@corenel/tools-web 0.1.0 → 0.3.0

package/dist/runtime.js

@@ -0,0 +1,858 @@
+import { createWorkerAgent } from './workerClient';
+import { createRunWatchdog } from './runWatchdog';
+import { listDocs, deleteDocsForSession } from './contextDocs';
+import { allTools } from '@corenel/harness/tools/builtins';
+import { applyTodoWrite, addActivity, resolveActivity, clearTodos } from '@corenel/harness/todos';
+import { getPolicy, STANDARD_POLICY } from '@corenel/harness/guardrail';
+import { composeAgentSystem, TOOLS_MARKER } from '@corenel/harness/prompts';
+import { getSystemParts } from '@corenel/harness/systemParts';
+// The agent's model is the user's picker selection (getModel) — a real
+// catalog entry, so pricing/context come from host.modelInfo, not hardcoded figures.
+const WATCHDOG_MS = 45000;
+function emptyInternal() {
+    return {
+        turns: [], live: null, running: false, error: '', mode: 'auto', input: '', attachments: [],
+        pendingPerm: null, pendingAsk: null, loaded: false, suggestions: [], recovery: null, abort: null, toolMs: {}, allowed: new Set(),
+        pendingCommand: null,
+        recEvents: [], lastUsage: { promptTokens: 0, completionTokens: 0 },
+        offloadTick: 0, policyNotes: [], degradedModel: null,
+    };
+}
+/** Build the user message — a plain string, or multimodal parts when images are attached. */
+function buildUserMessage(text, images) {
+    if (!images.length)
+        return { role: 'user', content: text };
+    const parts = [];
+    if (text)
+        parts.push({ type: 'text', text });
+    for (const url of images)
+        parts.push({ type: 'image_url', image_url: { url } });
+    return { role: 'user', content: parts };
+}
+function userText(m) {
+    if (typeof m.content === 'string')
+        return m.content;
+    if (Array.isArray(m.content)) {
+        const t = m.content.find((p) => p.type === 'text');
+        return t && 'text' in t ? t.text : '';
+    }
+    return '';
+}
+function userImages(m) {
+    if (!Array.isArray(m.content))
+        return [];
+    return m.content.filter((p) => p.type === 'image_url').map((p) => ('image_url' in p ? p.image_url.url : '')).filter(Boolean);
+}
+/** Merge a form's freshly-emitted envelope into a per-run override, against the
+ * currently saved default. The form only emits the keys it still wants set — a
+ * cleared field (e.g. "No limit") is simply ABSENT from `emitted`, not `undefined`.
+ * A plain `{...savedDefault, ...emitted}` merge at read time would then silently
+ * fall back to the saved default for that field, so "No limit" could never
+ * actually clear a saved cap. Fix: for every key present in `savedDefault` but
+ * absent from `emitted`, materialize an explicit `undefined` in the returned
+ * override so the read-time spread masks it (`{...{maxUsd:2}, ...{maxUsd:undefined}}`
+ * -> `maxUsd: undefined`, which all `!= null` consumers treat as no limit). Keys the
+ * form already sends as `undefined` (its own internal clears) pass through unchanged. */
+export function mergeOverride(savedDefault, emitted) {
+    const next = { ...emitted };
+    for (const key of Object.keys(savedDefault)) {
+        if (!(key in emitted))
+            next[key] = undefined;
+    }
+    return next;
+}
+export class AgentRuntime {
+    /** `surface` namespaces this runtime's sessions in the store (so /agent and /craft
+     * never list each other's chats). `systemExtra` is prepended to every run's system
+     * context — Craft uses it to carry the document-creation directive. */
+    constructor(host, surface = 'agent', 
+    // Not marked optional (`?`) — a required parameter (getModel) follows it, and
+    // TS forbids an optional parameter before a required one. Callers (createAgentRuntime)
+    // always pass all four positionally, so this is a mechanical, not semantic, change.
+    systemExtra, 
+    /** Resolves the model id for each run — the host factory always passes one
+     * (Corenel's agent model, or Craft's own surface getter). */
+    getModel, 
+    /** Optional sampling temperature for each run. The HOST resolves this,
+     * because whether a temperature may be sent at all depends on the model
+     * family (reasoning models reject a non-default value) and model metadata
+     * lives host-side. Undefined leaves the provider default in place. */
+    getTemperature) {
+        Object.defineProperty(this, "host", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: host
+        });
+        Object.defineProperty(this, "surface", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: surface
+        });
+        Object.defineProperty(this, "systemExtra", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: systemExtra
+        });
+        Object.defineProperty(this, "getModel", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: getModel
+        });
+        Object.defineProperty(this, "getTemperature", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: getTemperature
+        });
+        Object.defineProperty(this, "map", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "subs", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Map()
+        });
+        Object.defineProperty(this, "globalSubs", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
+        });
+        Object.defineProperty(this, "_ws", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+        Object.defineProperty(this, "worker", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+        /** Reuse the most-recent empty session if there is one, else create a fresh one.
