@agentproto/worktree 0.12.0 → 0.14.0

package/README.md

@@ -8,9 +8,12 @@ and cleaning up a git worktree — the primitive a `@agentproto/workflow-runtime
 
 - **`worktree.provision`** — `git worktree add` a new worktree for `repoRoot`
   at `<repoRoot>/../_worktrees/<slug>` on branch `wt/<slug>`, cut from `base`
-  (default `origin/main`). Optionally runs `depsCmd` inside it, and copies
-  `copyGlobs` (e.g. gitignored local secrets) from `repoRoot` into it at the
-  same relative path. Then runs the base tree's `agentproto.json` **setup**
+  (default `origin/main`). Before `depsCmd` runs: `linkPaths` are symlinked in,
+  `writeFiles` are written, and `cloneGlobs` (e.g. `node_modules`) are cloned
+  in — copy-on-write where the filesystem supports it, else a plain copy,
+  never a symlink. Then `depsCmd` runs, then `copyGlobs` (e.g. gitignored
+  local secrets) are copied from `repoRoot` into the worktree at the same
+  relative path. Finally runs the base tree's `agentproto.json` **setup**
   hooks (unless `runSetup: false`). Returns `{ cwd, branch }`.
 - **`worktree.run-gate`** — run a caller-provided command inside a directory
   and report pass/fail from its exit code.
@@ -70,6 +73,61 @@ working tree. A feature branch or an agent editing files inside a worktree
 therefore **cannot inject** setup/teardown hooks or service commands that run
 on the host; only what a reviewer merged into the base branch executes.
 
+## `<repoRoot>/.agentproto/worktree.json` — local, per-machine worktree defaults
+
+`agentproto.json` is committed and shared by everyone who clones the repo, so
+it can't hold anything host-specific — a pnpm store path, whether to clone
+`node_modules` at all. `.agentproto/worktree.json` fills that gap: a LOCAL,
+gitignored, host-owned file (same idea as `.agentproto/allowed-commands.json`)
+that one machine can drop to declare its own worktree defaults, without
+committing them:
+
+```json
+{
+  "cloneGlobs": ["node_modules"],
+  "linkPaths": ["../sibling-repo"],
+  "copyGlobs": ["envs/**/.env.local"],
+  "writeFiles": [
+    { "path": "pnpm-workspace.yaml", "content": "\nvirtualStoreDir: /abs/path/.pnpm-vstores/{slug}\n", "mode": "append" }
+  ],
+  "depsCmd": "pnpm install --prefer-offline"
+}
+```
+
+- **`cloneGlobs`** — glob patterns (relative to `repoRoot`) of gitignored
+  dirs/files cloned into the worktree BEFORE `depsCmd` runs. Copy-on-write
+  where the filesystem supports it (macOS APFS `cp -c`/clonefile, Linux `cp
+  --reflink=auto`), falling back to a plain copy — never a symlink, so
+  `depsCmd` can mutate the clone (e.g. `pnpm install` repairing it) without
+  touching the source checkout. A directory match is cloned as a whole unit
+  (e.g. `node_modules` costs one `readdir`, not a walk of everything inside
+  it); `**` is not supported — name each path segment explicitly.
+- **`writeFiles`' `path`/`content`** may use a literal `{slug}` placeholder,
+  substituted with the worktree's own slug — e.g. pointing pnpm's
+  `virtualStoreDir` at a distinct, collision-free directory per worktree
+  (mirrors the real use case this shipped for: `agentik-studio`'s
+  `infra/cli/src/commands/wt.ts` `defaultWriteFiles`).
+- **`copyGlobs` / `linkPaths` / `depsCmd`** — same shape and semantics as the
+  matching `worktree.provision` inputs / `agentproto.json` fields above.
+
+**Precedence** (highest wins): an explicit `worktree.provision` tool input >
+this local file > `agentproto.json`'s committed `worktree.depsCmd`/
+`worktree.linkPaths` (`copyGlobs`/`cloneGlobs`/`writeFiles` have no committed
+equivalent, so for those the chain stops at this file). Same `runSetup` gate
+as the committed config.
+
+**Security model**: unlike `agentproto.json`, this file is read straight off
+disk (never `git show`) from `repoRoot` — the SOURCE checkout, never the
+freshly created worktree, which starts with no copy of it (the directory is
+gitignored repo-wide). There is nothing here for the committed-config
+guarantee to defend against: a branch can't smuggle this file in, because it
+can never be committed at all. The trust model is simply "whoever owns this
+machine's filesystem" — same as `allowed-commands.json`.
+
+Path-traversal guard: a `cloneGlobs` pattern that could resolve outside
+`repoRoot` (a leading `/`, or any `..` segment) is rejected before any
+filesystem access.
+
 ### Environment
 
 Every hook, script, and service receives:
@@ -109,6 +167,41 @@ agentproto worktree archive <path> [--base <ref>] [--keep-branch] [--json]
 runs its teardown hooks, and removes it (deleting the branch unless
 `--keep-branch`).
 
+## Provisioning concurrency (daemon-wide queue)
+
+`worktree.provision` runs its heavy phases (`cloneGlobs`, `depsCmd`,
+`copyGlobs`, `setup` hooks) through `provisionScheduler`, a process-wide FIFO
+queue with a cap (default 2; `0` = unlimited). One slot covers the whole heavy
+segment of one provisioning, so a single spawn never interleaves with itself.
+`git worktree add` and the cheap prep (`linkPaths`, `writeFiles`) run before
+the queue and are never throttled.
+
+```ts
+import { provisionScheduler, parseProvisionLimits, runWithProvisionContext } from "@agentproto/worktree"
+
+provisionScheduler.configure(parseProvisionLimits(config.worktrees))
+
+await runWithProvisionContext(
+  { callerKey: parentSessionId, signal, onProgress: p => log(p) },
+  () => runTool({ tool: provisionWorktreeTool, candidates, input }),
+)
+```
+
+- **Fairness.** FIFO, with the caller holding the fewest running slots going
+  first, so one orchestrator's burst cannot starve another caller.
+- **Cancellation.** Aborting `signal` drops a queued entry, or kills a running
+  phase's whole process group (SIGTERM, then SIGKILL after 5s), and rejects
+  with `ProvisionCancelledError`. A cancelled provisioning removes its
+  half-made worktree and branch; a plain failure keeps the worktree.
+- **Progress.** `onProgress` receives `queued` (with `position`), `started`,
+  `phase` and `done` (`ok`, `failed` or `cancelled`).
+- **Config.** `worktrees.provisionConcurrency`,
+  `worktrees.provisionConcurrencyByRepo`, `worktrees.provisionLoadFactor` in
+  `~/.agentproto/config.json`; env `AGENTPROTO_WORKTREES_PROVISION_CONCURRENCY`
+  wins. See the CLI docs for the full table.
+- **Scope.** The queue is per process. The daemon owns the shared one;
+  `agentproto worktree new` has its own instance.
+
 ## `worktreeAgentWorkflow`
 
 This package also exports the `RuntimeWorkflow` def that chains the three

package/dist/bin/worktree-agent.mjs

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
-import { connectDaemonAgentSessionHost, worktreeAgentWorkflow } from '../chunk-5SDH2V6M.mjs';
+import { connectDaemonAgentSessionHost, worktreeAgentWorkflow } from '../chunk-FC3I5NTS.mjs';
 import '../chunk-E3EM24BS.mjs';
-import '../chunk-EVHLUKC7.mjs';
-import '../chunk-EK5BH2YL.mjs';
+import '../chunk-IEW2O3PF.mjs';
+import '../chunk-3FZWPMLF.mjs';
 import { runWorkflow } from '@agentproto/workflow-runtime';
 import { resolve } from 'path';
 import { openSync, closeSync, createReadStream, createWriteStream } from 'fs';

package/dist/{chunk-EK5BH2YL.mjs → chunk-3FZWPMLF.mjs}

@@ -8,8 +8,8 @@ import { defineTool } from '@agentproto/tool';
 
