@ai-sdk/harness-deepagents 1.0.87 → 1.0.90

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @ai-sdk/harness-deepagents
 
+## 1.0.90
+
+### Patch Changes
+
+- 0e590d2: feat(harness): harden credential brokering to only apply with correct ephemeral secret
+- Updated dependencies [3e125ba]
+- Updated dependencies [0e590d2]
+  - @ai-sdk/provider-utils@5.0.32
+  - @ai-sdk/harness@1.0.90
+
+## 1.0.89
+
+### Patch Changes
+
+- @ai-sdk/harness@1.0.89
+
+## 1.0.88
+
+### Patch Changes
+
+- Updated dependencies [32349cc]
+- Updated dependencies [a9782e1]
+- Updated dependencies [35841f5]
+- Updated dependencies [d2f3353]
+  - @ai-sdk/harness@1.0.88
+  - @ai-sdk/provider-utils@5.0.31
+
 ## 1.0.87
 
 ### Patch Changes

package/dist/index.js

@@ -8,13 +8,13 @@ import {
 } from "@ai-sdk/harness";
 import {
   applyCredentialForwarding,
+  createSandboxCredentialEnvironment,
   markBridgeStarting,
   createBridgeErrorHandler,
   createBridgeStartupError,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   getRestrictedSandboxSession,
-  maskSandboxCredentials,
   resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
@@ -105,20 +105,40 @@ var DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES = [
   "ANTHROPIC_API_KEY",
   "ANTHROPIC_AUTH_TOKEN"
 ];
-function createDeepAgentsRequestTransformations(env, auth) {
-  const headers = {};
-  if (env.ANTHROPIC_API_KEY) {
-    headers["x-api-key"] = env.ANTHROPIC_API_KEY;
+function createDeepAgentsRequestTransformations({
+  env: environment,
+  sandboxEnv: sandboxEnvironment,
+  auth: authenticationMode
+}) {
+  const matchUrl = authenticationMode === "ai-gateway" ? environment.ANTHROPIC_BASE_URL : environment.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com";
+  const transformations = [];
+  if (environment.ANTHROPIC_API_KEY != null && sandboxEnvironment.ANTHROPIC_API_KEY != null) {
+    transformations.push(
+      createCredentialRequestTransformation({
+        matchUrl,
+        matchHeaders: {
+          "x-api-key": sandboxEnvironment.ANTHROPIC_API_KEY
+        },
+        transformHeaders: {
+          "x-api-key": environment.ANTHROPIC_API_KEY
+        }
+      })
+    );
   }
-  if (env.ANTHROPIC_AUTH_TOKEN) {
-    headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;
+  if (environment.ANTHROPIC_AUTH_TOKEN != null && sandboxEnvironment.ANTHROPIC_AUTH_TOKEN != null) {
+    transformations.push(
+      createCredentialRequestTransformation({
+        matchUrl,
+        matchHeaders: {
+          Authorization: `Bearer ${sandboxEnvironment.ANTHROPIC_AUTH_TOKEN}`
+        },
+        transformHeaders: {
+          Authorization: `Bearer ${environment.ANTHROPIC_AUTH_TOKEN}`
+        }
+      })
+    );
   }
-  return Object.keys(headers).length === 0 ? [] : [
-    createCredentialRequestTransformation({
-      baseUrl: auth === "ai-gateway" ? env.ANTHROPIC_BASE_URL : env.ANTHROPIC_BASE_URL ?? "https://api.anthropic.com",
-      headers
-    })
-  ];
+  return transformations;
 }
 function resolveDeepAgentsEnv({
   auth,
@@ -243,7 +263,7 @@ var inboundMessageSchema = z.discriminatedUnion("type", [
 ]);
 
 // src/version.ts
-var VERSION = true ? "1.0.87" : "0.0.0-test";
+var VERSION = true ? "1.0.90" : "0.0.0-test";
 
 // src/deepagents-harness.ts
 var DEEPAGENTS_CLIENT_APP = `ai-sdk/harness-deepagents/${VERSION}`;
@@ -313,7 +333,8 @@ var deepAgentsBridgeCoordsSchema = z2.object({
   sandboxId: z2.string().optional()
 });
 var deepAgentsResumeStateSchema = z2.object({
-  bridge: deepAgentsBridgeCoordsSchema.optional()
+  bridge: deepAgentsBridgeCoordsSchema.optional(),
+  sandboxCredentialEnvironment: z2.record(z2.string(), z2.string()).optional()
 });
 function createDeepAgents(settings = {}) {
   return {
@@ -344,6 +365,11 @@ function createDeepAgents(settings = {}) {
         sandboxSession,
         abortSignal: startOpts.abortSignal
       });
+      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
+      const isResume = lifecycleState != null;
+      const isContinue = startOpts.continueFrom != null;
+      const resumeData = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data : void 0;
+      const coords = resumeData?.bridge;
       const authenticationMode = resolveDeepAgentsAuthenticationMode({
         auth: settings.auth
       });
@@ -351,20 +377,29 @@ function createDeepAgents(settings = {}) {
         auth: settings.auth
       });
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      let sandboxCredentialEnvironment;
+      let credentialsBrokered = false;
       if ("addRequestTransformations" in sandboxSession && sandboxSession.addRequestTransformations != null) {
-        const requestTransformations = createDeepAgentsRequestTransformations(
-          resolvedAuthEnvironment,
-          authenticationMode
-        );
+        sandboxCredentialEnvironment = resumeData?.sandboxCredentialEnvironment ?? await createSandboxCredentialEnvironment({
+          environment: resolvedAuthEnvironment,
+          credentialEnvironmentVariables: DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
+          credentialForwarding: settings.credentialForwarding
+        });
+        sandboxAuthEnvironment = {
+          ...resolvedAuthEnvironment,
+          ...sandboxCredentialEnvironment
+        };
+        const requestTransformations = createDeepAgentsRequestTransformations({
+          env: resolvedAuthEnvironment,
+          sandboxEnv: sandboxAuthEnvironment,
+          auth: authenticationMode
+        });
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
             requestTransformations
           );
         }
-        sandboxAuthEnvironment = maskSandboxCredentials({
-          environment: resolvedAuthEnvironment,
-          credentialEnvironmentVariables: DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES
-        });
+        credentialsBrokered = true;
       } else {
         warnCredentialBrokeringUnavailable();
       }
@@ -372,10 +407,6 @@ function createDeepAgents(settings = {}) {
         defaultWorkingDirectory,
         DEEPAGENTS_BOOTSTRAP_DIR
       );
-      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
-      const isResume = lifecycleState != null;
-      const isContinue = startOpts.continueFrom != null;
-      const coords = isResume && typeof lifecycleState?.data === "object" ? lifecycleState.data.bridge : void 0;
       const workDir = startOpts.sessionWorkDir;
       const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
       const bridgeStateDir = `${sessionDataDir}/bridge`;
@@ -420,6 +451,7 @@ function createDeepAgents(settings = {}) {
             bridgePort: coords.port,
             bridgeToken: coords.token,
             sandboxId,
+            sandboxCredentialEnvironment,
             isResume: true,
             attached: true,
             permissionMode,
@@ -450,7 +482,7 @@ function createDeepAgents(settings = {}) {
         });
         skillsPaths.push(homeSkillsRoot);
       }
-      const forwardedAuthEnvironment = await applyCredentialForwarding({
+      const forwardedAuthEnvironment = credentialsBrokered ? sandboxAuthEnvironment : await applyCredentialForwarding({
         environment: sandboxAuthEnvironment,
         credentialEnvironmentVariables: DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
         credentialForwarding: settings.credentialForwarding
@@ -529,6 +561,7 @@ function createDeepAgents(settings = {}) {
         bridgePort: boundPort,
         bridgeToken: token,
         sandboxId,
+        sandboxCredentialEnvironment,
         isResume,
         // Freshly spawned bridge — it must receive the instructions on the first prompt.
         attached: false,
@@ -642,6 +675,7 @@ function createSession({
   bridgePort,
   bridgeToken,
   sandboxId,
+  sandboxCredentialEnvironment,
   isResume,
   attached,
   skillsPaths,
@@ -826,6 +860,7 @@ function createSession({
         harnessId: "deepagents",
         specificationVersion: "harness-v1",
         data: {
+          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
           bridge: {
             port: bridgePort,
             token: bridgeToken,
@@ -849,6 +884,7 @@ function createSession({
         harnessId: "deepagents",
         specificationVersion: "harness-v1",
         data: {
+          ...sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment },
           bridge: {
             port: bridgePort,
             token: bridgeToken,
@@ -872,7 +908,7 @@ function createSession({
         type: "resume-session",
         harnessId: "deepagents",
         specificationVersion: "harness-v1",
-        data: {}
+        data: sandboxCredentialEnvironment == null ? {} : { sandboxCredentialEnvironment }
       };
       return payload;
     },

