@agenthippo-ai/agenthippo 0.2.3-dataplane → 1.110.11

package/out/remote/handleRemoteChat.js

@@ -9,6 +9,27 @@ const base_js_1 = require("../engines/base.js");
 const utils_js_1 = require("../utils.js");
 const sessionEvents_js_1 = require("../analytics/sessionEvents.js");
 const serveClient_js_1 = require("./serveClient.js");
+const remoteTrust_js_1 = require("./remoteTrust.js");
+/**
+ * The gate used when the caller does not inject one.
+ *
+ * `vscode` is resolved lazily (and may legitimately be absent in headless/CLI hosts) so this module
+ * stays importable outside the extension host. With no prompt available an untrusted host is
+ * REFUSED rather than silently contacted — the refusal message names the host and the env var that
+ * whitelists it, so the failure is actionable rather than mysterious.
+ */
+function defaultRemoteTrustGate() {
+    try {
+        // eslint-disable-next-line no-eval
+        const api = eval('require')('vscode');
+        return (0, remoteTrust_js_1.createRemoteTrustGate)({
+            prompt: (0, remoteTrust_js_1.vscodeRemoteTrustPrompt)((message, options, ...items) => api.window.showWarningMessage(message, options, ...items)),
+        });
+    }
+    catch {
+        return (0, remoteTrust_js_1.createRemoteTrustGate)();
+    }
+}
 function isLoopbackServeUrl(url) {
     try {
         const host = new URL(url).hostname;
@@ -78,16 +99,35 @@ async function handleRemoteServeChat(deps, args) {
         },
     } : questionEmitter;
     const requestId = (0, base_js_1.generateRequestId)();
-    let auth = deps.getServeAuth ? await deps.getServeAuth() : undefined;
-    if (!isLoopbackServeUrl(remoteUrl) && !auth?.accessToken && deps.ensureSignedIn) {
+    // Decide WHO this is before deciding whether to sign in. `remoteUrl` comes from a pack manifest,
+    // which is attacker-controllable; forcing a sign-in first (as this used to) meant an untrusted
+    // host got a freshly-minted access token handed to it on the very next line.
+    const trustGate = deps.remoteTrust ?? defaultRemoteTrustGate();
+    const trust = await trustGate.evaluate(remoteUrl);
+    if (!trust.allowed) {
+        const trustError = trust.verdict.reason
+            ?? `Refusing to send this chat to ${trust.verdict.origin}.`;
+        deps.log(outputChannel, `[AgentIDE] Remote serve refused: ${trustError}`);
+        await emitter.error(trustError);
+        await emitter.done();
+        return { error: trustError };
+    }
+    let auth = trust.sendAuth && deps.getServeAuth ? await deps.getServeAuth() : undefined;
+    // `requireAuth`, not `sendAuth`: a loopback serve may carry a token we already hold but must
+    // never trigger an interactive sign-in — an unauthenticated local `agenthippo serve` is a
+    // supported setup and used to work without one.
+    if (trust.requireAuth && !auth?.accessToken && deps.ensureSignedIn) {
         auth = await deps.ensureSignedIn();
     }
-    if (!isLoopbackServeUrl(remoteUrl) && !auth?.accessToken) {
+    if (trust.requireAuth && !auth?.accessToken) {
         const authError = 'Sign in to AgentHippo was cancelled or timed out. Use Command Palette → "Sign In to AgentHippo" to try again.';
         await emitter.error(authError);
         await emitter.done();
         return { error: authError };
     }
+    if (!trust.sendAuth) {
+        auth = undefined;
+    }
     const remoteSessionId = incomingOptions.contextSessionId?.trim() ||
         incomingOptions.sessionId?.trim() ||
         `ide-remote-${streamId}`;
@@ -102,6 +142,7 @@ async function handleRemoteServeChat(deps, args) {
             sessionId: remoteSessionId,
             signal: abortController.signal,
             auth,
+            authorizedForAuth: trust.sendAuth,
         }, observableEmitter);
         if (!result.ok) {
             // streamRemoteServeChat already surfaced the failure to the emitter (error + done);

package/out/remote/remoteTrust.js

@@ -0,0 +1,277 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RemoteTrustStore = exports.DEFAULT_TRUSTED_REMOTE_DOMAINS = void 0;
+exports.isLoopbackHostname = isLoopbackHostname;
+exports.classifyRemoteServeUrl = classifyRemoteServeUrl;
+exports.mayReceiveAccessToken = mayReceiveAccessToken;
+exports.defaultRemoteTrustStorePath = defaultRemoteTrustStorePath;
+exports.trustedDomainsFromEnv = trustedDomainsFromEnv;
+exports.createRemoteTrustGate = createRemoteTrustGate;
+exports.untrustedRefusalMessage = untrustedRefusalMessage;
+exports.vscodeRemoteTrustPrompt = vscodeRemoteTrustPrompt;
+/**
+ * Who is allowed to receive the user's AgentHippo access token.