 var provisionWorktreeTool = defineTool({
   id: "worktree.provision",
-  description: "Create a git worktree for `repoRoot` at a sibling '_worktrees/<slug>' directory (or `dir`, when given), on a new branch 'wt/<slug>' (or `branch`, when given) cut from `base`. If `depsCmd` is given, it runs inside the new worktree afterwards (e.g. install deps). If `copyGlobs` is given, matching files under `repoRoot` (including gitignored ones, e.g. local secrets) are copied into the worktree at the same relative path. If `linkPaths` is given, each is symlinked from `repoRoot` into the worktree before `depsCmd` runs \u2014 for gitignored, expensive-to-recreate trees a fresh worktree lacks (node_modules, sibling workspace repos) so the workspace graph resolves without a full reinstall. When `depsCmd`/`linkPaths` are omitted, they fall back to `worktree.depsCmd`/`worktree.linkPaths` declared in the base tree's agentproto.json (same `runSetup` gate as the setup hooks below) \u2014 an explicit input always wins over the declarative default. If `writeFiles` is given, each entry's `content` is written into the worktree at `path` before `depsCmd` runs \u2014 for generated, worktree-specific config a tool invoked by `depsCmd` needs to see (e.g. a package-manager config pointing a cache/store dir outside the worktree, so it isn't shared with \u2014 or clobbered by \u2014 a sibling worktree). `mode: \"create\"` (default) skips an entry whose path already exists, matching `linkPaths`' never-clobber rule; `mode: \"append\"` always appends (creating the file if missing) and, if git already tracks that path, marks it `skip-worktree` afterwards so the tweak never shows up as a local modification the caller could accidentally commit \u2014 callers are responsible for making the content itself idempotent (e.g. checking `repoRoot`'s copy of the file for the line before including the entry, since a fresh worktree's tracked files start as a byte-identical checkout). Also writes a creation-provenance marker into the worktree's private gitdir.",
-  version: "0.2.0",
+  description: "Create a git worktree for `repoRoot` at a sibling '_worktrees/<slug>' directory (or `dir`, when given), on a new branch 'wt/<slug>' (or `branch`, when given) cut from `base`. `depsCmd` runs inside the new worktree afterwards (e.g. install deps). `copyGlobs` copies matching files (incl. gitignored, e.g. secrets) from `repoRoot` into the worktree. `cloneGlobs` clones matching dirs/files (e.g. `node_modules`) from `repoRoot` before `depsCmd`, copy-on-write where supported, else a plain copy \u2014 never a symlink. `linkPaths` symlinks gitignored, expensive-to-recreate paths from `repoRoot` before `depsCmd`. `writeFiles` writes/appends generated, worktree-specific config before `depsCmd`; see each field's own description for its `mode` and clobber rules. Each of `depsCmd`/`linkPaths`/`copyGlobs`/`cloneGlobs`/`writeFiles`, when omitted, falls back first to the same-named field in `<repoRoot>/.agentproto/worktree.json` (local, host-owned, gitignored \u2014 read off disk, never a branch), then \u2014 `depsCmd`/`linkPaths` only \u2014 to `worktree.depsCmd`/`worktree.linkPaths` in the base tree's COMMITTED agentproto.json (same `runSetup` gate as the setup hooks below). An explicit input wins over both defaults; the local file wins over the committed one. Local `writeFiles` entries may use a `{slug}` placeholder in `path`/`content`, substituted per call. Also writes a creation-provenance marker into the worktree's private gitdir.",
+  version: "0.3.0",
   inputSchema: z.object({
     repoRoot: z.string().describe("Absolute path to the git repository root."),
     base: z.string().optional().describe("Ref the new branch is cut from. Default 'origin/main'."),
@@ -18,6 +18,9 @@ var provisionWorktreeTool = defineTool({
     dir: z.string().optional().describe("Absolute path for the new worktree. Default '<repoRoot>/../_worktrees/<slug>'."),
     depsCmd: z.string().optional().describe("Shell command run inside the worktree after creation, e.g. 'pnpm install --prefer-offline'."),
     copyGlobs: z.array(z.string()).optional().describe("Glob patterns (relative to repoRoot) of gitignored files to copy into the worktree, e.g. 'envs/**/.env.local'."),
+    cloneGlobs: z.array(z.string()).optional().describe(
+      "Glob patterns (relative to repoRoot) of gitignored dirs/files to clone into the worktree before depsCmd, e.g. 'node_modules'. Copy-on-write where the filesystem supports it, falling back to a plain copy \u2014 never a symlink. Each pattern segment may use '*'/'?'; '**' is not supported (a clone target is a single named entry per level, matched and copied as a whole rather than enumerated file-by-file)."
+    ),
     linkPaths: z.array(z.string()).optional().describe("Relative paths (dirs or files) symlinked from repoRoot into the worktree before depsCmd, e.g. 'node_modules' or a gitignored sibling workspace repo. Lets the workspace graph resolve without a full reinstall."),
     writeFiles: z.array(
       z.object({
@@ -26,7 +29,7 @@ var provisionWorktreeTool = defineTool({
         mode: z.enum(["create", "append"]).optional().describe("'create' (default): write only if path doesn't already exist. 'append': always append (creating if missing); if git tracks the path, it's marked skip-worktree afterwards so the change never shows as a local modification.")
       })
     ).optional().describe("Files written into the worktree before depsCmd runs, e.g. a package-manager config generated for this specific worktree."),
-    runSetup: z.boolean().optional().describe("Read the base tree's agentproto.json and apply its declarative worktree lifecycle: `worktree.depsCmd`/`worktree.linkPaths` as fallbacks for the inputs above, then the `worktree.setup` hooks after creation. Default true; a failing setup hook fails provisioning."),
+    runSetup: z.boolean().optional().describe("Apply the declarative worktree lifecycle: `<repoRoot>/.agentproto/worktree.json` (local) and the base tree's agentproto.json (committed) as fallbacks for the inputs above, then the committed config's `worktree.setup` hooks after creation. Default true; a failing setup hook fails provisioning."),
     setupLogPath: z.string().optional().describe("Absolute path to append the FULL, unfiltered stdout+stderr of every `worktree.setup` hook command to (success or failure). Caller-provided \u2014 typically a path under the spawning session's own directory, so the full output outlives a subsequently-reclaimed worktree. Best-effort: a write failure never fails provisioning. When omitted, only a short, noise-filtered tail survives in a failing hook's own error message."),
     retrySetupOnFailure: z.boolean().optional().describe("Re-run a failing `worktree.setup` command exactly once before giving up \u2014 a complement to (never a substitute for) a real root-cause fix, meant for unattended callers with no way to retry themselves short of provisioning an entirely new worktree. Default false: an interactive caller (e.g. `agentproto worktree new`) sees a genuine failure on the first try rather than waiting through an identical rerun.")
   }),
@@ -160,5 +163,5 @@ var listServicesTool = defineTool({
 });
 
 export { cleanupWorktreeTool, listServicesTool, provisionWorktreeTool, runGateTool, runScriptTool, serviceStatusSchema, startServiceTool, stopServiceTool };
-//# sourceMappingURL=chunk-EK5BH2YL.mjs.map
-//# sourceMappingURL=chunk-EK5BH2YL.mjs.map
+//# sourceMappingURL=chunk-3FZWPMLF.mjs.map
+//# sourceMappingURL=chunk-3FZWPMLF.mjs.map

