@ai-sdk/harness-pi 1.0.119 → 1.0.121

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @ai-sdk/harness-pi
 
+## 1.0.121
+
+### Patch Changes
+
+- 9e9f18f: fix(harness-pi): support stateless session restoration and injected credentials
+- 2adbb77: feat(harness): update underlying harness SDKs to their latest versions
+- Updated dependencies [125f493]
+  - @ai-sdk/harness@1.0.119
+
+## 1.0.120
+
+### Patch Changes
+
+- f39733b: fix(sandbox-just-bash): seed `realpath` binary via `readlink` so that it is available to consumers that require it, such as the Pi harness
+- a0f7700: fix(harness-pi): make grep compatible with just-bash sandboxes while preserving matches alongside bounded traversal diagnostics
+- Updated dependencies [d975097]
+- Updated dependencies [b2baeba]
+  - @ai-sdk/harness@1.0.118
+
 ## 1.0.119
 
 ### Patch Changes

package/README.md

@@ -51,6 +51,25 @@ try {
 
 The adapter requires a `HarnessV1SandboxProvider`. Pi has no in-sandbox bridge, so the sandbox doesn't need to expose any ports — `@ai-sdk/sandbox-vercel` or `@ai-sdk/sandbox-just-bash` both work.
 
+## Stateless session configuration
+
+By default, a suspended turn can reuse its live Pi session in the same process.
+For stateless or multi-replica applications, set `reattachInProcess: false` so
+continuations restore persisted state using the current request's settings.
+Application-managed credentials can be supplied through a `PiCredentialStore`;
+this replaces Pi's file-backed `auth.json` storage.
+
+```ts
+import { createPi, type PiCredentialStore } from '@ai-sdk/harness-pi';
+
+declare const credentials: PiCredentialStore;
+
+const harness = createPi({
+  credentials,
+  reattachInProcess: false,
+});
+```
+
 ## Inline extensions
 
 Use `extensionFactories` to load trusted inline Pi extensions for each harness session:

package/dist/index.d.ts

@@ -1,7 +1,9 @@
 import * as _ai_sdk_harness from '@ai-sdk/harness';
 import { HarnessV1Authentication, HarnessV1, HarnessV1BuiltinTool } from '@ai-sdk/harness';
-import { ProviderConfig, ExtensionFactory } from '@earendil-works/pi-coding-agent';
+import { CreateModelRuntimeOptions, ProviderConfig, ExtensionFactory } from '@earendil-works/pi-coding-agent';
 
+/** Persistent credential storage consumed by Pi's model runtime. */
+type PiCredentialStore = NonNullable<CreateModelRuntimeOptions['credentials']>;
 /**
  * Pi auth options. Choose an explicit mode or rely on 'auto' (precedence:
  * explicit gateway, then OpenAI / Anthropic / custom environment variables).
@@ -17,6 +19,19 @@ type PiThinkingLevel = 'off' | 'minimal' | 'low' | 'medium' | 'high' | 'xhigh' |
 type PiHarnessSettings = {
     /** Where Pi sources API keys / gateway credentials from. */
     readonly auth?: PiAuthenticationMode;
+    /**
+     * Application-owned credential storage for Pi's model runtime. When set,
+     * this replaces Pi's file-backed auth.json credential storage.
+     */
+    readonly credentials?: PiCredentialStore;
+    /**
+     * Whether a suspended turn may reuse its live Pi session in this process.
+     * Disable this in stateless or multi-replica applications so every request
+     * restores from persisted lifecycle state with the current settings.
+     *
+     * @default true
+     */
+    readonly reattachInProcess?: boolean;
     /**
      * Explicit Pi provider configurations keyed by provider id. Use this to
      * register custom models and their API protocol without coupling model
@@ -122,4 +137,4 @@ declare const pi: _ai_sdk_harness.HarnessV1<{
     readonly ls: _ai_sdk_harness.HarnessV1BuiltinTool;
 }>;
 
