@agent-native/core 0.157.9 → 0.157.10

package/corpus/templates/slides/server/handlers/import/pdf-fidelity-parser.ts

@@ -621,6 +621,19 @@ export function detectBlockAlignment(
   blockRight: number,
 ): "left" | "center" | "right" {
   if (blockLines.length < 2) return "left";
+  // The block bounds come from these same lines. Equal-width lines therefore
+  // have identical left edges, right edges, and midpoints whether they were
+  // left-aligned or centered; keep that ambiguous case left-aligned rather
+  // than moving ordinary paragraphs to the center.
+  const widths = blockLines.map((line) => line.right - line.left);
+  const minWidth = Math.min(...widths);
+  const maxWidth = Math.max(...widths);
+  const sameBounds = blockLines.every(
+    (line) => line.left === blockLeft && line.right === blockRight,
+  );
+  if (maxWidth - minWidth <= TEXT_ALIGNMENT_TOLERANCE_PT && sameBounds) {
+    return "left";
+  }
   const midpoint = (blockLeft + blockRight) / 2;
   const centered = blockLines.every(
     (line) =>

package/corpus/templates/slides/server/handlers/import/pptx-assets.ts

@@ -12,6 +12,30 @@ const BROWSER_RENDERABLE_IMAGE_MIME_TYPES = new Set([
   "image/bmp",
 ]);
 
+/**
+ * Validate every image before any upload starts. PPTX imports reject partial
+ * fidelity, so an unsupported image must not leave earlier slide uploads
+ * orphaned when the action eventually throws.
+ */
+export function assertPptxImagesRenderable(
+  slides: readonly ParsedSlide[],
+): void {
+  const unsupported = new Set<string>();
+  for (const slide of slides) {
+    for (const element of slide.elements ?? []) {
+      if (element.kind !== "image" || !element.image) continue;
+      if (!BROWSER_RENDERABLE_IMAGE_MIME_TYPES.has(element.image.mimeType)) {
+        unsupported.add(element.image.mimeType || "unknown");
+      }
+    }
+  }
+  if (unsupported.size > 0) {
+    throw new Error(
+      `Source-faithful PPTX import cannot preserve unsupported image type(s): ${[...unsupported].join(", ")}. No images were uploaded. Re-export the deck with browser-renderable images or use a PDF export for page-faithful preservation.`,
+    );
+  }
+}
+
 export async function uploadPptxSlideImages(args: {
   slide: ParsedSlide;
   slideIndex: number;

package/corpus/templates/slides/shared/aspect-ratios.ts

@@ -23,10 +23,22 @@ export const ASPECT_RATIOS = {
     label: "4:5",
     pptxInches: { w: 8, h: 10 },
   },
+  "4:3": {
+    width: 960,
+    height: 720,
+    label: "4:3",
+    pptxInches: { w: 10, h: 7.5 },
+  },
 } as const;
 
 export type AspectRatio = keyof typeof ASPECT_RATIOS;
-export const ASPECT_RATIO_VALUES = ["16:9", "1:1", "9:16", "4:5"] as const;
+export const ASPECT_RATIO_VALUES = [
+  "16:9",
+  "1:1",
+  "9:16",
+  "4:5",
+  "4:3",
+] as const;
 export const DEFAULT_ASPECT_RATIO: AspectRatio = "16:9";
 