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/deepagents-harness.ts","../src/deepagents-bootstrap.ts","../src/deepagents-auth.ts","../src/deepagents-bridge-protocol.ts","../src/version.ts","../src/index.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { posix } from 'node:path';\nimport {\n  commonTool,\n  HarnessCapabilityUnsupportedError,\n  harnessV1DiagnosticFromBridgeFrame,\n  type HarnessV1,\n  type HarnessV1BuiltinTool,\n  type HarnessV1BuiltinToolFiltering,\n  type HarnessV1ContinueTurnState,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1NetworkSandboxSession,\n  type HarnessV1PermissionMode,\n  type HarnessV1Prompt,\n  type HarnessV1PromptControl,\n  type HarnessV1PortEndpoint,\n  type HarnessV1ResumeSessionState,\n  type HarnessV1Session,\n  type HarnessV1Skill,\n  type HarnessV1StreamPart,\n} from '@ai-sdk/harness';\nimport {\n  applyCredentialForwarding,\n  markBridgeStarting,\n  createBridgeErrorHandler,\n  createBridgeStartupError,\n  drainBridgeProcessStream,\n  forwardBridgeProcessStream,\n  getRestrictedSandboxSession,\n  maskSandboxCredentials,\n  resolveSandboxDefaultWorkingDirectory,\n  resolveSandboxHomeDir,\n  SandboxChannel,\n  shellQuote,\n  warnCredentialBrokeringUnavailable,\n  waitForBridgeReady,\n  writeSkills as writeHarnessSkills,\n} from '@ai-sdk/harness/utils';\nimport {\n  tool,\n  type Experimental_SandboxProcess,\n  type Experimental_SandboxSession as SandboxSession,\n} from '@ai-sdk/provider-utils';\nimport { WebSocket } from 'ws';\nimport { z } from 'zod/v4';\nimport {\n  DEEPAGENTS_BOOTSTRAP_DIR as BOOTSTRAP_DIR,\n  getDeepAgentsBootstrap,\n} from './deepagents-bootstrap';\nimport {\n  createDeepAgentsRequestTransformations,\n  DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n  resolveDeepAgentsAuthenticationMode,\n  resolveDeepAgentsEnv,\n  type DeepAgentsAuthOptions,\n} from './deepagents-auth';\nimport {\n  outboundMessageSchema,\n  type InboundMessage,\n  type OutboundMessage,\n} from './deepagents-bridge-protocol';\nimport { VERSION } from './version';\n\ntype DeepAgentsChannel = SandboxChannel<OutboundMessage, InboundMessage>;\n\n/**\n * Value to use in User-Agent and `x-client-app` headers.\n */\nconst DEEPAGENTS_CLIENT_APP = `ai-sdk/harness-deepagents/${VERSION}`;\n\nexport type DeepAgentsThinkingConfig =\n  | {\n      readonly type: 'adaptive';\n      readonly display?: 'summarized' | 'omitted';\n    }\n  | {\n      readonly type: 'enabled';\n      readonly budget_tokens: number;\n      readonly display?: 'summarized' | 'omitted';\n    }\n  | {\n      readonly type: 'disabled';\n    };\n\n// Skills source subpath, written under $HOME (out of the work dir so it can't clash with code cloned into the work dir) and also discovered from <workDir> for repo-provided skills.\nconst SKILLS_SOURCE_PATH = '/.agents/skills';\n\nexport type DeepAgentsHarnessSettings = {\n  readonly auth?: DeepAgentsAuthOptions;\n  /**\n   * Customizes each credential value before it is forwarded into a sandbox\n   * process. This does not restrict which credentials the harness adapter can\n   * discover, read, or otherwise access in the host process.\n   */\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  /** Model id for the DeepAgents runtime, e.g. `claude-sonnet-4` (converted to `provider:model`). */\n  readonly model?: string;\n  /**\n   * Controls Anthropic extended thinking for the Deep Agents model. Unset\n   * preserves the Deep Agents runtime default.\n   */\n  readonly thinking?: DeepAgentsThinkingConfig;\n  /**\n   * Controls how much effort Claude applies when adaptive thinking is enabled.\n   * Unset uses the LangChain Anthropic client default.\n   */\n  readonly effort?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';\n  /** Bridge port override; defaults to the sandbox's first declared port. */\n  readonly port?: number;\n  /**\n   * Override the host endpoint used to connect to the sandbox bridge. Required\n   * together with `port` when using a basic sandbox session.\n   */\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  /** Maximum milliseconds to wait for the bridge to advertise its port. Defaults to 120000. */\n  readonly startupTimeoutMs?: number;\n  /**\n   * Creates the authentication token used by the sandbox bridge. Defaults to\n   * a random 32-byte hexadecimal token.\n   */\n  readonly mintBridgeToken?: (sandboxId: string) => string;\n  /**\n   * Maximum LangGraph super-steps per turn before it errors.\n   * When omitted, the Deep Agents default applies.\n   */\n  readonly recursionLimit?: number;\n  /**\n   * MCP server definitions keyed by server name. Each definition uses the\n   * underlying runtime's native MCP server configuration format.\n   */\n  readonly mcpServers?: Record<string, unknown>;\n};\n\n// Every model-callable DeepAgents built-in, keyed by what the bridge emits (commonName ?? nativeName); all must be listed or AI SDK throws AI_NoSuchToolError.\nconst DEEPAGENTS_BUILTIN_TOOLS = {\n  read: commonTool('read', {\n    nativeName: 'read_file',\n    toolUseKind: 'readonly',\n    description: 'Read file contents',\n    inputSchema: z.object({ file_path: z.string() }),\n  }),\n  write: commonTool('write', {\n    nativeName: 'write_file',\n    toolUseKind: 'edit',\n    description: 'Create a file',\n    inputSchema: z.object({ file_path: z.string(), content: z.string() }),\n  }),\n  edit: commonTool('edit', {\n    nativeName: 'edit_file',\n    toolUseKind: 'edit',\n    description: 'Perform exact string replacements in a file',\n    inputSchema: z.object({\n      file_path: z.string(),\n      old_string: z.string(),\n      new_string: z.string(),\n    }),\n  }),\n  bash: commonTool('bash', {\n    nativeName: 'execute',\n    toolUseKind: 'bash',\n    description: 'Run a shell command',\n    inputSchema: z.object({ command: z.string() }),\n  }),\n  grep: commonTool('grep', {\n    nativeName: 'grep',\n    toolUseKind: 'readonly',\n    description: 'Search file contents',\n    inputSchema: z.object({ pattern: z.string() }),\n  }),\n  glob: commonTool('glob', {\n    nativeName: 'glob',\n    toolUseKind: 'readonly',\n    description: 'Find files matching a glob pattern',\n    inputSchema: z.object({ pattern: z.string() }),\n  }),\n  // No common-name equivalent — keyed by native name.\n  ls: tool({\n    description: 'List files in a directory',\n    inputSchema: z.object({ path: z.string().optional() }),\n  }),\n  task: tool({\n    description: 'Spawn a subagent to handle a delegated task',\n    inputSchema: z.object({\n      description: z.string().optional(),\n      subagent_type: z.string().optional(),\n    }),\n  }),\n  write_todos: tool({\n    description: 'Manage a structured todo list',\n    inputSchema: z.object({ todos: z.array(z.unknown()).optional() }),\n  }),\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\n// Live bridge coordinates returned by doDetach/doSuspendTurn so a later process can reattach.\nconst deepAgentsBridgeCoordsSchema = z.object({\n  port: z.number(),\n  token: z.string(),\n  lastSeenEventId: z.number(),\n  sandboxId: z.string().optional(),\n});\nconst deepAgentsResumeStateSchema = z.object({\n  bridge: deepAgentsBridgeCoordsSchema.optional(),\n});\ntype DeepAgentsBridgeCoords = z.infer<typeof deepAgentsBridgeCoordsSchema>;\n\nexport function createDeepAgents(\n  settings: DeepAgentsHarnessSettings = {},\n): HarnessV1<typeof DEEPAGENTS_BUILTIN_TOOLS> {\n  return {\n    specificationVersion: 'harness-v1',\n    harnessId: 'deepagents',\n    builtinTools: DEEPAGENTS_BUILTIN_TOOLS,\n    // Built-in tool approvals are gated in-bridge via DeepAgents' interruptOn (HITL) middleware.\n    supportsBuiltinToolApprovals: true,\n    lifecycleStateSchema: deepAgentsResumeStateSchema,\n    getBootstrap: getDeepAgentsBootstrap,\n    doStart: async startOpts => {\n      const permissionMode = startOpts.permissionMode;\n      const sandboxSession = startOpts.sandboxSession;\n      const toolSafeSandboxSession =\n        getRestrictedSandboxSession(sandboxSession);\n      const sandboxId = 'id' in sandboxSession ? sandboxSession.id : undefined;\n      validateBasicSandboxSettings({\n        sandboxSession,\n        port: settings.port,\n        portEndpoint: settings.portEndpoint,\n      });\n      if (settings.mintBridgeToken != null && sandboxId == null) {\n        throw new HarnessCapabilityUnsupportedError({\n          harnessId: 'deepagents',\n          message:\n            'The deepagents harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.',\n        });\n      }\n      const defaultWorkingDirectory =\n        await resolveSandboxDefaultWorkingDirectory({\n          sandboxSession,\n          abortSignal: startOpts.abortSignal,\n        });\n      const authenticationMode = resolveDeepAgentsAuthenticationMode({\n        auth: settings.auth,\n      });\n      const resolvedAuthEnvironment = resolveDeepAgentsEnv({\n        auth: settings.auth,\n      });\n      let sandboxAuthEnvironment = resolvedAuthEnvironment;\n      if (\n        'addRequestTransformations' in sandboxSession &&\n        sandboxSession.addRequestTransformations != null\n      ) {\n        const requestTransformations = createDeepAgentsRequestTransformations(\n          resolvedAuthEnvironment,\n          authenticationMode,\n        );\n        if (requestTransformations.length > 0) {\n          await sandboxSession.addRequestTransformations(\n            requestTransformations,\n          );\n        }\n        sandboxAuthEnvironment = maskSandboxCredentials({\n          environment: resolvedAuthEnvironment,\n          credentialEnvironmentVariables:\n            DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n        });\n      } else {\n        warnCredentialBrokeringUnavailable();\n      }\n      const bootstrapDir = posix.resolve(\n        defaultWorkingDirectory,\n        BOOTSTRAP_DIR,\n      );\n\n      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;\n      const isResume = lifecycleState != null;\n      const isContinue = startOpts.continueFrom != null;\n      const coords =\n        isResume && typeof lifecycleState?.data === 'object'\n          ? (lifecycleState.data as { bridge?: DeepAgentsBridgeCoords }).bridge\n          : undefined;\n\n      const workDir = startOpts.sessionWorkDir;\n      const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;\n      const bridgeStateDir = `${sessionDataDir}/bridge`;\n      const timeoutMs = settings.startupTimeoutMs ?? 120_000;\n\n      const report = startOpts.observability?.report;\n      const onDiagnostic = report\n        ? (frame: Parameters<typeof harnessV1DiagnosticFromBridgeFrame>[0]) =>\n            report(\n              harnessV1DiagnosticFromBridgeFrame(frame, {\n                sessionId: startOpts.sessionId,\n                timestamp: Date.now(),\n              }),\n            )\n        : undefined;\n      const onBridgeError = createBridgeErrorHandler({\n        harnessId: 'deepagents',\n        sessionId: startOpts.sessionId,\n      });\n\n      // Attach to the still-running bridge (continueFrom replays past the cursor); on failure fall through to a fresh spawn.\n      if (coords) {\n        try {\n          const endpoint = await resolveBridgeEndpoint({\n            sandboxSession,\n            override: settings.portEndpoint,\n            port: coords.port,\n          });\n          const attachEndpoint = withBridgeToken({\n            endpoint,\n            token: coords.token,\n          });\n          const attachChannel: DeepAgentsChannel = new SandboxChannel({\n            connect: () => openWebSocket(attachEndpoint),\n            outboundSchema: outboundMessageSchema,\n            initialLastSeenEventId: coords.lastSeenEventId,\n            onDiagnostic,\n            onBridgeError,\n          });\n          await attachChannel.open(isContinue ? { resume: true } : undefined);\n          return createSession({\n            sessionId: startOpts.sessionId,\n            channel: attachChannel,\n            proc: undefined,\n            model: settings.model,\n            thinking: settings.thinking,\n            effort: settings.effort,\n            bridgePort: coords.port,\n            bridgeToken: coords.token,\n            sandboxId,\n            isResume: true,\n            attached: true,\n            permissionMode,\n            builtinToolFiltering: startOpts.builtinToolFiltering,\n            recursionLimit: settings.recursionLimit,\n            mcpServers: settings.mcpServers,\n          });\n        } catch {\n          // Bridge no longer reachable — recover by respawning below.\n        }\n      }\n\n      const port = resolveBridgePort({\n        sandboxSession,\n        override: settings.port,\n      });\n      const token =\n        settings.mintBridgeToken == null\n          ? randomBytes(32).toString('hex')\n          : settings.mintBridgeToken(sandboxId!);\n\n      // Always discover repo-provided skills under <workDir>/.agents/skills (e.g. a cloned repo); a missing dir is tolerated by deepagents.\n      // Absolute paths: LocalShellBackend (non-virtual) treats a leading-slash path as a real fs path.\n      const skillsPaths = [`${workDir}${SKILLS_SOURCE_PATH}`];\n      // Host-provided skills go to $HOME (out of the work dir) and take priority (listed last → wins on name collision).\n      if ((startOpts.skills?.length ?? 0) > 0) {\n        const homeDir = await resolveSandboxHomeDir({\n          sandbox: toolSafeSandboxSession,\n          abortSignal: startOpts.abortSignal,\n        });\n        const homeSkillsRoot = `${homeDir}${SKILLS_SOURCE_PATH}`;\n        await writeSkills({\n          sandbox: toolSafeSandboxSession,\n          root: homeSkillsRoot,\n          skills: startOpts.skills ?? [],\n          abortSignal: startOpts.abortSignal,\n        });\n        skillsPaths.push(homeSkillsRoot);\n      }\n\n      const forwardedAuthEnvironment = await applyCredentialForwarding({\n        environment: sandboxAuthEnvironment,\n        credentialEnvironmentVariables:\n          DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n        credentialForwarding: settings.credentialForwarding,\n      });\n      const env = {\n        ...forwardedAuthEnvironment,\n        AI_SDK_HARNESS_CLIENT_APP: DEEPAGENTS_CLIENT_APP,\n        BRIDGE_CHANNEL_TOKEN: token,\n        BRIDGE_WS_PORT: String(port),\n      };\n\n      await toolSafeSandboxSession.run({\n        command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,\n        abortSignal: startOpts.abortSignal,\n      });\n\n      await markBridgeStarting({\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'deepagents',\n        abortSignal: startOpts.abortSignal,\n      });\n\n      const proc = await toolSafeSandboxSession.spawn({\n        command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)} --bootstrap-dir ${shellQuote(bootstrapDir)}`,\n        env,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stderrTail: string[] = [];\n      const bridgeStderrDone = forwardBridgeProcessStream({\n        stream: proc.stderr,\n        streamName: 'stderr',\n        source: 'deepagents',\n        collectTail: stderrTail,\n      });\n\n      const { port: boundPort } = await waitForBridgeReady({\n        proc,\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'deepagents',\n        timeoutMs,\n        abortSignal: startOpts.abortSignal,\n        createTimeoutError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'deepagents bridge did not become ready in time.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n        createExitError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'deepagents bridge exited before becoming ready.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n      });\n      void drainBridgeProcessStream(proc.stdout);\n\n      const endpoint = await resolveBridgeEndpoint({\n        sandboxSession,\n        override: settings.portEndpoint,\n        port: boundPort,\n      });\n      const bridgeEndpoint = withBridgeToken({ endpoint, token });\n\n      const channel: DeepAgentsChannel = new SandboxChannel({\n        connect: () => openWebSocket(bridgeEndpoint),\n        outboundSchema: outboundMessageSchema,\n        onDiagnostic,\n        onBridgeError,\n      });\n      await channel.open();\n\n      return createSession({\n        sessionId: startOpts.sessionId,\n        channel,\n        proc,\n        model: settings.model,\n        thinking: settings.thinking,\n        effort: settings.effort,\n        bridgePort: boundPort,\n        bridgeToken: token,\n        sandboxId,\n        isResume,\n        // Freshly spawned bridge — it must receive the instructions on the first prompt.\n        attached: false,\n        skillsPaths,\n        permissionMode,\n        builtinToolFiltering: startOpts.builtinToolFiltering,\n        recursionLimit: settings.recursionLimit,\n        mcpServers: settings.mcpServers,\n      });\n    },\n  };\n}\n\nfunction resolveBridgePort({\n  sandboxSession,\n  override,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: number | undefined;\n}): number {\n  if (override !== undefined) return override;\n  if ('ports' in sandboxSession && sandboxSession.ports.length > 0) {\n    return sandboxSession.ports[0];\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'deepagents',\n    message:\n      'The deepagents harness needs a TCP port exposed by the sandbox. ' +\n      'Create the sandbox with `ports: [<port>]` or pass `createDeepAgents({ port })`.',\n  });\n}\n\nfunction validateBasicSandboxSettings({\n  sandboxSession,\n  port,\n  portEndpoint,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  port: number | undefined;\n  portEndpoint: HarnessV1PortEndpoint | undefined;\n}): void {\n  if ('getPortEndpoint' in sandboxSession) return;\n  if (port == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message:\n        'The deepagents harness requires an explicit `port` when using a basic sandbox session.',\n    });\n  }\n  if (portEndpoint == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message:\n        'The deepagents harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n    });\n  }\n}\n\nasync function resolveBridgeEndpoint({\n  sandboxSession,\n  override,\n  port,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: HarnessV1PortEndpoint | undefined;\n  port: number;\n}): Promise<HarnessV1PortEndpoint> {\n  if (override != null) return override;\n  if ('getPortEndpoint' in sandboxSession) {\n    return sandboxSession.getPortEndpoint({ port, protocol: 'ws' });\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'deepagents',\n    message:\n      'The deepagents harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n  });\n}\n\n// Materialize each skill as a native deepagents `<name>/SKILL.md` folder (+ attached files) under the given root, so skills load on demand and file references resolve.\nasync function writeSkills({\n  sandbox,\n  root,\n  skills,\n  abortSignal,\n}: {\n  sandbox: SandboxSession;\n  root: string;\n  skills: ReadonlyArray<HarnessV1Skill>;\n  abortSignal?: AbortSignal;\n}): Promise<void> {\n  /*\n   * DeepAgents requires each `SKILL.md` frontmatter name to match the parent\n   * directory name, so keep the stricter lowercase skill-name policy here.\n   */\n  await writeHarnessSkills({\n    sandbox,\n    rootDir: root,\n    skills,\n    abortSignal,\n    skillNamePattern: /^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/,\n    invalidSkillNameMessage: ({ name }) =>\n      `Invalid deepagents skill name '${name}': must be lowercase alphanumeric with hyphens, 1-64 chars.