@autohq/cli 0.1.609 → 0.1.611

package/dist/agent-bridge.js

@@ -37751,7 +37751,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.609",
+  version: "0.1.611",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -38969,6 +38969,8 @@ var AuthScopeSchema = external_exports.enum([
   "tools:write",
   "environments:read",
   "environments:write",
+  "runtimes:read",
+  "runtimes:write",
   "profiles:read",
   "profiles:write",
   "sessions:read",
@@ -39104,6 +39106,7 @@ function normalizePersistedAuthClient(value2) {
 }
 var SERVICE_ACCOUNT_READ_ONLY_SCOPES = [
   "environments:read",
+  "runtimes:read",
   "tools:read",
   "agents:read",
   "sessions:read",
@@ -42197,6 +42200,270 @@ var SecretRevealResponseSchema = external_exports.object({
   value: external_exports.string()
 });
 
+// ../../packages/schemas/src/environments.ts
+var RESOURCE_KIND_ENVIRONMENT = "environment";
+var CURRENT_SANDBOX_USER_HOME = "/home/user";
+var LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
+var STORED_SANDBOX_USER_HOMES = [
+  CURRENT_SANDBOX_USER_HOME,
+  ...LEGACY_SANDBOX_USER_HOMES
+];
+var EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value2) => isSafeSandboxUserHomePath(value2), {
+  message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+});
+var StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
+  (value2) => isSafeSandboxUserHomePath(value2, {
+    allowedHomes: STORED_SANDBOX_USER_HOMES
+  }),
+  {
+    message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
+  }
+);
+var EnvironmentImageSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("preset"),
+    name: ResourceNameSchema
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("base"),
+    ref: external_exports.string().trim().min(1).max(512).refine(isSafeBaseImageRef, {
+      message: "Expected a single Docker/OCI image reference"
+    })
+  }).strict()
+]);
+var StoredEnvironmentImageSchema = external_exports.discriminatedUnion("kind", [
+  external_exports.object({
+    kind: external_exports.literal("preset"),
+    name: external_exports.string().trim().min(1)
+  }).strict(),
+  external_exports.object({
+    kind: external_exports.literal("base"),
+    ref: external_exports.string().trim().min(1).refine(isSafeBaseImageRef, {
+      message: "Expected a single Docker/OCI image reference"
+    })
+  }).strict()
+]);
+var ENVIRONMENT_APPROVALS_MODES = ["bypass", "prompt"];
+var EnvironmentApprovalsSchema = external_exports.enum(ENVIRONMENT_APPROVALS_MODES);
+var EnvironmentSetupSchema = environmentSetupSchema(
+  StoredEnvironmentSetupCachePathSchema
+);
+var EnvironmentApplySetupSchema = environmentSetupSchema(
+  EnvironmentSetupCachePathSchema
+);
+var EnvironmentSetupCacheSchema = external_exports.object({
+  ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
+    message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
+  })
+}).strict();
+var EnvironmentResourcesSchema = external_exports.object({
+  cpuCount: external_exports.number().int().min(1).optional(),
+  memoryMB: external_exports.number().int().min(128).optional()
+}).strict().refine(
+  (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
+  {
+    message: "Expected at least one runtime resource setting"
+  }
+);
+var EnvironmentSpecSchema = environmentSpecSchema({
+  imageSchema: StoredEnvironmentImageSchema,
+  setupSchema: EnvironmentSetupSchema
+});
+var EnvironmentApplySpecSchema = environmentSpecSchema({
+  imageSchema: EnvironmentImageSchema,
+  setupSchema: EnvironmentApplySetupSchema
+});
+var EnvironmentCandidateSpecSchema = EnvironmentApplySpecSchema;
+var EnvironmentResourceSchema = resourceEnvelopeSchema(
+  EnvironmentSpecSchema
+);
+var EnvironmentApplyRequestSchema = resourceApplySchema(
+  EnvironmentApplySpecSchema
+);
+function environmentSetupSchema(cachePathSchema) {
+  return external_exports.object({
+    name: ResourceNameSchema,
+    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
+    cache: external_exports.object({
+      key: ResourceNameSchema.optional(),
+      files: external_exports.array(
+        external_exports.string().trim().refine(isSafeRelativePath, {
+          message: "Expected a relative path without traversal"
+        })
+      ).default([]),
+      paths: external_exports.array(cachePathSchema).default([])
+    }).strict().default({ files: [], paths: [] })
+  }).strict();
+}
+function environmentSpecSchema({
+  imageSchema,
+  setupSchema
+}) {
+  return external_exports.object({
+    image: imageSchema,
+    env: SecretEnvSchema.default({}),
+    resources: EnvironmentResourcesSchema.optional(),
+    steps: external_exports.array(external_exports.string()).default([]),
+    setup: external_exports.array(setupSchema).default([]),
+    setupCache: EnvironmentSetupCacheSchema.optional(),
+    // Optional rather than defaulted: a default would materialize the key
+    // into stored specs and session environment snapshots the moment the web
+    // app deploys, and this strict schema on a not-yet-deployed worker would
+    // reject those rows (web and workers do not deploy atomically). Absent
+    // means `bypass`; consumers default at the read boundary.