-export { type PiAuthenticationMode, type PiHarnessSettings, VERSION, createPi, pi };
+export { type PiAuthenticationMode, type PiCredentialStore, type PiHarnessSettings, VERSION, createPi, pi };

package/dist/index.js

@@ -111,7 +111,7 @@ import {
   SessionManager,
   SettingsManager
 } from "@earendil-works/pi-coding-agent";
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 import { mkdir as mkdir3, rm as rm2, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir } from "os";
 import path6 from "path";
@@ -136,7 +136,7 @@ import {
 import { access } from "fs/promises";
 
 // src/version.ts
-var VERSION = true ? "1.0.119" : "0.0.0-test";
+var VERSION = true ? "1.0.121" : "0.0.0-test";
 
 // src/pi-auth.ts
 var DEFAULT_GATEWAY_BASE_URL = "https://ai-gateway.vercel.sh";
@@ -203,19 +203,20 @@ function scopePiProviderEnvironment({
 }
 async function createPiModelRuntime({
   auth,
+  credentials,
   authPath,
   modelsPath
 }) {
   if (!isHarnessAuthenticationEnvironment(auth)) {
     return ModelRuntime.create({
-      authPath,
+      ...credentials ? { credentials } : { authPath },
       modelsPath,
       allowModelNetwork: false
     });
   }
-  const isolatedCredentials = createIsolatedPiCredentialStore();
+  const isolatedCredentials = credentials == null ? createIsolatedPiCredentialStore() : void 0;
   const modelRuntime = await ModelRuntime.create({
-    credentials: isolatedCredentials.credentials,
+    credentials: credentials ?? isolatedCredentials.credentials,
     modelsPath: null,
     allowModelNetwork: false
   });
@@ -237,7 +238,7 @@ async function createPiModelRuntime({
     modelRuntime,
     authenticationEnvironment: auth
   });
-  isolatedCredentials.finishInitialization();
+  isolatedCredentials?.finishInitialization();
   await modelRuntime.refresh({ allowNetwork: false });
   return modelRuntime;
 }
@@ -795,10 +796,39 @@ function createPiPathMapper(options) {
 }
 