`,\n    filePathMode: 'strip-leading-slashes',\n    invalidSkillFilePathMessage: ({ skillName, filePath }) =>\n      `Invalid skill file path for '${skillName}': ${filePath}`,\n  });\n}\n\nfunction openWebSocket({\n  url,\n  headers,\n}: HarnessV1PortEndpoint): Promise<WebSocket> {\n  return new Promise((resolve, reject) => {\n    const ws = new WebSocket(url, {\n      headers: headers == null ? undefined : { ...headers },\n    });\n    const onOpen = () => {\n      ws.off('error', onError);\n      resolve(ws);\n    };\n    const onError = (err: Error) => {\n      ws.off('open', onOpen);\n      reject(err);\n    };\n    ws.once('open', onOpen);\n    ws.once('error', onError);\n  });\n}\n\nfunction withBridgeToken({\n  endpoint,\n  token,\n}: {\n  endpoint: HarnessV1PortEndpoint;\n  token: string;\n}): HarnessV1PortEndpoint {\n  const bridgeUrl = new URL(endpoint.url);\n  bridgeUrl.searchParams.set('agent_bridge_token', token);\n  return { ...endpoint, url: bridgeUrl.toString() };\n}\n\nfunction createSession({\n  sessionId,\n  channel,\n  proc,\n  model,\n  thinking,\n  effort,\n  bridgePort,\n  bridgeToken,\n  sandboxId,\n  isResume,\n  attached,\n  skillsPaths,\n  permissionMode,\n  builtinToolFiltering,\n  recursionLimit,\n  mcpServers,\n}: {\n  sessionId: string;\n  channel: DeepAgentsChannel;\n  // Undefined on attach — the live bridge was spawned by another process.\n  proc: Experimental_SandboxProcess | undefined;\n  model: string | undefined;\n  thinking: DeepAgentsThinkingConfig | undefined;\n  effort: 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;\n  bridgePort: number;\n  bridgeToken: string;\n  sandboxId: string | undefined;\n  isResume: boolean;\n  // True only when attaching to a live bridge that already built the agent with\n  // its instructions. A fresh spawn (incl. a respawn on attach failure or a\n  // stop-resume) starts a new bridge that must receive the instructions again.\n  attached: boolean;\n  skillsPaths?: string[];\n  permissionMode?: HarnessV1PermissionMode;\n  builtinToolFiltering?: HarnessV1BuiltinToolFiltering;\n  recursionLimit?: number;\n  mcpServers?: Record<string, unknown>;\n}): HarnessV1Session {\n  let stopped = false;\n  let instructionsApplied = attached;\n\n  const wireTurn = (turnOpts: {\n    emit: (event: HarnessV1StreamPart) => void;\n    abortSignal?: AbortSignal;\n  }): HarnessV1PromptControl => {\n    let pendingResolve: (() => void) | undefined;\n    let pendingReject: ((err: unknown) => void) | undefined;\n    const done = new Promise<void>((resolve, reject) => {\n      pendingResolve = resolve;\n      pendingReject = reject;\n    });\n\n    const unsubs: Array<() => void> = [];\n    const forward = (event: HarnessV1StreamPart) => {\n      try {\n        turnOpts.emit(event);\n      } catch {}\n    };\n\n    const eventTypes = [\n      'stream-start',\n      'text-start',\n      'text-delta',\n      'text-end',\n      'reasoning-start',\n      'reasoning-delta',\n      'reasoning-end',\n      'tool-call',\n      'tool-approval-request',\n      'tool-result',\n      'file-change',\n      'finish-step',\n      'raw',\n    ] as const;\n    let isSettled = false;\n    const settleSuccess = () => {\n      if (isSettled) return;\n      isSettled = true;\n      for (const u of unsubs) u();\n      pendingResolve!();\n    };\n    const settleError = (err: unknown) => {\n      if (isSettled) return;\n      isSettled = true;\n      for (const u of unsubs) u();\n      pendingReject!(err);\n    };\n\n    for (const type of eventTypes) {\n      unsubs.push(channel.on(type, msg => forward(msg)));\n    }\n    unsubs.push(\n      channel.on('finish', msg => {\n        forward(msg);\n        settleSuccess();\n      }),\n    );\n    unsubs.push(\n      channel.on('error', msg => {\n        forward(msg);\n        settleError(msg.error);\n      }),\n    );\n\n    // A `'suspended'` close is a graceful slice-boundary freeze (suspend/detach keep the bridge alive for continuation); end the turn cleanly. Any other close is an unexpected bridge failure.\n    const onClose = (_code: number, reason: string) => {\n      if (isSettled) return;\n      if (reason === 'suspended') {\n        settleSuccess();\n        return;\n      }\n      settleError(\n        new Error('deepagents bridge closed before the turn finished.'),\n      );\n    };\n    channel.onClose(onClose);\n\n    const onAbort = () => {\n      if (isSettled) return;\n      try {\n        channel.send({ type: 'abort' });\n      } catch {}\n      settleError(\n        turnOpts.abortSignal?.reason ??\n          new DOMException('Aborted', 'AbortError'),\n      );\n    };\n    if (turnOpts.abortSignal) {\n      if (turnOpts.abortSignal.aborted) {\n        onAbort();\n      } else {\n        turnOpts.abortSignal.addEventListener('abort', onAbort, { once: true });\n      }\n    }\n\n    return {\n      submitToolResult: async input => {\n        channel.send({\n          type: 'tool-result',\n          toolCallId: input.toolCallId,\n          output: input.output,\n          isError: input.isError,\n        });\n      },\n      submitToolApproval: async input => {\n        channel.send({\n          type: 'tool-approval-response',\n          approvalId: input.approvalId,\n          approved: input.approved,\n          ...(input.reason != null ? { reason: input.reason } : {}),\n        });\n      },\n      done,\n    };\n  };\n\n  const unsupported = (capability: string): never => {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message: `Harness 'deepagents' does not support ${capability} yet.`,\n    });\n  };\n\n  return {\n    sessionId,\n    isResume,\n    modelId: model,\n    doPromptTurn: async promptOpts => {\n      if (\n        promptOpts.responseFormat?.type === 'json' &&\n        promptOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'deepagents' requires a JSON schema for structured output.\",\n          harnessId: 'deepagents',\n        });\n      }\n      const control = wireTurn({\n        emit: promptOpts.emit,\n        abortSignal: promptOpts.abortSignal,\n      });\n\n      const applyInstructions =\n        !instructionsApplied && !!promptOpts.instructions;\n      instructionsApplied = true;\n\n      channel.send({\n        type: 'start',\n        prompt: extractUserText(promptOpts.prompt),\n        ...(applyInstructions ? { instructions: promptOpts.instructions } : {}),\n        tools: (promptOpts.tools ?? []).map(t => ({\n          name: t.name,\n          description: t.description,\n          inputSchema: t.inputSchema,\n        })),\n        ...(promptOpts.responseFormat == null\n          ? {}\n          : { responseFormat: promptOpts.responseFormat }),\n        ...(model ? { model } : {}),\n        ...(thinking ? { thinking } : {}),\n        ...(effort ? { effort } : {}),\n        ...(skillsPaths?.length ? { skillsPaths } : {}),\n        ...(permissionMode ? { permissionMode } : {}),\n        ...(builtinToolFiltering ? { builtinToolFiltering } : {}),\n        ...(recursionLimit != null ? { recursionLimit } : {}),\n        ...(mcpServers == null ? {} : { mcpServers }),\n      });\n\n      return control;\n    },\n    doContinueTurn: async continueOpts => {\n      if (\n        continueOpts.responseFormat?.type === 'json' &&\n        continueOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'deepagents' requires a JSON schema for structured output.\",\n          harnessId: 'deepagents',\n        });\n      }\n      // Attach/replay: doStart opened with `{ resume: true }` so the bridge replays past the cursor; no `start` is sent (that would clear the replay log).\n      return wireTurn({\n        emit: continueOpts.emit,\n        abortSignal: continueOpts.abortSignal,\n      });\n    },\n    doSuspendTurn: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is stopped; cannot suspend.`,\n        );\n      }\n      stopped = true;\n      // Freeze the active turn at the cursor, leaving the bridge running so the next slice replays the tail.\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ContinueTurnState = {\n        type: 'continue-turn',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data: {\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doDetach: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is already stopped; cannot detach.`,\n        );\n      }\n      stopped = true;\n      // Park between turns: close the host socket but leave the bridge running for a later reattach via these coords.\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data: {\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doCompact: async () => unsupported('manual compaction'),\n    doStop: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is already stopped; cannot stop.`,\n        );\n      }\n      stopped = true;\n      await teardown({ channel, proc, operation: 'stop' });\n      // In-memory conversation is lost on teardown; the sandbox snapshot preserves the workspace files, not the conversation.\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data: {},\n      };\n      return payload;\n    },\n    doDestroy: async () => {\n      if (stopped) return;\n      stopped = true;\n      await teardown({ channel, proc, operation: 'destroy' });\n    },\n  };\n}\n\nasync function teardown({\n  channel,\n  proc,\n  operation,\n}: {\n  channel: DeepAgentsChannel;\n  proc: Experimental_SandboxProcess | undefined;\n  operation: 'stop' | 'destroy';\n}): Promise<void> {\n  channel.beginClose();\n  try {\n    if (!channel.isClosed()) {\n      channel.send({ type: operation });\n    }\n  } catch {}\n  let stopTimer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    if (proc) {\n      await Promise.race([\n        proc.wait(),\n        new Promise<void>(resolve => {\n          stopTimer = setTimeout(resolve, 5000);\n          stopTimer.unref?.();\n        }),\n      ]);\n    }\n  } finally {\n    if (stopTimer) clearTimeout(stopTimer);\n    try {\n      await proc?.kill();\n    } catch {}\n    channel.close();\n  }\n}\n\n// Reduce the prompt to plain user text; non-text parts are unsupported.\nfunction extractUserText(prompt: HarnessV1Prompt): string {\n  if (typeof prompt === 'string') return prompt;\n  const { content } = prompt;\n  if (typeof content === 'string') return content;\n  const parts: string[] = [];\n  for (const part of content) {\n    if (part.type !== 'text') {\n      throw new HarnessCapabilityUnsupportedError({\n        harnessId: 'deepagents',\n        message: `The deepagents harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`,\n      });\n    }\n    parts.push(part.text);\n  }\n  return parts.join('\\n\\n');\n}\n","import { readFile } from 'node:fs/promises';\nimport { fileURLToPath } from 'node:url';\nimport type { HarnessV1Bootstrap } from '@ai-sdk/harness';\n\n/*\n * Bootstrap is derived state stored under the sandbox's default working\n * directory so snapshot-capable providers preserve its installation and\n * recipe marker without requiring root filesystem access.\n */\nexport const DEEPAGENTS_BOOTSTRAP_DIR = '.harness-bootstrap/deepagents';\n\n/*\n * Pinned ripgrep release and per-architecture tarball checksums are verified\n * before installation.\n */\nconst RIPGREP_VERSION = '14.1.1';\nconst RIPGREP_SHA256_X64 =\n  '4cf9f2741e6c465ffdb7c26f38056a59e2a2544b51f7cc128ef28337eeae4d8e';\nconst RIPGREP_SHA256_ARM =\n  'c827481c4ff4ea10c9dc7a4022c8de5db34a5737cb74484d62eb94a95841ab2f';\n\nlet cachedBootstrap: HarnessV1Bootstrap | undefined;\n\nexport async function getDeepAgentsBootstrap(): Promise<HarnessV1Bootstrap> {\n  if (cachedBootstrap != null) return cachedBootstrap;\n  const [bridge, pkg, lock] = await Promise.all([\n    readBridgeAsset('index.mjs'),\n    readBridgeAsset('package.json'),\n    readBridgeAsset('pnpm-lock.yaml'),\n  ]);\n  cachedBootstrap = {\n    harnessId: 'deepagents',\n    bootstrapDir: DEEPAGENTS_BOOTSTRAP_DIR,\n    files: [\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/package.json`, content: pkg },\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },\n    ],\n    commands: [\n      { command: installRipgrepCommand() },\n      {\n        command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',\n      },\n    ],\n  };\n  return cachedBootstrap;\n}\n\n/*\n * DeepAgents' grep shells out to `rg`. Without it, the fallback reads the\n * entire workdir, including node_modules, into memory and can run out of\n * memory. The checksum-verified installation is skipped when `rg` exists.\n */\nfunction installRipgrepCommand(): string {\n  const v = RIPGREP_VERSION;\n  return [\n    'command -v rg >/dev/null 2>&1 || {',\n    'case \"$(uname -m)\" in',\n    `aarch64) a=aarch64-unknown-linux-gnu; sha=${RIPGREP_SHA256_ARM} ;;`,\n    `*) a=x86_64-unknown-linux-musl; sha=${RIPGREP_SHA256_X64} ;;`,\n    'esac;',\n    `f=/tmp/ripgrep-${v}.tar.gz;`,\n    `curl -fsSL \"https://github.com/BurntSushi/ripgrep/releases/download/${v}/ripgrep-${v}-$a.tar.gz\" -o \"$f\"`,\n    '&& echo \"$sha  $f\" | sha256sum -c -',\n    '&& tar xzf \"$f\" -C /tmp',\n    `&& mv \"/tmp/ripgrep-${v}-$a/rg\" /usr/local/bin/rg && chmod +x /usr/local/bin/rg;`,\n    '}',\n  ].join(' ');\n}\n\nasync function readBridgeAsset(name: string): Promise<string> {\n  const candidates = [\n    new URL(`./bridge/${name}`, import.meta.url),\n    new URL(`../bridge/${name}`, import.meta.url),\n  ];\n  let lastErr: unknown;\n  for (const url of candidates) {\n    try {\n      return await readFile(fileURLToPath(url), 'utf8');\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code !== 'ENOENT') throw err;\n      lastErr = err;\n    }\n  }\n  throw lastErr ?? new Error(`bridge asset not found: ${name}`);\n}\n","import type { HarnessV1RequestTransformation } from '@ai-sdk/harness';\nimport {\n  createCredentialRequestTransformation,\n  getAiGatewayAuthFromEnv,\n} from '@ai-sdk/harness/utils';\n\nexport const DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES = [\n  'AI_GATEWAY_API_KEY',\n  'ANTHROPIC_API_KEY',\n  'ANTHROPIC_AUTH_TOKEN',\n] as const;\n\nexport function createDeepAgentsRequestTransformations(\n  env: Record<string, string>,\n  auth: DeepAgentsResolvedAuthenticationMode,\n): HarnessV1RequestTransformation[] {\n  const headers: Record<string, string> = {};\n  if (env.ANTHROPIC_API_KEY) {\n    headers['x-api-key'] = env.ANTHROPIC_API_KEY;\n  }\n  if (env.ANTHROPIC_AUTH_TOKEN) {\n    headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;\n  }\n  return Object.keys(headers).length === 0\n    ? []\n    : [\n        createCredentialRequestTransformation({\n          baseUrl:\n            auth === 'ai-gateway'\n              ? env.ANTHROPIC_BASE_URL\n              : (env.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com'),\n          headers,\n        }),\n      ];\n}\n\nexport type DeepAgentsResolvedAuthenticationMode = 'anthropic' | 'ai-gateway';\n\nexport type DeepAgentsAuthenticationMode =\n  | DeepAgentsResolvedAuthenticationMode\n  | 'auto';\n\n/**\n * @deprecated Passing an object to auth options is deprecated. Use a `DeepAgentsAuthenticationMode` string value (\"auto\" | \"anthropic\" | \"ai-gateway\") instead, and pass credentials via environment variables.\n */\nexport type LegacyDeepAgentsAuthOptions = {\n  readonly anthropic?: {\n    readonly apiKey?: string;\n    readonly authToken?: string;\n    readonly baseUrl?: string;\n  };\n  readonly gateway?: {\n    readonly apiKey?: string;\n    readonly baseUrl?: string;\n  };\n};\n\nexport type DeepAgentsAuthOptions =\n  | DeepAgentsAuthenticationMode\n  | LegacyDeepAgentsAuthOptions;\n\n// DeepAgents always drives the Anthropic client. Non-Anthropic models reach it\n// through AI Gateway's Anthropic-compatible endpoint, which translates to any\n// model (Gemini, OpenAI, etc.), tool calls included.\nexport function resolveDeepAgentsEnv({\n  auth,\n  processEnv = process.env,\n}: {\n  auth?: DeepAgentsAuthOptions;\n  processEnv?: Record<string, string | undefined>;\n}): Record<string, string> {\n  const normalizedAuth = normalizeDeepAgentsAuthToLegacyAuth(auth);\n\n  if (normalizedAuth?.anthropic) {\n    return pickAnthropic({ explicit: normalizedAuth.anthropic, processEnv });\n  }\n\n  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });\n  if (normalizedAuth?.gateway) {\n    return pickGateway({\n      explicit: normalizedAuth.gateway,\n      gatewayAuthFromEnv,\n    });\n  }\n  if (gatewayAuthFromEnv.apiKey) {\n    return pickGateway({ explicit: {}, gatewayAuthFromEnv });\n  }\n\n  return pickAnthropic({ processEnv });\n}\n\nexport function resolveDeepAgentsAuthenticationMode({\n  auth,\n  processEnv = process.env,\n}: {\n  auth?: DeepAgentsAuthOptions;\n  processEnv?: Record<string, string | undefined>;\n}): DeepAgentsResolvedAuthenticationMode {\n  if (auth === 'anthropic' || (typeof auth !== 'string' && auth?.anthropic)) {\n    return 'anthropic';\n  }\n  if (auth === 'ai-gateway' || (typeof auth !== 'string' && auth?.gateway)) {\n    return 'ai-gateway';\n  }\n  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey\n    ? 'ai-gateway'\n    : 'anthropic';\n}\n\nfunction normalizeDeepAgentsAuthToLegacyAuth(\n  auth: DeepAgentsAuthOptions | undefined,\n): LegacyDeepAgentsAuthOptions | undefined {\n  if (auth == null || auth === 'auto') {\n    return undefined;\n  }\n  if (typeof auth === 'string') {\n    switch (auth) {\n      case 'anthropic':\n        return { anthropic: {} };\n      case 'ai-gateway':\n        return { gateway: {} };\n      default:\n        return undefined;\n    }\n  }\n\n  console.warn(\n    '[deepagents] Passing an object to auth options is deprecated. Use a string mode (\"auto\" | \"anthropic\" | \"ai-gateway\") instead, and pass credentials via environment variables.',\n  );\n  return auth;\n}\n\nfunction pickAnthropic({\n  explicit,\n  processEnv,\n}: {\n  explicit?: NonNullable<LegacyDeepAgentsAuthOptions['anthropic']>;\n  processEnv: Record<string, string | undefined>;\n}): Record<string, string> {\n  const env: Record<string, string> = {};\n  const apiKey = explicit?.apiKey ?? processEnv.ANTHROPIC_API_KEY;\n  if (apiKey) env.ANTHROPIC_API_KEY = apiKey;\n  const authToken = explicit?.authToken ?? processEnv.ANTHROPIC_AUTH_TOKEN;\n  if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken;\n  const baseUrl = explicit?.baseUrl ?? processEnv.ANTHROPIC_BASE_URL;\n  if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;\n  return env;\n}\n\nfunction pickGateway({\n  explicit,\n  gatewayAuthFromEnv,\n}: {\n  explicit: NonNullable<LegacyDeepAgentsAuthOptions['gateway']>;\n  gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;\n}): Record<string, string> {\n  const apiKey = explicit.apiKey ?? gatewayAuthFromEnv.apiKey;\n  // The Anthropic SDK appends `/v1/messages`, so the gateway base stays at its root.\n  const baseUrl = (explicit.baseUrl ?? gatewayAuthFromEnv.baseUrl).replace(\n    /\\/+$/,\n    '',\n  );\n  const env: Record<string, string> = {};\n  if (apiKey) {\n    env.AI_GATEWAY_API_KEY = apiKey;\n    env.ANTHROPIC_API_KEY = apiKey;\n  }\n  env.ANTHROPIC_BASE_URL = baseUrl;\n  return env;\n}\n","import {\n  harnessV1BridgeInboundCommandSchemas,\n  harnessV1BridgeOutboundMessageSchema,\n  harnessV1BridgeReadySchema,\n  harnessV1BridgeStartBaseSchema,\n} from '@ai-sdk/harness';\nimport { z } from 'zod/v4';\n\n// Deep Agents bridge wire protocol; only the `start` payload is adapter-specific.\nexport const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;\nexport type OutboundMessage = z.infer<typeof outboundMessageSchema>;\n\nconst thinkingSchema = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('adaptive'),\n    display: z.enum(['summarized', 'omitted']).optional(),\n  }),\n  z.object({\n    type: z.literal('enabled'),\n    budget_tokens: z.number(),\n    display: z.enum(['summarized', 'omitted']).optional(),\n  }),\n  z.object({ type: z.literal('disabled') }),\n]);\n\nexport const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({\n  mcpServers: z.record(z.string(), z.unknown()).optional(),\n  /*\n   * Appended to Deep Agents's native system prompt when the bridge constructs\n   * the session's agent.\n   */\n  instructions: z.string().optional(),\n  thinking: thinkingSchema.optional(),\n  effort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),\n  // In-backend skills source dirs ($HOME and <workDir>), passed to createDeepAgent({ skills }).\n  skillsPaths: z.array(z.string()).optional(),\n  // Max LangGraph super-steps per turn (streamEvents recursionLimit).