@alisio/core 0.1.0-alpha.21 → 0.1.0-alpha.22

package/dist/core/runner.js

@@ -17,7 +17,19 @@ const MAX_INJECT_CHARS = 24_000;
  * fails with an actionable error instead of silently losing the whole history.
  */
 const MIN_MESSAGE_BUDGET_FLOOR = 4_000;
-const allowed = (policy, effect) => effect === "read" || effect === "internal" || !!policy[effect];
+const allowed = (policy, effect) => effect === "read" ||
+    effect === "internal" ||
+    ((effect === "write" || effect === "process" || effect === "external") && !!policy[effect]);
+/** A tool's capability is pre-allowed by the policy alone (`--allow-analysis`). */
+const capabilityAllowed = (policy, tool) => tool.capability === "analysis.run" && !!policy.analysis;
+/** First 40 lines of a script input, for capability approvals. */
+const scriptPreview = (input) => typeof input.code === "string" ? input.code.split(/\r?\n/).slice(0, 40).join("\n") : undefined;
+/** A short id for a tool call the user started from a UI (alphanumeric, 9 characters). */
+const uiCallId = () => {
+    const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+    const bytes = crypto.getRandomValues(new Uint8Array(9));
+    return Array.from(bytes, (b) => alphabet[b % alphabet.length]).join("");
+};
 export class AgentRunner {
     options;
     /** Sessions with an active run or compaction (one at a time per session). */
@@ -80,8 +92,11 @@ export class AgentRunner {
             }
         };
     }
-    /** Tools offered to the model under the current policy (and optional run narrowing). */
-    availableTools(run = {}) {
+    /**
+     * Tools offered to the model under the current policy (and optional run narrowing). With a
+     * session, a capability tool is also offered when that session's root holds a persisted grant.
+     */
+    availableTools(run = {}, sessionId) {
         const o = this.options;
         const policy = run.policy ?? o.policy;
         const approvals = !!o.approve && run.approvals !== false;
@@ -91,6 +106,12 @@ export class AgentRunner {
             const effect = t.effect ?? "external";
             if (allowed(policy, effect))
                 return true;
+            if (t.capability) {
+                if (capabilityAllowed(policy, t))
+                    return true;
+                if (sessionId && o.capabilities?.granted(t.capability, sessionId))
+                    return true;
+            }
             return approvals && (effect === "write" || effect === "process" || effect === "external");
         });
     }
@@ -310,6 +331,343 @@ export class AgentRunner {
             throw error;
         }
     }
+    /**
+     * Gates and executes one tool call: external-directory paths, the capability/effect gate with
+     * its approval, the call journal, artifact publishing and the result bound. Shared by model
+     * runs and `runToolCall`, so a call started from a UI passes exactly the same gates.
+     */
+    async executeCall(scope, p) {
+        const o = this.options;
+        const { sessionId, runId, emit, workspace, policy, approvals, options } = scope;
+        const combined = scope.signal;
+        const pathAccess = o.pathAccess;
+        const { call } = p;
+        let result;
+        const started = Date.now();
+        // `effect` rides along so the TUI can group consecutive calls by capability kind
+        // (read batches, write batches, commands…) without a name heuristic. Additive field.
+        emit("tool_started", {
+            name: call.name,
+            id: call.id,
+            arguments: call.arguments,
+            effect: p.tool?.effect ?? "external",
+        });
+        try {
+            combined.throwIfAborted();
+            if (p.error)
+                throw new Error(p.error);
+            if (!p.tool || !p.input)
+                throw new Error("Invalid tool");
+            const effect = p.tool.effect ?? "external";
+            // External-directory prerequisite: declared paths are resolved (and, outside every
+            // allowed root, approved for the containing directory) BEFORE the effect gate, so a
+            // write still needs its own write policy and a read never hard-throws first. The
+            // resolved map keeps "allow once" scoped to this one call, with no shared mutable
+            // state that parallel read batches could race on.