+         * Returns the id to focus on page open — keeps a single throwaway "New chat"
+         * around instead of breeding empties. Concurrent calls are deduped (React
+         * StrictMode double-invokes the mount effect) so the page never opens two. */
+        Object.defineProperty(this, "initInFlight", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
+    }
+    ws() {
+        if (!this._ws)
+            this._ws = this.host.workspace();
+        // This surface is active — its workspace backs the session/recall stores.
+        // Gated on whenReady() so a fresh page load never lets the session store
+        // resolve the default root before the persisted source has been restored.
+        this.host.installFilesResolver(async () => {
+            const w = this._ws;
+            await w.whenReady();
+            return w.get();
+        });
+        return this._ws;
+    }
+    getWorker() {
+        if (!this.worker)
+            this.worker = createWorkerAgent({ getFileService: () => this.ws().get(), ...this.host.workerDeps });
+        return this.worker;
+    }
+    /** The active file workspace (the page shows its label as a context chip). */
+    fileService() { return this.ws().get(); }
+    workspace() { return this.ws(); }
+    /* ---- reactivity ---- */
+    ensure(id) {
+        let s = this.map.get(id);
+        if (!s) {
+            s = emptyInternal();
+            const dm = this.host.defaultMode?.();
+            if (dm)
+                s.mode = dm;
+            this.map.set(id, s);
+        }
+        return s;
+    }
+    notify(id) { this.subs.get(id)?.forEach((fn) => fn()); }
+    notifyGlobal() { this.globalSubs.forEach((fn) => fn()); }
+    /** Mutate a session and notify its view; `global` also pokes the running-badge subscribers. */
+    patch(id, p, global = false) {
+        Object.assign(this.ensure(id), p);
+        this.notify(id);
+        if (global)
+            this.notifyGlobal();
+    }
+    subscribe(id, cb) {
+        let set = this.subs.get(id);
+        if (!set) {
+            set = new Set();
+            this.subs.set(id, set);
+        }
+        set.add(cb);
+        return () => { set.delete(cb); };
+    }
+    subscribeGlobal(cb) { this.globalSubs.add(cb); return () => { this.globalSubs.delete(cb); }; }
+    getState(id) { return this.map.get(id) ?? emptyInternal(); }
+    status(id) {
+        const s = this.map.get(id);
+        if (!s)
+            return 'idle';
+        if (s.pendingPerm || s.pendingAsk)
+            return 'waiting';
+        // A running command is a running session. Reporting 'idle' while a command
+        // is in flight is what let a hung one look like a keystroke that did
+        // nothing, and it is the same claim the session list and the tab title make.
+        return s.running || s.pendingCommand ? 'running' : 'idle';
+    }
+    /* ---- session lifecycle ---- */
+    /** The session store reads through the module-global active-files resolver
+     * (stateFs), which only THIS runtime's ws() installs. Every session-store
+     * entry point must assert it first — a page that never touches
+     * workspace()/fileService() before its mount effect (CraftPage direct load)
+     * otherwise hits the default null resolver and the store throws
+     * "No file workspace is connected". */
+    /** Lazily load a session's turns from the store the first time it's focused. */
+    async load(id) {
+        if (!id)
+            return;
+        this.ws();
+        const s = this.ensure(id);
+        if (s.loaded)
+            return;
+        const ses = await this.host.sessions.get(id);
+        s.turns = ses?.messages || [];
+        s.loaded = true;
+        this.notify(id);
+    }
+    async openInitial() {
+        if (this.initInFlight)
+            return this.initInFlight;
+        this.ws();
+        this.initInFlight = (async () => {
+            const list = await this.host.sessions.list(this.surface);
+            const empty = list.find((s) => !s.messages || s.messages.length === 0);
+            if (empty) {
+                this.ensure(empty.id).loaded = true;
+                return empty.id;
+            }
+            return this.newSession();
+        })();
+        try {
+            return await this.initInFlight;
+        }
+        finally {
+            this.initInFlight = null;
+        }
+    }
+    async newSession() {
+        this.ws();
+        /* A NEW CHAT STARTS WITH NO TASKS.
+         *
+         * The task list is one module-level store keyed by nothing, so it outlived
+         * both the run that made it and the session it was made in: a fresh chat
+         * opened showing another agent's half-finished plan, and the only way out
+         * was to clear it by hand. Reported from a real machine.
