history, external-service responses, credentials, and the clock are runtime inputs. Programs launched by filesystem tools still require a compatible host environment. A locked configuration cannot make a macOS-only command run on Linux.
+- The SDK does not modify `process.env`, `HOME`, or the process working directory. The CLI sets project-local Pi state paths in its own process and disables Pi's automatic downloads and updates. Native TUI colors and key bindings affect presentation, not the agent definition.
+- A headless call that needs user interaction reports `INTERACTION_REQUIRED` by default; it does not approve automatically. The SDK can receive native `uiContext` callbacks. RPC and TUI use Pi's own interaction channels.
+- Session metadata is bound to an agent version. Applications must explicitly handle version and data migrations, and reversal of side effects already performed by external tools.
+- See the [acceptance report](docs/acceptance.md) for the tested environment. Tests in temporary directories on one machine are not presented as proof of cross-platform operation or compatibility with every third-party extension.
+
+## Development and acceptance
+
+```sh
+npm ci
+npm test
+```
+
+Acceptance uses Pi's real `AgentSession`, native TUI (through a PTY), native RPC, native OpenAI-compatible HTTP streaming, and a local MCP server. Model responses come from deterministic local fixtures, so no real account or paid request is required.
+
+See the [architecture notes](docs/architecture.md) for implementation details and trade-offs.

package/dist/bridge.d.ts

@@ -0,0 +1,7 @@
+import type { ExtensionFactory, LoadExtensionsResult, ExtensionRuntime, EventBus } from "@earendil-works/pi-coding-agent";
+export declare function assertEngine(): void;
+export declare function explicitExtensionLoader(): Promise<{
+    loadExtensions: (paths: string[], cwd: string, events?: EventBus, runtime?: ExtensionRuntime) => Promise<LoadExtensionsResult>;
+    loadExtensionFromFactory: (factory: ExtensionFactory, cwd: string, events: EventBus, runtime: ExtensionRuntime, name?: string) => Promise<LoadExtensionsResult["extensions"][number]>;
+}>;
+export declare function internalModule(path: string): Promise<any>;

