@aigne/agent-runtime 1.12.0-beta.5

package/dist/program/scoped-afs.mjs

@@ -0,0 +1,531 @@
+import { intersectTools, withQueryPairing } from "../providers/basic/ash/dist/index.mjs";
+import { resolveBudget } from "../agent-runners/budget.mjs";
+import { attachScratchMount, createScratchProvider } from "../agent-runners/scratchpad-afs.mjs";
+import { attachMemoryMount, buildMemoryIndexOptsForAfs, buildMemoryStorageForAfs, createMemoryProvider, extractManifestDomain, resolveMemoryDomain } from "../agent-runners/memory-afs.mjs";
+import { MESSAGING_TOOLS_GLOB, MESSAGING_TOOLS_ROOT } from "./agent-messages-tools.mjs";
+import { projectSubAgent } from "@aigne/afs";
+
+//#region src/program/scoped-afs.ts
+/**
+* Chain-depth hard cap. Mirrors `HARD_CAP` in
+* `providers/basic/ash/src/spawn-depth.ts`; kept in sync manually because
+* importing across package boundaries for a constant isn't worth the
+* dependency. Any change there must be reflected here.
+*
+* Semantics match `spawn-depth.ts`: a child whose post-increment depth
+* would be **>= HARD_CAP** is rejected with `CHAIN_DEPTH_EXCEEDED`. With
+* root.chainDepth = 0 this means the deepest reachable child is depth 9;
+* attempting to spawn depth 10 throws.
+*/
+const CHAIN_DEPTH_HARD_CAP = 10;
+/** Default ops applied when a manifest tool entry omits `ops`. */
+const DEFAULT_TOOL_OPS = [
+	"read",
+	"list",
+	"exec",
+	"query"
+];
+/**
+* Built-in messaging tool path — every scope surfaces
+* `/proc/messaging/tools/*`
+* so the LLM can call `agent_post_message` / `agent_read_messages` without
+* each manifest having to declare them. See B32 in
+* `providers/basic/ash/src/agent-run.ts`.
+*/
+const MESSAGING_TOOL_PATH = MESSAGING_TOOLS_GLOB;
+/**
+* Budget mount — per-scope `/.meta/budget/{limit,remaining,consumed}` state
+* files driven by the exec middleware in `attachBudgetMount`. Path contract:
+*
+*   - `read("/.meta/budget/limit")`     → configured ceiling (tokens)
+*   - `read("/.meta/budget/remaining")` → `max(0, limit - consumed)`
+*   - `read("/.meta/budget/consumed")`  → tokens decremented so far
+*   - `write("/.meta/budget/*", ...)`   → always `PERMISSION_DENIED`; only
+*       the middleware may mutate state (via the internal `BudgetState` ref).
+*   - `list("/.meta/budget")`           → three-entry listing (above keys).
+*
+* The exec middleware wraps the underlying `afs.exec`:
+*   1. Pre-check `consumed < limit`; otherwise throw `BUDGET_EXHAUSTED`.
+*   2. Call underlying exec.
+*   3. Extract `tokens_used` from the result and serialize the increment
+*      against the rootSession mutex so concurrent sub-runs don't race.
+*
+* Child scopes created by `projectForChild` inherit via a new `BudgetState`
+* whose `parent` points back to the caller's state. Each scope's middleware
+* only decrements its *own* `consumed` — propagation to ancestors happens
+* naturally because `child.exec` delegates to `parent.exec` through the
+* prototype chain, so every ancestor's middleware runs once per call and
+* the rootSession mutex keeps the sequence of increments linear.
+*/
+const BUDGET_MOUNT_ROOT = "/.meta/budget";
+const BUDGET_KEY_LIMIT = "limit";
+const BUDGET_KEY_REMAINING = "remaining";
+const BUDGET_KEY_CONSUMED = "consumed";
+const BUDGET_KEYS = [
+	BUDGET_KEY_LIMIT,
+	BUDGET_KEY_REMAINING,
+	BUDGET_KEY_CONSUMED
+];
+/**
+* Process-local mutex map keyed on `rootSession`. Every decrement for a
+* given scope tree serializes against the same promise chain, so two
+* concurrent sub-runs sharing a rootSession cannot double-count or see a
+* mid-update view of `consumed`. Phase 2 will swap the Map for an AFS KV
+* provider so the guarantee holds across processes; the API shape stays.
+*/
+const rootBudgetLocks = /* @__PURE__ */ new Map();
+async function withRootBudgetLock(rootSession, fn) {
+	const stored = (rootBudgetLocks.get(rootSession) ?? Promise.resolve()).then(fn, fn);
+	rootBudgetLocks.set(rootSession, stored);
+	try {
+		return await stored;
+	} finally {
+		if (rootBudgetLocks.get(rootSession) === stored) rootBudgetLocks.delete(rootSession);
+	}
+}
+function createBudgetState(init) {
+	if (!init.rootSession || typeof init.rootSession !== "string") throw new Error(`BUDGET_INVALID: rootSession must be a non-empty string`);
+	if (typeof init.limit !== "number" || Number.isNaN(init.limit) || init.limit < 0) throw new Error(`BUDGET_INVALID: limit must be a non-negative number`);
+	return {
+		rootSession: init.rootSession,
+		limit: Math.floor(init.limit),
+		consumed: 0
+	};
+}
+function budgetRemaining(state) {
+	return Math.max(0, state.limit - state.consumed);
+}
+function isBudgetPath(path) {
+	return path === BUDGET_MOUNT_ROOT || path.startsWith(`${BUDGET_MOUNT_ROOT}/`);
+}
+function parseBudgetKey(path) {
+	if (!path.startsWith(`${BUDGET_MOUNT_ROOT}/`)) return null;
+	const key = path.slice(14);
+	return BUDGET_KEYS.includes(key) ? key : null;
+}
+function budgetValue(state, key) {
+	if (key === BUDGET_KEY_LIMIT) return state.limit;
+	if (key === BUDGET_KEY_CONSUMED) return state.consumed;
+	return budgetRemaining(state);
+}
+/**
+* Extract `tokens_used` from an exec result. Supports both legacy
+* `data.total_tokens` (the agent-run envelope) and `data._meta.tokens_used`
+* (team/orchestrator aggregate meta). Anything else → 0.
+*/
+function extractTokensUsed(result) {
+	const data = result?.data;
+	if (!data || typeof data !== "object") return 0;
+	const candidates = [data.total_tokens, data._meta?.tokens_used];
+	for (const value of candidates) if (typeof value === "number" && Number.isFinite(value) && value > 0) return Math.floor(value);
+	return 0;
+}
+/**
+* Overlay the budget mount on an AFS root:
+*   - `/.meta/budget/{limit,remaining,consumed}` → live reads
+*   - `/.meta/budget/*` writes → `PERMISSION_DENIED`
+*   - `exec(...)` → pre-check `BUDGET_EXHAUSTED`, then decrement by
+*     `tokens_used` under the rootSession mutex.
+*
+* The overlay is non-enumerable (matches the scratch/memory pattern) and
+* transparent for non-budget paths, which fall through via the prototype
+* chain. Every projected child attaches its own overlay backed by its own
+* `BudgetState`, so sibling scopes never see each other's `consumed`.
+*/
+function attachBudgetMount(afs, state) {
+	const child = Object.create(afs);
+	Object.defineProperty(child, "read", {
+		value: async (path, options) => {
+			const key = parseBudgetKey(path);
+			if (key) return {
+				success: true,
+				data: {
+					content: String(budgetValue(state, key)),
+					path
+				}
+			};
+			return afs.read.call(afs, path, options);
+		},
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	Object.defineProperty(child, "write", {
+		value: async (path, payload, options) => {
+			if (isBudgetPath(path)) {
+				const err = /* @__PURE__ */ new Error(`PERMISSION_DENIED: ${path} is managed by the budget exec middleware and cannot be written directly`);
+				err.code = "PERMISSION_DENIED";
+				throw err;
+			}
+			if (typeof afs.write !== "function") throw new Error(`BUDGET_NO_UNDERLYING_WRITE: afs.write not available for ${path}`);
+			return afs.write.call(afs, path, payload, options);
+		},
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	Object.defineProperty(child, "list", {
+		value: async (path, options) => {
+			if (path === BUDGET_MOUNT_ROOT || path === `${BUDGET_MOUNT_ROOT}/`) return {
+				success: true,
+				data: { list: BUDGET_KEYS.map((name) => ({
+					path: `${BUDGET_MOUNT_ROOT}/${name}`,
+					name,
+					type: "file"
+				})) }
+			};
+			return afs.list.call(afs, path, options);
+		},
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	Object.defineProperty(child, "exec", {
+		value: async (path, args, options) => {
+			if (state.consumed >= state.limit) {
+				const err = /* @__PURE__ */ new Error(`BUDGET_EXHAUSTED: scope budget exhausted (path=${path}, limit=${state.limit}, consumed=${state.consumed})`);
+				err.code = "BUDGET_EXHAUSTED";
+				throw err;
+			}
+			const result = await afs.exec.call(afs, path, args, options);
+			const used = extractTokensUsed(result);
+			if (used > 0) await withRootBudgetLock(state.rootSession, () => {
+				state.consumed += used;
+			});
+			return result;
+		},
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return child;
+}
+/**
+* Resolve a child scope's budget. The child's effective limit is the
+* result of `resolveBudget({manifest, parentRemaining})`; consumed starts
+* at 0. Ancestor updates are handled by the middleware chain itself
+* (each scope's middleware runs once per call via the prototype chain),
+* so the child's `BudgetState` is independent from the parent's.
+*
+* Returns `undefined` when the parent has no active budget — zero-overhead
+* path for legacy callers that never opt in.
+*
+* Inheritance rules (P5 deferred nit documented here for clarity):
+*
+*   - Parent has budget, child manifest declares one → `resolveBudget`
+*     clamps `min(childBudget.totalTokens, parentRemaining)`.
+*   - Parent has budget, child manifest omits budget → `resolveBudget` uses
+*     `DEFAULT_TOTAL_TOKENS` (80k) then clamps to `parentRemaining`. Net
+*     effect: an undeclared child never exceeds the parent's remaining
+*     window, which is the conservative default.
+*   - Parent has no budget → child is unbudgeted too; the whole
+*     `/.meta/budget/*` overlay is skipped (zero-overhead legacy path).
+*
+* The clamp is only a ceiling. Actual spend is still accounted per call
+* via the exec middleware (`afs.exec` → decrement under `rootSession`
+* mutex), so siblings can't double-spend the parent's remaining window.