package/dist/chunk-3FZWPMLF.mjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/tools/provision-worktree.tool.ts","../src/tools/cleanup-worktree.tool.ts","../src/tools/run-gate.tool.ts","../src/tools/run-script.tool.ts","../src/tools/service.schema.ts","../src/tools/start-service.tool.ts","../src/tools/stop-service.tool.ts","../src/tools/list-services.tool.ts"],"names":["defineTool","z"],"mappings":";;;;;;;;AAQO,IAAM,wBAAwB,UAAA,CAAW;AAAA,EAC9C,EAAA,EAAI,oBAAA;AAAA,EACJ,WAAA,EACE,s6CAAA;AAAA,EAsBF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,EAAE,MAAA,CAAO;AAAA,IACpB,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2CAA2C,CAAA;AAAA,IACzE,MAAM,CAAA,CACH,MAAA,GACA,QAAA,EAAS,CACT,SAAS,wDAAwD,CAAA;AAAA,IACpE,IAAA,EAAM,EACH,MAAA,EAAO,CACP,MAAM,sBAAA,EAAwB,mCAAmC,CAAA,CACjE,QAAA,CAAS,2EAAsE,CAAA;AAAA,IAClF,QAAQ,CAAA,CACL,MAAA,GACA,QAAA,EAAS,CACT,SAAS,wDAAwD,CAAA;AAAA,IACpE,KAAK,CAAA,CACF,MAAA,GACA,QAAA,EAAS,CACT,SAAS,gFAAgF,CAAA;AAAA,IAC5F,SAAS,CAAA,CACN,MAAA,GACA,QAAA,EAAS,CACT,SAAS,6FAA6F,CAAA;AAAA,IACzG,SAAA,EAAW,CAAA,CACR,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,gHAAgH,CAAA;AAAA,IAC5H,UAAA,EAAY,EACT,KAAA,CAAM,CAAA,CAAE,QAAQ,CAAA,CAChB,UAAS,CACT,QAAA;AAAA,MACC;AAAA,KACF;AAAA,IACF,SAAA,EAAW,CAAA,CACR,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,iNAAiN,CAAA;AAAA,IAC7N,YAAY,CAAA,CACT,KAAA;AAAA,MACC,EAAE,MAAA,CAAO;AAAA,QACP,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC,CAAA;AAAA,QAC/D,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6CAA6C,CAAA;AAAA,QAC1E,IAAA,EAAM,CAAA,CACH,IAAA,CAAK,CAAC,QAAA,EAAU,QAAQ,CAAC,CAAA,CACzB,QAAA,EAAS,CACT,QAAA,CAAS,8NAA8N;AAAA,OAC3O;AAAA,KACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,0HAA0H,CAAA;AAAA,IACtI,UAAU,CAAA,CACP,OAAA,GACA,QAAA,EAAS,CACT,SAAS,uSAAuS,CAAA;AAAA,IACnT,cAAc,CAAA,CACX,MAAA,GACA,QAAA,EAAS,CACT,SAAS,saAAia,CAAA;AAAA,IAC7a,qBAAqB,CAAA,CAClB,OAAA,GACA,QAAA,EAAS,CACT,SAAS,2ZAAsZ;AAAA,GACna,CAAA;AAAA,EACD,YAAA,EAAc,EAAE,MAAA,CAAO;AAAA,IACrB,GAAA,EAAK,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wCAAwC,CAAA;AAAA,IACjE,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC;AAAA,GACtE,CAAA;AAAA,EACD,OAAA,EAAS,CAAC,UAAU,CAAA;AAAA,EACpB,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;ACvFM,IAAM,sBAAsBA,UAAAA,CAAW;AAAA,EAC5C,EAAA,EAAI,kBAAA;AAAA,EACJ,WAAA,EACE,+bAAA;AAAA,EAOF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2CAA2C,CAAA;AAAA,IACzE,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,0CAA0C,CAAA;AAAA,IACnE,QAAQA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,0CAA0C,CAAA;AAAA,IACjF,cAAcA,CAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,yDAAyD,CAAA;AAAA,IACvG,MAAMA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qFAAqF,CAAA;AAAA,IAC1H,aAAaA,CAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,+GAA+G,CAAA;AAAA,IAC5J,kBAAkBA,CAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,2FAA2F,CAAA;AAAA,IAC7I,iBAAiBA,CAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,6GAA6G;AAAA,GAC/J,CAAA;AAAA,EACD,YAAA,EAAcA,EAAE,MAAA,CAAO;AAAA,IACrB,OAAA,EAASA,CAAAA,CAAE,OAAA,CAAQ,IAAI;AAAA,GACxB,CAAA;AAAA,EACD,OAAA,EAAS,CAAC,UAAU,CAAA;AAAA,EACpB,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;AClCM,IAAM,cAAcD,UAAAA,CAAW;AAAA,EACpC,EAAA,EAAI,mBAAA;AAAA,EACJ,WAAA,EACE,gIAAA;AAAA,EAEF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,IAC3D,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,yCAAyC;AAAA,GACnE,CAAA;AAAA,EACD,YAAA,EAAcA,EAAE,MAAA,CAAO;AAAA,IACrB,MAAA,EAAQA,EAAE,OAAA,EAAQ;AAAA,IAClB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,IACzB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,IACjB,MAAA,EAAQA,EAAE,MAAA;AAAO,GAClB,CAAA;AAAA,EACD,SAAS,EAAC;AAAA,EACV,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;ACnBM,IAAM,gBAAgBD,UAAAA,CAAW;AAAA,EACtC,EAAA,EAAI,qBAAA;AAAA,EACJ,WAAA,EACE,sPAAA;AAAA,EAIF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kDAAkD,CAAA;AAAA,IAChF,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,0CAA0C,CAAA;AAAA,IAC5E,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,0DAA0D,CAAA;AAAA,IACtF,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,4CAA4C,CAAA;AAAA,IACxE,MAAMA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qEAAqE;AAAA,GAC3G,CAAA;AAAA,EACD,YAAA,EAAcA,EAAE,MAAA,CAAO;AAAA,IACrB,MAAA,EAAQA,EAAE,OAAA,EAAQ;AAAA,IAClB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,IACzB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,IACjB,MAAA,EAAQA,EAAE,MAAA;AAAO,GAClB,CAAA;AAAA,EACD,OAAA,EAAS,CAAC,UAAU,CAAA;AAAA,EACpB,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;AC9BM,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EAC1C,IAAA,EAAMA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,EACrD,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gEAAgE,CAAA;AAAA,EAC9F,MAAMA,CAAAA,CAAE,MAAA,GAAS,GAAA,EAAI,CAAE,SAAS,kCAAkC,CAAA;AAAA,EAClE,GAAA,EAAKA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kCAAkC,CAAA;AAAA,EAC3D,GAAA,EAAKA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,4CAA4C,CAAA;AAAA,EACtF,MAAA,EAAQA,EAAE,IAAA,CAAK,CAAC,WAAW,QAAQ,CAAC,CAAA,CAAE,QAAA,CAAS,oCAAoC,CAAA;AAAA,EACnF,QAAA,EAAUA,EAAE,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,0CAA0C,CAAA;AAAA,EACzF,WAAWA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,6CAA6C;AACzF,CAAC;ACFM,IAAM,mBAAmBD,UAAAA,CAAW;AAAA,EACzC,EAAA,EAAI,wBAAA;AAAA,EACJ,WAAA,EACE,0RAAA;AAAA,EAIF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kDAAkD,CAAA;AAAA,IAChF,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC,CAAA;AAAA,IAClE,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,IACzD,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gDAAkD,CAAA;AAAA,IAC9E,MAAMA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qEAAqE,CAAA;AAAA,IAC1G,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,QAAA,EAAS,CAAE,SAAS,mDAAmD;AAAA,GACtH,CAAA;AAAA,EACD,YAAA,EAAc,mBAAA;AAAA,EACd,OAAA,EAAS,CAAC,eAAe,CAAA;AAAA,EACzB,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;AC1BM,IAAM,kBAAkBD,UAAAA,CAAW;AAAA,EACxC,EAAA,EAAI,uBAAA;AAAA,EACJ,WAAA,EACE,6IAAA;AAAA,EAEF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC,CAAA;AAAA,IAClE,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,8BAA8B;AAAA,GAC3D,CAAA;AAAA,EACD,YAAA,EAAcA,EAAE,MAAA,CAAO;AAAA,IACrB,OAAA,EAASA,CAAAA,CAAE,OAAA,EAAQ,CAAE,SAAS,iDAAiD;AAAA,GAChF,CAAA;AAAA,EACD,OAAA,EAAS,CAAC,eAAe,CAAA;AAAA,EACzB,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC;ACVM,IAAM,mBAAmBD,UAAAA,CAAW;AAAA,EACzC,EAAA,EAAI,wBAAA;AAAA,EACJ,WAAA,EACE,oIAAA;AAAA,EAEF,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAaC,EAAE,MAAA,CAAO;AAAA,IACpB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kDAAkD,CAAA;AAAA,IAChF,YAAA,EAAcA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,gCAAgC,CAAA;AAAA,IAClE,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,IACzD,MAAMA,CAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qEAAqE,CAAA;AAAA,IAC1G,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,IAAI,KAAK,CAAA,CAAE,QAAA,EAAS,CAAE,SAAS,gDAAgD;AAAA,GACnH,CAAA;AAAA,EACD,YAAA,EAAcA,EAAE,MAAA,CAAO;AAAA,IACrB,QAAA,EAAUA,CAAAA,CAAE,KAAA,CAAM,mBAAmB;AAAA,GACtC,CAAA;AAAA,EACD,SAAS,EAAC;AAAA,EACV,QAAA,EAAU,MAAA;AAAA,EACV,SAAA,EAAW;AACb,CAAC","file":"chunk-3FZWPMLF.mjs","sourcesContent":["import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\n\n/**\n * AIP-14 contract: create a git worktree off a base ref, on its own branch,\n * optionally installing deps and copying gitignored files (secrets) into it.\n * Agnostic — no hardcoded package manager or env layout; both are inputs.\n */\nexport const provisionWorktreeTool = defineTool({\n  id: \"worktree.provision\",\n  description:\n    \"Create a git worktree for `repoRoot` at a sibling '_worktrees/<slug>' \" +\n    \"directory (or `dir`, when given), on a new branch 'wt/<slug>' (or \" +\n    \"`branch`, when given) cut from `base`. `depsCmd` runs inside the new \" +\n    \"worktree afterwards (e.g. install deps). `copyGlobs` copies matching \" +\n    \"files (incl. gitignored, e.g. secrets) from `repoRoot` into the \" +\n    \"worktree. `cloneGlobs` clones matching dirs/files (e.g. \" +\n    \"`node_modules`) from `repoRoot` before `depsCmd`, copy-on-write where \" +\n    \"supported, else a plain copy — never a symlink. `linkPaths` symlinks \" +\n    \"gitignored, expensive-to-recreate paths from `repoRoot` before \" +\n    \"`depsCmd`. `writeFiles` writes/appends generated, worktree-specific \" +\n    \"config before `depsCmd`; see each field's own description for its \" +\n    \"`mode` and clobber rules. Each of `depsCmd`/`linkPaths`/`copyGlobs`/\" +\n    \"`cloneGlobs`/`writeFiles`, when omitted, falls back first to the \" +\n    \"same-named field in `<repoRoot>/.agentproto/worktree.json` (local, \" +\n    \"host-owned, gitignored — read off disk, never a branch), then — \" +\n    \"`depsCmd`/`linkPaths` only — to `worktree.depsCmd`/`worktree.linkPaths` \" +\n    \"in the base tree's COMMITTED agentproto.json (same `runSetup` gate as \" +\n    \"the setup hooks below). An explicit input wins over both defaults; the \" +\n    \"local file wins over the committed one. Local `writeFiles` entries may \" +\n    \"use a `{slug}` placeholder in `path`/`content`, substituted per call. \" +\n    \"Also writes a creation-provenance marker into the worktree's private \" +\n    \"gitdir.\",\n  version: \"0.3.0\",\n  inputSchema: z.object({\n    repoRoot: z.string().describe(\"Absolute path to the git repository root.\"),\n    base: z\n      .string()\n      .optional()\n      .describe(\"Ref the new branch is cut from. Default 'origin/main'.\"),\n    slug: z\n      .string()\n      .regex(/^[a-z0-9][a-z0-9-]*$/, \"slug must be lowercase kebab-case\")\n      .describe(\"Short identifier — names both the worktree directory and its branch.\"),\n    branch: z\n      .string()\n      .optional()\n      .describe(\"Branch name for the new worktree. Default 'wt/<slug>'.\"),\n    dir: z\n      .string()\n      .optional()\n      .describe(\"Absolute path for the new worktree. Default '<repoRoot>/../_worktrees/<slug>'.\"),\n    depsCmd: z\n      .string()\n      .optional()\n      .describe(\"Shell command run inside the worktree after creation, e.g. 'pnpm install --prefer-offline'.\"),\n    copyGlobs: z\n      .array(z.string())\n      .optional()\n      .describe(\"Glob patterns (relative to repoRoot) of gitignored files to copy into the worktree, e.g. 'envs/**/.env.local'.\"),\n    cloneGlobs: z\n      .array(z.string())\n      .optional()\n      .describe(\n        \"Glob patterns (relative to repoRoot) of gitignored dirs/files to clone into the worktree before depsCmd, e.g. 'node_modules'. Copy-on-write where the filesystem supports it, falling back to a plain copy — never a symlink. Each pattern segment may use '*'/'?'; '**' is not supported (a clone target is a single named entry per level, matched and copied as a whole rather than enumerated file-by-file).\",\n      ),\n    linkPaths: z\n      .array(z.string())\n      .optional()\n      .describe(\"Relative paths (dirs or files) symlinked from repoRoot into the worktree before depsCmd, e.g. 'node_modules' or a gitignored sibling workspace repo. Lets the workspace graph resolve without a full reinstall.\"),\n    writeFiles: z\n      .array(\n        z.object({\n          path: z.string().describe(\"Path relative to the worktree root.\"),\n          content: z.string().describe(\"File content, written or appended verbatim.\"),\n          mode: z\n            .enum([\"create\", \"append\"])\n            .optional()\n            .describe(\"'create' (default): write only if path doesn't already exist. 