package/dist/bridge.js

@@ -0,0 +1,18 @@
+// Pi 1.3.0 exposes ResourceLoader publicly but not its explicit-only extension loader.
+// Keep these version-specific imports in one audited bridge; never call discovery.
+import { VERSION } from "@earendil-works/pi-coding-agent";
+import { PI_VERSION, fail } from "./common.js";
+const entry = import.meta.resolve("@earendil-works/pi-coding-agent");
+export function assertEngine() {
+    if (VERSION !== PI_VERSION)
+        fail("ENGINE_MISMATCH", `pi-lock supports Pi ${PI_VERSION}; installed Pi is ${VERSION}. Run npm ci.`);
+}
+export async function explicitExtensionLoader() {
+    assertEngine();
+    return import(new URL("./core/extensions/loader.js", entry).href);
+}
+export async function internalModule(path) {
+    assertEngine();
+    return import(new URL(path, entry).href);
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,mFAAmF;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,iCAAiC,CAAC;AAE1D,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC;AACrE,MAAM,UAAU,YAAY;IAC1B,IAAI,OAAO,KAAK,UAAU;QAAE,IAAI,CAAC,iBAAiB,EAAE,uBAAuB,UAAU,qBAAqB,OAAO,eAAe,CAAC,CAAC;AACpI,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAI3C,YAAY,EAAE,CAAC;IACf,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAY;IAC/C,YAAY,EAAE,CAAC;IACf,OAAO,MAAM,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/cli.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+// This entry intentionally imports no Pi code until its per-process paths are bound locally.
+import { mkdirSync } from "node:fs";
+import { resolve } from "node:path";
+import { fail, findProject, LockError, PI_VERSION } from "./common.js";
+const help = `pi-lock — Pi ${PI_VERSION}, project-local and reproducible
+
+  pi-lock init [--demo]              Create ordinary .pi settings and resources
+  pi-lock lock                       Generate/update pi.lock after editing
+  pi-lock                            Open Pi's native TUI (frozen by default)
+  pi-lock -p "prompt"                Print a response and exit
+  pi-lock --mode rpc                 Use Pi's JSONL RPC protocol
+  pi-lock --mode json "prompt"       Stream Pi JSON events
+  pi-lock inspect                    Show the locked resources and fingerprint
+  pi-lock verify                     Verify source/dependencies against pi.lock
+  pi-lock sync --frozen               npm ci, then verify; never rewrite pi.lock
+
+  --project <dir>                    Agent definition root (auto-detected)
+  --cwd <dir>                        Task workspace (does not change the agent)
+  --dev                              Edit/tune before locking; /reload reads local edits
+  --provider <id> --model <id>        init/--dev only; saves local Pi settings
+  --thinking <level> --tools <list>   --dev only; saves local Pi settings
+  --session <file>                   Resume a matching locked session
+  --session-dir <dir>                Explicit application-owned session directory
+  --no-session                      Use an in-memory session
+  -c, --continue                     Continue latest session of this Agent version
+`;
+async function main() {
+    const args = process.argv.slice(2);
+    if (args.includes("--help") || args.includes("-h")) {
+        console.log(help);
+        return;
+    }
+    if (args.includes("--version") || args.includes("-v")) {
+        console.log(`pi-lock 0.1.0 (Pi ${PI_VERSION})`);
+        return;
+    }
+    const commands = new Set(["init", "lock", "inspect", "verify", "sync"]);
+    let command = commands.has(args[0]) ? args.shift() : "run";
+    const flags = {};
+    const messages = [];
+    const booleanFlags = new Set(["--demo", "--dev", "--no-session", "--frozen", "--continue", "-c", "-p", "--print"]);
+    const valueFlags = new Set(["--project", "--cwd", "--mode", "--provider", "--model", "--thinking", "--tools", "--session", "--session-dir"]);
+    while (args.length) {
+        const arg = args.shift();
+        if (arg === "--") {
+            messages.push(...args);
+            break;
+        }
+        if (booleanFlags.has(arg))
+            flags[arg] = true;
+        else if (valueFlags.has(arg)) {
+            const value = args.shift();
+            if (!value || value.startsWith("--"))
+                fail("ARGUMENT", `${arg} needs a value.`);
+            flags[arg] = value;
+        }
+        else if (arg.startsWith("-"))
+            fail("ARGUMENT", `Unknown option ${arg}. Run pi-lock --help.`);
+        else if (command === "run" && !messages.length && !flags["-p"] && !flags["--print"] && !flags["--mode"] && commands.has(arg))
+            command = arg;
+        else
+            messages.push(arg);
+    }
+    const cwd = resolve(String(flags["--cwd"] ?? process.cwd()));
+    const root = command === "init" ? resolve(String(flags["--project"] ?? cwd)) : findProject(cwd, flags["--project"]);
+    // Pi TUI helpers still use getAgentDir(); set it before importing Pi, inside this CLI process only.
+    const uiRoot = resolve(root, ".pi-lock/state/ui");
+    mkdirSync(uiRoot, { recursive: true });
+    process.env.PI_CODING_AGENT_DIR = uiRoot;
+    process.env.PI_CODING_AGENT_SESSION_DIR = resolve(root, ".pi-lock/state/sessions");
+    process.env.PI_OFFLINE = "1";
+    process.env.PI_SKIP_VERSION_CHECK = "1";
+    process.env.PI_TELEMETRY = "0";
+    const { execute } = await import("./commands.js");
+    await execute(command, root, cwd, flags, messages);
+}
+main().catch(error => {
+    console.error(`${error instanceof LockError ? error.code : "PI_LOCK_ERROR"}: ${error.message}`);
+    process.exitCode = 1;
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,6FAA6F;AAC7F,OAAO,EAA4B,SAAS,EAAgB,MAAM,SAAS,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAoB,SAAS,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzF,MAAM,IAAI,GAAG,gBAAgB,UAAU;;;;;;;;;;;;;;;;;;;;;CAqBtC,CAAC;AAEF,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,UAAU,GAAG,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACnH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,IAAI,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAG,CAAC,CAAC,CAAC,KAAK,CAAC;IAC5D,MAAM,KAAK,GAAqC,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC,CAAC;IAC7I,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,EAAG,CAAC;QAC1B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;QACpD,IAAI,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;aACxC,IAAI,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,iBAAiB,CAAC,CAAC;YAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClI,CAAC;aAAM,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,kBAAkB,GAAG,uBAAuB,CAAC,CAAC;aAC1F,IAAI,OAAO,KAAK,KAAK,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,GAAG,CAAC;;YACvI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,WAAW,CAAuB,CAAC,CAAC;IAC1I,oGAAoG;IACpG,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;IAClD,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,MAAM,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,2BAA2B,GAAG,OAAO,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,qBAAqB,GAAG,GAAG,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC;IAC/B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AACrD,CAAC;AACD,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AACvB,CAAC,CAAC,CAAC"}

