Drive PBI Desk from your own code

# One base URL, one header pair. Put the token in the shell once.
API="https://api.skillsafe.ai/v1/app-api"
export SKILLSAFE_TOKEN="YOUR_TOKEN"

ss() {   # ss /me            -> GET
         # ss /estimate FILE -> POST the file as the body
  if [ -n "$2" ]; then
    curl -s -X POST "$API$1" \
      -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
      -H "Content-Type: application/json" \
      -d @"$2"
  else
    curl -s "$API$1" -H "Authorization: Bearer $SKILLSAFE_TOKEN"
  fi
}

import json, os, urllib.request

API = "https://api.skillsafe.ai/v1/app-api"
TOKEN = os.environ.get("SKILLSAFE_TOKEN", "YOUR_TOKEN")   # /tokens.html

def call(path, body=None, token=TOKEN, extra_headers=None):
    headers = {"Content-Type": "application/json"}
    if token:
        headers["Authorization"] = "Bearer " + token
    headers.update(extra_headers or {})
    data = json.dumps(body).encode() if body is not None else None
    req = urllib.request.Request(API + path, data=data, headers=headers,
                                 method="POST" if data is not None else "GET")
    with urllib.request.urlopen(req) as r:
        payload = json.loads(r.read().decode())
    if not payload.get("ok"):
        raise RuntimeError(payload.get("error"))
    return payload["data"]

const API = "https://api.skillsafe.ai/v1/app-api";
var TOKEN = "YOUR_TOKEN";   // from https://pbi-desk.skillsafe.ai/tokens.html

async function call(path, body, opts = {}) {
  const headers = { "Content-Type": "application/json", ...(opts.headers || {}) };
  if (opts.token !== null) headers.Authorization = `Bearer ${opts.token ?? TOKEN}`;
  const res = await fetch(API + path, {
    method: body === undefined ? "GET" : "POST",
    headers,
    body: body === undefined ? undefined : JSON.stringify(body),
  });
  const payload = await res.json();
  if (!payload.ok) throw Object.assign(new Error(payload.error?.message), payload.error);
  return payload.data;
}

package main

import (
	"bytes"
	"encoding/json"
	"fmt"
	"io"
	"net/http"
	"os"
)

const api = "https://api.skillsafe.ai/v1/app-api"

func token() string {
	if t := os.Getenv("SKILLSAFE_TOKEN"); t != "" {
		return t
	}
	return "YOUR_TOKEN" // from https://pbi-desk.skillsafe.ai/tokens.html
}

type envelope struct {
	OK    bool            `json:"ok"`
	Data  json.RawMessage `json:"data"`
	Error json.RawMessage `json:"error"`
}

func call(path string, body any, hdr map[string]string) (json.RawMessage, error) {
	var rdr io.Reader
	method := http.MethodGet
	if body != nil {
		b, _ := json.Marshal(body)
		rdr = bytes.NewReader(b)
		method = http.MethodPost
	}
	req, _ := http.NewRequest(method, api+path, rdr)
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+token())
	for k, v := range hdr {
		req.Header.Set(k, v)
	}
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer res.Body.Close()
	var e envelope
	if err := json.NewDecoder(res.Body).Decode(&e); err != nil {
		return nil, err
	}
	if !e.OK {
		return nil, fmt.Errorf("%s", e.Error)
	}
	return e.Data, nil
}

import java.net.URI;
import java.net.http.*;
import java.util.Map;

public class PbiDesk {
  static final String API = "https://api.skillsafe.ai/v1/app-api";
  // from https://pbi-desk.skillsafe.ai/tokens.html
  static final String TOKEN = System.getenv().getOrDefault("SKILLSAFE_TOKEN", "YOUR_TOKEN");
  static final HttpClient HTTP = HttpClient.newHttpClient();

  static String call(String path, String jsonBody, Map<String, String> extra) throws Exception {
    HttpRequest.Builder b = HttpRequest.newBuilder(URI.create(API + path))
        .header("Content-Type", "application/json")
        .header("Authorization", "Bearer " + TOKEN);
    extra.forEach(b::header);
    HttpRequest req = jsonBody == null
        ? b.GET().build()
        : b.POST(HttpRequest.BodyPublishers.ofString(jsonBody)).build();
    HttpResponse<String> res = HTTP.send(req, HttpResponse.BodyHandlers.ofString());
    return res.body();   // {"ok":true,"data":{...}} or {"ok":false,"error":{...}}
  }
}

require "json"
require "net/http"
require "uri"

