@alexkroman1/aai 0.12.3 → 1.0.3

package/dist/{direct-executor-DRRrZUp0.js → host/runtime-barrel.js}

@@ -1,18 +1,76 @@
-import { a as agentToolsToSchemas, o as toAgentConfig, r as EMPTY_PARAMS, t as buildSystemPrompt } from "./system-prompt-DYAYFW99.js";
-import { errorDetail, errorMessage, toolError } from "./isolate/_utils.js";
-import { C as MAX_VALUE_SIZE, S as MAX_TOOL_RESULT_CHARS, T as TOOL_EXECUTION_TIMEOUT_MS, _ as FETCH_TIMEOUT_MS, b as MAX_HTML_BYTES, g as DEFAULT_TTS_SAMPLE_RATE, h as DEFAULT_STT_SAMPLE_RATE, l as buildReadyConfig, m as DEFAULT_SHUTDOWN_TIMEOUT_MS, r as ClientMessageSchema, v as HOOK_TIMEOUT_MS, w as RUN_CODE_TIMEOUT_MS, x as MAX_PAGE_CHARS, y as MAX_GLOB_PATTERN_LENGTH } from "./protocol-rcOrz7T3.js";
-import { callResolveTurnConfig, createAgentHooks } from "./isolate/hooks.js";
+import { a as DEFAULT_SHUTDOWN_TIMEOUT_MS, c as FETCH_TIMEOUT_MS, d as MAX_PAGE_CHARS, f as MAX_TOOL_RESULT_CHARS, g as TOOL_EXECUTION_TIMEOUT_MS, h as RUN_CODE_TIMEOUT_MS, l as MAX_HTML_BYTES, m as MAX_WS_PAYLOAD_BYTES, o as DEFAULT_STT_SAMPLE_RATE, p as MAX_VALUE_SIZE, s as DEFAULT_TTS_SAMPLE_RATE, t as AGENT_CSP } from "../constants-VTFoymJ-.js";
+import { i as toolError, n as errorDetail, r as errorMessage, t as parseWsUpgradeParams } from "../ws-upgrade-BeOQ7fXL.js";
+import { ClientMessageSchema, buildReadyConfig, lenientParse } from "../sdk/protocol.js";
+import { a as agentToolsToSchemas, o as toAgentConfig, r as EMPTY_PARAMS, t as buildSystemPrompt } from "../system-prompt-nik_iavo.js";
 import { z } from "zod";
+import { convert } from "html-to-text";
 import vm from "node:vm";
 import pTimeout from "p-timeout";
 import { createStorage, prefixStorage } from "unstorage";
 import { createNanoEvents } from "nanoevents";
-import WsWebSocket from "ws";
+import WsWebSocket, { WebSocketServer } from "ws";
+import fs from "node:fs";
+import http from "node:http";
+import path from "node:path";
+import escapeHtml from "escape-html";
+import { lookup } from "mime-types";
 //#region host/_run-code.ts
 /**
 * run_code built-in tool — executes user JavaScript in a fresh `node:vm`
 * context with no network, filesystem, or process access.
 */
+const SKIPPED_CLASS_KEYS = new Set([
+	"constructor",
+	"prototype",
+	"length",
+	"name"
+]);
+/**
+* Copy static members from a class constructor to a wrapper function,
+* skipping built-in keys that must not be forwarded.
+*/
+function copyStaticMembers(src, dst) {
+	for (const key of Object.getOwnPropertyNames(src)) {
+		if (SKIPPED_CLASS_KEYS.has(key)) continue;
+		try {
+			const desc = Object.getOwnPropertyDescriptor(src, key);
+			if (desc) Object.defineProperty(dst, key, desc);
+		} catch {}
+	}
+}
+/**
+* Neuter the `.constructor` chain on a host function or class constructor.
+*
+* For plain functions: wraps the function so calling `.constructor` or
+* `.constructor.constructor` no longer exposes the host `Function`.
+*
+* For class constructors: additionally copies static methods and neutralizes
+* `prototype.constructor` so instances created via `new` also cannot escape.
+*
+* This prevents sandbox code from reaching the host `Function` constructor
+* via patterns like `fn.constructor.constructor('return process')()`.
+*/
+function neutralizeConstructor(fn) {
+	const hasPrototype = typeof fn.prototype === "object" && fn.prototype !== null;
+	function Wrapper(...args) {
+		if (hasPrototype) return new fn(...args);
+		return fn(...args);
+	}
+	if (hasPrototype) {
+		copyStaticMembers(fn, Wrapper);
+		if (Wrapper.prototype) Object.defineProperty(Wrapper.prototype, "constructor", {
+			value: void 0,
+			writable: false,
+			configurable: false
+		});
+	}
+	Object.defineProperty(Wrapper, "constructor", {
+		value: void 0,
+		writable: false,
+		configurable: false
+	});
+	return Wrapper;
+}
 const runCodeParams = z.object({ code: z.string().describe("JavaScript code to execute. Use console.log() for output.") });
 /**
 * Execute JavaScript code inside a fresh `node:vm` context.