package/dist/commands.d.ts

@@ -0,0 +1 @@
+export declare function execute(command: string, root: string, cwd: string, flags: Record<string, string | boolean>, messages: string[]): Promise<void>;

package/dist/commands.js

@@ -0,0 +1,114 @@
+import { copyFileSync, existsSync, mkdirSync, rmSync } from "node:fs";
+import { resolve } from "node:path";
+import { spawn } from "node:child_process";
+import { InteractiveMode, initTheme, runPrintMode, runRpcMode, SessionManager } from "@earendil-works/pi-coding-agent";
+import { atomicJson, digest, fail, json } from "./common.js";
+import { internalModule } from "./bridge.js";
+import { initialize } from "./init.js";
+import { createLockedRuntime, lockProject } from "./runtime.js";
+import { materialize, readLock, verifyDefinition, verifySourcesBeforeInstall } from "./lock.js";
+async function npmCi(cwd) {
+    await new Promise((done, reject) => {
+        const child = spawn("npm", ["ci", "--no-audit", "--no-fund"], { cwd, stdio: "inherit", shell: false });
+        child.on("error", reject);
+        child.on("close", code => code === 0 ? done() : reject(new Error(`npm ci failed (${code}) in ${cwd}`)));
+    });
+}
+export async function execute(command, root, cwd, flags, messages) {
+    if (command === "init") {
+        initialize(root, { demo: Boolean(flags["--demo"]), provider: flags["--provider"], model: flags["--model"] });
+        console.log(`Created .pi/settings.json${flags["--demo"] ? " and offline demo" : ""}. Run pi-lock --dev to tune, then pi-lock lock.`);
+        return;
+    }
+    if (command === "lock") {
+        const lock = await lockProject(root);
+        console.log(`Locked Pi ${lock.runtime.pi}: ${lock.agentDigest}\nCommit .pi/ and pi.lock to Git.`);
+        return;
+    }
+    if (command === "sync") {
+        if (!flags["--frozen"])
+            fail("ARGUMENT", "Use pi-lock sync --frozen to restore dependencies without changing pi.lock.");
+        const lock = readLock(root);
+        verifySourcesBeforeInstall(root, lock);
+        for (const path of [root, resolve(root, ".pi/npm")])
+            if (existsSync(resolve(path, "package-lock.json")))
+                await npmCi(path);
+    }
+    if (["verify", "inspect", "sync"].includes(command)) {
+        const lock = readLock(root);
+        verifyDefinition(root, lock);
+        materialize(root, lock);
+        if (command === "inspect")
+            console.log(JSON.stringify({ agentDigest: lock.agentDigest, pi: lock.runtime.pi, configuration: lock.effective, resources: lock.definition.resources, dependencies: lock.definition.dependencies }, null, 2));
+        else
+            console.log(`Verified ${lock.agentDigest}`);
+        return;
+    }
+    const edits = { "--model": "defaultModel", "--provider": "defaultProvider", "--thinking": "defaultThinkingLevel", "--tools": "defaultTools" };
+    for (const [flag, field] of Object.entries(edits))
+        if (flags[flag] !== undefined) {
+            if (!flags["--dev"])
+                fail("FROZEN_SETTING", `${flag} changes locked behavior. Start --dev to tune, then pi-lock lock.`);
+            const path = resolve(root, ".pi/settings.json");
+            const config = json(path);
+            config[field] = flag === "--tools" ? String(flags[flag]).split(",") : flags[flag];
+            atomicJson(path, config);
+        }
+    const mode = flags["--mode"] ?? ((flags["-p"] || flags["--print"]) ? "print" : "tui");
+    if (!["tui", "rpc", "json", "print", "text"].includes(String(mode)))
+        fail("ARGUMENT", `Unknown mode ${mode}.`);
+    const state = resolve(root, ".pi-lock/state");
+    mkdirSync(state, { recursive: true });
+    const { AuthStorage } = await internalModule("./core/auth-storage.js");
+    const credentials = AuthStorage.create(resolve(state, "auth.json"));
+    const opts = { projectRoot: root, cwd, credentials, dev: Boolean(flags["--dev"]), sessionFile: flags["--session"], sessionDir: flags["--session-dir"] };
+    if (flags["--no-session"])
+        opts.sessionManager = SessionManager.inMemory(cwd);
+    if (flags["--continue"] || flags["-c"]) {
+        if (opts.dev)
+            fail("ARGUMENT", "Continue a frozen version, or use --session explicitly while developing.");
+        const lock = readLock(root);
+        const dir = resolve(String(flags["--session-dir"] ?? resolve(state, "sessions", lock.agentDigest, digest(cwd).slice(0, 12))));
+        opts.sessionManager = SessionManager.continueRecent(cwd, dir);
+    }
+    if (mode !== "tui")
+        (await internalModule("./core/output-guard.js")).takeOverStdout();
+    const locked = await createLockedRuntime(opts);
+    const themeModule = await internalModule("./modes/interactive/theme/theme.js");
+    themeModule.setRegisteredThemes(locked.runtime.services.resourceLoader.getThemes().themes);
+    initTheme(locked.runtime.services.settingsManager.getTheme(), false);
+    const keys = resolve(locked.releaseRoot, ".pi/keybindings.json");
+    if (existsSync(keys))
+        copyFileSync(keys, resolve(state, "ui/keybindings.json"));
+    else
+        rmSync(resolve(state, "ui/keybindings.json"), { force: true });
+    try {
+        if (mode === "rpc") {
