@akon-labs/nexus-cli 0.1.7 → 0.1.8

package/dist/extensions/subagent/index.js

@@ -0,0 +1,568 @@
+/**
+ * Internal delegated-worker runtime.
+ *
+ * This file deliberately does not register a user-facing tool by default. The
+ * authenticated Hub policy must advertise delegation before the GitNexus
+ * extension calls registerDelegateTaskTool(). The CLI owns process isolation
+ * and streaming UX; the Hub owns one-time worker authorization and routing.
+ */
+import { execFile, spawn } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { Text } from "@earendil-works/pi-tui";
+import { Type } from "typebox";
+import { AUTO_MODEL_ID, AUTO_PROVIDER_ID, isAutoModel } from "../../core/auto-model.js";
+import { withFileMutationQueue } from "../../core/tools/index.js";
+import { resolveGitNexusConfig } from "../gitnexus/config.js";
+import { hubApiBase } from "../gitnexus/device-auth.js";
+export const DELEGATE_TASK_TOOL_NAME = "delegate_task";
+export const INTERNAL_WORKER_MARKER_ENV = "NEXUS_INTERNAL_DELEGATED_WORKER";
+export const INTERNAL_WORKER_SESSION_ENV = "NEXUS_INTERNAL_WORKER_SESSION_ID";
+export const INTERNAL_WORKER_TASK_ENV = "NEXUS_INTERNAL_WORKER_TASK_ID";
+export const INTERNAL_WORKER_RUN_ENV = "NEXUS_INTERNAL_WORKER_RUN_ID";
+export const INTERNAL_WORKER_ROOT_REQUEST_ENV = "NEXUS_INTERNAL_WORKER_ROOT_REQUEST_ID";
+export const INTERNAL_WORKER_PARENT_REQUEST_ENV = "NEXUS_INTERNAL_WORKER_PARENT_REQUEST_ID";
+export const INTERNAL_WORKER_GRANT_HEADER = "x-nexus-worker-grant";
+export const INTERNAL_WORKER_TASK_HEADER = "x-nexus-worker-task-id";
+export const SESSION_AFFINITY_HEADER = "x-session-affinity";
+export const RUN_ID_HEADER = "x-nexus-run-id";
+export const REQUEST_ID_HEADER = "x-nexus-request-id";
+export const ROOT_REQUEST_ID_HEADER = "x-nexus-root-request-id";
+export const PARENT_REQUEST_ID_HEADER = "x-nexus-parent-request-id";
+export const DELEGATION_ID_HEADER = "x-nexus-delegation-id";
+export const REQUEST_SCOPE_HEADER = "x-nexus-request-scope";
+export const MAX_DELEGATED_TURNS = 12;
+export const MAX_DELEGATIONS_PER_RUN = 3;
+export const DELEGATED_WORKER_TIMEOUT_MS = 5 * 60 * 1000;
+export const DELEGATED_OUTPUT_CAP_BYTES = 32 * 1024;
+export const DELEGATED_EVENT_CAP_BYTES = 1024 * 1024;
+export const MAX_DELEGATED_TASK_BYTES = 32 * 1024;
+const WORKER_GRANT_TIMEOUT_MS = 10_000;
+const INVALID_WORKER_GRANT = "unavailable";
+const MAX_ROOT_REVIEW_TOOL_CALLS = 8;
+const MAX_PARALLEL_MUTATING_WORKERS = 1;
+const ROOT_REVIEW_TOOLS = new Set([
+    "read",
+    "grep",
+    "find",
+    "ls",
+    "gitnexus_query",
+    "gitnexus_context",
+    "gitnexus_impact",
+    "gitnexus_detect_changes",
+    "gitnexus_cypher",
+    "gitnexus_list_repos",
+    "web_search",
+    "web_fetch",
+]);
+export const DELEGATED_WORKER_TOOLS = [
+    "read",
+    "grep",
+    "find",
+    "ls",
+    "bash",
+    "write",
+    "edit",
+    "gitnexus_query",
+    "gitnexus_context",
+    "gitnexus_impact",
+    "gitnexus_detect_changes",
+    "gitnexus_cypher",
+    "gitnexus_list_repos",
+];
+const WORKER_SYSTEM_PROMPT = `You are an internal implementation worker for Nexus Agent.
