@code-yeongyu/senpi 2026.11.2-3 → 2026.11.3-2

package/dist/core/dynamic-prompt/verification.js

@@ -3,32 +3,32 @@ export const TEST_DISCIPLINE_RULES = [
     {
         id: "deterministic-tests",
         concern: "test-determinism",
-        directive: "When you read or edit test code, treat nondeterminism as a bug; tests must not pass by timing luck.",
+        directive: "Reading/editing test code: nondeterminism = bug; no passing by timing luck.",
     },
     {
         id: "fixed-wait-ban",
         concern: "async-test-orchestration",
-        directive: "Unless time itself is the behavior under test, fixed sleeps, polling delays, and wait-for-time patterns are forbidden.",
+        directive: "Fixed sleeps, polling delays, wait-for-time: forbidden unless time itself is under test.",
     },
     {
         id: "event-timeout-pattern",
         concern: "async-test-orchestration",
-        directive: "For async behavior, subscribe to the exact event or state change before triggering the action, then await that signal with a bounded timeout.",
+        directive: "Async: subscribe to the exact event/state change before triggering, then await it with a bounded timeout.",
     },
     {
         id: "mock-contract-integrity",
         concern: "mock-contracts",
-        directive: "Mocks must preserve the behavior being asserted; do not isolate so heavily that the integration under test cannot fail.",
+        directive: "Mocks keep the asserted behavior; never isolate so hard the integration cannot fail.",
     },
     {
         id: "prompt-behavior-coverage",
         concern: "prompt-tests",
-        directive: "Never pin prose, prompt wording, or doc text with a test; test only machine-consumed values (parsed fields, sentinel tokens, shipped-copy equality). A pure-prose change ships with no new test.",
+        directive: "Never pin prose, prompt wording, or doc text with a test; test machine-consumed values only (parsed fields, sentinel tokens, shipped-copy equality). Pure-prose change = no new test.",
     },
     {
         id: "single-pass-runner",
         concern: "test-runner",
-        directive: "Run the relevant test command once and make that pass reliable; for Bun test targets, bun test must pass in a single run.",
+        directive: "Run the relevant test command once, make that pass reliable; Bun targets: bun test passes in a single run.",
     },
 ];
 export function buildTestDisciplineSection() {
@@ -44,20 +44,20 @@ export function buildTestDisciplineSection() {
  */
 export const APP_UNRUN_CHECK_RULE = "A check that did not run is covered by the evidence that did run; name it only when no other evidence supports the claim. Replies render in an app, so tool and hook feedback (comment-checker findings, language-server availability, internal notices) is for you to act on: it reaches the user only when it changes what they get, and an unavailable tool or hook never does by itself.";
 const CLAIM_AUDIT = {
-    terminal: "report only evidence-backed work, flag the unverified explicitly, and report failing tests with the output.",
-    app: `report only evidence-backed work and report failing tests with the output. ${APP_UNRUN_CHECK_RULE}`,
+    terminal: "evidence-backed work only, flag unverified explicitly, failing tests with output.",
+    app: `evidence-backed work only, failing tests with output. ${APP_UNRUN_CHECK_RULE}`,
 };
 export function buildVerificationSection(options = {}) {
     return `## Verification
 
 Tier the scope, never the rigor.
 
-- V1 (single-file non-behavioral edits): diagnostics on that file. Done.
-- V2 (single-domain behavioral edits): diagnostics on changed files in parallel, related tests, one execution of the affected runnable entry point when one exists.
-- V3 (multi-file or cross-cutting work): diagnostics on every changed file, related tests, build, manual exercise of user-visible behavior through its real surface.
+- V1 single-file non-behavioral edit: diagnostics on that file. Done.
+- V2 single-domain behavioral edit: diagnostics on changed files in parallel + related tests + one run of affected runnable entry point if any.
+- V3 multi-file / cross-cutting: diagnostics on every changed file + related tests + build + manual exercise of user-visible behavior through its real surface.
 