+            await runRpcMode(locked.runtime);
+        }
+        else if (mode === "tui") {
+            if (!process.stdin.isTTY || !process.stdout.isTTY)
+                fail("TTY_REQUIRED", "TUI requires a terminal. Use -p or --mode rpc for non-interactive execution.");
+            const tui = new InteractiveMode(locked.runtime, { initialMessage: messages.join(" ") || undefined, initialImages: [], initialMessages: [], migratedProviders: [], verbose: false });
+            await tui.run();
+        }
+        else {
+            let prompt = messages.join(" ");
+            if (!process.stdin.isTTY) {
+                const chunks = [];
+                for await (const chunk of process.stdin)
+                    chunks.push(Buffer.from(chunk));
+                const input = Buffer.concat(chunks).toString("utf8").trim();
+                if (input)
+                    prompt = [input, prompt].filter(Boolean).join("\n\n");
+            }
+            if (!prompt)
+                fail("PROMPT_REQUIRED", "Pass a prompt or pipe input into pi-lock -p.");
+            process.exitCode = await runPrintMode(locked.runtime, { mode: mode === "json" ? "json" : "text", initialMessage: prompt, initialImages: [], messages: [] });
+        }
+    }
+    finally {
+        await locked.dispose();
+    }
+}
+//# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACtE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,0BAA0B,EAAE,MAAM,WAAW,CAAC;AAEhG,KAAK,UAAU,KAAK,CAAC,GAAW;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IACrI,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,IAAY,EAAE,GAAW,EAAE,KAAuC,EAAE,QAAkB;IACnI,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,YAAY,CAAW,EAAE,KAAK,EAAE,KAAK,CAAC,SAAS,CAAW,EAAE,CAAC,CAAC;QACjI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,iDAAiD,CAAC,CAAC;QAAC,OAAO;IAC/I,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,IAAI,CAAC,WAAW,mCAAmC,CAAC,CAAC;QAAC,OAAO;IAC5G,CAAC;IACD,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAAE,IAAI,CAAC,UAAU,EAAE,6EAA6E,CAAC,CAAC;QACxH,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,0BAA0B,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACvC,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAAE,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;gBAAE,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7H,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAAC,gBAAgB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAAC,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACnF,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;;YACpO,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,KAAK,GAA2B,EAAE,SAAS,EAAE,cAAc,EAAE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,sBAAsB,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;IACtK,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YACjF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;gBAAE,IAAI,CAAC,gBAAgB,EAAE,GAAG,IAAI,mEAAmE,CAAC,CAAC;YACxH,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAAC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3E,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC9G,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IACtF,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,UAAU,EAAE,gBAAgB,IAAI,GAAG,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IAC9C,SAAS,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,EAAE,WAAW,EAAE,GAAG,MAAM,cAAc,CAAC,wBAAwB,CAAC,CAAC;IACvE,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;IAC7J,IAAI,KAAK,CAAC,cAAc,CAAC;QAAE,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9E,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG;YAAE,IAAI,CAAC,UAAU,EAAE,0EAA0E,CAAC,CAAC;QAC3G,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,IAAI,KAAK,KAAK;QAAE,CAAC,MAAM,cAAc,CAAC,wBAAwB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;IACtF,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,MAAM,cAAc,CAAC,oCAAoC,CAAC,CAAC;IAC/E,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3F,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,CAAC,CAAC;;QAC3E,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,qBAAqB,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAAC,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;aACpD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;gBAAE,IAAI,CAAC,cAAc,EAAE,8EAA8E,CAAC,CAAC;YACxJ,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,EAAE,aAAa,EAAE,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,iBAAiB,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YACpL,MAAM,GAAG,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;aAAM,CAAC;YACN,IAAI,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAa,EAAE,CAAC;gBAAC,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;oBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;gBACtG,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;gBAAC,IAAI,KAAK;oBAAE,MAAM,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAChI,CAAC;YACD,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,iBAAiB,EAAE,8CAA8C,CAAC,CAAC;YACrF,OAAO,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QAC9J,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AACvC,CAAC"}