+            const resolved = new Map();
+            if (pathAccess)
+                for (const declared of p.tool.paths?.(p.input) ?? [])
+                    if (!resolved.has(declared)) {
+                        const target = await pathAccess.resolve(declared, {
+                            workspace,
+                            session: sessionId,
+                            ...(options.label ? { label: options.label } : {}),
+                            signal: combined,
+                        });
+                        // Key both the declared input and its resolved form: a write resolves the
+                        // input once, then re-checks the already-absolute path, and neither lookup may
+                        // ask a second time for an "allow once" decision.
+                        resolved.set(declared, target);
+                        resolved.set(target, target);
+                    }
+            scope.guard?.(effect);
+            if (options.toolFilter && !options.toolFilter(p.tool))
+                throw new Error(`Tool ${call.name} is not available in this session`);
+            const capability = p.tool.capability;
+            const gate = o.capabilities;
+            if (capability && (allowed(policy, effect) || capabilityAllowed(policy, p.tool))) {
+                // A broad process grant or --allow-analysis: allowed, audited as a flag decision.
+                gate?.record({
+                    capability,
+                    sessionId,
+                    scope: "once",
+                    decision: "allow",
+                    source: "flag",
+                    callId: call.id,
+                    runId,
+                    ...(options.correlationId !== undefined ? { correlationId: options.correlationId } : {}),
+                });
+            }
+            else if (capability && gate?.granted(capability, sessionId)) {
+                // A persisted "allow for this session" grant of the root session.
+            }
+            else if (!allowed(policy, effect)) {
+                if (!o.approve ||
+                    !approvals ||
+                    (effect !== "write" && effect !== "process" && effect !== "external"))
+                    throw new Error(`Capability denied: ${capability ?? effect}`);
+                const preview = capability
+                    ? (scriptPreview(p.input) ?? (await gate?.preview?.(p.input, sessionId)))
+                    : undefined;
+                emit("approval_requested", {
+                    id: call.id,
+                    name: call.name,
+                    effect,
+                    ...(options.label ? { label: options.label } : {}),
+                    ...(capability ? { capability } : {}),
+                });
+                const decision = await o.approve({
+                    call,
+                    effect,
+                    input: p.input,
+                    signal: combined,
+                    session: sessionId,
+                    ...(options.label ? { label: options.label } : {}),
+                    ...(capability ? { capability } : {}),
+                    ...(preview !== undefined ? { preview } : {}),
+                    ...(capability && gate?.runtime ? { runtime: gate.runtime } : {}),
+                });
+                combined.throwIfAborted();
+                const persisted = !!capability && !!gate && decision === "session";
+                if (capability && gate)
+                    gate.record({
+                        capability,
+                        sessionId,
+                        scope: decision === "session" ? "session" : "once",
+                        decision: decision === "deny" ? "deny" : "allow",
+                        source: gate.source ?? "tui",
+                        callId: call.id,
+                        runId,
+                        ...(options.correlationId !== undefined
+                            ? { correlationId: options.correlationId }
+                            : {}),
+                    });
+                emit("approval_resolved", {
+                    id: call.id,
+                    name: call.name,
+                    effect,
+                    decision,
+                    ...(capability ? { capability } : {}),
+                    ...(persisted ? { persisted: true } : {}),
+                });
+                if (decision === "deny")
+                    throw new Error(`Capability ${capability ?? effect} denied by the user for this call`);
+                // A capability grant never widens the effect: only effect approvals do.
+                if (decision === "session" && !capability)
+                    policy[effect] = true;
+            }
+            o.store.beginCall(sessionId, call, { runId, effect });
+            const publisher = o.artifacts?.({ sessionId, runId, callId: call.id }, (published) => emit("artifact_published", {
+                artifact: published.artifact,
+                path: published.path,
+                callId: call.id,
+                ...(published.executionId ? { executionId: published.executionId } : {}),
+            }));
+            /**
+             * `analysis.install`: always asks, `once` only, and no flag or earlier grant covers it. Where
+             * nobody can be asked (headless, no approval handler) the answer is `deny`.
