@cursor/july 0.1.97 → 0.1.100

package/dist/internal/session-run-log.js

@@ -0,0 +1,358 @@
+/**
+ * Durable hosted-execution run log on the framework file store. **v2 only.**
+ *
+ * One JSON document per factory session (`ses_…`), with per-execution
+ * entries inside. The later customer UI is session-scoped ("why did this
+ * session fail?") so a single GET is the read path; continuations are FIFO
+ * so last-write-wins merge is safe. Guest-local `hosted-execution.json` and
+ * factorydb `last_error` are lossy: the on-disk diag dies with the pod, and
+ * the session row only keeps the first 1024 characters of a generic HTTP
+ * 500.
+ *
+ * Process death: persist `running` at turn start so SIGKILL / OOM still
+ * leaves a durable leftover. `uncaughtException` / SIGTERM flush the same
+ * session key with `processDeath: true` and the real throw. Soft-fail on
+ * persist so a store outage never changes the hosted-execution HTTP reply.
+ *
+ * Keys: {@link storageKeys.sessionRun}.
+ */
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+import { cursorFrameworkStoreSourceId, cursorHostedFiles, } from "../files-backends/cursor-hosted.js";
+import { storageKeys } from "../storage-protocol.js";
+import { resolveApiKeySync } from "./cursor/credentials.js";
+import { AGENT_SERVE_GENERATION_ENV_VAR } from "./cursor-relay-core.js";
+import { describeError } from "./describe-error.js";
+export const SESSION_RUN_LOG_VERSION = 1;
+/** Last N log-ring lines kept on each execution. */
+export const SESSION_RUN_LOG_MAX_ENTRIES = 200;
+/** Per-line cap so a runaway logger cannot blow the document. */
+export const SESSION_RUN_LOG_MAX_LINE_CHARS = 4096;
+/** Continuations are FIFO; keep a bounded history for the session UI. */
+export const SESSION_RUN_LOG_MAX_EXECUTIONS = 20;
+const MAX_ERROR_MESSAGE_CHARS = 4096;
+const MAX_ERROR_STACK_CHARS = 16384;
+const MAX_DOCUMENT_CHARS = 512 * 1024;
+/** Crash-handler flush must not block `process.exit`. */
+export const SESSION_RUN_FATAL_FLUSH_TIMEOUT_MS = 2000;
+let fatalFlush;
+/**
+ * Install the crash-handler flush used by `bin/agent-serve` on
+ * `uncaughtException`. One process, one active hosted serve.
+ */
+export function registerSessionRunFatalFlush(flush) {
+    fatalFlush = flush;
+}
+export function unregisterSessionRunFatalFlush() {
+    fatalFlush = undefined;
+}
+/**
+ * Await the registered crash flush, bounded so a hung store cannot prevent
+ * `process.exit`. Soft-fail.
+ */
+export function flushSessionRunFatal(error) {
+    return __awaiter(this, void 0, void 0, function* () {
+        if (fatalFlush === undefined) {
+            return;
+        }
+        yield Promise.race([
+            fatalFlush(error).catch(() => undefined),
+            new Promise((resolve) => {
+                setTimeout(resolve, SESSION_RUN_FATAL_FLUSH_TIMEOUT_MS);
+            }),
+        ]);
+    });
+}
+function boundedText(value, max) {
+    return value.length > max ? `${value.slice(0, max)}…` : value;
+}
+function boundedOptionalText(value, max) {
+    if (value === undefined || value.length === 0) {
+        return undefined;
+    }
+    return boundedText(value, max);
+}
+export function serializeSessionRunError(error) {
+    if (error instanceof Error) {
+        const stack = boundedOptionalText(error.stack, MAX_ERROR_STACK_CHARS);
+        return Object.assign({ name: boundedText(error.name.length > 0 ? error.name : "Error", 128), message: boundedText(error.message, MAX_ERROR_MESSAGE_CHARS) }, (stack === undefined ? {} : { stack }));
+    }
+    return {
+        name: "Error",
+        message: boundedText(String(error), MAX_ERROR_MESSAGE_CHARS),
+    };
+}
+export function snapshotSessionRunLogs(entries) {
+    const tail = entries.slice(-SESSION_RUN_LOG_MAX_ENTRIES);
+    return tail.map((entry) => ({
+        index: entry.index,
+        at: entry.at,
+        line: boundedText(entry.line, SESSION_RUN_LOG_MAX_LINE_CHARS),
+    }));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeSinkBody(body) {
+    return body instanceof Uint8Array ? body : body.body;
+}
+function parseError(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const name = typeof value.name === "string" ? value.name : "";
+    const message = typeof value.message === "string" ? value.message : "";
+    const stack = typeof value.stack === "string" ? value.stack : undefined;
+    return Object.assign({ name,
+        message }, (stack === undefined ? {} : { stack }));
+}
+function parseLogs(value) {
+    if (!Array.isArray(value)) {
+        return [];
+    }
+    const logs = [];
+    for (const entry of value) {
+        if (!isRecord(entry)) {
+            continue;
+        }