 ${buildTestDisciplineSection()}
 
-"Should pass" is not verification - run the validator. Before reporting progress, audit each claim against a tool result from this session: ${CLAIM_AUDIT[terminalOrApp(options.surface ?? "terminal")]} Fix only issues your changes caused; note pre-existing failures separately.`;
+Before reporting progress: audit each claim against a tool result from this session; ${CLAIM_AUDIT[terminalOrApp(options.surface ?? "terminal")]} Fix only issues your changes caused; note pre-existing failures separately.`;
 }
 //# sourceMappingURL=verification.js.map

package/dist/core/dynamic-prompt/working-task.d.ts

@@ -1,4 +1,4 @@
-export declare const DEFAULT_WORKING_TASK_OPENING = "Fire independent tool calls as one parallel wave - reads, searches, listings, diagnostics - and bias toward breadth when context is thin: pull in anything even loosely relevant now instead of serially later. Wasted reads cost almost nothing; stale assumptions cost the turn. Edits and result-dependent calls go one at a time, each compared with the state you meant to produce; when the result must be seen rather than read, render after each change and look before the next. Never fill missing parameters with placeholders.";
+export declare const DEFAULT_WORKING_TASK_OPENING = "Independent calls (reads, searches, listings, diagnostics) -> one parallel wave; thin context -> go wide now, pull anything loosely relevant, not serially later. Edits + result-dependent calls -> one at a time, each compared with intended state; result must be seen -> render after each change, look before next. Never fill missing parameters with placeholders.";
 export declare function buildWorkingTaskSection(options?: {
     opening?: string;
 }): string;

package/dist/core/dynamic-prompt/working-task.js

@@ -1,11 +1,11 @@
-export const DEFAULT_WORKING_TASK_OPENING = "Fire independent tool calls as one parallel wave - reads, searches, listings, diagnostics - and bias toward breadth when context is thin: pull in anything even loosely relevant now instead of serially later. Wasted reads cost almost nothing; stale assumptions cost the turn. Edits and result-dependent calls go one at a time, each compared with the state you meant to produce; when the result must be seen rather than read, render after each change and look before the next. Never fill missing parameters with placeholders.";
+export const DEFAULT_WORKING_TASK_OPENING = "Independent calls (reads, searches, listings, diagnostics) -> one parallel wave; thin context -> go wide now, pull anything loosely relevant, not serially later. Edits + result-dependent calls -> one at a time, each compared with intended state; result must be seen -> render after each change, look before next. Never fill missing parameters with placeholders.";
 export function buildWorkingTaskSection(options = {}) {
     return `## Working the Task
 
 ${options.opening ?? DEFAULT_WORKING_TASK_OPENING}
 
-Memory of file contents is unreliable - read before claiming, re-read before editing. Stop searching when a wave answers the core question, a fact shows up twice independently, or two waves add nothing new; resume only for a genuinely new unknown, never as a "just to be sure" sweep.
+Memory of file contents unreliable: read before claiming, re-read before editing. Stop searching when a wave answers the core question, a fact appears twice independently, or two waves add nothing; resume only for a genuinely new unknown, never a "just to be sure" sweep.
 
-Make one reasonable plan and execute it; reopen it only when new evidence contradicts it. Do not re-derive facts already established in the conversation or re-litigate decisions the user has made. When weighing a choice, give a recommendation, not a survey. When a delegation tool is available, hand sizeable independent tracks to subagents and keep working while they run; keep work you can finish in a few calls yourself.`;
+One reasonable plan, execute; reopen only when new evidence contradicts it. Don't re-derive established facts or re-litigate user decisions. Weighing a choice -> recommendation, not survey. Delegation tool available: hand sizeable independent tracks to subagents, keep working meanwhile; few-call work -> yourself.`;
 }
 //# sourceMappingURL=working-task.js.map

package/dist/core/dynamic-prompt/workstation.js

@@ -131,7 +131,7 @@ ${executors} on THIS workstation. Match commands, paths, package managers, and p
     codex: (executors) => `${executors} on this workstation; match commands, paths, and parallelism to it. Written code may target other platforms: executed code runs here.`,
     kimi: (executors) => `${executors} on this workstation: choose commands, paths, and parallelism that fit it. When writing code for another target platform, keep the code portable; only the execution happens here.`,
     gemini: (executors) => `${executors} on this workstation; match commands, paths, package managers, and parallel pool sizes to it. Code you write may target another machine; code you run always runs here.`,
-    default: (executors) => `**EXECUTION HAPPENS HERE.** ${executors} on THIS machine: you MUST match commands, paths, package managers, and parallel pool sizes to the workstation above. Code you WRITE may target a different machine; anything you RUN executes HERE.`,
+    default: (executors) => `**EXECUTION HAPPENS HERE.** ${executors} on THIS machine: match commands, paths, package managers, parallel pool sizes to the workstation above. Code you WRITE may target another machine; anything you RUN executes HERE.`,
 };
 /** Render the `<workstation>` facts block plus the dialect-tuned execution-context instruction. */
 export function buildWorkstationSection(options) {

