@amoree-code/ocean 0.0.0-stage → 1.1.0

package/node_modules/@ocean/loop/dist/runs/run-agent.js

@@ -0,0 +1,425 @@
+import { createHash, randomUUID } from "node:crypto";
+import { buildProfileFactsDigest, profileFactsFile, readProfileFacts, } from "@ocean/brain/memory/profile-facts.js";
+import { buildContextReferences, referenceReadDirectories, } from "@ocean/context/context/context-references.js";
+import { validateContextManifest } from "@ocean/core/domain/context/context-validator.js";
+import { isApiClient, profileIdentity, selectProfileClient, } from "@ocean/core/domain/profiles/profile.js";
+import { executionPolicy } from "@ocean/core/domain/profiles/profile-policy.js";
+import { redactRuntimeText } from "@ocean/core/domain/redaction/redaction.js";
+import { buildExecutionPlan, executionPlanIdentity, usesToolLoop, } from "@ocean/core/domain/runs/execution-plan.js";
+import { validateSessionEntryContract } from "@ocean/core/domain/sessions/entry-contract.js";
+import { getHandoff } from "../handoff/handoff-service.js";
+import { emitHook } from "../hooks/lifecycle-hooks.js";
+import { finalizeSession } from "../sessions/session-closeout.js";
+import { sessionProjectId } from "../sessions/session-projects.js";
+import { assemblePrompt, formatActiveLessons, formatProfileContract, formatSkillIndex, PROMOTED_SKILL_MAX_BYTES, readDirectoriesOutside, } from "./prompt-assembly.js";
+import { authorizeRun } from "./run-authorization.js";
+import { runToolLoop } from "./tool-loop.js";
+export async function runAgent(request, deps) {
+    const execute = deps.executeProvider;
+    const profile = selectProfileClient(await deps.loadProfile(request.profileName), request.client);
+    const handoff = request.handoffId
+        ? await getHandoff(request.handoffId, deps.openStore)
+        : null;
+    const effectiveTaskId = request.taskId ??
+        (typeof handoff?.taskId === "string" ? handoff.taskId : null);
+    const clientHome = deps.resolveClientHome(profile);
+    executionPolicy(profile, request.cwd);
+    // A completion client returns text and touches nothing, so it is read-only by construction.
+    if (!isApiClient(profile.provider))
+        deps.assertProviderSupportsReadOnly(profile.provider);
+    if (profile.writePolicy !== "none" &&
+        !request.runContract?.approval.approved) {
+        throw new Error("Writable profile runs require an approved run contract");
+    }
+    if (profile.governance?.approvalRequired && !request.runContract) {
+        throw new Error("Profile requires an approved run contract");
+    }
+    // Ocean executes a tool loop's tools itself, so it can enforce writes there; a writable
+    // tool-loop run still needs an approved run contract. CLI clients stay read-only.
+    const toolLoop = usesToolLoop(profile);
+    const plan = buildExecutionPlan(profile, {
+        cwd: request.cwd,
+        ...runtimeCapabilities,
+        writeAllowed: toolLoop && request.runContract?.approval.approved === true,
+    });
+    const sessionStore = await deps.openStore();
+    const sessionId = request.sessionId ?? randomUUID();
+    const session = sessionStore.create({
+        sessionId,
+        title: request.title ??