+        if (typeof entry.index !== "number" ||
+            typeof entry.at !== "string" ||
+            typeof entry.line !== "string") {
+            continue;
+        }
+        logs.push({ index: entry.index, at: entry.at, line: entry.line });
+    }
+    return logs;
+}
+function parseExecution(value) {
+    if (!isRecord(value)) {
+        return undefined;
+    }
+    const executionId = typeof value.executionId === "string" ? value.executionId : undefined;
+    const writtenAt = typeof value.writtenAt === "string" ? value.writtenAt : undefined;
+    const sessionId = typeof value.sessionId === "string" ? value.sessionId : undefined;
+    const turnStatus = typeof value.turnStatus === "string" ? value.turnStatus : undefined;
+    const durationMs = typeof value.durationMs === "number" && Number.isFinite(value.durationMs)
+        ? value.durationMs
+        : undefined;
+    if (executionId === undefined ||
+        executionId.length === 0 ||
+        writtenAt === undefined ||
+        sessionId === undefined ||
+        turnStatus === undefined ||
+        turnStatus.length === 0 ||
+        durationMs === undefined ||
+        durationMs < 0) {
+        return undefined;
+    }
+    const abortReason = typeof value.abortReason === "string" ? value.abortReason : undefined;
+    const message = typeof value.message === "string" ? value.message : undefined;
+    const error = parseError(value.error);
+    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ executionId,
+        writtenAt,
+        sessionId,
+        turnStatus,
+        durationMs }, (abortReason === undefined
+        ? {}
+        : { abortReason: abortReason })), (message === undefined ? {} : { message })), (error === undefined ? {} : { error })), (value.processDeath === true ? { processDeath: true } : {})), { logs: parseLogs(value.logs) });
+}
+export function lastFailureFromExecutions(executions) {
+    const latest = executions.at(-1);
+    if (latest === undefined || latest.turnStatus === "finished") {
+        return undefined;
+    }
+    return Object.assign(Object.assign(Object.assign(Object.assign({ executionId: latest.executionId, writtenAt: latest.writtenAt, turnStatus: latest.turnStatus }, (latest.abortReason === undefined
+        ? {}
+        : { abortReason: latest.abortReason })), (latest.message === undefined ? {} : { message: latest.message })), (latest.error === undefined ? {} : { error: latest.error })), (latest.processDeath === true ? { processDeath: true } : {}));
+}
+function boundExecution(write) {
+    const error = write.error === undefined
+        ? undefined
+        : Object.assign({ name: boundedText(write.error.name, 128), message: boundedText(write.error.message, MAX_ERROR_MESSAGE_CHARS) }, (write.error.stack === undefined
+            ? {}
+            : {
+                stack: boundedText(write.error.stack, MAX_ERROR_STACK_CHARS),
+            }));
+    return Object.assign(Object.assign(Object.assign(Object.assign(Object.assign({ executionId: write.executionId, writtenAt: write.writtenAt, sessionId: write.sessionId, turnStatus: write.turnStatus, durationMs: write.durationMs }, (write.abortReason === undefined
+        ? {}
+        : { abortReason: write.abortReason })), (boundedOptionalText(write.message, MAX_ERROR_MESSAGE_CHARS) ===
+        undefined
+        ? {}
+        : {
+            message: boundedOptionalText(write.message, MAX_ERROR_MESSAGE_CHARS),
+        })), (error === undefined ? {} : { error })), (write.processDeath === true ? { processDeath: true } : {})), { logs: snapshotSessionRunLogs(write.logs) });
+}
+function upsertExecution(existing, next) {
+    const executions = existing.filter((entry) => entry.executionId !== next.executionId);
+    executions.push(next);
+    executions.sort((a, b) => a.writtenAt.localeCompare(b.writtenAt));
+    return executions.slice(-SESSION_RUN_LOG_MAX_EXECUTIONS);
+}
+function shrinkSessionDocument(document) {
+    let executions = document.executions;
+    let next = Object.assign(Object.assign({}, document), { executions, lastFailure: lastFailureFromExecutions(executions) });
+    let serialized = JSON.stringify(next);
+    while (serialized.length > MAX_DOCUMENT_CHARS) {
+        const oldestWithLogs = executions.findIndex((entry) => entry.logs.length > 0);
+        if (oldestWithLogs >= 0) {
+            const entry = executions[oldestWithLogs];
+            executions = executions.map((item, index) => index === oldestWithLogs
+                ? Object.assign(Object.assign({}, entry), { logs: entry.logs.slice(Math.ceil(entry.logs.length / 2)) }) : item);
+        }
+        else if (executions.length > 1) {