+*/
+function deriveChildBudgetState(parent, childBudget) {
+	if (!parent) return void 0;
+	const resolved = resolveBudget({
+		manifest: childBudget,
+		parentRemaining: budgetRemaining(parent)
+	});
+	return createBudgetState({
+		rootSession: parent.rootSession,
+		limit: resolved.totalTokens
+	});
+}
+function assertSession(session) {
+	if (session === void 0) return;
+	if (typeof session !== "string" || session.length === 0) throw new Error(`SCOPE_INVALID_INPUT: session must be a non-empty string`);
+	if (session.includes("/") || session.includes("\\")) throw new Error(`SCOPE_INVALID_INPUT: session must not contain path separators`);
+	if (session.includes("\0")) throw new Error(`SCOPE_INVALID_INPUT: session must not contain null bytes`);
+}
+function assertMemberPath(memberPath) {
+	if (typeof memberPath !== "string" || memberPath.length === 0) throw new Error(`SCOPE_INVALID_MEMBER: memberPath must be a non-empty string`);
+	if (memberPath.includes("\0")) throw new Error(`SCOPE_INVALID_MEMBER: memberPath must not contain null bytes`);
+	if (memberPath.split("/").some((s) => s === "..")) throw new Error(`SCOPE_INVALID_MEMBER: memberPath must not traverse parent directories`);
+}
+function assertChildManifest(manifest) {
+	if (!manifest || typeof manifest !== "object") throw new Error(`SCOPE_INVALID_INPUT: childManifest is required`);
+}
+/**
+* Normalize a manifest's `tools` field into `ToolEntry[]`, rejecting shapes
+* that would let a dispatcher smuggle traversal or typo past intersection:
+*   - non-string / empty path → TOOL_PATH_INVALID
+*   - path containing `..` or `\0` → TOOL_PATH_INVALID
+*   - ops must be a non-empty string[] when provided
+*
+* The Phase 1 contract: one call site (projectForChild) owns normalization;
+* older runner-local normalize helpers delegate here.
+*/
+function normalizeManifestTools(manifest) {
+	const raw = manifest.tools ?? [];
+	const result = [];
+	raw.forEach((t, idx) => {
+		const path = typeof t === "string" ? t : t?.path;
+		if (typeof path !== "string" || path.length === 0) throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must be a non-empty string`);
+		if (path.includes("\0")) throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must not contain null bytes`);
+		if (path.includes("..")) throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must not contain ".."`);
+		if (typeof t === "string") {
+			result.push({
+				path,
+				ops: [...DEFAULT_TOOL_OPS]
+			});
+			return;
+		}
+		const ops = t.ops ?? [...DEFAULT_TOOL_OPS];
+		if (!Array.isArray(ops) || ops.length === 0 || ops.some((op) => typeof op !== "string")) throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].ops must be a non-empty string[]`);
+		const entry = {
+			path,
+			ops: withQueryPairing(ops)
+		};
+		if (t.maxDepth != null) entry.maxDepth = t.maxDepth;
+		result.push(entry);
+	});
+	return result;
+}
+/**
+* Phase 5 canonical session accessor — runners must read the effective
+* session id from `ctx.afs.scope.session` rather than from the legacy
+* `context.session` field. This helper keeps back-compat while the four
+* runners are swapped: if the AFS already carries a scope, return
+* `scope.session`; otherwise fall back to the deprecated `fallback`
+* argument. P6 removes the fallback path once `RunnerContext.session` is
+* deleted.
+*/
+function runnerSession(afs, fallback) {
+	return afs.scope?.session ?? fallback;
+}
+/**
+* Phase 5 canonical parent-session accessor. Mirrors `runnerSession` but
+* surfaces the parent's session id so runners can tag sub-runs without
+* consulting the legacy `context.parentSession` field. Returns undefined
+* for root scopes (no parent) — callers must treat undefined as "root".
+*/
+function runnerParentSession(afs, fallback) {
+	return afs.scope?.parentSession ?? fallback;
+}
+/**
+* Shared session-resolution ladder for every runner. Reads session and
+* parentSession from scope first (legacy context fields only as fallback
+* until P6) and, when both are set, derives the child session id.
+*
+* Collapses the ai / ash / team / orchestrator entry blocks into one
+* place — any adjustment to the derivation rule now has a single owner.
+*/
+function resolveChildSession(afs, ctx, deriveChildSession) {
+	const parentSession = runnerParentSession(afs, ctx.parentSession);
+	let session = runnerSession(afs, ctx.session);
+	if (parentSession && session) session = deriveChildSession(parentSession);
+	return {
+		session,
+		parentSession
+	};
+}
+/**
+* Lift a raw `AFSRoot` into a root-level `AgentScope`. Root scopes are
+* unbounded by construction — `scope.allowedTools` is the caller's own
+* manifest tools (or fully permissive when omitted), and `chainDepth` is 0.
+*
+* Top-level runners (agent-run action handler, test harnesses) use this to
+* bootstrap the scope chain; downstream runners never construct a root
+* scope themselves. Omit `manifestTools` (or pass `[]`) to keep the root
+* fully permissive — useful for tests that don't declare tools.
+*/
+function rootAgentScope(afs, opts) {
+	assertSession(opts.session);
+	const allowedTools = opts.manifestTools && opts.manifestTools.length > 0 ? opts.manifestTools : [{
+		path: "/**",
+		ops: [
+			"read",
+			"list",
+			"exec",
+			"write",
+			"search",
+			"query"
+		]
+	}];
+	let withBudget = afs;
+	let budgetState;
+	if (opts.budget) {
+		const resolved = resolveBudget({ manifest: opts.budget });
+		budgetState = createBudgetState({
+			rootSession: opts.session,
+			limit: resolved.totalTokens
+		});
+		withBudget = attachBudgetMount(afs, budgetState);
+	}
+	return attachScope(withBudget, {
+		session: opts.session,
+		rootSession: opts.session,
+		chainDepth: 0,
+		allowedPaths: allowedTools.map((t) => t.path),
+		allowedTools,
+		budget: budgetState,
+		memoryDomain: opts.memoryDomain
+	});
+}
+/**
+* Top-level runner bootstrap — if the caller's AFS is already a scope, use
+* it verbatim; otherwise synthesize a root scope and attach a fresh
+* `/scratch/*` mount. Team and orchestrator runners call this so hook
+* events and `state.yml` writes land in the scope-local scratch rather
+* than the legacy `/modules/memory/runs/` tree.
+*
+* Pass `manifestTools` + `session` to drive the synthetic root scope's
+* descriptor; the caller's own manifest is typically the source, and
+* `scratchRetention` follows `manifest.scratch` (run → session default).
+*/
+function ensureScopeWithMounts(afs, opts) {
+	if (afs.scope) return afs;
+	return attachScratchMount(rootAgentScope(afs, {
+		session: opts.session,
+		manifestTools: opts.manifestTools,
+		budget: opts.budget,
+		memoryDomain: extractManifestDomain(opts.memory)
+	}), opts.scratchProvider ?? createScratchProvider({
+		session: sanitizeSessionForScratch(opts.session),
+		retention: opts.scratchRetention ?? "session"
+	}));
+}
+/**
+* Resolve the `AgentScope` a parent runner projects children from.
+*
+* Phase 6 — if the caller already handed us a scoped AFS (via
+* `projectForChild` / `ensureScopeWithMounts`), reuse it: its `allowedTools`
+* is already the post-intersection view. Otherwise synthesize a root scope
+* from the caller's `manifest.tools`, normalized via `normalizeManifestTools`
+* for a single source of truth. Callers that want a tighter inherited
+* set must hand over a scoped AFS built via `projectForChild` or
+* `ensureScopeWithMounts`.
+*/
+function resolveParentAgentScope(opts) {
+	if (opts.afs.scope) return opts.afs;
+	const manifestTools = normalizeManifestTools(opts.manifest);
+	return rootAgentScope(opts.afs, {
+		session: opts.session ?? "root",
+		manifestTools: manifestTools.length > 0 ? manifestTools : void 0
+	});
+}
+function attachScope(afs, scope) {
+	const child = Object.create(afs);
+	Object.defineProperty(child, "scope", {
+		value: scope,
+		enumerable: true,
+		writable: false,
+		configurable: false
+	});
+	return child;
+}
+/**
+* Narrow down `parent` for a child agent:
+*   - path projection via existing `projectSubAgent` (rewrite + readonly)
+*   - tool ACL intersection via existing `intersectTools` (paths + ops)
+*   - scope descriptor: session / rootSession / chainDepth+1 / allowedPaths
+*
+* If the parent has a non-empty `scope.allowedTools` and the child declares
+* a non-empty `manifest.tools` that doesn't overlap (intersection empty),
+* we throw `TOOL_INTERSECTION_EMPTY` — an empty intersection means the
+* dispatcher has asked for an unreachable child scope, which is a hard
+* error rather than a silently-permissive default.
+*
+* See design.md §5 for the full six-step mount composition; P2–P5 add
+* scratch / memory / budget / session arms to the same function.