+
+Complete only the narrowly delegated task. Inspect the repository before editing, follow its local instructions, and verify the changed behavior. Do not delegate work or broaden scope. Do not discuss model names, providers, routing, credits, or internal architecture.
+
+Finish with a concise report containing:
+- changes made
+- verification run and results
+- blockers or remaining risks`;
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
+function parseAssistantSnapshot(value) {
+    if (!isRecord(value) || value.role !== "assistant" || !Array.isArray(value.content))
+        return undefined;
+    const text = value.content
+        .filter(isRecord)
+        .filter((part) => part.type === "text" && typeof part.text === "string")
+        .map((part) => part.text)
+        .join("\n");
+    return {
+        text,
+        ...(typeof value.stopReason === "string" ? { stopReason: value.stopReason } : {}),
+    };
+}
+export function composeDelegatedTask(task, acceptanceCriteria, relevantPaths) {
+    const sections = [`Task:\n${task.trim()}`];
+    if (acceptanceCriteria.length > 0) {
+        sections.push(`Acceptance criteria:\n${acceptanceCriteria.map((criterion) => `- ${criterion}`).join("\n")}`);
+    }
+    if (relevantPaths.length > 0) {
+        sections.push(`Relevant paths:\n${relevantPaths.map((filePath) => `- ${filePath}`).join("\n")}`);
+    }
+    return sections.join("\n\n");
+}
+export function buildDelegatedWorkerArgs(task, promptPath) {
+    return [
+        "--mode",
+        "json",
+        "-p",
+        "--no-session",
+        "--model",
+        `${AUTO_PROVIDER_ID}/${AUTO_MODEL_ID}`,
+        "--tools",
+        DELEGATED_WORKER_TOOLS.join(","),
+        "--exclude-tools",
+        `${DELEGATE_TASK_TOOL_NAME},subagent`,
+        "--append-system-prompt",
+        promptPath,
+        task,
+    ];
+}
+function getNexusInvocation(args) {
+    const currentScript = process.argv[1];
+    const isBunVirtualScript = currentScript?.startsWith("/$bunfs/root/");
+    if (currentScript && !isBunVirtualScript && fs.existsSync(currentScript)) {
+        return { command: process.execPath, args: [currentScript, ...args] };
+    }
+    const execName = path.basename(process.execPath).toLowerCase();
+    const isGenericRuntime = /^(node|bun)(\.exe)?$/.test(execName);
+    return isGenericRuntime ? { command: "nexus", args } : { command: process.execPath, args };
+}
+async function writeWorkerPrompt() {
+    const dir = await fs.promises.mkdtemp(path.join(os.tmpdir(), "nexus-worker-"));
+    const filePath = path.join(dir, "system.md");
+    await withFileMutationQueue(filePath, async () => {
+        await fs.promises.writeFile(filePath, WORKER_SYSTEM_PROMPT, { encoding: "utf8", mode: 0o600 });
+    });
+    return { dir, filePath };
+}
+function truncateUtf8(value, cap) {
+    if (Buffer.byteLength(value, "utf8") <= cap)
+        return { value, truncated: false };
+    const suffix = "\n\n[Report truncated]";
+    let truncated = value.slice(0, Math.max(0, cap - Buffer.byteLength(suffix, "utf8")));
+    while (Buffer.byteLength(`${truncated}${suffix}`, "utf8") > cap)
+        truncated = truncated.slice(0, -1);
+    return { value: `${truncated}${suffix}`, truncated: true };
+}
+export function createHubDelegationController(config, options = {}) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    return {
+        async createWorkerGrant(request) {
+            const controller = new AbortController();
+            const onAbort = () => controller.abort();
+            if (request.signal?.aborted)
+                controller.abort();
+            else
+                request.signal?.addEventListener("abort", onAbort, { once: true });