'append': always append (creating if missing); if git tracks the path, it's marked skip-worktree afterwards so the change never shows as a local modification.\"),\n        }),\n      )\n      .optional()\n      .describe(\"Files written into the worktree before depsCmd runs, e.g. a package-manager config generated for this specific worktree.\"),\n    runSetup: z\n      .boolean()\n      .optional()\n      .describe(\"Apply the declarative worktree lifecycle: `<repoRoot>/.agentproto/worktree.json` (local) and the base tree's agentproto.json (committed) as fallbacks for the inputs above, then the committed config's `worktree.setup` hooks after creation. Default true; a failing setup hook fails provisioning.\"),\n    setupLogPath: z\n      .string()\n      .optional()\n      .describe(\"Absolute path to append the FULL, unfiltered stdout+stderr of every `worktree.setup` hook command to (success or failure). Caller-provided — typically a path under the spawning session's own directory, so the full output outlives a subsequently-reclaimed worktree. Best-effort: a write failure never fails provisioning. When omitted, only a short, noise-filtered tail survives in a failing hook's own error message.\"),\n    retrySetupOnFailure: z\n      .boolean()\n      .optional()\n      .describe(\"Re-run a failing `worktree.setup` command exactly once before giving up — a complement to (never a substitute for) a real root-cause fix, meant for unattended callers with no way to retry themselves short of provisioning an entirely new worktree. Default false: an interactive caller (e.g. `agentproto worktree new`) sees a genuine failure on the first try rather than waiting through an identical rerun.\"),\n  }),\n  outputSchema: z.object({\n    cwd: z.string().describe(\"Absolute path to the created worktree.\"),\n    branch: z.string().describe(\"The branch the worktree was created on.\"),\n  }),\n  mutates: [\"fs:write\"],\n  approval: \"auto\",\n  riskLevel: 1,\n})\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\n\n/**\n * AIP-14 contract: remove a git worktree, optionally deleting its branch.\n *\n * Guarded by default (PLAN.md §5.2 layer 3): with neither discard flag set,\n * this runs a plain `git worktree remove` — git itself is the final arbiter\n * and refuses on modified or unignored-untracked files, tolerating gitignored\n * trees like `node_modules/`. `discardUntracked` / `discardModified` each\n * authorize exactly one class of destruction git otherwise refuses; only\n * when the flags cover everything actually dirty does `--force` get passed\n * through. This replaces an unconditional `--force` that used to destroy\n * real edits indiscriminately (the incident this contract change exists to\n * prevent) — hence `riskLevel: 2`, up from the old unconditional-force `1`.\n */\nexport const cleanupWorktreeTool = defineTool({\n  id: \"worktree.cleanup\",\n  description:\n    \"Remove a git worktree created by 'worktree.provision'. Refuses if the \" +\n    \"worktree has modified tracked files or unignored untracked files, \" +\n    \"unless the matching `discardModified` / `discardUntracked` flag is \" +\n    \"set — a clean or gitignore-only tree (e.g. installed deps) always \" +\n    \"removes with no flags. If `deleteBranch` is true and `branch` is \" +\n    \"given, also force-delete that branch (only ever called for merged \" +\n    \"branches by this package's own callers).\",\n  version: \"0.2.0\",\n  inputSchema: z.object({\n    repoRoot: z.string().describe(\"Absolute path to the git repository root.\"),\n    cwd: z.string().describe(\"Absolute path to the worktree to remove.\"),\n    branch: z.string().optional().describe(\"The worktree's branch, for deleteBranch.\"),\n    deleteBranch: z.boolean().optional().describe(\"Also force-delete `branch` after removing the worktree.\"),\n    base: z.string().optional().describe(\"Ref whose committed agentproto.json supplies teardown hooks. Default 'origin/main'.\"),\n    runTeardown: z.boolean().optional().describe(\"Run the `worktree.teardown` hooks before removal. Default true; teardown failures are logged, never blocking.\"),\n    discardUntracked: z.boolean().optional().describe(\"Authorize discarding unignored untracked files. Default false: refuse if any are present.\"),\n    discardModified: z.boolean().optional().describe(\"Authorize discarding modified tracked files (staged or unstaged). Default false: refuse if any are present.\"),\n  }),\n  outputSchema: z.object({\n    removed: z.literal(true),\n  }),\n  mutates: [\"fs:write\"],\n  approval: \"auto\",\n  riskLevel: 2,\n})\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\n\n/**\n * AIP-14 contract: run a caller-provided gate/check command inside a\n * directory (typically a provisioned worktree) and report pass/fail.\n * `cmd` is a trusted, developer-authored config value (same trust model as\n * a CI job's `script:` line), run through a shell so it may include flags.\n */\nexport const runGateTool = defineTool({\n  id: \"worktree.run-gate\",\n  description:\n    \"Run a gate command (e.g. 'pnpm test') inside `cwd` and report pass/fail \" +\n    \"from its exit code, along with captured stdout/stderr.\",\n  version: \"0.1.0\",\n  inputSchema: z.object({\n    cwd: z.string().describe(\"Directory to run the command in.\"),\n    cmd: z.string().describe(\"Shell command to run, e.g. 'pnpm test'.\"),\n  }),\n  outputSchema: z.object({\n    passed: z.boolean(),\n    exitCode: z.number().int(),\n    stdout: z.string(),\n    stderr: z.string(),\n  }),\n  mutates: [],\n  approval: \"auto\",\n  riskLevel: 1,\n})\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\n\n/**\n * AIP-14 contract: run a one-shot named `scripts.<name>` command from the\n * repo's committed `agentproto.json` inside a worktree, with the\n * `AGENTPROTO_*` context env injected. For long-running services use\n * `worktree.start-service` instead.\n */\nexport const runScriptTool = defineTool({\n  id: \"worktree.run-script\",\n  description:\n    \"Run a declared `scripts.<name>` command (from the base tree's \" +\n    \"agentproto.json) inside `worktreePath`, injecting AGENTPROTO_* env, and \" +\n    \"report pass/fail with captured stdout/stderr. For a `type: \\\"service\\\"` \" +\n    \"script prefer `worktree.start-service`.\",\n  version: \"0.1.0\",\n  inputSchema: z.object({\n    repoRoot: z.string().describe(\"Absolute path to the source git repository root.\"),\n    worktreePath: z.string().describe(\"Absolute path to the worktree to run in.\"),\n    branch: z.string().describe(\"The worktree's branch name (for AGENTPROTO_BRANCH_NAME).\"),\n    script: z.string().describe(\"Name of the script under `scripts` to run.\"),\n    base: z.string().optional().describe(\"Ref whose committed agentproto.json is read. Default 'origin/main'.\"),\n  }),\n  outputSchema: z.object({\n    passed: z.boolean(),\n    exitCode: z.number().int(),\n    stdout: z.string(),\n    stderr: z.string(),\n  }),\n  mutates: [\"fs:write\"],\n  approval: \"auto\",\n  riskLevel: 1,\n})\n","import { z } from \"zod\"\n\n/** Shared shape of a supervised service's status across the service tools. */\nexport const serviceStatusSchema = z.object({\n  name: z.string().describe(\"The declared script name.\"),\n  hostname: z.string().describe(\"The *.localhost host the reverse proxy routes to this service.\"),\n  port: z.number().int().describe(\"The port the service listens on.\"),\n  url: z.string().describe(\"The service's reverse-proxy URL.\"),\n  pid: z.number().int().nullable().describe(\"Child process id while running, else null.\"),\n  status: z.enum([\"running\", \"exited\"]).describe(\"Whether the service process is up.\"),\n  exitCode: z.number().int().nullable().describe(\"Exit code once it has exited, else null.\"),\n  startedAt: z.string().nullable().describe(\"ISO timestamp of the last start, else null.\"),\n})\n\nexport type ServiceStatusOutput = z.infer<typeof serviceStatusSchema>\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\nimport { serviceStatusSchema } from \"./service.schema.js\"\n\n/**\n * AIP-14 contract: start a declared `type: \"service\"` script for a worktree.\n * Allocates the service's port (declared port if free, else ephemeral),\n * injects AGENTPROTO_PORT/URL + peer env, and registers its hostname with the\n * reverse proxy. Idempotent per worktree+name.\n */\nexport const startServiceTool = defineTool({\n  id: \"worktree.start-service\",\n  description:\n    \"Start a declared `scripts.<name>` service for a worktree as a supervised \" +\n    \"long-running child process. Allocates a port, injects AGENTPROTO_PORT / \" +\n    \"AGENTPROTO_URL and AGENTPROTO_SERVICE_<PEER>_PORT|URL for siblings, and \" +\n    \"registers a `<script>--<branch>--<repo>.localhost` proxy route.\",\n  version: \"0.1.0\",\n  inputSchema: z.object({\n    repoRoot: z.string().describe(\"Absolute path to the source git repository root.\"),\n    worktreePath: z.string().describe(\"Absolute path to the worktree.\"),\n    branch: z.string().describe(\"The worktree's branch name.\"),\n    script: z.string().describe(\"Name of the `type: \\\"service\\\"` script to start.\"),\n    base: z.string().optional().describe(\"Ref whose committed agentproto.json is read. Default 'origin/main'.\"),\n    proxyPort: z.number().int().min(1).max(65535).optional().describe(\"Reverse-proxy port used to build the service URL.\"),\n  }),\n  outputSchema: serviceStatusSchema,\n  mutates: [\"process:spawn\"],\n  approval: \"auto\",\n  riskLevel: 1,\n})\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\n\n/** AIP-14 contract: stop a running supervised service for a worktree. */\nexport const stopServiceTool = defineTool({\n  id: \"worktree.stop-service\",\n  description:\n    \"Stop a supervised service (SIGTERM) for a worktree and drop its reverse-\" +\n    \"proxy route. A no-op (stopped: false) if the service isn't running.\",\n  version: \"0.1.0\",\n  inputSchema: z.object({\n    worktreePath: z.string().describe(\"Absolute path to the worktree.\"),\n    script: z.string().describe(\"Name of the service to stop.\"),\n  }),\n  outputSchema: z.object({\n    stopped: z.boolean().describe(\"Whether a running service was actually stopped.\"),\n  }),\n  mutates: [\"process:spawn\"],\n  approval: \"auto\",\n  riskLevel: 1,\n})\n","import { z } from \"zod\"\nimport { defineTool } from \"@agentproto/tool\"\nimport { serviceStatusSchema } from \"./service.schema.js\"\n\n/**\n * AIP-14 contract: list every declared service for a worktree with its\n * resolved port / proxy URL and current run status. Resolves (allocating\n * ports for) the worktree's services on first call so declared-but-unstarted\n * services still appear.\n */\nexport const listServicesTool = defineTool({\n  id: \"worktree.list-services\",\n  description:\n    \"List the declared services for a worktree — each with its allocated \" +\n    \"port, `*.localhost` proxy URL, and running/exited status.\",\n  version: \"0.1.0\",\n  inputSchema: z.object({\n    repoRoot: z.string().describe(\"Absolute path to the source git repository root.\"),\n    worktreePath: z.string().describe(\"Absolute path to the worktree.\"),\n    branch: z.string().describe(\"The worktree's branch name.\"),\n    base: z.string().optional().describe(\"Ref whose committed agentproto.json is read. Default 'origin/main'.\"),\n    proxyPort: z.number().int().min(1).max(65535).optional().describe(\"Reverse-proxy port used to build service URLs.\"),\n  }),\n  outputSchema: z.object({\n    services: z.array(serviceStatusSchema),\n  }),\n  mutates: [],\n  approval: \"auto\",\n  riskLevel: 0,\n})\n"]}