+         *
+         * This is the narrow fix — a NEW session, where inherited tasks are never
+         * right. Switching BETWEEN existing sessions still shows one shared list;
+         * making the store per-session is the real repair and a bigger change than
+         * this one. */
+        clearTodos();
+        const ses = await this.host.sessions.create('New chat', this.surface);
+        const s = this.ensure(ses.id);
+        s.loaded = true;
+        this.notifyGlobal();
+        return ses.id;
+    }
+    async deleteSession(id) {
+        this.ws();
+        this.map.get(id)?.abort?.abort();
+        this.map.delete(id);
+        this.subs.delete(id);
+        await this.host.sessions.delete(id).catch(() => { });
+        deleteDocsForSession(id);
+        this.notifyGlobal();
+    }
+    /* ---- view mutators ---- */
+    setInput(id, v) { this.patch(id, { input: v }); }
+    setMode(id, m) { this.patch(id, { mode: m }); }
+    /** Clear the conversation (keep the session) — empties the visible transcript and
+     * starts a fresh recording stream for what follows. */
+    clear(id) {
+        const s = this.ensure(id);
+        s.recId = undefined;
+        s.recPrompt = undefined;
+        s.recImages = undefined;
+        s.recEvents = [];
+        this.patch(id, { turns: [], error: '', suggestions: [] }, true);
+        void this.persist(id);
+    }
+    /** Append a local assistant-style notice turn (e.g. a /model confirmation) — not
+     * sent to the model, just shown in the transcript. */
+    note(id, text) {
+        const s = this.ensure(id);
+        const turn = { id: `n${Date.now().toString(36)}`, included: false, messages: [{ role: 'assistant', content: text }] };
+        this.patch(id, { turns: [...s.turns, turn] });
+        void this.persist(id);
+    }
+    setAttachments(id, fn) {
+        this.patch(id, { attachments: fn(this.ensure(id).attachments) });
+    }
+    toggleInclude(id, turnId) {
+        const s = this.ensure(id);
+        this.patch(id, { turns: s.turns.map((t) => (t.id === turnId ? { ...t, included: !t.included } : t)) });
+        void this.persist(id);
+    }
+    /**
+     * Ask the user to approve something the HOST is about to do, through the same
+     * card a tool call raises.
+     *
+     * A console command typed into the chat is judged by the same policy as the
+     * agent's own tools (see terminal/commandSubject), and when that policy says
+     * `ask` it has to actually ask - through this, not a second prompt of its own.
+     * Two different approval dialogs for the same act is how people learn to click
+     * the one that appears more often without reading it.
+     *
+     * Resolves false if the session is gone, so a caller can never read a dropped
+     * prompt as consent.
+     */
+    requestPermission(id, tool, summary) {
+        const s = this.map.get(id);
+        if (!s)
+            return Promise.resolve(false);
+        if (s.allowed.has(tool))
+            return Promise.resolve(true);
+        return new Promise((resolve) => {
+            // 'you': this path exists for something the USER typed (a `>pd` command),
+            // never for the run loop, which raises its own asks through onPermission.
+            this.patch(id, { pendingPerm: { tool, summary, requester: 'you', resolve } }, true);
+        });
+    }
+    /**
+     * Record a console command run from the chat as a synthetic tool call+result.
+     *
+     * The SHAPE is the point. Written as the message pair a real tool call
+     * produces, it gets four things with no new machinery: the agent sees it in a
+     * form it already understands, it persists to the session log (a
+     * transcript-only rendering would not), it replays in recordings, and the
+     * user can promote it into context with the include toggle every turn
+     * already has.
+     *
+     * IT IS RECORDED OUT OF CONTEXT. Persistence and context-inclusion are
+     * separate switches here - persist() writes every turn, while only `included`
+     * turns are sent to the model - and a command should default to written-down
+     * but not re-sent. A transcript message is the most expensive kind of
+     * context: it is paid again on every subsequent turn for the rest of the
+     * session, so a handful of exploratory `pd ls` calls quietly become a
+     * permanent tax. Defaulting IN would put the work of noticing on the user at
+     * exactly the moment they are thinking about something else, and the ones
+     * they forget are the ones that compound. Defaulting OUT makes forgetting
+     * free and makes Keep the deliberate act.
+     */
+    /** Mark a console command as running. Paired with recordCommand, which clears
+     * it - so the indicator cannot outlive the command even if it fails, since the
+     * failure is itself recorded. */
+    beginCommand(id, command, startedAt) {
+        this.patch(id, { pendingCommand: { command, startedAt } }, true);
+    }
+    /** Give up on a command that will never settle (the surface unmounted, the
+     * session was closed). Clears the indicator WITHOUT recording a result,
+     * because there is no honest result to record. */
+    abandonCommand(id) {
+        if (!this.map.get(id)?.pendingCommand)
+            return;
+        this.patch(id, { pendingCommand: null }, true);
+    }
+    recordCommand(id, command, output, ok) {
+        const s = this.ensure(id);
+        const callId = `cmd_${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`;
+        const turn = {
+            id: callId,
+            // Not included: kept on disk, out of the context window until Keep.