 // src/pi-remote-ops.ts
+import { randomUUID } from "crypto";
 import path3 from "path";
 import { shellQuote } from "@ai-sdk/harness/utils";
-function lastOutputLine(output) {
-  return output.toString("utf8").trim().split("\n").filter(Boolean).at(-1);
+var MAX_GREP_DIAGNOSTIC_BYTES = 8192;
+var REALPATH_FRAME = "__PI_REALPATH_FRAME__";
+var BASE64_PATH_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+function realpathShellLines(targetVariable) {
+  return [
+    "set -o pipefail",
+    `realpath_marker=${shellQuote(REALPATH_FRAME)}`,
+    `realpath_framed=$(realpath "$${targetVariable}" 2>/dev/null; realpath_status=$?; printf '%s' "$realpath_marker"; exit "$realpath_status")`,
+    "realpath_status=$?",
+    'if [ "$realpath_status" -ne 0 ]; then echo "__PI_REALPATH_FAILED__"; exit 3; fi',
+    "resolved=${realpath_framed%$realpath_marker}",
+    "resolved=${resolved%$'\\n'}"
+  ];
+}
+function framePathShell(pathExpression) {
+  return `if ! printf '%s' ${pathExpression} | base64 | tr -d '\\r\\n'; then exit 4; fi; printf '%s' "$realpath_marker"`;
+}
+function parseFramedPath(output) {
+  if (!output.endsWith(REALPATH_FRAME)) return void 0;
+  const encodedPath = output.slice(0, -REALPATH_FRAME.length);
+  if (!encodedPath || !BASE64_PATH_PATTERN.test(encodedPath)) {
+    return void 0;
+  }
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(
+      Buffer.from(encodedPath, "base64")
+    );
+  } catch {
+    return void 0;
+  }
 }
 function createPiRemoteOps(options) {
   const runShell = async (command, input = {}) => {
@@ -808,23 +838,24 @@ function createPiRemoteOps(options) {
       ...options.env ? { env: options.env } : {},
       ...input.signal ? { abortSignal: input.signal } : {}
     });
-    const combined = `${result.stdout}${result.stderr}`;
-    const output = Buffer.from(combined, "utf8");
+    const output = Buffer.from(`${result.stdout}${result.stderr}`, "utf8");
     if (output.length > 0) {
       input.onData?.(output);
     }
     return {
       exitCode: result.exitCode,
-      output
+      output,
+      stdout: result.stdout,
+      stderr: result.stderr
     };
   };
   const resolveExistingSandboxPath = async (remotePath, inputPath) => {
     const result = await runShell(
       [
         `target=${shellQuote(remotePath)}`,
-        `if [ ! -e "$target" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
-        `resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
-        `printf '%s\\n' "$resolved"`
+        ...realpathShellLines("target"),
+        `if [ ! -e "$resolved" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi`,
+        framePathShell('"$resolved"')
       ].join("; ")
     );
     const output = result.output.toString("utf8");
@@ -834,7 +865,7 @@ function createPiRemoteOps(options) {
     if (output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
-    const resolvedPath = lastOutputLine(result.output);
+    const resolvedPath = parseFramedPath(result.stdout);
     if (!resolvedPath) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
@@ -847,20 +878,21 @@ function createPiRemoteOps(options) {
     const result = await runShell(
       [
         `target=${shellQuote(remotePath)}`,
-        `if [ -e "$target" ] || [ -L "$target" ]; then resolved=$(realpath "$target" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }; printf '%s\\n' "$resolved"; exit 0; fi`,
-        `dir=$(dirname "$target")`,
-        `base=$(basename "$target")`,
+        `if [ -e "$target" ] || [ -L "$target" ]; then ${realpathShellLines("target").join("; ")}; ${framePathShell('"$resolved"')}; exit 0; fi`,
+        "dir=${target%/*}",
+        "base=${target##*/}",
+        '[ -n "$dir" ] || dir=/',
         `missing="$base"`,
-        `while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=$(dirname "$dir"); if [ "$parent" = "$dir" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi; missing="$(basename "$dir")/$missing"; dir="$parent"; done`,
-        `resolved_dir=$(realpath "$dir" 2>/dev/null) || { echo "__PI_REALPATH_FAILED__"; exit 3; }`,
-        `printf '%s/%s\\n' "$resolved_dir" "$missing"`