+ *
+ * `spec.remote.url` comes from a PACK MANIFEST — a file that arrives from the store, a PR, or a
+ * teammate's library. Before this module existed the remote chat path read that URL, FORCED a
+ * sign-in for any non-loopback host, and then sent `Authorization: Bearer <access token>` plus the
+ * user's full message to it. Publishing a pack whose manifest named an attacker host was therefore
+ * a one-step token exfiltration with no prompt and no scheme check.
+ *
+ * The model here is deliberately small:
+ *
+ *  - **loopback** (`127.0.0.1` / `localhost` / `::1`): a serve the user started themselves. Allowed
+ *    without a prompt, and may receive the token — a locally-run `agenthippo serve` validates it,
+ *    and refusing here would break that with no way to opt back in. Residual risk, stated: another
+ *    local account that can bind the port would receive the token. That is the same trust boundary
+ *    the user already extends to anything running as them on that machine.
+ *  - **trusted**: the product's own domains, plus hosts the user has explicitly approved. These may
+ *    receive the bearer token.
+ *  - **untrusted**: everything else. The turn either gets explicit consent (a modal naming the host
+ *    and saying the access token will be sent) or it is refused. The token is NEVER attached to an
+ *    unapproved host — not even "just this once".
+ *  - **refused**: cleartext `http://` to a non-loopback host, or a non-http(s) scheme. There is no
+ *    consent prompt for these; a bearer token does not go over cleartext.
+ *
+ * Approvals are persisted per HOST (scheme+hostname+port) in the user's home directory, never in
+ * workspace state — a repo must not be able to pre-approve itself by shipping a state file.
+ */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/**
+ * Hosts trusted without a prompt. Exact host or any subdomain. Keep this list to domains the
+ * product actually operates: every entry here is a host that may receive a user's access token.
+ */
+exports.DEFAULT_TRUSTED_REMOTE_DOMAINS = ['agenthippo.ai'];
+const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1', '[::1]']);
+function isLoopbackHostname(hostname) {
+    return LOOPBACK_HOSTNAMES.has(hostname.toLowerCase());
+}
+function matchesDomain(hostname, domain) {
+    const h = hostname.toLowerCase();
+    const d = domain.toLowerCase().replace(/^\./, '');
+    return h === d || h.endsWith(`.${d}`);
+}
+/**
+ * Classify a remote serve URL. Pure — the caller supplies the extra trust it knows about
+ * (built-in domains are always included; `approvedOrigins` comes from the persisted consent store).
+ */
+function classifyRemoteServeUrl(rawUrl, opts = {}) {
+    const trimmed = (rawUrl ?? '').trim();
+    let url;
+    try {
+        url = new URL(trimmed);
+    }
+    catch {
+        return {
+            level: 'refused',
+            origin: trimmed,
+            hostname: '',
+            reason: `remote agent URL "${trimmed}" is not a valid URL`,
+        };
+    }
+    const hostname = url.hostname;
+    const origin = `${url.protocol}//${url.host}`;
+    if (url.protocol !== 'https:' && url.protocol !== 'http:') {
+        return {
+            level: 'refused',
+            origin,
+            hostname,
+            reason: `remote agent URL "${trimmed}" uses an unsupported scheme (${url.protocol}) — only https:// is allowed (http:// for loopback)`,
+        };
+    }
+    if (isLoopbackHostname(hostname)) {
+        // Loopback over http is the normal `agenthippo serve` development case and never leaves
+        // the machine. It is also the only case that gets no bearer token, so there is nothing
+        // on the wire worth protecting with TLS.