+             */
+            const approveInstall = async (install) => {
+                if (!o.approve || !approvals)
+                    return "deny";
+                const installCall = { ...call, id: `${call.id}:install` };
+                emit("approval_requested", {
+                    id: installCall.id,
+                    name: call.name,
+                    effect: "process",
+                    ...(options.label ? { label: options.label } : {}),
+                    capability: "analysis.install",
+                    install,
+                });
+                let decision = "deny";
+                try {
+                    decision = await o.approve({
+                        call: installCall,
+                        effect: "process",
+                        input: { extras: install.extras },
+                        signal: combined,
+                        session: sessionId,
+                        ...(options.label ? { label: options.label } : {}),
+                        capability: "analysis.install",
+                        install,
+                    });
+                }
+                finally {
+                    combined.throwIfAborted();
+                }
+                // A `session` answer is treated as `once`: an installation permission is never stored.
+                const allowedNow = decision !== "deny";
+                gate?.record({
+                    capability: "analysis.install",
+                    sessionId,
+                    scope: "once",
+                    decision: allowedNow ? "allow" : "deny",
+                    source: gate.source ?? "tui",
+                    callId: call.id,
+                    runId,
+                    ...(options.correlationId !== undefined ? { correlationId: options.correlationId } : {}),
+                });
+                emit("approval_resolved", {
+                    id: installCall.id,
+                    name: call.name,
+                    effect: "process",
+                    decision: allowedNow ? "once" : "deny",
+                    capability: "analysis.install",
+                });
+                return allowedNow ? "once" : "deny";
+            };
+            result = await p.tool.execute(p.input, {
+                signal: combined,
+                workspace,
+                session: sessionId,
+                runId,
+                callId: call.id,
+                ...(publisher ? { artifacts: publisher } : {}),
+                approveInstall,
+                emit: (data) => emit("tool_progress", { id: call.id, data }),
+                ...(options.label ? { label: options.label } : {}),
+                ...(pathAccess
+                    ? {
+                        resolvePath: (path) => {
+                            const known = resolved.get(path);
+                            return known !== undefined
+                                ? Promise.resolve(known)
+                                : pathAccess.resolve(path, {
+                                    workspace,
+                                    session: sessionId,
+                                    ...(options.label ? { label: options.label } : {}),
+                                    signal: combined,
+                                });
+                        },
+                    }
+                    : {}),
+            });
+            // The bound applies to what the model sees (the text projection): display-only
+            // ui/image parts are bounded by their producers and must not push text over it.
+            const projected = textProjection(result);
+            if (JSON.stringify(projected).length > 48_000)
+                result = textResult(`${JSON.stringify(projected).slice(0, 40_000)}\n[tool output truncated]`, result.isError);
+            result = scope.amend?.(result, effect) ?? result;
+            o.store.endCall(sessionId, call, result);
+        }
+        catch (error) {
+            result = textResult(error instanceof Error ? error.message : String(error), true);
+            // A cancellation after execution may have left effects; journal remains pending.
+            if (!combined.aborted)
+                o.store.endCall(sessionId, call, result);
+        }
+        emit("tool_completed", {
+            id: call.id,
+            name: call.name,
+            isError: result.isError ?? false,
+            durationMs: Date.now() - started,
+            preview: result.content
+                .filter((part) => part.type === "text")
+                .map((c) => c.text)
+                .join("\n")
+                .slice(0, 2_000),
+        });
+        return result;
+    }
+    /**
+     * Runs ONE tool call without a model (spec §20 `runToolCall`): an action the user started from
+     * a UI, such as copying an artifact into the workspace. It is a real run of the session
+     * (`run_started` → `tool_*` → `run_completed`, journaled) and the call passes exactly the gates
+     * of a model call (`write` approval, capabilities, paths). The transcript stays valid for every
+     * provider: a user note (shown as `display`), an assistant message with the call, the tool
+     * result and a short assistant summary.