+            (typeof handoff?.title === "string"
+                ? handoff.title
+                : request.prompt.slice(0, 120)),
+        taskId: effectiveTaskId,
+        handoffId: request.handoffId ?? null,
+        provider: profile.provider,
+        providerSessionId: null,
+        parentSessionId: request.parentSessionId ?? null,
+        profile: profile.name,
+        profileIdentity: profileIdentity(profile),
+        workingDirectory: request.cwd,
+        resumeData: null,
+        projectId: await sessionProjectId(request.cwd),
+    });
+    if (request.runContract) {
+        if (request.runContract.sessionId !== sessionId) {
+            sessionStore.close();
+            throw new Error("Run contract session does not match the session being created");
+        }
+        try {
+            authorizeRun(sessionStore, request.runContract);
+        }
+        catch (error) {
+            sessionStore.close();
+            throw error;
+        }
+    }
+    try {
+        sessionStore.appendEvent(sessionId, "session_entry_contract", JSON.stringify(validateSessionEntryContract({
+            entryPoint: "ocean-run",
+            controlLevel: "full-head",
+            inputCapture: "semantic",
+            contextTransport: "profile-context-and-provider-adapter",
+            policyEnforcement: "profile-and-run-contract",
+            promotion: "explicit-review",
+            resume: profile.provider === "claude"
+                ? "provider-session-id"
+                : "unsupported",
+        })));
+        appendExecutionPlan(sessionStore, sessionId, plan);
+        const context = await buildContextReferences({
+            profile,
+            prompt: request.prompt,
+            cwd: request.cwd,
+        });
+        const factsDigest = plan.memoryNamespace
+            ? buildProfileFactsDigest(plan.memoryNamespace, await readProfileFacts(plan.memoryNamespace))
+            : { text: "", partial: false };
+        const skillIndex = await deps.loadSkillIndex(profile.skills, request.cwd);
+        const autoSkills = await deps.loadActiveLessons(request.prompt, PROMOTED_SKILL_MAX_BYTES);
+        for (const skill of autoSkills) {
+            sessionStore.appendEvent(sessionId, "skill_auto_activated", JSON.stringify({
+                id: skill.id,
+                name: skill.title,
+                sourceSessionId: skill.sourceSessionId ?? null,
+            }));
+        }
+        sessionStore.appendEvent(sessionId, "user_input", redactRuntimeText(request.prompt));
+        if (request.actor)
+            sessionStore.appendEvent(sessionId, "actor_bound", request.actor);
+        sessionStore.appendEvent(sessionId, "context_manifest", JSON.stringify(context.manifest));
+        sessionStore.updateStatus(sessionId, "running");
+        await emitHook("session.start", {
+            sessionId,
+            profile: profile.name,
+            provider: profile.provider,
+        });
+        const handoffContent = typeof handoff?.compactContext === "string"
+            ? `## Ocean handoff\n${handoff.compactContext}`
+            : "";
+        // A completion client runs off this machine and cannot open a file, so it gets no file
+        // pointers (skill index, context references) and no profile facts: local paths would leak
+        // the directory layout and facts are private memory that stays local.
+        const local = plan.transport === "cli";
+        const { prompt, bytes, breakdown } = assemblePrompt({
+            request: request.prompt,
+            profile: formatProfileContract(profile, {
+                taskId: effectiveTaskId,
+                handoffId: request.handoffId ?? null,
+            }),
+            instructions: profile.instructions,
+            skills: local
+                ? [formatSkillIndex(skillIndex), formatActiveLessons(autoSkills)]
+                    .filter(Boolean)
+                    .join("\n\n")
+                : "",
+            facts: local ? factsDigest.text : "",
+            handoff: handoffContent,
+            context: local ? context.content : "",
+        });
+        const contextHash = createHash("sha256").update(prompt).digest("hex");
+        sessionStore.updateContext(sessionId, contextHash, bytes);
+        sessionStore.appendEvent(sessionId, "context_cost", JSON.stringify({
+            bytes,
+            sources: context.manifest.files,
+            handoffId: request.handoffId ?? null,
+            selectedSkills: local ? skillIndex.map((skill) => skill.name) : [],
+            selectedLessons: local ? autoSkills.map((lesson) => lesson.id) : [],
+            sections: breakdown,
+        }));
+        const onEvent = (event) => {
+            captureProviderSessionId(sessionStore, sessionId, event);
+            sessionStore.appendEvent(sessionId, event.type, boundedEventData(event));
+        };
+        const result = plan.toolLoop
+            ? await runToolLoop({
+                plan,
+                prompt,
+                chat: deps.chat,
+                executeTool: deps.executeAgentTool,
+                toolLimits: request.runContract && {
+                    allowed: request.runContract.allowedTools,
+                    denied: request.runContract.deniedTools,
+                },
+                timeoutMs: request.runContract?.budget.timeoutMs,
+                maxOutputBytes: request.runContract?.budget.maxOutputBytes,
+                maxAttempts: request.runContract?.budget.maxAttempts,
+                onEvent,
+            })
+            : plan.transport === "openai-compatible-api"
+                ? await deps.executeCompletion({
+                    provider: plan.provider,
+                    model: plan.model,
+                    prompt,
+                    ...(plan.temperature === undefined
+                        ? {}