 export function getAspectRatioDims(ratio: AspectRatio | undefined | null) {

package/dist/agent/harness/migrations.js

@@ -10,8 +10,8 @@ export const AGENT_HARNESS_SESSION_MIGRATIONS = [
         harness_name TEXT NOT NULL,
         thread_id TEXT NOT NULL,
         status TEXT NOT NULL DEFAULT 'idle',
-        created_at INTEGER NOT NULL,
-        updated_at INTEGER NOT NULL
+        created_at BIGINT NOT NULL,
+        updated_at BIGINT NOT NULL
       )
     `,
     },
@@ -27,7 +27,7 @@ export const AGENT_HARNESS_SESSION_MIGRATIONS = [
       ALTER TABLE agent_harness_sessions ADD COLUMN IF NOT EXISTS resolved_approval_ids TEXT;
       ALTER TABLE agent_harness_sessions ADD COLUMN IF NOT EXISTS owner_email TEXT;
       ALTER TABLE agent_harness_sessions ADD COLUMN IF NOT EXISTS org_id TEXT;
-      ALTER TABLE agent_harness_sessions ADD COLUMN IF NOT EXISTS stopped_at INTEGER;
+      ALTER TABLE agent_harness_sessions ADD COLUMN IF NOT EXISTS stopped_at BIGINT;
       CREATE INDEX IF NOT EXISTS idx_agent_harness_sessions_thread
         ON agent_harness_sessions (thread_id, updated_at);
       CREATE INDEX IF NOT EXISTS idx_agent_harness_sessions_status
@@ -36,4 +36,25 @@ export const AGENT_HARNESS_SESSION_MIGRATIONS = [
         ON agent_harness_sessions (owner_email, updated_at)
     `,
     },
+    {
+        version: 3,
+        name: "agent-harness-sessions-widen-millisecond-timestamps",
+        // Existing release migrations may have created these columns as Postgres
+        // int4 before the timestamp contract was widened. The type change is
+        // additive and keeps Date.now() values representable on those databases.
+        sql: {
+            postgres: `
+        -- guard:allow-destructive-ddl — widen legacy int4 timestamp storage to preserve Date.now() values
+        ALTER TABLE agent_harness_sessions
+          ALTER COLUMN created_at TYPE BIGINT;
+        -- guard:allow-destructive-ddl — widen legacy int4 timestamp storage to preserve Date.now() values
+        ALTER TABLE agent_harness_sessions
+          ALTER COLUMN updated_at TYPE BIGINT;
+        -- guard:allow-destructive-ddl — widen legacy int4 timestamp storage to preserve Date.now() values
+        ALTER TABLE agent_harness_sessions
+          ALTER COLUMN stopped_at TYPE BIGINT
+      `,
+            sqlite: "",
+        },
+    },
 ];

package/dist/agent/production-agent.js

@@ -19,6 +19,7 @@ import { readBody } from "../server/h3-helpers.js";
 import { resolveHostedHarnessPolicy } from "../server/hosted-harness-policy.js";
 import { assertRequestActionSurfaceIsolation, getRequestRunContext, ensureRequestRunContext, getRequestContext, getRequestOrgId, getRequestUserEmail, runWithRequestContext, } from "../server/request-context.js";
 import { fireInternalDispatch } from "../server/self-dispatch.js";
+import { ANALYTICS_CLIENT_PLATFORM_BODY_FIELD } from "../shared/analytics-platform.js";
 import { isReasoningEffort, normalizeReasoningEffortForRequest, stepDownReasoningEffort, } from "../shared/reasoning-effort.js";
 import { actionPreparationContinuationNote } from "./action-continuation-guidance.js";
 import { drainAgentWarnings, formatAgentWarningsForToolResult, } from "./action-warnings.js";
@@ -6226,6 +6227,16 @@ export function createProductionAgentHandler(options) {
             isAgentChatDurableBackgroundEnabled({
                 appOptIn: options.durableBackgroundRuns,
             });
+        const mutableBody = body;
+        if (!isBackgroundWorker) {
+            delete mutableBody[ANALYTICS_CLIENT_PLATFORM_BODY_FIELD];
+        }
+        if (dispatchToBackground) {
+            const clientPlatform = getRequestContext()?.clientPlatform;
+            if (clientPlatform) {
+                mutableBody[ANALYTICS_CLIENT_PLATFORM_BODY_FIELD] = clientPlatform;
+            }
+        }
         const requestBrowserTabId = normalizeBrowserTabId(browserTabId);
         const requestChatScope = normalizeChatScope(scope);
         const requestRunCtx = ensureRequestRunContext();