API = "https://api.skillsafe.ai/v1/app-api"
# from https://pbi-desk.skillsafe.ai/tokens.html
TOKEN = ENV.fetch("SKILLSAFE_TOKEN", "YOUR_TOKEN")

def call(path, body = nil, extra = {})
  uri = URI(API + path)
  req = body.nil? ? Net::HTTP::Get.new(uri) : Net::HTTP::Post.new(uri)
  req["Content-Type"] = "application/json"
  req["Authorization"] = "Bearer #{TOKEN}"
  extra.each { |k, v| req[k] = v }
  req.body = JSON.dump(body) unless body.nil?
  res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
  payload = JSON.parse(res.body)
  raise payload["error"].to_s unless payload["ok"]
  payload["data"]
end

<?php
const API = "https://api.skillsafe.ai/v1/app-api";
// from https://pbi-desk.skillsafe.ai/tokens.html
$TOKEN = getenv("SKILLSAFE_TOKEN") ?: "YOUR_TOKEN";

function call(string $path, $body = null, array $extra = []) {
    global $TOKEN;
    $headers = ["Content-Type: application/json", "Authorization: Bearer " . $TOKEN];
    foreach ($extra as $k => $v) { $headers[] = "$k: $v"; }
    $ch = curl_init(API . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => $headers,
    ]);
    if ($body !== null) {
        curl_setopt($ch, CURLOPT_POST, true);
        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($body));
    }
    $payload = json_decode(curl_exec($ch), true);
    curl_close($ch);
    if (empty($payload["ok"])) { throw new RuntimeException(json_encode($payload["error"])); }
    return $payload["data"];
}

using System.Net.Http.Headers;
using System.Text;
using System.Text.Json;

static class PbiDesk {
    const string Api = "https://api.skillsafe.ai/v1/app-api";
    // from https://pbi-desk.skillsafe.ai/tokens.html
    static readonly string Token =
        Environment.GetEnvironmentVariable("SKILLSAFE_TOKEN") ?? "YOUR_TOKEN";
    static readonly HttpClient Http = new();

    public static async Task<JsonElement> CallAsync(
            string path, object? body = null, IDictionary<string, string>? extra = null) {
        var req = new HttpRequestMessage(body is null ? HttpMethod.Get : HttpMethod.Post, Api + path);
        req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Token);
        if (extra is not null) foreach (var kv in extra) req.Headers.Add(kv.Key, kv.Value);
        if (body is not null)
            req.Content = new StringContent(JsonSerializer.Serialize(body), Encoding.UTF8, "application/json");
        var res = await Http.SendAsync(req);
        var doc = JsonDocument.Parse(await res.Content.ReadAsStringAsync());
        if (!doc.RootElement.GetProperty("ok").GetBoolean())
            throw new Exception(doc.RootElement.GetProperty("error").ToString());
        return doc.RootElement.GetProperty("data");
    }
}

# A guest token - free calls only (/me and /estimate)
curl -s -X POST "https://api.skillsafe.ai/v1/app-api/guest" \
  -H "Content-Type: application/json" \
  -d '{"slug":"pbi-desk"}'

# The reply carries {"ok":true,"data":{"token":"aut_..."}}.
#
# Reviewing a project is metered and needs a PERSONAL token. Open
#   https://pbi-desk.skillsafe.ai/tokens.html
# sign in there, and copy the shell export it gives you:
export SKILLSAFE_TOKEN="YOUR_TOKEN"

# Free calls only - /me and /estimate:
guest = call("/guest", {"slug": "pbi-desk"}, token=None)["token"]

# A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
# Keep TOKEN out of source control; the helper above already reads
# SKILLSAFE_TOKEN from the environment and falls back to the placeholder.
print(guest[:8] + "...", "guest token minted")

// Free calls only - /me and /estimate:
const { token: guest } = await call("/guest", { slug: "pbi-desk" }, { token: null });

// A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
// In a browser build, read it from your own settings store and assign it:
TOKEN = guest;                 // fine for /me and /estimate
// TOKEN = "aut_your_personal_token";   // required before /run

// Free calls only - /me and /estimate. /guest takes no Authorization header,
// so it is the one call that ignores token().
body, _ := json.Marshal(map[string]string{"slug": "pbi-desk"})
res, _ := http.Post(api+"/guest", "application/json", bytes.NewReader(body))
defer res.Body.Close()

var g struct {
	Data struct {
		Token string `json:"token"`
	} `json:"data"`
}
json.NewDecoder(res.Body).Decode(&g)
fmt.Println("guest token:", g.Data.Token[:8]+"...")

// A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
// exported as SKILLSAFE_TOKEN.