+                        : { temperature: plan.temperature }),
+                    timeoutMs: request.runContract?.budget.timeoutMs,
+                    maxOutputBytes: request.runContract?.budget.maxOutputBytes,
+                    maxAttempts: request.runContract?.budget.maxAttempts,
+                    onEvent,
+                })
+                : await execute({
+                    provider: profile.provider,
+                    prompt,
+                    cwd: request.cwd,
+                    clientHome,
+                    timeoutMs: request.runContract?.budget.timeoutMs,
+                    maxOutputBytes: request.runContract?.budget.maxOutputBytes,
+                    readOnly: plan.readOnly,
+                    model: plan.model,
+                    env: plan.childEnv,
+                    readDirectories: headlessReadDirectories({
+                        cwd: request.cwd,
+                        profileName: profile.name,
+                        skillIndex,
+                        factsPartial: factsDigest.partial,
+                        contextDirectories: context.readDirectories,
+                    }),
+                    onSpawn: (pid) => sessionStore.setProviderPid(sessionId, pid),
+                    onEvent,
+                });
+        sessionStore.clearProviderPid(sessionId);
+        sessionStore.updateStatus(sessionId, result.exitCode === 0 ? "completed" : "failed");
+        sessionStore.appendEvent(sessionId, "process_exit", JSON.stringify({
+            exitCode: result.exitCode,
+            stderr: redactRuntimeText(result.stderr),
+        }));
+        sessionStore.appendEvent(sessionId, "evidence", JSON.stringify({
+            evidenceId: randomUUID(),
+            sessionId,
+            type: "provider_exit",
+            source: "headless-process",
+            observedAt: new Date().toISOString(),
+            result: result.exitCode === 0 ? "proven" : "not_proven",
+            criterion: "provider process exits successfully",
+            payload: JSON.stringify({ exitCode: result.exitCode }),
+        }));
+        sessionStore.scanCaptureItems(sessionId);
+        await deps.appendRuntimeLog({
+            timestamp: new Date().toISOString(),
+            event: result.exitCode === 124 ? "provider_timeout" : "run_finished",
+            correlationId: sessionId,
+            sessionId,
+            provider: profile.provider,
+            status: result.exitCode === 0 ? "completed" : "failed",
+            payload: JSON.stringify({ exitCode: result.exitCode }),
+        });
+        await finalizeSession(sessionStore, sessionId, {
+            exitCode: result.exitCode,
+        });
+        await emitHook("session.end", {
+            sessionId,
+            status: result.exitCode === 0 ? "completed" : "failed",
+            exitCode: result.exitCode,
+        });
+        return sessionStore.get(sessionId) ?? session;
+    }
+    catch (error) {
+        sessionStore.clearProviderPid(sessionId);
+        sessionStore.updateStatus(sessionId, "failed");
+        sessionStore.scanCaptureItems(sessionId);
+        sessionStore.appendEvent(sessionId, "error", redactRuntimeText(error instanceof Error ? error.message : String(error)));
+        await finalizeSession(sessionStore, sessionId, { exitCode: 1 });
+        await emitHook("run.error", {
+            sessionId,
+            error: error instanceof Error ? error.message : String(error),
+        });
+        await deps.appendRuntimeLog({
+            timestamp: new Date().toISOString(),
+            event: "run_failed",
+            correlationId: sessionId,
+            sessionId,
+            provider: profile.provider,
+            status: "failed",
+        });
+        throw error;
+    }
+    finally {
+        sessionStore.close();
+    }
+}
+export async function resumeAgent(sessionId, prompt, deps, runContract) {
+    const execute = deps.executeProvider;
+    const sessionStore = await deps.openStore();
+    try {
+        const existing = sessionStore.get(sessionId);
+        if (!existing)
+            throw new Error(`Session not found: ${sessionId}`);
+        if (existing.provider !== "claude" || !existing.providerSessionId) {
+            throw new Error(`Provider does not support resume yet: ${existing.provider}`);
+        }
+        const profile = selectProfileClient(await deps.loadProfile(existing.profile), existing.provider);
+        executionPolicy(profile, existing.workingDirectory);
+        deps.assertProviderSupportsReadOnly(profile.provider);
+        if (profile.writePolicy !== "none")
+            throw new Error("Writable profile resumes are not supported");
+        if (profileIdentity(profile) !== existing.profileIdentity)
+            throw new Error("Profile changed since the session was created; start a new reviewed run");
+        if (profile.governance?.approvalRequired && !runContract)
+            throw new Error("Profile requires an approved run contract to resume");
+        if (runContract) {
+            if (runContract.sessionId !== sessionId)
+                throw new Error("Run contract session does not match the session being resumed");
+            authorizeRun(sessionStore, runContract);
+        }
+        const plan = buildExecutionPlan(profile, {
+            cwd: existing.workingDirectory,
+            ...runtimeCapabilities,
+        });
+        sessionStore.updateStatus(sessionId, "running");
+        appendExecutionPlan(sessionStore, sessionId, plan);
+        sessionStore.appendEvent(sessionId, "resume_requested", redactRuntimeText(prompt));
+        sessionStore.appendEvent(sessionId, "user_input", redactRuntimeText(prompt));
+        // The first turn's prompt points at skill folders, context references and possibly the
+        // facts store; --add-dir is per invocation, so the same grant is rebuilt for the resume.