+            const timeout = setTimeout(() => controller.abort(), options.timeoutMs ?? WORKER_GRANT_TIMEOUT_MS);
+            try {
+                const response = await fetchImpl(`${hubApiBase(config.hubUrl)}/llm/worker-grants`, {
+                    method: "POST",
+                    headers: {
+                        "content-type": "application/json",
+                        accept: "application/json",
+                        authorization: `Bearer ${config.token}`,
+                        [RUN_ID_HEADER]: request.runId,
+                        [REQUEST_ID_HEADER]: request.requestId,
+                        [ROOT_REQUEST_ID_HEADER]: request.rootRequestId,
+                        [PARENT_REQUEST_ID_HEADER]: request.parentRequestId,
+                        [DELEGATION_ID_HEADER]: request.taskId,
+                        [REQUEST_SCOPE_HEADER]: "worker",
+                        ...(config.deviceFingerprint ? { "x-device-fingerprint": config.deviceFingerprint } : {}),
+                        ...(config.deviceName ? { "x-device-name": config.deviceName } : {}),
+                    },
+                    body: JSON.stringify({ sessionId: request.sessionId, taskId: request.taskId }),
+                    signal: controller.signal,
+                });
+                if (!response.ok) {
+                    await response.body?.cancel().catch(() => { });
+                    throw new Error("Worker authorization unavailable");
+                }
+                const body = await response.json();
+                if (!isRecord(body) ||
+                    typeof body.grant !== "string" ||
+                    !body.grant.trim() ||
+                    typeof body.expiresAt !== "string" ||
+                    !body.expiresAt.trim() ||
+                    !Number.isFinite(Date.parse(body.expiresAt))) {
+                    throw new Error("Invalid worker authorization response");
+                }
+                return { token: body.grant, expiresAt: body.expiresAt };
+            }
+            finally {
+                clearTimeout(timeout);
+                request.signal?.removeEventListener("abort", onAbort);
+            }
+        },
+    };
+}
+export function isDelegatedWorkerProcess(env = process.env) {
+    return env[INTERNAL_WORKER_MARKER_ENV] === "1";
+}
+/** Capture task routing once, then remove it before worker tools can inherit it. */
+export function consumeWorkerContext(env = process.env) {
+    if (!isDelegatedWorkerProcess(env))
+        return undefined;
+    const sessionId = env[INTERNAL_WORKER_SESSION_ENV]?.trim();
+    const taskId = env[INTERNAL_WORKER_TASK_ENV]?.trim();
+    const runId = env[INTERNAL_WORKER_RUN_ENV]?.trim();
+    const rootRequestId = env[INTERNAL_WORKER_ROOT_REQUEST_ENV]?.trim();
+    const parentRequestId = env[INTERNAL_WORKER_PARENT_REQUEST_ENV]?.trim();
+    delete env[INTERNAL_WORKER_SESSION_ENV];
+    delete env[INTERNAL_WORKER_TASK_ENV];
+    delete env[INTERNAL_WORKER_RUN_ENV];
+    delete env[INTERNAL_WORKER_ROOT_REQUEST_ENV];
+    delete env[INTERNAL_WORKER_PARENT_REQUEST_ENV];
+    if (!sessionId || !taskId || !runId || !rootRequestId || !parentRequestId)
+        return undefined;
+    return { sessionId, taskId, runId, rootRequestId, parentRequestId };
+}
+function killProcessTree(pid, signal) {
+    if (pid === undefined)
+        return;
+    if (process.platform === "win32") {
+        execFile("taskkill", ["/T", "/F", "/PID", String(pid)], () => undefined);
+        return;
+    }
+    try {
+        process.kill(-pid, signal);
+    }
+    catch {
+        // The detached process group may already have exited.