+     */
+    async runToolCall(sessionId, name, input, options = {}) {
+        const controller = this.claim(sessionId);
+        const runId = options.runId ?? crypto.randomUUID();
+        const o = this.options, emit = this.emitter(sessionId, { runId, correlationId: options.correlationId });
+        const finish = (status, error) => {
+            try {
+                o.store.endRun?.(runId, {
+                    status,
+                    usage: { input: 0, output: 0 },
+                    ...(error ? { error } : {}),
+                });
+            }
+            catch {
+                /* A journal write failure cannot invalidate an executed run. */
+            }
+        };
+        const timeout = AbortSignal.timeout(options.timeoutMs ?? o.timeoutMs ?? 300_000);
+        const combined = AbortSignal.any([
+            controller.signal,
+            timeout,
+            ...(options.signal ? [options.signal] : []),
+        ]);
+        const workspace = options.workspace ?? o.workspace;
+        let acquired = false;
+        try {
+            o.store.beginRun?.({
+                id: runId,
+                session: sessionId,
+                status: "running",
+                model: o.store.get(sessionId).model,
+                ...(options.correlationId !== undefined ? { correlationId: options.correlationId } : {}),
+            });
+            o.store.acquire(sessionId);
+            acquired = true;
+            o.store.reconcile(sessionId);
+            const session = o.store.get(sessionId);
+            if (session.workspace !== workspace)
+                throw new Error("Session workspace mismatch");
+            combined.throwIfAborted();
+            const call = { id: uiCallId(), name, arguments: JSON.stringify(input) };
+            let prepared;
+            try {
+                prepared = {
+                    call,
+                    tool: o.registry.get(name),
+                    input: o.registry.parse(name, call.arguments),
+                };
+            }
+            catch (error) {
+                prepared = { call, error: String(error) };
+            }
+            const note = `The user ran the ${name} tool from the interface.`;
+            o.store.append(sessionId, { role: "user", text: note, display: options.display ?? note });
+            emit("run_started", { model: session.model });
+            o.store.append(sessionId, { role: "assistant", text: "", calls: [call] });
+            const result = await this.executeCall({
+                sessionId,
+                runId,
+                emit,
+                signal: combined,
+                workspace,
+                policy: options.policy ?? o.policy,
+                approvals: !!o.approve && options.approvals !== false,
+                options,
+            }, prepared);
+            o.store.append(sessionId, { role: "tool", callId: call.id, result });
+            const first = textProjection(result)
+                .content.map((part) => (part.type === "text" ? part.text : ""))
+                .join(" ")
+                .replace(/\s*\n\s*/g, " ")
+                .trim()
+                .slice(0, 300);
+            const text = `${name} ${result.isError ? "failed" : "finished"}${first ? `: ${first}` : ""}`;
+            o.store.append(sessionId, { role: "assistant", text, calls: [] });
+            emit("run_completed", { tokens: 0, text });
+            finish("completed");
+            return { runId, status: "completed", result };
+        }
+        catch (error) {
+            const cause = combined.aborted ? (combined.reason ?? error) : error;
+            const message = cause instanceof Error ? cause.message : String(cause);
+            emit(combined.aborted ? "run_cancelled" : "run_failed", { error: message });
+            finish(combined.aborted ? "cancelled" : "failed", message);
+            throw error;
+        }
+        finally {
+            if (acquired)
+                o.store.release(sessionId);
+            this.active.delete(sessionId);
+        }
+    }
     async run(sessionId, prompt, signal, options = {}) {
         const controller = this.claim(sessionId);
         const runId = options.runId ?? crypto.randomUUID();
@@ -394,6 +752,7 @@ export class AgentRunner {
                 text: prompt,
                 ...(options.display ? { display: options.display } : {}),
                 ...(options.attachments?.length ? { attachments: options.attachments } : {}),
+                ...(options.datasets?.length ? { datasets: options.datasets } : {}),
             });
             emit("run_started", { model });
             const budget = options.maxTokens ?? o.maxTokens ?? defaultTokenBudget(o.contextWindow?.(model));
@@ -407,7 +766,7 @@ export class AgentRunner {
                         o.store.append(sessionId, { role: "user", text: queued });
                 let instructions = await withPersona();
                 let messages = o.store.messages(sessionId);
-                const tools = this.availableTools(options);
+                const tools = this.availableTools(options, sessionId);
                 const toolsText = this.toolsText(tools);
                 const chars = () => instructions.length + JSON.stringify(messages).length + toolsText.length;
                 // REDUCIBLE content only (instructions + transcript). The fixed tool catalog
@@ -556,137 +915,36 @@ export class AgentRunner {
                 if (paths.length)
                     contextUpdate = await context.beforePaths(paths, sessionId);
                 let pendingUpdate = contextUpdate;
-                const execute = async (p) => {
-                    const { call } = p;
-                    let result;
-                    const started = Date.now();
-                    // `effect` rides along so the TUI can group consecutive calls by capability kind
-                    // (read batches, write batches, commands…) without a name heuristic. Additive field.