+            included: false,
+            messages: [
+                {
+                    role: 'assistant',
+                    content: null,
+                    tool_calls: [{
+                            id: callId,
+                            type: 'function',
+                            // `ok` rides along in the arguments deliberately. On a synthetic call
+                            // it is part of the record, and once kept it tells the model the
+                            // command failed - which it would otherwise have to infer from
+                            // whatever the tool happened to print.
+                            function: { name: 'console_command', arguments: JSON.stringify({ command, ok }) },
+                        }],
+                },
+                {
+                    role: 'tool',
+                    tool_call_id: callId,
+                    content: output || (ok ? '(no output)' : '(failed, no output)'),
+                },
+            ],
+        };
+        this.patch(id, { turns: [...s.turns, turn], pendingCommand: null });
+        void this.persist(id);
+    }
+    resolvePerm(id, allow, always = false) {
+        const s = this.map.get(id);
+        if (!s?.pendingPerm)
+            return;
+        if (allow && always)
+            s.allowed.add(s.pendingPerm.tool);
+        s.pendingPerm.resolve(allow);
+        this.patch(id, { pendingPerm: null }, true);
+    }
+    resolveAsk(id, answers) {
+        const s = this.map.get(id);
+        if (!s?.pendingAsk)
+            return;
+        s.pendingAsk.resolve(answers);
+        this.patch(id, { pendingAsk: null }, true);
+    }
+    stop(id) { this.map.get(id)?.abort?.abort(); }
+    /* ---- run ---- */
+    async persist(id) {
+        const s = this.map.get(id);
+        if (!s)
+            return;
+        const ses = await this.host.sessions.get(id);
+        if (!ses)
+            return;
+        ses.messages = s.turns;
+        await this.host.sessions.save(ses).catch(() => { });
+    }
+    async composeSystem(id, persona, partsOverride) {
+        const svc = this.ws().get();
+        const s = this.ensure(id);
+        // systemExtra (e.g. Craft's document-creation directive) leads the context.
+        const blocks = this.systemExtra ? [this.systemExtra] : [];
+        if (svc) {
+            const src = svc.kind === 'directory' ? `local folder "${svc.label}"`
+                : svc.kind === 'sidecar' ? `connected sidecar machine "${svc.label}"`
+                    : `virtual in-browser workspace "${svc.label}"`;
+            const flags = `${svc.isLocalDisk ? "on the user's real disk" : 'in-browser'}, ${svc.writable ? 'writable' : 'read-only'}`;
+            blocks.push(`--- Workspace ---\n` +
+                `Connected source: ${src} (${flags}).\n` +
+                `All file paths are relative to this workspace root (POSIX, no leading slash, e.g. "prompts/base.prmd"). ` +
+                `There is no separate working directory or shell — inspect the workspace with list_files / read_file / ` +
+                `stat_file / search_files, and change it with write_file / create_file / delete_file / rename_file. ` +
+                `The browser does not expose the folder's absolute path, so report locations relative to the root.`);
+        }
+        else {
+            blocks.push(`--- Workspace ---\nNo file workspace is connected, so the file tools are unavailable. Say so rather than guessing about files.`);
+        }
+        // Host-supplied extra system-context blocks (project instructions, project
+        // memory, editor buffer …), resolved per send against the active FileService.
+        for (const p of this.host.contextProviders ?? []) {
+            const block = await p(svc);
+            if (block)
+                blocks.push(block);
+        }
+        // User-uploaded context documents (persistent chips): one stable block per
+        // doc, addedAt order — stable bytes/order keep provider prompt caches warm.
+        for (const d of listDocs(id)) {
+            blocks.push(`--- Attached document: ${d.name} ---\n${d.text}`);
+        }
+        const p = partsOverride ?? getSystemParts();
+        return composeAgentSystem({
+            persona: p.persona ? persona : '',
+            mode: s.mode,
+            includeMode: p.mode,
+            includeToolGuidance: p.toolGuidance,
+            systemPath: p.baseSystem ? undefined : this.host.systemPath?.(svc),
+            contextText: blocks.join('\n\n'),
+            toolsText: p.tools ? TOOLS_MARKER : '',
+            params: this.host.systemParams?.(),
+            memoryIndex: this.host.memoryIndex,
+        });
+    }
+    /** Send a message and run the agent for `id`. Concurrent with other sessions:
+     * each run is its own AbortController + watchdog and streams into its own slice. */
+    async send(id, text, images, opts) {
+        const s = this.ensure(id);
+        if ((!text && images.length === 0) || s.running)
+            return;
+        // Feature guard — the runtime is the chokepoint for every /agent run (send
+        // and retry), so a quota/plan guard registered later covers this surface
+        // too. Checked before the turn is appended or the composer cleared, so a
+        // denial loses nothing; s.running is re-read after the await because
+        // another send may have claimed the session while the guard evaluated.