package/dist/agent/run-loop-with-resume.js

@@ -407,7 +407,11 @@ export async function runAgentLoopDirectWithSoftTimeout(opts, softTimeoutMs, tim
             const internalContinuationReason = internalContinuationReasonForAttempt(attemptEvents);
             if (internalContinuationReason && !upstreamSignal.aborted) {
                 lastAttemptWasUnfinishedContinuation = true;
-                await appendContinuationAndJournal(opts.messages, internalContinuationReason, opts.threadId, opts.turnId, localTurnEvents, attemptEvents);
+                const continuationEvents = [...localTurnEvents];
+                if ((await completedSideEffectInCurrentTurn(opts.threadId, opts.turnId, continuationEvents)) === "none") {
+                    opts.send({ type: "clear" });
+                }
+                await appendContinuationAndJournal(opts.messages, internalContinuationReason, opts.threadId, opts.turnId, continuationEvents, attemptEvents);
                 continue;
             }
             if (softTimedOut && !upstreamSignal.aborted) {
@@ -422,7 +426,12 @@ export async function runAgentLoopDirectWithSoftTimeout(opts, softTimeoutMs, tim
         }
         catch (err) {
             if (softTimedOut && !upstreamSignal.aborted) {
+                // Clear partial text the client received before the abort so the
+                // resumed model doesn't re-emit it and produce duplicated output.
                 lastAttemptWasUnfinishedContinuation = true;
+                if ((await completedSideEffectInCurrentTurn(opts.threadId, opts.turnId, localTurnEvents)) === "none") {
+                    opts.send({ type: "clear" });
+                }
                 await appendContinuationAndJournal(opts.messages, "run_timeout", opts.threadId, opts.turnId, localTurnEvents, localTurnEvents.slice(attemptStartIndex));
                 continue;
             }
@@ -439,6 +448,9 @@ export async function runAgentLoopDirectWithSoftTimeout(opts, softTimeoutMs, tim
                 rateLimitRetryFitsBudget) {
                 lastAttemptWasUnfinishedContinuation = true;
                 backgroundRateLimitContinuations++;
+                if ((await completedSideEffectInCurrentTurn(opts.threadId, opts.turnId, localTurnEvents)) === "none") {
+                    opts.send({ type: "clear" });
+                }
                 await appendContinuationAndJournal(opts.messages, "rate_limited", opts.threadId, opts.turnId, localTurnEvents, localTurnEvents.slice(attemptStartIndex));
                 await waitForBackgroundRateLimitCooldown(upstreamSignal);
                 continue;
@@ -451,11 +463,16 @@ export async function runAgentLoopDirectWithSoftTimeout(opts, softTimeoutMs, tim
             // another LLM call. Anthropic's prompt cache makes the resume call much
             // faster than the cold first attempt.
             //
-            // Keep streamed text visible while the resumed model finishes from the
-            // internal checkpoint. The continuation prompt tells the model not to
-            // repeat that prefix, so clearing it would leave only the suffix visible.
+            // Emit 'clear' so any partial streamed text is discarded on the client
+            // before the model resumes. Without this the model restarts its sentence
+            // from scratch and the fold produces duplicated text in one message
+            // (the partial text was already sent to the client but is now retained
+            // only as an internal checkpoint so the next attempt can finish it).
             if (!upstreamSignal.aborted && isResumableEngineError(err)) {
                 lastAttemptWasUnfinishedContinuation = true;
+                if ((await completedSideEffectInCurrentTurn(opts.threadId, opts.turnId, localTurnEvents)) === "none") {
+                    opts.send({ type: "clear" });
+                }
                 await appendContinuationAndJournal(opts.messages, continuationReasonForResumableError(err), opts.threadId, opts.turnId, localTurnEvents, localTurnEvents.slice(attemptStartIndex));
                 continue;
             }