@@ -48,34 +106,67 @@ function createRunCode() {
 async function executeInIsolate(code) {
 	const output = [];
 	const capture = (...args) => output.push(args.map(String).join(" "));
+	const activeTimers = /* @__PURE__ */ new Set();
+	const sandboxSetTimeout = (fn, delay, ...args) => {
+		const id = setTimeout((...a) => {
+			activeTimers.delete(id);
+			fn(...a);
+		}, delay, ...args);
+		activeTimers.add(id);
+		return id;
+	};
+	const sandboxClearTimeout = (id) => {
+		if (id !== void 0) {
+			activeTimers.delete(id);
+			clearTimeout(id);
+		}
+	};
+	const sandboxSetInterval = (fn, delay, ...args) => {
+		const id = setInterval(fn, delay, ...args);
+		activeTimers.add(id);
+		return id;
+	};
+	const sandboxClearInterval = (id) => {
+		if (id !== void 0) {
+			activeTimers.delete(id);
+			clearInterval(id);
+		}
+	};
 	const context = vm.createContext({
-		console: {
-			log: capture,
-			info: capture,
-			warn: capture,
-			error: capture,
-			debug: capture
-		},
-		setTimeout,
-		clearTimeout,
-		setInterval,
-		clearInterval,
-		URL,
-		URLSearchParams,
-		TextEncoder,
-		TextDecoder,
-		atob,
-		btoa,
-		structuredClone,
-		queueMicrotask
-	});
+		console: Object.freeze({
+			log: neutralizeConstructor(capture),
+			info: neutralizeConstructor(capture),
+			warn: neutralizeConstructor(capture),
+			error: neutralizeConstructor(capture),
+			debug: neutralizeConstructor(capture)
+		}),
+		setTimeout: neutralizeConstructor(sandboxSetTimeout),
+		clearTimeout: neutralizeConstructor(sandboxClearTimeout),
+		setInterval: neutralizeConstructor(sandboxSetInterval),
+		clearInterval: neutralizeConstructor(sandboxClearInterval),
+		URL: neutralizeConstructor(URL),
+		URLSearchParams: neutralizeConstructor(URLSearchParams),
+		TextEncoder: neutralizeConstructor(TextEncoder),
+		TextDecoder: neutralizeConstructor(TextDecoder),
+		atob: neutralizeConstructor(atob),
+		btoa: neutralizeConstructor(btoa),
+		structuredClone: neutralizeConstructor(structuredClone)
+	}, { codeGeneration: {
+		strings: false,
+		wasm: false
+	} });
 	try {
 		const wrapped = `(async () => {\n${code}\n})()`;
-		const promise = new vm.Script(wrapped, { filename: "run_code.js" }).runInContext(context, { timeout: RUN_CODE_TIMEOUT_MS });
-		await Promise.race([promise, new Promise((_, reject) => setTimeout(() => reject(/* @__PURE__ */ new Error("Code execution timed out")), RUN_CODE_TIMEOUT_MS))]);
+		await new vm.Script(wrapped, { filename: "run_code.js" }).runInContext(context, { timeout: RUN_CODE_TIMEOUT_MS });
 		return output.join("\n").trim() || "Code ran successfully (no output)";
 	} catch (err) {
 		return { error: errorMessage(err) };
+	} finally {
+		for (const id of activeTimers) {
+			clearTimeout(id);
+			clearInterval(id);
+		}
+		activeTimers.clear();
 	}
 }
 //#endregion
@@ -88,10 +179,7 @@ async function executeInIsolate(code) {
 * Network requests go through the host's fetch proxy (with SSRF protection).
 */
 const fetchSignal = () => AbortSignal.timeout(FETCH_TIMEOUT_MS);
-/** Strip HTML tags and decode common entities. */
-function htmlToText(html) {
-	return html.replace(/<script[\s\S]*?<\/script>/gi, "").replace(/<style[\s\S]*?<\/style>/gi, "").replace(/<[^>]+>/g, " ").replace(/&amp;/g, "&").replace(/&lt;/g, "<").replace(/&gt;/g, ">").replace(/&quot;/g, "\"").replace(/&#39;/g, "'").replace(/&nbsp;/g, " ").replace(/\s{2,}/g, " ").trim();
-}
+const htmlToText = (html) => convert(html, { wordwrap: false });
 const webSearchParams = z.object({
 	query: z.string().describe("The search query"),
 	max_results: z.number().describe("Maximum number of results to return (default 5)").optional()
@@ -226,40 +314,46 @@ function resolveBuiltin(name, opts) {
 	}
 }
 /**
-* Create built-in tool definitions for the given tool names.
-* For runtime use.
+* Resolve all builtin tools in one pass, returning defs, schemas, and guidance.
+* Avoids redundant calls to `resolveBuiltin` and `z.toJSONSchema`.
 */
-function getBuiltinToolDefs(names, opts) {
+function resolveAllBuiltins(names, opts) {
 	const defs = {};
-	for (const name of names) for (const [k, v] of resolveBuiltin(name, opts)) defs[k] = v;
-	return defs;
-}
-/** Returns system prompt guidance strings for the specified builtin tools. */
-function getBuiltinToolGuidance(names) {
-	return names.flatMap((name) => resolveBuiltin(name).map(([, def]) => def.guidance).filter((g) => Boolean(g)));
-}
-/** Returns JSON tool schemas for the specified builtin tools. */
-function getBuiltinToolSchemas(names) {
-	return names.flatMap((name) => resolveBuiltin(name).map(([toolName, def]) => ({
-		name: toolName,
-		description: def.description,
-		parameters: z.toJSONSchema(def.parameters ?? EMPTY_PARAMS)
-	})));
+	const schemas = [];
+	const guidance = [];
+	for (const name of names) for (const [toolName, def] of resolveBuiltin(name, opts)) {
+		defs[toolName] = def;
+		schemas.push({
+			name: toolName,
+			description: def.description,
+			parameters: z.toJSONSchema(def.parameters ?? EMPTY_PARAMS)
+		});
+		const g = def.guidance;
+		if (g) guidance.push(g);
+	}
+	return {
+		defs,
+		schemas,
+		guidance
+	};
 }
 //#endregion
-//#region host/runtime.ts
+//#region host/runtime-config.ts
 /**
 * Runtime dependencies injected into the session pipeline.
 *
 * Defines the {@link Logger} interface, a default {@link consoleLogger},
 * and the {@link S2SConfig} for Speech-to-Speech endpoint configuration.