+        return { level: 'loopback', origin, hostname };
+    }
+    if (url.protocol === 'http:') {
+        return {
+            level: 'refused',
+            origin,
+            hostname,
+            reason: `remote agent URL "${trimmed}" is plain http:// to a non-loopback host. ` +
+                `This request would carry your AgentHippo access token and your full message, ` +
+                `so it is refused. Ask the pack author for an https:// endpoint.`,
+        };
+    }
+    const trusted = opts.trustedDomains ?? exports.DEFAULT_TRUSTED_REMOTE_DOMAINS;
+    if (trusted.some((domain) => matchesDomain(hostname, domain))) {
+        return { level: 'trusted', origin, hostname };
+    }
+    if ((opts.approvedOrigins ?? []).some((approved) => approved.toLowerCase() === origin.toLowerCase())) {
+        return { level: 'trusted', origin, hostname };
+    }
+    return { level: 'untrusted', origin, hostname };
+}
+/** A verdict that permits sending `Authorization: Bearer <access token>`. */
+function mayReceiveAccessToken(verdict) {
+    return verdict.level === 'trusted' || verdict.level === 'loopback';
+}
+// -----------------------------------------------------------------------------
+// Persisted per-host approvals
+// -----------------------------------------------------------------------------
+/**
+ * Where approvals live. The user's home directory, NOT workspace state and NOT the extension's
+ * workspace-scoped storage: a repository must not be able to ship a file that pre-approves its own
+ * exfiltration endpoint. 0600 so another local account cannot add an entry.
+ */
+function defaultRemoteTrustStorePath(homeDir = os.homedir()) {
+    return path.join(homeDir, '.agent-hippo', 'remote-trust.json');
+}
+class RemoteTrustStore {
+    storePath;
+    constructor(storePath = defaultRemoteTrustStorePath()) {
+        this.storePath = storePath;
+    }
+    readApprovedOrigins() {
+        try {
+            const raw = fs.readFileSync(this.storePath, 'utf8');
+            const parsed = JSON.parse(raw);
+            return Array.isArray(parsed.approvedOrigins)
+                ? parsed.approvedOrigins.filter((o) => typeof o === 'string')
+                : [];
+        }
+        catch {
+            // Missing / unreadable / malformed ⇒ nothing is approved. Fail closed.
+            return [];
+        }
+    }
+    approveOrigin(origin) {
+        const existing = new Set(this.readApprovedOrigins().map((o) => o.toLowerCase()));
+        if (existing.has(origin.toLowerCase())) {
+            return;
+        }
+        const next = [...this.readApprovedOrigins(), origin];
+        fs.mkdirSync(path.dirname(this.storePath), { recursive: true });
+        fs.writeFileSync(this.storePath, JSON.stringify({ approvedOrigins: next }, null, 2), { mode: 0o600 });
+        try {
+            fs.chmodSync(this.storePath, 0o600);
+        }
+        catch { /* best effort on platforms without chmod */ }
+    }
+    revokeOrigin(origin) {
+        const next = this.readApprovedOrigins().filter((o) => o.toLowerCase() !== origin.toLowerCase());
+        fs.mkdirSync(path.dirname(this.storePath), { recursive: true });
+        fs.writeFileSync(this.storePath, JSON.stringify({ approvedOrigins: next }, null, 2), { mode: 0o600 });
+    }
+}
+exports.RemoteTrustStore = RemoteTrustStore;
+/**
+ * Additional trusted domains from the process environment. Deliberately env and not a VS Code
+ * setting that a workspace could reach: this is the enterprise/self-host escape hatch, set by
+ * whoever launches the editor, and it must not be settable by a repository.
+ */
+function trustedDomainsFromEnv(env = process.env) {
+    return (env.AGENTHIPPO_REMOTE_TRUSTED_HOSTS ?? '')
+        .split(',')
+        .map((s) => s.trim())
+        .filter(Boolean);
+}
+function createRemoteTrustGate(opts = {}) {
+    const store = opts.store ?? new RemoteTrustStore();
+    const trustedDomains = opts.trustedDomains
+        ?? [...exports.DEFAULT_TRUSTED_REMOTE_DOMAINS, ...trustedDomainsFromEnv()];
+    return {
+        async evaluate(url) {
+            const approvedOrigins = store.readApprovedOrigins();
+            let verdict = classifyRemoteServeUrl(url, { trustedDomains, approvedOrigins });
+            if (verdict.level === 'refused') {
+                return { allowed: false, sendAuth: false, requireAuth: false, verdict };
+            }
+            if (verdict.level === 'loopback') {
+                // The user's own machine. Allowed without a prompt, and the token may go — a local
+                // `agenthippo serve` validates it, and this path has always worked that way. Crucially
+                // it does NOT force a sign-in: an unauthenticated local serve stays usable.