package/dist/{chunk-5SDH2V6M.mjs → chunk-FC3I5NTS.mjs}

@@ -1,5 +1,5 @@
-import { worktreeProvider } from './chunk-EVHLUKC7.mjs';
-import { provisionWorktreeTool, runGateTool, cleanupWorktreeTool } from './chunk-EK5BH2YL.mjs';
+import { worktreeProvider } from './chunk-IEW2O3PF.mjs';
+import { provisionWorktreeTool, runGateTool, cleanupWorktreeTool } from './chunk-3FZWPMLF.mjs';
 import { z } from 'zod';
 import { resolveMcpUrl, HarnessClient } from '@agentproto/harness';
 
@@ -196,5 +196,5 @@ async function waitForSettled(client, sessionId, since) {
 }
 
 export { connectDaemonAgentSessionHost, makeDaemonAgentSessionHost, worktreeAgentInputSchema, worktreeAgentWorkflow };
-//# sourceMappingURL=chunk-5SDH2V6M.mjs.map
-//# sourceMappingURL=chunk-5SDH2V6M.mjs.map
+//# sourceMappingURL=chunk-FC3I5NTS.mjs.map
+//# sourceMappingURL=chunk-FC3I5NTS.mjs.map

package/dist/{chunk-5SDH2V6M.mjs.map → chunk-FC3I5NTS.mjs.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/workflow.ts","../src/agent-session-host.ts"],"names":[],"mappings":";;;;;;;;;AASO,IAAM,wBAAA,GAA2B,EAAE,MAAA,CAAO;AAAA,EAC/C,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2CAA2C,CAAA;AAAA,EACzE,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oDAAoD,CAAA;AAAA,EAC9E,MAAM,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,6DAA6D,CAAA;AAAA,EAClG,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oFAAoF,CAAA;AAAA,EAC5H,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,2DAA2D,CAAA;AAAA,EAC9G,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,6KAA6K,CAAA;AAAA,EAChO,YAAY,CAAA,CACT,KAAA;AAAA,IACC,EAAE,MAAA,CAAO;AAAA,MACP,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC,CAAA;AAAA,MAC/D,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6CAA6C,CAAA;AAAA,MAC1E,IAAA,EAAM,CAAA,CACH,IAAA,CAAK,CAAC,QAAA,EAAU,QAAQ,CAAC,CAAA,CACzB,QAAA,EAAS,CACT,QAAA,CAAS,4KAA4K;AAAA,KACzL;AAAA,GACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,0HAA0H,CAAA;AAAA,EACtI,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAChE,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,4CAA4C,CAAA;AAAA,EACpF,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,8EAA8E,CAAA;AAAA,EAC3G,cAAc,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,wDAAwD;AACxG,CAAC;AAID,IAAM,UAAA,GAAa,CAAC,gBAAgB,CAAA;AAEpC,SAAS,MAAM,CAAA,EAA2C;AACxD,EAAA,OAAO,CAAA,CAAE,KAAA;AACX;AAOO,IAAM,qBAAA,GAAyC;AAAA,EACpD,EAAA,EAAI,gBAAA;AAAA,EACJ,WAAA,EACE,kNAAA;AAAA,EAGF,KAAA,EAAO;AAAA,IACL;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,EAAA,EAAI,WAAA;AAAA,MACJ,IAAA,EAAM,qBAAA;AAAA,MACN,UAAA;AAAA,MACA,KAAA,EAAO,CAAC,CAAA,KAAgB;AACtB,QAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,QAAA,OAAO;AAAA,UACL,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,SAAS,CAAA,CAAE,OAAA;AAAA,UACX,WAAW,CAAA,CAAE,SAAA;AAAA,UACb,WAAW,CAAA,CAAE,SAAA;AAAA,UACb,YAAY,CAAA,CAAE;AAAA,SAChB;AAAA,MACF;AAAA,KACF;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,EAAA,EAAI,MAAA;AAAA,MACJ,SAAS,CAAC,CAAA,KAAgB,KAAA,CAAM,CAAC,EAAE,OAAA,IAAW,aAAA;AAAA,MAC9C,GAAA,EAAK,CAAC,CAAA,KAAiB,CAAA,CAAE,MAAM,SAAA,CAA8B,GAAA;AAAA,MAC7D,MAAA,EAAQ,CAAC,CAAA,KAAgB,KAAA,CAAM,CAAC,CAAA,CAAE;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,EAAA,EAAI,MAAA;AAAA,MACJ,IAAA,EAAM,WAAA;AAAA,MACN,UAAA;AAAA,MACA,KAAA,EAAO,CAAC,CAAA,MAAiB;AAAA,QACvB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,QAC5C,GAAA,EAAK,KAAA,CAAM,CAAC,CAAA,CAAE;AAAA,OAChB;AAAA,KACF;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,EAAA,EAAI,OAAA;AAAA,MACJ,IAAA,EAAM,CAAC,CAAA,KAAiB,CAAA,CAAE,MAAM,IAAA,CAA6B,MAAA;AAAA,MAC7D,IAAA,EAAM;AAAA,QACJ;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,EAAA,EAAI,UAAA;AAAA,UACJ,QAAQ,MAAM,wCAAA;AAAA,UACd,SAAA,EAAW;AAAA,YACT;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,EAAA,EAAI,SAAA;AAAA,cACJ,IAAA,EAAM,mBAAA;AAAA,cACN,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAOA,KAAA,EAAO,CAAC,CAAA,MAAiB;AAAA,gBACvB,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA,CAAE,QAAA;AAAA,gBACnB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,gBAC5C,MAAA,EAAS,CAAA,CAAE,KAAA,CAAM,SAAA,CAAiC,MAAA;AAAA,gBAClD,YAAA,EAAc,KAAA,CAAM,CAAC,CAAA,CAAE,YAAA,IAAgB,IAAA;AAAA,gBACvC,gBAAA,EAAkB,IAAA;AAAA,gBAClB,eAAA,EAAiB;AAAA,eACnB;AAAA;AACF,WACF;AAAA,UACA,QAAA,EAAU;AAAA,YACR;AAAA,cACE,IAAA,EAAM,WAAA;AAAA,cACN,EAAA,EAAI,MAAA;AAAA,cACJ,SAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,kBAAA,EAA4B;AAAA;AACxE;AACF;AACF,OACF;AAAA,MACA,SAAA,EAAW;AAAA,QACT;AAAA,UACE,IAAA,EAAM,WAAA;AAAA,UACN,EAAA,EAAI,aAAA;AAAA,UACJ,SAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,aAAA,EAAuB;AAAA;AACnE;AACF;AACF,GACF;AAAA,EACA,MAAA,EAAQ,CAAC,CAAA,MAAiB;AAAA,IACxB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,IAC5C,MAAA,EAAS,CAAA,CAAE,KAAA,CAAM,SAAA,CAAiC,MAAA;AAAA,IAClD,IAAA,EAAM,EAAE,KAAA,CAAM,IAAA;AAAA,IACd,OAAA,EAAS,EAAE,KAAA,CAAM,OAAA,IAAW,EAAE,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,KAAA,CAAM,aAAa;AAAA,GACnE;AACF;ACpIA,IAAM,WAAA,GAAc,IAAA;AAmDpB,eAAsB,8BACpB,IAAA,EACiC;AACjC,EAAA,MAAM,GAAA,GAAM,cAAc,IAAI,CAAA;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,aAAA,CAAc,OAAA,CAAQ,EAAE,KAAK,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2EAA2E,GAAG,CAAA;AAAA,CAAA,EAGxE,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,KACxD;AAAA,EACF;AACA,EAAA,OAAO,2BAA2B,MAAM,CAAA;AAC1C;AAGO,SAAS,2BAA2B,MAAA,EAA8C;AACvF,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAEhD,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,OAAA,EAAS,IAAA,EAAuB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA,CAAM;AAAA,QAC9B,OAAA;AAAA,QACA,GAAI,KAAK,GAAA,KAAQ,MAAA,GAAY,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,EAAC;AAAA,QAClD,GAAI,KAAK,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,EAAe,IAAA,CAAK,aAAA,EAAc,GAAI,EAAC;AAAA,QAChF,GAAI,KAAK,MAAA,KAAW,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,MAAA,EAAO,GAAI;AAAC,OAC3D,CAAA;AACD,MAAA,IAAI,KAAK,MAAA,EAAQ,eAAA,CAAgB,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAK,EAAE,CAAA;AACzD,MAAA,OAAO,IAAA,CAAK,EAAA;AAAA,IACd,CAAA;AAAA,IAEA,MAAM,iBAAA,CAAkB,SAAA,EAAW,MAAA,EAAuB;AASxD,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,mBAAA,EAAoB;AAC/C,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AACrC,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,SAAA,EAAW,KAAK,CAAA;AAAA,IAC/C,CAAA;AAAA,IAEA,eAAe,MAAA,EAA4B;AACzC,MAAA,OAAO,eAAA,CAAgB,IAAI,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IAEA,MAAM,MAAM,IAAA,EAAkC;AAC5C,MAAA,OAAO,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAqB;AACnD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,SAAA,EAAW,KAAA,EAAwB;AAC9C,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,KAAK,CAAA;AAAA,IACvC,CAAA;AAAA,IAEA,MAAM,KAAK,SAAA,EAA0B;AACnC,MAAA,MAAM,MAAA,CAAO,KAAK,SAAS,CAAA;AAAA,IAC7B,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAA2B;AACtD,MAAA,OAAO,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,IAAI,CAAA;AAAA,IAC3C,CAAA;AAAA,IAEA,MAAM,mBAAA,GAAuC;AAC3C,MAAA,OAAO,OAAO,mBAAA,EAAoB;AAAA,IACpC,CAAA;AAAA,IAEA,GAAI,OAAO,MAAA,CAAO,KAAA,KAAU,UAAA,GACxB;AAAA,MACE,MAAM,MAAM,SAAA,EAAkD;AAC5D,QAAA,OAAO,MAAA,CAAO,MAAO,SAAS,CAAA;AAAA,MAChC;AAAA,QAEF,EAAC;AAAA,IAEL,MAAM,KAAA,GAAuB;AAC3B,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,GACF;AACF;AAWA,eAAe,cAAA,CAAe,MAAA,EAAsB,SAAA,EAAmB,KAAA,EAA8B;AACnG,EAAA,WAAS;AACP,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW,CAAC,SAAS,CAAA,EAAG,EAAE,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,OAAO,CAAA;AACnG,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AAAA,EACxB;AACF","file":"chunk-5SDH2V6M.mjs","sourcesContent":["import { z } from \"zod\"\nimport type { Bindings, RuntimeWorkflow } from \"@agentproto/workflow-runtime\"\nimport { provisionWorktreeTool, cleanupWorktreeTool, runGateTool } from \"./tools/index.js\"\nimport { worktreeProvider } from \"./provider/index.js\"\n\n/**\n * Input to the worktree-agent workflow: launch a coding agent inside a\n * fresh git worktree, gate its work, and — on approval — clean up.\n */\nexport const worktreeAgentInputSchema = z.object({\n  repoRoot: z.string().describe(\"Absolute path to the git repository root.\"),\n  slug: z.string().describe(\"Worktree/branch identifier, e.g. 'fix-flaky-test'.\"),\n  base: z.string().optional().describe(\"Ref to cut the worktree branch from. Default 'origin/main'.\"),\n  depsCmd: z.string().optional().describe(\"Command to install deps inside the worktree, e.g. 'pnpm install --prefer-offline'.\"),\n  copyGlobs: z.array(z.string()).optional().describe(\"Gitignored files to copy into the worktree, e.g. secrets.\"),\n  linkPaths: z.array(z.string()).optional().describe(\"Gitignored dirs/files symlinked from the host repo into the worktree before depsCmd (node_modules, sibling workspace repos) so the graph resolves without a full reinstall.\"),\n  writeFiles: z\n    .array(\n      z.object({\n        path: z.string().describe(\"Path relative to the worktree root.\"),\n        content: z.string().describe(\"File content, written or appended verbatim.\"),\n        mode: z\n          .enum([\"create\", \"append\"])\n          .optional()\n          .describe(\"'create' (default): write only if path doesn't already exist. 'append': always append (creating if missing); if git tracks the path, it's marked skip-worktree afterwards.\"),\n      }),\n    )\n    .optional()\n    .describe(\"Files written into the worktree before depsCmd runs, e.g. a package-manager config generated for this specific worktree.\"),\n  task: z.string().describe(\"The prompt sent to the coding agent.\"),\n  adapter: z.string().optional().describe(\"Agent adapter slug. Default 'claude-code'.\"),\n  gateCmd: z.string().describe(\"Command run inside the worktree to check the agent's work, e.g. 'pnpm test'.\"),\n  deleteBranch: z.boolean().optional().describe(\"Delete the worktree's branch on cleanup. Default true.\"),\n})\n\nexport type WorktreeAgentInput = z.infer<typeof worktreeAgentInputSchema>\n\nconst candidates = [worktreeProvider]\n\nfunction input(b: { input: unknown }): WorktreeAgentInput {\n  return b.input as WorktreeAgentInput\n}\n\n/**\n * provision (tool) → code (AgentStep, cwd bound to provision's output) →\n * gate (tool) → on pass: approval → cleanup (tool); on fail: leave the\n * worktree in place for inspection.