package/dist/core/execution/executor-body.d.ts

@@ -0,0 +1,22 @@
+import type { AgentContext, AgentTool, AgentToolCall, AgentToolResult, AgentToolUpdateCallback } from "@earendil-works/pi-agent-core";
+import type { AssistantMessage } from "@earendil-works/pi-ai";
+import type { PreparationPipeline } from "./executor-types.ts";
+/** What release needs from preparation; it lives in memory with the executor that prepared the call. */
+export interface PreparedBody {
+    readonly tool: AgentTool;
+    readonly toolCall: AgentToolCall;
+    readonly args: unknown;
+    readonly assistantMessage: AssistantMessage;
+    readonly context: AgentContext;
+    /** The model's own name when it resolved to another tool; today's result carries a correction notice for it. */
+    readonly requestedName?: string;
+}
+export interface BodyOutcome {
+    readonly result: AgentToolResult<unknown>;
+    readonly isError: boolean;
+}
+export declare function errorResult(message: string): AgentToolResult<unknown>;
+export declare function messageOf(error: unknown): string;
+export declare function runBody(body: PreparedBody, signal: AbortSignal | undefined, onUpdate: AgentToolUpdateCallback<unknown>): Promise<BodyOutcome>;
+export declare function finalizeBody(body: PreparedBody, executed: BodyOutcome, pipeline: PreparationPipeline, signal: AbortSignal | undefined): Promise<BodyOutcome>;
+//# sourceMappingURL=executor-body.d.ts.map

package/dist/core/execution/executor-body.js

@@ -0,0 +1,73 @@
+export function errorResult(message) {
+    return { content: [{ type: "text", text: message }], details: {} };
+}
+export function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+const ABORTED = Symbol("aborted");
+// Today's body semantics (agent-loop `executePreparedToolCall`): an abort releases the wait even when the tool never
+// settles, and updates stop at settlement.
+export async function runBody(body, signal, onUpdate) {
+    const updates = [];
+    let accepting = true;
+    try {
+        const execution = body.tool.execute(body.toolCall.id, body.args, signal, (partial) => {
+            if (accepting)
+                updates.push(Promise.resolve(onUpdate(partial)));
+        });
+        const aborted = signal === undefined
+            ? undefined
+            : new Promise((resolve) => {
+                if (signal.aborted)
+                    resolve(ABORTED);
+                else
+                    signal.addEventListener("abort", () => resolve(ABORTED), { once: true });
+            });
+        const settled = aborted ? await Promise.race([execution, aborted]) : await execution;
+        accepting = false;
+        await Promise.all(updates);
+        if (settled === ABORTED) {
+            void Promise.resolve(execution).catch(() => undefined);
+            return { result: errorResult("Tool execution aborted"), isError: true };
+        }
+        return { result: settled, isError: settled.isError === true };
+    }
+    catch (error) {
+        accepting = false;
+        await Promise.all(updates);
+        return { result: errorResult(messageOf(error)), isError: true };
+    }
+}
+// Today's after-hook merge (agent-loop `finalizeExecutedToolCall`), field by field.
+export async function finalizeBody(body, executed, pipeline, signal) {
+    const { result, isError } = executed;
+    try {
+        const after = await pipeline.afterToolCall({
+            assistantMessage: body.assistantMessage,
+            toolCall: body.toolCall,
+            args: body.args,
+            result,
+            isError,
+            context: body.context,
+        }, signal);
+        if (!after)
+            return executed;
+        const structuredContent = after.structuredContent ?? (after.content ? undefined : result.structuredContent);
+        const merged = {
+            ...result,
+            content: after.content ?? result.content,
+            details: after.details ?? result.details,
+            usage: after.usage ?? result.usage,
+            terminate: after.terminate ?? result.terminate,
+        };
+        if (structuredContent === undefined)
+            delete merged.structuredContent;
+        else
+            merged.structuredContent = structuredContent;
+        return { result: merged, isError: after.isError ?? isError };
+    }
+    catch (error) {
+        return { result: errorResult(messageOf(error)), isError: true };
+    }
+}
+//# sourceMappingURL=executor-body.js.map