// Free calls only - /me and /estimate:
HttpRequest guestReq = HttpRequest.newBuilder(URI.create(API + "/guest"))
    .header("Content-Type", "application/json")
    .POST(HttpRequest.BodyPublishers.ofString("{\"slug\":\"pbi-desk\"}"))
    .build();
System.out.println(HTTP.send(guestReq, HttpResponse.BodyHandlers.ofString()).body());

// A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
// exported as SKILLSAFE_TOKEN, which TOKEN above already picks up.

# Free calls only - /me and /estimate:
uri = URI(API + "/guest")
req = Net::HTTP::Post.new(uri)
req["Content-Type"] = "application/json"
req.body = JSON.dump({ "slug" => "pbi-desk" })
res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |h| h.request(req) }
guest = JSON.parse(res.body)["data"]["token"]
puts "guest token: #{guest[0, 8]}..."

# A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
# exported as SKILLSAFE_TOKEN.

<?php
// Free calls only - /me and /estimate:
$ch = curl_init(API . "/guest");
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_POST => true,
    CURLOPT_HTTPHEADER => ["Content-Type: application/json"],
    CURLOPT_POSTFIELDS => json_encode(["slug" => "pbi-desk"]),
]);
$guest = json_decode(curl_exec($ch), true)["data"]["token"];
curl_close($ch);
printf("guest token: %s...\n", substr($guest, 0, 8));

// A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
// exported as SKILLSAFE_TOKEN.

// Free calls only - /me and /estimate:
using var guestRes = await new HttpClient().PostAsync(
    "https://api.skillsafe.ai/v1/app-api/guest",
    new StringContent("{\"slug\":\"pbi-desk\"}", Encoding.UTF8, "application/json"));
var guest = JsonDocument.Parse(await guestRes.Content.ReadAsStringAsync())
    .RootElement.GetProperty("data").GetProperty("token").GetString();
Console.WriteLine($"guest token: {guest![..8]}...");

// A review needs a personal token from https://pbi-desk.skillsafe.ai/tokens.html
// exported as SKILLSAFE_TOKEN, which Token above already picks up.

curl -s "https://api.skillsafe.ai/v1/app-api/me" -H "Authorization: Bearer $SKILLSAFE_TOKEN"

# {"ok":true,"data":{"subject_type":"user","username":"...","credits":128400}}
# subject_type "guest" means /estimate works but /run will be rejected.

me = call("/me")
print(me["subject_type"], me.get("credits"))
if me["subject_type"] != "user":
    raise SystemExit("reviewing a project needs a personal token")

const me = await call("/me");
console.log(me.subject_type, me.credits);
if (me.subject_type !== "user") throw new Error("reviewing a project needs a personal token");

raw, err := call("/me", nil, nil)
if err != nil {
	panic(err)
}
var me struct {
	SubjectType string `json:"subject_type"`
	Credits     int    `json:"credits"`
}
json.Unmarshal(raw, &me)
fmt.Println(me.SubjectType, me.Credits)
if me.SubjectType != "user" {
	panic("reviewing a project needs a personal token")
}

String me = call("/me", null, Map.of());
System.out.println(me);   // subject_type must be "user" before /run

me = call("/me")
puts "#{me["subject_type"]} #{me["credits"]}"
abort "reviewing a project needs a personal token" unless me["subject_type"] == "user"

$me = call("/me");
printf("%s %d\n", $me["subject_type"], $me["credits"] ?? 0);
if ($me["subject_type"] !== "user") {
    throw new RuntimeException("reviewing a project needs a personal token");
}

var me = await PbiDesk.CallAsync("/me");
Console.WriteLine($"{me.GetProperty("subject_type")} {me.GetProperty("credits")}");

curl -s -X POST "https://api.skillsafe.ai/v1/app-api/estimate" \
  -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"task":"model","project":"table Sales\n  column CustomerKey\n","context":"Import mode."}'

# {"ok":true,"data":{"model":"gpt-5.6-terra","model_alias":"gpt-terra",
#                    "markup_bps":1000,"hold_credits":5240,"min_credits":900}}
#
# Re-run this for each task value you intend to use. The holds are not the same.