package/dist/common.d.ts

@@ -0,0 +1,17 @@
+export declare const PI_VERSION = "1.3.0";
+export declare const FORMAT = 1;
+export declare class LockError extends Error {
+    code: string;
+    constructor(code: string, message: string);
+}
+export declare function fail(code: string, message: string): never;
+export declare function canonical(value: unknown): string;
+export declare function hash(value: string | Buffer): string;
+export declare function digest(value: unknown): string;
+export declare function json<T = any>(path: string): T;
+export declare function atomicJson(path: string, value: unknown): void;
+export declare function inside(root: string, path: string): string;
+export declare function portablePath(root: string, full: string): string;
+export declare function walk(root: string, path: string, skip?: Set<string>): string[];
+export declare function findProject(start: string, explicit?: string): string;
+export declare function replaceRoots(value: unknown, roots: Array<[string, string]>): unknown;

package/dist/common.js

@@ -0,0 +1,87 @@
+import { createHash } from "node:crypto";
+import { existsSync, lstatSync, readFileSync, realpathSync, readdirSync, statSync, mkdirSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
+export const PI_VERSION = "1.3.0";
+export const FORMAT = 1;
+export class LockError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "LockError";
+    }
+}
+export function fail(code, message) { throw new LockError(code, message); }
+export function canonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.keys(value).filter(k => value[k] !== undefined).sort().map(k => `${JSON.stringify(k)}:${canonical(value[k])}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+export function hash(value) { return createHash("sha256").update(value).digest("hex"); }
+export function digest(value) { return hash(canonical(value)); }
+export function json(path) {
+    try {
+        return JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch (e) {
+        return fail("INVALID_JSON", `${path}: ${e.message}`);
+    }
+}
+export function atomicJson(path, value) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temp = `${path}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
+    writeFileSync(temp, JSON.stringify(value, null, 2) + "\n", { mode: 0o600 });
+    renameSync(temp, path);
+}
+export function inside(root, path) {
+    const full = resolve(root, path);
+    const rel = relative(root, full);
+    if (isAbsolute(rel) || rel === ".." || rel.startsWith(`..${sep}`))
+        fail("OUTSIDE_PROJECT", `Resource must be inside the agent project: ${path}`);
+    if (existsSync(full)) {
+        const actual = relative(realpathSync(root), realpathSync(full));
+        if (isAbsolute(actual) || actual === ".." || actual.startsWith(`..${sep}`))
+            fail("OUTSIDE_PROJECT", `Symlink leaves agent project: ${path}`);
+    }
+    return full;
+}
+export function portablePath(root, full) { return relative(root, full).split(sep).join("/"); }
+export function walk(root, path, skip = new Set()) {
+    if (!existsSync(path))
+        return [];
+    inside(root, path);
+    if (lstatSync(path).isSymbolicLink())
+        fail("SYMLINK_RESOURCE", `Use ordinary project files instead of symlinks: ${path}`);
+    if (!statSync(path).isDirectory())
+        return [path];
+    return readdirSync(path).sort().filter(name => !skip.has(name)).flatMap(name => walk(root, resolve(path, name), skip));
+}
+export function findProject(start, explicit) {
+    if (explicit)
+        return realpathSync(resolve(explicit));
+    let path = realpathSync(resolve(start));
+    while (true) {
+        if (existsSync(resolve(path, "pi.lock")) || existsSync(resolve(path, ".pi/settings.json")))
+            return path;
+        const parent = dirname(path);
+        if (parent === path)
+            fail("NO_PROJECT", "No pi.lock or .pi/settings.json found. Run pi-lock init in the agent project.");
+        path = parent;
+    }
+}
+export function replaceRoots(value, roots) {
+    if (typeof value === "string") {
+        for (const [root, label] of [...roots].sort((a, b) => b[0].length - a[0].length))
+            value = value.split(root).join(label);
+        return value;
+    }
+    if (Array.isArray(value))
+        return value.map(v => replaceRoots(v, roots));
+    if (value && typeof value === "object")
+        return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, replaceRoots(v, roots)]));
+    return value;
+}
+//# sourceMappingURL=common.js.map