\n  recursionLimit: z.number().optional(),\n});\n\nexport type StartMessage = z.infer<typeof startMessageSchema>;\n\nexport const inboundMessageSchema = z.discriminatedUnion('type', [\n  startMessageSchema,\n  ...harnessV1BridgeInboundCommandSchemas,\n]);\nexport type InboundMessage = z.infer<typeof inboundMessageSchema>;\n\nexport const bridgeReadySchema = harnessV1BridgeReadySchema;\nexport type BridgeReady = z.infer<typeof bridgeReadySchema>;\n","// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createDeepAgents } from './deepagents-harness';\n\n/** Default `deepagents` harness instance; equivalent to `createDeepAgents()`. */\nexport const deepAgents = createDeepAgents();\n\nexport { createDeepAgents } from './deepagents-harness';\nexport { VERSION } from './version';\nexport type {\n  DeepAgentsHarnessSettings,\n  DeepAgentsThinkingConfig,\n} from './deepagents-harness';\nexport type {\n  DeepAgentsAuthenticationMode,\n  DeepAgentsAuthOptions,\n} from './deepagents-auth';\n"],"mappings":";AAAA,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAeK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,OACV;AACP;AAAA,EACE;AAAA,OAGK;AACP,SAAS,iBAAiB;AAC1B,SAAS,KAAAA,UAAS;;;AC5ClB,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAQvB,IAAM,2BAA2B;AAMxC,IAAM,kBAAkB;AACxB,IAAM,qBACJ;AACF,IAAM,qBACJ;AAEF,IAAI;AAEJ,eAAsB,yBAAsD;AAC1E,MAAI,mBAAmB,KAAM,QAAO;AACpC,QAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC5C,gBAAgB,WAAW;AAAA,IAC3B,gBAAgB,cAAc;AAAA,IAC9B,gBAAgB,gBAAgB;AAAA,EAClC,CAAC;AACD,oBAAkB;AAAA,IAChB,WAAW;AAAA,IACX,cAAc;AAAA,IACd,OAAO;AAAA,MACL,EAAE,MAAM,GAAG,wBAAwB,eAAe,SAAS,OAAO;AAAA,MAClE,EAAE,MAAM,GAAG,wBAAwB,iBAAiB,SAAS,IAAI;AAAA,MACjE,EAAE,MAAM,GAAG,wBAAwB,mBAAmB,SAAS,KAAK;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,MACR,EAAE,SAAS,sBAAsB,EAAE;AAAA,MACnC;AAAA,QACE,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,wBAAgC;AACvC,QAAM,IAAI;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,6CAA6C,kBAAkB;AAAA,IAC/D,uCAAuC,kBAAkB;AAAA,IACzD;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,uEAAuE,CAAC,YAAY,CAAC;AAAA,IACrF;AAAA,IACA;AAAA,IACA,uBAAuB,CAAC;AAAA,IACxB;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,eAAe,gBAAgB,MAA+B;AAC5D,QAAM,aAAa;AAAA,IACjB,IAAI,IAAI,YAAY,IAAI,IAAI,YAAY,GAAG;AAAA,IAC3C,IAAI,IAAI,aAAa,IAAI,IAAI,YAAY,GAAG;AAAA,EAC9C;AACA,MAAI;AACJ,aAAW,OAAO,YAAY;AAC5B,QAAI;AACF,aAAO,MAAM,SAAS,cAAc,GAAG,GAAG,MAAM;AAAA,IAClD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,SAAU,OAAM;AAC7B,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,QAAM,WAAW,IAAI,MAAM,2BAA2B,IAAI,EAAE;AAC9D;;;ACrFA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,IAAM,8CAA8C;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,uCACd,KACA,MACkC;AAClC,QAAM,UAAkC,CAAC;AACzC,MAAI,IAAI,mBAAmB;AACzB,YAAQ,WAAW,IAAI,IAAI;AAAA,EAC7B;AACA,MAAI,IAAI,sBAAsB;AAC5B,YAAQ,gBAAgB,UAAU,IAAI,oBAAoB;AAAA,EAC5D;AACA,SAAO,OAAO,KAAK,OAAO,EAAE,WAAW,IACnC,CAAC,IACD;AAAA,IACE,sCAAsC;AAAA,MACpC,SACE,SAAS,eACL,IAAI,qBACH,IAAI,sBAAsB;AAAA,MACjC;AAAA,IACF,CAAC;AAAA,EACH;AACN;AA8BO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,aAAa,QAAQ;AACvB,GAG2B;AACzB,QAAM,iBAAiB,oCAAoC,IAAI;AAE/D,MAAI,gBAAgB,WAAW;AAC7B,WAAO,cAAc,EAAE,UAAU,eAAe,WAAW,WAAW,CAAC;AAAA,EACzE;AAEA,QAAM,qBAAqB,wBAAwB,EAAE,KAAK,WAAW,CAAC;AACtE,MAAI,gBAAgB,SAAS;AAC3B,WAAO,YAAY;AAAA,MACjB,UAAU,eAAe;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB,QAAQ;AAC7B,WAAO,YAAY,EAAE,UAAU,CAAC,GAAG,mBAAmB,CAAC;AAAA,EACzD;AAEA,SAAO,cAAc,EAAE,WAAW,CAAC;AACrC;AAEO,SAAS,oCAAoC;AAAA,EAClD;AAAA,EACA,aAAa,QAAQ;AACvB,GAGyC;AACvC,MAAI,SAAS,eAAgB,OAAO,SAAS,YAAY,MAAM,WAAY;AACzE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,gBAAiB,OAAO,SAAS,YAAY,MAAM,SAAU;AACxE,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,EAAE,KAAK,WAAW,CAAC,EAAE,SAChD,eACA;AACN;AAEA,SAAS,oCACP,MACyC;AACzC,MAAI,QAAQ,QAAQ,SAAS,QAAQ;AACnC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,eAAO,EAAE,WAAW,CAAC,EAAE;AAAA,MACzB,KAAK;AACH,eAAO,EAAE,SAAS,CAAC,EAAE;AAAA,MACvB;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,UAAQ;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AACF,GAG2B;AACzB,QAAM,MAA8B,CAAC;AACrC,QAAM,SAAS,UAAU,UAAU,WAAW;AAC9C,MAAI,OAAQ,KAAI,oBAAoB;AACpC,QAAM,YAAY,UAAU,aAAa,WAAW;AACpD,MAAI,UAAW,KAAI,uBAAuB;AAC1C,QAAM,UAAU,UAAU,WAAW,WAAW;AAChD,MAAI,QAAS,KAAI,qBAAqB;AACtC,SAAO;AACT;AAEA,SAAS,YAAY;AAAA,EACnB;AAAA,EACA;AACF,GAG2B;AACzB,QAAM,SAAS,SAAS,UAAU,mBAAmB;AAErD,QAAM,WAAW,SAAS,WAAW,mBAAmB,SAAS;AAAA,IAC/D;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,MAAI,QAAQ;AACV,QAAI,qBAAqB;AACzB,QAAI,oBAAoB;AAAA,EAC1B;AACA,MAAI,qBAAqB;AACzB,SAAO;AACT;;;ACzKA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAGX,IAAM,wBAAwB;AAGrC,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EAClD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,SAAS,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,eAAe,EAAE,OAAO;AAAA,IACxB,SAAS,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AAAA,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE,CAAC;AAC1C,CAAC;AAEM,IAAM,qBAAqB,+BAA+B,OAAO;AAAA,EACtE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,eAAe,SAAS;AAAA,EAClC,QAAQ,EAAE,KAAK,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAIM,IAAM,uBAAuB,EAAE,mBAAmB,QAAQ;AAAA,EAC/D;AAAA,EACA,GAAG;AACL,CAAC;;;AC3CM,IAAM,UACX,OACI,WACA;;;AJ+DN,IAAM,wBAAwB,6BAA6B,OAAO;AAiBlE,IAAM,qBAAqB;AAiD3B,IAAM,2BAA2B;AAAA,EAC/B,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaC,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,CAAC;AAAA,EACjD,CAAC;AAAA,EACD,OAAO,WAAW,SAAS;AAAA,IACzB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,GAAG,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,WAAWA,GAAE,OAAO;AAAA,MACpB,YAAYA,GAAE,OAAO;AAAA,MACrB,YAAYA,GAAE,OAAO;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA;AAAA,EAED,IAAI,KAAK;AAAA,IACP,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACvD,CAAC;AAAA,EACD,MAAM,KAAK;AAAA,IACT,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,IACrC,CAAC;AAAA,EACH,CAAC;AAAA,EACD,aAAa,KAAK;AAAA,IAChB,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,OAAOA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,EAClE,CAAC;AACH;AAGA,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AACD,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAC3C,QAAQ,6BAA6B,SAAS;AAChD,CAAC;AAGM,SAAS,iBACd,WAAsC,CAAC,GACK;AAC5C,SAAO;AAAA,IACL,sBAAsB;AAAA,IACtB,WAAW;AAAA,IACX,cAAc;AAAA;AAAA,IAEd,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,cAAc;AAAA,IACd,SAAS,OAAM,cAAa;AAC1B,YAAM,iBAAiB,UAAU;AACjC,YAAM,iBAAiB,UAAU;AACjC,YAAM,yBACJ,4BAA4B,cAAc;AAC5C,YAAM,YAAY,QAAQ,iBAAiB,eAAe,KAAK;AAC/D,mCAA6B;AAAA,QAC3B;AAAA,QACA,MAAM,SAAS;AAAA,QACf,cAAc,SAAS;AAAA,MACzB,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,aAAa,MAAM;AACzD,cAAM,IAAI,kCAAkC;AAAA,UAC1C,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,YAAM,0BACJ,MAAM,sCAAsC;AAAA,QAC1C;AAAA,QACA,aAAa,UAAU;AAAA,MACzB,CAAC;AACH,YAAM,qBAAqB,oCAAoC;AAAA,QAC7D,MAAM,SAAS;AAAA,MACjB,CAAC;AACD,YAAM,0BAA0B,qBAAqB;AAAA,QACnD,MAAM,SAAS;AAAA,MACjB,CAAC;AACD,UAAI,yBAAyB;AAC7B,UACE,+BAA+B,kBAC/B,eAAe,6BAA6B,MAC5C;AACA,cAAM,yBAAyB;AAAA,UAC7B;AAAA,UACA;AAAA,QACF;AACA,YAAI,uBAAuB,SAAS,GAAG;AACrC,gBAAM,eAAe;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AACA,iCAAyB,uBAAuB;AAAA,UAC9C,aAAa;AAAA,UACb,gCACE;AAAA,QACJ,CAAC;AAAA,MACH,OAAO;AACL,2CAAmC;AAAA,MACrC;AACA,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAEA,YAAM,iBAAiB,UAAU,gBAAgB,UAAU;AAC3D,YAAM,WAAW,kBAAkB;AACnC,YAAM,aAAa,UAAU,gBAAgB;AAC7C,YAAM,SACJ,YAAY,OAAO,gBAAgB,SAAS,WACvC,eAAe,KAA6C,SAC7D;AAEN,YAAM,UAAU,UAAU;AAC1B,YAAM,iBAAiB,GAAG,uBAAuB,gBAAgB,UAAU,SAAS;AACpF,YAAM,iBAAiB,GAAG,cAAc;AACxC,YAAM,YAAY,SAAS,oBAAoB;AAE/C,YAAM,SAAS,UAAU,eAAe;AACxC,YAAM,eAAe,SACjB,CAAC,UACC;AAAA,QACE,mCAAmC,OAAO;AAAA,UACxC,WAAW,UAAU;AAAA,UACrB,WAAW,KAAK,IAAI;AAAA,QACtB,CAAC;AAAA,MACH,IACF;AACJ,YAAM,gBAAgB,yBAAyB;AAAA,QAC7C,WAAW;AAAA,QACX,WAAW,UAAU;AAAA,MACvB,CAAC;AAGD,UAAI,QAAQ;AACV,YAAI;AACF,gBAAMC,YAAW,MAAM,sBAAsB;AAAA,YAC3C;AAAA,YACA,UAAU,SAAS;AAAA,YACnB,MAAM,OAAO;AAAA,UACf,CAAC;AACD,gBAAM,iBAAiB,gBAAgB;AAAA,YACrC,UAAAA;AAAA,YACA,OAAO,OAAO;AAAA,UAChB,CAAC;AACD,gBAAM,gBAAmC,IAAI,eAAe;AAAA,YAC1D,SAAS,MAAM,cAAc,cAAc;AAAA,YAC3C,gBAAgB;AAAA,YAChB,wBAAwB,OAAO;AAAA,YAC/B;AAAA,YACA;AAAA,UACF,CAAC;AACD,gBAAM,cAAc,KAAK,aAAa,EAAE,QAAQ,KAAK,IAAI,MAAS;AAClE,iBAAO,cAAc;AAAA,YACnB,WAAW,UAAU;AAAA,YACrB,SAAS;AAAA,YACT,MAAM;AAAA,YACN,OAAO,SAAS;AAAA,YAChB,UAAU,SAAS;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,YAAY,OAAO;AAAA,YACnB,aAAa,OAAO;AAAA,YACpB;AAAA,YACA,UAAU;AAAA,YACV,UAAU;AAAA,YACV;AAAA,YACA,sBAAsB,UAAU;AAAA,YAChC,gBAAgB,SAAS;AAAA,YACzB,YAAY,SAAS;AAAA,UACvB,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,YAAM,OAAO,kBAAkB;AAAA,QAC7B;AAAA,QACA,UAAU,SAAS;AAAA,MACrB,CAAC;AACD,YAAM,QACJ,SAAS,mBAAmB,OACxB,YAAY,EAAE,EAAE,SAAS,KAAK,IAC9B,SAAS,gBAAgB,SAAU;AAIzC,YAAM,cAAc,CAAC,GAAG,OAAO,GAAG,kBAAkB,EAAE;AAEtD,WAAK,UAAU,QAAQ,UAAU,KAAK,GAAG;AACvC,cAAM,UAAU,MAAM,sBAAsB;AAAA,UAC1C,SAAS;AAAA,UACT,aAAa,UAAU;AAAA,QACzB,CAAC;AACD,cAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB;AACtD,cAAM,YAAY;AAAA,UAChB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,UAAU,UAAU,CAAC;AAAA,UAC7B,aAAa,UAAU;AAAA,QACzB,CAAC;AACD,oBAAY,KAAK,cAAc;AAAA,MACjC;AAEA,YAAM,2BAA2B,MAAM,0BAA0B;AAAA,QAC/D,aAAa;AAAA,QACb,gCACE;AAAA,QACF,sBAAsB,SAAS;AAAA,MACjC,CAAC;AACD,YAAM,MAAM;AAAA,QACV,GAAG;AAAA,QACH,2BAA2B;AAAA,QAC3B,sBAAsB;AAAA,QACtB,gBAAgB,OAAO,IAAI;AAAA,MAC7B;AAEA,YAAM,uBAAuB,IAAI;AAAA,QAC/B,SAAS,YAAY,WAAW,OAAO,CAAC,IAAI,WAAW,cAAc,CAAC;AAAA,QACtE,aAAa,UAAU;AAAA,MACzB,CAAC;AAED,YAAM,mBAAmB;AAAA,QACvB,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ,aAAa,UAAU;AAAA,MACzB,CAAC;AAED,YAAM,OAAO,MAAM,uBAAuB,MAAM;AAAA,QAC9C,SAAS,QAAQ,WAAW,GAAG,YAAY,aAAa,CAAC,cAAc,WAAW,OAAO,CAAC,uBAAuB,WAAW,cAAc,CAAC,oBAAoB,WAAW,YAAY,CAAC;AAAA,QACvL;AAAA,QACA,aAAa,UAAU;AAAA,MACzB,CAAC;AACD,YAAM,aAAuB,CAAC;AAC9B,YAAM,mBAAmB,2BAA2B;AAAA,QAClD,QAAQ,KAAK;AAAA,QACb,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,aAAa;AAAA,MACf,CAAC;AAED,YAAM,EAAE,MAAM,UAAU,IAAI,MAAM,mBAAmB;AAAA,QACnD;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,aAAa,UAAU;AAAA,QACvB,oBAAoB,CAAC,EAAE,MAAAC,OAAM,WAAW,MACtC,yBAAyB;AAAA,UACvB,SAAS;AAAA,UACT,MAAAA;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AAAA,QACH,iBAAiB,CAAC,EAAE,MAAAA,OAAM,WAAW,MACnC,yBAAyB;AAAA,UACvB,SAAS;AAAA,UACT,MAAAA;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AAAA,MACL,CAAC;AACD,WAAK,yBAAyB,KAAK,MAAM;AAEzC,YAAM,WAAW,MAAM,sBAAsB;AAAA,QAC3C;AAAA,QACA,UAAU,SAAS;AAAA,QACnB,MAAM;AAAA,MACR,CAAC;AACD,YAAM,iBAAiB,gBAAgB,EAAE,UAAU,MAAM,CAAC;AAE1D,YAAM,UAA6B,IAAI,eAAe;AAAA,QACpD,SAAS,MAAM,cAAc,cAAc;AAAA,QAC3C,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,KAAK;AAEnB,aAAO,cAAc;AAAA,QACnB,WAAW,UAAU;AAAA,QACrB;AAAA,QACA;AAAA,QACA,OAAO,SAAS;AAAA,QAChB,UAAU,SAAS;AAAA,QACnB,QAAQ,SAAS;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,QACb;AAAA,QACA;AAAA;AAAA,QAEA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA,sBAAsB,UAAU;AAAA,QAChC,gBAAgB,SAAS;AAAA,QACzB,YAAY,SAAS;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB;AAAA,EACzB;AAAA,EACA;AACF,GAGW;AACT,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,WAAW,kBAAkB,eAAe,MAAM,SAAS,GAAG;AAChE,WAAO,eAAe,MAAM,CAAC;AAAA,EAC/B;AACA,QAAM,IAAI,kCAAkC;AAAA,IAC1C,WAAW;AAAA,IACX,SACE;AAAA,EAEJ,CAAC;AACH;AAEA,SAAS,6BAA6B;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF,GAIS;AACP,MAAI,qBAAqB,eAAgB;AACzC,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,gBAAgB,MAAM;AACxB,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AACF,GAImC;AACjC,MAAI,YAAY,KAAM,QAAO;AAC7B,MAAI,qBAAqB,gBAAgB;AACvC,WAAO,eAAe,gBAAgB,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EAChE;AACA,QAAM,IAAI,kCAAkC;AAAA,IAC1C,WAAW;AAAA,IACX,SACE;AAAA,EACJ,CAAC;AACH;AAGA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKkB;AAKhB,QAAM,mBAAmB;AAAA,IACvB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,yBAAyB,CAAC,EAAE,KAAK,MAC/B,kCAAkC,IAAI;AAAA,IACxC,cAAc;AAAA,IACd,6BAA6B,CAAC,EAAE,WAAW,SAAS,MAClD,gCAAgC,SAAS,MAAM,QAAQ;AAAA,EAC3D,CAAC;AACH;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AACF,GAA8C;AAC5C,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,KAAK,IAAI,UAAU,KAAK;AAAA,MAC5B,SAAS,WAAW,OAAO,SAAY,EAAE,GAAG,QAAQ;AAAA,IACtD,CAAC;AACD,UAAM,SAAS,MAAM;AACnB,SAAG,IAAI,SAAS,OAAO;AACvB,cAAQ,EAAE;AAAA,IACZ;AACA,UAAM,UAAU,CAAC,QAAe;AAC9B,SAAG,IAAI,QAAQ,MAAM;AACrB,aAAO,GAAG;AAAA,IACZ;AACA,OAAG,KAAK,QAAQ,MAAM;AACtB,OAAG,KAAK,SAAS,OAAO;AAAA,EAC1B,CAAC;AACH;AAEA,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AACF,GAG0B;AACxB,QAAM,YAAY,IAAI,IAAI,SAAS,GAAG;AACtC,YAAU,aAAa,IAAI,sBAAsB,KAAK;AACtD,SAAO,EAAE,GAAG,UAAU,KAAK,UAAU,SAAS,EAAE;AAClD;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAqBqB;AACnB,MAAI,UAAU;AACd,MAAI,sBAAsB;AAE1B,QAAM,WAAW,CAAC,aAGY;AAC5B,QAAI;AACJ,QAAI;AACJ,UAAM,OAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,uBAAiB;AACjB,sBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,SAA4B,CAAC;AACnC,UAAM,UAAU,CAAC,UAA+B;AAC9C,UAAI;AACF,iBAAS,KAAK,KAAK;AAAA,MACrB,QAAQ;AAAA,MAAC;AAAA,IACX;AAEA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,YAAY;AAChB,UAAM,gBAAgB,MAAM;AAC1B,UAAI,UAAW;AACf,kBAAY;AACZ,iBAAW,KAAK,OAAQ,GAAE;AAC1B,qBAAgB;AAAA,IAClB;AACA,UAAM,cAAc,CAAC,QAAiB;AACpC,UAAI,UAAW;AACf,kBAAY;AACZ,iBAAW,KAAK,OAAQ,GAAE;AAC1B,oBAAe,GAAG;AAAA,IACpB;AAEA,eAAW,QAAQ,YAAY;AAC7B,aAAO,KAAK,QAAQ,GAAG,MAAM,SAAO,QAAQ,GAAG,CAAC,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,MACL,QAAQ,GAAG,UAAU,SAAO;AAC1B,gBAAQ,GAAG;AACX,sBAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,QAAQ,GAAG,SAAS,SAAO;AACzB,gBAAQ,GAAG;AACX,oBAAY,IAAI,KAAK;AAAA,MACvB,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,CAAC,OAAe,WAAmB;AACjD,UAAI,UAAW;AACf,UAAI,WAAW,aAAa;AAC1B,sBAAc;AACd;AAAA,MACF;AACA;AAAA,QACE,IAAI,MAAM,oDAAoD;AAAA,MAChE;AAAA,IACF;AACA,YAAQ,QAAQ,OAAO;AAEvB,UAAM,UAAU,MAAM;AACpB,UAAI,UAAW;AACf,UAAI;AACF,gBAAQ,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,MAChC,QAAQ;AAAA,MAAC;AACT;AAAA,QACE,SAAS,aAAa,UACpB,IAAI,aAAa,WAAW,YAAY;AAAA,MAC5C;AAAA,IACF;AACA,QAAI,SAAS,aAAa;AACxB,UAAI,SAAS,YAAY,SAAS;AAChC,gBAAQ;AAAA,MACV,OAAO;AACL,iBAAS,YAAY,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MACxE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,kBAAkB,OAAM,UAAS;AAC/B,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,YAAY,MAAM;AAAA,UAClB,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,MACA,oBAAoB,OAAM,UAAS;AACjC,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,YAAY,MAAM;AAAA,UAClB,UAAU,MAAM;AAAA,UAChB,GAAI,MAAM,UAAU,OAAO,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,QACzD,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,eAA8B;AACjD,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SAAS,yCAAyC,UAAU;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,cAAc,OAAM,eAAc;AAChC,UACE,WAAW,gBAAgB,SAAS,UACpC,WAAW,eAAe,UAAU,MACpC;AACA,cAAM,IAAI,kCAAkC;AAAA,UAC1C,SACE;AAAA,UACF,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,SAAS;AAAA,QACvB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,MAC1B,CAAC;AAED,YAAM,oBACJ,CAAC,uBAAuB,CAAC,CAAC,WAAW;AACvC,4BAAsB;AAEtB,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,QAAQ,gBAAgB,WAAW,MAAM;AAAA,QACzC,GAAI,oBAAoB,EAAE,cAAc,WAAW,aAAa,IAAI,CAAC;AAAA,QACrE,QAAQ,WAAW,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,UACxC,MAAM,EAAE;AAAA,UACR,aAAa,EAAE;AAAA,UACf,aAAa,EAAE;AAAA,QACjB,EAAE;AAAA,QACF,GAAI,WAAW,kBAAkB,OAC7B,CAAC,IACD,EAAE,gBAAgB,WAAW,eAAe;AAAA,QAChD,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,QACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC3B,GAAI,aAAa,SAAS,EAAE,YAAY,IAAI,CAAC;AAAA,QAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,QAC3C,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,QACvD,GAAI,kBAAkB,OAAO,EAAE,eAAe,IAAI,CAAC;AAAA,QACnD,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;AAAA,MAC7C,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IACA,gBAAgB,OAAM,iBAAgB;AACpC,UACE,aAAa,gBAAgB,SAAS,UACtC,aAAa,eAAe,UAAU,MACtC;AACA,cAAM,IAAI,kCAAkC;AAAA,UAC1C,SACE;AAAA,UACF,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,aAAO,SAAS;AAAA,QACd,MAAM,aAAa;AAAA,QACnB,aAAa,aAAa;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACA,eAAe,YAAY;AACzB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AAEV,YAAM,kBAAkB,MAAM,QAAQ,QAAQ;AAC9C,YAAM,UAAsC;AAAA,QAC1C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MAAM;AAAA,UACJ,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,YACP;AAAA,YACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AACpB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AAEV,YAAM,kBAAkB,MAAM,QAAQ,QAAQ;AAC9C,YAAM,UAAuC;AAAA,QAC3C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MAAM;AAAA,UACJ,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,YACP;AAAA,YACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,WAAW,YAAY,YAAY,mBAAmB;AAAA,IACtD,QAAQ,YAAY;AAClB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AACV,YAAM,SAAS,EAAE,SAAS,MAAM,WAAW,OAAO,CAAC;AAEnD,YAAM,UAAuC;AAAA,QAC3C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MAAM,CAAC;AAAA,MACT;AACA,aAAO;AAAA,IACT;AAAA,IACA,WAAW,YAAY;AACrB,UAAI,QAAS;AACb,gBAAU;AACV,YAAM,SAAS,EAAE,SAAS,MAAM,WAAW,UAAU,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAe,SAAS;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,UAAQ,WAAW;AACnB,MAAI;AACF,QAAI,CAAC,QAAQ,SAAS,GAAG;AACvB,cAAQ,KAAK,EAAE,MAAM,UAAU,CAAC;AAAA,IAClC;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,MAAI;AACJ,MAAI;AACF,QAAI,MAAM;AACR,YAAM,QAAQ,KAAK;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,IAAI,QAAc,aAAW;AAC3B,sBAAY,WAAW,SAAS,GAAI;AACpC,oBAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,QAAI,UAAW,cAAa,SAAS;AACrC,QAAI;AACF,YAAM,MAAM,KAAK;AAAA,IACnB,QAAQ;AAAA,IAAC;AACT,YAAQ,MAAM;AAAA,EAChB;AACF;AAGA,SAAS,gBAAgB,QAAiC;AACxD,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAM,EAAE,QAAQ,IAAI;AACpB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,SAAS;AAC1B,QAAI,KAAK,SAAS,QAAQ;AACxB,YAAM,IAAI,kCAAkC;AAAA,QAC1C,WAAW;AAAA,QACX,SAAS,2EAA2E,KAAK,IAAI;AAAA,MAC/F,CAAC;AAAA,IACH;AACA,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACA,SAAO,MAAM,KAAK,MAAM;AAC1B;;;AKv7BO,IAAM,aAAa,iBAAiB;","names":["z","z","endpoint","proc"]}