\n */\nexport const worktreeAgentWorkflow: RuntimeWorkflow = {\n  id: \"worktree-agent\",\n  description:\n    \"Launch a coding agent inside a fresh git worktree, gate its work with a \" +\n    \"check command, get a human ack, then clean up. On gate failure the \" +\n    \"worktree is left in place for inspection instead of being cleaned up.\",\n  steps: [\n    {\n      kind: \"tool\",\n      id: \"provision\",\n      tool: provisionWorktreeTool,\n      candidates,\n      input: (b: Bindings) => {\n        const i = input(b)\n        return {\n          repoRoot: i.repoRoot,\n          slug: i.slug,\n          base: i.base,\n          depsCmd: i.depsCmd,\n          copyGlobs: i.copyGlobs,\n          linkPaths: i.linkPaths,\n          writeFiles: i.writeFiles,\n        }\n      },\n    },\n    {\n      kind: \"agent\",\n      id: \"code\",\n      adapter: (b: Bindings) => input(b).adapter ?? \"claude-code\",\n      cwd: (b: Bindings) => (b.steps.provision as { cwd: string }).cwd,\n      prompt: (b: Bindings) => input(b).task,\n    },\n    {\n      kind: \"tool\",\n      id: \"gate\",\n      tool: runGateTool,\n      candidates,\n      input: (b: Bindings) => ({\n        cwd: (b.steps.provision as { cwd: string }).cwd,\n        cmd: input(b).gateCmd,\n      }),\n    },\n    {\n      kind: \"branch\",\n      id: \"route\",\n      cond: (b: Bindings) => (b.steps.gate as { passed: boolean }).passed,\n      then: [\n        {\n          kind: \"approval\",\n          id: \"approval\",\n          prompt: () => \"Gate passed. Approve worktree cleanup?\",\n          onApprove: [\n            {\n              kind: \"tool\",\n              id: \"cleanup\",\n              tool: cleanupWorktreeTool,\n              candidates,\n              // discardUntracked/discardModified: worktree.cleanup refuses a\n              // dirty tree by default (PLAN.md §5.2 layer 3). This workflow's\n              // own approval step, just above, is that guard already —  a\n              // human explicitly approved tearing this worktree down, so\n              // both flags are granted here rather than surfacing a second,\n              // redundant refusal.\n              input: (b: Bindings) => ({\n                repoRoot: input(b).repoRoot,\n                cwd: (b.steps.provision as { cwd: string }).cwd,\n                branch: (b.steps.provision as { branch: string }).branch,\n                deleteBranch: input(b).deleteBranch ?? true,\n                discardUntracked: true,\n                discardModified: true,\n              }),\n            },\n          ],\n          onReject: [\n            {\n              kind: \"transform\",\n              id: \"held\",\n              compute: () => ({ removed: false, reason: \"cleanup_rejected\" as const }),\n            },\n          ],\n        },\n      ],\n      otherwise: [\n        {\n          kind: \"transform\",\n          id: \"gate-failed\",\n          compute: () => ({ removed: false, reason: \"gate_failed\" as const }),\n        },\n      ],\n    },\n  ],\n  output: (b: Bindings) => ({\n    cwd: (b.steps.provision as { cwd: string }).cwd,\n    branch: (b.steps.provision as { branch: string }).branch,\n    gate: b.steps.gate,\n    cleanup: b.steps.cleanup ?? b.steps.held ?? b.steps[\"gate-failed\"],\n  }),\n}\n","import {\n  HarnessClient,\n  resolveMcpUrl,\n  type ConnectHarnessOptions,\n  type SessionDescriptor,\n  type SessionUsageSnapshot,\n  type StartAgentArgs,\n  type TurnEvent,\n  type TurnResult,\n} from \"@agentproto/harness\"\nimport type { AgentSessionHost } from \"@agentproto/workflow-runtime\"\n\n/** `session_monitor`'s max accepted long-poll window (`orchestration-tools.ts`). */\nconst MAX_POLL_MS = 49_000\n\n/** The subset of `HarnessClient` the host drives — narrowed for fake-client tests. */\nexport type DaemonClient = Pick<\n  HarnessClient,\n  \"start\" | \"prompt\" | \"output\" | \"kill\" | \"waitForAny\" | \"currentEventsCursor\" | \"close\"\n> & {\n  /** `session_usage` — optional so pre-existing fakes/clients without it still\n   *  satisfy the type; the host simply exposes no `usage` then. */\n  usage?: HarnessClient[\"usage\"]\n}\n\nexport interface DaemonAgentSessionHost extends AgentSessionHost {\n  close(): Promise<void>\n  /** Full `agent_start`, returning the raw descriptor and forwarding every\n   *  `StartAgentArgs` field (`mcpServers`, `model`, `effort`, `label`, …) —\n   *  unlike `spawn()` above (the narrow AgentStep-shaped convenience\n   *  wrapper), which only takes `cwd`/`workspaceSlug`/`stepId`. Consumers\n   *  that need finer per-turn control than the AgentStep contract provides\n   *  (e.g. `@agentproto/sandbox`'s sandbox agent-session proxy) use this\n   *  plus `prompt`/`output`/`kill`/`waitForAny` directly instead of\n   *  `spawn`/`sendPromptAndWait`. */\n  start(args: StartAgentArgs): Promise<SessionDescriptor>\n  /** Send a follow-up turn — `opts.interrupt` cancels an in-flight turn and\n   *  redirects the session onto this prompt (mirrors `agent_prompt`). */\n  prompt(sessionId: string, prompt: string, opts?: { interrupt?: boolean }): Promise<void>\n  /** Tail the ring buffer (`agent_output`). */\n  output(sessionId: string, lastN?: number): Promise<string>\n  /** SIGTERM the session (`agent_kill`). */\n  kill(sessionId: string): Promise<void>\n  /** Multiplexed long-poll (`session_monitor`) — see `HarnessClient.waitForAny`. */\n  waitForAny(\n    sessionIds: string[],\n    opts?: { timeoutMs?: number; event?: TurnEvent; since?: number },\n  ): Promise<TurnResult>\n  /** Race-free cursor for a subsequent `waitForAny({ since })` — see\n   *  `HarnessClient.currentEventsCursor`. */\n  currentEventsCursor(): Promise<number>\n  /** Usage accounting for a session on this daemon (`session_usage`) — present\n   *  when the underlying client can answer it. `@agentproto/sandbox`'s host\n   *  inherits it, which is how a sandboxed session's cost/tokens/model reach\n   *  the HOST daemon's descriptor (the proxy's text stream carries none). */\n  usage?(sessionId: string): Promise<SessionUsageSnapshot>\n}\n\n/**\n * Connect to the agentproto daemon's MCP endpoint and return a real,\n * supervisable `AgentSessionHost` — every `AgentStep` becomes an `agent_start`\n * daemon session rather than a bare subprocess. Fails loudly (no silent\n * fallback) if the daemon isn't reachable.\n */\nexport async function connectDaemonAgentSessionHost(\n  opts?: ConnectHarnessOptions,\n): Promise<DaemonAgentSessionHost> {\n  const url = resolveMcpUrl(opts)\n  let client: HarnessClient\n  try {\n    client = await HarnessClient.connect({ url })\n  } catch (err) {\n    throw new Error(\n      `worktree-agent: could not reach the agentproto daemon's MCP endpoint at ${url}. ` +\n        \"Start the daemon (`agentproto daemon start`), or point at a running one via \" +\n        `AGENTPROTO_MCP_URL, before running this command.\\n` +\n        `(${err instanceof Error ? err.message : String(err)})`,\n    )\n  }\n  return makeDaemonAgentSessionHost(client)\n}\n\n/** Build the host over an already-connected client (exported for tests with a fake client). */\nexport function makeDaemonAgentSessionHost(client: DaemonClient): DaemonAgentSessionHost {\n  const sessionByStepId = new Map<string, string>()\n\n  return {\n    async spawn(adapter, opts): Promise<string> {\n      const desc = await client.start({\n        adapter,\n        ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),\n        ...(opts.workspaceSlug !== undefined ? { workspaceSlug: opts.workspaceSlug } : {}),\n        ...(opts.stepId !== undefined ? { label: opts.stepId } : {}),\n      })\n      if (opts.stepId) sessionByStepId.set(opts.stepId, desc.id)\n      return desc.id\n    },\n\n    async sendPromptAndWait(sessionId, prompt): Promise<void> {\n      // Capture a race-free cursor BEFORE sending: an extremely fast turn\n      // can settle before a live bus subscription even starts — a real\n      // race over the network round-trip to `prompt`/`waitForAny`, not\n      // just in-process call ordering (see `HarnessClient\n      // .currentEventsCursor`'s doc). The awaited cursor fetch completes\n      // strictly before `prompt` is sent, so the daemon's ring-replay\n      // branch can always find the matching turn-end regardless of how\n      // late the long-poll's own subscription lands.\n      const since = await client.currentEventsCursor()\n      await client.prompt(sessionId, prompt)\n      await waitForSettled(client, sessionId, since)\n    },\n\n    resolveByLabel(stepId): string | undefined {\n      return sessionByStepId.get(stepId)\n    },\n\n    async start(args): Promise<SessionDescriptor> {\n      return client.start(args)\n    },\n\n    async prompt(sessionId, prompt, opts): Promise<void> {\n      await client.prompt(sessionId, prompt, opts)\n    },\n\n    async output(sessionId, lastN): Promise<string> {\n      return client.output(sessionId, lastN)\n    },\n\n    async kill(sessionId): Promise<void> {\n      await client.kill(sessionId)\n    },\n\n    async waitForAny(sessionIds, opts): Promise<TurnResult> {\n      return client.waitForAny(sessionIds, opts)\n    },\n\n    async currentEventsCursor(): Promise<number> {\n      return client.currentEventsCursor()\n    },\n\n    ...(typeof client.usage === \"function\"\n      ? {\n          async usage(sessionId: string): Promise<SessionUsageSnapshot> {\n            return client.usage!(sessionId)\n          },\n        }\n      : {}),\n\n    async close(): Promise<void> {\n      await client.close()\n    },\n  }\n}\n\n/**\n * `session_monitor` long-polls cap at 49s; loop past timeouts for longer\n * turns. A clean timeout comes back as `{ timedOut: true, sessionIds }` —\n * there is no `event: \"timeout\"` on the wire, `event` is only ever set on a\n * real match. Keep polling while `timedOut` is true; stop once it's\n * falsy/absent (a real turn-end/awaiting-input/exited match). `since` is\n * reused unchanged across retries — a timeout means nothing has matched\n * since that cursor yet, so there is nothing to advance.\n */\nasync function waitForSettled(client: DaemonClient, sessionId: string, since: number): Promise<void> {\n  for (;;) {\n    const result = await client.waitForAny([sessionId], { event: \"any\", timeoutMs: MAX_POLL_MS, since })\n    if (!result.timedOut) return\n  }\n}\n"]}