+*/
+function projectForChild(parent, options) {
+	assertChildManifest(options.childManifest);
+	assertMemberPath(options.memberPath);
+	assertSession(options.session);
+	if (!parent || typeof parent !== "object" || !parent.scope) throw new Error(`SCOPE_INVALID_INPUT: parent scope is required`);
+	const nextDepth = parent.scope.chainDepth + 1;
+	if (nextDepth >= CHAIN_DEPTH_HARD_CAP) throw new Error(`CHAIN_DEPTH_EXCEEDED: chainDepth ${nextDepth} reaches hard cap ${CHAIN_DEPTH_HARD_CAP}`);
+	const childDeclaredTools = normalizeManifestTools(options.childManifest);
+	const parentAllowed = parent.scope.allowedTools;
+	const intersected = childDeclaredTools.length === 0 ? [] : intersectTools([...parentAllowed], childDeclaredTools);
+	if (childDeclaredTools.length > 0 && intersected.length === 0) throw new Error(`TOOL_INTERSECTION_EMPTY: child manifest declares tools that don't intersect parent scope`);
+	const withMessaging = ensureMessagingTool(intersected);
+	const projectedAfs = projectSubAgent(parent, {
+		memberPath: options.memberPath,
+		mode: "readonly"
+	});
+	const childSession = options.session ?? deriveDefaultChildSession(parent.scope.session, options.memberPath);
+	const withScratch = attachScratchMount(projectedAfs, createScratchProvider({
+		session: sanitizeSessionForScratch(childSession),
+		retention: options.childManifest.scratch ? "session" : "run"
+	}));
+	const memoryDomain = isMemoryEnabled(options.childManifest.memory) ? resolveMemoryDomain({
+		manifestMemory: options.childManifest.memory,
+		parentDomain: parent.scope.memoryDomain,
+		memberPath: options.memberPath
+	}) : void 0;
+	const inheritsParentMemoryMount = memoryDomain !== void 0 && memoryDomain === parent.scope.memoryDomain;
+	const withMemory = memoryDomain && !inheritsParentMemoryMount ? attachMemoryMount(withScratch, createMemoryProvider({
+		domain: memoryDomain,
+		storage: buildMemoryStorageForAfs(parent),
+		...buildMemoryIndexOptsForAfs(parent)
+	})) : withScratch;
+	const finalTools = memoryDomain ? ensureMemoryTool(withMessaging) : withMessaging;
+	const childBudget = deriveChildBudgetState(parent.scope.budget, options.childManifest.budget);
+	return attachScope(childBudget ? attachBudgetMount(withMemory, childBudget) : withMemory, {
+		session: childSession,
+		parentSession: parent.scope.session,
+		rootSession: parent.scope.rootSession,
+		chainDepth: nextDepth,
+		allowedPaths: finalTools.map((t) => t.path),
+		allowedTools: finalTools,
+		memoryDomain,
+		budget: childBudget
+	});
+}
+/** `memory: true` | `memory: { … }` both count; `false`/`undefined` do not. */
+function isMemoryEnabled(value) {
+	return value === true || typeof value === "object" && value !== null;
+}
+const MEMORY_TOOL_PATH = "/memory/**";
+function ensureMemoryTool(tools) {
+	if (tools.some((t) => t.path === MEMORY_TOOL_PATH || t.path === "/memory")) return tools;
+	return [...tools, {
+		path: MEMORY_TOOL_PATH,
+		ops: [
+			"read",
+			"list",
+			"exec"
+		]
+	}];
+}
+/**
+* The scope descriptor's `session` may come from callers that tolerate path
+* segments (e.g. `.../planner-0`). The scratch provider rejects separators
+* and dots, so we collapse the caller-supplied id down to a bare token
+* before handing it over.
+*/
+function sanitizeSessionForScratch(session) {
+	const trimmed = (session ?? "").replace(/\/+$/, "");
+	const cleaned = trimmed.slice(trimmed.lastIndexOf("/") + 1).replace(/\.\./g, "").replace(/\0/g, "");
+	return cleaned.length > 0 ? cleaned : "scope";
+}
+function ensureMessagingTool(tools) {
+	if (tools.some((t) => t.path === MESSAGING_TOOL_PATH || t.path === MESSAGING_TOOLS_ROOT)) return tools;
+	return [...tools, {
+		path: MESSAGING_TOOL_PATH,
+		ops: ["exec"]
+	}];
+}
+function deriveDefaultChildSession(parentSession, memberPath) {
+	return `${parentSession}.${memberPath.split("/").filter(Boolean).pop() ?? "child"}.${Math.random().toString(36).slice(2, 8)}`;
+}
+/**
+* Phase 2 target — serialize a scope for cross-process hand-off (MCP
+* sandbox worker, code-agent runner, …). Always throws in Phase 0/1 so
+* no caller is tempted to persist a partial descriptor before the sandbox
+* boundary exists.
+*/
+function toJSON(_scope) {
+	throw new Error("AGENT_SCOPE_TOJSON_PHASE_2: scope serialization lands with the MCP sandbox (Phase 2)");
+}
+
+//#endregion
+export { CHAIN_DEPTH_HARD_CAP, ensureScopeWithMounts, normalizeManifestTools, projectForChild, resolveChildSession, resolveParentAgentScope, rootAgentScope, runnerSession, toJSON };
+//# sourceMappingURL=scoped-afs.mjs.map

package/dist/program/scoped-afs.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-afs.mjs","names":[],"sources":["../../src/program/scoped-afs.ts"],"sourcesContent":["/**\n * AgentScope — the per-agent AFS view that replaces the earlier grab-bag\n * of ad-hoc fields on `RunnerContext`. It carries tool whitelist, memory\n * domain, budget, spawn-chain depth, and session identity in one place.\n *\n * Phase 0 defined the contract; Phase 1 arms the **tools** projection:\n * `projectForChild` computes the child's `scope.allowedPaths` as the\n * intersection of `parent.scope.allowedTools` and `childManifest.tools`,\n * and also carries the full `ToolEntry[]` (with ops/maxDepth) in\n * `scope.allowedTools` so runners surface a correctly narrowed tool\n * catalog to the LLM directly from the scope. The memory / scratch /\n * budget / session mount arms land in P2–P5.\n *\n * Naming note: this file intentionally does NOT reuse the existing\n * `ScopedAFS` class in `@aigne/afs/blocklet` (that class is the path-prefix\n * proxy for blocklet-local AFS views). `AgentScope` is a richer structure\n * that layers scratch / memory / budget / tool-projection on top of a\n * base scope; P1+ phases compose them.\n *\n * HARD CONSTRAINT — `projectForChild` options are closed at three fields:\n *   { memberPath, childManifest, session? }\n * `tools`, `budget`, `scratch`, `memory`, `budgetRemaining` etc. are NEVER\n * accepted as options. The implementation must derive them from\n * `childManifest` + parent scope state (including `afs.read(\"/.meta/budget/remaining\")`\n * in Phase 4). A dispatcher that hands `tools: [\"**\"]` or a wider budget\n * must be rejected in code review — the options type shape is closed.\n */\n\nimport type { AFSModule, AFSRoot, AgentManifest } from \"@aigne/afs\";\nimport { projectSubAgent } from \"@aigne/afs\";\nimport { intersectTools, type ToolEntry, withQueryPairing } from \"@aigne/afs-ash\";\nimport { type BudgetConfig, resolveBudget } from \"../agent-runners/budget.js\";\nimport {\n  attachMemoryMount,\n  buildMemoryIndexOptsForAfs,\n  buildMemoryStorageForAfs,\n  createMemoryProvider,\n  extractManifestDomain,\n  resolveMemoryDomain,\n} from \"../agent-runners/memory-afs.js\";\nimport {\n  attachScratchMount,\n  createScratchProvider,\n  type ScratchProvider,\n  type ScratchRetention,\n} from \"../agent-runners/scratchpad-afs.js\";\nimport { MESSAGING_TOOLS_GLOB, MESSAGING_TOOLS_ROOT } from \"./agent-messages-tools.js\";\n\n/**\n * Chain-depth hard cap. Mirrors `HARD_CAP` in\n * `providers/basic/ash/src/spawn-depth.ts`; kept in sync manually because\n * importing across package boundaries for a constant isn't worth the\n * dependency. Any change there must be reflected here.\n *\n * Semantics match `spawn-depth.ts`: a child whose post-increment depth\n * would be **>= HARD_CAP** is rejected with `CHAIN_DEPTH_EXCEEDED`. With\n * root.chainDepth = 0 this means the deepest reachable child is depth 9;\n * attempting to spawn depth 10 throws.\n */\nexport const CHAIN_DEPTH_HARD_CAP = 10;\n\n/** Default ops applied when a manifest tool entry omits `ops`. */\n// `query` pairs with `list` (read-class collection view, design §3.1b).\nconst DEFAULT_TOOL_OPS: readonly string[] = [\"read\", \"list\", \"exec\", \"query\"];\n\n/**\n * Built-in messaging tool path — every scope surfaces\n * `/proc/messaging/tools/*`\n * so the LLM can call `agent_post_message` / `agent_read_messages` without\n * each manifest having to declare them. See B32 in\n * `providers/basic/ash/src/agent-run.ts`.\n */\nconst MESSAGING_TOOL_PATH = MESSAGING_TOOLS_GLOB;\n\n/**\n * Budget mount — per-scope `/.meta/budget/{limit,remaining,consumed}` state\n * files driven by the exec middleware in `attachBudgetMount`. Path contract:\n *\n *   - `read(\"/.meta/budget/limit\")`     → configured ceiling (tokens)\n *   - `read(\"/.meta/budget/remaining\")` → `max(0, limit - consumed)`\n *   - `read(\"/.meta/budget/consumed\")`  → tokens decremented so far\n *   - `write(\"/.meta/budget/*\", ...)