+    approvals: EnvironmentApprovalsSchema.optional()
+  }).strict();
+}
+function isSafeSandboxUserHomePath(value2, options = {}) {
+  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
+    (home) => isSafePathUnderHome(value2, home)
+  );
+}
+function isSafePathUnderHome(value2, home) {
+  const prefix = `${home}/`;
+  if (!value2.startsWith(prefix)) {
+    return false;
+  }
+  const relative2 = value2.slice(prefix.length);
+  return relative2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeRelativePath(value2) {
+  if (!value2 || value2.startsWith("/")) {
+    return false;
+  }
+  return value2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
+}
+function isSafeBaseImageRef(value2) {
+  return !value2.startsWith("-") && /^[^\s#\\]+$/.test(value2);
+}
+function isSetupCacheTtl(value2) {
+  return /^[1-9][0-9]*(s|m|h|d)$/.test(value2);
+}
+
+// ../../packages/schemas/src/hosted-runtimes.ts
+var HOSTED_RUNTIME_STATUSES = [
+  "queued",
+  "provisioning",
+  "running",
+  "closing",
+  "closed"
+];
+var HOSTED_RUNTIME_OUTCOMES = [
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var HOSTED_RUNTIME_COMMAND_STATUSES = [
+  "pending",
+  "running",
+  "succeeded",
+  "failed",
+  "cancelled"
+];
+var HOSTED_RUNTIME_CLOSE_REASONS = [
+  "completed",
+  "command_failed",
+  "provision_failed",
+  "requested",
+  "internal_error"
+];
+var HOSTED_RUNTIME_MAX_COMMAND_BUDGET_SECONDS = 45 * 60;
+var HostedRuntimeEnvironmentInputSchema = external_exports.discriminatedUnion(
+  "kind",
+  [
+    external_exports.object({
+      kind: external_exports.literal("inline"),
+      spec: EnvironmentCandidateSpecSchema
+    }).strict(),
+    external_exports.object({
+      kind: external_exports.literal("applied"),
+      name: ResourceNameSchema
+    }).strict()
+  ]
+);
+var HostedRuntimeEnvironmentSourceSchema = external_exports.discriminatedUnion(
+  "kind",
+  [
+    external_exports.object({ kind: external_exports.literal("inline") }).strict(),
+    external_exports.object({
+      kind: external_exports.literal("applied"),
+      name: ResourceNameSchema,
+      resourceId: external_exports.string().trim().min(1),
+      generation: external_exports.number().int().positive()
+    }).strict()
+  ]
+);
+var HostedRuntimeEnvironmentSnapshotSchema = external_exports.object({
+  source: HostedRuntimeEnvironmentSourceSchema,
+  spec: EnvironmentSpecSchema
+}).strict();
+var HostedRuntimeCommandInputSchema = external_exports.object({
+  command: external_exports.string().trim().min(1).max(4096),
+  timeoutSeconds: external_exports.number().int().min(1).max(300).default(60)
+}).strict();
+var HostedRuntimeIdempotencyKeySchema = external_exports.string().trim().min(1).max(200);
+var CreateHostedRuntimeRequestSchema = external_exports.object({
+  environment: HostedRuntimeEnvironmentInputSchema,
+  commands: external_exports.array(HostedRuntimeCommandInputSchema).min(1).max(20)
+}).strict().superRefine((request, context) => {
+  const totalTimeoutSeconds = request.commands.reduce(
+    (total, command) => total + command.timeoutSeconds,
+    0
+  );
+  if (totalTimeoutSeconds > HOSTED_RUNTIME_MAX_COMMAND_BUDGET_SECONDS) {
+    context.addIssue({
+      code: "custom",
+      message: `Total command timeout must not exceed ${HOSTED_RUNTIME_MAX_COMMAND_BUDGET_SECONDS} seconds`,
+      path: ["commands"]
+    });
+  }
+});
+var HostedRuntimeStatusSchema = external_exports.enum(HOSTED_RUNTIME_STATUSES);