+{"version":3,"sources":["../src/workflow.ts","../src/agent-session-host.ts"],"names":[],"mappings":";;;;;;;;;AASO,IAAM,wBAAA,GAA2B,EAAE,MAAA,CAAO;AAAA,EAC/C,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2CAA2C,CAAA;AAAA,EACzE,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oDAAoD,CAAA;AAAA,EAC9E,MAAM,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,6DAA6D,CAAA;AAAA,EAClG,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oFAAoF,CAAA;AAAA,EAC5H,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,2DAA2D,CAAA;AAAA,EAC9G,SAAA,EAAW,CAAA,CAAE,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,6KAA6K,CAAA;AAAA,EAChO,YAAY,CAAA,CACT,KAAA;AAAA,IACC,EAAE,MAAA,CAAO;AAAA,MACP,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qCAAqC,CAAA;AAAA,MAC/D,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6CAA6C,CAAA;AAAA,MAC1E,IAAA,EAAM,CAAA,CACH,IAAA,CAAK,CAAC,QAAA,EAAU,QAAQ,CAAC,CAAA,CACzB,QAAA,EAAS,CACT,QAAA,CAAS,4KAA4K;AAAA,KACzL;AAAA,GACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,0HAA0H,CAAA;AAAA,EACtI,IAAA,EAAM,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sCAAsC,CAAA;AAAA,EAChE,SAAS,CAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,4CAA4C,CAAA;AAAA,EACpF,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,8EAA8E,CAAA;AAAA,EAC3G,cAAc,CAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,wDAAwD;AACxG,CAAC;AAID,IAAM,UAAA,GAAa,CAAC,gBAAgB,CAAA;AAEpC,SAAS,MAAM,CAAA,EAA2C;AACxD,EAAA,OAAO,CAAA,CAAE,KAAA;AACX;AAOO,IAAM,qBAAA,GAAyC;AAAA,EACpD,EAAA,EAAI,gBAAA;AAAA,EACJ,WAAA,EACE,kNAAA;AAAA,EAGF,KAAA,EAAO;AAAA,IACL;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,EAAA,EAAI,WAAA;AAAA,MACJ,IAAA,EAAM,qBAAA;AAAA,MACN,UAAA;AAAA,MACA,KAAA,EAAO,CAAC,CAAA,KAAgB;AACtB,QAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,QAAA,OAAO;AAAA,UACL,UAAU,CAAA,CAAE,QAAA;AAAA,UACZ,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,MAAM,CAAA,CAAE,IAAA;AAAA,UACR,SAAS,CAAA,CAAE,OAAA;AAAA,UACX,WAAW,CAAA,CAAE,SAAA;AAAA,UACb,WAAW,CAAA,CAAE,SAAA;AAAA,UACb,YAAY,CAAA,CAAE;AAAA,SAChB;AAAA,MACF;AAAA,KACF;AAAA,IACA;AAAA,MACE,IAAA,EAAM,OAAA;AAAA,MACN,EAAA,EAAI,MAAA;AAAA,MACJ,SAAS,CAAC,CAAA,KAAgB,KAAA,CAAM,CAAC,EAAE,OAAA,IAAW,aAAA;AAAA,MAC9C,GAAA,EAAK,CAAC,CAAA,KAAiB,CAAA,CAAE,MAAM,SAAA,CAA8B,GAAA;AAAA,MAC7D,MAAA,EAAQ,CAAC,CAAA,KAAgB,KAAA,CAAM,CAAC,CAAA,CAAE;AAAA,KACpC;AAAA,IACA;AAAA,MACE,IAAA,EAAM,MAAA;AAAA,MACN,EAAA,EAAI,MAAA;AAAA,MACJ,IAAA,EAAM,WAAA;AAAA,MACN,UAAA;AAAA,MACA,KAAA,EAAO,CAAC,CAAA,MAAiB;AAAA,QACvB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,QAC5C,GAAA,EAAK,KAAA,CAAM,CAAC,CAAA,CAAE;AAAA,OAChB;AAAA,KACF;AAAA,IACA;AAAA,MACE,IAAA,EAAM,QAAA;AAAA,MACN,EAAA,EAAI,OAAA;AAAA,MACJ,IAAA,EAAM,CAAC,CAAA,KAAiB,CAAA,CAAE,MAAM,IAAA,CAA6B,MAAA;AAAA,MAC7D,IAAA,EAAM;AAAA,QACJ;AAAA,UACE,IAAA,EAAM,UAAA;AAAA,UACN,EAAA,EAAI,UAAA;AAAA,UACJ,QAAQ,MAAM,wCAAA;AAAA,UACd,SAAA,EAAW;AAAA,YACT;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,EAAA,EAAI,SAAA;AAAA,cACJ,IAAA,EAAM,mBAAA;AAAA,cACN,UAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAOA,KAAA,EAAO,CAAC,CAAA,MAAiB;AAAA,gBACvB,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA,CAAE,QAAA;AAAA,gBACnB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,gBAC5C,MAAA,EAAS,CAAA,CAAE,KAAA,CAAM,SAAA,CAAiC,MAAA;AAAA,gBAClD,YAAA,EAAc,KAAA,CAAM,CAAC,CAAA,CAAE,YAAA,IAAgB,IAAA;AAAA,gBACvC,gBAAA,EAAkB,IAAA;AAAA,gBAClB,eAAA,EAAiB;AAAA,eACnB;AAAA;AACF,WACF;AAAA,UACA,QAAA,EAAU;AAAA,YACR;AAAA,cACE,IAAA,EAAM,WAAA;AAAA,cACN,EAAA,EAAI,MAAA;AAAA,cACJ,SAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,kBAAA,EAA4B;AAAA;AACxE;AACF;AACF,OACF;AAAA,MACA,SAAA,EAAW;AAAA,QACT;AAAA,UACE,IAAA,EAAM,WAAA;AAAA,UACN,EAAA,EAAI,aAAA;AAAA,UACJ,SAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,QAAQ,aAAA,EAAuB;AAAA;AACnE;AACF;AACF,GACF;AAAA,EACA,MAAA,EAAQ,CAAC,CAAA,MAAiB;AAAA,IACxB,GAAA,EAAM,CAAA,CAAE,KAAA,CAAM,SAAA,CAA8B,GAAA;AAAA,IAC5C,MAAA,EAAS,CAAA,CAAE,KAAA,CAAM,SAAA,CAAiC,MAAA;AAAA,IAClD,IAAA,EAAM,EAAE,KAAA,CAAM,IAAA;AAAA,IACd,OAAA,EAAS,EAAE,KAAA,CAAM,OAAA,IAAW,EAAE,KAAA,CAAM,IAAA,IAAQ,CAAA,CAAE,KAAA,CAAM,aAAa;AAAA,GACnE;AACF;ACpIA,IAAM,WAAA,GAAc,IAAA;AAmDpB,eAAsB,8BACpB,IAAA,EACiC;AACjC,EAAA,MAAM,GAAA,GAAM,cAAc,IAAI,CAAA;AAC9B,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,aAAA,CAAc,OAAA,CAAQ,EAAE,KAAK,CAAA;AAAA,EAC9C,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,2EAA2E,GAAG,CAAA;AAAA,CAAA,EAGxE,eAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAA;AAAA,KACxD;AAAA,EACF;AACA,EAAA,OAAO,2BAA2B,MAAM,CAAA;AAC1C;AAGO,SAAS,2BAA2B,MAAA,EAA8C;AACvF,EAAA,MAAM,eAAA,uBAAsB,GAAA,EAAoB;AAEhD,EAAA,OAAO;AAAA,IACL,MAAM,KAAA,CAAM,OAAA,EAAS,IAAA,EAAuB;AAC1C,MAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,KAAA,CAAM;AAAA,QAC9B,OAAA;AAAA,QACA,GAAI,KAAK,GAAA,KAAQ,MAAA,GAAY,EAAE,GAAA,EAAK,IAAA,CAAK,GAAA,EAAI,GAAI,EAAC;AAAA,QAClD,GAAI,KAAK,aAAA,KAAkB,MAAA,GAAY,EAAE,aAAA,EAAe,IAAA,CAAK,aAAA,EAAc,GAAI,EAAC;AAAA,QAChF,GAAI,KAAK,MAAA,KAAW,MAAA,GAAY,EAAE,KAAA,EAAO,IAAA,CAAK,MAAA,EAAO,GAAI;AAAC,OAC3D,CAAA;AACD,MAAA,IAAI,KAAK,MAAA,EAAQ,eAAA,CAAgB,IAAI,IAAA,CAAK,MAAA,EAAQ,KAAK,EAAE,CAAA;AACzD,MAAA,OAAO,IAAA,CAAK,EAAA;AAAA,IACd,CAAA;AAAA,IAEA,MAAM,iBAAA,CAAkB,SAAA,EAAW,MAAA,EAAuB;AASxD,MAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,mBAAA,EAAoB;AAC/C,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AACrC,MAAA,MAAM,cAAA,CAAe,MAAA,EAAQ,SAAA,EAAW,KAAK,CAAA;AAAA,IAC/C,CAAA;AAAA,IAEA,eAAe,MAAA,EAA4B;AACzC,MAAA,OAAO,eAAA,CAAgB,IAAI,MAAM,CAAA;AAAA,IACnC,CAAA;AAAA,IAEA,MAAM,MAAM,IAAA,EAAkC;AAC5C,MAAA,OAAO,MAAA,CAAO,MAAM,IAAI,CAAA;AAAA,IAC1B,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,IAAA,EAAqB;AACnD,MAAA,MAAM,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAA,EAAQ,IAAI,CAAA;AAAA,IAC7C,CAAA;AAAA,IAEA,MAAM,MAAA,CAAO,SAAA,EAAW,KAAA,EAAwB;AAC9C,MAAA,OAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,KAAK,CAAA;AAAA,IACvC,CAAA;AAAA,IAEA,MAAM,KAAK,SAAA,EAA0B;AACnC,MAAA,MAAM,MAAA,CAAO,KAAK,SAAS,CAAA;AAAA,IAC7B,CAAA;AAAA,IAEA,MAAM,UAAA,CAAW,UAAA,EAAY,IAAA,EAA2B;AACtD,MAAA,OAAO,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,IAAI,CAAA;AAAA,IAC3C,CAAA;AAAA,IAEA,MAAM,mBAAA,GAAuC;AAC3C,MAAA,OAAO,OAAO,mBAAA,EAAoB;AAAA,IACpC,CAAA;AAAA,IAEA,GAAI,OAAO,MAAA,CAAO,KAAA,KAAU,UAAA,GACxB;AAAA,MACE,MAAM,MAAM,SAAA,EAAkD;AAC5D,QAAA,OAAO,MAAA,CAAO,MAAO,SAAS,CAAA;AAAA,MAChC;AAAA,QAEF,EAAC;AAAA,IAEL,MAAM,KAAA,GAAuB;AAC3B,MAAA,MAAM,OAAO,KAAA,EAAM;AAAA,IACrB;AAAA,GACF;AACF;AAWA,eAAe,cAAA,CAAe,MAAA,EAAsB,SAAA,EAAmB,KAAA,EAA8B;AACnG,EAAA,WAAS;AACP,IAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,UAAA,CAAW,CAAC,SAAS,CAAA,EAAG,EAAE,KAAA,EAAO,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,OAAO,CAAA;AACnG,IAAA,IAAI,CAAC,OAAO,QAAA,EAAU;AAAA,EACxB;AACF","file":"chunk-FC3I5NTS.mjs","sourcesContent":["import { z } from \"zod\"\nimport type { Bindings, RuntimeWorkflow } from \"@agentproto/workflow-runtime\"\nimport { provisionWorktreeTool, cleanupWorktreeTool, runGateTool } from \"./tools/index.js\"\nimport { worktreeProvider } from \"./provider/index.js\"\n\n/**\n * Input to the worktree-agent workflow: launch a coding agent inside a\n * fresh git worktree, gate its work, and — on approval — clean up.\n */\nexport const worktreeAgentInputSchema = z.object({\n  repoRoot: z.string().describe(\"Absolute path to the git repository root.\"),\n  slug: z.string().describe(\"Worktree/branch identifier, e.g. 'fix-flaky-test'.\"),\n  base: z.string().optional().describe(\"Ref to cut the worktree branch from. Default 'origin/main'.\"),\n  depsCmd: z.string().optional().describe(\"Command to install deps inside the worktree, e.g. 'pnpm install --prefer-offline'.\"),\n  copyGlobs: z.array(z.string()).optional().describe(\"Gitignored files to copy into the worktree, e.g. secrets.\"),\n  linkPaths: z.array(z.string()).optional().describe(\"Gitignored dirs/files symlinked from the host repo into the worktree before depsCmd (node_modules, sibling workspace repos) so the graph resolves without a full reinstall.\"),\n  writeFiles: z\n    .array(\n      z.object({\n        path: z.string().describe(\"Path relative to the worktree root.\"),\n        content: z.string().describe(\"File content, written or appended verbatim.\"),\n        mode: z\n          .enum([\"create\", \"append\"])\n          .optional()\n          .describe(\"'create' (default): write only if path doesn't already exist. 'append': always append (creating if missing); if git tracks the path, it's marked skip-worktree afterwards.\"),\n      }),\n    )\n    .optional()\n    .describe(\"Files written into the worktree before depsCmd runs, e.g. a package-manager config generated for this specific worktree.\"),\n  task: z.string().describe(\"The prompt sent to the coding agent.\"),\n  adapter: z.string().optional().describe(\"Agent adapter slug. Default 'claude-code'.\"),\n  gateCmd: z.string().describe(\"Command run inside the worktree to check the agent's work, e.g. 'pnpm test'.\"),\n  deleteBranch: z.boolean().optional().describe(\"Delete the worktree's branch on cleanup. Default true.\"),\n})\n\nexport type WorktreeAgentInput = z.infer<typeof worktreeAgentInputSchema>\n\nconst candidates = [worktreeProvider]\n\nfunction input(b: { input: unknown }): WorktreeAgentInput {\n  return b.input as WorktreeAgentInput\n}\n\n/**\n * provision (tool) → code (AgentStep, cwd bound to provision's output) →\n * gate (tool) → on pass: approval → cleanup (tool); on fail: leave the\n * worktree in place for inspection.\n */\nexport const worktreeAgentWorkflow: RuntimeWorkflow = {\n  id: \"worktree-agent\",\n  description:\n    \"Launch a coding agent inside a fresh git worktree, gate its work with a \" +\n    \"check command, get a human ack, then clean up. On gate failure the \" +\n    \"worktree is left in place for inspection instead of being cleaned up.