package/dist/core/execution/executor-freeze.d.ts

@@ -0,0 +1,17 @@
+import type { AgentToolResult } from "@earendil-works/pi-agent-core";
+import type { FrozenCall, StoreValue } from "@earendil-works/pi-agent-core/conformance";
+import type { PrepareReply } from "./executor-types.ts";
+/** Tool arguments and results are JSON on every model and wire path; a round trip drops what JSON cannot carry. */
+export declare function toStoreValue(value: unknown): StoreValue;
+export declare function digestOf(value: StoreValue): string;
+/** The call after the whole `tool_call` chain, detached from every object a handler or caller still holds. */
+export declare function freezeCall(name: string, args: unknown): FrozenCall;
+/** The durable record of a settled body: what the issuer commits before ACK. Details stay in the in-process reply. */
+export declare function resultValue(result: AgentToolResult<unknown>, isError: boolean, requestedName?: string): StoreValue;
+export type StoppedReply = Extract<PrepareReply, {
+    readonly kind: "blocked" | "batch_abort";
+}>;
+/** A preparation that ended without a frozen call, as the ledger's durable `blocked` outcome value. */
+export declare function stoppedValue(reply: StoppedReply): StoreValue;
+export declare function stoppedReply(value: StoreValue): StoppedReply | undefined;
+//# sourceMappingURL=executor-freeze.d.ts.map

package/dist/core/execution/executor-freeze.js

@@ -0,0 +1,53 @@
+import { createHash } from "node:crypto";
+import { errorResult } from "./executor-body.js";
+function canonical(value) {
+    if (value === null || typeof value !== "object")
+        return JSON.stringify(value);
+    if (Array.isArray(value))
+        return `[${value.map(canonical).join(",")}]`;
+    const entries = Object.entries(value).sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0));
+    return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${canonical(entry)}`).join(",")}}`;
+}
+/** Tool arguments and results are JSON on every model and wire path; a round trip drops what JSON cannot carry. */
+export function toStoreValue(value) {
+    const json = JSON.stringify(value);
+    return json === undefined ? null : JSON.parse(json);
+}
+export function digestOf(value) {
+    return createHash("sha256").update(canonical(value)).digest("hex");
+}
+/** The call after the whole `tool_call` chain, detached from every object a handler or caller still holds. */
+export function freezeCall(name, args) {
+    const frozenArgs = toStoreValue(args);
+    return { name, args: frozenArgs, digest: digestOf({ name, args: frozenArgs }) };
+}
+/** The durable record of a settled body: what the issuer commits before ACK. Details stay in the in-process reply. */
+export function resultValue(result, isError, requestedName) {
+    return toStoreValue({ content: result.content ?? [], isError, requestedName });
+}
+/** A preparation that ended without a frozen call, as the ledger's durable `blocked` outcome value. */
+export function stoppedValue(reply) {
+    const text = (reply.result.content ?? []).map((part) => (part.type === "text" ? part.text : "")).join("");
+    const requestedName = reply.kind === "blocked" ? reply.requestedName : undefined;
+    return toStoreValue({ kind: reply.kind, text, terminate: reply.result.terminate === true, requestedName });
+}
+/** The reply a re-sent prepare gets back from a durable `blocked` outcome; undefined for a value this module never wrote. */
+function isRecord(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+export function stoppedReply(value) {
+    if (!isRecord(value))
+        return undefined;
+    const { kind, text, terminate, requestedName } = value;
+    if (typeof text !== "string" || typeof terminate !== "boolean")
+        return undefined;
+    const result = errorResult(text);
+    if (terminate)
+        result.terminate = true;
+    if (kind === "batch_abort")
+        return { kind, result };
+    if (kind !== "blocked")
+        return undefined;
+    return typeof requestedName === "string" ? { kind, result, requestedName } : { kind, result };
+}
+//# sourceMappingURL=executor-freeze.js.map