+    }
+}
+export async function runDelegatedWorker(options) {
+    const prompt = await writeWorkerPrompt();
+    const task = composeDelegatedTask(options.task, options.acceptanceCriteria, options.relevantPaths);
+    const args = buildDelegatedWorkerArgs(task, prompt.filePath);
+    let output = "";
+    let turns = 0;
+    let terminalStatus;
+    let assistantFailed = false;
+    let eventBytes = 0;
+    try {
+        const exitCode = await new Promise((resolve) => {
+            const invocation = getNexusInvocation(args);
+            const child = spawn(invocation.command, invocation.args, {
+                cwd: options.cwd,
+                detached: true,
+                env: {
+                    ...process.env,
+                    [INTERNAL_WORKER_MARKER_ENV]: "1",
+                    [INTERNAL_WORKER_SESSION_ENV]: options.workerContext.sessionId,
+                    [INTERNAL_WORKER_TASK_ENV]: options.workerContext.taskId,
+                    [INTERNAL_WORKER_RUN_ENV]: options.workerContext.runId,
+                    [INTERNAL_WORKER_ROOT_REQUEST_ENV]: options.workerContext.rootRequestId,
+                    [INTERNAL_WORKER_PARENT_REQUEST_ENV]: options.workerContext.parentRequestId,
+                },
+                shell: false,
+                stdio: ["ignore", "pipe", "pipe"],
+                windowsHide: true,
+            });
+            let buffer = "";
+            let settled = false;
+            let stopped = false;
+            let forceKillTimer;
+            const finish = (code) => {
+                if (settled)
+                    return;
+                settled = true;
+                clearTimeout(timeoutTimer);
+                clearTimeout(forceKillTimer);
+                options.signal?.removeEventListener("abort", abortHandler);
+                resolve(code);
+            };
+            const stop = (status) => {
+                if (stopped)
+                    return;
+                stopped = true;
+                terminalStatus = status;
+                killProcessTree(child.pid, "SIGTERM");
+                forceKillTimer = setTimeout(() => {
+                    if (process.platform !== "win32")
+                        killProcessTree(child.pid, "SIGKILL");
+                    finish(1);
+                }, 5000);
+            };
+            const emitProgress = () => {
+                options.onUpdate?.({
+                    content: [{ type: "text", text: "Delegated work is in progress." }],
+                    details: { status: "running", turns },
+                });
+            };
+            const processLine = (line) => {
+                if (!line.trim())
+                    return;
+                let parsed;
+                try {
+                    parsed = JSON.parse(line);
+                }
+                catch {
+                    return;
+                }
+                if (!isRecord(parsed) || parsed.type !== "message_end")
+                    return;
+                const snapshot = parseAssistantSnapshot(parsed.message);
+                if (!snapshot)
+                    return;
+                turns += 1;
+                if (snapshot.text)
+                    output = snapshot.text;
+                if (snapshot.stopReason === "error" || snapshot.stopReason === "aborted")
+                    assistantFailed = true;
+                emitProgress();
+                if (turns >= MAX_DELEGATED_TURNS)
+                    stop("turn_limit");
+            };
+            const abortHandler = () => stop("aborted");
+            const timeoutTimer = setTimeout(() => stop("timeout"), Math.min(Math.max(1_000, options.timeoutMs ?? DELEGATED_WORKER_TIMEOUT_MS), DELEGATED_WORKER_TIMEOUT_MS));
+            child.stdout.on("data", (chunk) => {
+                eventBytes += Buffer.byteLength(chunk);
+                if (eventBytes > DELEGATED_EVENT_CAP_BYTES) {
+                    assistantFailed = true;
+                    stop("event_limit");
+                    return;
+                }
+                buffer += chunk.toString();
+                if (Buffer.byteLength(buffer, "utf8") > DELEGATED_EVENT_CAP_BYTES) {
+                    buffer = "";
+                    assistantFailed = true;
+                    return;
+                }
+                const lines = buffer.split("\n");
+                buffer = lines.pop() ?? "";
+                for (const line of lines)
+                    processLine(line);
+            });
+            // Consume stderr so a noisy child cannot block. Raw provider/process output
+            // is intentionally not retained or exposed to the orchestrator or user.
+            child.stderr.on("data", () => undefined);
+            child.on("close", (code) => {
+                if (buffer.trim())
+                    processLine(buffer);
+                finish(code ?? (terminalStatus ? 1 : 0));
+            });
+            child.on("error", () => finish(1));
+            if (options.signal?.aborted)
+                abortHandler();
+            else