+var HostedRuntimeOutcomeSchema = external_exports.enum(HOSTED_RUNTIME_OUTCOMES);
+var HostedRuntimeCommandStatusSchema = external_exports.enum(
+  HOSTED_RUNTIME_COMMAND_STATUSES
+);
+var HostedRuntimeCloseReasonSchema = external_exports.enum(
+  HOSTED_RUNTIME_CLOSE_REASONS
+);
+var HostedRuntimeCommandRecordSchema = external_exports.object({
+  ordinal: external_exports.number().int().positive(),
+  command: external_exports.string(),
+  timeoutSeconds: external_exports.number().int().positive(),
+  status: HostedRuntimeCommandStatusSchema,
+  startedAt: external_exports.string().datetime().nullable(),
+  finishedAt: external_exports.string().datetime().nullable(),
+  durationMs: external_exports.number().int().nonnegative().nullable(),
+  exitCode: external_exports.number().int().nullable(),
+  stdout: external_exports.string().nullable(),
+  stderr: external_exports.string().nullable(),
+  error: external_exports.string().nullable()
+}).strict();
+var HostedRuntimeRecordSchema = external_exports.object({
+  id: RuntimeIdSchema2,
+  status: HostedRuntimeStatusSchema,
+  outcome: HostedRuntimeOutcomeSchema.nullable(),
+  environment: HostedRuntimeEnvironmentSourceSchema,
+  commands: external_exports.array(HostedRuntimeCommandRecordSchema),
+  error: external_exports.string().nullable(),
+  closeReason: HostedRuntimeCloseReasonSchema.nullable(),
+  closeRequestedAt: external_exports.string().datetime().nullable(),
+  startedAt: external_exports.string().datetime().nullable(),
+  finishedAt: external_exports.string().datetime().nullable(),
+  createdAt: external_exports.string().datetime(),
+  updatedAt: external_exports.string().datetime()
+}).strict();
+var HostedRuntimeDispatchStatusSchema = external_exports.enum([
+  "started",
+  "deferred"
+]);
+var HostedRuntimeReceiptSchema = external_exports.object({
+  runtime: HostedRuntimeRecordSchema,
+  workflowId: external_exports.string().trim().min(1),
+  dispatchStatus: HostedRuntimeDispatchStatusSchema
+}).strict();
+var HostedRuntimeWorkflowInputSchema = external_exports.object({ runtimeId: RuntimeIdSchema2 }).strip();
+
 // ../../packages/schemas/src/session-bindings.ts
 var BINDING_TARGET_TYPES = [
   "github.pull_request",
@@ -43980,145 +44247,6 @@ var IdentitySpecSchema = AgentIdentitySchema;
 var IdentityResourceSchema = resourceEnvelopeSchema(IdentitySpecSchema);
 var IdentityApplyRequestSchema = resourceApplySchema(IdentitySpecSchema);
 
-// ../../packages/schemas/src/environments.ts
-var RESOURCE_KIND_ENVIRONMENT = "environment";
-var CURRENT_SANDBOX_USER_HOME = "/home/user";
-var LEGACY_SANDBOX_USER_HOMES = ["/home/auto", "/home/node"];
-var STORED_SANDBOX_USER_HOMES = [
-  CURRENT_SANDBOX_USER_HOME,
-  ...LEGACY_SANDBOX_USER_HOMES
-];
-var EnvironmentSetupCachePathSchema = external_exports.string().trim().refine((value2) => isSafeSandboxUserHomePath(value2), {
-  message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-});
-var StoredEnvironmentSetupCachePathSchema = external_exports.string().trim().refine(
-  (value2) => isSafeSandboxUserHomePath(value2, {
-    allowedHomes: STORED_SANDBOX_USER_HOMES
-  }),
-  {
-    message: `Expected an absolute path under ${CURRENT_SANDBOX_USER_HOME}`
-  }
-);
-var EnvironmentImageSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({
-    kind: external_exports.literal("preset"),
-    name: ResourceNameSchema
-  }).strict(),
-  external_exports.object({
-    kind: external_exports.literal("base"),