\",\n  steps: [\n    {\n      kind: \"tool\",\n      id: \"provision\",\n      tool: provisionWorktreeTool,\n      candidates,\n      input: (b: Bindings) => {\n        const i = input(b)\n        return {\n          repoRoot: i.repoRoot,\n          slug: i.slug,\n          base: i.base,\n          depsCmd: i.depsCmd,\n          copyGlobs: i.copyGlobs,\n          linkPaths: i.linkPaths,\n          writeFiles: i.writeFiles,\n        }\n      },\n    },\n    {\n      kind: \"agent\",\n      id: \"code\",\n      adapter: (b: Bindings) => input(b).adapter ?? \"claude-code\",\n      cwd: (b: Bindings) => (b.steps.provision as { cwd: string }).cwd,\n      prompt: (b: Bindings) => input(b).task,\n    },\n    {\n      kind: \"tool\",\n      id: \"gate\",\n      tool: runGateTool,\n      candidates,\n      input: (b: Bindings) => ({\n        cwd: (b.steps.provision as { cwd: string }).cwd,\n        cmd: input(b).gateCmd,\n      }),\n    },\n    {\n      kind: \"branch\",\n      id: \"route\",\n      cond: (b: Bindings) => (b.steps.gate as { passed: boolean }).passed,\n      then: [\n        {\n          kind: \"approval\",\n          id: \"approval\",\n          prompt: () => \"Gate passed. Approve worktree cleanup?\",\n          onApprove: [\n            {\n              kind: \"tool\",\n              id: \"cleanup\",\n              tool: cleanupWorktreeTool,\n              candidates,\n              // discardUntracked/discardModified: worktree.cleanup refuses a\n              // dirty tree by default (PLAN.md §5.2 layer 3). This workflow's\n              // own approval step, just above, is that guard already —  a\n              // human explicitly approved tearing this worktree down, so\n              // both flags are granted here rather than surfacing a second,\n              // redundant refusal.\n              input: (b: Bindings) => ({\n                repoRoot: input(b).repoRoot,\n                cwd: (b.steps.provision as { cwd: string }).cwd,\n                branch: (b.steps.provision as { branch: string }).branch,\n                deleteBranch: input(b).deleteBranch ?? true,\n                discardUntracked: true,\n                discardModified: true,\n              }),\n            },\n          ],\n          onReject: [\n            {\n              kind: \"transform\",\n              id: \"held\",\n              compute: () => ({ removed: false, reason: \"cleanup_rejected\" as const }),\n            },\n          ],\n        },\n      ],\n      otherwise: [\n        {\n          kind: \"transform\",\n          id: \"gate-failed\",\n          compute: () => ({ removed: false, reason: \"gate_failed\" as const }),\n        },\n      ],\n    },\n  ],\n  output: (b: Bindings) => ({\n    cwd: (b.steps.provision as { cwd: string }).cwd,\n    branch: (b.steps.provision as { branch: string }).branch,\n    gate: b.steps.gate,\n    cleanup: b.steps.cleanup ?? b.steps.held ?? b.steps[\"gate-failed\"],\n  }),\n}\n","import {\n  HarnessClient,\n  resolveMcpUrl,\n  type ConnectHarnessOptions,\n  type SessionDescriptor,\n  type SessionUsageSnapshot,\n  type StartAgentArgs,\n  type TurnEvent,\n  type TurnResult,\n} from \"@agentproto/harness\"\nimport type { AgentSessionHost } from \"@agentproto/workflow-runtime\"\n\n/** `session_monitor`'s max accepted long-poll window (`orchestration-tools.ts`). */\nconst MAX_POLL_MS = 49_000\n\n/** The subset of `HarnessClient` the host drives — narrowed for fake-client tests. */\nexport type DaemonClient = Pick<\n  HarnessClient,\n  \"start\" | \"prompt\" | \"output\" | \"kill\" | \"waitForAny\" | \"currentEventsCursor\" | \"close\"\n> & {\n  /** `session_usage` — optional so pre-existing fakes/clients without it still\n   *  satisfy the type; the host simply exposes no `usage` then. */\n  usage?: HarnessClient[\"usage\"]\n}\n\nexport interface DaemonAgentSessionHost extends AgentSessionHost {\n  close(): Promise<void>\n  /** Full `agent_start`, returning the raw descriptor and forwarding every\n   *  `StartAgentArgs` field (`mcpServers`, `model`, `effort`, `label`, …) —\n   *  unlike `spawn()` above (the narrow AgentStep-shaped convenience\n   *  wrapper), which only takes `cwd`/`workspaceSlug`/`stepId`. Consumers\n   *  that need finer per-turn control than the AgentStep contract provides\n   *  (e.g. `@agentproto/sandbox`'s sandbox agent-session proxy) use this\n   *  plus `prompt`/`output`/`kill`/`waitForAny` directly instead of\n   *  `spawn`/`sendPromptAndWait`. */\n  start(args: StartAgentArgs): Promise<SessionDescriptor>\n  /** Send a follow-up turn — `opts.interrupt` cancels an in-flight turn and\n   *  redirects the session onto this prompt (mirrors `agent_prompt`). */\n  prompt(sessionId: string, prompt: string, opts?: { interrupt?: boolean }): Promise<void>\n  /** Tail the ring buffer (`agent_output`). */\n  output(sessionId: string, lastN?: number): Promise<string>\n  /** SIGTERM the session (`agent_kill`). */\n  kill(sessionId: string): Promise<void>\n  /** Multiplexed long-poll (`session_monitor`) — see `HarnessClient.waitForAny`. */\n  waitForAny(\n    sessionIds: string[],\n    opts?: { timeoutMs?: number; event?: TurnEvent; since?: number },\n  ): Promise<TurnResult>\n  /** Race-free cursor for a subsequent `waitForAny({ since })` — see\n   *  `HarnessClient.currentEventsCursor`. */\n  currentEventsCursor(): Promise<number>\n  /** Usage accounting for a session on this daemon (`session_usage`) — present\n   *  when the underlying client can answer it. `@agentproto/sandbox`'s host\n   *  inherits it, which is how a sandboxed session's cost/tokens/model reach\n   *  the HOST daemon's descriptor (the proxy's text stream carries none). */\n  usage?(sessionId: string): Promise<SessionUsageSnapshot>\n}\n\n/**\n * Connect to the agentproto daemon's MCP endpoint and return a real,\n * supervisable `AgentSessionHost` — every `AgentStep` becomes an `agent_start`\n * daemon session rather than a bare subprocess. Fails loudly (no silent\n * fallback) if the daemon isn't reachable.\n */\nexport async function connectDaemonAgentSessionHost(\n  opts?: ConnectHarnessOptions,\n): Promise<DaemonAgentSessionHost> {\n  const url = resolveMcpUrl(opts)\n  let client: HarnessClient\n  try {\n    client = await HarnessClient.connect({ url })\n  } catch (err) {\n    throw new Error(\n      `worktree-agent: could not reach the agentproto daemon's MCP endpoint at ${url}. ` +\n        \"Start the daemon (`agentproto daemon start`), or point at a running one via \" +\n        `AGENTPROTO_MCP_URL, before running this command.\\n` +\n        `(${err instanceof Error ? err.message : String(err)})`,\n    )\n  }\n  return makeDaemonAgentSessionHost(client)\n}\n\n/** Build the host over an already-connected client (exported for tests with a fake client). */\nexport function makeDaemonAgentSessionHost(client: DaemonClient): DaemonAgentSessionHost {\n  const sessionByStepId = new Map<string, string>()\n\n  return {\n    async spawn(adapter, opts): Promise<string> {\n      const desc = await client.start({\n        adapter,\n        ...(opts.cwd !== undefined ? { cwd: opts.cwd } : {}),\n        ...(opts.workspaceSlug !== undefined ? { workspaceSlug: opts.workspaceSlug } : {}),\n        ...(opts.stepId !== undefined ? { label: opts.stepId } : {}),\n      })\n      if (opts.stepId) sessionByStepId.set(opts.stepId, desc.id)\n      return desc.id\n    },\n\n    async sendPromptAndWait(sessionId, prompt): Promise<void> {\n      // Capture a race-free cursor BEFORE sending: an extremely fast turn\n      // can settle before a live bus subscription even starts — a real\n      // race over the network round-trip to `prompt`/`waitForAny`, not\n      // just in-process call ordering (see `HarnessClient\n      // .currentEventsCursor`'s doc). The awaited cursor fetch completes\n      // strictly before `prompt` is sent, so the daemon's ring-replay\n      // branch can always find the matching turn-end regardless of how\n      // late the long-poll's own subscription lands.\n      const since = await client.currentEventsCursor()\n      await client.prompt(sessionId, prompt)\n      await waitForSettled(client, sessionId, since)\n    },\n\n    resolveByLabel(stepId): string | undefined {\n      return sessionByStepId.get(stepId)\n    },\n\n    async start(args): Promise<SessionDescriptor> {\n      return client.start(args)\n    },\n\n    async prompt(sessionId, prompt, opts): Promise<void> {\n      await client.prompt(sessionId, prompt, opts)\n    },\n\n    async output(sessionId, lastN): Promise<string> {\n      return client.output(sessionId, lastN)\n    },\n\n    async kill(sessionId): Promise<void> {\n      await client.kill(sessionId)\n    },\n\n    async waitForAny(sessionIds, opts): Promise<TurnResult> {\n      return client.waitForAny(sessionIds, opts)\n    },\n\n    async currentEventsCursor(): Promise<number> {\n      return client.currentEventsCursor()\n    },\n\n    ...(typeof client.usage === \"function\"\n      ? {\n          async usage(sessionId: string): Promise<SessionUsageSnapshot> {\n            return client.usage!(sessionId)\n          },\n        }\n      : {}),\n\n    async close(): Promise<void> {\n      await client.close()\n    },\n  }\n}\n\n/**\n * `session_monitor` long-polls cap at 49s; loop past timeouts for longer\n * turns. A clean timeout comes back as `{ timedOut: true, sessionIds }` —\n * there is no `event: \"timeout\"` on the wire, `event` is only ever set on a\n * real match. Keep polling while `timedOut` is true; stop once it's\n * falsy/absent (a real turn-end/awaiting-input/exited match). `since` is\n * reused unchanged across retries — a timeout means nothing has matched\n * since that cursor yet, so there is nothing to advance.\n */\nasync function waitForSettled(client: DaemonClient, sessionId: string, since: number): Promise<void> {\n  for (;;) {\n    const result = await client.waitForAny([sessionId], { event: \"any\", timeoutMs: MAX_POLL_MS, since })\n    if (!result.timedOut) return\n  }\n}\n"]}