package/dist/core/execution/executor-pipeline.d.ts

@@ -0,0 +1,9 @@
+import { type Agent } from "@earendil-works/pi-agent-core";
+import type { PreparationPipeline } from "./executor-types.ts";
+/**
+ * The preparation steps an agent's loop runs today, read from the agent at call time: its resolver (lazy activation),
+ * its `beforeToolCall` / `afterToolCall` (the session's `tool_call` and `tool_result` chains) and its removed-tool
+ * hints. Building this pipeline installs nothing on the agent.
+ */
+export declare function agentPreparationPipeline(agent: Agent): PreparationPipeline;
+//# sourceMappingURL=executor-pipeline.d.ts.map

package/dist/core/execution/executor-pipeline.js

@@ -0,0 +1,25 @@
+import { resolveToolNameAlias } from "@earendil-works/pi-agent-core";
+/**
+ * The preparation steps an agent's loop runs today, read from the agent at call time: its resolver (lazy activation),
+ * its `beforeToolCall` / `afterToolCall` (the session's `tool_call` and `tool_result` chains) and its removed-tool
+ * hints. Building this pipeline installs nothing on the agent.
+ */
+export function agentPreparationPipeline(agent) {
+    return {
+        resolve: async (call, context) => {
+            const tools = context.tools ?? [];
+            const exact = tools.find((tool) => tool.name === call.name);
+            if (exact)
+                return exact;
+            const resolved = await agent.resolveUnknownToolCall?.(call.name, context);
+            if (resolved)
+                return resolved;
+            const aliased = resolveToolNameAlias(call.name, tools.map((tool) => tool.name));
+            return tools.find((tool) => tool.name === aliased);
+        },
+        beforeToolCall: async (context, signal) => agent.beforeToolCall?.(context, signal),
+        afterToolCall: async (context, signal) => agent.afterToolCall?.(context, signal),
+        removedToolHint: (name) => agent.removedToolHints?.[name],
+    };
+}
+//# sourceMappingURL=executor-pipeline.js.map

package/dist/core/execution/executor-types.d.ts

@@ -0,0 +1,82 @@
+import type { AfterToolCallContext, AfterToolCallResult, AgentContext, AgentTool, AgentToolCall, AgentToolResult, AgentToolUpdateCallback, BeforeToolCallContext, BeforeToolCallResult } from "@earendil-works/pi-agent-core";
+import type { ExecutionEntry, ExecutionKey, ExecutionLedger, FrozenCall } from "@earendil-works/pi-agent-core/conformance";
+import type { AssistantMessage } from "@earendil-works/pi-ai";
+/** Today's per-call steps, as the executor runs them; the executor owns their order and the ledger around them. */
+export interface PreparationPipeline {
+    /** Exact name, then the host resolver (which may activate a lazy tool), then the alias rule. */
+    resolve(call: AgentToolCall, context: AgentContext): Promise<AgentTool | undefined>;
+    /** The ordered `tool_call` chain; PreToolUse is one handler in it. */
+    beforeToolCall(context: BeforeToolCallContext, signal?: AbortSignal): Promise<BeforeToolCallResult | undefined>;
+    afterToolCall(context: AfterToolCallContext, signal?: AbortSignal): Promise<AfterToolCallResult | undefined>;
+    removedToolHint(name: string): string | undefined;
+}
+export interface PreparedExecutorOptions {
+    readonly ledger: ExecutionLedger;
+    /** The executor's authenticated identity: the actor of every executor-side ledger event. */
+    readonly executor: string;
+    readonly pipeline: PreparationPipeline;
+    readonly clock?: () => number;
+}
+export interface PrepareRequest {
+    readonly issuer: string;
+    readonly generation: number;
+    readonly workspace: string;
+    readonly scope: string;
+    /** The model's raw call; its id is the execution's command id. */
+    readonly call: AgentToolCall;
+    readonly assistantMessage: AssistantMessage;
+    readonly context: AgentContext;
+    /** Issuer-minted with the call, so a re-sent prepare matches its admission exactly. */
+    readonly admittedAt: number;
+    readonly leaseUntil: number;
+    readonly reconcilable?: boolean;
+    readonly signal?: AbortSignal;
+}
+/** `requestedName` is set when the model's name resolved to another tool; the caller adds today's notice. */
+export type PrepareReply = {
+    readonly kind: "prepared";
+    readonly call: FrozenCall;
+    readonly requestedName?: string;
+} | {
+    readonly kind: "blocked";
+    readonly result: AgentToolResult<unknown>;
+    readonly requestedName?: string;
+} | {
+    readonly kind: "batch_abort";
+    readonly result: AgentToolResult<unknown>;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+};
+export interface ReleaseRequest {
+    readonly key: ExecutionKey;
+    readonly generation: number;
+    /** Verified identity of the releasing issuer, supplied by the endpoint. */
+    readonly actor: {
+        readonly id: string;
+    };
+    readonly signal?: AbortSignal;
+    readonly onUpdate?: AgentToolUpdateCallback<unknown>;
+}
+export type ReleaseReply = {
+    readonly kind: "settled";
+    readonly toolCall: AgentToolCall;
+    readonly result: AgentToolResult<unknown>;
+    readonly isError: boolean;
+    /** Set when the model's name resolved to another tool; the caller adds today's correction notice. */
+    readonly requestedName?: string;
+} | {
+    readonly kind: "aborted";
+    readonly result: AgentToolResult<unknown>;
+} | {
+    readonly kind: "replayed";
+    readonly entry: ExecutionEntry;
+} | {
+    readonly kind: "refused";
+    readonly reason: string;
+};
+export interface PreparedExecutor {
+    prepare(request: PrepareRequest): Promise<PrepareReply>;
+    release(request: ReleaseRequest): Promise<ReleaseReply>;
+}
+//# sourceMappingURL=executor-types.d.ts.map