-                    emit("tool_started", {
-                        name: call.name,
-                        id: call.id,
-                        arguments: call.arguments,
-                        effect: p.tool?.effect ?? "external",
-                    });
-                    try {
-                        combined.throwIfAborted();
-                        if (p.error)
-                            throw new Error(p.error);
-                        if (!p.tool || !p.input)
-                            throw new Error("Invalid tool");
-                        const effect = p.tool.effect ?? "external";
-                        // External-directory prerequisite: declared paths are resolved (and, outside every
-                        // allowed root, approved for the containing directory) BEFORE the effect gate, so a
-                        // write still needs its own write policy and a read never hard-throws first. The
-                        // resolved map keeps "allow once" scoped to this one call, with no shared mutable
-                        // state that parallel read batches could race on.
-                        const resolved = new Map();
-                        if (pathAccess)
-                            for (const declared of p.tool.paths?.(p.input) ?? [])
-                                if (!resolved.has(declared)) {
-                                    const target = await pathAccess.resolve(declared, {
-                                        workspace,
-                                        session: sessionId,
-                                        ...(options.label ? { label: options.label } : {}),
-                                        signal: combined,
-                                    });
-                                    // Key both the declared input and its resolved form: a write resolves the
-                                    // input once, then re-checks the already-absolute path, and neither lookup may
-                                    // ask a second time for an "allow once" decision.
-                                    resolved.set(declared, target);
-                                    resolved.set(target, target);
-                                }
+                const scope = {
+                    sessionId,
+                    runId,
+                    emit,
+                    signal: combined,
+                    workspace,
+                    policy,
+                    approvals,
+                    options,
+                    guard: (effect) => {
                         if (contextUpdate && effect !== "read")
                             throw new Error(`Context changed; reconsider this call before retrying.\n${contextUpdate}`);
                         if (tokens >= budget)
                             throw new Error("Token budget exhausted; tool was not executed");
-                        if (options.toolFilter && !options.toolFilter(p.tool))
-                            throw new Error(`Tool ${call.name} is not available in this session`);
-                        if (!allowed(policy, effect)) {
-                            if (!o.approve ||
-                                !approvals ||
-                                (effect !== "write" && effect !== "process" && effect !== "external"))
-                                throw new Error(`Capability denied: ${effect}`);
-                            emit("approval_requested", {
-                                id: call.id,
-                                name: call.name,
-                                effect,
-                                ...(options.label ? { label: options.label } : {}),
-                            });
-                            const decision = await o.approve({
-                                call,
-                                effect,
-                                input: p.input,
-                                signal: combined,
-                                session: sessionId,
-                                ...(options.label ? { label: options.label } : {}),
-                            });
-                            combined.throwIfAborted();
-                            emit("approval_resolved", { id: call.id, name: call.name, effect, decision });
-                            if (decision === "deny")
-                                throw new Error(`Capability ${effect} denied by the user for this call`);
-                            if (decision === "session")
-                                policy[effect] = true;
-                        }
-                        o.store.beginCall(sessionId, call, { runId, effect });
-                        result = await p.tool.execute(p.input, {
-                            signal: combined,
-                            workspace,
-                            session: sessionId,
-                            emit: (data) => emit("tool_progress", { id: call.id, data }),
-                            ...(options.label ? { label: options.label } : {}),
-                            ...(pathAccess
-                                ? {
-                                    resolvePath: (path) => {
-                                        const known = resolved.get(path);
-                                        return known !== undefined
-                                            ? Promise.resolve(known)
-                                            : pathAccess.resolve(path, {
-                                                workspace,
-                                                session: sessionId,
-                                                ...(options.label ? { label: options.label } : {}),
-                                                signal: combined,
-                                            });
-                                    },
-                                }
-                                : {}),
-                        });
-                        // The bound applies to what the model sees (the text projection): display-only
-                        // ui/image parts are bounded by their producers and must not push text over it.