+        'while [ ! -e "$dir" ] && [ ! -L "$dir" ]; do parent=${dir%/*}; [ -n "$parent" ] || parent=/; if [ "$parent" = "$dir" ]; then echo "__PI_REALPATH_NOT_FOUND__"; exit 2; fi; missing=${dir##*/}/$missing; dir=$parent; done',
+        ...realpathShellLines("dir"),
+        framePathShell('"$resolved/$missing"')
       ].join("; ")
     );
     const output = result.output.toString("utf8");
     if (output.includes("__PI_REALPATH_NOT_FOUND__") || output.includes("__PI_REALPATH_FAILED__") || result.exitCode !== 0) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
-    const resolvedPath = lastOutputLine(result.output);
+    const resolvedPath = parseFramedPath(result.stdout);
     if (!resolvedPath) {
       throw new Error(`Unable to resolve path: ${inputPath}`);
     }
@@ -969,29 +1001,126 @@ function createPiRemoteOps(options) {
       input.path ?? "."
     );
     const relativeTarget = options.paths.toRelativePath(resolvedPath);
-    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? resolvedPath : relativeTarget;
-    const flags = [
-      "-r",
+    const targetPath = relativeTarget.startsWith("../") || path3.posix.isAbsolute(relativeTarget) ? resolvedPath : relativeTarget.startsWith("-") ? `./${relativeTarget}` : relativeTarget;
+    const limit = Math.max(1, input.limit ?? 100);
+    const commonFlags = [
       "-n",
-      "--binary-files=without-match",
       ...input.ignoreCase ? ["-i"] : [],
       ...input.literal ? ["-F"] : [],
-      ...typeof input.context === "number" && input.context > 0 ? ["-C", String(input.context)] : [],
-      ...input.glob ? ["--include", input.glob] : []
+      ...typeof input.context === "number" && input.context > 0 ? ["-C", String(input.context)] : []
     ];
-    const limit = Math.max(1, input.limit ?? 100);
+    const recursiveFlags = [
+      "-r",
+      ...commonFlags,
+      "-m",
+      String(limit),
+      ...input.glob ? [`--include=${input.glob}`] : []
+    ];
+    const temporaryPathPrefix = `/tmp/.ai-sdk-harness-pi-grep-${randomUUID()}`;
+    const outputPath = `${temporaryPathPrefix}.stdout`;
+    const stderrPath = `${temporaryPathPrefix}.stderr`;
+    const statusPath = `${temporaryPathPrefix}.status`;
+    const fileOutputPath = `${temporaryPathPrefix}.file.stdout`;
+    const fileStderrPath = `${temporaryPathPrefix}.file.stderr`;
+    const findStderrPath = `${temporaryPathPrefix}.find.stderr`;
+    const boundedFileGrepScript = [
+      `grep_limit=${limit}`,
+      `grep_output=${shellQuote(outputPath)}`,
+      `grep_stderr=${shellQuote(stderrPath)}`,
+      `grep_status=${shellQuote(statusPath)}`,
+      `grep_file_output=${shellQuote(fileOutputPath)}`,
+      `grep_file_stderr=${shellQuote(fileStderrPath)}`,
+      'grep_output_lines=$(wc -l < "$grep_output")',
+      'grep_overall_status=$(cat "$grep_status")',
+      'for grep_file in "$@"; do',
+      "grep_remaining=$((grep_limit - grep_output_lines))",
+      'if [ "$grep_remaining" -le 0 ]; then break; fi',
+      `grep ${commonFlags.map(shellQuote).join(" ")} -m "$grep_remaining" -e ${shellQuote(pattern)} "$grep_file" > "$grep_file_output" 2> "$grep_file_stderr"`,
+      "grep_file_status=$?",
+      'if [ "$grep_file_status" -eq 0 ]; then',
+      "grep_display_file=${grep_file#./}",
+      "grep_file_lines=0",
+      "while IFS= read -r grep_line; do",
+      'if [ "$grep_file_lines" -ge "$grep_remaining" ]; then break; fi',
+      'case "$grep_line" in',
+      `'--') printf '%s\\n' "$grep_line" ;;`,
+      `[0-9]*:*) printf '%s:%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      `[0-9]*-*) printf '%s-%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      `*) printf '%s:%s\\n' "$grep_display_file" "$grep_line" ;;`,
+      "esac",
+      "grep_file_lines=$((grep_file_lines + 1))",
+      'done < "$grep_file_output" >> "$grep_output"',
+      "grep_output_lines=$((grep_output_lines + grep_file_lines))",
+      "grep_overall_status=0",
+      'elif [ "$grep_file_status" -gt 1 ]; then',
+      `grep_diagnostic_size=$(wc -c < "$grep_stderr")`,
+      `grep_diagnostic_remaining=$((${MAX_GREP_DIAGNOSTIC_BYTES} - grep_diagnostic_size))`,