package/dist/automations/service.d.ts

@@ -38,6 +38,9 @@ export interface DefineAutomationInput {
     domain?: string;
     delegatedPolicyId?: string;
     model?: string;
+    executionHostId?: string;
+    executionEngine?: string;
+    executionCwd?: string;
     mcpTools?: unknown;
     delivery?: AutomationDelivery;
 }
@@ -52,6 +55,9 @@ export interface UpdateAutomationInput {
     schedule?: string;
     timezone?: string;
     model?: string | null;
+    executionHostId?: string | null;
+    executionEngine?: string | null;
+    executionCwd?: string | null;
     mcpTools?: unknown;
 }
 /**

package/dist/automations/service.js

@@ -9,6 +9,20 @@ export const DEFAULT_AUTOMATION_SCHEDULE = "0 * * * *";
 function httpError(message, statusCode) {
     return Object.assign(new Error(message), { statusCode });
 }
+function normalizeExecutionTarget(value, label, options = {}) {
+    if (value === null || value === undefined)
+        return undefined;
+    const normalized = value.trim();
+    if (!normalized)
+        return undefined;
+    const max = options.max ?? (options.opaque ? 128 : 1024);
+    if (normalized.length > max ||
+        /[\r\n]/.test(normalized) ||
+        (options.opaque && !/^[a-z0-9][a-z0-9._:-]{0,127}$/i.test(normalized))) {
+        throw httpError(`${label} must be a bounded identifier${options.opaque ? " using letters, numbers, dots, underscores, colons, or hyphens" : ""}.`, 400);
+    }
+    return normalized;
+}
 function normalizeActor(actor) {
     const userEmail = actor.userEmail.trim().toLowerCase();
     if (!userEmail)
@@ -204,6 +218,12 @@ export async function defineAutomation(actorInput, input) {
         ? input.timezone || (await resolveUserSchedulingTimezone(actor.userEmail))
         : undefined;
     const mcpTools = normalizeJobMcpTools(input.mcpTools);
+    const executionHostId = normalizeExecutionTarget(input.executionHostId, "execution_host_id", { opaque: true });
+    const executionEngine = normalizeExecutionTarget(input.executionEngine, "execution_engine", { opaque: true });
+    const executionCwd = normalizeExecutionTarget(input.executionCwd, "execution_cwd");
+    if (executionHostId && input.triggerType !== "schedule") {
+        throw httpError("Execution hosts are currently supported for scheduled code automations only.", 400);
+    }
     const meta = {
         schedule: input.triggerType === "schedule" ? schedule : "",
         timezone,
@@ -222,6 +242,9 @@ export async function defineAutomation(actorInput, input) {
             ? nextOccurrence(schedule, undefined, timezone).toISOString()
             : undefined,
         model: input.model?.trim() || undefined,
+        executionHostId,
+        executionEngine,
+        executionCwd,
         mcpTools: mcpTools?.length ? mcpTools : undefined,
         originScopeId: input.delivery?.originScopeId,
         deliveryPlatform: input.delivery?.platform,
@@ -283,6 +306,18 @@ export async function updateAutomation(actorInput, input) {
     if (input.model !== undefined) {
         meta.model = input.model?.trim() || undefined;
     }
+    if (input.executionHostId !== undefined) {
+        if (input.executionHostId && meta.triggerType !== "schedule") {
+            throw httpError("Execution hosts are currently supported for scheduled code automations only.", 400);
+        }
+        meta.executionHostId = normalizeExecutionTarget(input.executionHostId, "execution_host_id", { opaque: true });
+    }
+    if (input.executionEngine !== undefined) {
+        meta.executionEngine = normalizeExecutionTarget(input.executionEngine, "execution_engine", { opaque: true });
+    }
+    if (input.executionCwd !== undefined) {
+        meta.executionCwd = normalizeExecutionTarget(input.executionCwd, "execution_cwd");
+    }
     if (input.mcpTools !== undefined) {
         const mcpTools = normalizeJobMcpTools(input.mcpTools);
         meta.mcpTools = mcpTools?.length ? mcpTools : undefined;