-                        const projected = textProjection(result);
-                        if (JSON.stringify(projected).length > 48_000)
-                            result = textResult(`${JSON.stringify(projected).slice(0, 40_000)}\n[tool output truncated]`, result.isError);
-                        if (pendingUpdate && effect === "read") {
-                            result = {
-                                ...result,
-                                content: [
-                                    ...result.content,
-                                    { type: "text", text: `\n<instructions>\n${pendingUpdate}\n</instructions>` },
-                                ],
-                            };
-                            pendingUpdate = undefined;
-                        }
-                        o.store.endCall(sessionId, call, result);
-                    }
-                    catch (error) {
-                        result = textResult(error instanceof Error ? error.message : String(error), true);
-                        // A cancellation after execution may have left effects; journal remains pending.
-                        if (!combined.aborted)
-                            o.store.endCall(sessionId, call, result);
-                    }
-                    emit("tool_completed", {
-                        id: call.id,
-                        name: call.name,
-                        isError: result.isError ?? false,
-                        durationMs: Date.now() - started,
-                        preview: result.content
-                            .filter((part) => part.type === "text")
-                            .map((c) => c.text)
-                            .join("\n")
-                            .slice(0, 2_000),
-                    });
-                    return result;
+                    },
+                    amend: (result, effect) => {
+                        if (!pendingUpdate || effect !== "read")
+                            return result;
+                        const update = pendingUpdate;
+                        pendingUpdate = undefined;
+                        return {
+                            ...result,
+                            content: [
+                                ...result.content,
+                                { type: "text", text: `\n<instructions>\n${update}\n</instructions>` },
+                            ],
+                        };
+                    },
                 };
+                const execute = (p) => this.executeCall(scope, p);
                 const results = [];
                 // Bounded parallel batches for consecutive read or explicitly concurrent tools.
                 const parallel = (p) => !!p?.tool && (p.tool.effect === "read" || p.tool.concurrent === true);

package/dist/index.d.ts

@@ -7,11 +7,26 @@ export { AGENT_ID_PATTERN, AGENT_LIMITS, AGENT_REASONING_SUMMARIES, AGENT_TEXT_F
 export { AGENT_DRAFT_INSTRUCTIONS, AGENT_DRAFT_MAX_DESCRIPTION, type AgentAuthoringGuidance, agentAuthoringGuidance, agentDraftRequest, generateAgentDraft, parseAgentDraft, } from "./agents/draft.ts";
 export { type AgentChange, AgentDefinitionService, type AgentDefinitionServiceOptions, type AgentRegistry, mergeAgentScopes, } from "./agents/service.ts";
 export { AGENT_TEMPLATES, agentTemplate } from "./agents/templates.ts";
+export { CapabilityGrants, type GrantRecord, type GrantSource, toGrantWire, } from "./analysis/capabilities.ts";
+export { CsvParser, decodeTextBytes, detectDelimiter } from "./analysis/data/csv.ts";
