@0xmaxma/claude-gateway 1.8.14 → 2.0.0

package/dist/orchestration/workflow.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_WORKFLOW_RULES = exports.WORKER_WORKFLOW_RULES = exports.WORKFLOW_SCHEMA = void 0;
+exports.parseWorkflow = parseWorkflow;
+exports.advanceWorkflow = advanceWorkflow;
+const types_1 = require("./types");
+const text = { type: 'string', maxLength: 1024 };
+exports.WORKFLOW_SCHEMA = {
+    type: 'object', additionalProperties: false,
+    properties: {
+        phase: text, evidenceVersion: text, nextAction: text,
+        checks: { type: 'array', maxItems: 30, items: { type: 'object', additionalProperties: false, properties: { id: text, outcome: text, evidenceVersion: text }, required: ['id', 'outcome', 'evidenceVersion'] } },
+        findings: { type: 'array', maxItems: 30, items: { type: 'object', additionalProperties: false, properties: { id: text, status: { type: 'string', enum: ['open', 'resolved', 'dismissed'] }, summary: text }, required: ['id', 'status', 'summary'] } },
+        review: { type: 'object', additionalProperties: false, properties: { id: text, kind: { type: 'string', enum: ['full', 'targeted'] }, reason: text }, required: ['id', 'kind'] },
+    }, required: ['phase', 'evidenceVersion', 'nextAction', 'checks', 'findings'],
+};
+function parseWorkflow(value) {
+    if (value === undefined)
+        return undefined;
+    const bad = () => { throw new types_1.OrchestrationError('INVALID_WORKFLOW_CHECKPOINT'); };
+    const obj = (v, keys) => { if (!v || typeof v !== 'object' || Array.isArray(v) || Object.keys(v).some(k => !keys.includes(k)))
+        bad(); return v; };
+    const str = (v) => { if (typeof v !== 'string' || v.length > 1024)
+        bad(); };
+    const v = obj(value, ['phase', 'evidenceVersion', 'nextAction', 'checks', 'findings', 'review']);
+    for (const k of ['phase', 'evidenceVersion', 'nextAction'])
+        str(v[k]);
+    for (const key of ['checks', 'findings']) {
+        const items = v[key];
+        if (!Array.isArray(items) || items.length > 30)
+            bad();
+        for (const item of items) {
+            const fields = key === 'checks' ? ['id', 'outcome', 'evidenceVersion'] : ['id', 'status', 'summary'];
+            const row = obj(item, fields);
+            for (const f of fields)
+                str(row[f]);
+            if (key === 'findings' && !['open', 'resolved', 'dismissed'].includes(String(row.status)))
+                bad();
+        }
+    }
+    if (v.review !== undefined) {
+        const r = obj(v.review, ['id', 'kind', 'reason']);
+        str(r.id);
+        if (!['full', 'targeted'].includes(String(r.kind)))
+            bad();
+        if (r.reason !== undefined)
+            str(r.reason);
+    }
+    if (JSON.stringify(v).length > 16384)
+        bad();
+    return v;
+}
+function advanceWorkflow(previous, checkpoint, attemptId) {
+    if (previous?.attemptId === attemptId && JSON.stringify(previous.checkpoint) === JSON.stringify(checkpoint))
+        return previous;
+    const reviews = [...(previous?.reviews ?? [])], review = checkpoint.review;
+    let warning;
+    if (review && !reviews.some(r => r.id === review.id && r.evidenceVersion === checkpoint.evidenceVersion)) {
+        if (review.kind === 'full' && reviews.some(r => r.kind === 'full') && !review.reason?.trim())
+            warning = 'A full review already exists. Verify the changed evidence and unresolved findings; do not restart the full workflow merely because a fix was applied. State the new risk or explicit user request if another full review is necessary.';
+        reviews.push({ id: review.id, kind: review.kind, evidenceVersion: checkpoint.evidenceVersion });
+    }
+    return { version: (previous?.version ?? 0) + 1, observedAt: Date.now(), attemptId, checkpoint, reviews: reviews.slice(-24), warning };
+}
+exports.WORKER_WORKFLOW_RULES = `Work to a verifiable stopping condition, not repeated reassurance. Follow the requested skill's actual steps; do not add a second/native/full review merely because this is delegated work. Track completed verification against the evidence version (commit/tree/document revision), open findings by stable ID, and the next necessary action. Use task_report_progress with checkpoint at phase changes, after a review, after resolving findings, and before finalization; use ordinary text progress for short tasks. This is internal bookkeeping, not a request to message the user each time.
+For a defect, trace the user's actual entry path and test the integration that fails before adding extra defensive layers. A missing helper/export is not proof of the original behavior regression. Check contradictory review findings against reachable code before changing anything. A completed full review is followed by fixes and targeted verification of affected behavior; another full review needs new substantial risk or an explicit user request, not just "one final check". Keep unresolved findings visible; do not suppress real defects to finish faster.