+        // profileIdentity is unchanged (checked above), so the skill set is the same. The grant
+        // only adds read access: a skill or facts lookup that fails now narrows it, never the turn.
+        const cwd = existing.workingDirectory;
+        let skillIndex = [];
+        try {
+            skillIndex = await deps.loadSkillIndex(profile.skills, cwd);
+        }
+        catch {
+            skillIndex = [];
+        }
+        let factsPartial = false;
+        try {
+            factsPartial = plan.memoryNamespace
+                ? buildProfileFactsDigest(plan.memoryNamespace, await readProfileFacts(plan.memoryNamespace)).partial
+                : false;
+        }
+        catch {
+            factsPartial = false;
+        }
+        const readDirectories = headlessReadDirectories({
+            cwd,
+            profileName: profile.name,
+            skillIndex,
+            factsPartial,
+            contextDirectories: await referenceReadDirectories(recordedReferences(sessionStore.listEvents(sessionId)), profile.allowedPaths, cwd),
+        });
+        const result = await execute({
+            provider: "claude",
+            prompt,
+            cwd,
+            resumeId: existing.providerSessionId,
+            clientHome: deps.resolveClientHome(profile),
+            timeoutMs: runContract?.budget.timeoutMs,
+            maxOutputBytes: runContract?.budget.maxOutputBytes,
+            readOnly: plan.readOnly,
+            model: plan.model,
+            env: plan.childEnv,
+            readDirectories,
+            onSpawn: (pid) => sessionStore.setProviderPid(sessionId, pid),
+            onEvent: (event) => {
+                captureProviderSessionId(sessionStore, sessionId, event);
+                sessionStore.appendEvent(sessionId, event.type, boundedEventData(event));
+            },
+        });
+        sessionStore.clearProviderPid(sessionId);
+        sessionStore.updateStatus(sessionId, result.exitCode === 0 ? "completed" : "failed");
+        sessionStore.appendEvent(sessionId, "process_exit", JSON.stringify({
+            exitCode: result.exitCode,
+            stderr: redactRuntimeText(result.stderr),
+        }));
+        sessionStore.scanCaptureItems(sessionId);
+        await finalizeSession(sessionStore, sessionId, {
+            exitCode: result.exitCode,
+        });
+        return sessionStore.get(sessionId) ?? existing;
+    }
+    catch (error) {
+        sessionStore.clearProviderPid(sessionId);
+        sessionStore.updateStatus(sessionId, "failed");
+        sessionStore.scanCaptureItems(sessionId);
+        sessionStore.appendEvent(sessionId, "error", redactRuntimeText(error instanceof Error ? error.message : String(error)));
+        await finalizeSession(sessionStore, sessionId, { exitCode: 1 });
+        throw error;
+    }
+    finally {
+        sessionStore.close();
+    }
+}
+// What this runtime executes today. CLI clients and completion APIs both execute. Writes
+// stay off except in a tool loop, where Ocean executes (and bounds) every write itself.
+const runtimeCapabilities = {
+    supportedTransports: ["cli", "openai-compatible-api"],
+    writeAllowed: false,
+};
+// The plan is recorded with its identity before any context is assembled or process starts,
+// so a session always shows the exact client, model, memory namespace and write mode it ran with.
+function appendExecutionPlan(store, sessionId, plan) {
+    store.appendEvent(sessionId, "execution_plan", JSON.stringify({ identity: executionPlanIdentity(plan), plan }));
+}
+// Read access for everything the lean prompt points at outside cwd: skill folders, the
+// facts store when the digest left facts out, and the allowedPaths-bounded directories of
+// context references. Deduped in that order.
+function headlessReadDirectories(options) {
+    return [
+        ...new Set([
+            ...readDirectoriesOutside(options.cwd, [
+                ...options.skillIndex.map((skill) => skill.path),
+                ...(options.factsPartial
+                    ? [profileFactsFile(options.profileName)]
+                    : []),
+            ]),
+            ...options.contextDirectories,
+        ]),
+    ];
+}
+// The references the session's first turn recorded (its last context_manifest event).