package/dist/cli/code-agent-connector.d.ts

@@ -1,9 +1,11 @@
-import type { RemoteComputerCapabilities } from "../integrations/remote-types.js";
+import type { RemoteComputerCapabilities, RemoteExecutionCapabilities } from "../integrations/remote-types.js";
 export interface RemoteCodeAgentDeviceConfig {
     token: string;
     relayUrl?: string;
     deviceId?: string;
     deviceName?: string;
+    /** Default host-local workspace used when a command omits cwd. */
+    workspacePath?: string;
     pollIntervalMs?: number;
 }
 export interface RunCodeAgentConnectorOptions {
@@ -17,6 +19,7 @@ export interface LocalComputerBridgeConfig {
     token: string;
     capabilities: RemoteComputerCapabilities;
 }
+export declare const DEFAULT_REMOTE_EXECUTION_CAPABILITIES: RemoteExecutionCapabilities;
 export declare function remoteDeviceConfigPath(): string;
 export declare function loadRemoteCodeAgentDeviceConfig(configPath?: string): RemoteCodeAgentDeviceConfig | null;
 export declare function runCodeAgentConnector(options?: RunCodeAgentConnectorOptions): Promise<number>;

package/dist/cli/code-agent-connector.js

@@ -6,14 +6,25 @@ import { assertValidComputerCommandEnvelope } from "../integrations/computer-sup
 import { serializeBoundedRemoteJson } from "../integrations/remote-json-safety.js";
 import { executeDenyCodeAgentApproval, executePendingCodeAgentApproval, } from "./code-agent-executor.js";
 import { appendCodeAgentTranscriptEvent, codeAgentRunTranscriptPath, codeAgentStoreRoot, createCodeAgentRunRecord, getCodeAgentRunRecord, listCodeAgentRunRecords, normalizeCodeAgentPermissionMode, queueCodeAgentFollowUp, updateCodeAgentRunRecord, } from "./code-agent-runs.js";
+import { loadPortalEnvironment, preparePortalWorkspace, parsePortalHandoff, } from "./portal-workspace.js";
 const DEVICE_PATH_ENV = "AGENT_NATIVE_REMOTE_DEVICE_PATH";
 const COMPUTER_BRIDGE_URL_ENV = "AGENT_NATIVE_COMPUTER_BRIDGE_URL";
 const COMPUTER_BRIDGE_TOKEN_ENV = "AGENT_NATIVE_COMPUTER_BRIDGE_TOKEN";
 const COMPUTER_CAPABILITIES_ENV = "AGENT_NATIVE_COMPUTER_CAPABILITIES";
+const REMOTE_ENGINES_ENV = "AGENT_NATIVE_REMOTE_ENGINES";
 const DEFAULT_POLL_INTERVAL_MS = 2_000;
 const MAX_POLL_INTERVAL_MS = 30_000;
 const MAX_TRANSCRIPT_EVENTS_PER_BATCH = 50;
 const activeRunners = new Map();
+export const DEFAULT_REMOTE_EXECUTION_CAPABILITIES = {
+    backend: "desktop",
+    workloads: ["code-agent", "scheduled-code"],
+    engines: ["codex-cli", "claude-cli", "pi-cli", "opencode-cli"],
+    acceptsScheduledWork: true,
+    acceptsPortalHandoffs: true,
+    persistence: "local-files",
+    adapters: ["agent-native-code"],
+};
 export function remoteDeviceConfigPath() {
     return path.resolve(process.env[DEVICE_PATH_ENV] ??
         path.join(os.homedir(), ".agent-native", "remote-device.json"));
@@ -32,6 +43,7 @@ export function loadRemoteCodeAgentDeviceConfig(configPath = remoteDeviceConfigP
             relayUrl: firstStringValue(raw.relayUrl, raw.url, raw.baseUrl),
             deviceId: firstStringValue(raw.deviceId, raw.id),
             deviceName: firstStringValue(raw.deviceName, raw.name),
+            workspacePath: firstStringValue(raw.workspacePath, raw.workspace, raw.cwd, raw.projectPath),
             pollIntervalMs: Number.isFinite(pollIntervalMs) && pollIntervalMs > 0
                 ? Math.min(Math.max(pollIntervalMs, 500), MAX_POLL_INTERVAL_MS)
                 : undefined,
@@ -77,6 +89,7 @@ class RemoteCodeAgentConnector {
     output;
     transcriptCursors = new Map();
     remoteRunIds = new Set();
+    terminalCommandIds = new Set();
     stopped = false;
     computerBridge = loadLocalComputerBridgeConfig();
     constructor(config, relayUrl, output) {
@@ -140,6 +153,7 @@ class RemoteCodeAgentConnector {
                 "run-events",
             ],
             computerCapabilities: this.computerBridge?.capabilities ?? {},
+            executionCapabilities: remoteExecutionCapabilities(),
             activeRunIds: Array.from(this.remoteRunIds),