+export { type DatasetLimits, type DatasetRecord, DatasetService, DEFAULT_DATASET_LIMITS, datasetFormat, PageParamError, toDatasetRef, XLSX_REMEDY, } from "./analysis/data/datasets.ts";
+export { DataEngine, DataError, type DataErrorCode, } from "./analysis/data/engine-client.ts";
+export { guardSql } from "./analysis/data/sql-guard.ts";
+export { detectHintHost, type HintHost, type InstallHints, installHintsMarkdown, installHintsText, parseOsRelease, pythonInstallHints, } from "./analysis/install-hints.ts";
+export { AnalysisJanitor, type RetentionPolicy, SWEEP_INTERVAL_MS, type SweepReport, } from "./analysis/janitor.ts";
+export { AnalysisJobs, type ExecutionDetails, type ExecutionStatus, type JobPaths, } from "./analysis/jobs.ts";
+export { containerName, type OciDeps, type OciEngine, OciRuntime, type OciSettings, type OciStatus, ociRunArgs, parseDigests, } from "./analysis/oci.ts";
+export { AnalysisRerun, type RerunPlan, type RerunPreparation, } from "./analysis/rerun.ts";
+export { AnalysisRuntimeManager, type DiscoveryDeps, type Extras, ExtrasInstallError, type InstallStep, installPreview, type PythonCandidate, type PythonResolution, type RuntimeState, setupCommand, venvInterpreter, } from "./analysis/runtime-manager.ts";
+export { analysisStatus } from "./analysis/status.ts";
 export { type AppOptions, type BuiltinContext, type BuiltinPlugin, createApplication, enabledBuiltins, type PluginCatalogEntry, type PluginCatalogStatus, } from "./application.ts";
+export { classifyArtifact, extensionOf, fileType as artifactFileType, isPreviewable, KIND_LABELS, viewerContentType, } from "./artifacts/kinds.ts";
+export { createArtifactPublisher } from "./artifacts/publisher.ts";
+export { type ArtifactFile, type ArtifactLimits, type ArtifactOwner, type ArtifactRecord, ArtifactRejected, ArtifactStore, type PublishedArtifact, readHead as readArtifactHead, slugify as artifactSlug, toRef, } from "./artifacts/store.ts";
 export { BUILTIN_COMMANDS, type BuiltinCommand, CommandCatalog, type CommandExecutionContext, type CommandHost, type CommandResult, type CommandSurface, } from "./commands/catalog.ts";
-export { type Config, type ConfigLoadResult, type ConfigProvenance, configFile, configHome, configSchema, isSettableSettingKey, type LoadedConfig, loadConfig, loadConfigWithProvenance, type McpServerSource, overridesSavedProviderProfile, type SettableSettingInfo, type SettableSettingKey, setConfigValue, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, settableSettings, stateHome, } from "./config.ts";
+export { type Config, type ConfigLoadResult, type ConfigProvenance, configFile, configHome, configSchema, isSettableSettingKey, type LoadedConfig, loadConfig, loadConfigWithProvenance, type McpServerSource, OCI_IMAGE_PATTERN, overridesSavedProviderProfile, type SettableSettingInfo, type SettableSettingKey, setConfigValue, setGlobalMcpAllow, setMcpServerEnabled, setProjectPluginEnabled, setProjectSkillEnabled, settableSettings, stateHome, } from "./config.ts";
 export { type ContextBudget, checkpointInstructions, completeText, effectiveContextBudget, estimateTokens, MAX_TRUSTED_WINDOW, parseCheckpointOutput, planCompaction, renderCheckpoint, serializeForSummary, shouldCompact, shouldCompactContext, summarize, } from "./core/compaction.ts";
-export type { ApprovalDecision, ApprovalHandler, ApprovalRequest, BeginRunInput, ContextSource, EndRunInput, EventPage, HookFailure, MessagePage, PageOptions, Policy, RunnerExtensions, RunRecord, RunStatus, Session, SessionStore, StoredEvent, TerminalRunStatus, ToolCallMeta, } from "./core/contracts.ts";