`   → always `PERMISSION_DENIED`; only\n *       the middleware may mutate state (via the internal `BudgetState` ref).\n *   - `list(\"/.meta/budget\")`           → three-entry listing (above keys).\n *\n * The exec middleware wraps the underlying `afs.exec`:\n *   1. Pre-check `consumed < limit`; otherwise throw `BUDGET_EXHAUSTED`.\n *   2. Call underlying exec.\n *   3. Extract `tokens_used` from the result and serialize the increment\n *      against the rootSession mutex so concurrent sub-runs don't race.\n *\n * Child scopes created by `projectForChild` inherit via a new `BudgetState`\n * whose `parent` points back to the caller's state. Each scope's middleware\n * only decrements its *own* `consumed` — propagation to ancestors happens\n * naturally because `child.exec` delegates to `parent.exec` through the\n * prototype chain, so every ancestor's middleware runs once per call and\n * the rootSession mutex keeps the sequence of increments linear.\n */\nconst BUDGET_MOUNT_ROOT = \"/.meta/budget\";\nconst BUDGET_KEY_LIMIT = \"limit\";\nconst BUDGET_KEY_REMAINING = \"remaining\";\nconst BUDGET_KEY_CONSUMED = \"consumed\";\nconst BUDGET_KEYS = [BUDGET_KEY_LIMIT, BUDGET_KEY_REMAINING, BUDGET_KEY_CONSUMED] as const;\ntype BudgetKey = (typeof BUDGET_KEYS)[number];\n\n/**\n * Process-local mutex map keyed on `rootSession`. Every decrement for a\n * given scope tree serializes against the same promise chain, so two\n * concurrent sub-runs sharing a rootSession cannot double-count or see a\n * mid-update view of `consumed`. Phase 2 will swap the Map for an AFS KV\n * provider so the guarantee holds across processes; the API shape stays.\n */\nconst rootBudgetLocks = new Map<string, Promise<unknown>>();\n\nasync function withRootBudgetLock<T>(rootSession: string, fn: () => Promise<T> | T): Promise<T> {\n  const prev = rootBudgetLocks.get(rootSession) ?? Promise.resolve();\n  // `prev.then(fn, fn)` chains regardless of whether the previous decrement\n  // settled cleanly — so one failing fn doesn't poison the rest of the\n  // chain (subsequent decrements still run). `stored` is the exact promise\n  // identity we put into the map; the `finally` below uses it to detect\n  // whether a later caller has already queued behind us.\n  const stored: Promise<unknown> = prev.then(fn, fn);\n  rootBudgetLocks.set(rootSession, stored);\n  try {\n    return (await stored) as T;\n  } finally {\n    if (rootBudgetLocks.get(rootSession) === stored) {\n      rootBudgetLocks.delete(rootSession);\n    }\n  }\n}\n\n/**\n * Mutable budget accounting backing a single scope's `/.meta/budget/*`\n * mount and its exec middleware. `rootSession` is the mutex key shared by\n * every scope in one spawn chain; ancestor aggregation happens naturally\n * because `child.exec` delegates to `parent.exec` through the prototype\n * chain, so each ancestor's middleware runs once per call and applies its\n * own increment — no parent pointer needed.\n */\nexport interface BudgetState {\n  readonly rootSession: string;\n  readonly limit: number;\n  consumed: number;\n}\n\nexport interface BudgetStateInit {\n  readonly rootSession: string;\n  readonly limit: number;\n}\n\nexport function createBudgetState(init: BudgetStateInit): BudgetState {\n  if (!init.rootSession || typeof init.rootSession !== \"string\") {\n    throw new Error(`BUDGET_INVALID: rootSession must be a non-empty string`);\n  }\n  if (typeof init.limit !== \"number\" || Number.isNaN(init.limit) || init.limit < 0) {\n    throw new Error(`BUDGET_INVALID: limit must be a non-negative number`);\n  }\n  return {\n    rootSession: init.rootSession,\n    limit: Math.floor(init.limit),\n    consumed: 0,\n  };\n}\n\nfunction budgetRemaining(state: BudgetState): number {\n  return Math.max(0, state.limit - state.consumed);\n}\n\nfunction isBudgetPath(path: string): boolean {\n  return path === BUDGET_MOUNT_ROOT || path.startsWith(`${BUDGET_MOUNT_ROOT}/`);\n}\n\nfunction parseBudgetKey(path: string): BudgetKey | null {\n  if (!path.startsWith(`${BUDGET_MOUNT_ROOT}/`)) return null;\n  const key = path.slice(BUDGET_MOUNT_ROOT.length + 1);\n  return (BUDGET_KEYS as readonly string[]).includes(key) ? (key as BudgetKey) : null;\n}\n\nfunction budgetValue(state: BudgetState, key: BudgetKey): number {\n  if (key === BUDGET_KEY_LIMIT) return state.limit;\n  if (key === BUDGET_KEY_CONSUMED) return state.consumed;\n  return budgetRemaining(state);\n}\n\n/**\n * Extract `tokens_used` from an exec result. Supports both legacy\n * `data.total_tokens` (the agent-run envelope) and `data._meta.tokens_used`\n * (team/orchestrator aggregate meta). Anything else → 0.\n */\nfunction extractTokensUsed(result: unknown): number {\n  const data = (result as { data?: unknown } | undefined)?.data;\n  if (!data || typeof data !== \"object\") return 0;\n  const candidates = [\n    (data as { total_tokens?: unknown }).total_tokens,\n    (data as { _meta?: { tokens_used?: unknown } })._meta?.tokens_used,\n  ];\n  for (const value of candidates) {\n    if (typeof value === \"number\" && Number.isFinite(value) && value > 0) {\n      return Math.floor(value);\n    }\n  }\n  return 0;\n}\n\n/**\n * Overlay the budget mount on an AFS root:\n *   - `/.meta/budget/{limit,remaining,consumed}` → live reads\n *   - `/.meta/budget/*` writes → `PERMISSION_DENIED`\n *   - `exec(...)` → pre-check `BUDGET_EXHAUSTED`, then decrement by\n *     `tokens_used` under the rootSession mutex.\n *\n * The overlay is non-enumerable (matches the scratch/memory pattern) and\n * transparent for non-budget paths, which fall through via the prototype\n * chain. Every projected child attaches its own overlay backed by its own\n * `BudgetState`, so sibling scopes never see each other's `consumed`.\n */\nexport function attachBudgetMount<T extends AFSRoot>(afs: T, state: BudgetState): T {\n  const child = Object.create(afs) as T;\n\n  Object.defineProperty(child, \"read\", {\n    value: async (path: string, options?: unknown) => {\n      const key = parseBudgetKey(path);\n      if (key) {\n        return {\n          success: true,\n          data: { content: String(budgetValue(state, key)), path },\n        } as never;\n      }\n      return (afs.read as never as (p: string, o?: unknown) => unknown).call(afs, path, options);\n    },\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n\n  Object.defineProperty(child, \"write\", {\n    value: async (path: string, payload: unknown, options?: unknown) => {\n      if (isBudgetPath(path)) {\n        const err = new Error(\n          `PERMISSION_DENIED: ${path} is managed by the budget exec middleware and cannot be written directly`,\n        );\n        (err as { code?: string }).code = \"PERMISSION_DENIED\";\n        throw err;\n      }\n      if (typeof afs.write !== \"function\") {\n        throw new Error(`BUDGET_NO_UNDERLYING_WRITE: afs.write not available for ${path}`);\n      }\n      return (afs.write as never as (p: string, v: unknown, o?: unknown) => unknown).call(\n        afs,\n        path,\n        payload,\n        options,\n      );\n    },\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n\n  Object.defineProperty(child, \"list\", {\n    value: async (path: string, options?: unknown) => {\n      if (path === BUDGET_MOUNT_ROOT || path === `${BUDGET_MOUNT_ROOT}/`) {\n        return {\n          success: true,\n          data: {\n            list: BUDGET_KEYS.map((name) => ({\n              path: `${BUDGET_MOUNT_ROOT}/${name}`,\n              name,\n              type: \"file\",\n            })),\n          },\n        } as never;\n      }\n      return (afs.list as never as (p: string, o?: unknown) => unknown).call(afs, path, options);\n    },\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n\n  Object.defineProperty(child, \"exec\", {\n    value: async (path: string, args: unknown, options: unknown) => {\n      if (state.consumed >= state.limit) {\n        const err = new Error(\n          `BUDGET_EXHAUSTED: scope budget exhausted (path=${path}, limit=${state.limit}, consumed=${state.consumed})`,\n        );\n        (err as { code?: string }).code = \"BUDGET_EXHAUSTED\";\n        throw err;\n      }\n      const result = await (\n        afs.exec as never as (p: string, a: unknown, o: unknown) => Promise<unknown>\n      ).call(afs, path, args, options);\n      const used = extractTokensUsed(result);\n      if (used > 0) {\n        await withRootBudgetLock(state.rootSession, () => {\n          state.consumed += used;\n        });\n      }\n      return result as never;\n    },\n    enumerable: false,\n    writable: false,\n    configurable: false,\n  });\n\n  return child;\n}\n\n/**\n * Resolve a child scope's budget. The child's effective limit is the\n * result of `resolveBudget({manifest, parentRemaining})`; consumed starts\n * at 0. Ancestor updates are handled by the middleware chain itself\n * (each scope's middleware runs once per call via the prototype chain),\n * so the child's `BudgetState` is independent from the parent's.