         });
         const commands = normalizeCommands(response);
@@ -180,25 +194,65 @@ class RemoteCodeAgentConnector {
     async computerOperation(command) {
         return dispatchComputerOperationToLocalBridge(this.computerBridge, command.params.envelope);
     }
-    createRun(command) {
+    async createRun(command) {
         const prompt = firstTextValue(command.params.prompt, command.params.message, command.params.input);
         if (!prompt) {
             return { ok: false, error: "Missing prompt." };
         }
         const goalId = firstStringValue(command.params.goalId) ?? "task";
-        const cwd = resolveCommandCwd(command.params.cwd);
+        const metadata = isObject(command.params.metadata)
+            ? command.params.metadata
+            : {};
+        let cwd = resolveCommandCwd(command.params.cwd ?? this.config.workspacePath);
+        let portalWorkspace;
+        let portalEnvironment;
+        if (metadata.portal !== undefined) {
+            try {
+                portalWorkspace = await preparePortalWorkspace({
+                    handoff: parsePortalHandoff(metadata.portal),
+                    workspacePath: this.config.workspacePath,
+                });
+                portalEnvironment = loadPortalEnvironment(portalWorkspace.environmentRoot);
+                cwd = portalWorkspace.workspacePath;
+            }
+            catch (error) {
+                return {
+                    ok: false,
+                    error: error instanceof Error ? error.message : String(error),
+                };
+            }
+        }
+        const requestedRunId = firstStringValue(command.params.runId);
+        if (portalWorkspace && requestedRunId && !isSafeRunId(requestedRunId)) {
+            return { ok: false, error: "Portal run id is invalid." };
+        }
+        if (portalWorkspace && requestedRunId) {
+            const existing = getCodeAgentRunRecord(requestedRunId);
+            const existingRemote = isObject(existing?.metadata?.remote)
+                ? existing.metadata.remote
+                : {};
+            if (existing &&
+                firstStringValue(existingRemote.commandId) === command.id) {
+                this.remoteRunIds.add(existing.id);
+                this.transcriptCursors.set(existing.id, { offset: 0, seq: 0 });
+                if (!activeRunners.has(existing.id)) {
+                    this.spawnRunner(existing.id, existing.cwd, existing.permissionMode, portalEnvironment?.values);
+                }
+                return { ok: true, runId: existing.id, run: existing, resumed: true };
+            }
+        }
         const permissionMode = normalizeCodeAgentPermissionMode(command.params.permissionMode) ??
             "full-auto";
         const engine = firstStringValue(command.params.engine);
         const model = firstStringValue(command.params.model);
         const effort = firstStringValue(command.params.effort, command.params.reasoningEffort);
-        const metadata = isObject(command.params.metadata)
-            ? command.params.metadata
-            : {};
         const run = createCodeAgentRunRecord({
+            ...(portalWorkspace && requestedRunId ? { id: requestedRunId } : {}),
             goalId,
             title: firstStringValue(command.params.title) ?? titleFromPrompt(prompt),
-            subtitle: "Remote coding task",
+            subtitle: portalWorkspace
+                ? `Portal on ${this.config.deviceName ?? "paired computer"}`
+                : "Remote coding task",
             status: "queued",
             phase: "queued",
             permissionMode,
@@ -213,6 +267,20 @@ class RemoteCodeAgentConnector {
                 { label: "Prompt", value: truncateForDisplay(prompt, 160) },
                 { label: "Agent", value: "Remote connector" },
                 { label: "Mode", value: permissionMode },
+                ...(portalWorkspace
+                    ? [