run_input = {
    "task": "model",                       # model | dax | perf | tmdl | report
    "project": open("definition.tmdl").read(),
    "context": "Import mode, refreshed hourly. RLS by region is live.",
    # "focus": "Sales LY and Active Customers",   # dax and tmdl lanes
    # "target_ms": 1500,                          # perf lane
    "prescan_facts": prescan,                     # optional, see above
}

est = call("/estimate", run_input)
print(est["hold_credits"], "credits reserved;", est["model"], est["model_alias"])
# FREE, creates no job, and performs no body validation at all - it cannot tell
# you the input shape is wrong, only that the model binding is right.
if me.get("credits", 0) < est["min_credits"]:
    raise SystemExit("top up before running")

const runInput = {
  task: "model",                       // model | dax | perf | tmdl | report
  project: tmdlSource,
  context: "Import mode, refreshed hourly. RLS by region is live.",
  // focus: "Sales LY and Active Customers",   // dax and tmdl lanes
  // target_ms: 1500,                          // perf lane
  prescan_facts: prescan,                      // optional
};

const est = await call("/estimate", runInput);
console.log(est.hold_credits, "reserved;", est.model, est.model_alias, est.markup_bps);
if (me.credits < est.min_credits) throw new Error("top up before running");

runInput := map[string]any{
	"task":    "model", // model | dax | perf | tmdl | report
	"project": tmdlSource,
	"context": "Import mode, refreshed hourly. RLS by region is live.",
}
raw, _ := call("/estimate", runInput, nil)
var est struct {
	Model      string `json:"model"`
	ModelAlias string `json:"model_alias"`
	Hold       int    `json:"hold_credits"`
	Min        int    `json:"min_credits"`
	MarkupBps  int    `json:"markup_bps"`
}
json.Unmarshal(raw, &est)
fmt.Println(est.Hold, "reserved;", est.Model, est.ModelAlias, est.MarkupBps)

String body = """
    {"task":"model",
     "project":"table Sales\\n  column CustomerKey\\n",
     "context":"Import mode, refreshed hourly."}
    """;
System.out.println(call("/estimate", body, Map.of()));
// hold_credits is a reservation priced against the output cap, not a price.

run_input = {
  "task" => "model",                   # model | dax | perf | tmdl | report
  "project" => File.read("definition.tmdl"),
  "context" => "Import mode, refreshed hourly. RLS by region is live.",
  # "focus" => "Sales LY",             # dax and tmdl lanes
  # "target_ms" => 1500,               # perf lane
}
est = call("/estimate", run_input)
puts "#{est["hold_credits"]} reserved; #{est["model"]} (#{est["model_alias"]})"
abort "top up before running" if me["credits"].to_i < est["min_credits"].to_i

$runInput = [
    "task" => "model",                 // model | dax | perf | tmdl | report
    "project" => file_get_contents("definition.tmdl"),
    "context" => "Import mode, refreshed hourly. RLS by region is live.",
];
$est = call("/estimate", $runInput);
printf("%d reserved; %s (%s)\n", $est["hold_credits"], $est["model"], $est["model_alias"]);
if (($me["credits"] ?? 0) < $est["min_credits"]) {
    throw new RuntimeException("top up before running");
}

var runInput = new Dictionary<string, object> {
    ["task"] = "model",                // model | dax | perf | tmdl | report
    ["project"] = File.ReadAllText("definition.tmdl"),
    ["context"] = "Import mode, refreshed hourly. RLS by region is live.",
};
var est = await PbiDesk.CallAsync("/estimate", runInput);
Console.WriteLine($"{est.GetProperty("hold_credits")} reserved; {est.GetProperty("model")}");

# The Idempotency-Key must carry the LANE. Five lanes over one project are five
# distinct runs and must not collide on one key.
KEY="pbi-desk:model:$(shasum -a 256 run-input.json | cut -c1-32):a1"

JOB=$(curl -s -X POST "https://api.skillsafe.ai/v1/app-api/run" \
  -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: $KEY" \
  -d @run-input.json | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"]["job_id"])')

until [ "$(curl -s "https://api.skillsafe.ai/v1/app-api/jobs/$JOB" -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
       | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"]["status"])')" != "running" ]; do
  sleep 2
done

curl -s "https://api.skillsafe.ai/v1/app-api/jobs/$JOB" -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"]["output"]["output"])'

import hashlib, time

basis = "|~|".join([run_input["task"], run_input["project"],
                    run_input.get("context", ""), run_input.get("focus", ""),
                    str(run_input.get("target_ms", ""))])
key = "pbi-desk:{}:{}:a1".format(run_input["task"],
                                 hashlib.sha256(basis.encode()).hexdigest()[:32])

job = call("/run", run_input, extra_headers={"Idempotency-Key": key})
job_id = job["job_id"]

while True:
    j = call("/jobs/" + job_id)
    if j["status"] != "running":
        break
    time.sleep(2)

result = json.loads(j["output"]["output"])   # the single JSON object
print(result["lane"], result["verdict"], len(result["findings"]), "findings")