 */
+function consoleLog(fn) {
+	return (msg, ctx) => ctx ? fn(msg, ctx) : fn(msg);
+}
 /** Default console-backed logger. */
 const consoleLogger = {
-	info: (msg, ctx) => ctx ? console.log(msg, ctx) : console.log(msg),
-	warn: (msg, ctx) => ctx ? console.warn(msg, ctx) : console.warn(msg),
-	error: (msg, ctx) => ctx ? console.error(msg, ctx) : console.error(msg),
-	debug: (msg, ctx) => ctx ? console.debug(msg, ctx) : console.debug(msg)
+	info: consoleLog(console.log),
+	warn: consoleLog(console.warn),
+	error: consoleLog(console.error),
+	debug: consoleLog(console.debug)
 };
 /**
 * Structured JSON logger for production diagnostics. Each log entry is a
@@ -285,7 +379,7 @@ const jsonLogger = {
 };
 /** Default S2S endpoint configuration. */
 const DEFAULT_S2S_CONFIG = {
-	wssUrl: "wss://speech-to-speech.us.assemblyai.com/v1/realtime",
+	wssUrl: "wss://agents.assemblyai.com/v1/voice",
 	inputSampleRate: DEFAULT_STT_SAMPLE_RATE,
 	outputSampleRate: DEFAULT_TTS_SAMPLE_RATE
 };
@@ -293,7 +387,6 @@ const DEFAULT_S2S_CONFIG = {
 //#region host/s2s.ts
 const uint8ToBase64 = (bytes) => Buffer.from(bytes).toString("base64");
 const base64ToUint8 = (base64) => new Uint8Array(Buffer.from(base64, "base64"));
-const WS_OPEN = 1;
 const defaultCreateS2sWebSocket = (url, opts) => new WsWebSocket(url, { headers: opts.headers });
 const S2sMessageSchema = z.discriminatedUnion("type", [
 	z.object({
@@ -303,10 +396,6 @@ const S2sMessageSchema = z.discriminatedUnion("type", [
 	z.object({ type: z.literal("session.updated") }).passthrough(),
 	z.object({ type: z.literal("input.speech.started") }),
 	z.object({ type: z.literal("input.speech.stopped") }),
-	z.object({
-		type: z.literal("transcript.user.delta"),
-		text: z.string()
-	}),
 	z.object({
 		type: z.literal("transcript.user"),
 		item_id: z.string(),
@@ -316,10 +405,6 @@ const S2sMessageSchema = z.discriminatedUnion("type", [
 		type: z.literal("reply.started"),
 		reply_id: z.string()
 	}),
-	z.object({
-		type: z.literal("transcript.agent.delta"),
-		delta: z.string()
-	}).passthrough(),
 	z.object({
 		type: z.literal("transcript.agent"),
 		text: z.string(),
@@ -327,8 +412,6 @@ const S2sMessageSchema = z.discriminatedUnion("type", [
 		item_id: z.string().optional().default(""),
 		interrupted: z.boolean().optional().default(false)
 	}),
-	z.object({ type: z.literal("reply.content_part.started") }).passthrough(),
-	z.object({ type: z.literal("reply.content_part.done") }).passthrough(),
 	z.object({
 		type: z.literal("tool.call"),
 		call_id: z.string(),
@@ -358,66 +441,48 @@ function dispatchS2sMessage(emitter, msg) {
 		case "session.ready":
 			emitter.emit("ready", { sessionId: msg.session_id });
 			break;
-		case "session.updated":
-			emitter.emit("sessionUpdated", msg);
-			break;
+		case "session.updated": break;
 		case "input.speech.started":
-			emitter.emit("speechStarted");
+			emitter.emit("event", { type: "speech_started" });
 			break;
 		case "input.speech.stopped":
-			emitter.emit("speechStopped");
-			break;
-		case "transcript.user.delta":
-			emitter.emit("userTranscriptDelta", { text: msg.text });
+			emitter.emit("event", { type: "speech_stopped" });
 			break;
 		case "transcript.user":
-			emitter.emit("userTranscript", {
-				itemId: msg.item_id,
+			emitter.emit("event", {
+				type: "user_transcript",
 				text: msg.text
 			});
 			break;
 		case "reply.started":
 			emitter.emit("replyStarted", { replyId: msg.reply_id });
 			break;
-		case "transcript.agent.delta":
-			emitter.emit("agentTranscriptDelta", { text: msg.delta });
-			break;
 		case "transcript.agent":
-			emitter.emit("agentTranscript", {
+			emitter.emit("event", {
+				type: "agent_transcript",
 				text: msg.text,
-				replyId: msg.reply_id,
-				itemId: msg.item_id,
-				interrupted: msg.interrupted
+				_interrupted: msg.interrupted
 			});
 			break;
 		case "tool.call":
-			emitter.emit("toolCall", {
-				callId: msg.call_id,
-				name: msg.name,
+			emitter.emit("event", {
+				type: "tool_call",
+				toolCallId: msg.call_id,
+				toolName: msg.name,
 				args: msg.args
 			});
 			break;
 		case "reply.done":
-			emitter.emit("replyDone", msg.status ? { status: msg.status } : {});
+			if (msg.status === "interrupted") emitter.emit("event", { type: "cancelled" });
+			else emitter.emit("event", { type: "reply_done" });
 			break;
 		case "session.error":
-			if (msg.code === "session_not_found" || msg.code === "session_forbidden") emitter.emit("sessionExpired", {
-				code: msg.code,
-				message: msg.message
-			});
-			else emitter.emit("error", {
-				code: msg.code,
-				message: msg.message
-			});
+			if (msg.code === "session_not_found" || msg.code === "session_forbidden") emitter.emit("sessionExpired");
+			else emitter.emit("error", new Error(msg.message));
 			break;
 		case "error":
-			emitter.emit("error", {
-				code: "connection",
-				message: msg.message
-			});
+			emitter.emit("error", new Error(msg.message));
 			break;
-		case "reply.content_part.started":
-		case "reply.content_part.done": break;
 		default: break;
 	}
 }