+                return { allowed: true, sendAuth: true, requireAuth: false, verdict };
+            }
+            if (verdict.level === 'trusted') {
+                return { allowed: true, sendAuth: true, requireAuth: true, verdict };
+            }
+            // Untrusted: one explicit, modal, host-naming consent — or nothing.
+            if (!opts.prompt) {
+                return {
+                    allowed: false,
+                    sendAuth: false,
+                    requireAuth: false,
+                    verdict: {
+                        ...verdict,
+                        reason: untrustedRefusalMessage(verdict),
+                    },
+                };
+            }
+            const approved = await opts.prompt(verdict);
+            if (!approved) {
+                return {
+                    allowed: false,
+                    sendAuth: false,
+                    requireAuth: false,
+                    verdict: { ...verdict, reason: untrustedRefusalMessage(verdict) },
+                };
+            }
+            store.approveOrigin(verdict.origin);
+            verdict = { ...verdict, level: 'trusted' };
+            return { allowed: true, sendAuth: true, requireAuth: true, verdict };
+        },
+    };
+}
+function untrustedRefusalMessage(verdict) {
+    return (`This agent pack routes your chat to "${verdict.origin}", which is not an AgentHippo host and ` +
+        `which you have not approved. The request would include your AgentHippo access token and your ` +
+        `full message, so it was refused. If you trust this host, approve it when prompted, or set ` +
+        `AGENTHIPPO_REMOTE_TRUSTED_HOSTS=${verdict.hostname} in the environment that launches your editor.`);
+}
+/**
+ * The consent prompt, as a modal. Separated from the gate so tests never touch the VS Code API and
+ * so a headless/CLI host simply has no prompt (⇒ refuse) rather than a broken import.
+ */
+function vscodeRemoteTrustPrompt(showWarningMessage) {
+    return async (verdict) => {
+        const choice = await showWarningMessage(`Send your AgentHippo access token to ${verdict.origin}?`, {
+            modal: true,
+            detail: `This agent pack runs remotely on ${verdict.hostname}, which is not an AgentHippo host.\n\n` +
+                `Approving sends your AgentHippo access token and the full text of every message in this ` +
+                `chat to that host. Approve only if you operate or trust it.\n\n` +
+                `This choice is remembered for ${verdict.origin} on this machine.`,
+        }, 'Approve and Remember');
+        return choice === 'Approve and Remember';
+    };
+}

package/out/remote/serveClient.js

@@ -6,31 +6,78 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildServeAuthHeaders = buildServeAuthHeaders;
 exports.normalizeServeBaseUrl = normalizeServeBaseUrl;
 exports.getRemoteServeUrl = getRemoteServeUrl;
+exports.getRemoteServeUrlDiagnostic = getRemoteServeUrlDiagnostic;
 exports.streamRemoteServeChat = streamRemoteServeChat;
+const remoteTrust_js_1 = require("./remoteTrust.js");
 /** Abort if the stream sends no data for this long (reset on every chunk). */
 const IDLE_TIMEOUT_MS = 120_000;
 /** Safety net so a runaway stream can't hold the conversation open forever. */
 const HARD_CAP_MS = 30 * 60_000;
+/**
+ * Build the outbound auth headers.
+ *
+ * **No self-asserted identity header.** This used to also send `X-Agent-User: <auth.userEmail>`,
+ * and the serve side trusts `x-agent-user` as its first identity alias. On any deployment that does
+ * not pin `AGENTHIPPO_IDENTITY_HEADER`, a client could put someone else's address there and be
+ * namespaced into that user's session and state, and be issued a data-plane nonce scoped to them.
+ * The bearer token already carries a *verified* identity, so the header added nothing but an
+ * impersonation primitive: send the credential and let the server derive who it belongs to.
+ */
 function buildServeAuthHeaders(auth) {
     const headers = {};
     if (!auth?.accessToken) {
         return headers;
     }
     headers.Authorization = `Bearer ${auth.accessToken}`;
-    if (auth.userEmail?.trim()) {
-        headers['X-Agent-User'] = auth.userEmail.trim();
-    }
     return headers;
 }
 function normalizeServeBaseUrl(url) {
     return url.trim().replace(/\/+$/, '');
 }
+/**
+ * The remote endpoint declared by a pack manifest.