+// Packet references depend on the original prompt, so they are read back, not recomputed.
+function recordedReferences(events) {
+    const manifest = [...events]
+        .reverse()
+        .find((event) => event.type === "context_manifest");
+    if (!manifest)
+        return [];
+    try {
+        return validateContextManifest(JSON.parse(manifest.data)).references;
+    }
+    catch {
+        return [];
+    }
+}
+function boundedEventData(event) {
+    const serialized = typeof event.data === "string" ? event.data : JSON.stringify(event.data);
+    return redactRuntimeText(serialized);
+}
+function captureProviderSessionId(store, sessionId, event) {
+    if (event.type === "json" &&
+        typeof event.data === "object" &&
+        event.data !== null &&
+        "session_id" in event.data) {
+        const providerSessionId = event.data
+            .session_id;
+        if (typeof providerSessionId === "string" &&
+            isValidProviderSessionId(providerSessionId))
+            store.updateProviderSessionId(sessionId, providerSessionId);
+    }
+}
+export function isValidProviderSessionId(value) {
+    return value.length <= 256 && /^[A-Za-z0-9._:-]+$/.test(value);
+}
+//# sourceMappingURL=run-agent.js.map

package/node_modules/@ocean/loop/dist/runs/run-authorization.js

@@ -0,0 +1,24 @@
+import { assertRunCanStart, } from "@ocean/core/domain/runs/run-contract.js";
+export function authorizeRun(store, contract, attempt = 1) {
+    try {
+        const session = store.get(contract.sessionId);
+        if (!session)
+            throw new Error(`Run contract session not found: ${contract.sessionId}`);
+        if (session.profile !== contract.profile)
+            throw new Error("Run contract profile does not match the session");
+        if (session.workingDirectory !== contract.workingDirectory)
+            throw new Error("Run contract working directory does not match the session");
+        assertRunCanStart(contract, attempt);
+        store.appendEvent(contract.sessionId, "run_approval", JSON.stringify({ runId: contract.runId, approved: true, attempt }));
+    }
+    catch (error) {
+        store.appendEvent(contract.sessionId, "run_refusal", JSON.stringify({
+            runId: contract.runId,
+            approved: false,
+            reason: error instanceof Error ? error.message : String(error),
+            attempt,
+        }));
+        throw error;
+    }
+}
+//# sourceMappingURL=run-authorization.js.map

package/node_modules/@ocean/loop/dist/runs/tool-loop.js

@@ -0,0 +1,173 @@
+import { redactRuntimeText } from "@ocean/core/domain/redaction/redaction.js";
+import { decideToolCall, toolDefinitions, } from "@ocean/core/domain/runs/agent-tools.js";
+// A completion client working through Ocean's tools, bounded on every axis (T-245 Phase 6):
+// iterations, tool calls, one wall-clock deadline, total tool output, repeated calls, and
+// cancellation. Every tool call is decided against the execution plan before it runs.
+export const MAX_ITERATIONS = 20;
+export const MAX_TOOL_CALLS = 50;
+export const MAX_REPEATS = 3;
+const DEFAULT_TIMEOUT_MS = 10 * 60_000;
+const DEFAULT_MAX_OUTPUT_BYTES = 1024 * 1024;
+class LoopStop extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+        super(message);
+        this.exitCode = exitCode;
+    }
+}
+export async function runToolLoop(request) {
+    const { plan } = request;
+    const events = [];
+    const emit = (data) => {
+        const event = { type: "json", data };
+        events.push(event);
+        request.onEvent?.(event);
+    };
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(new LoopStop("Process timed out.", 124)), request.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    const cancel = () => controller.abort(new LoopStop("Run cancelled.", 130));
+    if (request.signal?.aborted)
+        cancel();
+    request.signal?.addEventListener("abort", cancel, { once: true });
+    const outputBudget = request.maxOutputBytes ?? DEFAULT_MAX_OUTPUT_BYTES;
+    const tools = toolDefinitions(plan, request.toolLimits);
+    const messages = [{ role: "user", content: request.prompt }];
+    const seen = new Map();
+    let toolCalls = 0;
+    let outputBytes = 0;
+    const checkAborted = () => {
+        if (controller.signal.aborted)
+            throw controller.signal.reason;
+    };
+    try {
+        for (let iteration = 1; iteration <= MAX_ITERATIONS; iteration += 1) {
+            checkAborted();
+            const reply = await request.chat({
+                provider: plan.provider,
+                model: plan.model,
+                ...(plan.temperature === undefined
+                    ? {}
+                    : { temperature: plan.temperature }),
+                messages,
+                tools,
+                maxOutputBytes: outputBudget,
+                maxAttempts: request.maxAttempts,
+                signal: controller.signal,
+                onEvent: request.onEvent,
+            });
+            messages.push(reply.message);
+            // The model's own replies count against the run's output budget, like tool output.