@@ -429,18 +494,19 @@ function connectS2s(opts) {
 		const emitter = createNanoEvents();
 		let opened = false;
 		function send(msg) {
-			if (ws.readyState !== WS_OPEN) {
+			if (ws.readyState !== 1) {
 				log.debug("S2S send dropped: socket not open", { type: msg.type });
 				return;
 			}
 			const json = JSON.stringify(msg);
-			if (msg.type !== "input.audio") log.info(`S2S >> ${msg.type}`, msg.type === "session.update" ? { payload: json } : void 0);
+			if (msg.type !== "input.audio") if (msg.type === "session.update") log.info(`S2S >> ${msg.type}`, { payload: json });
+			else log.info(`S2S >> ${msg.type}`);
 			ws.send(json);
 		}
 		const handle = {
 			on: emitter.on.bind(emitter),
 			sendAudio(audio) {
-				if (ws.readyState !== WS_OPEN) {
+				if (ws.readyState !== 1) {
 					log.debug("S2S sendAudio dropped: socket not open");
 					return;
 				}
@@ -501,7 +567,7 @@ function connectS2s(opts) {
 		}
 		function logIncoming(obj) {
 			if (obj.type === "reply.audio" || obj.type === "input.audio") return;
-			log.info(`S2S << ${obj.type}`, obj.type === "transcript.agent.delta" ? { delta: obj.delta } : void 0);
+			log.info(`S2S << ${obj.type}`);
 		}
 		function handleS2sMessage(ev) {
 			const raw = tryParseJson(ev.data);
@@ -522,32 +588,29 @@ function connectS2s(opts) {
 		}
 		ws.addEventListener("message", handleS2sMessage);
 		ws.addEventListener("close", (ev) => {
+			const code = ev.code ?? 0;
+			const reason = ev.reason ?? "";
 			log.info("S2S WebSocket closed", {
-				code: ev.code ?? 0,
-				reason: ev.reason ?? ""
+				code,
+				reason
 			});
-			if (!opened) reject(/* @__PURE__ */ new Error(`WebSocket closed before open (code: ${ev.code ?? 0})`));
-			emitter.emit("close");
+			if (!opened) reject(/* @__PURE__ */ new Error(`WebSocket closed before open (code: ${code})`));
+			emitter.emit("close", code, reason);
 		});
 		ws.addEventListener("error", (ev) => {
 			const message = typeof ev.message === "string" ? ev.message : "WebSocket error";
 			const errObj = new Error(message);
 			log.error("S2S WebSocket error", { error: errObj.message });
 			if (!opened) reject(errObj);
-			else emitter.emit("error", {
-				code: "ws_error",
-				message: errObj.message
-			});
+			else emitter.emit("error", errObj);
 		});
 	});
 }
 //#endregion
-//#region host/session.ts
+//#region host/session-ctx.ts
 function buildCtx(opts) {
-	const { id, agentConfig, hooks, log } = opts;
+	const { agentConfig, log } = opts;
 	const maxHistory = opts.maxHistory ?? 200;
-	/** Track in-flight hook promises so they can be awaited during shutdown. */
-	const pendingHooks = /* @__PURE__ */ new Set();
 	const ctx = {
 		...opts,
 		s2s: null,
@@ -559,12 +622,9 @@ function buildCtx(opts) {
 		turnPromise: null,
 		conversationMessages: [],
 		maxHistory,
-		resolveTurnConfig() {
-			return callResolveTurnConfig(hooks, id, HOOK_TIMEOUT_MS);
-		},
-		consumeToolCallStep(turnConfig, _name, replyId) {
+		consumeToolCallStep(_name, replyId) {
 			if (replyId === null || replyId !== ctx.reply.currentReplyId) return toolError("Reply was interrupted. Discarding stale tool call.");
-			const maxSteps = turnConfig?.maxSteps ?? agentConfig.maxSteps;
+			const maxSteps = agentConfig.maxSteps;
 			ctx.reply.toolCallCount++;
 			if (maxSteps !== void 0 && ctx.reply.toolCallCount > maxSteps) {
 				log.info("maxSteps exceeded, refusing tool call", {
@@ -575,32 +635,9 @@ function buildCtx(opts) {
 			}
 			return null;
 		},
-		fireHook(name, ...args) {
-			if (!hooks) return;
-			const notifyOnError = (err) => {
-				log.warn(`${name} hook failed`, { err: errorMessage(err) });
-				if (name !== "error") {
-					const ep = hooks.callHook("error", id, { message: errorMessage(err) });
-					if (ep && typeof ep.catch === "function") ep.catch((e) => {
-						log.warn("error hook failed", { err: errorMessage(e) });
-					});
-				}
-			};
-			try {
-				const result = hooks.callHook(name, ...args);
-				if (result == null) return;
-				const p = result.catch(notifyOnError).finally(() => pendingHooks.delete(p));
-				pendingHooks.add(p);
-			} catch (err) {
-				notifyOnError(err);
-			}
-		},
-		async drainHooks() {
-			if (pendingHooks.size > 0) await Promise.all([...pendingHooks]);
-		},
 		pushMessages(...msgs) {
 			ctx.conversationMessages.push(...msgs);
-			if (maxHistory > 0 && ctx.conversationMessages.length > maxHistory) ctx.conversationMessages = ctx.conversationMessages.slice(-maxHistory);
+			if (maxHistory > 0 && ctx.conversationMessages.length > maxHistory) ctx.conversationMessages.splice(0, ctx.conversationMessages.length - maxHistory);
 		},
 		beginReply(replyId) {
 			ctx.reply = {
@@ -623,8 +660,15 @@ function buildCtx(opts) {
 	};
 	return ctx;
 }
+//#endregion
+//#region host/session.ts
 /** @internal Not part of the public API. Exposed for testing only. */
 const _internals = { connectS2s };
+/**
+* Create an idle timer that closes the S2S connection after inactivity.
+* Convention: `timeoutMs <= 0` disables the timer entirely (returns a no-op).
+* This allows agents to opt out of idle timeout via `idleTimeoutMs: 0` in their config.