const enc = new TextEncoder().encode([
  runInput.task, runInput.project, runInput.context ?? "",
  runInput.focus ?? "", String(runInput.target_ms ?? ""),
].join("|~|"));
const digest = [...new Uint8Array(await crypto.subtle.digest("SHA-256", enc))]
  .map((b) => b.toString(16).padStart(2, "0")).join("").slice(0, 32);
const key = `pbi-desk:${runInput.task}:${digest}:a1`;

const { job_id } = await call("/run", runInput, { headers: { "Idempotency-Key": key } });

let job;
do {
  await new Promise((r) => setTimeout(r, 2000));
  job = await call(`/jobs/${job_id}`);
} while (job.status === "running");

const result = JSON.parse(job.output.output);
console.log(result.lane, result.verdict, result.findings.length, "findings");

sum := sha256.Sum256([]byte(strings.Join([]string{
	"model", tmdlSource, contextText, "", "",
}, "|~|")))
key := fmt.Sprintf("pbi-desk:model:%x:a1", sum[:16])

raw, _ := call("/run", runInput, map[string]string{"Idempotency-Key": key})
var started struct {
	JobID string `json:"job_id"`
}
json.Unmarshal(raw, &started)

for {
	raw, _ = call("/jobs/"+started.JobID, nil, nil)
	var job struct {
		Status string `json:"status"`
		Output struct {
			Output string `json:"output"`
		} `json:"output"`
	}
	json.Unmarshal(raw, &job)
	if job.Status != "running" {
		fmt.Println(job.Output.Output)
		break
	}
	time.Sleep(2 * time.Second)
}

String key = "pbi-desk:model:" + Integer.toHexString(bodyJson.hashCode()) + ":a1";
String started = call("/run", bodyJson, Map.of("Idempotency-Key", key));
// Parse job_id out of `started`, then poll GET /jobs/{job_id} until
// status != "running", and read data.output.output as the single JSON object.
// Sleep two seconds between polls; a tight loop earns a 429.

require "digest"

basis = [run_input["task"], run_input["project"], run_input["context"].to_s,
         run_input["focus"].to_s, run_input["target_ms"].to_s].join("|~|")
key = "pbi-desk:#{run_input["task"]}:#{Digest::SHA256.hexdigest(basis)[0, 32]}:a1"

job_id = call("/run", run_input, { "Idempotency-Key" => key })["job_id"]

loop do
  job = call("/jobs/#{job_id}")
  break puts(job["output"]["output"]) if job["status"] != "running"
  sleep 2
end

$basis = implode("|~|", [
    $runInput["task"], $runInput["project"], $runInput["context"] ?? "",
    $runInput["focus"] ?? "", (string)($runInput["target_ms"] ?? ""),
]);
$key = sprintf("pbi-desk:%s:%s:a1", $runInput["task"], substr(hash("sha256", $basis), 0, 32));

$jobId = call("/run", $runInput, ["Idempotency-Key" => $key])["job_id"];

do {
    sleep(2);
    $job = call("/jobs/" . $jobId);
} while ($job["status"] === "running");

echo $job["output"]["output"];

var basis = string.Join("|~|", new[] {
    "model", tmdlSource, contextText, "", "" });
var digest = Convert.ToHexString(
    System.Security.Cryptography.SHA256.HashData(Encoding.UTF8.GetBytes(basis)))[..32].ToLower();
var key = $"pbi-desk:model:{digest}:a1";

var started = await PbiDesk.CallAsync("/run", runInput,
    new Dictionary<string, string> { ["Idempotency-Key"] = key });
var jobId = started.GetProperty("job_id").GetString();

JsonElement job;
do {
    await Task.Delay(2000);
    job = await PbiDesk.CallAsync($"/jobs/{jobId}");
} while (job.GetProperty("status").GetString() == "running");

Console.WriteLine(job.GetProperty("output").GetProperty("output"));

curl -N -X POST "https://api.skillsafe.ai/v1/app-api/run-stream" \
  -H "Authorization: Bearer $SKILLSAFE_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Accept: text/event-stream" \
  -H "Idempotency-Key: $KEY" \
  -d @run-input.json