+{"version":3,"sources":["../src/deepagents-harness.ts","../src/deepagents-bootstrap.ts","../src/deepagents-auth.ts","../src/deepagents-bridge-protocol.ts","../src/version.ts","../src/index.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto';\nimport { posix } from 'node:path';\nimport {\n  commonTool,\n  HarnessCapabilityUnsupportedError,\n  harnessV1DiagnosticFromBridgeFrame,\n  type HarnessV1,\n  type HarnessV1BuiltinTool,\n  type HarnessV1BuiltinToolFiltering,\n  type HarnessV1ContinueTurnState,\n  type HarnessV1CredentialForwarding,\n  type HarnessV1NetworkSandboxSession,\n  type HarnessV1PermissionMode,\n  type HarnessV1Prompt,\n  type HarnessV1PromptControl,\n  type HarnessV1PortEndpoint,\n  type HarnessV1ResumeSessionState,\n  type HarnessV1Session,\n  type HarnessV1Skill,\n  type HarnessV1StreamPart,\n} from '@ai-sdk/harness';\nimport {\n  applyCredentialForwarding,\n  createSandboxCredentialEnvironment,\n  markBridgeStarting,\n  createBridgeErrorHandler,\n  createBridgeStartupError,\n  drainBridgeProcessStream,\n  forwardBridgeProcessStream,\n  getRestrictedSandboxSession,\n  resolveSandboxDefaultWorkingDirectory,\n  resolveSandboxHomeDir,\n  SandboxChannel,\n  shellQuote,\n  warnCredentialBrokeringUnavailable,\n  waitForBridgeReady,\n  writeSkills as writeHarnessSkills,\n} from '@ai-sdk/harness/utils';\nimport {\n  tool,\n  type Experimental_SandboxProcess,\n  type Experimental_SandboxSession as SandboxSession,\n} from '@ai-sdk/provider-utils';\nimport { WebSocket } from 'ws';\nimport { z } from 'zod/v4';\nimport {\n  DEEPAGENTS_BOOTSTRAP_DIR as BOOTSTRAP_DIR,\n  getDeepAgentsBootstrap,\n} from './deepagents-bootstrap';\nimport {\n  createDeepAgentsRequestTransformations,\n  DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n  resolveDeepAgentsAuthenticationMode,\n  resolveDeepAgentsEnv,\n  type DeepAgentsAuthOptions,\n} from './deepagents-auth';\nimport {\n  outboundMessageSchema,\n  type InboundMessage,\n  type OutboundMessage,\n} from './deepagents-bridge-protocol';\nimport { VERSION } from './version';\n\ntype DeepAgentsChannel = SandboxChannel<OutboundMessage, InboundMessage>;\n\n/**\n * Value to use in User-Agent and `x-client-app` headers.\n */\nconst DEEPAGENTS_CLIENT_APP = `ai-sdk/harness-deepagents/${VERSION}`;\n\nexport type DeepAgentsThinkingConfig =\n  | {\n      readonly type: 'adaptive';\n      readonly display?: 'summarized' | 'omitted';\n    }\n  | {\n      readonly type: 'enabled';\n      readonly budget_tokens: number;\n      readonly display?: 'summarized' | 'omitted';\n    }\n  | {\n      readonly type: 'disabled';\n    };\n\n// Skills source subpath, written under $HOME (out of the work dir so it can't clash with code cloned into the work dir) and also discovered from <workDir> for repo-provided skills.\nconst SKILLS_SOURCE_PATH = '/.agents/skills';\n\nexport type DeepAgentsHarnessSettings = {\n  readonly auth?: DeepAgentsAuthOptions;\n  /**\n   * Customizes each credential value before it is forwarded into a sandbox\n   * process. This does not restrict which credentials the harness adapter can\n   * discover, read, or otherwise access in the host process.\n   */\n  readonly credentialForwarding?: HarnessV1CredentialForwarding;\n  /** Model id for the DeepAgents runtime, e.g. `claude-sonnet-4` (converted to `provider:model`). */\n  readonly model?: string;\n  /**\n   * Controls Anthropic extended thinking for the Deep Agents model. Unset\n   * preserves the Deep Agents runtime default.\n   */\n  readonly thinking?: DeepAgentsThinkingConfig;\n  /**\n   * Controls how much effort Claude applies when adaptive thinking is enabled.\n   * Unset uses the LangChain Anthropic client default.\n   */\n  readonly effort?: 'low' | 'medium' | 'high' | 'xhigh' | 'max';\n  /** Bridge port override; defaults to the sandbox's first declared port. */\n  readonly port?: number;\n  /**\n   * Override the host endpoint used to connect to the sandbox bridge. Required\n   * together with `port` when using a basic sandbox session.\n   */\n  readonly portEndpoint?: HarnessV1PortEndpoint;\n  /** Maximum milliseconds to wait for the bridge to advertise its port. Defaults to 120000. */\n  readonly startupTimeoutMs?: number;\n  /**\n   * Creates the authentication token used by the sandbox bridge. Defaults to\n   * a random 32-byte hexadecimal token.\n   */\n  readonly mintBridgeToken?: (sandboxId: string) => string;\n  /**\n   * Maximum LangGraph super-steps per turn before it errors.\n   * When omitted, the Deep Agents default applies.\n   */\n  readonly recursionLimit?: number;\n  /**\n   * MCP server definitions keyed by server name. Each definition uses the\n   * underlying runtime's native MCP server configuration format.\n   */\n  readonly mcpServers?: Record<string, unknown>;\n};\n\n// Every model-callable DeepAgents built-in, keyed by what the bridge emits (commonName ?? nativeName); all must be listed or AI SDK throws AI_NoSuchToolError.\nconst DEEPAGENTS_BUILTIN_TOOLS = {\n  read: commonTool('read', {\n    nativeName: 'read_file',\n    toolUseKind: 'readonly',\n    description: 'Read file contents',\n    inputSchema: z.object({ file_path: z.string() }),\n  }),\n  write: commonTool('write', {\n    nativeName: 'write_file',\n    toolUseKind: 'edit',\n    description: 'Create a file',\n    inputSchema: z.object({ file_path: z.string(), content: z.string() }),\n  }),\n  edit: commonTool('edit', {\n    nativeName: 'edit_file',\n    toolUseKind: 'edit',\n    description: 'Perform exact string replacements in a file',\n    inputSchema: z.object({\n      file_path: z.string(),\n      old_string: z.string(),\n      new_string: z.string(),\n    }),\n  }),\n  bash: commonTool('bash', {\n    nativeName: 'execute',\n    toolUseKind: 'bash',\n    description: 'Run a shell command',\n    inputSchema: z.object({ command: z.string() }),\n  }),\n  grep: commonTool('grep', {\n    nativeName: 'grep',\n    toolUseKind: 'readonly',\n    description: 'Search file contents',\n    inputSchema: z.object({ pattern: z.string() }),\n  }),\n  glob: commonTool('glob', {\n    nativeName: 'glob',\n    toolUseKind: 'readonly',\n    description: 'Find files matching a glob pattern',\n    inputSchema: z.object({ pattern: z.string() }),\n  }),\n  // No common-name equivalent — keyed by native name.\n  ls: tool({\n    description: 'List files in a directory',\n    inputSchema: z.object({ path: z.string().optional() }),\n  }),\n  task: tool({\n    description: 'Spawn a subagent to handle a delegated task',\n    inputSchema: z.object({\n      description: z.string().optional(),\n      subagent_type: z.string().optional(),\n    }),\n  }),\n  write_todos: tool({\n    description: 'Manage a structured todo list',\n    inputSchema: z.object({ todos: z.array(z.unknown()).optional() }),\n  }),\n} as const satisfies Record<string, HarnessV1BuiltinTool<any, any>>;\n\n// Live bridge coordinates returned by doDetach/doSuspendTurn so a later process can reattach.\nconst deepAgentsBridgeCoordsSchema = z.object({\n  port: z.number(),\n  token: z.string(),\n  lastSeenEventId: z.number(),\n  sandboxId: z.string().optional(),\n});\nconst deepAgentsResumeStateSchema = z.object({\n  bridge: deepAgentsBridgeCoordsSchema.optional(),\n  sandboxCredentialEnvironment: z.record(z.string(), z.string()).optional(),\n});\ntype DeepAgentsBridgeCoords = z.infer<typeof deepAgentsBridgeCoordsSchema>;\n\nexport function createDeepAgents(\n  settings: DeepAgentsHarnessSettings = {},\n): HarnessV1<typeof DEEPAGENTS_BUILTIN_TOOLS> {\n  return {\n    specificationVersion: 'harness-v1',\n    harnessId: 'deepagents',\n    builtinTools: DEEPAGENTS_BUILTIN_TOOLS,\n    // Built-in tool approvals are gated in-bridge via DeepAgents' interruptOn (HITL) middleware.\n    supportsBuiltinToolApprovals: true,\n    lifecycleStateSchema: deepAgentsResumeStateSchema,\n    getBootstrap: getDeepAgentsBootstrap,\n    doStart: async startOpts => {\n      const permissionMode = startOpts.permissionMode;\n      const sandboxSession = startOpts.sandboxSession;\n      const toolSafeSandboxSession =\n        getRestrictedSandboxSession(sandboxSession);\n      const sandboxId = 'id' in sandboxSession ? sandboxSession.id : undefined;\n      validateBasicSandboxSettings({\n        sandboxSession,\n        port: settings.port,\n        portEndpoint: settings.portEndpoint,\n      });\n      if (settings.mintBridgeToken != null && sandboxId == null) {\n        throw new HarnessCapabilityUnsupportedError({\n          harnessId: 'deepagents',\n          message:\n            'The deepagents harness cannot use `mintBridgeToken` with a sandbox session that does not expose an id.',\n        });\n      }\n      const defaultWorkingDirectory =\n        await resolveSandboxDefaultWorkingDirectory({\n          sandboxSession,\n          abortSignal: startOpts.abortSignal,\n        });\n      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;\n      const isResume = lifecycleState != null;\n      const isContinue = startOpts.continueFrom != null;\n      const resumeData =\n        isResume && typeof lifecycleState?.data === 'object'\n          ? (lifecycleState.data as {\n              bridge?: DeepAgentsBridgeCoords;\n              sandboxCredentialEnvironment?: Record<string, string>;\n            })\n          : undefined;\n      const coords = resumeData?.bridge;\n      const authenticationMode = resolveDeepAgentsAuthenticationMode({\n        auth: settings.auth,\n      });\n      const resolvedAuthEnvironment = resolveDeepAgentsEnv({\n        auth: settings.auth,\n      });\n      let sandboxAuthEnvironment = resolvedAuthEnvironment;\n      let sandboxCredentialEnvironment: Record<string, string> | undefined;\n      let credentialsBrokered = false;\n      if (\n        'addRequestTransformations' in sandboxSession &&\n        sandboxSession.addRequestTransformations != null\n      ) {\n        sandboxCredentialEnvironment =\n          resumeData?.sandboxCredentialEnvironment ??\n          (await createSandboxCredentialEnvironment({\n            environment: resolvedAuthEnvironment,\n            credentialEnvironmentVariables:\n              DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n          }));\n        sandboxAuthEnvironment = {\n          ...resolvedAuthEnvironment,\n          ...sandboxCredentialEnvironment,\n        };\n        const requestTransformations = createDeepAgentsRequestTransformations({\n          env: resolvedAuthEnvironment,\n          sandboxEnv: sandboxAuthEnvironment,\n          auth: authenticationMode,\n        });\n        if (requestTransformations.length > 0) {\n          await sandboxSession.addRequestTransformations(\n            requestTransformations,\n          );\n        }\n        credentialsBrokered = true;\n      } else {\n        warnCredentialBrokeringUnavailable();\n      }\n      const bootstrapDir = posix.resolve(\n        defaultWorkingDirectory,\n        BOOTSTRAP_DIR,\n      );\n\n      const workDir = startOpts.sessionWorkDir;\n      const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;\n      const bridgeStateDir = `${sessionDataDir}/bridge`;\n      const timeoutMs = settings.startupTimeoutMs ?? 120_000;\n\n      const report = startOpts.observability?.report;\n      const onDiagnostic = report\n        ? (frame: Parameters<typeof harnessV1DiagnosticFromBridgeFrame>[0]) =>\n            report(\n              harnessV1DiagnosticFromBridgeFrame(frame, {\n                sessionId: startOpts.sessionId,\n                timestamp: Date.now(),\n              }),\n            )\n        : undefined;\n      const onBridgeError = createBridgeErrorHandler({\n        harnessId: 'deepagents',\n        sessionId: startOpts.sessionId,\n      });\n\n      // Attach to the still-running bridge (continueFrom replays past the cursor); on failure fall through to a fresh spawn.\n      if (coords) {\n        try {\n          const endpoint = await resolveBridgeEndpoint({\n            sandboxSession,\n            override: settings.portEndpoint,\n            port: coords.port,\n          });\n          const attachEndpoint = withBridgeToken({\n            endpoint,\n            token: coords.token,\n          });\n          const attachChannel: DeepAgentsChannel = new SandboxChannel({\n            connect: () => openWebSocket(attachEndpoint),\n            outboundSchema: outboundMessageSchema,\n            initialLastSeenEventId: coords.lastSeenEventId,\n            onDiagnostic,\n            onBridgeError,\n          });\n          await attachChannel.open(isContinue ? { resume: true } : undefined);\n          return createSession({\n            sessionId: startOpts.sessionId,\n            channel: attachChannel,\n            proc: undefined,\n            model: settings.model,\n            thinking: settings.thinking,\n            effort: settings.effort,\n            bridgePort: coords.port,\n            bridgeToken: coords.token,\n            sandboxId,\n            sandboxCredentialEnvironment,\n            isResume: true,\n            attached: true,\n            permissionMode,\n            builtinToolFiltering: startOpts.builtinToolFiltering,\n            recursionLimit: settings.recursionLimit,\n            mcpServers: settings.mcpServers,\n          });\n        } catch {\n          // Bridge no longer reachable — recover by respawning below.\n        }\n      }\n\n      const port = resolveBridgePort({\n        sandboxSession,\n        override: settings.port,\n      });\n      const token =\n        settings.mintBridgeToken == null\n          ? randomBytes(32).toString('hex')\n          : settings.mintBridgeToken(sandboxId!);\n\n      // Always discover repo-provided skills under <workDir>/.agents/skills (e.g. a cloned repo); a missing dir is tolerated by deepagents.\n      // Absolute paths: LocalShellBackend (non-virtual) treats a leading-slash path as a real fs path.\n      const skillsPaths = [`${workDir}${SKILLS_SOURCE_PATH}`];\n      // Host-provided skills go to $HOME (out of the work dir) and take priority (listed last → wins on name collision).\n      if ((startOpts.skills?.length ?? 0) > 0) {\n        const homeDir = await resolveSandboxHomeDir({\n          sandbox: toolSafeSandboxSession,\n          abortSignal: startOpts.abortSignal,\n        });\n        const homeSkillsRoot = `${homeDir}${SKILLS_SOURCE_PATH}`;\n        await writeSkills({\n          sandbox: toolSafeSandboxSession,\n          root: homeSkillsRoot,\n          skills: startOpts.skills ?? [],\n          abortSignal: startOpts.abortSignal,\n        });\n        skillsPaths.push(homeSkillsRoot);\n      }\n\n      const forwardedAuthEnvironment = credentialsBrokered\n        ? sandboxAuthEnvironment\n        : await applyCredentialForwarding({\n            environment: sandboxAuthEnvironment,\n            credentialEnvironmentVariables:\n              DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,\n            credentialForwarding: settings.credentialForwarding,\n          });\n      const env = {\n        ...forwardedAuthEnvironment,\n        AI_SDK_HARNESS_CLIENT_APP: DEEPAGENTS_CLIENT_APP,\n        BRIDGE_CHANNEL_TOKEN: token,\n        BRIDGE_WS_PORT: String(port),\n      };\n\n      await toolSafeSandboxSession.run({\n        command: `mkdir -p ${shellQuote(workDir)} ${shellQuote(bridgeStateDir)}`,\n        abortSignal: startOpts.abortSignal,\n      });\n\n      await markBridgeStarting({\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'deepagents',\n        abortSignal: startOpts.abortSignal,\n      });\n\n      const proc = await toolSafeSandboxSession.spawn({\n        command: `node ${shellQuote(`${bootstrapDir}/bridge.mjs`)} --workdir ${shellQuote(workDir)} --bridge-state-dir ${shellQuote(bridgeStateDir)} --bootstrap-dir ${shellQuote(bootstrapDir)}`,\n        env,\n        abortSignal: startOpts.abortSignal,\n      });\n      const stderrTail: string[] = [];\n      const bridgeStderrDone = forwardBridgeProcessStream({\n        stream: proc.stderr,\n        streamName: 'stderr',\n        source: 'deepagents',\n        collectTail: stderrTail,\n      });\n\n      const { port: boundPort } = await waitForBridgeReady({\n        proc,\n        sandbox: toolSafeSandboxSession,\n        bridgeStateDir,\n        bridgeType: 'deepagents',\n        timeoutMs,\n        abortSignal: startOpts.abortSignal,\n        createTimeoutError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'deepagents bridge did not become ready in time.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n        createExitError: ({ proc, stdoutTail }) =>\n          createBridgeStartupError({\n            message: 'deepagents bridge exited before becoming ready.',\n            proc,\n            stdoutTail,\n            stderrTail,\n            stderrDone: bridgeStderrDone,\n          }),\n      });\n      void drainBridgeProcessStream(proc.stdout);\n\n      const endpoint = await resolveBridgeEndpoint({\n        sandboxSession,\n        override: settings.portEndpoint,\n        port: boundPort,\n      });\n      const bridgeEndpoint = withBridgeToken({ endpoint, token });\n\n      const channel: DeepAgentsChannel = new SandboxChannel({\n        connect: () => openWebSocket(bridgeEndpoint),\n        outboundSchema: outboundMessageSchema,\n        onDiagnostic,\n        onBridgeError,\n      });\n      await channel.open();\n\n      return createSession({\n        sessionId: startOpts.sessionId,\n        channel,\n        proc,\n        model: settings.model,\n        thinking: settings.thinking,\n        effort: settings.effort,\n        bridgePort: boundPort,\n        bridgeToken: token,\n        sandboxId,\n        sandboxCredentialEnvironment,\n        isResume,\n        // Freshly spawned bridge — it must receive the instructions on the first prompt.\n        attached: false,\n        skillsPaths,\n        permissionMode,\n        builtinToolFiltering: startOpts.builtinToolFiltering,\n        recursionLimit: settings.recursionLimit,\n        mcpServers: settings.mcpServers,\n      });\n    },\n  };\n}\n\nfunction resolveBridgePort({\n  sandboxSession,\n  override,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: number | undefined;\n}): number {\n  if (override !== undefined) return override;\n  if ('ports' in sandboxSession && sandboxSession.ports.length > 0) {\n    return sandboxSession.ports[0];\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'deepagents',\n    message:\n      'The deepagents harness needs a TCP port exposed by the sandbox. ' +\n      'Create the sandbox with `ports: [<port>]` or pass `createDeepAgents({ port })`.',\n  });\n}\n\nfunction validateBasicSandboxSettings({\n  sandboxSession,\n  port,\n  portEndpoint,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  port: number | undefined;\n  portEndpoint: HarnessV1PortEndpoint | undefined;\n}): void {\n  if ('getPortEndpoint' in sandboxSession) return;\n  if (port == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message:\n        'The deepagents harness requires an explicit `port` when using a basic sandbox session.',\n    });\n  }\n  if (portEndpoint == null) {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message:\n        'The deepagents harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n    });\n  }\n}\n\nasync function resolveBridgeEndpoint({\n  sandboxSession,\n  override,\n  port,\n}: {\n  sandboxSession: HarnessV1NetworkSandboxSession | SandboxSession;\n  override: HarnessV1PortEndpoint | undefined;\n  port: number;\n}): Promise<HarnessV1PortEndpoint> {\n  if (override != null) return override;\n  if ('getPortEndpoint' in sandboxSession) {\n    return sandboxSession.getPortEndpoint({ port, protocol: 'ws' });\n  }\n  throw new HarnessCapabilityUnsupportedError({\n    harnessId: 'deepagents',\n    message:\n      'The deepagents harness requires an explicit `portEndpoint` when using a basic sandbox session.',\n  });\n}\n\n// Materialize each skill as a native deepagents `<name>/SKILL.md` folder (+ attached files) under the given root, so skills load on demand and file references resolve.\nasync function writeSkills({\n  sandbox,\n  root,\n  skills,\n  abortSignal,\n}: {\n  sandbox: SandboxSession;\n  root: string;\n  skills: ReadonlyArray<HarnessV1Skill>;\n  abortSignal?: AbortSignal;\n}): Promise<void> {\n  /*\n   * DeepAgents requires each `SKILL.md` frontmatter name to match the parent\n   * directory name, so keep the stricter lowercase skill-name policy here.\n   */\n  await writeHarnessSkills({\n    sandbox,\n    rootDir: root,\n    skills,\n    abortSignal,\n    skillNamePattern: /^[a-z0-9]([a-z0-9-]{0,62}[a-z0-9])?$/,\n    invalidSkillNameMessage: ({ name }) =>\n      `Invalid deepagents skill name '${name}': must be lowercase alphanumeric with hyphens, 1-64 chars.`,\n    filePathMode: 'strip-leading-slashes',\n    invalidSkillFilePathMessage: ({ skillName, filePath }) =>\n      `Invalid skill file path for '${skillName}': ${filePath}`,\n  });\n}\n\nfunction openWebSocket({\n  url,\n  headers,\n}: HarnessV1PortEndpoint): Promise<WebSocket> {\n  return new Promise((resolve, reject) => {\n    const ws = new WebSocket(url, {\n      headers: headers == null ? undefined : { ...headers },\n    });\n    const onOpen = () => {\n      ws.off('error', onError);\n      resolve(ws);\n    };\n    const onError = (err: Error) => {\n      ws.off('open', onOpen);\n      reject(err);\n    };\n    ws.once('open', onOpen);\n    ws.once('error', onError);\n  });\n}\n\nfunction withBridgeToken({\n  endpoint,\n  token,\n}: {\n  endpoint: HarnessV1PortEndpoint;\n  token: string;\n}): HarnessV1PortEndpoint {\n  const bridgeUrl = new URL(endpoint.url);\n  bridgeUrl.searchParams.set('agent_bridge_token', token);\n  return { ...endpoint, url: bridgeUrl.toString() };\n}\n\nfunction createSession({\n  sessionId,\n  channel,\n  proc,\n  model,\n  thinking,\n  effort,\n  bridgePort,\n  bridgeToken,\n  sandboxId,\n  sandboxCredentialEnvironment,\n  isResume,\n  attached,\n  skillsPaths,\n  permissionMode,\n  builtinToolFiltering,\n  recursionLimit,\n  mcpServers,\n}: {\n  sessionId: string;\n  channel: DeepAgentsChannel;\n  // Undefined on attach — the live bridge was spawned by another process.\n  proc: Experimental_SandboxProcess | undefined;\n  model: string | undefined;\n  thinking: DeepAgentsThinkingConfig | undefined;\n  effort: 'low' | 'medium' | 'high' | 'xhigh' | 'max' | undefined;\n  bridgePort: number;\n  bridgeToken: string;\n  sandboxId: string | undefined;\n  sandboxCredentialEnvironment: Record<string, string> | undefined;\n  isResume: boolean;\n  // True only when attaching to a live bridge that already built the agent with\n  // its instructions. A fresh spawn (incl. a respawn on attach failure or a\n  // stop-resume) starts a new bridge that must receive the instructions again.