+ *
+ * This value is attacker-controllable in the interesting case: manifests arrive from the store, a
+ * pull request, or a shared library. Only the scheme is decided here (`https://`, or `http://` for
+ * loopback); WHO may receive the user's access token is decided by `remote/remoteTrust.ts` at the
+ * moment of use, because that decision needs the user's persisted approvals.
+ *
+ * A URL with an unusable scheme is dropped rather than returned, so no other code path can dial it;
+ * `getRemoteServeUrlDiagnostic` explains the drop for callers that want to tell the user.
+ */
 function getRemoteServeUrl(manifest) {
     const url = manifest?.spec?.remote?.url?.trim();
-    return url || undefined;
+    if (!url) {
+        return undefined;
+    }
+    return (0, remoteTrust_js_1.classifyRemoteServeUrl)(url).level === 'refused' ? undefined : url;
+}
+/** The reason `getRemoteServeUrl` dropped a manifest's URL, or undefined if it did not. */
+function getRemoteServeUrlDiagnostic(manifest) {
+    const url = manifest?.spec?.remote?.url?.trim();
+    if (!url) {
+        return undefined;
+    }
+    const verdict = (0, remoteTrust_js_1.classifyRemoteServeUrl)(url);
+    return verdict.level === 'refused' ? verdict.reason : undefined;
 }
 async function streamRemoteServeChat(options, emitter) {
     const base = normalizeServeBaseUrl(options.baseUrl);
+    // Final gate before anything leaves the process. A refused scheme never reaches fetch(), and a
+    // host the caller did not vouch for never receives the bearer token — the request goes out
+    // unauthenticated instead, so a misconfigured pack fails with the remote's own 401 rather than
+    // handing over the credential.
+    const verdict = (0, remoteTrust_js_1.classifyRemoteServeUrl)(base, {
+        trustedDomains: [...remoteTrust_js_1.DEFAULT_TRUSTED_REMOTE_DOMAINS, ...(0, remoteTrust_js_1.trustedDomainsFromEnv)()],
+    });
+    if (verdict.level === 'refused') {
+        const message = verdict.reason ?? `Refusing to contact remote agent at ${base}`;
+        await emitter.error(message);
+        await emitter.done();
+        return { ok: false, error: message };
+    }
+    const authAllowed = options.authorizedForAuth === true || (0, remoteTrust_js_1.mayReceiveAccessToken)(verdict);
+    const auth = authAllowed ? options.auth : undefined;
     const url = `${base}/v1/chat/stream`;
     const body = { message: options.message };
     if (options.sessionId?.trim()) {
@@ -66,7 +113,7 @@ async function streamRemoteServeChat(options, emitter) {
             headers: {
                 'Content-Type': 'application/json',
                 Accept: 'text/event-stream',
-                ...buildServeAuthHeaders(options.auth),
+                ...buildServeAuthHeaders(auth),
             },
             body: JSON.stringify(body),
             signal: ac.signal,

package/out/runner/host.js

@@ -0,0 +1,141 @@
+"use strict";
+/*---------------------------------------------------------------------------------------------
+ *  Copyright (c) AgentHippo.ai. All rights reserved.
+ *--------------------------------------------------------------------------------------------*/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startRunnerHost = startRunnerHost;
+const protocol_1 = require("./protocol");
+/** Engines sweep idle sessions/caches on this cadence (matches the in-process host's timer). */
+const MAINTENANCE_INTERVAL_MS = 1000 * 60 * 5;
+/**
+ * The answer the runner gives to every `question`. Mirrors `cli/commands/serve.ts` and
+ * `headless/index.ts`: emit for visibility, decline so the run continues. There is no reverse
+ * RPC to wait on, so a question can never wedge a turn.
+ */
+const DECLINED = { selected: [], freeText: null, declined: true };
+function startRunnerHost(opts) {
+    const send = (frame) => { opts.output.write((0, protocol_1.encodeRunnerFrame)(frame)); };
+    const inflight = new Map();
+    let buffer = '';
+    let closed = false;
+    const maintenance = setInterval(() => {
+        try {
+            opts.engine.onMaintenance(opts.logger ?? consoleLogger());
+        }
+        catch (err) {
+            opts.logger?.warn(`[Runner] maintenance failed: ${errText(err)}`);
+        }
+    }, opts.maintenanceIntervalMs ?? MAINTENANCE_INTERVAL_MS);
+    // Never hold the sandbox open on the timer alone.