\n *\n * Returns `undefined` when the parent has no active budget — zero-overhead\n * path for legacy callers that never opt in.\n *\n * Inheritance rules (P5 deferred nit documented here for clarity):\n *\n *   - Parent has budget, child manifest declares one → `resolveBudget`\n *     clamps `min(childBudget.totalTokens, parentRemaining)`.\n *   - Parent has budget, child manifest omits budget → `resolveBudget` uses\n *     `DEFAULT_TOTAL_TOKENS` (80k) then clamps to `parentRemaining`. Net\n *     effect: an undeclared child never exceeds the parent's remaining\n *     window, which is the conservative default.\n *   - Parent has no budget → child is unbudgeted too; the whole\n *     `/.meta/budget/*` overlay is skipped (zero-overhead legacy path).\n *\n * The clamp is only a ceiling. Actual spend is still accounted per call\n * via the exec middleware (`afs.exec` → decrement under `rootSession`\n * mutex), so siblings can't double-spend the parent's remaining window.\n */\nfunction deriveChildBudgetState(\n  parent: BudgetState | undefined,\n  childBudget: BudgetConfig | undefined,\n): BudgetState | undefined {\n  if (!parent) return undefined;\n  const resolved = resolveBudget({\n    manifest: childBudget,\n    parentRemaining: budgetRemaining(parent),\n  });\n  return createBudgetState({\n    rootSession: parent.rootSession,\n    limit: resolved.totalTokens,\n  });\n}\n\n/**\n * Per-scope descriptor threaded through every AFS call a runner makes.\n *\n * - `session` — this scope's session id (not the underlying WS session)\n * - `parentSession` — the session that spawned us (used for event aggregation)\n * - `rootSession` — the session at the root of the spawn chain. All children\n *   of the same root share this value; P4's budget exec middleware uses it\n *   as the mutex key so concurrent sub-runs serialize correctly against the\n *   same budget file. Root scope: rootSession === session.\n * - `chainDepth` — distance from the root scope (root = 0). Enforced against\n *   `CHAIN_DEPTH_HARD_CAP` on every `projectForChild` call.\n * - `allowedPaths` — paths visible inside this scope. Populated from the\n *   intersection of the parent's `allowedTools` and the child manifest's\n *   declared tools (P1).\n * - `allowedTools` — intersected `ToolEntry[]` (paths + ops + maxDepth +\n *   exclude_actions). Carried alongside `allowedPaths` because runners\n *   need the ops metadata to build the LLM tool catalog; the `.actions/`\n *   mount in later phases will let consumers list tools directly from the\n *   scope and this field will become a cache.\n */\nexport interface AgentScopeDescriptorFields {\n  readonly session: string;\n  readonly parentSession?: string;\n  readonly rootSession: string;\n  readonly chainDepth: number;\n  readonly allowedPaths: readonly string[];\n  readonly allowedTools: readonly ToolEntry[];\n  /**\n   * Tenant string that the scope's `/memory/` mount was instantiated with.\n   * Absent on scopes where `manifest.memory` is falsy — child scopes inherit\n   * this value when they declare `memory: true` without an explicit domain.\n   * See `docs/architecture/agent-memory.md` §3.3 for the precedence ladder.\n   */\n  readonly memoryDomain?: string;\n  /**\n   * Live budget state backing this scope's `/.meta/budget/*` mount. Absent\n   * on scopes that never opted into budget tracking (legacy callers that\n   * synthesize a scope without declaring a limit). When present, the exec\n   * middleware reads/writes this object under the rootSession mutex;\n   * children created via `projectForChild` inherit a new state whose\n   * `parent` pointer links here so decrements walk up the chain.\n   */\n  readonly budget?: BudgetState;\n}\n\n/**\n * A scoped AFS view handed to an agent runner. Same shape as `AFSRoot`\n * (list/read/write/exec/…) with an extra `scope` descriptor.\n *\n * Runners read session / chain / permissions from `scope` rather than\n * from their own arguments. The five sibling phases (P1 tools, P2 scratch,\n * P3 memory, P4 budget, P5 session) wire mounts into the scope so the\n * runner never needs provider-specific fields on its context.\n */\nexport interface AgentScope extends AFSRoot {\n  readonly scope: AgentScopeDescriptorFields;\n}\n\n/**\n * Options accepted by `projectForChild`.\n *\n * **Closed at 3 fields** — permission-widening fields (tools / budget /\n * scratch / memory / budgetRemaining / …) are intentionally absent. The\n * implementation must derive those from `childManifest` and the parent\n * scope. Extending this type to smuggle in a wider budget or tool set\n * defeats the whole point of scope-based projection.\n */\nexport interface ProjectForChildOptions {\n  /** Required — where the child agent lives in the parent's mount tree (e.g. \"members/reviewer\"). */\n  readonly memberPath: string;\n  /** Required — scratch/memory/tools/budget are all derived from this. */\n  readonly childManifest: AgentManifest;\n  /**\n   * Optional — if omitted, the runtime generates\n   * `${parent.scope.session}.${memberName}.${counter}`. Must not contain\n   * path separators, null bytes, or be empty.\n   */\n  readonly session?: string;\n}\n\n/**\n * Phase 2 sandbox serialization target. When the runtime needs to hand a\n * scope to an out-of-process worker (code agent, sandboxed MCP server, …),\n * it serializes to this descriptor and the far side rebuilds an AgentScope\n * backed by an MCP bridge.\n *\n * Phase 0 only defines the shape — `toJSON()` throws until Phase 2 lands.\n */\nexport interface AgentScopeDescriptor {\n  readonly kind: \"agent-scope\";\n  readonly session: string;\n  readonly parentSession?: string;\n  readonly rootSession: string;\n  readonly chainDepth: number;\n  readonly allowedPaths: readonly string[];\n  readonly mountDescriptors: ReadonlyArray<{\n    readonly path: string;\n    readonly providerDescriptor: unknown;\n  }>;\n}\n\nfunction assertSession(session: string | undefined): void {\n  if (session === undefined) return;\n  if (typeof session !== \"string\" || session.length === 0) {\n    throw new Error(`SCOPE_INVALID_INPUT: session must be a non-empty string`);\n  }\n  if (session.includes(\"/\") || session.includes(\"\\\\\")) {\n    throw new Error(`SCOPE_INVALID_INPUT: session must not contain path separators`);\n  }\n  if (session.includes(\"\\0\")) {\n    throw new Error(`SCOPE_INVALID_INPUT: session must not contain null bytes`);\n  }\n}\n\nfunction assertMemberPath(memberPath: unknown): asserts memberPath is string {\n  if (typeof memberPath !== \"string\" || memberPath.length === 0) {\n    throw new Error(`SCOPE_INVALID_MEMBER: memberPath must be a non-empty string`);\n  }\n  if (memberPath.includes(\"\\0\")) {\n    throw new Error(`SCOPE_INVALID_MEMBER: memberPath must not contain null bytes`);\n  }\n  const segments = memberPath.split(\"/\");\n  if (segments.some((s) => s === \"..\")) {\n    throw new Error(`SCOPE_INVALID_MEMBER: memberPath must not traverse parent directories`);\n  }\n}\n\nfunction assertChildManifest(manifest: unknown): asserts manifest is AgentManifest {\n  if (!manifest || typeof manifest !== \"object\") {\n    throw new Error(`SCOPE_INVALID_INPUT: childManifest is required`);\n  }\n}\n\n/**\n * Normalize a manifest's `tools` field into `ToolEntry[]`, rejecting shapes\n * that would let a dispatcher smuggle traversal or typo past intersection:\n *   - non-string / empty path → TOOL_PATH_INVALID\n *   - path containing `..` or `\\0` → TOOL_PATH_INVALID\n *   - ops must be a non-empty string[] when provided\n *\n * The Phase 1 contract: one call site (projectForChild) owns normalization;\n * older runner-local normalize helpers delegate here.\n */\nexport function normalizeManifestTools(manifest: { tools?: AgentManifest[\"tools\"] }): ToolEntry[] {\n  const raw = manifest.tools ?? [];\n  const result: ToolEntry[] = [];\n  raw.forEach((t, idx) => {\n    const path = typeof t === \"string\" ? t : t?.path;\n    if (typeof path !