\n  attached: boolean;\n  skillsPaths?: string[];\n  permissionMode?: HarnessV1PermissionMode;\n  builtinToolFiltering?: HarnessV1BuiltinToolFiltering;\n  recursionLimit?: number;\n  mcpServers?: Record<string, unknown>;\n}): HarnessV1Session {\n  let stopped = false;\n  let instructionsApplied = attached;\n\n  const wireTurn = (turnOpts: {\n    emit: (event: HarnessV1StreamPart) => void;\n    abortSignal?: AbortSignal;\n  }): HarnessV1PromptControl => {\n    let pendingResolve: (() => void) | undefined;\n    let pendingReject: ((err: unknown) => void) | undefined;\n    const done = new Promise<void>((resolve, reject) => {\n      pendingResolve = resolve;\n      pendingReject = reject;\n    });\n\n    const unsubs: Array<() => void> = [];\n    const forward = (event: HarnessV1StreamPart) => {\n      try {\n        turnOpts.emit(event);\n      } catch {}\n    };\n\n    const eventTypes = [\n      'stream-start',\n      'text-start',\n      'text-delta',\n      'text-end',\n      'reasoning-start',\n      'reasoning-delta',\n      'reasoning-end',\n      'tool-call',\n      'tool-approval-request',\n      'tool-result',\n      'file-change',\n      'finish-step',\n      'raw',\n    ] as const;\n    let isSettled = false;\n    const settleSuccess = () => {\n      if (isSettled) return;\n      isSettled = true;\n      for (const u of unsubs) u();\n      pendingResolve!();\n    };\n    const settleError = (err: unknown) => {\n      if (isSettled) return;\n      isSettled = true;\n      for (const u of unsubs) u();\n      pendingReject!(err);\n    };\n\n    for (const type of eventTypes) {\n      unsubs.push(channel.on(type, msg => forward(msg)));\n    }\n    unsubs.push(\n      channel.on('finish', msg => {\n        forward(msg);\n        settleSuccess();\n      }),\n    );\n    unsubs.push(\n      channel.on('error', msg => {\n        forward(msg);\n        settleError(msg.error);\n      }),\n    );\n\n    // A `'suspended'` close is a graceful slice-boundary freeze (suspend/detach keep the bridge alive for continuation); end the turn cleanly. Any other close is an unexpected bridge failure.\n    const onClose = (_code: number, reason: string) => {\n      if (isSettled) return;\n      if (reason === 'suspended') {\n        settleSuccess();\n        return;\n      }\n      settleError(\n        new Error('deepagents bridge closed before the turn finished.'),\n      );\n    };\n    channel.onClose(onClose);\n\n    const onAbort = () => {\n      if (isSettled) return;\n      try {\n        channel.send({ type: 'abort' });\n      } catch {}\n      settleError(\n        turnOpts.abortSignal?.reason ??\n          new DOMException('Aborted', 'AbortError'),\n      );\n    };\n    if (turnOpts.abortSignal) {\n      if (turnOpts.abortSignal.aborted) {\n        onAbort();\n      } else {\n        turnOpts.abortSignal.addEventListener('abort', onAbort, { once: true });\n      }\n    }\n\n    return {\n      submitToolResult: async input => {\n        channel.send({\n          type: 'tool-result',\n          toolCallId: input.toolCallId,\n          output: input.output,\n          isError: input.isError,\n        });\n      },\n      submitToolApproval: async input => {\n        channel.send({\n          type: 'tool-approval-response',\n          approvalId: input.approvalId,\n          approved: input.approved,\n          ...(input.reason != null ? { reason: input.reason } : {}),\n        });\n      },\n      done,\n    };\n  };\n\n  const unsupported = (capability: string): never => {\n    throw new HarnessCapabilityUnsupportedError({\n      harnessId: 'deepagents',\n      message: `Harness 'deepagents' does not support ${capability} yet.`,\n    });\n  };\n\n  return {\n    sessionId,\n    isResume,\n    modelId: model,\n    doPromptTurn: async promptOpts => {\n      if (\n        promptOpts.responseFormat?.type === 'json' &&\n        promptOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'deepagents' requires a JSON schema for structured output.\",\n          harnessId: 'deepagents',\n        });\n      }\n      const control = wireTurn({\n        emit: promptOpts.emit,\n        abortSignal: promptOpts.abortSignal,\n      });\n\n      const applyInstructions =\n        !instructionsApplied && !!promptOpts.instructions;\n      instructionsApplied = true;\n\n      channel.send({\n        type: 'start',\n        prompt: extractUserText(promptOpts.prompt),\n        ...(applyInstructions ? { instructions: promptOpts.instructions } : {}),\n        tools: (promptOpts.tools ?? []).map(t => ({\n          name: t.name,\n          description: t.description,\n          inputSchema: t.inputSchema,\n        })),\n        ...(promptOpts.responseFormat == null\n          ? {}\n          : { responseFormat: promptOpts.responseFormat }),\n        ...(model ? { model } : {}),\n        ...(thinking ? { thinking } : {}),\n        ...(effort ? { effort } : {}),\n        ...(skillsPaths?.length ? { skillsPaths } : {}),\n        ...(permissionMode ? { permissionMode } : {}),\n        ...(builtinToolFiltering ? { builtinToolFiltering } : {}),\n        ...(recursionLimit != null ? { recursionLimit } : {}),\n        ...(mcpServers == null ? {} : { mcpServers }),\n      });\n\n      return control;\n    },\n    doContinueTurn: async continueOpts => {\n      if (\n        continueOpts.responseFormat?.type === 'json' &&\n        continueOpts.responseFormat.schema == null\n      ) {\n        throw new HarnessCapabilityUnsupportedError({\n          message:\n            \"Harness 'deepagents' requires a JSON schema for structured output.\",\n          harnessId: 'deepagents',\n        });\n      }\n      // Attach/replay: doStart opened with `{ resume: true }` so the bridge replays past the cursor; no `start` is sent (that would clear the replay log).\n      return wireTurn({\n        emit: continueOpts.emit,\n        abortSignal: continueOpts.abortSignal,\n      });\n    },\n    doSuspendTurn: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is stopped; cannot suspend.`,\n        );\n      }\n      stopped = true;\n      // Freeze the active turn at the cursor, leaving the bridge running so the next slice replays the tail.\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ContinueTurnState = {\n        type: 'continue-turn',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doDetach: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is already stopped; cannot detach.`,\n        );\n      }\n      stopped = true;\n      // Park between turns: close the host socket but leave the bridge running for a later reattach via these coords.\n      const lastSeenEventId = await channel.suspend();\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data: {\n          ...(sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment }),\n          bridge: {\n            port: bridgePort,\n            token: bridgeToken,\n            lastSeenEventId,\n            ...(sandboxId == null ? {} : { sandboxId }),\n          },\n        },\n      };\n      return payload;\n    },\n    doCompact: async () => unsupported('manual compaction'),\n    doStop: async () => {\n      if (stopped) {\n        throw new Error(\n          `deepagents session ${sessionId} is already stopped; cannot stop.`,\n        );\n      }\n      stopped = true;\n      await teardown({ channel, proc, operation: 'stop' });\n      // In-memory conversation is lost on teardown; the sandbox snapshot preserves the workspace files, not the conversation.\n      const payload: HarnessV1ResumeSessionState = {\n        type: 'resume-session',\n        harnessId: 'deepagents',\n        specificationVersion: 'harness-v1',\n        data:\n          sandboxCredentialEnvironment == null\n            ? {}\n            : { sandboxCredentialEnvironment },\n      };\n      return payload;\n    },\n    doDestroy: async () => {\n      if (stopped) return;\n      stopped = true;\n      await teardown({ channel, proc, operation: 'destroy' });\n    },\n  };\n}\n\nasync function teardown({\n  channel,\n  proc,\n  operation,\n}: {\n  channel: DeepAgentsChannel;\n  proc: Experimental_SandboxProcess | undefined;\n  operation: 'stop' | 'destroy';\n}): Promise<void> {\n  channel.beginClose();\n  try {\n    if (!channel.isClosed()) {\n      channel.send({ type: operation });\n    }\n  } catch {}\n  let stopTimer: ReturnType<typeof setTimeout> | undefined;\n  try {\n    if (proc) {\n      await Promise.race([\n        proc.wait(),\n        new Promise<void>(resolve => {\n          stopTimer = setTimeout(resolve, 5000);\n          stopTimer.unref?.();\n        }),\n      ]);\n    }\n  } finally {\n    if (stopTimer) clearTimeout(stopTimer);\n    try {\n      await proc?.kill();\n    } catch {}\n    channel.close();\n  }\n}\n\n// Reduce the prompt to plain user text; non-text parts are unsupported.\nfunction extractUserText(prompt: HarnessV1Prompt): string {\n  if (typeof prompt === 'string') return prompt;\n  const { content } = prompt;\n  if (typeof content === 'string') return content;\n  const parts: string[] = [];\n  for (const part of content) {\n    if (part.type !== 'text') {\n      throw new HarnessCapabilityUnsupportedError({\n        harnessId: 'deepagents',\n        message: `The deepagents harness does not yet support user message parts of type '${part.type}'. Pass a string or a user message whose content contains only text parts.`,\n      });\n    }\n    parts.push(part.text);\n  }\n  return parts.join('\\n\\n');\n}\n","import { readFile } from 'node:fs/promises';\nimport { fileURLToPath } from 'node:url';\nimport type { HarnessV1Bootstrap } from '@ai-sdk/harness';\n\n/*\n * Bootstrap is derived state stored under the sandbox's default working\n * directory so snapshot-capable providers preserve its installation and\n * recipe marker without requiring root filesystem access.\n */\nexport const DEEPAGENTS_BOOTSTRAP_DIR = '.harness-bootstrap/deepagents';\n\n/*\n * Pinned ripgrep release and per-architecture tarball checksums are verified\n * before installation.\n */\nconst RIPGREP_VERSION = '14.1.1';\nconst RIPGREP_SHA256_X64 =\n  '4cf9f2741e6c465ffdb7c26f38056a59e2a2544b51f7cc128ef28337eeae4d8e';\nconst RIPGREP_SHA256_ARM =\n  'c827481c4ff4ea10c9dc7a4022c8de5db34a5737cb74484d62eb94a95841ab2f';\n\nlet cachedBootstrap: HarnessV1Bootstrap | undefined;\n\nexport async function getDeepAgentsBootstrap(): Promise<HarnessV1Bootstrap> {\n  if (cachedBootstrap != null) return cachedBootstrap;\n  const [bridge, pkg, lock] = await Promise.all([\n    readBridgeAsset('index.mjs'),\n    readBridgeAsset('package.json'),\n    readBridgeAsset('pnpm-lock.yaml'),\n  ]);\n  cachedBootstrap = {\n    harnessId: 'deepagents',\n    bootstrapDir: DEEPAGENTS_BOOTSTRAP_DIR,\n    files: [\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/bridge.mjs`, content: bridge },\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/package.json`, content: pkg },\n      { path: `${DEEPAGENTS_BOOTSTRAP_DIR}/pnpm-lock.yaml`, content: lock },\n    ],\n    commands: [\n      { command: installRipgrepCommand() },\n      {\n        command: 'pnpm install --frozen-lockfile --store-dir .pnpm-store',\n      },\n    ],\n  };\n  return cachedBootstrap;\n}\n\n/*\n * DeepAgents' grep shells out to `rg`. Without it, the fallback reads the\n * entire workdir, including node_modules, into memory and can run out of\n * memory. The checksum-verified installation is skipped when `rg` exists.\n */\nfunction installRipgrepCommand(): string {\n  const v = RIPGREP_VERSION;\n  return [\n    'command -v rg >/dev/null 2>&1 || {',\n    'case \"$(uname -m)\" in',\n    `aarch64) a=aarch64-unknown-linux-gnu; sha=${RIPGREP_SHA256_ARM} ;;`,\n    `*) a=x86_64-unknown-linux-musl; sha=${RIPGREP_SHA256_X64} ;;`,\n    'esac;',\n    `f=/tmp/ripgrep-${v}.tar.gz;`,\n    `curl -fsSL \"https://github.com/BurntSushi/ripgrep/releases/download/${v}/ripgrep-${v}-$a.tar.gz\" -o \"$f\"`,\n    '&& echo \"$sha  $f\" | sha256sum -c -',\n    '&& tar xzf \"$f\" -C /tmp',\n    `&& mv \"/tmp/ripgrep-${v}-$a/rg\" /usr/local/bin/rg && chmod +x /usr/local/bin/rg;`,\n    '}',\n  ].join(' ');\n}\n\nasync function readBridgeAsset(name: string): Promise<string> {\n  const candidates = [\n    new URL(`./bridge/${name}`, import.meta.url),\n    new URL(`../bridge/${name}`, import.meta.url),\n  ];\n  let lastErr: unknown;\n  for (const url of candidates) {\n    try {\n      return await readFile(fileURLToPath(url), 'utf8');\n    } catch (err) {\n      const code = (err as NodeJS.ErrnoException).code;\n      if (code !== 'ENOENT') throw err;\n      lastErr = err;\n    }\n  }\n  throw lastErr ?? new Error(`bridge asset not found: ${name}`);\n}\n","import type {\n  HarnessV1RequestTransformation,\n  HarnessV1RequestTransformationSources,\n} from '@ai-sdk/harness';\nimport {\n  createCredentialRequestTransformation,\n  getAiGatewayAuthFromEnv,\n} from '@ai-sdk/harness/utils';\n\nexport const DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES = [\n  'AI_GATEWAY_API_KEY',\n  'ANTHROPIC_API_KEY',\n  'ANTHROPIC_AUTH_TOKEN',\n] as const;\n\nexport function createDeepAgentsRequestTransformations({\n  env: environment,\n  sandboxEnv: sandboxEnvironment,\n  auth: authenticationMode,\n}: HarnessV1RequestTransformationSources<DeepAgentsResolvedAuthenticationMode>): HarnessV1RequestTransformation[] {\n  const matchUrl =\n    authenticationMode === 'ai-gateway'\n      ? environment.ANTHROPIC_BASE_URL\n      : (environment.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com');\n  const transformations: HarnessV1RequestTransformation[] = [];\n\n  if (\n    environment.ANTHROPIC_API_KEY != null &&\n    sandboxEnvironment.ANTHROPIC_API_KEY != null\n  ) {\n    transformations.push(\n      createCredentialRequestTransformation({\n        matchUrl,\n        matchHeaders: {\n          'x-api-key': sandboxEnvironment.ANTHROPIC_API_KEY,\n        },\n        transformHeaders: {\n          'x-api-key': environment.ANTHROPIC_API_KEY,\n        },\n      }),\n    );\n  }\n\n  if (\n    environment.ANTHROPIC_AUTH_TOKEN != null &&\n    sandboxEnvironment.ANTHROPIC_AUTH_TOKEN != null\n  ) {\n    transformations.push(\n      createCredentialRequestTransformation({\n        matchUrl,\n        matchHeaders: {\n          Authorization: `Bearer ${sandboxEnvironment.ANTHROPIC_AUTH_TOKEN}`,\n        },\n        transformHeaders: {\n          Authorization: `Bearer ${environment.ANTHROPIC_AUTH_TOKEN}`,\n        },\n      }),\n    );\n  }\n\n  return transformations;\n}\n\nexport type DeepAgentsResolvedAuthenticationMode = 'anthropic' | 'ai-gateway';\n\nexport type DeepAgentsAuthenticationMode =\n  | DeepAgentsResolvedAuthenticationMode\n  | 'auto';\n\n/**\n * @deprecated Passing an object to auth options is deprecated. Use a `DeepAgentsAuthenticationMode` string value (\"auto\" | \"anthropic\" | \"ai-gateway\") instead, and pass credentials via environment variables.\n */\nexport type LegacyDeepAgentsAuthOptions = {\n  readonly anthropic?: {\n    readonly apiKey?: string;\n    readonly authToken?: string;\n    readonly baseUrl?: string;\n  };\n  readonly gateway?: {\n    readonly apiKey?: string;\n    readonly baseUrl?: string;\n  };\n};\n\nexport type DeepAgentsAuthOptions =\n  | DeepAgentsAuthenticationMode\n  | LegacyDeepAgentsAuthOptions;\n\n// DeepAgents always drives the Anthropic client. Non-Anthropic models reach it\n// through AI Gateway's Anthropic-compatible endpoint, which translates to any\n// model (Gemini, OpenAI, etc.), tool calls included.\nexport function resolveDeepAgentsEnv({\n  auth,\n  processEnv = process.env,\n}: {\n  auth?: DeepAgentsAuthOptions;\n  processEnv?: Record<string, string | undefined>;\n}): Record<string, string> {\n  const normalizedAuth = normalizeDeepAgentsAuthToLegacyAuth(auth);\n\n  if (normalizedAuth?.anthropic) {\n    return pickAnthropic({ explicit: normalizedAuth.anthropic, processEnv });\n  }\n\n  const gatewayAuthFromEnv = getAiGatewayAuthFromEnv({ env: processEnv });\n  if (normalizedAuth?.gateway) {\n    return pickGateway({\n      explicit: normalizedAuth.gateway,\n      gatewayAuthFromEnv,\n    });\n  }\n  if (gatewayAuthFromEnv.apiKey) {\n    return pickGateway({ explicit: {}, gatewayAuthFromEnv });\n  }\n\n  return pickAnthropic({ processEnv });\n}\n\nexport function resolveDeepAgentsAuthenticationMode({\n  auth,\n  processEnv = process.env,\n}: {\n  auth?: DeepAgentsAuthOptions;\n  processEnv?: Record<string, string | undefined>;\n}): DeepAgentsResolvedAuthenticationMode {\n  if (auth === 'anthropic' || (typeof auth !== 'string' && auth?.anthropic)) {\n    return 'anthropic';\n  }\n  if (auth === 'ai-gateway' || (typeof auth !== 'string' && auth?.gateway)) {\n    return 'ai-gateway';\n  }\n  return getAiGatewayAuthFromEnv({ env: processEnv }).apiKey\n    ? 'ai-gateway'\n    : 'anthropic';\n}\n\nfunction normalizeDeepAgentsAuthToLegacyAuth(\n  auth: DeepAgentsAuthOptions | undefined,\n): LegacyDeepAgentsAuthOptions | undefined {\n  if (auth == null || auth === 'auto') {\n    return undefined;\n  }\n  if (typeof auth === 'string') {\n    switch (auth) {\n      case 'anthropic':\n        return { anthropic: {} };\n      case 'ai-gateway':\n        return { gateway: {} };\n      default:\n        return undefined;\n    }\n  }\n\n  console.warn(\n    '[deepagents] Passing an object to auth options is deprecated. Use a string mode (\"auto\" | \"anthropic\" | \"ai-gateway\") instead, and pass credentials via environment variables.',\n  );\n  return auth;\n}\n\nfunction pickAnthropic({\n  explicit,\n  processEnv,\n}: {\n  explicit?: NonNullable<LegacyDeepAgentsAuthOptions['anthropic']>;\n  processEnv: Record<string, string | undefined>;\n}): Record<string, string> {\n  const env: Record<string, string> = {};\n  const apiKey = explicit?.apiKey ?? processEnv.ANTHROPIC_API_KEY;\n  if (apiKey) env.ANTHROPIC_API_KEY = apiKey;\n  const authToken = explicit?.authToken ?? processEnv.ANTHROPIC_AUTH_TOKEN;\n  if (authToken) env.ANTHROPIC_AUTH_TOKEN = authToken;\n  const baseUrl = explicit?.baseUrl ?? processEnv.ANTHROPIC_BASE_URL;\n  if (baseUrl) env.ANTHROPIC_BASE_URL = baseUrl;\n  return env;\n}\n\nfunction pickGateway({\n  explicit,\n  gatewayAuthFromEnv,\n}: {\n  explicit: NonNullable<LegacyDeepAgentsAuthOptions['gateway']>;\n  gatewayAuthFromEnv: ReturnType<typeof getAiGatewayAuthFromEnv>;\n}): Record<string, string> {\n  const apiKey = explicit.apiKey ?? gatewayAuthFromEnv.apiKey;\n  // The Anthropic SDK appends `/v1/messages`, so the gateway base stays at its root.\n  const baseUrl = (explicit.baseUrl ?? gatewayAuthFromEnv.baseUrl).replace(\n    /\\/+$/,\n    '',\n  );\n  const env: Record<string, string> = {};\n  if (apiKey) {\n    env.AI_GATEWAY_API_KEY = apiKey;\n    env.ANTHROPIC_API_KEY = apiKey;\n  }\n  env.ANTHROPIC_BASE_URL = baseUrl;\n  return env;\n}\n","import {\n  harnessV1BridgeInboundCommandSchemas,\n  harnessV1BridgeOutboundMessageSchema,\n  harnessV1BridgeReadySchema,\n  harnessV1BridgeStartBaseSchema,\n} from '@ai-sdk/harness';\nimport { z } from 'zod/v4';\n\n// Deep Agents bridge wire protocol; only the `start` payload is adapter-specific.\nexport const outboundMessageSchema = harnessV1BridgeOutboundMessageSchema;\nexport type OutboundMessage = z.infer<typeof outboundMessageSchema>;\n\nconst thinkingSchema = z.discriminatedUnion('type', [\n  z.object({\n    type: z.literal('adaptive'),\n    display: z.enum(['summarized', 'omitted']).optional(),\n  }),\n  z.object({\n    type: z.literal('enabled'),\n    budget_tokens: z.number(),\n    display: z.enum(['summarized', 'omitted']).optional(),\n  }),\n  z.object({ type: z.literal('disabled') }),\n]);\n\nexport const startMessageSchema = harnessV1BridgeStartBaseSchema.extend({\n  mcpServers: z.record(z.string(), z.unknown()).optional(),\n  /*\n   * Appended to Deep Agents's native system prompt when the bridge constructs\n   * the session's agent.\n   */\n  instructions: z.string().optional(),\n  thinking: thinkingSchema.optional(),\n  effort: z.enum(['low', 'medium', 'high', 'xhigh', 'max']).optional(),\n  // In-backend skills source dirs ($HOME and <workDir>), passed to createDeepAgent({ skills }).