+                options.signal?.addEventListener("abort", abortHandler, { once: true });
+        });
+        const limitedOutput = truncateUtf8(output, DELEGATED_OUTPUT_CAP_BYTES);
+        const status = terminalStatus ?? (exitCode === 0 && !assistantFailed ? "completed" : "failed");
+        return {
+            status,
+            turns,
+            exitCode,
+            output: limitedOutput.value,
+            outputTruncated: limitedOutput.truncated,
+        };
+    }
+    finally {
+        await fs.promises.rm(prompt.dir, { recursive: true, force: true });
+    }
+}
+const DelegateTaskParameters = Type.Object({
+    task: Type.String({ description: "A narrow implementation task with explicit boundaries", maxLength: 32_768 }),
+    acceptanceCriteria: Type.Optional(Type.Array(Type.String({ maxLength: 2000 }), { maxItems: 10 })),
+    relevantPaths: Type.Optional(Type.Array(Type.String({ maxLength: 1000 }), { maxItems: 20 })),
+});
+function resultContent(result) {
+    const report = result.output.trim() || "No implementation report was returned.";
+    if (result.status === "completed")
+        return `Delegated implementation completed.\n\n${report}`;
+    return `Delegated implementation did not complete (${result.status}).\n\nPartial report:\n${report}`;
+}
+/** Register the tool only after the Hub explicitly advertises delegation. */
+export function registerDelegateTaskTool(pi, capability) {
+    const maxTaskBytes = Math.min(Math.max(1, Math.floor(capability.maxTaskBytes)), MAX_DELEGATED_TASK_BYTES);
+    const workerTimeoutMs = Math.min(Math.max(1_000, Math.floor(capability.workerTimeoutMs)), DELEGATED_WORKER_TIMEOUT_MS);
+    const runId = randomUUID();
+    let rootRequestId;
+    let latestRootRequestId;
+    let activeWorkers = 0;
+    let invocationCount = 0;
+    let rootReviewToolCalls = 0;
+    pi.on("before_agent_start", (event) => {
+        invocationCount = 0;
+        rootReviewToolCalls = 0;
+        return {
+            systemPrompt: `${event.systemPrompt}\n\nImplementation policy: perform implementation, mutation, shell, and repeated tool loops through delegate_task. Keep this parent conversation focused on planning and final review. Use only bounded read-only tools to inspect worker changes, verify graph impact, and reach the final answer.`,
+        };
+    });
+    pi.on("before_provider_headers", (event, ctx) => {
+        if (!isAutoModel(ctx.model) || isDelegatedWorkerProcess())
+            return;
+        const requestId = randomUUID();
+        rootRequestId ??= requestId;
+        latestRootRequestId = requestId;
+        event.headers[RUN_ID_HEADER] = runId;
+        event.headers[REQUEST_ID_HEADER] = requestId;
+        event.headers[ROOT_REQUEST_ID_HEADER] = rootRequestId;
+        event.headers[REQUEST_SCOPE_HEADER] = "root";
+    });
+    pi.on("tool_call", (event, ctx) => {
+        if (!isAutoModel(ctx.model) || isDelegatedWorkerProcess() || event.toolName === DELEGATE_TASK_TOOL_NAME) {
+            return;
+        }
+        if (!ROOT_REVIEW_TOOLS.has(event.toolName)) {
+            return {
+                block: true,
+                reason: "This parent run is review-only. Use delegate_task for implementation, mutation, shell commands, tests, or other execution.",
+            };
+        }
+        if (rootReviewToolCalls >= MAX_ROOT_REVIEW_TOOL_CALLS) {
+            return {
+                block: true,
+                reason: "The bounded parent review budget is exhausted. Delegate further investigation or finalize the review.",
+            };
+        }
+        rootReviewToolCalls += 1;
+    });
+    pi.registerTool({
+        name: DELEGATE_TASK_TOOL_NAME,
+        label: "Work",
+        description: "Delegate one narrow implementation task to an isolated internal worker. Keep planning, user communication, and final verification in this conversation.",
+        promptGuidelines: [
+            "Use delegate_task for bounded implementation, mutation, command execution, tests, and repeated tool work after you have formed a plan.",
+            "You remain responsible for reviewing the returned report, verifying the result, and communicating with the user.",
+        ],
+        parameters: DelegateTaskParameters,
+        executionMode: "sequential",
+        async execute(_toolCallId, params, signal, onUpdate, ctx) {
+            if (!isAutoModel(ctx.model)) {
+                return {
+                    content: [{ type: "text", text: "Delegated work is unavailable for the active mode." }],
+                    details: { status: "failed", turns: 0 },
+                };
+            }
+            if (!ctx.isProjectTrusted()) {
+                return {
+                    content: [{ type: "text", text: "Delegated work requires a trusted project." }],
+                    details: { status: "failed", turns: 0 },
+                };
+            }
+            if (activeWorkers >= MAX_PARALLEL_MUTATING_WORKERS || invocationCount >= MAX_DELEGATIONS_PER_RUN) {
+                return {