== \"string\" || path.length === 0) {\n      throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must be a non-empty string`);\n    }\n    if (path.includes(\"\\0\")) {\n      throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must not contain null bytes`);\n    }\n    if (path.includes(\"..\")) {\n      throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].path must not contain \"..\"`);\n    }\n    if (typeof t === \"string\") {\n      result.push({ path, ops: [...DEFAULT_TOOL_OPS] });\n      return;\n    }\n    const ops = t.ops ?? [...DEFAULT_TOOL_OPS];\n    if (!Array.isArray(ops) || ops.length === 0 || ops.some((op) => typeof op !== \"string\")) {\n      throw new Error(`TOOL_PATH_INVALID: manifest.tools[${idx}].ops must be a non-empty string[]`);\n    }\n    // list grants pair with query (read-class collection view).\n    const entry: ToolEntry = { path, ops: withQueryPairing(ops) };\n    if (t.maxDepth != null) entry.maxDepth = t.maxDepth;\n    result.push(entry);\n  });\n  return result;\n}\n\n/**\n * Phase 5 canonical session accessor — runners must read the effective\n * session id from `ctx.afs.scope.session` rather than from the legacy\n * `context.session` field. This helper keeps back-compat while the four\n * runners are swapped: if the AFS already carries a scope, return\n * `scope.session`; otherwise fall back to the deprecated `fallback`\n * argument. P6 removes the fallback path once `RunnerContext.session` is\n * deleted.\n */\nexport function runnerSession(afs: AFSRoot, fallback?: string): string | undefined {\n  const scope = (afs as AgentScope).scope;\n  return scope?.session ?? fallback;\n}\n\n/**\n * Phase 5 canonical parent-session accessor. Mirrors `runnerSession` but\n * surfaces the parent's session id so runners can tag sub-runs without\n * consulting the legacy `context.parentSession` field. Returns undefined\n * for root scopes (no parent) — callers must treat undefined as \"root\".\n */\nexport function runnerParentSession(afs: AFSRoot, fallback?: string): string | undefined {\n  const scope = (afs as AgentScope).scope;\n  return scope?.parentSession ?? fallback;\n}\n\n/**\n * Shared session-resolution ladder for every runner. Reads session and\n * parentSession from scope first (legacy context fields only as fallback\n * until P6) and, when both are set, derives the child session id.\n *\n * Collapses the ai / ash / team / orchestrator entry blocks into one\n * place — any adjustment to the derivation rule now has a single owner.\n */\nexport function resolveChildSession(\n  afs: AFSRoot,\n  ctx: { session?: string; parentSession?: string },\n  deriveChildSession: (parent: string) => string,\n): { session: string | undefined; parentSession: string | undefined } {\n  const parentSession = runnerParentSession(afs, ctx.parentSession);\n  let session = runnerSession(afs, ctx.session);\n  if (parentSession && session) session = deriveChildSession(parentSession);\n  return { session, parentSession };\n}\n\n/**\n * Lift a raw `AFSRoot` into a root-level `AgentScope`. Root scopes are\n * unbounded by construction — `scope.allowedTools` is the caller's own\n * manifest tools (or fully permissive when omitted), and `chainDepth` is 0.\n *\n * Top-level runners (agent-run action handler, test harnesses) use this to\n * bootstrap the scope chain; downstream runners never construct a root\n * scope themselves. Omit `manifestTools` (or pass `[]`) to keep the root\n * fully permissive — useful for tests that don't declare tools.\n */\nexport function rootAgentScope(\n  afs: AFSRoot,\n  opts: {\n    session: string;\n    manifestTools?: ToolEntry[];\n    /**\n     * Optional manifest budget config for the root scope. When set, the\n     * returned scope carries a `/.meta/budget/*` mount and the exec\n     * middleware; children projected from it inherit clamped budgets.\n     * Omitted → scope is unbudgeted (legacy behaviour).\n     */\n    budget?: BudgetConfig;\n    /**\n     * Optional memory domain to stamp into the root scope descriptor.\n     * Callers that pre-attached a `/memory/*` mount (e.g. team-runner when\n     * the team manifest declares memory at the top level) pass the domain\n     * so downstream `scope.memoryDomain` reads resolve authoritatively.\n     * Omitted → scope carries no memory domain (legacy behaviour).\n     */\n    memoryDomain?: string;\n  },\n): AgentScope {\n  assertSession(opts.session);\n  const allowedTools: ToolEntry[] =\n    opts.manifestTools && opts.manifestTools.length > 0\n      ? opts.manifestTools\n      : [{ path: \"/**\", ops: [\"read\", \"list\", \"exec\", \"write\", \"search\", \"query\"] }];\n  let withBudget: AFSRoot = afs;\n  let budgetState: BudgetState | undefined;\n  if (opts.budget) {\n    const resolved = resolveBudget({ manifest: opts.budget });\n    budgetState = createBudgetState({\n      rootSession: opts.session,\n      limit: resolved.totalTokens,\n    });\n    withBudget = attachBudgetMount(afs, budgetState);\n  }\n  return attachScope(withBudget, {\n    session: opts.session,\n    rootSession: opts.session,\n    chainDepth: 0,\n    allowedPaths: allowedTools.map((t) => t.path),\n    allowedTools,\n    budget: budgetState,\n    memoryDomain: opts.memoryDomain,\n  });\n}\n\n/**\n * Top-level runner bootstrap — if the caller's AFS is already a scope, use\n * it verbatim; otherwise synthesize a root scope and attach a fresh\n * `/scratch/*` mount. Team and orchestrator runners call this so hook\n * events and `state.yml` writes land in the scope-local scratch rather\n * than the legacy `/modules/memory/runs/` tree.\n *\n * Pass `manifestTools` + `session` to drive the synthetic root scope's\n * descriptor; the caller's own manifest is typically the source, and\n * `scratchRetention` follows `manifest.scratch` (run → session default).\n */\nexport function ensureScopeWithMounts(\n  afs: AFSRoot,\n  opts: {\n    session: string;\n    manifestTools?: ToolEntry[];\n    scratchRetention?: ScratchRetention;\n    scratchProvider?: ScratchProvider;\n    /**\n     * Manifest budget for the synthetic root scope. Forwarded to\n     * `rootAgentScope` so the bootstrap scope carries the budget mount\n     * and children projected from it inherit the clamp. Optional — when\n     * unset, the scope stays unbudgeted (legacy behaviour).\n     */\n    budget?: BudgetConfig;\n    /**\n     * Top-level team's `manifest.memory`. When the team declares memory,\n     * the synthetic root scope stamps `memoryDomain` so downstream G2\n     * handoff read-through resolves authoritatively without re-reading\n     * the manifest. Does NOT attach a memory mount — the caller is\n     * expected to have one already (tests use `attachMemoryMount`;\n     * production wires via the per-scope scaffolding).\n     */\n    memory?: unknown;\n  },\n): AgentScope {\n  const existing = (afs as AgentScope).scope;\n  if (existing) return afs as AgentScope;\n  const root = rootAgentScope(afs, {\n    session: opts.session,\n    manifestTools: opts.manifestTools,\n    budget: opts.budget,\n    memoryDomain: extractManifestDomain(opts.memory),\n  });\n  const provider =\n    opts.scratchProvider ??\n    createScratchProvider({\n      session: sanitizeSessionForScratch(opts.session),\n      retention: opts.scratchRetention ?? \"session\",\n    });\n  return attachScratchMount(root, provider);\n}\n\n/**\n * Resolve the `AgentScope` a parent runner projects children from.\n *\n * Phase 6 — if the caller already handed us a scoped AFS (via\n * `projectForChild` / `ensureScopeWithMounts`), reuse it: its `allowedTools`\n * is already the post-intersection view. Otherwise synthesize a root scope\n * from the caller's `manifest.tools`, normalized via `normalizeManifestTools`\n * for a single source of truth. Callers that want a tighter inherited\n * set must hand over a scoped AFS built via `projectForChild` or\n * `ensureScopeWithMounts`.