-    ref: external_exports.string().trim().min(1).max(512).refine(isSafeBaseImageRef, {
-      message: "Expected a single Docker/OCI image reference"
-    })
-  }).strict()
-]);
-var StoredEnvironmentImageSchema = external_exports.discriminatedUnion("kind", [
-  external_exports.object({
-    kind: external_exports.literal("preset"),
-    name: external_exports.string().trim().min(1)
-  }).strict(),
-  external_exports.object({
-    kind: external_exports.literal("base"),
-    ref: external_exports.string().trim().min(1).refine(isSafeBaseImageRef, {
-      message: "Expected a single Docker/OCI image reference"
-    })
-  }).strict()
-]);
-var ENVIRONMENT_APPROVALS_MODES = ["bypass", "prompt"];
-var EnvironmentApprovalsSchema = external_exports.enum(ENVIRONMENT_APPROVALS_MODES);
-var EnvironmentSetupSchema = environmentSetupSchema(
-  StoredEnvironmentSetupCachePathSchema
-);
-var EnvironmentApplySetupSchema = environmentSetupSchema(
-  EnvironmentSetupCachePathSchema
-);
-var EnvironmentSetupCacheSchema = external_exports.object({
-  ttl: external_exports.string().trim().refine(isSetupCacheTtl, {
-    message: "Expected a positive setup cache TTL such as 30m, 24h, or 7d"
-  })
-}).strict();
-var EnvironmentResourcesSchema = external_exports.object({
-  cpuCount: external_exports.number().int().min(1).optional(),
-  memoryMB: external_exports.number().int().min(128).optional()
-}).strict().refine(
-  (resources) => resources.cpuCount !== void 0 || resources.memoryMB !== void 0,
-  {
-    message: "Expected at least one runtime resource setting"
-  }
-);
-var EnvironmentSpecSchema = environmentSpecSchema({
-  imageSchema: StoredEnvironmentImageSchema,
-  setupSchema: EnvironmentSetupSchema
-});
-var EnvironmentApplySpecSchema = environmentSpecSchema({
-  imageSchema: EnvironmentImageSchema,
-  setupSchema: EnvironmentApplySetupSchema
-});
-var EnvironmentResourceSchema = resourceEnvelopeSchema(
-  EnvironmentSpecSchema
-);
-var EnvironmentApplyRequestSchema = resourceApplySchema(
-  EnvironmentApplySpecSchema
-);
-function environmentSetupSchema(cachePathSchema) {
-  return external_exports.object({
-    name: ResourceNameSchema,
-    commands: external_exports.array(external_exports.string().trim().min(1)).min(1),
-    cache: external_exports.object({
-      key: ResourceNameSchema.optional(),
-      files: external_exports.array(
-        external_exports.string().trim().refine(isSafeRelativePath, {
-          message: "Expected a relative path without traversal"
-        })
-      ).default([]),
-      paths: external_exports.array(cachePathSchema).default([])
-    }).strict().default({ files: [], paths: [] })
-  }).strict();
-}
-function environmentSpecSchema({
-  imageSchema,
-  setupSchema
-}) {
-  return external_exports.object({
-    image: imageSchema,
-    env: SecretEnvSchema.default({}),
-    resources: EnvironmentResourcesSchema.optional(),
-    steps: external_exports.array(external_exports.string()).default([]),
-    setup: external_exports.array(setupSchema).default([]),
-    setupCache: EnvironmentSetupCacheSchema.optional(),
-    // Optional rather than defaulted: a default would materialize the key
-    // into stored specs and session environment snapshots the moment the web
-    // app deploys, and this strict schema on a not-yet-deployed worker would
-    // reject those rows (web and workers do not deploy atomically). Absent
-    // means `bypass`; consumers default at the read boundary.