+*/
 function createIdleTimer(opts) {
 	if (opts.timeoutMs <= 0) return {
 		reset() {},
@@ -671,25 +715,11 @@ function finishToolCall(ctx, callId, result, replyId) {
 		if (ctx.maxHistory > 0 && ctx.reply.pendingTools.length > ctx.maxHistory) ctx.reply.pendingTools.shift();
 	}
 }
-async function handleToolCall(ctx, detail) {
-	const { callId, name, args: parsedArgs } = detail;
+async function handleToolCall(ctx, event) {
+	const { toolCallId: callId, toolName: name, args: parsedArgs } = event;
 	const replyId = ctx.reply.currentReplyId;
-	ctx.client.event({
-		type: "tool_call_start",
-		toolCallId: callId,
-		toolName: name,
-		args: parsedArgs
-	});
-	let turnConfig;
-	try {
-		turnConfig = await ctx.resolveTurnConfig();
-	} catch (err) {
-		const msg = `resolveTurnConfig hook error: ${errorMessage(err)}`;
-		ctx.log.error(msg);
-		finishToolCall(ctx, callId, toolError(msg), replyId);
-		return;
-	}
-	const refused = ctx.consumeToolCallStep(turnConfig, name, replyId);
+	ctx.client.event(event);
+	const refused = ctx.consumeToolCallStep(name, replyId);
 	if (refused !== null) {
 		finishToolCall(ctx, callId, refused, replyId);
 		return;
@@ -721,23 +751,17 @@ async function handleToolCall(ctx, detail) {
 function handleUserTranscript(ctx, text) {
 	ctx.log.info("S2S user transcript", { text });
 	ctx.client.event({
-		type: "transcript",
-		text,
-		isFinal: true
-	});
-	ctx.client.event({
-		type: "turn",
+		type: "user_transcript",
 		text
 	});
 	ctx.pushMessages({
 		role: "user",
 		content: text
 	});
-	ctx.fireHook("turn", ctx.id, text, HOOK_TIMEOUT_MS);
 }
 function handleAgentTranscript(ctx, text, interrupted) {
 	ctx.client.event({
-		type: "chat",
+		type: "agent_transcript",
 		text
 	});
 	if (!interrupted) ctx.pushMessages({
@@ -745,13 +769,12 @@ function handleAgentTranscript(ctx, text, interrupted) {
 		content: text
 	});
 }
-function handleReplyDone(ctx, status) {
-	if (status === "interrupted") {
-		ctx.log.info("S2S reply interrupted (barge-in)");
-		ctx.cancelReply();
-		ctx.client.event({ type: "cancelled" });
-		return;
-	}
+function handleReplyCancelled(ctx) {
+	ctx.log.info("S2S reply interrupted (barge-in)");
+	ctx.cancelReply();
+	ctx.client.event({ type: "cancelled" });
+}
+function handleReplyDone(ctx) {
 	const doneReplyId = ctx.reply.currentReplyId;
 	const sendPending = () => {
 		if (ctx.reply.currentReplyId !== doneReplyId) {
@@ -768,7 +791,7 @@ function handleReplyDone(ctx, status) {
 				agent: ctx.agent
 			});
 			ctx.client.playAudioDone();
-			ctx.client.event({ type: "tts_done" });
+			ctx.client.event({ type: "reply_done" });
 		}
 	};
 	if (ctx.turnPromise !== null) ctx.turnPromise.then(sendPending);
@@ -776,54 +799,58 @@ function handleReplyDone(ctx, status) {
 }
 function setupListeners(ctx, handle) {
 	handle.on("ready", ({ sessionId }) => ctx.log.info("S2S session ready", { sessionId }));
+	handle.on("replyStarted", ({ replyId }) => {
+		ctx.beginReply(replyId);
+	});
 	handle.on("sessionExpired", () => {
 		ctx.log.info("S2S session expired");
 		handle.close();
 	});
-	handle.on("speechStarted", () => ctx.client.event({ type: "speech_started" }));
-	handle.on("speechStopped", () => ctx.client.event({ type: "speech_stopped" }));
-	handle.on("userTranscriptDelta", ({ text }) => ctx.client.event({
-		type: "transcript",
-		text,
-		isFinal: false
-	}));
-	handle.on("userTranscript", ({ text }) => handleUserTranscript(ctx, text));
-	handle.on("replyStarted", ({ replyId }) => {
-		ctx.beginReply(replyId);
-	});
 	handle.on("audio", ({ audio }) => ctx.client.playAudioChunk(audio));
-	handle.on("agentTranscriptDelta", ({ text }) => ctx.client.event({
-		type: "chat_delta",
-		text
-	}));
-	handle.on("agentTranscript", ({ text, interrupted }) => handleAgentTranscript(ctx, text, interrupted));
-	handle.on("toolCall", (detail) => {
-		const p = handleToolCall(ctx, detail).catch((err) => {
-			ctx.log.error("Tool call handler failed", { err: errorMessage(err) });
-		});
-		ctx.chainTurn(p);
-	});
-	handle.on("replyDone", ({ status }) => handleReplyDone(ctx, status));
-	handle.on("error", ({ code, message }) => {
-		ctx.log.error("S2S error", {
-			code,
-			message
-		});
+	handle.on("error", (err) => {
+		ctx.log.error("S2S error", { message: err.message });
 		ctx.client.event({
 			type: "error",
 			code: "internal",
-			message
+			message: err.message
 		});
 		handle.close();
 	});
-	handle.on("close", () => {
-		ctx.log.info("S2S closed");
+	handle.on("close", (code, reason) => {
+		ctx.log.info("S2S closed", {
+			code,
+			reason
+		});
 		ctx.s2s = null;
 		ctx.cancelReply();
 	});
+	handle.on("event", (event) => {
+		switch (event.type) {
+			case "user_transcript":
+				handleUserTranscript(ctx, event.text);
+				break;
+			case "agent_transcript":
+				handleAgentTranscript(ctx, event.text, event._interrupted ?? false);
+				break;
+			case "tool_call": {
+				const p = handleToolCall(ctx, event).catch((err) => {
+					ctx.log.error("Tool call handler failed", { err: errorMessage(err) });
+				});
+				ctx.chainTurn(p);
+				break;
+			}
+			case "reply_done":
+				handleReplyDone(ctx);
+				break;
+			case "cancelled":
+				handleReplyCancelled(ctx);
+				break;
+			default: ctx.client.event(event);
+		}
+	});
 }
 function createS2sSession(opts) {
-	const { id, agent, client, toolSchemas, apiKey, s2sConfig, executeTool, createWebSocket = defaultCreateS2sWebSocket, hooks, logger: log = consoleLogger } = opts;
+	const { id, agent, client, toolSchemas, apiKey, s2sConfig, executeTool, createWebSocket = defaultCreateS2sWebSocket, logger: log = consoleLogger } = opts;
 	const agentConfig = opts.skipGreeting ? {
 		...opts.agentConfig,
 		greeting: ""
@@ -846,7 +873,6 @@ function createS2sSession(opts) {
 		client,
 		agentConfig,
 		executeTool,
-		hooks,
 		log,
 		maxHistory: opts.maxHistory
 	});
@@ -893,7 +919,6 @@ function createS2sSession(opts) {
 	}
 	return {
 		async start() {
-			ctx.fireHook("connect", id, HOOK_TIMEOUT_MS);
 			await connectAndSetup();
 		},
 		async stop() {
@@ -901,10 +926,7 @@ function createS2sSession(opts) {
 			sessionAbort.abort();
 			idle.clear();
 			if (ctx.turnPromise !== null) await ctx.turnPromise;
-			await ctx.drainHooks();
 			ctx.s2s?.close();
-			ctx.fireHook("disconnect", id, HOOK_TIMEOUT_MS);
-			await ctx.drainHooks();
 		},
 		onAudio(data) {
 			idle.reset();
@@ -936,33 +958,50 @@ function createS2sSession(opts) {
 	};
 }
 //#endregion
-//#region isolate/_kv-utils.ts
-/** Internal KV helpers shared by kv.ts and unstorage-kv.ts. */
-/** Sort entries by key and apply reverse/limit options. Mutates the array. */
-function sortAndPaginate(entries, options) {
-	entries.sort((a, b) => a.key.localeCompare(b.key));
-	if (options?.reverse) entries.reverse();
-	if (options?.limit && options.limit > 0) entries.length = Math.min(entries.length, options.limit);
-	return entries;
+//#region host/tool-executor.ts
+/**
+* Tool execution — validates arguments and invokes tool handlers.