+Choose checks appropriate to the work and machine capacity. Reuse successful checks only for unchanged relevant evidence. Batch related fixes and formatting before commit/push to avoid repeated full-suite hooks. Never bypass required checks, security boundaries or user approvals. Once required work and verification are complete, return the result with evidence and remaining limitations; optional polish or an advisory checkpoint must not restart completed phases. Advisory guidance is fallible: prefer newer direct evidence over stale claims that an earlier fix was already proven. These rules apply equally to native subagents you delegate to.`;
+exports.AGENT_WORKFLOW_RULES = `Preserve the user's requested workflow without adding review rounds or widening its scope. A requested skill owns its procedure; do not append a mandatory second/native review unless the user or the actual skill requires it. Supervise from the latest task_status checkpoint (phase, evidenceVersion, checks and findings), not old progress prose or tool names. Worker checkpoints are reports, not independently verified facts. If evidence is missing or superseded, ask for a fresh checkpoint rather than declaring an old fix correct or forbidding relevant investigation. Advice should name the changed evidence, unresolved finding or concrete next step; do not repeatedly say finish/open PR/run review when those steps are already complete. Do not mistake an idle tool sample for a stall or a browser command from an earlier phase for current work. Keep user updates separate from internal supervision.`;
+//# sourceMappingURL=workflow.js.map

package/dist/orchestration/workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow.js","sourceRoot":"","sources":["../../src/orchestration/workflow.ts"],"names":[],"mappings":";;;AA0BA,sCAkBC;AACD,0CAUC;AAvDD,mCAA6C;AAgB7C,MAAM,IAAI,GAAG,EAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,EAAC,IAAI,EAAC,CAAC;AAC/B,QAAA,eAAe,GAAG;IAC7B,IAAI,EAAC,QAAQ,EAAC,oBAAoB,EAAC,KAAK;IACxC,UAAU,EAAC;QACT,KAAK,EAAC,IAAI,EAAC,eAAe,EAAC,IAAI,EAAC,UAAU,EAAC,IAAI;QAC/C,MAAM,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,QAAQ,EAAC,EAAE,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,oBAAoB,EAAC,KAAK,EAAC,UAAU,EAAC,EAAC,EAAE,EAAC,IAAI,EAAC,OAAO,EAAC,IAAI,EAAC,eAAe,EAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,CAAC,IAAI,EAAC,SAAS,EAAC,iBAAiB,CAAC,EAAC,EAAC;QACrL,QAAQ,EAAC,EAAC,IAAI,EAAC,OAAO,EAAC,QAAQ,EAAC,EAAE,EAAC,KAAK,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,oBAAoB,EAAC,KAAK,EAAC,UAAU,EAAC,EAAC,EAAE,EAAC,IAAI,EAAC,MAAM,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,MAAM,EAAC,UAAU,EAAC,WAAW,CAAC,EAAC,EAAC,OAAO,EAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,CAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,CAAC,EAAC,EAAC;QACrN,MAAM,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,oBAAoB,EAAC,KAAK,EAAC,UAAU,EAAC,EAAC,EAAE,EAAC,IAAI,EAAC,IAAI,EAAC,EAAC,IAAI,EAAC,QAAQ,EAAC,IAAI,EAAC,CAAC,MAAM,EAAC,UAAU,CAAC,EAAC,EAAC,MAAM,EAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,CAAC,IAAI,EAAC,MAAM,CAAC,EAAC;KACxJ,EAAC,QAAQ,EAAC,CAAC,OAAO,EAAC,iBAAiB,EAAC,YAAY,EAAC,QAAQ,EAAC,UAAU,CAAC;CACxE,CAAC;AACF,SAAgB,aAAa,CAAC,KAAc;IAC1C,IAAG,KAAK,KAAG,SAAS;QAAC,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAC,GAAE,EAAE,GAAC,MAAM,IAAI,0BAAkB,CAAC,6BAA6B,CAAC,CAAC,CAAA,CAAC,CAAC;IAC7E,MAAM,GAAG,GAAC,CAAC,CAAS,EAAC,IAAa,EAAC,EAAE,GAAC,IAAG,CAAC,CAAC,IAAE,OAAO,CAAC,KAAG,QAAQ,IAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAAC,GAAG,EAAE,CAAC,CAAA,OAAO,CAA2B,CAAC,CAAA,CAAC,CAAC;IACzK,MAAM,GAAG,GAAC,CAAC,CAAS,EAAC,EAAE,GAAC,IAAG,OAAO,CAAC,KAAG,QAAQ,IAAE,CAAC,CAAC,MAAM,GAAC,IAAI;QAAC,GAAG,EAAE,CAAC,CAAA,CAAC,CAAC;IACtE,MAAM,CAAC,GAAC,GAAG,CAAC,KAAK,EAAC,CAAC,OAAO,EAAC,iBAAiB,EAAC,YAAY,EAAC,QAAQ,EAAC,UAAU,EAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,KAAI,MAAM,CAAC,IAAI,CAAC,OAAO,EAAC,iBAAiB,EAAC,YAAY,CAAC;QAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,KAAI,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAC,UAAU,CAAC,EAAC,CAAC;QACtC,MAAM,KAAK,GAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAAA,IAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAE,KAAK,CAAC,MAAM,GAAC,EAAE;YAAC,GAAG,EAAE,CAAC;QACnE,KAAI,MAAM,IAAI,IAAI,KAAkB,EAAC,CAAC;YACpC,MAAM,MAAM,GAAC,GAAG,KAAG,QAAQ,CAAA,CAAC,CAAA,CAAC,IAAI,EAAC,SAAS,EAAC,iBAAiB,CAAC,CAAA,CAAC,CAAA,CAAC,IAAI,EAAC,QAAQ,EAAC,SAAS,CAAC,CAAC;YACzF,MAAM,GAAG,GAAC,GAAG,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC;YAAA,KAAI,MAAM,CAAC,IAAI,MAAM;gBAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7D,IAAG,GAAG,KAAG,UAAU,IAAE,CAAC,CAAC,MAAM,EAAC,UAAU,EAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAAC,GAAG,EAAE,CAAC;QAC3F,CAAC;IACH,CAAC;IACD,IAAG,CAAC,CAAC,MAAM,KAAG,SAAS,EAAC,CAAC;QAAA,MAAM,CAAC,GAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAC,CAAC,IAAI,EAAC,MAAM,EAAC,QAAQ,CAAC,CAAC,CAAC;QAAA,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAAA,IAAG,CAAC,CAAC,MAAM,EAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAAC,GAAG,EAAE,CAAC;QAAA,IAAG,CAAC,CAAC,MAAM,KAAG,SAAS;YAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAAA,CAAC;IAC9K,IAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,GAAC,KAAK;QAAC,GAAG,EAAE,CAAC;IACxC,OAAO,CAAkC,CAAC;AAC5C,CAAC;AACD,SAAgB,eAAe,CAAC,QAA+B,EAAC,UAA6B,EAAC,SAAgB;IAC5G,IAAG,QAAQ,EAAE,SAAS,KAAG,SAAS,IAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAG,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;QAAC,OAAO,QAAQ,CAAC;IACrH,MAAM,OAAO,GAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,IAAE,EAAE,CAAC,CAAC,EAAC,MAAM,GAAC,UAAU,CAAC,MAAM,CAAC;IACpE,IAAI,OAAwB,CAAC;IAC7B,IAAG,MAAM,IAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,EAAE,KAAG,MAAM,CAAC,EAAE,IAAE,CAAC,CAAC,eAAe,KAAG,UAAU,CAAC,eAAe,CAAC,EAAC,CAAC;QAC7F,IAAG,MAAM,CAAC,IAAI,KAAG,MAAM,IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA,EAAE,CAAA,CAAC,CAAC,IAAI,KAAG,MAAM,CAAC,IAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE;YAC/E,OAAO,GAAC,wOAAwO,CAAC;QACnP,OAAO,CAAC,IAAI,CAAC,EAAC,EAAE,EAAC,MAAM,CAAC,EAAE,EAAC,IAAI,EAAC,MAAM,CAAC,IAAI,EAAC,eAAe,EAAC,UAAU,CAAC,eAAe,EAAC,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,EAAC,OAAO,EAAC,CAAC,QAAQ,EAAE,OAAO,IAAE,CAAC,CAAC,GAAC,CAAC,EAAC,UAAU,EAAC,IAAI,CAAC,GAAG,EAAE,EAAC,SAAS,EAAC,UAAU,EAAC,OAAO,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAC,OAAO,EAAC,CAAC;AAC1H,CAAC;AACY,QAAA,qBAAqB,GAAG;;woBAEmmB,CAAC;AAC5nB,QAAA,oBAAoB,GAAG,s4BAAs4B,CAAC"}

package/dist/session/input-image.d.ts

@@ -0,0 +1,10 @@
+/** Native Claude stream-json image input; never a file-reading tool grant. */
+export interface InputImage {
+    type: 'image';
+    source: {
+        type: 'base64';
+        media_type: 'image/jpeg' | 'image/png' | 'image/gif' | 'image/webp';
+        data: string;
+    };
+}
+//# sourceMappingURL=input-image.d.ts.map

package/dist/session/input-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-image.d.ts","sourceRoot":"","sources":["../../src/session/input-image.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,YAAY,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/G"}

package/dist/session/input-image.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=input-image.js.map

package/dist/session/input-image.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-image.js","sourceRoot":"","sources":["../../src/session/input-image.ts"],"names":[],"mappings":""}

package/dist/session/process.d.ts

@@ -1,4 +1,6 @@
+import type { InputImage } from './input-image';
 import { EventEmitter } from 'events';
+import { RuntimeProfile } from './runtime-profile';
 import { AgentConfig, GatewayConfig } from '../types';
 import { type ChatChannelOrApi } from '../history/types';
 import { SessionStore } from './store';
@@ -13,6 +15,12 @@ export declare const INTERRUPTED_NO_REPLY_TEXT = "Session was interrupted before
  */
 export declare function resolveMaxHistoryMessages(agentMax?: number, globalMax?: number): number;
 export declare class SessionProcess extends EventEmitter {
+    readonly runtimeProfile?: RuntimeProfile | undefined;
+    private managedProcessGroup?;
+    private containerAttempt?;
+    managedGroupStopped: boolean;
+    get processId(): number | undefined;
+    get managedProcessId(): number | undefined;
     readonly sessionId: string;
     readonly chatId: string;
     readonly source: ChatChannelOrApi;
@@ -65,7 +73,8 @@ export declare class SessionProcess extends EventEmitter {
     private _querySettled;
     private pendingInitialPrompt?;
     private spawnedConnectors;
-    constructor(sessionId: string, source: ChatChannelOrApi, agentConfig: AgentConfig, gatewayConfig: GatewayConfig, sessionStore: SessionStore, chatId?: string);
+    constructor(sessionId: string, source: ChatChannelOrApi, agentConfig: AgentConfig, gatewayConfig: GatewayConfig, sessionStore: SessionStore, chatId?: string, // for telegram/discord: actual chatId; for api: same as sessionId
+    runtimeProfile?: RuntimeProfile | undefined);
     /**
      * Resolve the model for this session.
      * Priority: per-session override > config.json on disk > cached agentConfig.
@@ -162,6 +171,9 @@ export declare class SessionProcess extends EventEmitter {
      * it is a tool-less API session that gets no MCP servers at all.
      */
     connectorConfigChanged(connectorId: string, resolvedServer: unknown): boolean;
+    /** Only trust connector namespaces actually written into this subprocess config. */
+    isSpawnedConnectorTool(name: string): boolean;
+    private managedMcpConfigPath?;
     private writeMcpConfig;
     /** Find the first API key that has access to this agent (agents: '*' or includes agentId). */
     private findApiKeyForAgent;
@@ -191,7 +203,7 @@ export declare class SessionProcess extends EventEmitter {
      * that Claude Code was replaying on every request.
      */
     private recoverFromCorruptedThinking;
-    sendMessage(text: string): void;
+    sendMessage(text: string, images?: readonly InputImage[]): void;
     /**
      * Send a control keystroke to the PTY wrapper (Epic #195, Phase 3b). Only
      * meaningful on the interactive (pty-shell) backend — the headless backend has
@@ -215,7 +227,7 @@ export declare class SessionProcess extends EventEmitter {
     private isTrackedDispatchStillOutstanding;
     private resetBackgroundDispatchState;
     /**
-     * Extend Telegram's working state only while a parent session is waiting for
+     * Extend Telegram's working state only while a agent session is waiting for
      * background Agent/Workflow/Monitor work. A bounded expiry (BACKGROUND_AGENT_GRACE_MS,
      * fixed from the dispatch timestamp — not renewed by later activity) releases
      * the state if the dispatch never sends its completion notification within