-    approvals: EnvironmentApprovalsSchema.optional()
-  }).strict();
-}
-function isSafeSandboxUserHomePath(value2, options = {}) {
-  return (options.allowedHomes ?? [CURRENT_SANDBOX_USER_HOME]).some(
-    (home) => isSafePathUnderHome(value2, home)
-  );
-}
-function isSafePathUnderHome(value2, home) {
-  const prefix = `${home}/`;
-  if (!value2.startsWith(prefix)) {
-    return false;
-  }
-  const relative2 = value2.slice(prefix.length);
-  return relative2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeRelativePath(value2) {
-  if (!value2 || value2.startsWith("/")) {
-    return false;
-  }
-  return value2.split("/").every((segment) => segment !== "" && segment !== "." && segment !== "..");
-}
-function isSafeBaseImageRef(value2) {
-  return !value2.startsWith("-") && /^[^\s#\\]+$/.test(value2);
-}
-function isSetupCacheTtl(value2) {
-  return /^[1-9][0-9]*(s|m|h|d)$/.test(value2);
-}
-
 // ../../packages/schemas/src/environment-setup-failures.ts
 var EnvironmentSetupStepFailureDiagnosticSchema = external_exports.object({
   kind: external_exports.literal("environment_setup_step_failure"),
@@ -83225,9 +83353,170 @@ var defaultDownload2 = createDownload();
 
 // src/commands/agent-bridge/harness/envelope-bounds.ts
 import { Buffer as Buffer2 } from "buffer";
+
+// src/commands/agent-bridge/harness/mcp-result-canonicalization.ts
+function canonicalizeEnvelopeMcpResults(envelope) {
+  switch (envelope.type) {
+    case "conversation.entry": {
+      const content = canonicalizeMcpResultValue(envelope.content);
+      return toCanonicalizedEnvelope(
+        envelope,
+        { ...envelope, content: content.value },
+        content.deduplicatedBranches
+      );
+    }
+    case "conversation.delta": {
+      const delta = canonicalizeMcpResultValue(envelope.delta);
+      return toCanonicalizedEnvelope(
+        envelope,
+        { ...envelope, delta: delta.value },
+        delta.deduplicatedBranches
+      );
+    }
+    case "ui.message.chunk": {
+      const chunk = canonicalizeMcpResultValue(envelope.chunk);
+      return toCanonicalizedEnvelope(
+        envelope,
+        { ...envelope, chunk: chunk.value },
+        chunk.deduplicatedBranches
+      );
+    }
+    case "ui.message.part": {
+      const part = canonicalizeMcpResultValue(envelope.part);
+      const metadata = canonicalizeMcpResultValue(envelope.messageMetadata);
+      const deduplicatedBranches = part.deduplicatedBranches + metadata.deduplicatedBranches;
+      return toCanonicalizedEnvelope(
+        envelope,
+        {
+          ...envelope,
+          part: part.value,
+          ...envelope.messageMetadata === void 0 ? {} : { messageMetadata: metadata.value }
+        },
+        deduplicatedBranches
+      );
+    }
+    case "ui.message.completed": {
+      const message = canonicalizeMcpResultValue(envelope.message);
+      return toCanonicalizedEnvelope(
+        envelope,
+        { ...envelope, message: message.value },
+        message.deduplicatedBranches
+      );
+    }
+    case "runtime.liveness":
+    case "runtime.usage_turn":
+      return { value: envelope, deduplicatedBranches: 0 };
+  }
+}
+function toCanonicalizedEnvelope(original, candidate, deduplicatedBranches) {
+  return {
+    value: deduplicatedBranches > 0 ? RuntimeBridgeOutputEnvelopeSchema.parse(candidate) : original,