+      'if [ "$grep_diagnostic_remaining" -gt 0 ]; then head -c "$grep_diagnostic_remaining" "$grep_file_stderr" >> "$grep_stderr"; fi',
+      "grep_overall_status=2",
+      "break",
+      "fi",
+      "done",
+      `printf '%s\\n' "$grep_overall_status" > "$grep_status"`
+    ].join("\n");
+    const findFlags = [
+      shellQuote(targetPath),
+      "-type",
+      "f",
+      ...input.glob ? ["-name", shellQuote(input.glob)] : []
+    ].join(" ");
     const result = await runShell(
       [
         `if [ ! -e ${shellQuote(resolvedPath)} ]; then echo "__PI_GREP_NOT_FOUND__"; exit 2; fi`,
         `cd ${shellQuote(options.paths.sandboxWorkDir)}`,
-        `grep ${flags.map(shellQuote).join(" ")} -- ${shellQuote(pattern)} ${shellQuote(targetPath)} 2>/dev/null | head -n ${limit}`
+        // Preserve binary skipping where grep supports it without passing an
+        // unsupported option to just-bash.
+        `binary_option_error=$(grep --binary-files=without-match -e '' /dev/null 2>&1)`,
+        `if [ -z "$binary_option_error" ]; then binary_option='--binary-files=without-match'; else binary_option=''; fi`,
+        `grep_stderr=${shellQuote(stderrPath)}`,
+        `grep_output=${shellQuote(outputPath)}`,
+        `grep_status_file=${shellQuote(statusPath)}`,
+        `grep_find_stderr=${shellQuote(findStderrPath)}`,
+        ': > "$grep_stderr"',
+        // just-bash buffers every pipeline stage and applies grep -m per file.
+        // Search files individually there so the producer never emits more
+        // than the remaining global result limit.
+        `if [ -n "$binary_option" ] || [ ! -d ${shellQuote(targetPath)} ]; then set -o pipefail; grep $binary_option ${recursiveFlags.map(shellQuote).join(" ")} -e ${shellQuote(pattern)} ${shellQuote(targetPath)} 2>"$grep_stderr" | head -n ${limit}; grep_status=$?; else : > "$grep_output"; printf '1\\n' > "$grep_status_file"; find ${findFlags} -exec bash -c ${shellQuote(boundedFileGrepScript)} bash {} + 2>"$grep_find_stderr"; find_status=$?; grep_diagnostic_size=$(wc -c < "$grep_stderr"); grep_diagnostic_remaining=$((${MAX_GREP_DIAGNOSTIC_BYTES} - grep_diagnostic_size)); if [ "$grep_diagnostic_remaining" -gt 0 ]; then head -c "$grep_diagnostic_remaining" "$grep_find_stderr" >> "$grep_stderr"; fi; grep_status=$(cat "$grep_status_file"); if [ "$find_status" -ne 0 ]; then grep_status=2; fi; cat "$grep_output"; fi`,
+        `head -c ${MAX_GREP_DIAGNOSTIC_BYTES} "$grep_stderr" >&2`,
+        `rm -f ${[
+          outputPath,
+          stderrPath,
+          statusPath,
+          fileOutputPath,
+          fileStderrPath,
+          findStderrPath
+        ].map(shellQuote).join(" ")}`,
+        'exit "$grep_status"'
       ].join("; ")
     );
     const output = result.output.toString("utf8").trim();
     if (output.includes("__PI_GREP_NOT_FOUND__")) {
       throw new Error(`Path not found: ${input.path ?? "."}`);
     }
-    return output || "No matches found";
+    const stdout = result.stdout.trim();
+    const stderr = result.stderr.trim();
+    if (result.exitCode === 0 || result.exitCode === 1 || // GNU grep can receive SIGPIPE after head reaches the requested limit.
+    result.exitCode === 141) {
+      if (stdout) {
+        return [stdout, stderr].filter(Boolean).join("\n");
+      }
+      if (stderr) {
+        throw new Error(stderr);
+      }
+      return "No matches found";
+    }
+    if (result.exitCode === 2 && stdout && stderr) {
+      return `${stdout}
+${stderr}`;
+    }
+    if (stderr) {
+      throw new Error(stderr);
+    }
+    throw new Error(output || `grep failed with exit code ${result.exitCode}`);
   };
   return {
     paths: options.paths,
@@ -2100,15 +2229,18 @@ function resolveActivePiBuiltinNames(toolFiltering) {
     (native) => !toolFiltering.toolNames.includes(NATIVE_TO_COMMON[native] ?? native)
   );
 }
+function hasCompatibleReattachSettings(parked, current) {