package/dist/session/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/session/process.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAKtC,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAmC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAevC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAqHvC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAqDD,qBAAa,cAAe,SAAQ,YAAY;IAC9C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,cAAc,SAAc;IAQ5B,OAAO,CAAC,6BAA6B,CAAuB;IAG5D,OAAO,CAAC,iBAAiB,CAAqC;IAM9D,OAAO,CAAC,2BAA2B,CAAS;IAC5C,OAAO,CAAC,mBAAmB,CAA8C;IACzE,QAAQ,CAAC,SAAS,SAAc;IAChC,qFAAqF;IACrF,OAAO,EAAE,WAAW,GAAG,UAAU,CAAc;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,YAAY,EAAE,MAAM,CAAwB;IAM5C,aAAa,EAAE,OAAO,CAAS;IAC/B,YAAY,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;IAC1G,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAK;IAKzB,OAAO,CAAC,WAAW,CAAK;IAOxB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAUhC,OAAO,CAAC,OAAO,CAAS;IAMxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,SAAS,UAAS;IAIlB,OAAO,CAAC,eAAe,CAAK;IAE5B,UAAU,SAAM;IAChB,OAAO,CAAC,qBAAqB,CAAK;IAKlC,OAAO,CAAC,qBAAqB,CAAqB;IAMlD,OAAO,CAAC,aAAa,CAAY;IACjC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAE1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,oBAAoB,CAAC,CAAS;IActC,OAAO,CAAC,iBAAiB,CAAoC;gBAG3D,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,MAAM;IAmBjB;;;OAGG;IACH,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,aAAa;IAMrB,wFAAwF;IACxF,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,0EAA0E;IAC1E,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,gEAAgE;IAChE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,cAAc;IAchB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;YA8Bb,kBAAkB;IA4DhC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,OAAO,CAAC,uBAAuB;IAiE/B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO;IAM7E,OAAO,CAAC,cAAc;IAgLtB,8FAA8F;IAC9F,OAAO,CAAC,kBAAkB;IAY1B,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,SAAS;IAsCjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;YAOjB,YAAY;IA8hB1B,OAAO,CAAC,eAAe;IA4DvB;;;;;OAKG;IACH,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5D;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAmBpC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IA+B/B;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB/C;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkBhC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB1D,IAAI,YAAY,IAAI,OAAO,CAA6B;IAExD,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,4BAA4B;IAOpC;;;;;;;;OAQG;IACH,4BAA4B,IAAI,OAAO;IA8BvC,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAwCpC,SAAS,IAAI,OAAO;IAWpB;;;;;;OAMG;IACH,oBAAoB,IAAI,OAAO;IAM/B,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;OAMG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B,KAAK,IAAI,IAAI;IAIb,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;;;;;OAQG;IACH,kCAAkC,IAAI,OAAO;IAK7C,SAAS,IAAI,OAAO;IAOd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA8C5B"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/session/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAIhD,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAItC,OAAO,EAAE,cAAc,EAAsB,MAAM,mBAAmB,CAAC;AAKvE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,EAAmC,KAAK,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAC1F,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAevC,eAAO,MAAM,oBAAoB,KAAK,CAAC;AAqHvC,eAAO,MAAM,yBAAyB,oDAAoD,CAAC;AAE3F;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,CAAC,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,MAAM,CAMR;AAqDD,qBAAa,cAAe,SAAQ,YAAY;IA0I5C,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc;IAzI1C,OAAO,CAAC,mBAAmB,CAAC,CAAS;IACrC,OAAO,CAAC,gBAAgB,CAAC,CAAwC;IACjE,mBAAmB,UAAS;IAC5B,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAA6D;IAChG,IAAI,gBAAgB,IAAI,MAAM,GAAG,SAAS,CAAqC;IAC/E,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAc;IAC7C,cAAc,SAAc;IAQ5B,OAAO,CAAC,6BAA6B,CAAuB;IAG5D,OAAO,CAAC,iBAAiB,CAAqC;IAM9D,OAAO,CAAC,2BAA2B,CAAS;IAC5C,OAAO,CAAC,mBAAmB,CAA8C;IACzE,QAAQ,CAAC,SAAS,SAAc;IAChC,qFAAqF;IACrF,OAAO,EAAE,WAAW,GAAG,UAAU,CAAc;IAC/C,aAAa,CAAC,EAAE,MAAM,CAAC;IAMvB,YAAY,EAAE,MAAM,CAAwB;IAM5C,aAAa,EAAE,OAAO,CAAS;IAC/B,YAAY,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,mBAAmB,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAQ;IAC1G,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,YAAY,CAAK;IAKzB,OAAO,CAAC,WAAW,CAAK;IAOxB,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,eAAe,CAAS;IAUhC,OAAO,CAAC,OAAO,CAAS;IAMxB,OAAO,CAAC,kBAAkB,CAAS;IACnC,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAc;IAC1C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;IAC3C,SAAS,UAAS;IAIlB,OAAO,CAAC,eAAe,CAAK;IAE5B,UAAU,SAAM;IAChB,OAAO,CAAC,qBAAqB,CAAK;IAKlC,OAAO,CAAC,qBAAqB,CAAqB;IAMlD,OAAO,CAAC,aAAa,CAAY;IACjC,OAAO,CAAC,cAAc,CAAuB;IAC7C,OAAO,CAAC,YAAY,CAAM;IAE1B,OAAO,CAAC,iBAAiB,CAAS;IAClC,OAAO,CAAC,aAAa,CAAC,CAAyB;IAC/C,OAAO,CAAC,YAAY,CAAM;IAC1B,OAAO,CAAC,WAAW,CAAC,CAAgC;IACpD,OAAO,CAAC,aAAa,CAAS;IAE9B,OAAO,CAAC,oBAAoB,CAAC,CAAS;IActC,OAAO,CAAC,iBAAiB,CAAoC;gBAG3D,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,WAAW,EACxB,aAAa,EAAE,aAAa,EAC5B,YAAY,EAAE,YAAY,EAC1B,MAAM,CAAC,EAAE,MAAM,EAAG,kEAAkE;IAC3E,cAAc,CAAC,EAAE,cAAc,YAAA;IAmB1C;;;OAGG;IACH,OAAO,KAAK,SAAS,GAEpB;IAED,OAAO,CAAC,aAAa;IAOrB,wFAAwF;IACxF,IAAI,KAAK,IAAI,MAAM,CAElB;IAED,0EAA0E;IAC1E,IAAI,WAAW,IAAI,MAAM,CAExB;IAED,gEAAgE;IAChE,IAAI,SAAS,IAAI,MAAM,CAEtB;IAED,OAAO,CAAC,cAAc;IAchB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAO5B;;;;OAIG;IACH,OAAO,CAAC,mBAAmB;YA8Bb,kBAAkB;IA4DhC;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAMzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACH,OAAO,CAAC,uBAAuB;IAiE/B;;;;OAIG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,EAAE,OAAO,GAAG,OAAO;IAM7E,oFAAoF;IACpF,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAO7C,OAAO,CAAC,oBAAoB,CAAC,CAAS;IAEtC,OAAO,CAAC,cAAc;IAoMtB,8FAA8F;IAC9F,OAAO,CAAC,kBAAkB;IAY1B,qFAAqF;IACrF,OAAO,CAAC,kBAAkB;IAQ1B;;;;OAIG;IACH,OAAO,CAAC,uBAAuB;IAa/B,OAAO,CAAC,SAAS;IAkDjB,OAAO,CAAC,MAAM,CAAC,gBAAgB;YAOjB,YAAY;IAsjB1B,OAAO,CAAC,eAAe;IA4DvB;;;;;OAKG;IACH,MAAM,CAAC,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI5D;;;;;OAKG;IACH,OAAO,CAAC,4BAA4B;IAoBpC,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,SAAS,UAAU,EAAO,GAAG,IAAI;IA+BnE;;;;;;OAMG;IACH,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI;IAmB/C;;;;;;;OAOG;IACH,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAkBhC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IAqB1D,IAAI,YAAY,IAAI,OAAO,CAA6B;IAExD,OAAO,CAAC,wBAAwB;IAYhC,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,4BAA4B;IAOpC;;;;;;;;OAQG;IACH,4BAA4B,IAAI,OAAO;IA8BvC,aAAa,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAwCpC,SAAS,IAAI,OAAO;IAWpB;;;;;;OAMG;IACH,oBAAoB,IAAI,OAAO;IAM/B,kBAAkB,IAAI,IAAI;IAQ1B;;;;;;OAMG;IACH,iBAAiB,IAAI,OAAO;IAI5B;;;;;;;;;OASG;IACH,kBAAkB,IAAI,OAAO;IAI7B,KAAK,IAAI,IAAI;IAIb,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAI/B;;;;;;;;OAQG;IACH,kCAAkC,IAAI,OAAO;IAK7C,SAAS,IAAI,OAAO;IAOd,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CA2D5B"}

package/dist/session/process.js

@@ -38,12 +38,17 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SessionProcess = exports.INTERRUPTED_NO_REPLY_TEXT = exports.MAX_HISTORY_MESSAGES = void 0;
 exports.resolveMaxHistoryMessages = resolveMaxHistoryMessages;
+const container_1 = require("../orchestration/container");
 const child_process_1 = require("child_process");
 const crypto_1 = require("crypto");
 const events_1 = require("events");
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
+const runtime_profile_1 = require("./runtime-profile");
+const string_decoder_1 = require("string_decoder");
+const process_supervisor_1 = require("../orchestration/process-supervisor");
+const capacity_1 = require("../orchestration/capacity");
 const chokidar_1 = __importDefault(require("chokidar"));
 const knowledge_1 = require("../agent/knowledge");
 const config_1 = require("../agent/dreaming/config");
@@ -232,8 +237,13 @@ const STATE_SUBDIR = {
     wechat: '.wechat-state',
 };
 class SessionProcess extends events_1.EventEmitter {
-    constructor(sessionId, source, agentConfig, gatewayConfig, sessionStore, chatId) {
+    get processId() { return this.isRunning() ? this.process?.pid : undefined; }
+    get managedProcessId() { return this.managedProcessGroup; }
+    constructor(sessionId, source, agentConfig, gatewayConfig, sessionStore, chatId, // for telegram/discord: actual chatId; for api: same as sessionId
+    runtimeProfile) {
         super();
+        this.runtimeProfile = runtimeProfile;
+        this.managedGroupStopped = false;
         this.lastActivityAt = Date.now(); // accessible by AgentRunner for eviction sort
         // Wall-clock time of the most recent BACKGROUND_DISPATCH_TOOLS tool_use seen
         // in this session's own turn, while no NEWER turn has started since. Cleared
@@ -363,6 +373,8 @@ class SessionProcess extends events_1.EventEmitter {
         return path.join(this.agentConfig.workspace, STATE_SUBDIR[this.sessionChannel], 'typing');
     }
     appendToStore(msg) {
+        if (this.runtimeProfile)
+            return Promise.resolve(); // orchestration owns canonical history operations
         return this.source !== 'api'
             ? this.sessionStore.appendTelegramMessage(this.agentConfig.id, this.chatId, this.sessionId, msg, this.sessionChannel)
             : this.sessionStore.appendMessage(this.agentConfig.id, this.sessionId, msg);
@@ -407,7 +419,7 @@ class SessionProcess extends events_1.EventEmitter {
      * re-spawn it with the latest model from config.json.
      */
     setupRestartWatcher() {
-        if (this.restartWatcher)
+        if (this.restartWatcher || this.runtimeProfile)
             return;
         this.restartWatcher = chokidar_1.default.watch(this.restartSignalPath, { ignoreInitial: true });
         this.restartWatcher.on('add', () => {
@@ -648,7 +660,36 @@ class SessionProcess extends events_1.EventEmitter {
         const now = resolvedServer === undefined ? undefined : connectorFingerprint(resolvedServer);
         return this.spawnedConnectors.get(connectorId) !== now;
     }
+    /** Only trust connector namespaces actually written into this subprocess config. */
+    isSpawnedConnectorTool(name) {
+        if (!this.spawnedConnectors || this.agentConfig.type === 'app-agent' ||
+            this.agentConfig.allow_tools === false || this.runtimeProfile?.role === 'agent' || this.runtimeProfile?.connectorsAllowed === false ||
+            (this.runtimeProfile?.role === 'worker' && !this.runtimeProfile.hostExecution))
+            return false;
+        return [...this.spawnedConnectors.keys()].some(id => name.startsWith(`mcp__${id}__`) && name.length > id.length + 7);
+    }
     writeMcpConfig() {
+        if (this.runtimeProfile) {
+            // Orchestrators dispatch execution; only eligible workers receive connectors.
+            // App and isolated workers must never receive host connector credentials
+            // or start host-configured stdio servers inside their execution boundary.