\n  skillsPaths: z.array(z.string()).optional(),\n  // Max LangGraph super-steps per turn (streamEvents recursionLimit).\n  recursionLimit: z.number().optional(),\n});\n\nexport type StartMessage = z.infer<typeof startMessageSchema>;\n\nexport const inboundMessageSchema = z.discriminatedUnion('type', [\n  startMessageSchema,\n  ...harnessV1BridgeInboundCommandSchemas,\n]);\nexport type InboundMessage = z.infer<typeof inboundMessageSchema>;\n\nexport const bridgeReadySchema = harnessV1BridgeReadySchema;\nexport type BridgeReady = z.infer<typeof bridgeReadySchema>;\n","// Version string of this package injected at build time.\ndeclare const __PACKAGE_VERSION__: string | undefined;\nexport const VERSION: string =\n  typeof __PACKAGE_VERSION__ !== 'undefined'\n    ? __PACKAGE_VERSION__\n    : '0.0.0-test';\n","import { createDeepAgents } from './deepagents-harness';\n\n/** Default `deepagents` harness instance; equivalent to `createDeepAgents()`. */\nexport const deepAgents = createDeepAgents();\n\nexport { createDeepAgents } from './deepagents-harness';\nexport { VERSION } from './version';\nexport type {\n  DeepAgentsHarnessSettings,\n  DeepAgentsThinkingConfig,\n} from './deepagents-harness';\nexport type {\n  DeepAgentsAuthenticationMode,\n  DeepAgentsAuthOptions,\n} from './deepagents-auth';\n"],"mappings":";AAAA,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AACtB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAeK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,eAAe;AAAA,OACV;AACP;AAAA,EACE;AAAA,OAGK;AACP,SAAS,iBAAiB;AAC1B,SAAS,KAAAA,UAAS;;;AC5ClB,SAAS,gBAAgB;AACzB,SAAS,qBAAqB;AAQvB,IAAM,2BAA2B;AAMxC,IAAM,kBAAkB;AACxB,IAAM,qBACJ;AACF,IAAM,qBACJ;AAEF,IAAI;AAEJ,eAAsB,yBAAsD;AAC1E,MAAI,mBAAmB,KAAM,QAAO;AACpC,QAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,QAAQ,IAAI;AAAA,IAC5C,gBAAgB,WAAW;AAAA,IAC3B,gBAAgB,cAAc;AAAA,IAC9B,gBAAgB,gBAAgB;AAAA,EAClC,CAAC;AACD,oBAAkB;AAAA,IAChB,WAAW;AAAA,IACX,cAAc;AAAA,IACd,OAAO;AAAA,MACL,EAAE,MAAM,GAAG,wBAAwB,eAAe,SAAS,OAAO;AAAA,MAClE,EAAE,MAAM,GAAG,wBAAwB,iBAAiB,SAAS,IAAI;AAAA,MACjE,EAAE,MAAM,GAAG,wBAAwB,mBAAmB,SAAS,KAAK;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,MACR,EAAE,SAAS,sBAAsB,EAAE;AAAA,MACnC;AAAA,QACE,SAAS;AAAA,MACX;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOA,SAAS,wBAAgC;AACvC,QAAM,IAAI;AACV,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,6CAA6C,kBAAkB;AAAA,IAC/D,uCAAuC,kBAAkB;AAAA,IACzD;AAAA,IACA,kBAAkB,CAAC;AAAA,IACnB,uEAAuE,CAAC,YAAY,CAAC;AAAA,IACrF;AAAA,IACA;AAAA,IACA,uBAAuB,CAAC;AAAA,IACxB;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,eAAe,gBAAgB,MAA+B;AAC5D,QAAM,aAAa;AAAA,IACjB,IAAI,IAAI,YAAY,IAAI,IAAI,YAAY,GAAG;AAAA,IAC3C,IAAI,IAAI,aAAa,IAAI,IAAI,YAAY,GAAG;AAAA,EAC9C;AACA,MAAI;AACJ,aAAW,OAAO,YAAY;AAC5B,QAAI;AACF,aAAO,MAAM,SAAS,cAAc,GAAG,GAAG,MAAM;AAAA,IAClD,SAAS,KAAK;AACZ,YAAM,OAAQ,IAA8B;AAC5C,UAAI,SAAS,SAAU,OAAM;AAC7B,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,QAAM,WAAW,IAAI,MAAM,2BAA2B,IAAI,EAAE;AAC9D;;;AClFA;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,IAAM,8CAA8C;AAAA,EACzD;AAAA,EACA;AAAA,EACA;AACF;AAEO,SAAS,uCAAuC;AAAA,EACrD,KAAK;AAAA,EACL,YAAY;AAAA,EACZ,MAAM;AACR,GAAkH;AAChH,QAAM,WACJ,uBAAuB,eACnB,YAAY,qBACX,YAAY,sBAAsB;AACzC,QAAM,kBAAoD,CAAC;AAE3D,MACE,YAAY,qBAAqB,QACjC,mBAAmB,qBAAqB,MACxC;AACA,oBAAgB;AAAA,MACd,sCAAsC;AAAA,QACpC;AAAA,QACA,cAAc;AAAA,UACZ,aAAa,mBAAmB;AAAA,QAClC;AAAA,QACA,kBAAkB;AAAA,UAChB,aAAa,YAAY;AAAA,QAC3B;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MACE,YAAY,wBAAwB,QACpC,mBAAmB,wBAAwB,MAC3C;AACA,oBAAgB;AAAA,MACd,sCAAsC;AAAA,QACpC;AAAA,QACA,cAAc;AAAA,UACZ,eAAe,UAAU,mBAAmB,oBAAoB;AAAA,QAClE;AAAA,QACA,kBAAkB;AAAA,UAChB,eAAe,UAAU,YAAY,oBAAoB;AAAA,QAC3D;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;AA8BO,SAAS,qBAAqB;AAAA,EACnC;AAAA,EACA,aAAa,QAAQ;AACvB,GAG2B;AACzB,QAAM,iBAAiB,oCAAoC,IAAI;AAE/D,MAAI,gBAAgB,WAAW;AAC7B,WAAO,cAAc,EAAE,UAAU,eAAe,WAAW,WAAW,CAAC;AAAA,EACzE;AAEA,QAAM,qBAAqB,wBAAwB,EAAE,KAAK,WAAW,CAAC;AACtE,MAAI,gBAAgB,SAAS;AAC3B,WAAO,YAAY;AAAA,MACjB,UAAU,eAAe;AAAA,MACzB;AAAA,IACF,CAAC;AAAA,EACH;AACA,MAAI,mBAAmB,QAAQ;AAC7B,WAAO,YAAY,EAAE,UAAU,CAAC,GAAG,mBAAmB,CAAC;AAAA,EACzD;AAEA,SAAO,cAAc,EAAE,WAAW,CAAC;AACrC;AAEO,SAAS,oCAAoC;AAAA,EAClD;AAAA,EACA,aAAa,QAAQ;AACvB,GAGyC;AACvC,MAAI,SAAS,eAAgB,OAAO,SAAS,YAAY,MAAM,WAAY;AACzE,WAAO;AAAA,EACT;AACA,MAAI,SAAS,gBAAiB,OAAO,SAAS,YAAY,MAAM,SAAU;AACxE,WAAO;AAAA,EACT;AACA,SAAO,wBAAwB,EAAE,KAAK,WAAW,CAAC,EAAE,SAChD,eACA;AACN;AAEA,SAAS,oCACP,MACyC;AACzC,MAAI,QAAQ,QAAQ,SAAS,QAAQ;AACnC,WAAO;AAAA,EACT;AACA,MAAI,OAAO,SAAS,UAAU;AAC5B,YAAQ,MAAM;AAAA,MACZ,KAAK;AACH,eAAO,EAAE,WAAW,CAAC,EAAE;AAAA,MACzB,KAAK;AACH,eAAO,EAAE,SAAS,CAAC,EAAE;AAAA,MACvB;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAEA,UAAQ;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AACF,GAG2B;AACzB,QAAM,MAA8B,CAAC;AACrC,QAAM,SAAS,UAAU,UAAU,WAAW;AAC9C,MAAI,OAAQ,KAAI,oBAAoB;AACpC,QAAM,YAAY,UAAU,aAAa,WAAW;AACpD,MAAI,UAAW,KAAI,uBAAuB;AAC1C,QAAM,UAAU,UAAU,WAAW,WAAW;AAChD,MAAI,QAAS,KAAI,qBAAqB;AACtC,SAAO;AACT;AAEA,SAAS,YAAY;AAAA,EACnB;AAAA,EACA;AACF,GAG2B;AACzB,QAAM,SAAS,SAAS,UAAU,mBAAmB;AAErD,QAAM,WAAW,SAAS,WAAW,mBAAmB,SAAS;AAAA,IAC/D;AAAA,IACA;AAAA,EACF;AACA,QAAM,MAA8B,CAAC;AACrC,MAAI,QAAQ;AACV,QAAI,qBAAqB;AACzB,QAAI,oBAAoB;AAAA,EAC1B;AACA,MAAI,qBAAqB;AACzB,SAAO;AACT;;;ACpMA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAGX,IAAM,wBAAwB;AAGrC,IAAM,iBAAiB,EAAE,mBAAmB,QAAQ;AAAA,EAClD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,UAAU;AAAA,IAC1B,SAAS,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AAAA,EACD,EAAE,OAAO;AAAA,IACP,MAAM,EAAE,QAAQ,SAAS;AAAA,IACzB,eAAe,EAAE,OAAO;AAAA,IACxB,SAAS,EAAE,KAAK,CAAC,cAAc,SAAS,CAAC,EAAE,SAAS;AAAA,EACtD,CAAC;AAAA,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,UAAU,EAAE,CAAC;AAC1C,CAAC;AAEM,IAAM,qBAAqB,+BAA+B,OAAO;AAAA,EACtE,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvD,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,UAAU,eAAe,SAAS;AAAA,EAClC,QAAQ,EAAE,KAAK,CAAC,OAAO,UAAU,QAAQ,SAAS,KAAK,CAAC,EAAE,SAAS;AAAA;AAAA,EAEnE,aAAa,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA,EAE1C,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAIM,IAAM,uBAAuB,EAAE,mBAAmB,QAAQ;AAAA,EAC/D;AAAA,EACA,GAAG;AACL,CAAC;;;AC3CM,IAAM,UACX,OACI,WACA;;;AJ+DN,IAAM,wBAAwB,6BAA6B,OAAO;AAiBlE,IAAM,qBAAqB;AAiD3B,IAAM,2BAA2B;AAAA,EAC/B,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaC,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,EAAE,CAAC;AAAA,EACjD,CAAC;AAAA,EACD,OAAO,WAAW,SAAS;AAAA,IACzB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,WAAWA,GAAE,OAAO,GAAG,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EACtE,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,WAAWA,GAAE,OAAO;AAAA,MACpB,YAAYA,GAAE,OAAO;AAAA,MACrB,YAAYA,GAAE,OAAO;AAAA,IACvB,CAAC;AAAA,EACH,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA,EACD,MAAM,WAAW,QAAQ;AAAA,IACvB,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,SAASA,GAAE,OAAO,EAAE,CAAC;AAAA,EAC/C,CAAC;AAAA;AAAA,EAED,IAAI,KAAK;AAAA,IACP,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,MAAMA,GAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AAAA,EACvD,CAAC;AAAA,EACD,MAAM,KAAK;AAAA,IACT,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO;AAAA,MACpB,aAAaA,GAAE,OAAO,EAAE,SAAS;AAAA,MACjC,eAAeA,GAAE,OAAO,EAAE,SAAS;AAAA,IACrC,CAAC;AAAA,EACH,CAAC;AAAA,EACD,aAAa,KAAK;AAAA,IAChB,aAAa;AAAA,IACb,aAAaA,GAAE,OAAO,EAAE,OAAOA,GAAE,MAAMA,GAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,CAAC;AAAA,EAClE,CAAC;AACH;AAGA,IAAM,+BAA+BA,GAAE,OAAO;AAAA,EAC5C,MAAMA,GAAE,OAAO;AAAA,EACf,OAAOA,GAAE,OAAO;AAAA,EAChB,iBAAiBA,GAAE,OAAO;AAAA,EAC1B,WAAWA,GAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AACD,IAAM,8BAA8BA,GAAE,OAAO;AAAA,EAC3C,QAAQ,6BAA6B,SAAS;AAAA,EAC9C,8BAA8BA,GAAE,OAAOA,GAAE,OAAO,GAAGA,GAAE,OAAO,CAAC,EAAE,SAAS;AAC1E,CAAC;AAGM,SAAS,iBACd,WAAsC,CAAC,GACK;AAC5C,SAAO;AAAA,IACL,sBAAsB;AAAA,IACtB,WAAW;AAAA,IACX,cAAc;AAAA;AAAA,IAEd,8BAA8B;AAAA,IAC9B,sBAAsB;AAAA,IACtB,cAAc;AAAA,IACd,SAAS,OAAM,cAAa;AAC1B,YAAM,iBAAiB,UAAU;AACjC,YAAM,iBAAiB,UAAU;AACjC,YAAM,yBACJ,4BAA4B,cAAc;AAC5C,YAAM,YAAY,QAAQ,iBAAiB,eAAe,KAAK;AAC/D,mCAA6B;AAAA,QAC3B;AAAA,QACA,MAAM,SAAS;AAAA,QACf,cAAc,SAAS;AAAA,MACzB,CAAC;AACD,UAAI,SAAS,mBAAmB,QAAQ,aAAa,MAAM;AACzD,cAAM,IAAI,kCAAkC;AAAA,UAC1C,WAAW;AAAA,UACX,SACE;AAAA,QACJ,CAAC;AAAA,MACH;AACA,YAAM,0BACJ,MAAM,sCAAsC;AAAA,QAC1C;AAAA,QACA,aAAa,UAAU;AAAA,MACzB,CAAC;AACH,YAAM,iBAAiB,UAAU,gBAAgB,UAAU;AAC3D,YAAM,WAAW,kBAAkB;AACnC,YAAM,aAAa,UAAU,gBAAgB;AAC7C,YAAM,aACJ,YAAY,OAAO,gBAAgB,SAAS,WACvC,eAAe,OAIhB;AACN,YAAM,SAAS,YAAY;AAC3B,YAAM,qBAAqB,oCAAoC;AAAA,QAC7D,MAAM,SAAS;AAAA,MACjB,CAAC;AACD,YAAM,0BAA0B,qBAAqB;AAAA,QACnD,MAAM,SAAS;AAAA,MACjB,CAAC;AACD,UAAI,yBAAyB;AAC7B,UAAI;AACJ,UAAI,sBAAsB;AAC1B,UACE,+BAA+B,kBAC/B,eAAe,6BAA6B,MAC5C;AACA,uCACE,YAAY,gCACX,MAAM,mCAAmC;AAAA,UACxC,aAAa;AAAA,UACb,gCACE;AAAA,UACF,sBAAsB,SAAS;AAAA,QACjC,CAAC;AACH,iCAAyB;AAAA,UACvB,GAAG;AAAA,UACH,GAAG;AAAA,QACL;AACA,cAAM,yBAAyB,uCAAuC;AAAA,UACpE,KAAK;AAAA,UACL,YAAY;AAAA,UACZ,MAAM;AAAA,QACR,CAAC;AACD,YAAI,uBAAuB,SAAS,GAAG;AACrC,gBAAM,eAAe;AAAA,YACnB;AAAA,UACF;AAAA,QACF;AACA,8BAAsB;AAAA,MACxB,OAAO;AACL,2CAAmC;AAAA,MACrC;AACA,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,MACF;AAEA,YAAM,UAAU,UAAU;AAC1B,YAAM,iBAAiB,GAAG,uBAAuB,gBAAgB,UAAU,SAAS;AACpF,YAAM,iBAAiB,GAAG,cAAc;AACxC,YAAM,YAAY,SAAS,oBAAoB;AAE/C,YAAM,SAAS,UAAU,eAAe;AACxC,YAAM,eAAe,SACjB,CAAC,UACC;AAAA,QACE,mCAAmC,OAAO;AAAA,UACxC,WAAW,UAAU;AAAA,UACrB,WAAW,KAAK,IAAI;AAAA,QACtB,CAAC;AAAA,MACH,IACF;AACJ,YAAM,gBAAgB,yBAAyB;AAAA,QAC7C,WAAW;AAAA,QACX,WAAW,UAAU;AAAA,MACvB,CAAC;AAGD,UAAI,QAAQ;AACV,YAAI;AACF,gBAAMC,YAAW,MAAM,sBAAsB;AAAA,YAC3C;AAAA,YACA,UAAU,SAAS;AAAA,YACnB,MAAM,OAAO;AAAA,UACf,CAAC;AACD,gBAAM,iBAAiB,gBAAgB;AAAA,YACrC,UAAAA;AAAA,YACA,OAAO,OAAO;AAAA,UAChB,CAAC;AACD,gBAAM,gBAAmC,IAAI,eAAe;AAAA,YAC1D,SAAS,MAAM,cAAc,cAAc;AAAA,YAC3C,gBAAgB;AAAA,YAChB,wBAAwB,OAAO;AAAA,YAC/B;AAAA,YACA;AAAA,UACF,CAAC;AACD,gBAAM,cAAc,KAAK,aAAa,EAAE,QAAQ,KAAK,IAAI,MAAS;AAClE,iBAAO,cAAc;AAAA,YACnB,WAAW,UAAU;AAAA,YACrB,SAAS;AAAA,YACT,MAAM;AAAA,YACN,OAAO,SAAS;AAAA,YAChB,UAAU,SAAS;AAAA,YACnB,QAAQ,SAAS;AAAA,YACjB,YAAY,OAAO;AAAA,YACnB,aAAa,OAAO;AAAA,YACpB;AAAA,YACA;AAAA,YACA,UAAU;AAAA,YACV,UAAU;AAAA,YACV;AAAA,YACA,sBAAsB,UAAU;AAAA,YAChC,gBAAgB,SAAS;AAAA,YACzB,YAAY,SAAS;AAAA,UACvB,CAAC;AAAA,QACH,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,YAAM,OAAO,kBAAkB;AAAA,QAC7B;AAAA,QACA,UAAU,SAAS;AAAA,MACrB,CAAC;AACD,YAAM,QACJ,SAAS,mBAAmB,OACxB,YAAY,EAAE,EAAE,SAAS,KAAK,IAC9B,SAAS,gBAAgB,SAAU;AAIzC,YAAM,cAAc,CAAC,GAAG,OAAO,GAAG,kBAAkB,EAAE;AAEtD,WAAK,UAAU,QAAQ,UAAU,KAAK,GAAG;AACvC,cAAM,UAAU,MAAM,sBAAsB;AAAA,UAC1C,SAAS;AAAA,UACT,aAAa,UAAU;AAAA,QACzB,CAAC;AACD,cAAM,iBAAiB,GAAG,OAAO,GAAG,kBAAkB;AACtD,cAAM,YAAY;AAAA,UAChB,SAAS;AAAA,UACT,MAAM;AAAA,UACN,QAAQ,UAAU,UAAU,CAAC;AAAA,UAC7B,aAAa,UAAU;AAAA,QACzB,CAAC;AACD,oBAAY,KAAK,cAAc;AAAA,MACjC;AAEA,YAAM,2BAA2B,sBAC7B,yBACA,MAAM,0BAA0B;AAAA,QAC9B,aAAa;AAAA,QACb,gCACE;AAAA,QACF,sBAAsB,SAAS;AAAA,MACjC,CAAC;AACL,YAAM,MAAM;AAAA,QACV,GAAG;AAAA,QACH,2BAA2B;AAAA,QAC3B,sBAAsB;AAAA,QACtB,gBAAgB,OAAO,IAAI;AAAA,MAC7B;AAEA,YAAM,uBAAuB,IAAI;AAAA,QAC/B,SAAS,YAAY,WAAW,OAAO,CAAC,IAAI,WAAW,cAAc,CAAC;AAAA,QACtE,aAAa,UAAU;AAAA,MACzB,CAAC;AAED,YAAM,mBAAmB;AAAA,QACvB,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ,aAAa,UAAU;AAAA,MACzB,CAAC;AAED,YAAM,OAAO,MAAM,uBAAuB,MAAM;AAAA,QAC9C,SAAS,QAAQ,WAAW,GAAG,YAAY,aAAa,CAAC,cAAc,WAAW,OAAO,CAAC,uBAAuB,WAAW,cAAc,CAAC,oBAAoB,WAAW,YAAY,CAAC;AAAA,QACvL;AAAA,QACA,aAAa,UAAU;AAAA,MACzB,CAAC;AACD,YAAM,aAAuB,CAAC;AAC9B,YAAM,mBAAmB,2BAA2B;AAAA,QAClD,QAAQ,KAAK;AAAA,QACb,YAAY;AAAA,QACZ,QAAQ;AAAA,QACR,aAAa;AAAA,MACf,CAAC;AAED,YAAM,EAAE,MAAM,UAAU,IAAI,MAAM,mBAAmB;AAAA,QACnD;AAAA,QACA,SAAS;AAAA,QACT;AAAA,QACA,YAAY;AAAA,QACZ;AAAA,QACA,aAAa,UAAU;AAAA,QACvB,oBAAoB,CAAC,EAAE,MAAAC,OAAM,WAAW,MACtC,yBAAyB;AAAA,UACvB,SAAS;AAAA,UACT,MAAAA;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AAAA,QACH,iBAAiB,CAAC,EAAE,MAAAA,OAAM,WAAW,MACnC,yBAAyB;AAAA,UACvB,SAAS;AAAA,UACT,MAAAA;AAAA,UACA;AAAA,UACA;AAAA,UACA,YAAY;AAAA,QACd,CAAC;AAAA,MACL,CAAC;AACD,WAAK,yBAAyB,KAAK,MAAM;AAEzC,YAAM,WAAW,MAAM,sBAAsB;AAAA,QAC3C;AAAA,QACA,UAAU,SAAS;AAAA,QACnB,MAAM;AAAA,MACR,CAAC;AACD,YAAM,iBAAiB,gBAAgB,EAAE,UAAU,MAAM,CAAC;AAE1D,YAAM,UAA6B,IAAI,eAAe;AAAA,QACpD,SAAS,MAAM,cAAc,cAAc;AAAA,QAC3C,gBAAgB;AAAA,QAChB;AAAA,QACA;AAAA,MACF,CAAC;AACD,YAAM,QAAQ,KAAK;AAEnB,aAAO,cAAc;AAAA,QACnB,WAAW,UAAU;AAAA,QACrB;AAAA,QACA;AAAA,QACA,OAAO,SAAS;AAAA,QAChB,UAAU,SAAS;AAAA,QACnB,QAAQ,SAAS;AAAA,QACjB,YAAY;AAAA,QACZ,aAAa;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA;AAAA,QAEA,UAAU;AAAA,QACV;AAAA,QACA;AAAA,QACA,sBAAsB,UAAU;AAAA,QAChC,gBAAgB,SAAS;AAAA,QACzB,YAAY,SAAS;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB;AAAA,EACzB;AAAA,EACA;AACF,GAGW;AACT,MAAI,aAAa,OAAW,QAAO;AACnC,MAAI,WAAW,kBAAkB,eAAe,MAAM,SAAS,GAAG;AAChE,WAAO,eAAe,MAAM,CAAC;AAAA,EAC/B;AACA,QAAM,IAAI,kCAAkC;AAAA,IAC1C,WAAW;AAAA,IACX,SACE;AAAA,EAEJ,CAAC;AACH;AAEA,SAAS,6BAA6B;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AACF,GAIS;AACP,MAAI,qBAAqB,eAAgB;AACzC,MAAI,QAAQ,MAAM;AAChB,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACA,MAAI,gBAAgB,MAAM;AACxB,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SACE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,eAAe,sBAAsB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AACF,GAImC;AACjC,MAAI,YAAY,KAAM,QAAO;AAC7B,MAAI,qBAAqB,gBAAgB;AACvC,WAAO,eAAe,gBAAgB,EAAE,MAAM,UAAU,KAAK,CAAC;AAAA,EAChE;AACA,QAAM,IAAI,kCAAkC;AAAA,IAC1C,WAAW;AAAA,IACX,SACE;AAAA,EACJ,CAAC;AACH;AAGA,eAAe,YAAY;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKkB;AAKhB,QAAM,mBAAmB;AAAA,IACvB;AAAA,IACA,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,IAClB,yBAAyB,CAAC,EAAE,KAAK,MAC/B,kCAAkC,IAAI;AAAA,IACxC,cAAc;AAAA,IACd,6BAA6B,CAAC,EAAE,WAAW,SAAS,MAClD,gCAAgC,SAAS,MAAM,QAAQ;AAAA,EAC3D,CAAC;AACH;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AACF,GAA8C;AAC5C,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,KAAK,IAAI,UAAU,KAAK;AAAA,MAC5B,SAAS,WAAW,OAAO,SAAY,EAAE,GAAG,QAAQ;AAAA,IACtD,CAAC;AACD,UAAM,SAAS,MAAM;AACnB,SAAG,IAAI,SAAS,OAAO;AACvB,cAAQ,EAAE;AAAA,IACZ;AACA,UAAM,UAAU,CAAC,QAAe;AAC9B,SAAG,IAAI,QAAQ,MAAM;AACrB,aAAO,GAAG;AAAA,IACZ;AACA,OAAG,KAAK,QAAQ,MAAM;AACtB,OAAG,KAAK,SAAS,OAAO;AAAA,EAC1B,CAAC;AACH;AAEA,SAAS,gBAAgB;AAAA,EACvB;AAAA,EACA;AACF,GAG0B;AACxB,QAAM,YAAY,IAAI,IAAI,SAAS,GAAG;AACtC,YAAU,aAAa,IAAI,sBAAsB,KAAK;AACtD,SAAO,EAAE,GAAG,UAAU,KAAK,UAAU,SAAS,EAAE;AAClD;AAEA,SAAS,cAAc;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAsBqB;AACnB,MAAI,UAAU;AACd,MAAI,sBAAsB;AAE1B,QAAM,WAAW,CAAC,aAGY;AAC5B,QAAI;AACJ,QAAI;AACJ,UAAM,OAAO,IAAI,QAAc,CAAC,SAAS,WAAW;AAClD,uBAAiB;AACjB,sBAAgB;AAAA,IAClB,CAAC;AAED,UAAM,SAA4B,CAAC;AACnC,UAAM,UAAU,CAAC,UAA+B;AAC9C,UAAI;AACF,iBAAS,KAAK,KAAK;AAAA,MACrB,QAAQ;AAAA,MAAC;AAAA,IACX;AAEA,UAAM,aAAa;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,YAAY;AAChB,UAAM,gBAAgB,MAAM;AAC1B,UAAI,UAAW;AACf,kBAAY;AACZ,iBAAW,KAAK,OAAQ,GAAE;AAC1B,qBAAgB;AAAA,IAClB;AACA,UAAM,cAAc,CAAC,QAAiB;AACpC,UAAI,UAAW;AACf,kBAAY;AACZ,iBAAW,KAAK,OAAQ,GAAE;AAC1B,oBAAe,GAAG;AAAA,IACpB;AAEA,eAAW,QAAQ,YAAY;AAC7B,aAAO,KAAK,QAAQ,GAAG,MAAM,SAAO,QAAQ,GAAG,CAAC,CAAC;AAAA,IACnD;AACA,WAAO;AAAA,MACL,QAAQ,GAAG,UAAU,SAAO;AAC1B,gBAAQ,GAAG;AACX,sBAAc;AAAA,MAChB,CAAC;AAAA,IACH;AACA,WAAO;AAAA,MACL,QAAQ,GAAG,SAAS,SAAO;AACzB,gBAAQ,GAAG;AACX,oBAAY,IAAI,KAAK;AAAA,MACvB,CAAC;AAAA,IACH;AAGA,UAAM,UAAU,CAAC,OAAe,WAAmB;AACjD,UAAI,UAAW;AACf,UAAI,WAAW,aAAa;AAC1B,sBAAc;AACd;AAAA,MACF;AACA;AAAA,QACE,IAAI,MAAM,oDAAoD;AAAA,MAChE;AAAA,IACF;AACA,YAAQ,QAAQ,OAAO;AAEvB,UAAM,UAAU,MAAM;AACpB,UAAI,UAAW;AACf,UAAI;AACF,gBAAQ,KAAK,EAAE,MAAM,QAAQ,CAAC;AAAA,MAChC,QAAQ;AAAA,MAAC;AACT;AAAA,QACE,SAAS,aAAa,UACpB,IAAI,aAAa,WAAW,YAAY;AAAA,MAC5C;AAAA,IACF;AACA,QAAI,SAAS,aAAa;AACxB,UAAI,SAAS,YAAY,SAAS;AAChC,gBAAQ;AAAA,MACV,OAAO;AACL,iBAAS,YAAY,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AAAA,MACxE;AAAA,IACF;AAEA,WAAO;AAAA,MACL,kBAAkB,OAAM,UAAS;AAC/B,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,YAAY,MAAM;AAAA,UAClB,QAAQ,MAAM;AAAA,UACd,SAAS,MAAM;AAAA,QACjB,CAAC;AAAA,MACH;AAAA,MACA,oBAAoB,OAAM,UAAS;AACjC,gBAAQ,KAAK;AAAA,UACX,MAAM;AAAA,UACN,YAAY,MAAM;AAAA,UAClB,UAAU,MAAM;AAAA,UAChB,GAAI,MAAM,UAAU,OAAO,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,QACzD,CAAC;AAAA,MACH;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,eAA8B;AACjD,UAAM,IAAI,kCAAkC;AAAA,MAC1C,WAAW;AAAA,MACX,SAAS,yCAAyC,UAAU;AAAA,IAC9D,CAAC;AAAA,EACH;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,cAAc,OAAM,eAAc;AAChC,UACE,WAAW,gBAAgB,SAAS,UACpC,WAAW,eAAe,UAAU,MACpC;AACA,cAAM,IAAI,kCAAkC;AAAA,UAC1C,SACE;AAAA,UACF,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AACA,YAAM,UAAU,SAAS;AAAA,QACvB,MAAM,WAAW;AAAA,QACjB,aAAa,WAAW;AAAA,MAC1B,CAAC;AAED,YAAM,oBACJ,CAAC,uBAAuB,CAAC,CAAC,WAAW;AACvC,4BAAsB;AAEtB,cAAQ,KAAK;AAAA,QACX,MAAM;AAAA,QACN,QAAQ,gBAAgB,WAAW,MAAM;AAAA,QACzC,GAAI,oBAAoB,EAAE,cAAc,WAAW,aAAa,IAAI,CAAC;AAAA,QACrE,QAAQ,WAAW,SAAS,CAAC,GAAG,IAAI,QAAM;AAAA,UACxC,MAAM,EAAE;AAAA,UACR,aAAa,EAAE;AAAA,UACf,aAAa,EAAE;AAAA,QACjB,EAAE;AAAA,QACF,GAAI,WAAW,kBAAkB,OAC7B,CAAC,IACD,EAAE,gBAAgB,WAAW,eAAe;AAAA,QAChD,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,QACzB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,QAC/B,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;AAAA,QAC3B,GAAI,aAAa,SAAS,EAAE,YAAY,IAAI,CAAC;AAAA,QAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;AAAA,QAC3C,GAAI,uBAAuB,EAAE,qBAAqB,IAAI,CAAC;AAAA,QACvD,GAAI,kBAAkB,OAAO,EAAE,eAAe,IAAI,CAAC;AAAA,QACnD,GAAI,cAAc,OAAO,CAAC,IAAI,EAAE,WAAW;AAAA,MAC7C,CAAC;AAED,aAAO;AAAA,IACT;AAAA,IACA,gBAAgB,OAAM,iBAAgB;AACpC,UACE,aAAa,gBAAgB,SAAS,UACtC,aAAa,eAAe,UAAU,MACtC;AACA,cAAM,IAAI,kCAAkC;AAAA,UAC1C,SACE;AAAA,UACF,WAAW;AAAA,QACb,CAAC;AAAA,MACH;AAEA,aAAO,SAAS;AAAA,QACd,MAAM,aAAa;AAAA,QACnB,aAAa,aAAa;AAAA,MAC5B,CAAC;AAAA,IACH;AAAA,IACA,eAAe,YAAY;AACzB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AAEV,YAAM,kBAAkB,MAAM,QAAQ,QAAQ;AAC9C,YAAM,UAAsC;AAAA,QAC1C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MAAM;AAAA,UACJ,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;AAAA,UACnC,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,YACP;AAAA,YACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,UAAU,YAAY;AACpB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AAEV,YAAM,kBAAkB,MAAM,QAAQ,QAAQ;AAC9C,YAAM,UAAuC;AAAA,QAC3C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MAAM;AAAA,UACJ,GAAI,gCAAgC,OAChC,CAAC,IACD,EAAE,6BAA6B;AAAA,UACnC,QAAQ;AAAA,YACN,MAAM;AAAA,YACN,OAAO;AAAA,YACP;AAAA,YACA,GAAI,aAAa,OAAO,CAAC,IAAI,EAAE,UAAU;AAAA,UAC3C;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,IACA,WAAW,YAAY,YAAY,mBAAmB;AAAA,IACtD,QAAQ,YAAY;AAClB,UAAI,SAAS;AACX,cAAM,IAAI;AAAA,UACR,sBAAsB,SAAS;AAAA,QACjC;AAAA,MACF;AACA,gBAAU;AACV,YAAM,SAAS,EAAE,SAAS,MAAM,WAAW,OAAO,CAAC;AAEnD,YAAM,UAAuC;AAAA,QAC3C,MAAM;AAAA,QACN,WAAW;AAAA,QACX,sBAAsB;AAAA,QACtB,MACE,gCAAgC,OAC5B,CAAC,IACD,EAAE,6BAA6B;AAAA,MACvC;AACA,aAAO;AAAA,IACT;AAAA,IACA,WAAW,YAAY;AACrB,UAAI,QAAS;AACb,gBAAU;AACV,YAAM,SAAS,EAAE,SAAS,MAAM,WAAW,UAAU,CAAC;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAe,SAAS;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AACF,GAIkB;AAChB,UAAQ,WAAW;AACnB,MAAI;AACF,QAAI,CAAC,QAAQ,SAAS,GAAG;AACvB,cAAQ,KAAK,EAAE,MAAM,UAAU,CAAC;AAAA,IAClC;AAAA,EACF,QAAQ;AAAA,EAAC;AACT,MAAI;AACJ,MAAI;AACF,QAAI,MAAM;AACR,YAAM,QAAQ,KAAK;AAAA,QACjB,KAAK,KAAK;AAAA,QACV,IAAI,QAAc,aAAW;AAC3B,sBAAY,WAAW,SAAS,GAAI;AACpC,oBAAU,QAAQ;AAAA,QACpB,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AAAA,EACF,UAAE;AACA,QAAI,UAAW,cAAa,SAAS;AACrC,QAAI;AACF,YAAM,MAAM,KAAK;AAAA,IACnB,QAAQ;AAAA,IAAC;AACT,YAAQ,MAAM;AAAA,EAChB;AACF;AAGA,SAAS,gBAAgB,QAAiC;AACxD,MAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAM,EAAE,QAAQ,IAAI;AACpB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,SAAS;AAC1B,QAAI,KAAK,SAAS,QAAQ;AACxB,YAAM,IAAI,kCAAkC;AAAA,QAC1C,WAAW;AAAA,QACX,SAAS,2EAA2E,KAAK,IAAI;AAAA,MAC/F,CAAC;AAAA,IACH;AACA,UAAM,KAAK,KAAK,IAAI;AAAA,EACtB;AACA,SAAO,MAAM,KAAK,MAAM;AAC1B;;;AKr9BO,IAAM,aAAa,iBAAiB;","names":["z","z","endpoint","proc"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/harness-deepagents",
-  "version": "1.0.87",
+  "version": "1.0.90",
   "type": "module",
   "license": "Apache-2.0",
   "sideEffects": false,
@@ -26,8 +26,8 @@
     }
   },
   "dependencies": {
-    "@ai-sdk/harness": "1.0.87",
-    "@ai-sdk/provider-utils": "5.0.30",
+    "@ai-sdk/harness": "1.0.90",
+    "@ai-sdk/provider-utils": "5.0.32",
     "ws": "8.21.0"
   },
   "peerDependencies": {