\n */\nexport function resolveParentAgentScope(opts: {\n  afs: AFSRoot;\n  manifest: AgentManifest;\n  session?: string;\n}): AgentScope {\n  const existing = (opts.afs as AgentScope).scope;\n  if (existing) return opts.afs as AgentScope;\n  const manifestTools = normalizeManifestTools(opts.manifest);\n  return rootAgentScope(opts.afs, {\n    session: opts.session ?? \"root\",\n    manifestTools: manifestTools.length > 0 ? manifestTools : undefined,\n  });\n}\n\nfunction attachScope(afs: AFSRoot, scope: AgentScopeDescriptorFields): AgentScope {\n  const child = Object.create(afs as object) as AgentScope;\n  Object.defineProperty(child, \"scope\", {\n    value: scope,\n    enumerable: true,\n    writable: false,\n    configurable: false,\n  });\n  return child;\n}\n\n/**\n * Narrow down `parent` for a child agent:\n *   - path projection via existing `projectSubAgent` (rewrite + readonly)\n *   - tool ACL intersection via existing `intersectTools` (paths + ops)\n *   - scope descriptor: session / rootSession / chainDepth+1 / allowedPaths\n *\n * If the parent has a non-empty `scope.allowedTools` and the child declares\n * a non-empty `manifest.tools` that doesn't overlap (intersection empty),\n * we throw `TOOL_INTERSECTION_EMPTY` — an empty intersection means the\n * dispatcher has asked for an unreachable child scope, which is a hard\n * error rather than a silently-permissive default.\n *\n * See design.md §5 for the full six-step mount composition; P2–P5 add\n * scratch / memory / budget / session arms to the same function.\n */\nexport function projectForChild(parent: AgentScope, options: ProjectForChildOptions): AgentScope {\n  assertChildManifest(options.childManifest);\n  assertMemberPath(options.memberPath);\n  assertSession(options.session);\n\n  if (!parent || typeof parent !== \"object\" || !parent.scope) {\n    throw new Error(`SCOPE_INVALID_INPUT: parent scope is required`);\n  }\n\n  const nextDepth = parent.scope.chainDepth + 1;\n  if (nextDepth >= CHAIN_DEPTH_HARD_CAP) {\n    throw new Error(\n      `CHAIN_DEPTH_EXCEEDED: chainDepth ${nextDepth} reaches hard cap ${CHAIN_DEPTH_HARD_CAP}`,\n    );\n  }\n\n  const childDeclaredTools = normalizeManifestTools(options.childManifest);\n  const parentAllowed = parent.scope.allowedTools;\n  const intersected =\n    childDeclaredTools.length === 0 ? [] : intersectTools([...parentAllowed], childDeclaredTools);\n\n  if (childDeclaredTools.length > 0 && intersected.length === 0) {\n    throw new Error(\n      `TOOL_INTERSECTION_EMPTY: child manifest declares tools that don't intersect parent scope`,\n    );\n  }\n\n  // Built-in `/proc/messaging/tools/*` is appended after intersection so that\n  // even a child with an empty or fully-disjoint manifest.tools still has a\n  // working `agent_post_message` / `agent_read_messages`. Parent cannot\n  // forbid this channel — B32 semantics.\n  const withMessaging = ensureMessagingTool(intersected);\n\n  const projectedAfs = projectSubAgent(parent as unknown as AFSModule, {\n    memberPath: options.memberPath,\n    mode: \"readonly\",\n  }) as unknown as AFSRoot;\n\n  const childSession =\n    options.session ?? deriveDefaultChildSession(parent.scope.session, options.memberPath);\n\n  // Every child scope carries its own `/scratch/*` mount. Sub-agent writes to\n  // `state.yml` / `hook-channel.jsonl` land in this in-memory store —\n  // independent of the parent and of any sibling scope, so concurrent sub-runs\n  // never stomp each other. Retention follows the child manifest's `scratch`\n  // flag: declared-scratch agents default to `session` retention so the\n  // scratch outlives a single run; plain sub-agents use `run` retention.\n  const scratchProvider = createScratchProvider({\n    session: sanitizeSessionForScratch(childSession),\n    retention: options.childManifest.scratch ? \"session\" : \"run\",\n  });\n  const withScratch = attachScratchMount(projectedAfs, scratchProvider);\n\n  // Memory arm — when the child manifest declares `memory: true` (or an\n  // object override), mount a per-scope AFSMemory at `/memory/`. The\n  // provider is instantiated with a fixed `defaultDomain`, so runtime arg\n  // tampering can't read another tenant's entries. Child scopes inherit\n  // the parent's domain by default; explicit `memory.domain` wins. Tools\n  // automatically pick up `/memory/**` in the LLM catalog when memory is on.\n  const memoryDomain = isMemoryEnabled(options.childManifest.memory)\n    ? resolveMemoryDomain({\n        manifestMemory: options.childManifest.memory,\n        parentDomain: parent.scope.memoryDomain,\n        memberPath: options.memberPath,\n      })\n    : undefined;\n  // When the child inherits the parent's domain, reuse the parent's existing\n  // `/memory/` mount via the prototype chain instead of layering a fresh\n  // provider with its own storage. A new `createMemoryProvider` would\n  // instantiate a fresh `InMemoryStorage`, so archive writes from the child\n  // would never be visible to siblings, the team, or cross-run G2 recall.\n  // Only attach a new mount when the child explicitly overrides the domain.\n  const inheritsParentMemoryMount =\n    memoryDomain !== undefined && memoryDomain === parent.scope.memoryDomain;\n  const withMemory =\n    memoryDomain && !inheritsParentMemoryMount\n      ? attachMemoryMount(\n          withScratch,\n          createMemoryProvider({\n            domain: memoryDomain,\n            // Propagate DID Space storage so child scopes (different domain)\n            // also persist to the caller's /user/memory space, and the same\n            // per-caller index root so recall hits /user/index (not the global).\n            storage: buildMemoryStorageForAfs(parent),\n            ...buildMemoryIndexOptsForAfs(parent),\n          }),\n        )\n      : withScratch;\n  const finalTools = memoryDomain ? ensureMemoryTool(withMessaging) : withMessaging;\n\n  // Budget arm — inherit when the parent has a live budget; clamp via\n  // `resolveBudget`; wire a fresh `/.meta/budget/*` mount + middleware for\n  // the child. Parents without a budget leave the child unbudgeted so\n  // legacy scopes keep working.\n  const childBudget = deriveChildBudgetState(parent.scope.budget, options.childManifest.budget);\n  const withBudget = childBudget ? attachBudgetMount(withMemory, childBudget) : withMemory;\n\n  return attachScope(withBudget, {\n    session: childSession,\n    parentSession: parent.scope.session,\n    rootSession: parent.scope.rootSession,\n    chainDepth: nextDepth,\n    allowedPaths: finalTools.map((t) => t.path),\n    allowedTools: finalTools,\n    memoryDomain,\n    budget: childBudget,\n  });\n}\n\n/** `memory: true` | `memory: { … }` both count; `false`/`undefined` do not. */\nfunction isMemoryEnabled(value: unknown): boolean {\n  return value === true || (typeof value === \"object\" && value !== null);\n}\n\nconst MEMORY_TOOL_PATH = \"/memory/**\";\n\nfunction ensureMemoryTool(tools: ToolEntry[]): ToolEntry[] {\n  if (tools.some((t) => t.path === MEMORY_TOOL_PATH || t.path === \"/memory\")) {\n    return tools;\n  }\n  return [...tools, { path: MEMORY_TOOL_PATH, ops: [\"read\", \"list\", \"exec\"] }];\n}\n\n/**\n * The scope descriptor's `session` may come from callers that tolerate path\n * segments (e.g. `.../planner-0`). The scratch provider rejects separators\n * and dots, so we collapse the caller-supplied id down to a bare token\n * before handing it over.\n */\nfunction sanitizeSessionForScratch(session: string): string {\n  const trimmed = (session ?? \"\").replace(/\\/+$/, \"\");\n  const tail = trimmed.slice(trimmed.lastIndexOf(\"/\") + 1);\n  const cleaned = tail.replace(/\\.\\./g, \"\").replace(/\\0/g, \"\");\n  return cleaned.length > 0 ? cleaned : \"scope\";\n}\n\nfunction ensureMessagingTool(tools: ToolEntry[]): ToolEntry[] {\n  if (tools.some((t) => t.path === MESSAGING_TOOL_PATH || t.path === MESSAGING_TOOLS_ROOT)) {\n    return tools;\n  }\n  return [...tools, { path: MESSAGING_TOOL_PATH, ops: [\"exec\"] }];\n}\n\nfunction deriveDefaultChildSession(parentSession: string, memberPath: string): string {\n  const memberName = memberPath.split(\"/\").filter(Boolean).pop() ?? \"child\";\n  // Stable-ish id: session.member.<random>. The numeric counter mentioned in\n  // design.md becomes a fresh crypto segment here — good enough for dev/test;\n  // P5 will tie this to real session hierarchy.\n  const suffix = Math.random().toString(36).slice(2, 8);\n  return `${parentSession}.${memberName}.${suffix}`;\n}\n\n/**\n * Phase 2 target — serialize a scope for cross-process hand-off (MCP\n * sandbox worker, code-agent runner, …). Always throws in Phase 0/1 so\n * no caller is tempted to persist a partial descriptor before the sandbox\n * boundary exists.