+*
+* {@link executeToolCall} is the single entry point used by both the
+* direct (self-hosted) runtime and the platform sandbox sidecar.
+*/
+const yieldTick = () => new Promise((r) => setTimeout(r, 0));
+function buildToolContext(opts) {
+	const { env, state, kv, messages, sessionId } = opts;
+	return {
+		env,
+		state: state ?? {},
+		get kv() {
+			if (!kv) throw new Error("KV not available");
+			return kv;
+		},
+		messages: messages ?? [],
+		sessionId: sessionId ?? ""
+	};
 }
-/** Simple glob matcher — supports `*` as a wildcard for any characters. */
-function matchGlob(key, pattern) {
-	if (pattern.length > 1024) throw new Error(`Glob pattern exceeds maximum length of ${MAX_GLOB_PATTERN_LENGTH}`);
-	const parts = pattern.split("*");
-	if (parts.length === 1) return key === pattern;
-	const first = parts[0];
-	if (!key.startsWith(first)) return false;
-	const last = parts.at(-1);
-	if (key.length < first.length + last.length) return false;
-	if (!key.endsWith(last)) return false;
-	let pos = first.length;
-	const end = key.length - last.length;
-	for (const part of parts.slice(1, -1)) {
-		const idx = key.indexOf(part, pos);
-		if (idx === -1 || idx > end) return false;
-		pos = idx + part.length;
+async function executeToolCall(name, args, options) {
+	const { tool } = options;
+	const parsed = (tool.parameters ?? EMPTY_PARAMS).safeParse(args);
+	if (!parsed.success) return toolError(`Invalid arguments for tool "${name}": ${(parsed.error?.issues ?? []).map((i) => `${i.path.map(String).join(".")}: ${i.message}`).join(", ")}`);
+	try {
+		const ctx = buildToolContext(options);
+		await yieldTick();
+		const result = await pTimeout(Promise.resolve(tool.execute(parsed.data, ctx)), {
+			milliseconds: TOOL_EXECUTION_TIMEOUT_MS,
+			message: `Tool "${name}" timed out after ${TOOL_EXECUTION_TIMEOUT_MS}ms`
+		});
+		await yieldTick();
+		if (result == null) return "null";
+		return typeof result === "string" ? result : JSON.stringify(result);
+	} catch (err) {
+		const log = options.logger;
+		if (log) log.warn("Tool execution failed", {
+			tool: name,
+			error: errorDetail(err)
+		});
+		else console.warn(`[tool-executor] Tool execution failed: ${name}`, err);
+		return toolError(errorMessage(err));
 	}
-	return pos <= end;
 }
 //#endregion
 //#region host/unstorage-kv.ts
@@ -1003,23 +1042,6 @@ function createUnstorageKv(options) {
 			const keyArray = Array.isArray(keys) ? keys : [keys];
 			await Promise.all(keyArray.map((k) => store.removeItem(k)));
 		},
-		async list(listPrefix, listOptions) {
-			const allKeys = await store.getKeys(listPrefix);
-			const entries = [];
-			for (const key of allKeys) {
-				const value = await store.getItem(key);
-				if (value != null) entries.push({
-					key,
-					value
-				});
-			}
-			return sortAndPaginate(entries, listOptions);
-		},
-		async keys(pattern) {
-			const allKeys = await store.getKeys();
-			if (!pattern) return allKeys.sort((a, b) => a.localeCompare(b));
-			return allKeys.filter((key) => matchGlob(key, pattern)).sort((a, b) => a.localeCompare(b));
-		},
 		close() {
 			store.dispose();
 		}
@@ -1086,12 +1108,12 @@ function handleTextMessage(data, session, log, ctx, sid) {
 		});
 		return;
 	}
-	const parsed = ClientMessageSchema.safeParse(json);
-	if (!parsed.success) {
-		log.warn("Invalid client message", {
+	const parsed = lenientParse(ClientMessageSchema, json);
+	if (!parsed.ok) {
+		if (parsed.malformed) log.warn("Invalid client message", {
 			...ctx,
 			sid,
-			error: parsed.error.message
+			error: parsed.error
 		});
 		return;
 	}
@@ -1183,7 +1205,7 @@ function wireSessionSocket(ws, opts) {
 	ws.addEventListener("message", (event) => {
 		if (!session) return;
 		if (!sessionReady) {
-			messageBuffer?.push(event);
+			if (messageBuffer && messageBuffer.length < 100) messageBuffer.push(event);
 			return;
 		}
 		const { data } = event;
@@ -1203,6 +1225,7 @@ function wireSessionSocket(ws, opts) {
 			});
 		}).finally(() => {
 			sessions.delete(sessionId);
+			opts.onSessionEnd?.(sessionId);
 		});
 		opts.onClose?.();
 	});
@@ -1216,7 +1239,7 @@ function wireSessionSocket(ws, opts) {
 	});
 }
 //#endregion
-//#region host/direct-executor.ts
+//#region host/runtime.ts
 /**
 * Agent runtime — the execution engine for voice agents.
 *
@@ -1224,45 +1247,6 @@ function wireSessionSocket(ws, opts) {
 * self-hosted servers and the platform sandbox. It wires up tool execution,
 * lifecycle hooks, and session management.