package/dist/core/execution/executor-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=executor-types.js.map

package/dist/core/execution/executor.d.ts

@@ -0,0 +1,8 @@
+import type { PreparedExecutor, PreparedExecutorOptions } from "./executor-types.ts";
+/**
+ * The prepared executor (design 5.6.1): PREPARE persists effect_possible, runs today's resolution, shim, validation
+ * and `tool_call` chain once, and freezes the result; RELEASE dispatches the frozen call at most once and runs the
+ * after-hook once. Nothing here is installed on a session; a caller builds one and drives it.
+ */
+export declare function createPreparedExecutor(options: PreparedExecutorOptions): PreparedExecutor;
+//# sourceMappingURL=executor.d.ts.map

package/dist/core/execution/executor.js

@@ -0,0 +1,216 @@
+import { prepareAgentToolCall } from "@earendil-works/pi-agent-core";
+import { errorResult, finalizeBody, messageOf, runBody } from "./executor-body.js";
+import { digestOf, freezeCall, resultValue, stoppedReply, stoppedValue, toStoreValue, } from "./executor-freeze.js";
+const keyId = ({ issuer, commandId }) => JSON.stringify([issuer, commandId]);
+function refusal(reply) {
+    return { kind: "refused", reason: reply.status === "refused" ? reply.reason : reply.status };
+}
+// Today's message for a call the response cut off (agent-loop `createIncompleteToolCallErrorMessage`).
+function incompleteMessage(name, errorMessage) {
+    if (errorMessage !== undefined) {
+        return `${errorMessage}${errorMessage.endsWith(".") ? "" : "."} Re-issue the tool call with complete arguments.`;
+    }
+    return `Tool call "${name}" was not executed: the response ended before the tool call was complete because it hit the output token limit. Re-issue the tool call with complete arguments.`;
+}
+/** A durable row that already passed admission: answer from it and never run preparation again. */
+function fromRow(entry) {
+    const progress = entry.progress;
+    if ("call" in progress)
+        return { kind: "prepared", call: progress.call };
+    if (progress.state !== "settled")
+        return { kind: "refused", reason: progress.state };
+    const outcome = progress.outcome;
+    if (outcome.reason !== "blocked")
+        return { kind: "refused", reason: "terminal" };
+    return stoppedReply(outcome.value) ?? { kind: "refused", reason: "corrupt_blocked_outcome" };
+}
+/**
+ * The prepared executor (design 5.6.1): PREPARE persists effect_possible, runs today's resolution, shim, validation
+ * and `tool_call` chain once, and freezes the result; RELEASE dispatches the frozen call at most once and runs the
+ * after-hook once. Nothing here is installed on a session; a caller builds one and drives it.
+ */
+export function createPreparedExecutor(options) {
+    const { ledger, executor, pipeline } = options;
+    const clock = options.clock ?? Date.now;
+    const preparations = new Map();
+    const bodies = new Map();
+    const releases = new Map();
+    const step = (key, generation, event) => ledger.apply({ key, generation, actor: { id: executor }, now: clock(), event });
+    // A preparation that ends without a frozen call is terminal and durable, so a re-sent prepare (also from a new
+    // executor process after restart) gets this reply back instead of a restart-recovered `hand_restarted`.
+    async function stop(key, generation, reply) {
+        const recorded = await step(key, generation, { kind: "block", value: stoppedValue(reply) });
+        if (recorded.status === "applied")
+            return reply;
+        return recorded.status === "replayed" ? fromRow(recorded.entry) : refusal(recorded);
+    }
+    async function prepareOnce(request, requestDigest) {
+        const { call, generation, signal } = request;
+        const key = { issuer: request.issuer, commandId: call.id };
+        const admitted = await ledger.admit({
+            ...key,
+            executor,
+            workspace: request.workspace,
+            scope: request.scope,
+            generation,
+            requestDigest,
+            admittedAt: request.admittedAt,
+            leaseUntil: request.leaseUntil,
+            reconcilable: request.reconcilable ?? false,
+        });
+        if (admitted.status === "replayed")
+            return fromRow(admitted.entry);