+            if (this.runtimeProfile.role === 'agent' || this.agentConfig.allow_tools === false || this.runtimeProfile.connectorsAllowed === false || this.agentConfig.type === 'app-agent' || (this.runtimeProfile.role === 'worker' && !this.runtimeProfile.hostExecution))
+                return this.runtimeProfile.mcpConfigPath;
+            const ticket = JSON.parse(fs.readFileSync(this.runtimeProfile.mcpConfigPath, 'utf8'));
+            const connectors = (0, resolve_1.resolveEnabledConnectors)(this.agentConfig, this.gatewayConfig.gateway.customConnectors, this.gatewayConfig.gateway.connectorsDefaultEnabled ?? true);
+            this.spawnedConnectors = new Map();
+            for (const [id, server] of Object.entries(connectors)) {
+                if ((0, custom_1.isReservedConnectorId)(id))
+                    continue;
+                this.spawnedConnectors.set(id, connectorFingerprint(server));
+            }
+            const servers = Object.fromEntries([...this.spawnedConnectors.keys()].map(id => [id, connectors[id]]));
+            const configPath = path.join(path.dirname(this.runtimeProfile.mcpConfigPath), 'managed-connectors.json');
+            fs.writeFileSync(configPath, JSON.stringify({ mcpServers: { ...servers, ...ticket.mcpServers } }), { mode: 0o600 });
+            fs.chmodSync(configPath, 0o600);
+            this.managedMcpConfigPath = configPath;
+            return configPath;
+        }
         if (this.source === 'api' && !this.agentConfig.allow_tools)
             return null;
         const stateDir = path.join(this.agentConfig.workspace, '.telegram-state');
@@ -846,6 +887,20 @@ class SessionProcess extends events_1.EventEmitter {
             '--print',
             '--verbose',
         ];
+        if (this.runtimeProfile) {
+            if (this.agentConfig.type === 'app-agent' && this.runtimeProfile.hostExecution)
+                throw new Error('Container roles cannot use host execution');
+            if (this.gatewayConfig.gateway.headless === false)
+                throw new Error('Orchestration runtime profile is only verified for the configured headless backend');
+            const context = this.runtimeProfile.context ?? fs.readFileSync(path.join(this.agentConfig.workspace, 'CLAUDE.md'), 'utf8');
+            args.push(...(0, runtime_profile_1.runtimeProfileArgs)({ ...this.runtimeProfile, context, checkpointCommand: this.containerAttempt && this.runtimeProfile.checkpointCommand ? `node ${this.containerAttempt.directory}/checkpoint.cjs ${this.containerAttempt.directory}/ticket.json` : this.runtimeProfile.checkpointCommand, containerExecution: this.agentConfig.type === 'app-agent', mcpConfigPath: this.containerAttempt?.config ?? mcpConfigPath ?? this.runtimeProfile.mcpConfigPath, skillPluginDir: this.containerAttempt && this.runtimeProfile.skillPluginDir ? this.containerAttempt.directory + '/skill-plugin' : this.runtimeProfile.skillPluginDir }, this.agentConfig.claude.extraFlags ?? []));
+            if (this.runtimeProfile.workerSession) {
+                const session = this.runtimeProfile.workerSession;
+                args.push(session.resume ? '--resume' : '--session-id', session.id);
+            }
+            args.push('--dangerously-skip-permissions');
+            return args;
+        }
         if (mcpConfigPath) {
             // NOTE: --strict-mcp-config is intentionally omitted.
             // With --strict-mcp-config, Claude Code blocks all plugin MCP servers (e.g. figma).
@@ -869,17 +924,22 @@ class SessionProcess extends events_1.EventEmitter {
         return args;
         // NOTE: NO --channels flag — messages arrive via stdin injection, not Telegram channels
     }
-    static toStreamJsonTurn(text) {
+    static toStreamJsonTurn(text, images = []) {
         return JSON.stringify({
             type: 'user',
-            message: { role: 'user', content: [{ type: 'text', text }] },
+            message: { role: 'user', content: [{ type: 'text', text }, ...images] },
         });
     }
     async spawnProcess() {
         const { historyPrompt, loadedAtSpawn, archivedCount, messageCountAtSpawn } = await this.buildInitialPrompt();
         this.spawnContext = { loadedAtSpawn, archivedCount, messageCountAtSpawn };
         // Determine if this is a docker-exec app-agent before computing paths
+        (0, container_1.assertContainerBinding)(this.agentConfig, this.runtimeProfile);
         const isAppAgent = this.agentConfig.type === 'app-agent' && !!this.agentConfig.container;
+        if (isAppAgent && this.runtimeProfile) {
+            this.containerAttempt = await (0, container_1.prepareContainerProfile)(this.agentConfig, this.runtimeProfile);
+            this.runtimeProfile.context = await (0, container_1.containerNode)(this.agentConfig.container, "process.stdout.write(require('fs').readFileSync('/workspace/CLAUDE.md','utf8'))");
+        }
         const mcpConfigPath = this.writeMcpConfig();
         // For app-agents, Claude runs inside the container where /workspace is mounted.
         // Convert host paths (agentConfig.workspace-relative) to container paths (/workspace/...).
@@ -979,7 +1039,7 @@ class SessionProcess extends events_1.EventEmitter {
             CLAUDE_WORKSPACE: '/workspace',
             GATEWAY_RESTART_SIGNAL_PATH: containerRestartPath,
         };
-        if (process.env.GATEWAY_API_URL)
+        if (!this.runtimeProfile && process.env.GATEWAY_API_URL)
             containerEnv.GATEWAY_API_URL = process.env.GATEWAY_API_URL;
         // Secrets are forwarded by NAME only (`-e KEY`, no `=value`), which makes
         // Docker read the value from this process's own environment (set on the spawn
@@ -990,8 +1050,8 @@ class SessionProcess extends events_1.EventEmitter {
         // TELEGRAM_BOT_TOKEN travels by name for exactly the same reason as the
         // Claude credentials — it is a bearer token for the agent's whole bot
         // account. It is already placed in the spawn env below, unconditionally.
-        const containerAuthEnv = isAppAgent ? this.resolveContainerAuthEnv() : {};
-        const byNameKeys = ['TELEGRAM_BOT_TOKEN', ...Object.keys(containerAuthEnv)];
+        const containerAuthEnv = isAppAgent || (this.runtimeProfile?.checkpointCommand && !this.runtimeProfile.hostExecution) ? this.resolveContainerAuthEnv() : {};
+        const byNameKeys = [...(this.runtimeProfile ? [] : ['TELEGRAM_BOT_TOKEN']), ...Object.keys(containerAuthEnv)];
         const dockerEnvFlags = [
             ...Object.entries(containerEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
             ...byNameKeys.flatMap((k) => ['-e', k]),
@@ -1001,7 +1061,7 @@ class SessionProcess extends events_1.EventEmitter {
                 'exec', '--workdir', '/workspace', '--user', String(containerUid), '-i',
                 ...dockerEnvFlags,
                 this.agentConfig.container,
-                this.agentConfig.claudeBin ?? claudeBin,
+                ...(this.containerAttempt ? ['node', '-e', container_1.CONTAINER_SUPERVISOR, this.containerAttempt.directory, this.agentConfig.claudeBin ?? claudeBin] : [this.agentConfig.claudeBin ?? claudeBin]),
                 ...allArgs,
             ]
             : allArgs;
@@ -1016,22 +1076,42 @@ class SessionProcess extends events_1.EventEmitter {
         // so a bare `claude` resolves even if the gateway itself was launched with a
         // minimal PATH that predates the native-installer migration.