+        const gate = await this.host.guard('llm-execution');
+        if (!gate.allowed) {
+            this.patch(id, { error: gate.reason });
+            return;
+        }
+        if (s.running)
+            return;
+        const isFirst = s.turns.length === 0;
+        const userTurn = { id: `t${Date.now().toString(36)}`, included: true, messages: [buildUserMessage(text, images)] };
+        const nextTurns = [...s.turns, userTurn];
+        s.toolMs = {};
+        this.patch(id, {
+            turns: nextTurns, error: '', live: { text: '', tools: [] }, running: true, input: '', attachments: [], suggestions: [],
+            policyNotes: [], degradedModel: null,
+        }, true);
+        const startedAt = Date.now();
+        // Title an untitled session from its first message, so the switcher is readable.
+        // A hand-renamed session is locked, so its chosen title is left alone.
+        if (isFirst && text) {
+            const ses = await this.host.sessions.get(id);
+            if (ses && !ses.titleLocked) {
+                ses.title = text.slice(0, 48);
+                await this.host.sessions.save(ses).catch(() => { });
+                this.notifyGlobal();
+            }
+        }
+        const outgoing = nextTurns.filter((t) => t.included).flatMap((t) => t.messages);
+        const ac = new AbortController();
+        s.abort = ac;
+        // This turn's events append to the session's accumulated stream (one recording
+        // per session, not per turn) — see Internal.recEvents.
+        const recBuf = s.recEvents;
+        // Where THIS turn's events start — so `ok` reflects only this turn (a transient
+        // error in an earlier turn must not mark a recovered session as failed forever).
+        const turnStart = recBuf.length;
+        // Mark a FOLLOW-UP user turn so the replay shows it as a bubble in place. The
+        // first turn's prompt is the recording's `prompt` header, so only record once
+        // the session already has replayable content (avoids duplicating it).
+        if (recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
+            recBuf.push({ at: Date.now(), ev: { type: 'user', content: text, images: images.length ? images.slice() : undefined } });
+        }
+        // Shared wedged-run watchdog (see runWatchdog.ts): soft window while
+        // streaming, paused mid-tool with a hard cap so a never-settling tool
+        // (half-open sidecar socket) can't hang the run forever.
+        const dog = createRunWatchdog((reason) => {
+            ac.abort();
+            this.patch(id, {
+                error: reason === 'tool-hard-cap'
+                    ? 'A tool ran for over 10 minutes without completing — aborted. The connection to it may have dropped.'
+                    : 'No response from the gateway in 45s — aborted. Check that you are signed in and the backend is reachable.',
+            });
+        }, { softMs: WATCHDOG_MS });
+        dog.bump();
+        try {
+            const system = await this.composeSystem(id, opts.persona, opts.partsOverride);
+            const model = this.getModel();
+            // Live model for onBreach pricing — reassigned when a degrade breach
+            // switches the run onto a cheaper model (see onBreach below).
+            let activeModel = model;
+            const priced = this.host.modelInfo(model);
+            const contextWindow = priced.contextWindow ?? 128000;
+            // The surface's constraints default (Task 7), overridden per run when the
+            // caller passes one (a masked-override envelope from `mergeOverride`) —
+            // mirrors AgentPanel's `eff = { ...savedDefault, ...perRunOverride }`.
+            // NOTE: this deliberately reads `this.surface`'s constraints, not a
+            // hardcoded 'agent' — a behavior change for /craft vs. the pre-extraction
+            // class (which always read 'agent'); 'craft' has no saved defaults so the
+            // effective result is unchanged.
+            const constraints = { ...this.host.constraints(this.surface), ...(opts.constraints ?? {}) };
+            const hasBudgetLimits = constraints.maxUsd != null || constraints.maxTokens != null || constraints.maxMs != null;
+            // Capability seam (Task 3): only send toolNames when the host's tools
+            // getter is NOT the default allTools (reference inequality) — this keeps
+            // the default path byte-identical, since every surface today passes
+            // `tools: allTools` (or omits capabilities entirely).
+            const capTools = this.host.capabilities?.tools;
+            const toolNames = capTools && capTools !== allTools ? capTools().map((t) => t.name) : undefined;
+            const toolDeny = this.host.capabilities?.toolDeny?.();
+            // Resolved per run so an edit to a callee (or its canCall list) applies to
+            // the next delegation without rebuilding the runtime. Never fatal: a read
+            // failure costs delegation, not the run.