+        if (admitted.status !== "applied")
+            return refusal(admitted);
+        const preparing = await step(key, generation, { kind: "prepare" });
+        if (preparing.status !== "applied")
+            return refusal(preparing);
+        if (call.incomplete === true) {
+            return stop(key, generation, {
+                kind: "blocked",
+                result: errorResult(incompleteMessage(call.name, call.errorMessage)),
+            });
+        }
+        const effect = await step(key, generation, { kind: "effect" });
+        if (effect.status !== "applied")
+            return refusal(effect);
+        let tool;
+        try {
+            tool = await pipeline.resolve(call, request.context);
+        }
+        catch (error) {
+            return stop(key, generation, { kind: "blocked", result: errorResult(messageOf(error)) });
+        }
+        if (!tool) {
+            const hint = pipeline.removedToolHint(call.name);
+            const text = hint === undefined ? `Tool ${call.name} not found` : `Tool ${call.name} not found. ${hint}`;
+            return stop(key, generation, { kind: "blocked", result: errorResult(text) });
+        }
+        const requestedName = tool.name === call.name ? undefined : call.name;
+        const named = requestedName === undefined ? {} : { requestedName };
+        try {
+            const prepared = prepareAgentToolCall(tool, requestedName === undefined ? call : { ...call, name: tool.name });
+            const before = await pipeline.beforeToolCall({
+                assistantMessage: request.assistantMessage,
+                toolCall: prepared.toolCall,
+                args: prepared.args,
+                context: request.context,
+            }, signal);
+            if (signal?.aborted)
+                return stop(key, generation, { kind: "batch_abort", result: errorResult("Operation aborted") });
+            if (before?.block) {
+                const result = errorResult(before.reason || "Tool execution was blocked");
+                if (before.terminate === true)
+                    result.terminate = true;
+                return stop(key, generation, { kind: "blocked", result, ...named });
+            }
+            const frozen = freezeCall(tool.name, prepared.args);
+            const freeze = await step(key, generation, { kind: "freeze", call: frozen, awaitingConsent: false });
+            if (freeze.status !== "applied")
+                return refusal(freeze);
+            bodies.set(keyId(key), {
+                ...named,
+                tool,
+                toolCall: prepared.toolCall,
+                args: frozen.args,
+                assistantMessage: request.assistantMessage,
+                context: request.context,
+            });
+            return { kind: "prepared", call: frozen, ...named };
+        }
+        catch (error) {
+            return stop(key, generation, { kind: "blocked", result: errorResult(messageOf(error)), ...named });
+        }
+    }
+    async function terminalRow(key) {
+        const entry = await ledger.read(key);
+        if (entry === undefined)
+            return { kind: "refused", reason: "not_found" };
+        const progress = entry.progress;
+        // A blocked call never had a body: release on it is refused, not replayed.
+        if (progress.state === "settled" && progress.outcome.reason === "blocked")
+            return { kind: "refused", reason: "blocked" };
+        return { kind: "replayed", entry };
+    }
+    async function runReleased(request, body) {
+        const { key, generation, signal } = request;
+        const dispatched = await step(key, generation, { kind: "dispatch" });
+        if (dispatched.status === "replayed")
+            return { kind: "replayed", entry: dispatched.entry };
+        if (dispatched.status !== "applied" || dispatched.entry.progress.state !== "dispatched") {
+            return refusal(dispatched);
+        }
+        const executed = await runBody(body, signal, request.onUpdate ?? (() => { }));
+        const { result, isError } = await finalizeBody(body, executed, pipeline, signal);
+        const value = resultValue(result, isError, body.requestedName);
+        const recorded = await step(key, generation, { kind: "result", value });
+        for (const memo of [bodies, preparations, releases])