         const hardenedPath = (0, claude_bin_1.pathWithNativeBin)();
-        const proc = (0, child_process_1.spawn)(spawnBin, spawnArgs, {
-            env: {
-                ...process.env,
-                ...containerAuthEnv,
-                ...(hardenedPath ? { PATH: hardenedPath } : {}),
-                CLAUDE_WORKSPACE: isAppAgent ? '/workspace' : this.agentConfig.workspace,
-                TELEGRAM_BOT_TOKEN: this.agentConfig.telegram?.botToken ?? '',
-                GATEWAY_RESTART_SIGNAL_PATH: this.restartSignalPath,
-                ...(ptyRealBin ? { CLAUDE_REAL_BIN: ptyRealBin } : {}),
-                ...(ptyHeartbeatPath ? { PTY_SHELL_HEARTBEAT_PATH: ptyHeartbeatPath } : {}),
-                ...(ptyStreamSocketPath ? { PTY_SHELL_STREAM_SOCKET: ptyStreamSocketPath } : {}),
-            },
-            cwd: this.agentConfig.workspace,
-            stdio: ['pipe', 'pipe', 'pipe'],
-        });
+        const capacityEnabled = Boolean(this.runtimeProfile || this.gatewayConfig.gateway.processLimits || this.gatewayConfig.agents?.some(agent => agent.orchestration?.enabled));
+        const releaseCapacity = this.runtimeProfile?.capacityReserved ? () => { } : (0, capacity_1.gatewayCapacity)(this.gatewayConfig).acquire(this.runtimeProfile?.role ?? 'legacy', capacityEnabled);
+        if (!releaseCapacity)
+            throw Object.assign(new Error('Gateway process capacity exceeded'), { code: 'CAPACITY_EXCEEDED' });
+        let proc;
+        try {
+            proc = (0, child_process_1.spawn)(spawnBin, spawnArgs, {
+                env: {
+                    ...process.env,
+                    ...(!isAppAgent && this.runtimeProfile?.checkpointCommand && !this.runtimeProfile.hostExecution ? Object.fromEntries(CONTAINER_CREDENTIAL_KEYS.map(key => [key, undefined])) : {}),
+                    ...containerAuthEnv,
+                    ...(hardenedPath ? { PATH: hardenedPath } : {}),
+                    GATEWAY_ORIGIN_SESSION_ID: this.runtimeProfile?.originSessionId ?? this.sessionId,
+                    GATEWAY_TASK_ID: this.runtimeProfile?.taskId ?? '',
+                    GATEWAY_TASK_ATTEMPT_ID: this.runtimeProfile?.attemptId ?? '',
+                    CLAUDE_WORKSPACE: isAppAgent ? '/workspace' : this.agentConfig.workspace,
+                    TELEGRAM_BOT_TOKEN: this.agentConfig.telegram?.botToken ?? '',
+                    GATEWAY_RESTART_SIGNAL_PATH: this.restartSignalPath,
+                    ...(ptyRealBin ? { CLAUDE_REAL_BIN: ptyRealBin } : {}),
+                    ...(ptyHeartbeatPath ? { PTY_SHELL_HEARTBEAT_PATH: ptyHeartbeatPath } : {}),
+                    ...(ptyStreamSocketPath ? { PTY_SHELL_STREAM_SOCKET: ptyStreamSocketPath } : {}),
+                },
+                cwd: this.agentConfig.workspace,
+                ...(this.runtimeProfile?.role === 'worker' && process.platform === 'linux' ? { detached: true } : {}),
+                stdio: ['pipe', 'pipe', 'pipe'],
+            });
+        }
+        catch (error) {
+            releaseCapacity();
+            throw error;
+        }
         this.process = proc;
+        proc.once('exit', releaseCapacity);
+        proc.once('error', releaseCapacity);
+        if (this.runtimeProfile?.role === 'worker' && process.platform === 'linux')
+            this.managedProcessGroup = proc.pid;
         // Fresh child is alive: clear any exit observed for a prior process (e.g.
         // after an auto-restart), so isRunning()/interrupt() see it as live.
         this._exited = false;
@@ -1050,7 +1130,10 @@ class SessionProcess extends events_1.EventEmitter {
         // becomes Turn 2 — two separate responses forwarded to the channel. Deferring
         // history to sendMessage() bundles [history + activation + user reply] into a
         // single turn so Claude produces exactly one response.
-        if (this.source !== 'api') {
+        if (this.runtimeProfile) {
+            this.pendingInitialPrompt = historyPrompt ?? undefined;
+        }
+        else if (this.source !== 'api') {
             if (historyPrompt) {
                 // Has history: defer to first incoming user message to prevent double-response.
                 this.pendingInitialPrompt = `${historyPrompt}\n\n${CHANNELS_ACTIVATION_PROMPT}`;
@@ -1064,7 +1147,7 @@ class SessionProcess extends events_1.EventEmitter {
             this.pendingInitialPrompt = historyPrompt;
         }
         // Capture stdout — emit output events + persist assistant replies
-        const typingDir = this.source !== 'api' ? this.typingDir : null;
+        const typingDir = this.source !== 'api' && !this.runtimeProfile ? this.typingDir : null;
         const heartbeatPath = typingDir ? path.join(typingDir, `${this.chatId}.heartbeat`) : null;
         const statusPath = typingDir ? path.join(typingDir, `${this.chatId}.status`) : null;
         const writeStatus = (status, detail) => {
@@ -1090,10 +1173,12 @@ class SessionProcess extends events_1.EventEmitter {
         // Track context from message_start events (first sub-call of each turn) for accurate context % display.
         // result.usage is cumulative across all sub-calls; message_start.usage reflects a single API call's context.
         let lastMessageStartContext = 0;
+        let orchestrationOutputBuffer = '';
+        const orchestrationDecoder = new string_decoder_1.StringDecoder('utf8');
         proc.stdout?.on('data', (data) => {
             // Child produced output => the session is doing real work right now. Count
             // this as activity so the idle reaper measures "time since the session last
-            // did anything", not just "time since the parent last injected a message".
+            // did anything", not just "time since the agent last injected a message".