+    deduplicatedBranches
+  };
+}
+function canonicalizeMcpResultValue(value2) {
+  if (Array.isArray(value2)) {
+    let deduplicatedBranches2 = 0;
+    let changed2 = false;
+    const items = value2.map((item) => {
+      const canonical2 = canonicalizeMcpResultValue(item);
+      deduplicatedBranches2 += canonical2.deduplicatedBranches;
+      changed2 ||= canonical2.value !== item;
+      return canonical2.value;
+    });
+    return {
+      value: changed2 ? items : value2,
+      deduplicatedBranches: deduplicatedBranches2
+    };
+  }
+  if (typeof value2 !== "object" || value2 === null) {
+    return { value: value2, deduplicatedBranches: 0 };
+  }
+  const record2 = value2;
+  const duplicateContentIndexes = equivalentMcpTextContentIndexes(record2);
+  let deduplicatedBranches = duplicateContentIndexes.size;
+  let changed = duplicateContentIndexes.size > 0;
+  const canonical = /* @__PURE__ */ Object.create(null);
+  for (const [key, item] of Object.entries(record2)) {
+    if (key === "content" && Array.isArray(item)) {
+      const retainedContent = duplicateContentIndexes.size > 0 ? item.filter(
+        (_contentItem, index) => !duplicateContentIndexes.has(index)
+      ) : item;
+      if (retainedContent.length === 0 && duplicateContentIndexes.size > 0) {
+        continue;
+      }
+      const content = canonicalizeMcpResultValue(retainedContent);
+      canonical[key] = content.value;
+      deduplicatedBranches += content.deduplicatedBranches;
+      changed ||= content.value !== item;
+      continue;
+    }
+    const child = canonicalizeMcpResultValue(item);
+    canonical[key] = child.value;
+    deduplicatedBranches += child.deduplicatedBranches;
+    changed ||= child.value !== item;
+  }
+  return {
+    value: changed ? canonical : value2,
+    deduplicatedBranches
+  };
+}
+function equivalentMcpTextContentIndexes(value2) {
+  if (!Array.isArray(value2.content) || !Object.hasOwn(value2, "structuredContent") || value2.structuredContent === void 0) {
+    return /* @__PURE__ */ new Set();
+  }
+  const indexes = /* @__PURE__ */ new Set();
+  for (const [index, item] of value2.content.entries()) {
+    if (!isPlainMcpTextBlock(item)) {
+      continue;
+    }
+    const parsed = parseJson(item.text);
+    if (parsed.parsed && jsonValuesEqual(parsed.value, value2.structuredContent)) {
+      indexes.add(index);
+    }
+  }
+  return indexes;
+}
+function isPlainMcpTextBlock(value2) {
+  if (typeof value2 !== "object" || value2 === null || Array.isArray(value2)) {
+    return false;
+  }
+  const record2 = value2;
+  const keys = Object.keys(record2);
+  return keys.length === 2 && record2.type === "text" && typeof record2.text === "string";
+}
+function parseJson(value2) {
+  try {
+    return { parsed: true, value: JSON.parse(value2) };
+  } catch {
+    return { parsed: false, value: null };
+  }
+}
+function jsonValuesEqual(left, right) {
+  if (Object.is(left, right)) {
+    return true;
+  }
+  if (Array.isArray(left) || Array.isArray(right)) {
+    if (!Array.isArray(left) || !Array.isArray(right)) {
+      return false;
+    }
+    return left.length === right.length && left.every((item, index) => jsonValuesEqual(item, right[index]));
+  }
+  if (typeof left !== "object" || left === null || typeof right !== "object" || right === null) {
+    return false;
+  }
+  const leftRecord = left;