# event: job     {"job_id":"..."}
# event: delta   {"text":"{\"lane\":\"model\",\"title\":\"Sales"}
# event: done    {"status":"succeeded","charged_credits":1840,"truncated":false}

req = urllib.request.Request(
    API + "/run-stream",
    data=json.dumps(run_input).encode(),
    headers={"Content-Type": "application/json", "Accept": "text/event-stream",
             "Authorization": "Bearer " + TOKEN, "Idempotency-Key": key},
)
buf, event = "", None
with urllib.request.urlopen(req) as stream:
    for raw in stream:
        line = raw.decode().rstrip("\n")
        if line.startswith("event: "):
            event = line[7:]
        elif line.startswith("data: ") and event == "delta":
            buf += json.loads(line[6:]).get("text", "")

result = json.loads(buf[buf.index("{"):buf.rindex("}") + 1])
print(result["lane"], result["verdict"], result["headline"])

const res = await fetch(`${API}/run-stream`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    Accept: "text/event-stream",
    Authorization: `Bearer ${TOKEN}`,
    "Idempotency-Key": key,
  },
  body: JSON.stringify(runInput),
});

const reader = res.body.getReader();
const decoder = new TextDecoder();
let buf = "", pending = "", event = null;
for (;;) {
  const { value, done } = await reader.read();
  if (done) break;
  pending += decoder.decode(value, { stream: true });
  const lines = pending.split("\n");
  pending = lines.pop();
  for (const line of lines) {
    if (line.startsWith("event: ")) event = line.slice(7);
    else if (line.startsWith("data: ") && event === "delta") {
      buf += JSON.parse(line.slice(6)).text ?? "";
    }
  }
}
const result = JSON.parse(buf.slice(buf.indexOf("{"), buf.lastIndexOf("}") + 1));
console.log(result.lane, result.verdict, result.headline);

req, _ := http.NewRequest(http.MethodPost, api+"/run-stream", bytes.NewReader(bodyBytes))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("Accept", "text/event-stream")
req.Header.Set("Authorization", "Bearer "+token())
req.Header.Set("Idempotency-Key", key)

res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()

var buf strings.Builder
var event string
sc := bufio.NewScanner(res.Body)
sc.Buffer(make([]byte, 1<<20), 1<<20)
for sc.Scan() {
	line := sc.Text()
	switch {
	case strings.HasPrefix(line, "event: "):
		event = strings.TrimPrefix(line, "event: ")
	case strings.HasPrefix(line, "data: ") && event == "delta":
		var d struct {
			Text string `json:"text"`
		}
		json.Unmarshal([]byte(strings.TrimPrefix(line, "data: ")), &d)
		buf.WriteString(d.Text)
	}
}
fmt.Println(buf.String())

HttpRequest req = HttpRequest.newBuilder(URI.create(API + "/run-stream"))
    .header("Content-Type", "application/json")
    .header("Accept", "text/event-stream")
    .header("Authorization", "Bearer " + TOKEN)
    .header("Idempotency-Key", key)
    .POST(HttpRequest.BodyPublishers.ofString(bodyJson))
    .build();

StringBuilder buf = new StringBuilder();
final String[] event = { null };
HTTP.send(req, HttpResponse.BodyHandlers.ofLines()).body().forEach(line -> {
  if (line.startsWith("event: ")) event[0] = line.substring(7);
  else if (line.startsWith("data: ") && "delta".equals(event[0])) {
    buf.append(extractText(line.substring(6)));   // your JSON reader
  }
});
System.out.println(buf);

uri = URI(API + "/run-stream")
req = Net::HTTP::Post.new(uri)
req["Content-Type"] = "application/json"
req["Accept"] = "text/event-stream"
req["Authorization"] = "Bearer #{TOKEN}"
req["Idempotency-Key"] = key
req.body = JSON.dump(run_input)

buf = +""
event = nil
Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) do |http|
  http.request(req) do |res|
    res.read_body do |chunk|
      chunk.each_line do |line|
        line = line.chomp
        if line.start_with?("event: ") then event = line[7..]
        elsif line.start_with?("data: ") && event == "delta"
          buf << (JSON.parse(line[6..])["text"] || "")
        end
      end
    end
  end
end
puts JSON.parse(buf[buf.index("{")..buf.rindex("}")])["verdict"]

$buf = "";
$event = null;
$ch = curl_init(API . "/run-stream");
curl_setopt_array($ch, [
    CURLOPT_POST => true,
    CURLOPT_POSTFIELDS => json_encode($runInput),
    CURLOPT_HTTPHEADER => [
        "Content-Type: application/json",
        "Accept: text/event-stream",
        "Authorization: Bearer " . $TOKEN,
        "Idempotency-Key: " . $key,
    ],
    CURLOPT_WRITEFUNCTION => function ($ch, $chunk) use (&$buf, &$event) {
        foreach (explode("\n", $chunk) as $line) {
            if (str_starts_with($line, "event: ")) { $event = substr($line, 7); }
            elseif (str_starts_with($line, "data: ") && $event === "delta") {
                $buf .= json_decode(substr($line, 6), true)["text"] ?? "";
            }
        }
        return strlen($chunk);
    },
]);
curl_exec($ch);
curl_close($ch);
echo $buf;