+            const crewDelegates = await (this.host.capabilities?.delegates?.().catch(() => []) ?? Promise.resolve([]));
+            const res = await this.getWorker().run(outgoing, {
+                model,
+                temperature: this.getTemperature?.(),
+                toolDeny,
+                crewDelegates,
+                system,
+                policy: getPolicy(opts.policyName) ?? STANDARD_POLICY,
+                compression: { mode: this.host.compression(), contextWindow },
+                signal: ac.signal,
+                sessionId: id,
+                toolNames,
+                onPermission: (req) => new Promise((resolve) => {
+                    if (s.allowed.has(req.tool)) {
+                        resolve(true);
+                        return;
+                    }
+                    this.patch(id, { pendingPerm: { ...req, resolve } }, true);
+                }),
+                onAsk: (questions) => new Promise((resolve) => {
+                    dog.pause();
+                    this.patch(id, { pendingAsk: { questions, resolve: (a) => { resolve(a); dog.bump(); } } }, true);
+                }),
+                // Editor-buffer surfaces pass onEditReview/editorFile (Task 4); the
+                // standalone page omits both, so propose_edit keeps its non-blocking
+                // fallback exactly as before.
+                editorFile: opts.editorFile,
+                onNodeEvent: opts.onNodeEvent,
+                onEditReview: opts.onEditReview
+                    ? async (callId) => {
+                        // propose_edit blocks on the user's verdict — pause the watchdog
+                        // (like an open ask form), resume once the host resolves it.
+                        dog.pause();
+                        const r = await opts.onEditReview(callId, ac.signal);
+                        dog.bump();
+                        return r;
+                    }
+                    : undefined,
+                constraints: hasBudgetLimits ? constraints : undefined,
+                price: (usage, priceModel) => this.host.price(usage, priceModel),
+                onBreach: constraints.onBreach && this.host.breach
+                    ? async (breach) => {
+                        // Tracks the model actually running (workerClient resets its breach
+                        // latch after a degrade, so a second in-run breach can fire on the
+                        // NEW model) — price the next breach against that, not the model
+                        // captured at run() time.
+                        const r = await this.host.breach.decide(constraints.onBreach, breach, {
+                            currentModel: activeModel,
+                            // Reuse the tool-permission confirm dialog (pendingPerm/resolvePerm) as
+                            // the yes/no "continue past budget?" prompt — same pattern as AgentPanel's
+                            // per-run budget control: a 'budget' pseudo-tool the overlay special-cases.
+                            ask: (m) => new Promise((resolve) => {
+                                dog.pause();
+                                this.patch(id, { pendingPerm: { tool: 'budget', summary: m, resolve: (b) => { resolve(b); dog.bump(); } } }, true);
+                            }),
+                            // Reuse the existing "append a local notice turn" affordance (used
+                            // today for /model confirmations) for a soft warn — ALSO appended to
+                            // policyNotes, unless the caller opted into policyNotes-only
+                            // rendering (see SendOpts.budgetNotices).
+                            warn: (m) => {
+                                if ((opts.budgetNotices ?? 'transcript') === 'transcript')
+                                    this.note(id, m);
+                                this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: m, action: 'warn' }] });
+                            },
+                            cheaperModel: this.host.breach.cheaperModel(() => s.lastUsage),
+                        });
+                        if (r.model) {
+                            activeModel = r.model;
+                            this.patch(id, { degradedModel: r.model });
+                        }
+                        return r;
+                    }
+                    : undefined,
+                onEvent: (e) => {
+                    /* The task list is fed HERE, at the one choke point every surface's
+                     * runtime passes through - not by a host.
+                     *
+                     * It used to be wired in prompd's AgentPanel alone, so `todo_write`
+                     * worked there and nowhere else: on corenel the model dutifully kept a
+                     * plan across a multi-step job and not one surface could read it,
+                     * because nothing was listening. A tool whose entire purpose is to be
+                     * SEEN cannot depend on each host remembering to subscribe.
+                     *
+                     * Other tool calls bucket as activity under whichever task is active,
+                     * which is what gives an expanded task its detail. */
+                    if (e.type === 'tool-call') {
+                        if (e.name === 'todo_write')
+                            applyTodoWrite(e.args);
+                        else
+                            addActivity(e.id, e.name);
+                    }
+                    else if (e.type === 'tool-result') {
+                        resolveActivity(e.id, e.isError);
+                    }
+                    opts.onRunEvent?.(e);
+                    dog.onEvent(e);
+                    recBuf.push({ at: Date.now(), ev: e });
+                    // Heal persistence is centralized in the worker client (host workerDeps
+                    // onHeal) so it captures sub-agent/DAG-node heals too — not tapped here.