+  const rightRecord = right;
+  const leftKeys = Object.keys(leftRecord);
+  const rightKeys = Object.keys(rightRecord);
+  return leftKeys.length === rightKeys.length && leftKeys.every(
+    (key) => Object.hasOwn(rightRecord, key) && jsonValuesEqual(leftRecord[key], rightRecord[key])
+  );
+}
+
+// src/commands/agent-bridge/harness/envelope-bounds.ts
 var AGENT_BRIDGE_OUTPUT_MAX_ENVELOPE_BYTES = 512 * 1024;
 var AGENT_BRIDGE_OUTPUT_QUARANTINE_MAX_ENVELOPE_BYTES = 8 * 1024;
-var MAX_TARGETED_PAYLOAD_NOTICES = 4;
 var PAYLOAD_FIELD_RULES = {
   output: { label: "tool output", priority: 0 },
   errorText: { label: "tool error", priority: 0 },
@@ -83262,48 +83551,97 @@ var STRUCTURAL_STRING_FIELDS = /* @__PURE__ */ new Set([
   "completedAt"
 ]);
 function boundOutputEnvelope(envelope, maxBytes = AGENT_BRIDGE_OUTPUT_MAX_ENVELOPE_BYTES) {
-  const originalBytes = serializedByteLength(envelope);
+  const original = envelopeSerializationInfo(envelope);
+  const originalBytes = original.bytes;
   if (originalBytes <= maxBytes) {
-    return { envelope, originalBytes, truncated: false };
+    return {
+      envelope,
+      originalBytes,
+      boundedBytes: originalBytes,
+      kind: "none",
+      deduplicatedMcpResultBranches: 0,
+      truncated: false
+    };
   }
-  const targeted = truncatePayloads(envelope, maxBytes);
+  const canonicalized = original.hasStructuredContent ? canonicalizeEnvelopeMcpResults(envelope) : { value: envelope, deduplicatedBranches: 0 };
+  const canonicalEnvelope = canonicalized.value;
+  const canonicalBytes = serializedByteLength(canonicalEnvelope);
+  if (canonicalBytes <= maxBytes) {
+    return {
+      envelope: canonicalEnvelope,
+      originalBytes,
+      boundedBytes: canonicalBytes,
+      kind: "mcp-result-deduplicated",
+      deduplicatedMcpResultBranches: canonicalized.deduplicatedBranches,
+      truncated: true
+    };
+  }
+  const targeted = truncatePayloads(canonicalEnvelope, maxBytes);
   if (targeted) {
+    const boundedEnvelope = RuntimeBridgeOutputEnvelopeSchema.parse(targeted);
     return {
-      envelope: RuntimeBridgeOutputEnvelopeSchema.parse(targeted),
+      envelope: boundedEnvelope,
       originalBytes,
+      boundedBytes: serializedByteLength(boundedEnvelope),
+      kind: canonicalized.deduplicatedBranches > 0 ? "mcp-result-deduplicated+targeted-truncation" : "targeted-truncation",
+      deduplicatedMcpResultBranches: canonicalized.deduplicatedBranches,
       truncated: true
     };
   }
+  const fallbackEnvelope = RuntimeBridgeOutputEnvelopeSchema.parse(
+    replacePayloadWithMarker(canonicalEnvelope)
+  );
   return {
-    envelope: RuntimeBridgeOutputEnvelopeSchema.parse(
-      replacePayloadWithMarker(envelope)
-    ),
+    envelope: fallbackEnvelope,
     originalBytes,
+    boundedBytes: serializedByteLength(fallbackEnvelope),
+    kind: canonicalized.deduplicatedBranches > 0 ? "mcp-result-deduplicated+payload-fallback" : "payload-fallback",
+    deduplicatedMcpResultBranches: canonicalized.deduplicatedBranches,
     truncated: true
   };
 }
 function truncatePayloads(envelope, maxBytes) {
   const candidateEnvelope = structuredClone(envelope);
   const candidates = collectPayloadCandidates(envelope);
-  for (let noticeCount = 0; noticeCount < MAX_TARGETED_PAYLOAD_NOTICES; noticeCount += 1) {