 */
-const yieldTick = () => new Promise((r) => setTimeout(r, 0));
-function buildToolContext(opts) {
-	const { env, state, kv, messages, fetch: fetchFn, sessionId } = opts;
-	return {
-		env: { ...env },
-		state: state ?? {},
-		get kv() {
-			if (!kv) throw new Error("KV not available");
-			return kv;
-		},
-		messages: messages ?? [],
-		fetch: fetchFn ?? globalThis.fetch,
-		sessionId: sessionId ?? ""
-	};
-}
-async function executeToolCall(name, args, options) {
-	const { tool } = options;
-	const parsed = (tool.parameters ?? EMPTY_PARAMS).safeParse(args);
-	if (!parsed.success) return toolError(`Invalid arguments for tool "${name}": ${(parsed.error?.issues ?? []).map((i) => `${i.path.map(String).join(".")}: ${i.message}`).join(", ")}`);
-	try {
-		const ctx = buildToolContext(options);
-		await yieldTick();
-		const result = await pTimeout(Promise.resolve(tool.execute(parsed.data, ctx)), {
-			milliseconds: TOOL_EXECUTION_TIMEOUT_MS,
-			message: `Tool "${name}" timed out after ${TOOL_EXECUTION_TIMEOUT_MS}ms`
-		});
-		await yieldTick();
-		if (result == null) return "null";
-		return typeof result === "string" ? result : JSON.stringify(result);
-	} catch (err) {
-		const log = options.logger;
-		if (log) log.warn("Tool execution failed", {
-			tool: name,
-			error: errorDetail(err)
-		});
-		else console.warn(`[tool-executor] Tool execution failed: ${name}`, err);
-		return toolError(errorMessage(err));
-	}
-}
 /** Create an in-memory KV store (default for self-hosted). */
 function createLocalKv() {
 	return createUnstorageKv({ storage: createStorage() });
@@ -1285,40 +1269,43 @@ function createRuntime(opts) {
 	const sessions = /* @__PURE__ */ new Map();
 	const readyConfig = buildReadyConfig(s2sConfig);
 	let executeTool;
-	let hooks;
 	let toolSchemas;
 	let toolGuidance = [];
-	if (opts.executeTool && opts.hooks && opts.toolSchemas) {
-		executeTool = opts.executeTool;
-		hooks = opts.hooks;
+	const builtinFetchOpt = opts.fetch ? { fetch: opts.fetch } : void 0;
+	if (opts.executeTool && opts.toolSchemas) {
+		const builtinDefs = opts.builtinDefs ?? resolveAllBuiltins(agent.builtinTools ?? [], builtinFetchOpt).defs;
+		const rpcExecuteTool = opts.executeTool;
+		const frozenEnv = Object.freeze({ ...env });
+		executeTool = async (name, args, sessionId, messages) => {
+			if (builtinDefs[name]) {
+				const tool = builtinDefs[name];
+				return executeToolCall(name, args, {
+					tool,
+					env: frozenEnv,
+					sessionId: sessionId ?? "",
+					kv,
+					messages,
+					logger
+				});
+			}
+			return rpcExecuteTool(name, args, sessionId, messages);
+		};
 		toolSchemas = opts.toolSchemas;
 		toolGuidance = opts.toolGuidance ?? [];
 	} else {
+		const builtins = resolveAllBuiltins(agent.builtinTools ?? [], builtinFetchOpt);
 		const allTools = {
-			...getBuiltinToolDefs(agent.builtinTools ?? []),
+			...builtins.defs,
 			...agent.tools
 		};
-		const customSchemas = agentToolsToSchemas(agent.tools ?? {});
-		const builtinSchemas = getBuiltinToolSchemas(agent.builtinTools ?? []);
-		toolSchemas = [...customSchemas, ...builtinSchemas];
-		toolGuidance = getBuiltinToolGuidance(agent.builtinTools ?? []);
+		toolSchemas = [...agentToolsToSchemas(agent.tools ?? {}), ...builtins.schemas];
+		toolGuidance = builtins.guidance;
 		const stateMap = /* @__PURE__ */ new Map();
 		const getState = (sid) => {
 			if (!stateMap.has(sid) && agent.state) stateMap.set(sid, agent.state());
 			return stateMap.get(sid) ?? {};
 		};
 		const frozenEnv = Object.freeze({ ...env });
-		function makeHookContext(sessionId) {
-			return {
-				env: frozenEnv,
-				state: getState(sessionId),
-				sessionId,
-				get kv() {
-					return kv;
-				},
-				fetch: globalThis.fetch
-			};
-		}
 		executeTool = async (name, args, sessionId, messages) => {
 			const tool = allTools[name];
 			if (!tool) return toolError(`Unknown tool: ${name}`);
@@ -1329,17 +1316,9 @@ function createRuntime(opts) {
 				sessionId: sessionId ?? "",
 				kv,
 				messages,
-				logger,
-				fetch: globalThis.fetch
+				logger
 			});
 		};
-		hooks = createAgentHooks({
-			agent,
-			makeCtx: makeHookContext
-		});
-		hooks.hook("disconnect", async (sessionId) => {
-			stateMap.delete(sessionId);
-		});
 	}
 	function createSession(sessionOpts) {
 		const apiKey = env.ASSEMBLYAI_API_KEY ?? "";
@@ -1354,7 +1333,6 @@ function createRuntime(opts) {
 			s2sConfig,
 			executeTool,
 			...createWebSocket ? { createWebSocket } : {},
-			hooks,
 			skipGreeting: sessionOpts.skipGreeting ?? false,
 			logger,
 			...sessionOpts.resumeFrom ? { resumeFrom: sessionOpts.resumeFrom } : {}
@@ -1376,32 +1354,23 @@ function createRuntime(opts) {
 			...startOpts?.logContext ? { logContext: startOpts.logContext } : {},
 			...startOpts?.onOpen ? { onOpen: startOpts.onOpen } : {},
 			...startOpts?.onClose ? { onClose: startOpts.onClose } : {},
+			...startOpts?.onSessionEnd ? { onSessionEnd: startOpts.onSessionEnd } : {},
 			...sessionStartTimeoutMs !== void 0 ? { sessionStartTimeoutMs } : {},
 			...resumeFrom ? { resumeFrom } : {}
 		});
 	}
 	async function shutdown() {
 		if (sessions.size === 0) return;
-		let timer;
-		const timeout = new Promise((resolve) => {
-			timer = setTimeout(resolve, shutdownTimeoutMs, "timeout");
-		});
-		const graceful = Promise.allSettled([...sessions.values()].map((s) => s.stop())).then((results) => {
-			for (const r of results) if (r.status === "rejected") logger.warn(`Session stop failed during shutdown: ${r.reason}`);
-			return "done";
-		});
-		let outcome;
 		try {
-			outcome = await Promise.race([graceful, timeout]);
-		} finally {
-			if (timer) clearTimeout(timer);
+			const results = await pTimeout(Promise.allSettled([...sessions.values()].map((s) => s.stop())), { milliseconds: shutdownTimeoutMs });
+			for (const r of results) if (r.status === "rejected") logger.warn(`Session stop failed during shutdown: ${r.reason}`);
+		} catch {
+			logger.warn(`Shutdown timeout (${shutdownTimeoutMs}ms) exceeded — force-closing ${sessions.size} remaining session(s)`);
 		}
-		if (outcome === "timeout") logger.warn(`Shutdown timeout (${shutdownTimeoutMs}ms) exceeded — force-closing ${sessions.size} remaining session(s)`);
 		sessions.clear();
 	}
 	return {
 		executeTool,
-		hooks,
 		toolSchemas,
 		createSession,
 		startSession,
@@ -1410,4 +1379,140 @@ function createRuntime(opts) {
 	};
 }
 //#endregion
-export { _internals as a, connectS2s as c, consoleLogger as d, jsonLogger as f, executeInIsolate as g, getBuiltinToolSchemas as h, createUnstorageKv as i, defaultCreateS2sWebSocket as l, getBuiltinToolGuidance as m, executeToolCall as n, buildCtx as o, getBuiltinToolDefs as p, wireSessionSocket as r, createS2sSession as s, createRuntime as t, DEFAULT_S2S_CONFIG as u };
+//#region host/server.ts
+/**
+* Agent HTTP+WebSocket server.