             // Without this, a self-paced loop (a /loop in dynamic mode using
             // ScheduleWakeup) that wakes itself and works entirely inside this child
             // process stays invisible to the idle timer and gets reaped mid-flight.
@@ -1105,7 +1190,11 @@ class SessionProcess extends events_1.EventEmitter {
                 }
                 catch { }
             }
-            const lines = data.toString().split('\n');
+            const lines = this.runtimeProfile
+                ? (orchestrationOutputBuffer + orchestrationDecoder.write(data)).split('\n')
+                : data.toString().split('\n');
+            if (this.runtimeProfile)
+                orchestrationOutputBuffer = lines.pop() ?? '';
             for (const line of lines) {
                 if (!line.trim())
                     continue;
@@ -1411,7 +1500,7 @@ class SessionProcess extends events_1.EventEmitter {
             if (this.lastSpawnAt && Date.now() - this.lastSpawnAt >= RESTART_COUNT_RESET_MS) {
                 this.restartCount = 0;
             }
-            if (!this.stopping)
+            if (!this.stopping && !this.runtimeProfile)
                 this.scheduleRestart();
         });
         proc.on('error', (err) => {
@@ -1499,6 +1588,8 @@ class SessionProcess extends events_1.EventEmitter {
      * that Claude Code was replaying on every request.
      */
     recoverFromCorruptedThinking() {
+        if (this.runtimeProfile)
+            return; // recovery belongs to the orchestration, never replay task effects
         if (this.restartRequested || this.stopping)
             return; // already respawning
         if (this.thinkingRecoveryCount >= MAX_THINKING_RECOVERIES) {
@@ -1518,7 +1609,7 @@ class SessionProcess extends events_1.EventEmitter {
         if (this.process)
             this.process.kill('SIGTERM');
     }
-    sendMessage(text) {
+    sendMessage(text, images = []) {
         if (!this.process?.stdin?.writable) {
             this.logger.warn('Cannot send message: subprocess not running', {
                 sessionId: this.sessionId,
@@ -1531,7 +1622,7 @@ class SessionProcess extends events_1.EventEmitter {
         // Signal queued state + ensure typing signal file exists for this turn.
         // If the previous turn already called stop() and cleared the typing loop,
         // re-creating the signal file here lets stop() restart the loop for queued turns.
-        if (this.source !== 'api') {
+        if (this.source !== 'api' && !this.runtimeProfile) {
             const typingDir = this.typingDir;
             const typingSignalPath = path.join(typingDir, this.chatId);
             const statusPath = path.join(typingDir, `${this.chatId}.status`);
@@ -1547,7 +1638,7 @@ class SessionProcess extends events_1.EventEmitter {
             ? `${this.pendingInitialPrompt}\n\n${text}`
             : text;
         this.pendingInitialPrompt = undefined;
-        this.process.stdin.write(SessionProcess.toStreamJsonTurn(fullText) + '\n');
+        this.process.stdin.write(SessionProcess.toStreamJsonTurn(fullText, images) + '\n');
     }
     /**
      * Send a control keystroke to the PTY wrapper (Epic #195, Phase 3b). Only
@@ -1652,7 +1743,7 @@ class SessionProcess extends events_1.EventEmitter {
         this.clearBackgroundWaitTimer();
     }
     /**
-     * Extend Telegram's working state only while a parent session is waiting for
+     * Extend Telegram's working state only while a agent session is waiting for
      * background Agent/Workflow/Monitor work. A bounded expiry (BACKGROUND_AGENT_GRACE_MS,
      * fixed from the dispatch timestamp — not renewed by later activity) releases
      * the state if the dispatch never sends its completion notification within
@@ -1661,7 +1752,7 @@ class SessionProcess extends events_1.EventEmitter {
      * BACKGROUND_AGENT_GRACE_MS.
      */
     retainBackgroundWorkingState() {
-        if (this.source !== 'telegram' || !this.hasLikelyOutstandingBackgroundWork())
+        if (this.runtimeProfile || this.source !== 'telegram' || !this.hasLikelyOutstandingBackgroundWork())
             return false;
         const processingPath = path.join(this.typingDir, `${this.chatId}.processing`);
         try {
@@ -1713,7 +1804,7 @@ class SessionProcess extends events_1.EventEmitter {
                 }
             }
             this.emit('processingChange', active);
-            if (this.source === 'telegram') {
+            if (this.source === 'telegram' && !this.runtimeProfile) {
                 const processingPath = path.join(this.typingDir, `${this.chatId}.processing`);
                 try {
                     if (active) {
@@ -1816,6 +1907,16 @@ class SessionProcess extends events_1.EventEmitter {
     }
     async stop() {
         this.stopping = true;
+        if (this.containerAttempt && this.agentConfig.container) {
+            this.managedGroupStopped = await (0, container_1.stopContainerProfile)(this.agentConfig.container, this.containerAttempt.directory);
+            this.containerAttempt = undefined;
+        }
+        if (this.managedProcessGroup) {
+            const hostStopped = await (0, process_supervisor_1.stopProcessGroup)(this.managedProcessGroup);
+            this.managedGroupStopped = this.agentConfig.type === 'app-agent' ? this.managedGroupStopped && hostStopped : hostStopped;
+            if (this.managedGroupStopped)
+                this.managedProcessGroup = undefined;
+        }
         this.resetBackgroundDispatchState();
         await this.restartWatcher?.close();
         this.restartWatcher = null;
@@ -1823,7 +1924,7 @@ class SessionProcess extends events_1.EventEmitter {
             fs.rmSync(this.restartSignalPath, { force: true });
         }
         catch { }
-        if (this.source === 'telegram') {
+        if (this.source === 'telegram' && !this.runtimeProfile) {
             try {
                 fs.rmSync(path.join(this.typingDir, `${this.chatId}.processing`), { force: true });
             }
@@ -1838,6 +1939,13 @@ class SessionProcess extends events_1.EventEmitter {
         // bind-mounts this path) can be alive for up to the 10s graceful-shutdown
         // window immediately after this point, and must not find it gone under it.
         const removeSessionDir = () => {
+            if (this.managedMcpConfigPath) {
+                try {
+                    fs.rmSync(this.managedMcpConfigPath, { force: true });
+                }
+                catch { }
+                this.managedMcpConfigPath = undefined;
+            }
             try {
                 fs.rmSync(path.join(this.agentConfig.workspace, '.sessions', this.sessionId), { recursive: true, force: true });
             }