+            memo.delete(keyId(key));
+        // A cancel or lease expiry that settled first stays terminal; the late body result is audit only.
+        if (recorded.status === "replayed")
+            return { kind: "replayed", entry: recorded.entry };
+        if (recorded.status !== "applied")
+            return refusal(recorded);
+        const named = body.requestedName === undefined ? {} : { requestedName: body.requestedName };
+        return { kind: "settled", toolCall: body.toolCall, result, isError, ...named };
+    }
+    // Every release reaches the ledger with its own actor and generation before any memo is read or written, so a
+    // wrong actor or an old generation is refused there and can never answer, or block, the issuer's own release.
+    async function release(request) {
+        const { key, generation } = request;
+        const released = await ledger.apply({
+            key,
+            generation,
+            actor: request.actor,
+            now: clock(),
+            event: { kind: "release" },
+        });
+        if (released.status === "refused")
+            return released.reason === "terminal" ? terminalRow(key) : refusal(released);
+        if (released.status === "result_expired")
+            return refusal(released);
+        const id = keyId(key);
+        const pending = releases.get(id);
+        if (pending !== undefined)
+            return pending;
+        const body = bodies.get(id);
+        if (body === undefined)
+            return { kind: "refused", reason: "not_prepared" };
+        // Today's loop never starts a body once the run is aborted; the call stays released for the issuer's abort.
+        if (request.signal?.aborted)
+            return { kind: "aborted", result: errorResult("Operation aborted") };
+        const reply = runReleased(request, body);
+        releases.set(id, reply);
+        void reply.catch(() => releases.get(id) === reply && releases.delete(id));
+        return reply;
+    }
+    return {
+        prepare: (request) => {
+            const { name, arguments: args, incomplete, errorMessage } = request.call;
+            const requestDigest = digestOf(toStoreValue({ name, args, incomplete, errorMessage }));
+            const admission = JSON.stringify([
+                request.generation,
+                request.workspace,
+                request.scope,
+                requestDigest,
+                request.admittedAt,
+                request.leaseUntil,
+                request.reconcilable ?? false,
+            ]);
+            const id = keyId({ issuer: request.issuer, commandId: request.call.id });
+            const pending = preparations.get(id);
+            if (pending !== undefined && pending.admission === admission)
+                return pending.reply;
+            if (pending !== undefined)
+                return Promise.resolve({ kind: "refused", reason: "identity_conflict" });
+            const reply = prepareOnce(request, requestDigest);
+            preparations.set(id, { admission, reply });
+            // Only a prepared call keeps its memo (release needs it); every other reply is durable or retryable.
+            const forget = () => preparations.get(id)?.reply === reply && preparations.delete(id);
+            void reply.then((settled) => settled.kind === "prepared" || forget(), forget);
+            return reply;
+        },
+        release,
+    };
+}
+//# sourceMappingURL=executor.js.map

package/dist/core/extensions/builtin/anthropic-subscription/account-block-log.d.ts

@@ -0,0 +1,15 @@
+export type AccountBlockRecord = {
+    readonly account: string;
+    readonly reason: string;
+    readonly until: number | undefined;
+    /** Whether the block was written to the credential store for every session, or held for this session only. */
+    readonly shared: boolean;
+    readonly detail: string;
+};
+/**
+ * Writes one `account_blocked` line to session.log for every block that is saved, so a pool that later
+ * refuses a request locally has a recorded cause (senpi#4671). The account is named by its seat digest,
+ * never its name (Desktop#4753); an unknown end time is left out rather than guessed.
+ */
+export declare function logAccountBlocked(record: AccountBlockRecord): void;
+//# sourceMappingURL=account-block-log.d.ts.map