+  return parked.sandboxSession === current.sandboxSession && parked.sessionWorkDir === current.sessionWorkDir && parked.clientApp === current.clientApp && parked.permissionMode === current.permissionMode && parked.builtinToolFiltering === current.builtinToolFiltering && parked.abortSignal === current.abortSignal && parked.agentDir === current.agentDir && parked.settings.auth === current.settings.auth && parked.settings.credentials === current.settings.credentials && parked.settings.headers === current.settings.headers && parked.settings.thinkingLevel === current.settings.thinkingLevel && parked.settings.mcpServers === current.settings.mcpServers && parked.settings.providers === current.settings.providers && parked.settings.extensionFactories === current.settings.extensionFactories;
+}
 async function isWorkspaceAvailableOnHost({
   sandbox,
   sessionWorkDir
 }) {
   const probePath = path6.join(
     sessionWorkDir,
-    `.ai-sdk-harness-pi-${randomUUID()}`
+    `.ai-sdk-harness-pi-${randomUUID2()}`
   );
-  const probeContent = randomUUID();
+  const probeContent = randomUUID2();
   try {
     await writeFile3(probePath, probeContent, { flag: "wx" });
     const sandboxContent = await sandbox.readBinaryFile({ path: probePath });
@@ -2122,13 +2254,16 @@ async function isWorkspaceAvailableOnHost({
 }
 async function createPiSession(input) {
   if (input.isResume) {
-    const parkedSession = parkedPiSessions.get(input.sessionId);
-    if (parkedSession) {
+    const parked = parkedPiSessions.get(input.sessionId);
+    if (parked) {
       parkedPiSessions.delete(input.sessionId);
-      return {
-        ...parkedSession,
-        isResume: true
-      };
+      if (input.settings.reattachInProcess !== false && (input.resumeStateType == null || input.resumeStateType === parked.stateType) && hasCompatibleReattachSettings(parked.input, input)) {
+        return {
+          ...parked.session,
+          isResume: true
+        };
+      }
+      await parked.session.doDestroy();
     }
   }
   const safeSessionId = input.sessionId.replace(/[\\/: ]/g, "-");
@@ -2200,6 +2335,7 @@ async function createPiSession(input) {
   });
   const modelRuntime = await createPiModelRuntime({
     auth: input.settings.auth,
+    credentials: input.settings.credentials,
     authPath: path6.join(nativeAgentDir ?? hostAgentDir, "auth.json"),
     modelsPath: path6.join(agentDir, "models.json")
   });
@@ -2956,7 +3092,11 @@ async function createPiSession(input) {
     doStop,
     doDetach: async () => {
       if (activeTurn != null || pendingToolResults.size > 0) {
-        parkedPiSessions.set(input.sessionId, sessionImpl);
+        parkedPiSessions.set(input.sessionId, {
+          session: sessionImpl,
+          input,
+          stateType: "resume-session"
+        });
         if (sessionFileName) {
           try {
             await persistSessionFile();
@@ -2977,7 +3117,11 @@ async function createPiSession(input) {
         throw new Error("Pi session has been stopped.");
       }
       if (activeTurn != null && (pendingToolResults.size > 0 || pendingToolApprovals.size > 0)) {
-        parkedPiSessions.set(input.sessionId, sessionImpl);
+        parkedPiSessions.set(input.sessionId, {
+          session: sessionImpl,
+          input,
+          stateType: "continue-turn"
+        });
         if (sessionFileName) {
           try {
             await persistSessionFile();
@@ -3353,6 +3497,8 @@ function createPi(settings = {}) {
         sessionWorkDir: startOpts.sessionWorkDir,
         settings: {
           ...settings.auth ? { auth: settings.auth } : {},
+          ...settings.credentials ? { credentials: settings.credentials } : {},
+          ...settings.reattachInProcess != null ? { reattachInProcess: settings.reattachInProcess } : {},
           ...settings.thinkingLevel ? { thinkingLevel: settings.thinkingLevel } : {},
           ...settings.mcpServers ? { mcpServers: settings.mcpServers } : {},
           ...settings.providers ? { providers: settings.providers } : {},
@@ -3361,6 +3507,7 @@ function createPi(settings = {}) {
         },
         clientApp: PI_CLIENT_APP,
         isResume: lifecycleState != null,
+        ...lifecycleState ? { resumeStateType: lifecycleState.type } : {},
         permissionMode: startOpts.permissionMode,
         builtinToolFiltering: startOpts.builtinToolFiltering,
         ...resumeData?.sessionFileName ? { resumeSessionFileName: resumeData.sessionFileName } : {},