var req = new HttpRequestMessage(HttpMethod.Post, Api + "/run-stream");
req.Headers.Authorization = new AuthenticationHeaderValue("Bearer", Token);
req.Headers.Add("Accept", "text/event-stream");
req.Headers.Add("Idempotency-Key", key);
req.Content = new StringContent(JsonSerializer.Serialize(runInput), Encoding.UTF8, "application/json");

using var res = await Http.SendAsync(req, HttpCompletionOption.ResponseHeadersRead);
using var reader = new StreamReader(await res.Content.ReadAsStreamAsync());

var buf = new StringBuilder();
string? evt = null, line;
while ((line = await reader.ReadLineAsync()) is not null) {
    if (line.StartsWith("event: ")) evt = line[7..];
    else if (line.StartsWith("data: ") && evt == "delta")
        buf.Append(JsonDocument.Parse(line[6..]).RootElement.GetProperty("text").GetString());
}
Console.WriteLine(buf.ToString());

# data.output.output is a STRING holding the JSON object. Strip an accidental
# code fence, keep the outermost { ... }, then check the coverage contract.
curl -s "$API/jobs/$JOB" -H "Authorization: Bearer $SKILLSAFE_TOKEN" | python3 -c '
import sys, json
raw = json.load(sys.stdin)["data"]["output"]["output"].strip()
if raw.startswith("```"):
    raw = raw.split("\n", 1)[-1].rsplit("```", 1)[0]
reply = json.loads(raw[raw.index("{"):raw.rindex("}") + 1])

sent = [f["id"] for f in json.load(open("run-input.json"))
        .get("prescan_facts", {}).get("flags", [])]
got = [c["id"] for c in reply["coverage_check"]]
print(reply["lane"], reply["verdict"], "-", reply["headline"])
print("uncovered flags:", [i for i in sent if got.count(i) != 1] or "none")
print("unsent ids returned:", [i for i in got if i not in sent] or "none")
'

import re

def parse_reply(text, prescan=None):
    s = text.strip()
    s = re.sub(r"^```[A-Za-z0-9_-]*\s*", "", s)   # an accidental opening fence
    s = re.sub(r"\s*```$", "", s)                 # and its closing partner
    s = s[s.index("{"):s.rindex("}") + 1]         # outermost object, whatever else leaked
    reply = json.loads(s)

    sent = [f["id"] for f in (prescan or {}).get("flags", [])]
    got = [c.get("id") for c in reply.get("coverage_check", [])]
    uncovered = [i for i in sent if got.count(i) != 1]   # missing OR duplicated
    unsent = [i for i in got if i not in sent]
    if uncovered or unsent:
        raise ValueError("coverage_check broken: uncovered=%s unsent=%s" % (uncovered, unsent))
    return reply

reply = parse_reply(j["output"]["output"], run_input.get("prescan_facts"))
print(reply["lane"], reply["verdict"], reply["objects_seen"]["tables"], "tables seen")
for f in reply["findings"]:
    print(f["id"], f["severity"], f["area"], f["object"], "-", f["what"])

function parseReply(text, prescan) {
  let s = String(text).trim();
  s = s.replace(/^```[A-Za-z0-9_-]*\s*/, "").replace(/\s*```$/, "");
  s = s.slice(s.indexOf("{"), s.lastIndexOf("}") + 1);
  const reply = JSON.parse(s);

  const sent = (prescan?.flags ?? []).map((f) => f.id);
  const got = (reply.coverage_check ?? []).map((c) => c.id);
  const uncovered = sent.filter((id) => got.filter((g) => g === id).length !== 1);
  const unsent = got.filter((id) => !sent.includes(id));
  if (uncovered.length || unsent.length) {
    throw new Error("coverage_check broken: uncovered " + uncovered.join(", ") +
                    "; unsent " + unsent.join(", "));
  }
  return reply;
}

const reply = parseReply(job.output.output, runInput.prescan_facts);
console.log(reply.lane, reply.verdict, reply.objects_seen.tables, "tables seen");
for (const f of reply.findings) console.log(f.id, f.severity, f.area, f.object, "-", f.what);

type coverage struct {
	ID       string `json:"id"`
	Handling string `json:"handling"`
	Note     string `json:"note"`
}
type reply struct {
	Lane          string     `json:"lane"`
	Verdict       string     `json:"verdict"`
	Headline      string     `json:"headline"`
	CoverageCheck []coverage `json:"coverage_check"`
}