package/src/deepagents-auth.ts

@@ -1,4 +1,7 @@
-import type { HarnessV1RequestTransformation } from '@ai-sdk/harness';
+import type {
+  HarnessV1RequestTransformation,
+  HarnessV1RequestTransformationSources,
+} from '@ai-sdk/harness';
 import {
   createCredentialRequestTransformation,
   getAiGatewayAuthFromEnv,
@@ -10,28 +13,52 @@ export const DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES = [
   'ANTHROPIC_AUTH_TOKEN',
 ] as const;
 
-export function createDeepAgentsRequestTransformations(
-  env: Record<string, string>,
-  auth: DeepAgentsResolvedAuthenticationMode,
-): HarnessV1RequestTransformation[] {
-  const headers: Record<string, string> = {};
-  if (env.ANTHROPIC_API_KEY) {
-    headers['x-api-key'] = env.ANTHROPIC_API_KEY;
+export function createDeepAgentsRequestTransformations({
+  env: environment,
+  sandboxEnv: sandboxEnvironment,
+  auth: authenticationMode,
+}: HarnessV1RequestTransformationSources<DeepAgentsResolvedAuthenticationMode>): HarnessV1RequestTransformation[] {
+  const matchUrl =
+    authenticationMode === 'ai-gateway'
+      ? environment.ANTHROPIC_BASE_URL
+      : (environment.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com');
+  const transformations: HarnessV1RequestTransformation[] = [];
+
+  if (
+    environment.ANTHROPIC_API_KEY != null &&
+    sandboxEnvironment.ANTHROPIC_API_KEY != null
+  ) {
+    transformations.push(
+      createCredentialRequestTransformation({
+        matchUrl,
+        matchHeaders: {
+          'x-api-key': sandboxEnvironment.ANTHROPIC_API_KEY,
+        },
+        transformHeaders: {
+          'x-api-key': environment.ANTHROPIC_API_KEY,
+        },
+      }),
+    );
   }
-  if (env.ANTHROPIC_AUTH_TOKEN) {
-    headers.Authorization = `Bearer ${env.ANTHROPIC_AUTH_TOKEN}`;
+
+  if (
+    environment.ANTHROPIC_AUTH_TOKEN != null &&
+    sandboxEnvironment.ANTHROPIC_AUTH_TOKEN != null
+  ) {
+    transformations.push(
+      createCredentialRequestTransformation({
+        matchUrl,
+        matchHeaders: {
+          Authorization: `Bearer ${sandboxEnvironment.ANTHROPIC_AUTH_TOKEN}`,
+        },
+        transformHeaders: {
+          Authorization: `Bearer ${environment.ANTHROPIC_AUTH_TOKEN}`,
+        },
+      }),
+    );
   }
-  return Object.keys(headers).length === 0
-    ? []
-    : [
-        createCredentialRequestTransformation({
-          baseUrl:
-            auth === 'ai-gateway'
-              ? env.ANTHROPIC_BASE_URL
-              : (env.ANTHROPIC_BASE_URL ?? 'https://api.anthropic.com'),
-          headers,
-        }),
-      ];
+
+  return transformations;
 }
 
 export type DeepAgentsResolvedAuthenticationMode = 'anthropic' | 'ai-gateway';

package/src/deepagents-harness.ts

@@ -21,13 +21,13 @@ import {
 } from '@ai-sdk/harness';
 import {
   applyCredentialForwarding,
+  createSandboxCredentialEnvironment,
   markBridgeStarting,
   createBridgeErrorHandler,
   createBridgeStartupError,
   drainBridgeProcessStream,
   forwardBridgeProcessStream,
   getRestrictedSandboxSession,
-  maskSandboxCredentials,
   resolveSandboxDefaultWorkingDirectory,
   resolveSandboxHomeDir,
   SandboxChannel,
@@ -200,6 +200,7 @@ const deepAgentsBridgeCoordsSchema = z.object({
 });
 const deepAgentsResumeStateSchema = z.object({
   bridge: deepAgentsBridgeCoordsSchema.optional(),
+  sandboxCredentialEnvironment: z.record(z.string(), z.string()).optional(),
 });
 type DeepAgentsBridgeCoords = z.infer<typeof deepAgentsBridgeCoordsSchema>;
 
@@ -237,6 +238,17 @@ export function createDeepAgents(
           sandboxSession,
           abortSignal: startOpts.abortSignal,
         });
+      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
+      const isResume = lifecycleState != null;
+      const isContinue = startOpts.continueFrom != null;
+      const resumeData =
+        isResume && typeof lifecycleState?.data === 'object'
+          ? (lifecycleState.data as {
+              bridge?: DeepAgentsBridgeCoords;
+              sandboxCredentialEnvironment?: Record<string, string>;
+            })
+          : undefined;
+      const coords = resumeData?.bridge;
       const authenticationMode = resolveDeepAgentsAuthenticationMode({
         auth: settings.auth,
       });
@@ -244,24 +256,35 @@ export function createDeepAgents(
         auth: settings.auth,
       });
       let sandboxAuthEnvironment = resolvedAuthEnvironment;
+      let sandboxCredentialEnvironment: Record<string, string> | undefined;
+      let credentialsBrokered = false;
       if (
         'addRequestTransformations' in sandboxSession &&
         sandboxSession.addRequestTransformations != null
       ) {
-        const requestTransformations = createDeepAgentsRequestTransformations(
-          resolvedAuthEnvironment,
-          authenticationMode,
-        );
+        sandboxCredentialEnvironment =
+          resumeData?.sandboxCredentialEnvironment ??
+          (await createSandboxCredentialEnvironment({
+            environment: resolvedAuthEnvironment,
+            credentialEnvironmentVariables:
+              DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
+            credentialForwarding: settings.credentialForwarding,
+          }));
+        sandboxAuthEnvironment = {
+          ...resolvedAuthEnvironment,
+          ...sandboxCredentialEnvironment,
+        };
+        const requestTransformations = createDeepAgentsRequestTransformations({
+          env: resolvedAuthEnvironment,
+          sandboxEnv: sandboxAuthEnvironment,
+          auth: authenticationMode,
+        });
         if (requestTransformations.length > 0) {
           await sandboxSession.addRequestTransformations(
             requestTransformations,
           );
         }
-        sandboxAuthEnvironment = maskSandboxCredentials({
-          environment: resolvedAuthEnvironment,
-          credentialEnvironmentVariables:
-            DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
-        });
+        credentialsBrokered = true;
       } else {
         warnCredentialBrokeringUnavailable();
       }
@@ -270,14 +293,6 @@ export function createDeepAgents(
         BOOTSTRAP_DIR,
       );
 
-      const lifecycleState = startOpts.continueFrom ?? startOpts.resumeFrom;
-      const isResume = lifecycleState != null;
-      const isContinue = startOpts.continueFrom != null;
-      const coords =
-        isResume && typeof lifecycleState?.data === 'object'
-          ? (lifecycleState.data as { bridge?: DeepAgentsBridgeCoords }).bridge
-          : undefined;
-
       const workDir = startOpts.sessionWorkDir;
       const sessionDataDir = `${defaultWorkingDirectory}/.agent-runs/${startOpts.sessionId}`;
       const bridgeStateDir = `${sessionDataDir}/bridge`;
@@ -328,6 +343,7 @@ export function createDeepAgents(
             bridgePort: coords.port,
             bridgeToken: coords.token,
             sandboxId,
+            sandboxCredentialEnvironment,
             isResume: true,
             attached: true,
             permissionMode,
@@ -368,12 +384,14 @@ export function createDeepAgents(
         skillsPaths.push(homeSkillsRoot);
       }
 
-      const forwardedAuthEnvironment = await applyCredentialForwarding({
-        environment: sandboxAuthEnvironment,
-        credentialEnvironmentVariables:
-          DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
-        credentialForwarding: settings.credentialForwarding,
-      });
+      const forwardedAuthEnvironment = credentialsBrokered
+        ? sandboxAuthEnvironment
+        : await applyCredentialForwarding({
+            environment: sandboxAuthEnvironment,
+            credentialEnvironmentVariables:
+              DEEPAGENTS_CREDENTIAL_ENVIRONMENT_VARIABLES,
+            credentialForwarding: settings.credentialForwarding,
+          });
       const env = {
         ...forwardedAuthEnvironment,
         AI_SDK_HARNESS_CLIENT_APP: DEEPAGENTS_CLIENT_APP,
@@ -457,6 +475,7 @@ export function createDeepAgents(
         bridgePort: boundPort,
         bridgeToken: token,
         sandboxId,
+        sandboxCredentialEnvironment,
         isResume,
         // Freshly spawned bridge — it must receive the instructions on the first prompt.
         attached: false,
@@ -608,6 +627,7 @@ function createSession({
   bridgePort,
   bridgeToken,
   sandboxId,
+  sandboxCredentialEnvironment,
   isResume,
   attached,
   skillsPaths,
@@ -626,6 +646,7 @@ function createSession({
   bridgePort: number;
   bridgeToken: string;
   sandboxId: string | undefined;
+  sandboxCredentialEnvironment: Record<string, string> | undefined;
   isResume: boolean;
   // True only when attaching to a live bridge that already built the agent with
   // its instructions. A fresh spawn (incl. a respawn on attach failure or a
@@ -841,6 +862,9 @@ function createSession({
         harnessId: 'deepagents',
         specificationVersion: 'harness-v1',
         data: {
+          ...(sandboxCredentialEnvironment == null
+            ? {}
+            : { sandboxCredentialEnvironment }),
           bridge: {
             port: bridgePort,
             token: bridgeToken,
@@ -865,6 +889,9 @@ function createSession({
         harnessId: 'deepagents',
         specificationVersion: 'harness-v1',
         data: {
+          ...(sandboxCredentialEnvironment == null
+            ? {}
+            : { sandboxCredentialEnvironment }),
           bridge: {
             port: bridgePort,
             token: bridgeToken,
@@ -889,7 +916,10 @@ function createSession({
         type: 'resume-session',
         harnessId: 'deepagents',
         specificationVersion: 'harness-v1',
-        data: {},
+        data:
+          sandboxCredentialEnvironment == null
+            ? {}
+            : { sandboxCredentialEnvironment },
       };
       return payload;
     },