\n */\nexport function toJSON(_scope: AgentScope): AgentScopeDescriptor {\n  throw new Error(\n    \"AGENT_SCOPE_TOJSON_PHASE_2: scope serialization lands with the MCP sandbox (Phase 2)\",\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA2DA,MAAa,uBAAuB;;AAIpC,MAAM,mBAAsC;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;;;;;;;;AAS7E,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;AA0B5B,MAAM,oBAAoB;AAC1B,MAAM,mBAAmB;AACzB,MAAM,uBAAuB;AAC7B,MAAM,sBAAsB;AAC5B,MAAM,cAAc;CAAC;CAAkB;CAAsB;CAAoB;;;;;;;;AAUjF,MAAM,kCAAkB,IAAI,KAA+B;AAE3D,eAAe,mBAAsB,aAAqB,IAAsC;CAO9F,MAAM,UANO,gBAAgB,IAAI,YAAY,IAAI,QAAQ,SAAS,EAM5B,KAAK,IAAI,GAAG;AAClD,iBAAgB,IAAI,aAAa,OAAO;AACxC,KAAI;AACF,SAAQ,MAAM;WACN;AACR,MAAI,gBAAgB,IAAI,YAAY,KAAK,OACvC,iBAAgB,OAAO,YAAY;;;AAwBzC,SAAgB,kBAAkB,MAAoC;AACpE,KAAI,CAAC,KAAK,eAAe,OAAO,KAAK,gBAAgB,SACnD,OAAM,IAAI,MAAM,yDAAyD;AAE3E,KAAI,OAAO,KAAK,UAAU,YAAY,OAAO,MAAM,KAAK,MAAM,IAAI,KAAK,QAAQ,EAC7E,OAAM,IAAI,MAAM,sDAAsD;AAExE,QAAO;EACL,aAAa,KAAK;EAClB,OAAO,KAAK,MAAM,KAAK,MAAM;EAC7B,UAAU;EACX;;AAGH,SAAS,gBAAgB,OAA4B;AACnD,QAAO,KAAK,IAAI,GAAG,MAAM,QAAQ,MAAM,SAAS;;AAGlD,SAAS,aAAa,MAAuB;AAC3C,QAAO,SAAS,qBAAqB,KAAK,WAAW,GAAG,kBAAkB,GAAG;;AAG/E,SAAS,eAAe,MAAgC;AACtD,KAAI,CAAC,KAAK,WAAW,GAAG,kBAAkB,GAAG,CAAE,QAAO;CACtD,MAAM,MAAM,KAAK,MAAM,GAA6B;AACpD,QAAQ,YAAkC,SAAS,IAAI,GAAI,MAAoB;;AAGjF,SAAS,YAAY,OAAoB,KAAwB;AAC/D,KAAI,QAAQ,iBAAkB,QAAO,MAAM;AAC3C,KAAI,QAAQ,oBAAqB,QAAO,MAAM;AAC9C,QAAO,gBAAgB,MAAM;;;;;;;AAQ/B,SAAS,kBAAkB,QAAyB;CAClD,MAAM,OAAQ,QAA2C;AACzD,KAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;CAC9C,MAAM,aAAa,CAChB,KAAoC,cACpC,KAA+C,OAAO,YACxD;AACD,MAAK,MAAM,SAAS,WAClB,KAAI,OAAO,UAAU,YAAY,OAAO,SAAS,MAAM,IAAI,QAAQ,EACjE,QAAO,KAAK,MAAM,MAAM;AAG5B,QAAO;;;;;;;;;;;;;;AAeT,SAAgB,kBAAqC,KAAQ,OAAuB;CAClF,MAAM,QAAQ,OAAO,OAAO,IAAI;AAEhC,QAAO,eAAe,OAAO,QAAQ;EACnC,OAAO,OAAO,MAAc,YAAsB;GAChD,MAAM,MAAM,eAAe,KAAK;AAChC,OAAI,IACF,QAAO;IACL,SAAS;IACT,MAAM;KAAE,SAAS,OAAO,YAAY,OAAO,IAAI,CAAC;KAAE;KAAM;IACzD;AAEH,UAAQ,IAAI,KAAsD,KAAK,KAAK,MAAM,QAAQ;;EAE5F,YAAY;EACZ,UAAU;EACV,cAAc;EACf,CAAC;AAEF,QAAO,eAAe,OAAO,SAAS;EACpC,OAAO,OAAO,MAAc,SAAkB,YAAsB;AAClE,OAAI,aAAa,KAAK,EAAE;IACtB,MAAM,sBAAM,IAAI,MACd,sBAAsB,KAAK,0EAC5B;AACD,IAAC,IAA0B,OAAO;AAClC,UAAM;;AAER,OAAI,OAAO,IAAI,UAAU,WACvB,OAAM,IAAI,MAAM,2DAA2D,OAAO;AAEpF,UAAQ,IAAI,MAAmE,KAC7E,KACA,MACA,SACA,QACD;;EAEH,YAAY;EACZ,UAAU;EACV,cAAc;EACf,CAAC;AAEF,QAAO,eAAe,OAAO,QAAQ;EACnC,OAAO,OAAO,MAAc,YAAsB;AAChD,OAAI,SAAS,qBAAqB,SAAS,GAAG,kBAAkB,GAC9D,QAAO;IACL,SAAS;IACT,MAAM,EACJ,MAAM,YAAY,KAAK,UAAU;KAC/B,MAAM,GAAG,kBAAkB,GAAG;KAC9B;KACA,MAAM;KACP,EAAE,EACJ;IACF;AAEH,UAAQ,IAAI,KAAsD,KAAK,KAAK,MAAM,QAAQ;;EAE5F,YAAY;EACZ,UAAU;EACV,cAAc;EACf,CAAC;AAEF,QAAO,eAAe,OAAO,QAAQ;EACnC,OAAO,OAAO,MAAc,MAAe,YAAqB;AAC9D,OAAI,MAAM,YAAY,MAAM,OAAO;IACjC,MAAM,sBAAM,IAAI,MACd,kDAAkD,KAAK,UAAU,MAAM,MAAM,aAAa,MAAM,SAAS,GAC1G;AACD,IAAC,IAA0B,OAAO;AAClC,UAAM;;GAER,MAAM,SAAS,MACb,IAAI,KACJ,KAAK,KAAK,MAAM,MAAM,QAAQ;GAChC,MAAM,OAAO,kBAAkB,OAAO;AACtC,OAAI,OAAO,EACT,OAAM,mBAAmB,MAAM,mBAAmB;AAChD,UAAM,YAAY;KAClB;AAEJ,UAAO;;EAET,YAAY;EACZ,UAAU;EACV,cAAc;EACf,CAAC;AAEF,QAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BT,SAAS,uBACP,QACA,aACyB;AACzB,KAAI,CAAC,OAAQ,QAAO;CACpB,MAAM,WAAW,cAAc;EAC7B,UAAU;EACV,iBAAiB,gBAAgB,OAAO;EACzC,CAAC;AACF,QAAO,kBAAkB;EACvB,aAAa,OAAO;EACpB,OAAO,SAAS;EACjB,CAAC;;AAwGJ,SAAS,cAAc,SAAmC;AACxD,KAAI,YAAY,OAAW;AAC3B,KAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,EACpD,OAAM,IAAI,MAAM,0DAA0D;AAE5E,KAAI,QAAQ,SAAS,IAAI,IAAI,QAAQ,SAAS,KAAK,CACjD,OAAM,IAAI,MAAM,gEAAgE;AAElF,KAAI,QAAQ,SAAS,KAAK,CACxB,OAAM,IAAI,MAAM,2DAA2D;;AAI/E,SAAS,iBAAiB,YAAmD;AAC3E,KAAI,OAAO,eAAe,YAAY,WAAW,WAAW,EAC1D,OAAM,IAAI,MAAM,8DAA8D;AAEhF,KAAI,WAAW,SAAS,KAAK,CAC3B,OAAM,IAAI,MAAM,+DAA+D;AAGjF,KADiB,WAAW,MAAM,IAAI,CACzB,MAAM,MAAM,MAAM,KAAK,CAClC,OAAM,IAAI,MAAM,wEAAwE;;AAI5F,SAAS,oBAAoB,UAAsD;AACjF,KAAI,CAAC,YAAY,OAAO,aAAa,SACnC,OAAM,IAAI,MAAM,iDAAiD;;;;;;;;;;;;AAcrE,SAAgB,uBAAuB,UAA2D;CAChG,MAAM,MAAM,SAAS,SAAS,EAAE;CAChC,MAAM,SAAsB,EAAE;AAC9B,KAAI,SAAS,GAAG,QAAQ;EACtB,MAAM,OAAO,OAAO,MAAM,WAAW,IAAI,GAAG;AAC5C,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,EAC9C,OAAM,IAAI,MAAM,qCAAqC,IAAI,mCAAmC;AAE9F,MAAI,KAAK,SAAS,KAAK,CACrB,OAAM,IAAI,MAAM,qCAAqC,IAAI,oCAAoC;AAE/F,MAAI,KAAK,SAAS,KAAK,CACrB,OAAM,IAAI,MAAM,qCAAqC,IAAI,8BAA8B;AAEzF,MAAI,OAAO,MAAM,UAAU;AACzB,UAAO,KAAK;IAAE;IAAM,KAAK,CAAC,GAAG,iBAAiB;IAAE,CAAC;AACjD;;EAEF,MAAM,MAAM,EAAE,OAAO,CAAC,GAAG,iBAAiB;AAC1C,MAAI,CAAC,MAAM,QAAQ,IAAI,IAAI,IAAI,WAAW,KAAK,IAAI,MAAM,OAAO,OAAO,OAAO,SAAS,CACrF,OAAM,IAAI,MAAM,qCAAqC,IAAI,oCAAoC;EAG/F,MAAM,QAAmB;GAAE;GAAM,KAAK,iBAAiB,IAAI;GAAE;AAC7D,MAAI,EAAE,YAAY,KAAM,OAAM,WAAW,EAAE;AAC3C,SAAO,KAAK,MAAM;GAClB;AACF,QAAO;;;;;;;;;;;AAYT,SAAgB,cAAc,KAAc,UAAuC;AAEjF,QADe,IAAmB,OACpB,WAAW;;;;;;;;AAS3B,SAAgB,oBAAoB,KAAc,UAAuC;AAEvF,QADe,IAAmB,OACpB,iBAAiB;;;;;;;;;;AAWjC,SAAgB,oBACd,KACA,KACA,oBACoE;CACpE,MAAM,gBAAgB,oBAAoB,KAAK,IAAI,cAAc;CACjE,IAAI,UAAU,cAAc,KAAK,IAAI,QAAQ;AAC7C,KAAI,iBAAiB,QAAS,WAAU,mBAAmB,cAAc;AACzE,QAAO;EAAE;EAAS;EAAe;;;;;;;;;;;;AAanC,SAAgB,eACd,KACA,MAmBY;AACZ,eAAc,KAAK,QAAQ;CAC3B,MAAM,eACJ,KAAK,iBAAiB,KAAK,cAAc,SAAS,IAC9C,KAAK,gBACL,CAAC;EAAE,MAAM;EAAO,KAAK;GAAC;GAAQ;GAAQ;GAAQ;GAAS;GAAU;GAAQ;EAAE,CAAC;CAClF,IAAI,aAAsB;CAC1B,IAAI;AACJ,KAAI,KAAK,QAAQ;EACf,MAAM,WAAW,cAAc,EAAE,UAAU,KAAK,QAAQ,CAAC;AACzD,gBAAc,kBAAkB;GAC9B,aAAa,KAAK;GAClB,OAAO,SAAS;GACjB,CAAC;AACF,eAAa,kBAAkB,KAAK,YAAY;;AAElD,QAAO,YAAY,YAAY;EAC7B,SAAS,KAAK;EACd,aAAa,KAAK;EAClB,YAAY;EACZ,cAAc,aAAa,KAAK,MAAM,EAAE,KAAK;EAC7C;EACA,QAAQ;EACR,cAAc,KAAK;EACpB,CAAC;;;;;;;;;;;;;AAcJ,SAAgB,sBACd,KACA,MAsBY;AAEZ,KADkB,IAAmB,MACvB,QAAO;AAarB,QAAO,mBAZM,eAAe,KAAK;EAC/B,SAAS,KAAK;EACd,eAAe,KAAK;EACpB,QAAQ,KAAK;EACb,cAAc,sBAAsB,KAAK,OAAO;EACjD,CAAC,EAEA,KAAK,mBACL,sBAAsB;EACpB,SAAS,0BAA0B,KAAK,QAAQ;EAChD,WAAW,KAAK,oBAAoB;EACrC,CAAC,CACqC;;;;;;;;;;;;;AAc3C,SAAgB,wBAAwB,MAIzB;AAEb,KADkB,KAAK,IAAmB,MAC5B,QAAO,KAAK;CAC1B,MAAM,gBAAgB,uBAAuB,KAAK,SAAS;AAC3D,QAAO,eAAe,KAAK,KAAK;EAC9B,SAAS,KAAK,WAAW;EACzB,eAAe,cAAc,SAAS,IAAI,gBAAgB;EAC3D,CAAC;;AAGJ,SAAS,YAAY,KAAc,OAA+C;CAChF,MAAM,QAAQ,OAAO,OAAO,IAAc;AAC1C,QAAO,eAAe,OAAO,SAAS;EACpC,OAAO;EACP,YAAY;EACZ,UAAU;EACV,cAAc;EACf,CAAC;AACF,QAAO;;;;;;;;;;;;;;;;;AAkBT,SAAgB,gBAAgB,QAAoB,SAA6C;AAC/F,qBAAoB,QAAQ,cAAc;AAC1C,kBAAiB,QAAQ,WAAW;AACpC,eAAc,QAAQ,QAAQ;AAE9B,KAAI,CAAC,UAAU,OAAO,WAAW,YAAY,CAAC,OAAO,MACnD,OAAM,IAAI,MAAM,gDAAgD;CAGlE,MAAM,YAAY,OAAO,MAAM,aAAa;AAC5C,KAAI,aAAa,qBACf,OAAM,IAAI,MACR,oCAAoC,UAAU,oBAAoB,uBACnE;CAGH,MAAM,qBAAqB,uBAAuB,QAAQ,cAAc;CACxE,MAAM,gBAAgB,OAAO,MAAM;CACnC,MAAM,cACJ,mBAAmB,WAAW,IAAI,EAAE,GAAG,eAAe,CAAC,GAAG,cAAc,EAAE,mBAAmB;AAE/F,KAAI,mBAAmB,SAAS,KAAK,YAAY,WAAW,EAC1D,OAAM,IAAI,MACR,2FACD;CAOH,MAAM,gBAAgB,oBAAoB,YAAY;CAEtD,MAAM,eAAe,gBAAgB,QAAgC;EACnE,YAAY,QAAQ;EACpB,MAAM;EACP,CAAC;CAEF,MAAM,eACJ,QAAQ,WAAW,0BAA0B,OAAO,MAAM,SAAS,QAAQ,WAAW;CAYxF,MAAM,cAAc,mBAAmB,cAJf,sBAAsB;EAC5C,SAAS,0BAA0B,aAAa;EAChD,WAAW,QAAQ,cAAc,UAAU,YAAY;EACxD,CAAC,CACmE;CAQrE,MAAM,eAAe,gBAAgB,QAAQ,cAAc,OAAO,GAC9D,oBAAoB;EAClB,gBAAgB,QAAQ,cAAc;EACtC,cAAc,OAAO,MAAM;EAC3B,YAAY,QAAQ;EACrB,CAAC,GACF;CAOJ,MAAM,4BACJ,iBAAiB,UAAa,iBAAiB,OAAO,MAAM;CAC9D,MAAM,aACJ,gBAAgB,CAAC,4BACb,kBACE,aACA,qBAAqB;EACnB,QAAQ;EAIR,SAAS,yBAAyB,OAAO;EACzC,GAAG,2BAA2B,OAAO;EACtC,CAAC,CACH,GACD;CACN,MAAM,aAAa,eAAe,iBAAiB,cAAc,GAAG;CAMpE,MAAM,cAAc,uBAAuB,OAAO,MAAM,QAAQ,QAAQ,cAAc,OAAO;AAG7F,QAAO,YAFY,cAAc,kBAAkB,YAAY,YAAY,GAAG,YAE/C;EAC7B,SAAS;EACT,eAAe,OAAO,MAAM;EAC5B,aAAa,OAAO,MAAM;EAC1B,YAAY;EACZ,cAAc,WAAW,KAAK,MAAM,EAAE,KAAK;EAC3C,cAAc;EACd;EACA,QAAQ;EACT,CAAC;;;AAIJ,SAAS,gBAAgB,OAAyB;AAChD,QAAO,UAAU,QAAS,OAAO,UAAU,YAAY,UAAU;;AAGnE,MAAM,mBAAmB;AAEzB,SAAS,iBAAiB,OAAiC;AACzD,KAAI,MAAM,MAAM,MAAM,EAAE,SAAS,oBAAoB,EAAE,SAAS,UAAU,CACxE,QAAO;AAET,QAAO,CAAC,GAAG,OAAO;EAAE,MAAM;EAAkB,KAAK;GAAC;GAAQ;GAAQ;GAAO;EAAE,CAAC;;;;;;;;AAS9E,SAAS,0BAA0B,SAAyB;CAC1D,MAAM,WAAW,WAAW,IAAI,QAAQ,QAAQ,GAAG;CAEnD,MAAM,UADO,QAAQ,MAAM,QAAQ,YAAY,IAAI,GAAG,EAAE,CACnC,QAAQ,SAAS,GAAG,CAAC,QAAQ,OAAO,GAAG;AAC5D,QAAO,QAAQ,SAAS,IAAI,UAAU;;AAGxC,SAAS,oBAAoB,OAAiC;AAC5D,KAAI,MAAM,MAAM,MAAM,EAAE,SAAS,uBAAuB,EAAE,SAAS,qBAAqB,CACtF,QAAO;AAET,QAAO,CAAC,GAAG,OAAO;EAAE,MAAM;EAAqB,KAAK,CAAC,OAAO;EAAE,CAAC;;AAGjE,SAAS,0BAA0B,eAAuB,YAA4B;AAMpF,QAAO,GAAG,cAAc,GALL,WAAW,MAAM,IAAI,CAAC,OAAO,QAAQ,CAAC,KAAK,IAAI,QAK5B,GADvB,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE;;;;;;;;AAUvD,SAAgB,OAAO,QAA0C;AAC/D,OAAM,IAAI,MACR,uFACD"}

package/dist/program/session-hierarchy.cjs

@@ -0,0 +1 @@
+let _aigne_afs_agent = require("@aigne/afs-agent");

package/dist/program/session-hierarchy.d.cts

@@ -0,0 +1,2 @@
+import { checkSpawnDepth, deriveChildSession } from "@aigne/afs-agent";
+export { checkSpawnDepth, deriveChildSession };

package/dist/program/session-hierarchy.d.mts

@@ -0,0 +1,2 @@
+import { checkSpawnDepth, deriveChildSession } from "@aigne/afs-agent";
+export { checkSpawnDepth, deriveChildSession };

package/dist/program/session-hierarchy.mjs

@@ -0,0 +1,3 @@
+import { checkSpawnDepth, deriveChildSession } from "@aigne/afs-agent";
+
+export { checkSpawnDepth, deriveChildSession };