func parseReply(text string, sentIDs []string) (*reply, error) {
	s := strings.TrimSpace(text)
	if strings.HasPrefix(s, "```") {
		if i := strings.Index(s, "\n"); i >= 0 {
			s = s[i+1:]
		}
		s = strings.TrimSuffix(strings.TrimSpace(s), "```")
	}
	start, end := strings.Index(s, "{"), strings.LastIndex(s, "}")
	if start < 0 || end <= start {
		return nil, fmt.Errorf("no JSON object in the reply")
	}
	var r reply
	if err := json.Unmarshal([]byte(s[start:end+1]), &r); err != nil {
		return nil, err
	}
	seen := map[string]int{}
	for _, c := range r.CoverageCheck {
		seen[c.ID]++
	}
	for _, id := range sentIDs {
		if seen[id] != 1 {
			return nil, fmt.Errorf("flag %s appears %d times in coverage_check", id, seen[id])
		}
	}
	return &r, nil
}

static String outermostObject(String text) {
  String s = text.strip();
  if (s.startsWith("```")) {                       // an accidental code fence
    int nl = s.indexOf('\n');
    if (nl >= 0) s = s.substring(nl + 1);
    int close = s.lastIndexOf("```");
    if (close >= 0) s = s.substring(0, close);
  }
  int a = s.indexOf('{'), b = s.lastIndexOf('}');
  if (a < 0 || b <= a) throw new IllegalStateException("no JSON object in the reply");
  return s.substring(a, b + 1);
}

// Then, with your JSON reader: collect every coverage_check[].id, and assert
// that each prescan_facts.flags[].id you sent occurs there exactly once and
// that no id you did not send occurs at all. Anything else is a contract
// violation - resend the same body with a retry_note naming the missing ids.

def parse_reply(text, prescan = nil)
  s = text.strip
  s = s.sub(/\A```[A-Za-z0-9_-]*\s*/, "").sub(/\s*```\z/, "")
  s = s[s.index("{")..s.rindex("}")]
  reply = JSON.parse(s)

  sent = (prescan && prescan["flags"] || []).map { |f| f["id"] }
  got = (reply["coverage_check"] || []).map { |c| c["id"] }
  uncovered = sent.reject { |id| got.count(id) == 1 }
  unsent = got.reject { |id| sent.include?(id) }
  raise "coverage_check broken: #{uncovered} / #{unsent}" unless uncovered.empty? && unsent.empty?

  reply
end

reply = parse_reply(job["output"]["output"], run_input["prescan_facts"])
puts "#{reply["lane"]} #{reply["verdict"]} - #{reply["headline"]}"

function parse_reply(string $text, ?array $prescan = null): array {
    $s = trim($text);
    $s = preg_replace('/\A```[A-Za-z0-9_-]*\s*/', "", $s);
    $s = preg_replace('/\s*```\z/', "", $s);
    $a = strpos($s, "{");
    $b = strrpos($s, "}");
    if ($a === false || $b === false || $b <= $a) {
        throw new RuntimeException("no JSON object in the reply");
    }
    $reply = json_decode(substr($s, $a, $b - $a + 1), true);

    $sent = array_column($prescan["flags"] ?? [], "id");
    $got = array_column($reply["coverage_check"] ?? [], "id");
    $counts = array_count_values($got);
    $uncovered = array_values(array_filter($sent, fn($id) => ($counts[$id] ?? 0) !== 1));
    $unsent = array_values(array_diff($got, $sent));
    if ($uncovered || $unsent) {
        throw new RuntimeException("coverage_check broken: "
            . json_encode(["uncovered" => $uncovered, "unsent" => $unsent]));
    }
    return $reply;
}

static JsonElement ParseReply(string text, IEnumerable<string> sentIds) {
    var s = text.Trim();
    if (s.StartsWith("```")) {                       // an accidental code fence
        var nl = s.IndexOf('\n');
        if (nl >= 0) s = s[(nl + 1)..];
        var close = s.LastIndexOf("```", StringComparison.Ordinal);
        if (close >= 0) s = s[..close];
    }
    int a = s.IndexOf('{'), b = s.LastIndexOf('}');
    if (a < 0 || b <= a) throw new InvalidOperationException("no JSON object in the reply");
    var reply = JsonDocument.Parse(s[a..(b + 1)]).RootElement;

    var got = reply.GetProperty("coverage_check").EnumerateArray()
        .Select(c => c.GetProperty("id").GetString()).ToList();
    var uncovered = sentIds.Where(id => got.Count(g => g == id) != 1).ToList();
    var unsent = got.Where(id => !sentIds.Contains(id)).ToList();
    if (uncovered.Count > 0 || unsent.Count > 0)
        throw new InvalidOperationException(
            $"coverage_check broken: uncovered {string.Join(", ", uncovered)}; " +
            $"unsent {string.Join(", ", unsent)}");
    return reply;
}