+    if (typeof maintenance.unref === 'function') {
+        maintenance.unref();
+    }
+    let finish = () => undefined;
+    const done = new Promise((resolve) => {
+        finish = () => {
+            if (closed) {
+                return;
+            }
+            closed = true;
+            clearInterval(maintenance);
+            for (const ctrl of inflight.values()) {
+                ctrl.abort();
+            }
+            inflight.clear();
+            resolve();
+        };
+        opts.input.on('data', (chunk) => {
+            buffer += typeof chunk === 'string' ? chunk : chunk.toString('utf8');
+            const { lines, rest } = (0, protocol_1.splitFrames)(buffer);
+            buffer = rest;
+            for (const line of lines) {
+                const frame = (0, protocol_1.parseClientFrame)(line);
+                if (!frame) {
+                    opts.logger?.warn('[Runner] dropped malformed client frame');
+                    continue;
+                }
+                void handle(frame);
+            }
+        });
+        opts.input.on('end', finish);
+        opts.input.on('close', finish);
+        opts.input.on('error', (err) => {
+            opts.logger?.warn(`[Runner] input error: ${errText(err)}`);
+            finish();
+        });
+    });
+    async function handle(frame) {
+        if (frame.type === 'abort') {
+            inflight.get(frame.id)?.abort();
+            return;
+        }
+        await run(frame.id, frame.message, frame.options);
+    }
+    async function run(id, message, options) {
+        if (inflight.has(id)) {
+            send({ type: 'failed', id, message: `duplicate run id ${id}` });
+            return;
+        }
+        const controller = new AbortController();
+        inflight.set(id, controller);
+        const emitter = makeEmitter(send, id);
+        try {
+            // `options` crossed the boundary already scrubbed of apiKey (see toWireOptions); the
+            // engine reaches models via baseUrl + modelToken, both sandbox-scoped.
+            await opts.engine.stream(message, options, emitter, opts.runtime, controller.signal);
+            const nativeSessionId = opts.nativeSessionId?.();
+            send({ type: 'result', id, ...(nativeSessionId ? { nativeSessionId } : {}) });
+        }
+        catch (err) {
+            // An aborted turn is a normal terminal, not a crash — report it as such so the caller
+            // settles instead of waiting out a timeout.
+            const message = controller.signal.aborted ? 'aborted' : errText(err);
+            send({ type: 'failed', id, message });
+        }
+        finally {
+            inflight.delete(id);
+        }
+    }
+    // The runner is live once the engine is constructed and the loop is wired. `demux: true` tells
+    // serve this host tags streamed events with their run id, so it may run several turns here at
+    // once; a serve talking to an older image never sees it and serializes instead.
+    send({ type: 'ready', demux: true });
+    return { done, close: () => finish() };
+}
+/**
+ * Bridges `StreamEmitter` calls onto the wire, 1:1 with the existing worker event union.
+ *
+ * Every event is tagged with the run it came from. One sandbox may host several of a user's
+ * sessions, and an untagged event can only be broadcast to every in-flight turn — which wrote one
+ * session's tokens and tool calls into another's transcript.
+ */
+function makeEmitter(send, id) {
+    const emit = (event) => send({ id, event });
+    return {
+        async thinking(delta) { emit({ type: 'thinking', delta }); },
+        async text(delta) { emit({ type: 'text', delta }); },
+        async toolStart(toolName, input, toolCallId) {
+            emit({ type: 'toolStart', toolName, ...(input !== undefined ? { input } : {}), ...(toolCallId ? { toolCallId } : {}) });
+        },
+        async toolEnd(toolName, toolCallId, result, isError) {
+            emit({ type: 'toolEnd', toolName, toolCallId, ...(result !== undefined ? { result } : {}), ...(isError !== undefined ? { isError } : {}) });
+        },
+        async progress(message) { emit({ type: 'progress', message }); },
+        async question(payload) {
+            // One-way: forwarded for visibility, answered here. No answer frame exists, but it
+            // still reaches a client stream, so it carries the run id like any other event.
+            send({ type: 'question', payload, id });
+            return DECLINED;
+        },
+        async error(message) { emit({ type: 'error', message }); },
+        async done() { emit({ type: 'done' }); },
+    };
+}
+function errText(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function consoleLogger() {
+    return {
+        info: () => undefined, warn: () => undefined, error: () => undefined, debug: () => undefined,
+    };
+}