+  const truncatedCandidates = [];
+  while (true) {
     const currentBytes = serializedByteLength(candidateEnvelope);
     if (currentBytes <= maxBytes) {
       return candidateEnvelope;
     }
     const candidate = takePayloadCandidate(candidates, currentBytes - maxBytes);
     if (!candidate) {
-      return null;
+      break;
     }
     setValueAtPath(
       candidateEnvelope,
       candidate.path,
       truncationNotice(candidate, "")
     );
-    if (serializedByteLength(candidateEnvelope) <= maxBytes) {
+    const truncatedBytes = serializedByteLength(candidateEnvelope);
+    if (truncatedBytes >= currentBytes) {
+      setValueAtPath(candidateEnvelope, candidate.path, candidate.value);
+      continue;
+    }
+    truncatedCandidates.push(candidate);
+    if (truncatedBytes <= maxBytes) {
       maximizePreview(candidateEnvelope, candidate, maxBytes);
       return candidateEnvelope;
     }
   }
+  for (const candidate of truncatedCandidates) {
+    setValueAtPath(
+      candidateEnvelope,
+      candidate.path,
+      compactTruncationNotice(candidate)
+    );
+  }
+  if (serializedByteLength(candidateEnvelope) <= maxBytes) {
+    return candidateEnvelope;
+  }
+  for (const candidate of truncatedCandidates) {
+    setValueAtPath(candidateEnvelope, candidate.path, "");
+  }
   return serializedByteLength(candidateEnvelope) <= maxBytes ? candidateEnvelope : null;
 }
 function collectPayloadCandidates(envelope) {
@@ -83468,10 +83806,20 @@ function truncationNotice(candidate, preview) {
   const separator = preview.length > 0 ? "\n" : "";
   return `${preview}${separator}[agent-bridge ${candidate.label} truncated: original ${candidate.originalBytes} UTF-8 bytes; kept ${keptBytes}; omitted ${omittedBytes}. Omitted content was not persisted in this transcript.]`;
 }
+function compactTruncationNotice(candidate) {
+  return `[agent-bridge ${candidate.label} truncated: original ${candidate.originalBytes} UTF-8 bytes.]`;
+}
 function serializedByteLength(value2) {
   const serialized = JSON.stringify(value2);
   return serialized === void 0 ? 0 : Buffer2.byteLength(serialized, "utf8");
 }
+function envelopeSerializationInfo(envelope) {
+  const serialized = JSON.stringify(envelope);
+  return {
+    bytes: Buffer2.byteLength(serialized, "utf8"),
+    hasStructuredContent: serialized.includes('"structuredContent":')
+  };
+}
 function replacePayloadWithMarker(envelope) {
   switch (envelope.type) {
     case "conversation.entry": {
@@ -84432,6 +84780,9 @@ var AgentBridgeOutputBuffer = class {
         "agent_bridge_output_envelope_truncated",
         this.outputLogContext(bounded.envelope, {
           original_bytes: bounded.originalBytes,
+          bounded_bytes: bounded.boundedBytes,
+          bound_kind: bounded.kind,
+          deduplicated_mcp_result_branches: bounded.deduplicatedMcpResultBranches,
           pending_count: this.pendingOutputs.size
         })
       );
@@ -84465,6 +84816,9 @@ var AgentBridgeOutputBuffer = class {
       this.outputLogContext(bounded.envelope, {
         exhausts,
         original_bytes: bounded.originalBytes,
+        bounded_bytes: bounded.boundedBytes,
+        bound_kind: bounded.kind,
+        deduplicated_mcp_result_branches: bounded.deduplicatedMcpResultBranches,
         truncated: bounded.truncated,
         pending_count: this.pendingOutputs.size
       })