package/dist/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../src/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACzI,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExE,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAC;AACxB,MAAM,OAAO,SAAU,SAAQ,KAAK;IACf,IAAI;IAAvB,YAAmB,IAAY,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;oBAAhD,IAAI;QAA6C,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAAC,CAAC;CAC/F;AACD,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,OAAe,IAAW,MAAM,IAAI,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;AAClG,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,KAAa,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,SAAS,CAAE,KAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClK,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AAC/B,CAAC;AACD,MAAM,UAAU,IAAI,CAAC,KAAsB,IAAY,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjH,MAAM,UAAU,MAAM,CAAC,KAAc,IAAY,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,MAAM,UAAU,IAAI,CAAU,IAAY;IACxC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IACtD,OAAO,CAAC,EAAE,CAAC;QAAC,OAAO,IAAI,CAAC,cAAc,EAAE,GAAG,IAAI,KAAM,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AAChF,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,KAAc;IACrD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;IACjF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACzB,CAAC;AACD,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;QAAE,IAAI,CAAC,iBAAiB,EAAE,8CAA8C,IAAI,EAAE,CAAC,CAAC;IACjJ,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAChE,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,GAAG,EAAE,CAAC;YAAE,IAAI,CAAC,iBAAiB,EAAE,iCAAiC,IAAI,EAAE,CAAC,CAAC;IAC/I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAY,IAAY,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtH,MAAM,UAAU,IAAI,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,IAAI,GAAG,EAAU;IACvE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnB,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;QAAE,IAAI,CAAC,kBAAkB,EAAE,mDAAmD,IAAI,EAAE,CAAC,CAAC;IAC1H,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACzH,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,QAAiB;IAC1D,IAAI,QAAQ;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,IAAI,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACxC,OAAO,IAAI,EAAE,CAAC;QACZ,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACxG,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,MAAM,KAAK,IAAI;YAAE,IAAI,CAAC,YAAY,EAAE,+EAA+E,CAAC,CAAC;QACzH,IAAI,GAAG,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AACD,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAA8B;IACzE,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;YAAE,KAAK,GAAI,KAAgB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpI,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACxE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACtI,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/definition.d.ts

@@ -0,0 +1,32 @@
+export interface FileRecord {
+    path: string;
+    sha256: string;
+    executable: boolean;
+}
+export interface Resources {
+    extensions: string[];
+    skills: string[];
+    prompts: string[];
+    themes: string[];
+    context: string[];
+    system?: string;
+    append?: string;
+}
+export interface Definition {
+    settings: Record<string, any>;
+    files: FileRecord[];
+    resources: Resources;
+    dependencies: Array<{
+        path: string;
+        name: string;
+        version: string;
+        integrity?: string;
+    }>;
+    modelConfig: Record<string, any>;
+}
+export declare function readDefinition(root: string): Definition;
+export declare function runtimeIdentity(): {
+    pi: string;
+    adapter: string;
+    sha256: string;
+};