+*
+* {@link createServer} wraps a {@link Runtime} with an HTTP + WebSocket
+* server using only `node:http` and `ws` (no framework dependencies).
+*
+* **Internal module** — used by `aai-cli` dev server. Not a public API.
+* Import via `aai/host`.
+*/
+async function serveStatic(dir, req, res) {
+	const url = req.url?.split("?")[0] ?? "/";
+	const filePath = path.join(dir, url === "/" ? "index.html" : url);
+	const resolved = path.resolve(dir);
+	if (!filePath.startsWith(resolved + path.sep) && filePath !== resolved) return false;
+	try {
+		const stat = await fs.promises.stat(filePath);
+		if (!stat.isFile()) return false;
+		const mime = lookup(path.extname(filePath).toLowerCase()) || "application/octet-stream";
+		res.writeHead(200, {
+			"Content-Type": mime,
+			"Content-Length": stat.size
+		});
+		fs.createReadStream(filePath).pipe(res);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function handleKvGet(kv, req, res) {
+	const key = new URL(req.url ?? "/", "http://localhost").searchParams.get("key");
+	if (!key) {
+		res.writeHead(400, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Missing key query parameter" }));
+		return;
+	}
+	kv.get(key).then((value) => {
+		if (value === null) {
+			res.writeHead(404, { "Content-Type": "application/json" });
+			res.end("null");
+		} else {
+			res.writeHead(200, { "Content-Type": "application/json" });
+			res.end(JSON.stringify(value));
+		}
+	}).catch(() => {
+		res.writeHead(500, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "KV error" }));
+	});
+}
+/**
+* Create an HTTP + WebSocket server for an agent.
+*
+* @internal Used by aai-cli dev server.
+*/
+function createServer(options) {
+	const { runtime, clientHtml, clientDir, logger = consoleLogger, kv } = options;
+	const name = options.name ?? "agent";
+	if (clientHtml && clientDir) throw new Error("clientHtml and clientDir are mutually exclusive");
+	const escapedName = escapeHtml(name);
+	const defaultHtml = clientHtml ?? `<!DOCTYPE html><html><body><h1>${escapedName}</h1><p>Agent server running.</p></body></html>`;
+	const httpServer = http.createServer((req, res) => {
+		const url = req.url?.split("?")[0] ?? "/";
+		const method = req.method ?? "GET";
+		res.setHeader("Content-Security-Policy", AGENT_CSP);
+		res.setHeader("X-Content-Type-Options", "nosniff");
+		res.setHeader("X-Frame-Options", "SAMEORIGIN");
+		if (method === "GET" && url === "/health") {
+			res.writeHead(200, { "Content-Type": "application/json" });
+			res.end(JSON.stringify({
+				status: "ok",
+				name
+			}));
+			return;
+		}
+		if (kv && method === "GET" && url === "/kv") {
+			handleKvGet(kv, req, res);
+			return;
+		}
+		handleRequest(req, res, url, method);
+	});
+	async function handleRequest(req, res, url, method) {
+		if (clientDir && await serveStatic(clientDir, req, res)) return;
+		if (method === "GET" && url === "/") {
+			res.writeHead(200, { "Content-Type": "text/html" });
+			res.end(defaultHtml);
+			return;
+		}
+		logger.error(`${method} ${url} 404`);
+		res.writeHead(404, { "Content-Type": "application/json" });
+		res.end(JSON.stringify({ error: "Not found" }));
+	}
+	const wss = new WebSocketServer({
+		noServer: true,
+		maxPayload: MAX_WS_PAYLOAD_BYTES
+	});
+	httpServer.on("upgrade", (req, socket, head) => {
+		const url = req.url?.split("?")[0] ?? "";
+		if (!url.startsWith("/websocket")) return;
+		wss.handleUpgrade(req, socket, head, (ws) => {
+			const startOpts = parseWsUpgradeParams(req.url ?? "");
+			logger.info(`WS upgrade ${url}${startOpts.skipGreeting ? " (resume)" : ""}`);
+			runtime.startSession(ws, startOpts);
+		});
+	});
+	let listenPort;
+	return {
+		get port() {
+			return listenPort;
+		},
+		async listen(port = 3e3) {
+			await new Promise((resolve, reject) => {
+				httpServer.on("error", reject);
+				httpServer.listen(port, () => {
+					const addr = httpServer.address();
+					listenPort = typeof addr === "object" && addr ? addr.port : port;
+					resolve();
+				});
+			});
+		},
+		async close() {
+			try {
+				await runtime.shutdown();
+			} finally {
+				try {
+					wss.close();
+				} finally {
+					if (listenPort !== void 0) await new Promise((resolve, reject) => {
+						httpServer.close((err) => err ? reject(err) : resolve());
+					});
+					listenPort = void 0;
+				}
+			}
+		}
+	};
+}
+//#endregion
+export { DEFAULT_S2S_CONFIG, _internals, buildCtx, connectS2s, consoleLogger, createRuntime, createS2sSession, createServer, createUnstorageKv, defaultCreateS2sWebSocket, executeInIsolate, executeToolCall, jsonLogger, resolveAllBuiltins, wireSessionSocket };