+                        {
+                            label: "Workspace",
+                            value: `Portal · ${portalWorkspace.workspacePath}`,
+                        },
+                        {
+                            label: "Environment",
+                            value: portalEnvironment?.files.length
+                                ? `Loaded ${portalEnvironment.files.join(", ")}`
+                                : "Using paired computer environment",
+                        },
+                    ]
+                    : []),
             ],
             metadata: {
                 ...metadata,
@@ -225,7 +293,26 @@ class RemoteCodeAgentConnector {
                     commandId: command.id,
                     deviceId: this.config.deviceId,
                     relayUrl: this.relayUrl,
+                    ...(portalWorkspace ? { remoteRunId: run.id } : {}),
                 },
+                ...(portalWorkspace
+                    ? {
+                        portal: portalWorkspace.handoff,
+                        executionResidence: {
+                            schemaVersion: 1,
+                            kind: "portal",
+                            hostId: this.config.deviceId,
+                            hostLabel: this.config.deviceName ?? os.hostname(),
+                            workspacePath: portalWorkspace.workspacePath,
+                            sourceBranch: portalWorkspace.handoff.sourceBranch,
+                            sourceCommit: portalWorkspace.handoff.commit,
+                            handoffId: portalWorkspace.handoff.handoffId,
+                            envPolicy: portalWorkspace.handoff.envPolicy,
+                            environmentFiles: portalEnvironment?.files ?? [],
+                            environmentLoadedAt: new Date().toISOString(),
+                        },
+                    }
+                    : {}),
             },
         });
         appendCodeAgentTranscriptEvent({
@@ -242,7 +329,7 @@ class RemoteCodeAgentConnector {
         });
         this.remoteRunIds.add(run.id);
         this.transcriptCursors.set(run.id, { offset: 0, seq: 0 });
-        this.spawnRunner(run.id, cwd, permissionMode);
+        this.spawnRunner(run.id, cwd, permissionMode, portalEnvironment?.values);
         return { ok: true, runId: run.id, run };
     }
     appendFollowUp(command) {
@@ -424,7 +511,7 @@ class RemoteCodeAgentConnector {
             activeRunIds: Array.from(activeRunners.keys()),
         };
     }
-    spawnRunner(runId, cwd, permissionMode) {
+    spawnRunner(runId, cwd, permissionMode, portalEnvironment) {
         if (activeRunners.has(runId))
             return;
         const invocation = resolveCodeAgentCliInvocation();
@@ -434,6 +521,7 @@ class RemoteCodeAgentConnector {
             stdio: ["ignore", "pipe", "pipe"],
             env: {
                 ...process.env,
+                ...portalEnvironment,
                 AGENT_NATIVE_CODE_AGENTS_HOME: codeAgentStoreRoot(),
                 ...(permissionMode
                     ? { AGENT_NATIVE_CODE_AGENT_PERMISSION_MODE: permissionMode }
@@ -484,28 +572,50 @@ class RemoteCodeAgentConnector {
         for (const runId of this.remoteRunIds) {
             const cursor = this.transcriptCursors.get(runId) ?? { offset: 0, seq: 0 };
             const batch = readTranscriptBatch(runId, cursor.offset);
-            if (batch.events.length === 0) {
-                this.transcriptCursors.set(runId, {
-                    offset: batch.nextOffset,
-                    seq: cursor.seq,
+            if (batch.events.length > 0) {
+                await this.postJson("/_agent-native/integrations/remote/run-events", {
+                    deviceId: this.config.deviceId,
+                    remoteRunId: runId,
+                    cursor: { offset: batch.nextOffset },
+                    events: batch.events.map((event, index) => ({
+                        seq: cursor.seq + index,