+                    content: [{ type: "text", text: "Delegated work is temporarily unavailable for this run." }],
+                    details: { status: "failed", turns: 0 },
+                };
+            }
+            const request = {
+                task: params.task,
+                acceptanceCriteria: params.acceptanceCriteria ?? [],
+                relevantPaths: params.relevantPaths ?? [],
+                cwd: ctx.cwd,
+                signal,
+            };
+            if (Buffer.byteLength(composeDelegatedTask(request.task, request.acceptanceCriteria, request.relevantPaths), "utf8") > maxTaskBytes) {
+                return {
+                    content: [{ type: "text", text: "Delegated work is too large for one bounded task." }],
+                    details: { status: "failed", turns: 0 },
+                };
+            }
+            activeWorkers += 1;
+            invocationCount += 1;
+            try {
+                const delegationId = randomUUID();
+                rootRequestId ??= randomUUID();
+                const result = await runDelegatedWorker({
+                    ...request,
+                    workerContext: {
+                        sessionId: ctx.sessionManager.getSessionId(),
+                        taskId: delegationId,
+                        runId,
+                        rootRequestId,
+                        parentRequestId: latestRootRequestId ?? rootRequestId,
+                    },
+                    timeoutMs: workerTimeoutMs,
+                    onUpdate,
+                });
+                return {
+                    content: [{ type: "text", text: resultContent(result) }],
+                    details: {
+                        status: result.status,
+                        turns: result.turns,
+                        exitCode: result.exitCode,
+                        outputTruncated: result.outputTruncated,
+                    },
+                };
+            }
+            catch {
+                return {
+                    content: [{ type: "text", text: "Delegated work could not be started." }],
+                    details: { status: "failed", turns: 0 },
+                };
+            }
+            finally {
+                activeWorkers -= 1;
+            }
+        },
+        renderCall(_args, theme) {
+            return new Text(theme.fg("toolTitle", theme.bold("Working…")), 0, 0);
+        },
+        renderResult(result, _options, theme) {
+            const details = result.details;
+            if (details?.status === "running")
+                return new Text(theme.fg("muted", "Working…"), 0, 0);
+            if (details?.status === "completed")
+                return new Text(theme.fg("success", "Work completed"), 0, 0);
+            return new Text(theme.fg("error", "Work needs attention"), 0, 0);
+        },
+    });
+}
+/**
+ * Install a fail-closed header hook for one worker task. A fresh one-time grant
+ * is minted for each model turn; no grant is inherited by worker tools.
+ */
+export function registerWorkerGrantHeaders(pi, workerContext, controller) {
+    pi.on("before_provider_headers", async (event, ctx) => {
+        if (!isAutoModel(ctx.model)) {
+            ctx.abort();
+            return;
+        }
+        // Set an invalid sentinel first. Extension handler errors are reported and
+        // swallowed by the runner, so this prevents a mint failure from silently
+        // falling back to an ungranted root request.
+        const requestId = randomUUID();
+        event.headers[INTERNAL_WORKER_GRANT_HEADER] = INVALID_WORKER_GRANT;
+        event.headers[INTERNAL_WORKER_TASK_HEADER] = workerContext.taskId;
+        event.headers[SESSION_AFFINITY_HEADER] = workerContext.sessionId;
+        event.headers[RUN_ID_HEADER] = workerContext.runId;
+        event.headers[REQUEST_ID_HEADER] = requestId;
+        event.headers[ROOT_REQUEST_ID_HEADER] = workerContext.rootRequestId;
+        event.headers[PARENT_REQUEST_ID_HEADER] = workerContext.parentRequestId;
+        event.headers[DELEGATION_ID_HEADER] = workerContext.taskId;
+        event.headers[REQUEST_SCOPE_HEADER] = "worker";
+        if (!controller)
+            return;
+        const grant = await controller.createWorkerGrant({
+            ...workerContext,
+            requestId,
+            signal: ctx.signal,
+        });
+        event.headers[INTERNAL_WORKER_GRANT_HEADER] = grant.token;
+    });
+}
+export default function delegatedWorkerRuntime(pi) {
+    const isWorker = isDelegatedWorkerProcess();
+    const workerContext = consumeWorkerContext();
+    if (!isWorker)
+        return;
+    const config = resolveGitNexusConfig();
+    const failClosedContext = {
+        sessionId: "unavailable",
+        taskId: "unavailable",
+        runId: "unavailable",
+        rootRequestId: "unavailable",
+        parentRequestId: "unavailable",
+    };
+    registerWorkerGrantHeaders(pi, workerContext ?? failClosedContext, workerContext && config ? createHubDelegationController(config) : undefined);
+}
+//# sourceMappingURL=index.js.map