+                    // We just surface the live "Recovering…" status (null clears it on recovered).
+                    if (e.type === 'heal') {
+                        this.patch(id, { recovery: this.host.healNote?.(e.record) ?? null });
+                        return;
+                    }
+                    if (e.type === 'offload') {
+                        this.patch(id, { offloadTick: this.ensure(id).offloadTick + 1 });
+                        return;
+                    }
+                    if (e.type === 'policy-violation') {
+                        this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: e.kind, message: e.message, action: e.action }] });
+                        return;
+                    }
+                    const live = s.live;
+                    if (!live)
+                        return;
+                    if (e.type === 'assistant-delta')
+                        this.patch(id, { live: { ...live, text: live.text + e.delta }, recovery: null });
+                    else if (e.type === 'assistant')
+                        this.patch(id, { live: { ...live, text: '' } });
+                    else if (e.type === 'tool-call')
+                        this.patch(id, { live: { ...live, tools: [...live.tools, { id: e.id, name: e.name, args: e.args }] } });
+                    else if (e.type === 'tool-result') {
+                        if (typeof e.durationMs === 'number')
+                            s.toolMs[e.id] = e.durationMs;
+                        this.patch(id, { live: { ...live, tools: live.tools.map((t) => (t.id === e.id ? { ...t, result: e.result, isError: e.isError, done: true, ms: e.durationMs } : t)) } });
+                    }
+                    else if (e.type === 'error')
+                        this.patch(id, { error: e.message });
+                    else if (e.type === 'usage')
+                        s.lastUsage = e.usage;
+                    // Synthetic event workerClient emits when onBreach returned {continue:false}
+                    // — surfaced as a transcript notice via the existing note() affordance,
+                    // AND appended to policyNotes (same warn/stop duality as above, gated
+                    // by SendOpts.budgetNotices).
+                    else if (e.type === 'budget-stop') {
+                        const msg = `Run stopped: budget reached (${this.host.breach.describe(e.breach)}).`;
+                        if ((opts.budgetNotices ?? 'transcript') === 'transcript')
+                            this.note(id, msg);
+                        this.patch(id, { policyNotes: [...this.ensure(id).policyNotes, { kind: 'budget', message: msg, action: 'stop' }] });
+                    }
+                },
+            });
+            // Stitch each tool call's measured duration onto its tool message (`_ms`).
+            const ms = s.toolMs;
+            const created = res.messages.slice(outgoing.length + 1).map((m) => {
+                const tid = m.tool_call_id;
+                return m.role === 'tool' && tid && ms[tid] != null ? { ...m, _ms: ms[tid] } : m;
+            });
+            const u = res.usage;
+            const stats = u && (u.promptTokens || u.completionTokens)
+                ? { inTok: u.promptTokens, outTok: u.completionTokens, cost: (u.promptTokens / 1e6) * priced.inPrice + (u.completionTokens / 1e6) * priced.outPrice, ms: Date.now() - startedAt }
+                : undefined;
+            this.patch(id, { turns: s.turns.map((t) => (t.id === userTurn.id ? { ...t, messages: [userTurn.messages[0], ...created], stats } : t)) });
+            void this.persist(id);
+            if (stats) {
+                this.host.recordUsage({ surface: this.surface, provider: priced.provider, model, modelLabel: priced.label, inEst: null, inTok: stats.inTok, outTok: stats.outTok, cost: stats.cost });
+            }
+            // Best-effort follow-up chips for this turn — generated after the reply lands,
+            // dropped if the user starts/aborts another run before it returns.
+            if (this.host.suggestFollowups) {
+                void this.host.suggestFollowups({ messages: res.messages, model, signal: ac.signal }).then((sug) => {
+                    if (sug.length && !ac.signal.aborted)
+                        this.patch(id, { suggestions: sug }, true);
+                });
+            }
+        }
+        catch (e) {
+            this.patch(id, { error: String(e?.message || e) });
+        }
+        finally {
+            // A run that ends (abort/watchdog/error) while a perm overlay (tool-permission
+            // or budget-breach "continue?") is still open must not leave its promise —
+            // and the caller awaiting it — hanging forever. Treat an unanswered perm as
+            // "no". resolvePerm() already nulls s.pendingPerm once the user answers, so
+            // this is a no-op (idempotent) on the happy path.
+            if (s.pendingPerm) {
+                s.pendingPerm.resolve(false);
+                this.patch(id, { pendingPerm: null }, true);
+            }
+            dog.clear();
+            s.abort = null;
+            this.patch(id, { running: false, live: null, recovery: null }, true);
+            // Upsert the session recording with everything captured so far (this turn's
+            // events appended to prior turns), under one stable id so the whole session
+            // replays as a single stream. Skipped until something replayable happened.