+            outputBytes += Buffer.byteLength(JSON.stringify(reply.message));
+            if (outputBytes > outputBudget)
+                throw new LoopStop("Output budget exceeded.", 125);
+            const calls = reply.message.tool_calls ?? [];
+            if (!calls.length) {
+                emit({
+                    type: "completion",
+                    provider: plan.provider,
+                    model: reply.model,
+                    id: reply.id,
+                    usage: reply.usage,
+                    iterations: iteration,
+                    toolCalls,
+                    text: reply.message.content ?? "",
+                });
+                return { exitCode: 0, events, stderr: "" };
+            }
+            for (const call of calls) {
+                checkAborted();
+                toolCalls += 1;
+                if (toolCalls > MAX_TOOL_CALLS)
+                    throw new LoopStop(`Tool call budget exhausted (${MAX_TOOL_CALLS}).`, 1);
+                const key = `${call.function.name}\0${call.function.arguments}`;
+                const repeats = (seen.get(key) ?? 0) + 1;
+                seen.set(key, repeats);
+                if (repeats >= MAX_REPEATS)
+                    throw new LoopStop(`Repeated tool call stopped the run: ${call.function.name} x${repeats}.`, 1);
+                const decision = decideToolCall(plan, {
+                    id: call.id,
+                    name: call.function.name,
+                    arguments: call.function.arguments,
+                }, request.toolLimits);
+                let content;
+                if (!decision.ok) {
+                    emit({
+                        type: "tool_denied",
+                        id: call.id,
+                        name: call.function.name,
+                        reason: decision.reason,
+                    });
+                    content = `denied: ${decision.reason}`;
+                }
+                else {
+                    // Only the path and size of a write are recorded: its content is the file's.
+                    const { content: written, ...rest } = decision.args;
+                    emit({
+                        type: "tool_call",
+                        id: call.id,
+                        name: decision.name,
+                        arguments: redactRuntimeText(JSON.stringify(rest)).slice(0, 2_000),
+                        ...(written === undefined
+                            ? {}
+                            : { bytes: Buffer.byteLength(written) }),
+                    });
+                    try {
+                        content = await request.executeTool(plan, decision.name, decision.args);
+                        // A write changes what a repeated read or listing would return.
+                        if (decision.name === "write_file")
+                            seen.clear();
+                        emit({
+                            type: "tool_result",
+                            id: call.id,
+                            ok: true,
+                            bytes: Buffer.byteLength(content),
+                        });
+                    }
+                    catch (error) {
+                        checkAborted();
+                        const message = redactRuntimeText(error.message);
+                        // A refusal at execution (path outside the allowed paths, a credential file) is a
+                        // denial; any other failure is reported to the model, which may recover.
+                        if (error.name === "ToolDenied") {
+                            emit({
+                                type: "tool_denied",
+                                id: call.id,
+                                name: decision.name,
+                                reason: message,
+                            });
+                            content = `denied: ${message}`;
+                        }
+                        else {
+                            emit({
+                                type: "tool_result",
+                                id: call.id,
+                                ok: false,
+                                error: message,
+                            });
+                            content = `error: ${message}`;
+                        }
+                    }
+                }
+                outputBytes += Buffer.byteLength(content);
+                if (outputBytes > outputBudget)
+                    throw new LoopStop("Output budget exceeded.", 125);
+                messages.push({ role: "tool", tool_call_id: call.id, content });
+            }
+        }
+        throw new LoopStop(`Iteration budget exhausted (${MAX_ITERATIONS}).`, 1);
+    }
+    catch (error) {
+        const stop = error instanceof LoopStop
+            ? error
+            : controller.signal.aborted &&
+                controller.signal.reason instanceof LoopStop
+                ? controller.signal.reason
+                : new LoopStop(error.message, error.exitCode ?? 1);
+        return { exitCode: stop.exitCode, events, stderr: `${stop.message}\n` };
+    }
+    finally {
+        clearTimeout(timer);
+        request.signal?.removeEventListener("abort", cancel);
+    }
+}
+//# sourceMappingURL=tool-loop.js.map