+export type { ApprovalDecision, ApprovalHandler, ApprovalRequest, ArtifactPublisherFactory, BeginRunInput, CapabilityGate, ContextSource, CoreArtifactPublisher, EndRunInput, EventPage, HookFailure, MessagePage, PageOptions, Policy, PublishedArtifactInfo, RunnerExtensions, RunRecord, RunStatus, Session, SessionStore, StoredEvent, TerminalRunStatus, ToolCallMeta, } from "./core/contracts.ts";
 export { ToolRegistry } from "./core/registry.ts";
 export { AgentRunner, type CompactionResult, defaultTokenBudget, type RunnerOptions, type RunnerSettingsPatch, type RunOptions, } from "./core/runner.ts";
 export { type ExtensionConflict, ExtensionRegistry } from "./extensions/registry.ts";
@@ -26,16 +41,20 @@ export { type InstructionFile, ProjectContext, type ProjectContextOptions, } fro
 export { expandSlashPrompt, loadPromptTemplates, type PromptDiagnostic, type PromptRequirement, type PromptSource, type PromptSourceKind, type PromptTemplate, parsePromptTemplate, promptSources, renderPromptTemplate, splitArguments, } from "./resources/prompts.ts";
 export { type Skill, type SkillCatalogEntry, type SkillRoot, type SkillScope, Skills, skillRoots, } from "./resources/skills.ts";
 export { type ExternalDirectoryDecision, type ExternalDirectoryHandler, type ExternalDirectoryRequest, PathAccess, type PathAccessOptions, type ResolvePathOptions, } from "./runtime/access.ts";
-export { BlobStore, type BlobStoreOptions } from "./runtime/blobs.ts";
+export { BlobStore, type BlobStoreOptions, BlobTooLarge } from "./runtime/blobs.ts";
 export { clipLines, unifiedPatch } from "./runtime/diff.ts";
 export { exists, fileSize, readHead, readJson, readText, which } from "./runtime/fs.ts";
+export { newId, ulid } from "./runtime/ids.ts";
 export { defaultGlobalRoots, isPathSpec, PLUGIN_KEYWORD, resolvePluginSpec, } from "./runtime/modules.ts";
-export { findWorkspace, inside, outsideRootsMessage, safePath } from "./runtime/paths.ts";
+export { findWorkspace, inside, outsideRootsMessage, safePath, workspaceKey, } from "./runtime/paths.ts";
 export { isMissingCommand, type ProcessResult, RIPGREP_INSTALL_HINT, runProcess, } from "./runtime/process.ts";
 export { isSqliteExperimentalWarning, openDatabase } from "./runtime/sqlite.ts";
 export { SQLiteStore } from "./runtime/store.ts";
+export { crc32, writeZip, type ZipEntry, type ZipSink } from "./runtime/zip.ts";
 export { ChildSessions, type ChildSessionsOptions } from "./sessions/children.ts";
 export { formatSideQuestion, SIDE_QUESTION_DESCRIPTION, SIDE_QUESTION_HISTORY_LIMIT, SIDE_QUESTION_INSTRUCTIONS, SIDE_QUESTION_MAX_CHARS, SIDE_QUESTION_USAGE, SIDE_QUESTIONS_NAMESPACE, type SideQuestionEntry, SideQuestions, type SideQuestionsOptions, sideTranscript, } from "./sessions/side-questions.ts";
 export { composeSideBySide, DefaultAlisioMascot, DefaultStartupScreen, infoSection, mascotSection, padEnd, pluginsSection, renderStartup, type StartupDiagnostic, type StartupInput, type StartupResult, sanitizeLine, shortenPath, startupTips, stripAnsi, tipsSection, titleSection, truncate, visibleWidth, welcomeSection, } from "./startup/index.ts";
+export { formatBytes, NOT_SANDBOXED } from "./tools/analysis.ts";
+export { ARTIFACT_READ_MAX, exportedPaths } from "./tools/artifacts.ts";
 export { hash, objectSchema, registerStandard } from "./tools/standard.ts";
 export { getTrust, hashProjectConfig, hasProjectResources, listTrust, resolveTrust, revokeTrust, setTrust, type TrustEntry, type TrustListing, type TrustResolution, trustStorePath, } from "./trust.ts";