+            if (this.host.recorder && recBuf.some((r) => r.ev.type === 'assistant' || r.ev.type === 'tool-call')) {
+                if (!s.recId) {
+                    s.recId = this.host.recorder.newId();
+                    s.recPrompt = text;
+                    s.recImages = images.length ? images.slice() : undefined;
+                }
+                // `ok` is THIS turn's outcome (slice from turnStart); a snapshot copy of the
+                // events so the store doesn't hold the live array that later turns mutate.
+                const ok = !recBuf.slice(turnStart).some((r) => r.ev.type === 'error');
+                this.host.recorder.save({ kind: 'agent', id: s.recId, title: (s.recPrompt || 'Agent run').slice(0, 60), at: Date.now(), ok, prompt: s.recPrompt || text, promptImages: s.recImages, events: recBuf.slice() });
+            }
+        }
+    }
+    /** A host-driven turn: appends the user message, then awaits a host-supplied
+     * `produce` (e.g. the /strategy command's own completion) instead of running
+     * the worker agent. Same running/live/error/abort shape as `send`, minus
+     * tool calls — used by surfaces that render a live "thinking" placeholder for
+     * work the engine itself doesn't perform. */
+    async hostTurn(id, userText, produce) {
+        const s = this.ensure(id);
+        if (!userText || s.running)
+            return;
+        this.ws();
+        const gate = await this.host.guard('llm-execution');
+        if (!gate.allowed) {
+            this.patch(id, { error: gate.reason });
+            return;
+        }
+        if (s.running)
+            return;
+        const userTurn = { id: `t${Date.now().toString(36)}`, included: true, messages: [{ role: 'user', content: userText }] };
+        const ac = new AbortController();
+        s.abort = ac;
+        this.patch(id, { turns: [...s.turns, userTurn], error: '', live: { text: '', tools: [] }, running: true, suggestions: [] }, true);
+        try {
+            const content = await produce(ac.signal);
+            this.patch(id, { turns: this.ensure(id).turns.map((t) => (t.id === userTurn.id ? { ...t, messages: [userTurn.messages[0], { role: 'assistant', content }] } : t)) });
+            void this.persist(id);
+        }
+        catch (e) {
+            this.patch(id, { error: String(e?.message || e) });
+        }
+        finally {
+            s.abort = null;
+            this.patch(id, { running: false, live: null }, true);
+        }
+    }
+    /** Replace the offload stub for `blobId` inside turn `turnId` (session `id`)
+     * with the full content — the context drawer's per-item Restore, transplanted
+     * from the harness/conversation.ts singleton (same marker-matching and
+     * identity-swap semantics; see that module for the rationale). Returns false
+     * (state untouched, no persist) when the turn or the matching stub is absent. */
+    restoreToolResult(id, turnId, blobId, content) {
+        const marker = `recall_result({ id: "${blobId}" })`;
+        const s = this.ensure(id);
+        const turn = s.turns.find((t) => t.id === turnId);
+        if (!turn)
+            return false;
+        const idx = turn.messages.findIndex((m) => m.role === 'tool' && typeof m.content === 'string' && m.content.includes(marker));
+        if (idx < 0)
+            return false;
+        const next = s.turns.map((t) => {
+            if (t.id !== turnId)
+                return t;
+            const messages = t.messages.slice();
+            messages[idx] = { ...messages[idx], content };
+            return { ...t, messages };
+        });
+        this.patch(id, { turns: next });
+        void this.persist(id);
+        return true;
+    }
+    /** Re-run a prior user turn: drop it and everything after, then resend it. */
+    async retry(id, turnId, opts) {
+        const s = this.ensure(id);
+        if (s.running)
+            return;
+        const idx = s.turns.findIndex((t) => t.id === turnId);
+        if (idx < 0)
+            return;
+        const first = s.turns[idx].messages[0];
+        const text = first ? userText(first) : '';
+        const images = first ? userImages(first) : [];
+        if (!text && images.length === 0)
+            return;
+        this.patch(id, { turns: s.turns.slice(0, idx) });
+        await this.send(id, text, images, opts);
+    }
+    /** Drop all in-memory state and abort every run — called on a scope change so
+     * one identity's sessions and runs never carry into another's. */
+    reset() {
+        for (const s of this.map.values())
+            s.abort?.abort();
+        const ids = [...this.subs.keys()];
+        this.map.clear();
+        this.worker?.dispose();
+        this.worker = null;
+        this._ws = null;
+        for (const id of ids)
+            this.notify(id);
+        this.notifyGlobal();
+    }
+}
+//# sourceMappingURL=runtime.js.map