+                        event,
+                    })),
                 });
-                continue;
             }
-            await this.postJson("/_agent-native/integrations/remote/run-events", {
-                deviceId: this.config.deviceId,
-                remoteRunId: runId,
-                cursor: { offset: batch.nextOffset },
-                events: batch.events.map((event, index) => ({
-                    seq: cursor.seq + index,
-                    event,
-                })),
-            });
             this.transcriptCursors.set(runId, {
                 offset: batch.nextOffset,
                 seq: cursor.seq + batch.events.length,
             });
+            await this.reportRemoteRunTerminal(runId);
         }
     }
+    async reportRemoteRunTerminal(runId) {
+        const run = getCodeAgentRunRecord(runId);
+        if (!run || (run.status !== "completed" && run.status !== "errored")) {
+            return;
+        }
+        const remote = isObject(run.metadata?.remote) ? run.metadata.remote : {};
+        const commandId = firstStringValue(remote.commandId);
+        if (!commandId || this.terminalCommandIds.has(commandId))
+            return;
+        const errorMessage = firstStringValue(run.metadata?.error, run.metadata?.runnerError);
+        await this.postJson("/_agent-native/integrations/remote/result", {
+            deviceId: this.config.deviceId,
+            commandId,
+            kind: "create-run",
+            ok: run.status === "completed",
+            status: run.status === "completed" ? "completed" : "failed",
+            result: {
+                ok: run.status === "completed",
+                run,
+            },
+            errorMessage: run.status === "errored"
+                ? (errorMessage ?? "Remote code-agent run failed.")
+                : undefined,
+        });
+        this.terminalCommandIds.add(commandId);
+    }
     async postCommandResult(command, result) {
         let safeResult;
         try {
@@ -519,12 +629,17 @@ class RemoteCodeAgentConnector {
                     : "Connector result rejected as unsafe.",
             };
         }
+        const isAcceptedCreateRun = normalizeKind(command.kind) === "create-run" && safeResult.ok !== false;
         await this.postJson("/_agent-native/integrations/remote/result", {
             deviceId: this.config.deviceId,
             commandId: command.id,
             kind: command.kind,
             ok: safeResult.ok !== false,
-            status: safeResult.ok === false ? "failed" : "completed",
+            status: safeResult.ok === false
+                ? "failed"
+                : isAcceptedCreateRun
+                    ? "running"
+                    : "completed",
             result: safeResult,
             errorMessage: typeof safeResult.error === "string" ? safeResult.error : undefined,
         });
@@ -535,6 +650,7 @@ class RemoteCodeAgentConnector {
             method: "POST",
             headers: {
                 authorization: `Bearer ${this.config.token}`,
+                "x-agent-native-device-token": this.config.token,
                 "content-type": "application/json",
             },
             body: JSON.stringify(body),
@@ -712,6 +828,21 @@ function resolveCommandCwd(value) {
     const cwd = firstStringValue(value);
     return cwd ? path.resolve(cwd) : process.cwd();
 }
+function isSafeRunId(value) {
+    return value.length <= 160 && /^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(value);
+}
+function remoteExecutionCapabilities() {
+    const configured = process.env[REMOTE_ENGINES_ENV]
+        ?.split(",")
+        .map((engine) => engine.trim())
+        .filter(Boolean);
+    return {
+        ...DEFAULT_REMOTE_EXECUTION_CAPABILITIES,
+        ...(configured?.length
+            ? { engines: [...new Set(configured)].slice(0, 32) }
+            : {}),
+    };
+}
 function normalizeRelayUrl(value) {
     if (!value)
         return null;