+            executions = executions.slice(1);
+        }
+        else {
+            break;
+        }
+        next = Object.assign(Object.assign({}, document), { executions, lastFailure: lastFailureFromExecutions(executions) });
+        serialized = JSON.stringify(next);
+    }
+    return next;
+}
+export function parseSessionRunLogDocument(value) {
+    if (!isRecord(value) || value.v !== SESSION_RUN_LOG_VERSION) {
+        return undefined;
+    }
+    const sessionPublicId = typeof value.sessionPublicId === "string"
+        ? value.sessionPublicId
+        : undefined;
+    const updatedAt = typeof value.updatedAt === "string" ? value.updatedAt : undefined;
+    if (sessionPublicId === undefined ||
+        sessionPublicId.length === 0 ||
+        updatedAt === undefined ||
+        !Array.isArray(value.executions)) {
+        return undefined;
+    }
+    const executions = [];
+    for (const entry of value.executions) {
+        const parsed = parseExecution(entry);
+        if (parsed !== undefined) {
+            executions.push(parsed);
+        }
+    }
+    executions.sort((a, b) => a.writtenAt.localeCompare(b.writtenAt));
+    const lastFailure = lastFailureFromExecutions(executions);
+    return Object.assign(Object.assign({ v: SESSION_RUN_LOG_VERSION, sessionPublicId,
+        updatedAt }, (lastFailure === undefined ? {} : { lastFailure })), { executions });
+}
+export function createSessionRunLogStore(input) {
+    var _a;
+    const { sink, agentName } = input;
+    const logger = (_a = input.logger) !== null && _a !== void 0 ? _a : (() => { });
+    let active;
+    const readDocument = (sessionPublicId) => __awaiter(this, void 0, void 0, function* () {
+        const key = storageKeys.sessionRun(agentName, sessionPublicId);
+        const body = yield sink.get(key);
+        if (body === undefined) {
+            return undefined;
+        }
+        try {
+            return parseSessionRunLogDocument(JSON.parse(new TextDecoder().decode(decodeSinkBody(body))));
+        }
+        catch (error) {
+            logger(`[agent-sdk] session-run log: skip unreadable ${key} (${describeError(error)})`);
+            return undefined;
+        }
+    });
+    const persistWrite = (write) => __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const fitted = boundExecution(write);
+        let existing;
+        try {
+            existing = yield readDocument(write.sessionPublicId);
+        }
+        catch (error) {
+            logger(`[agent-sdk] session-run log: persist failed for ${fitted.executionId} (${describeError(error)})`);
+            return;
+        }
+        const executions = upsertExecution((_a = existing === null || existing === void 0 ? void 0 : existing.executions) !== null && _a !== void 0 ? _a : [], fitted);
+        const document = shrinkSessionDocument({
+            v: SESSION_RUN_LOG_VERSION,
+            sessionPublicId: write.sessionPublicId,
+            updatedAt: fitted.writtenAt,
+            executions,
+        });
+        const key = storageKeys.sessionRun(agentName, document.sessionPublicId);
+        try {
+            yield sink.put(key, new TextEncoder().encode(JSON.stringify(document)));
+        }
+        catch (error) {
+            logger(`[agent-sdk] session-run log: persist failed for ${fitted.executionId} (${describeError(error)})`);
+            return;
+        }
+        if (fitted.turnStatus === "running") {
+            active = {
+                sessionPublicId: write.sessionPublicId,
+                executionId: fitted.executionId,
+                sessionId: fitted.sessionId,
+                startedAt: Date.now(),
+            };
+            return;
+        }
+        if ((active === null || active === void 0 ? void 0 : active.executionId) === fitted.executionId) {
+            active = undefined;
+        }
+    });
+    return {
+        persist: persistWrite,
+        read(sessionPublicId) {
+            return __awaiter(this, void 0, void 0, function* () {
+                try {
+                    return yield readDocument(sessionPublicId);
+                }
+                catch (error) {
+                    logger(`[agent-sdk] session-run log: read failed for ${sessionPublicId} (${describeError(error)})`);
+                    return undefined;
+                }
+            });
+        },
+        flushProcessDeath(reason, error) {
+            return __awaiter(this, void 0, void 0, function* () {
+                var _a;
+                var _b;
+                if (active === undefined) {
+                    return;
+                }
+                const current = active;
+                const serialized = error === undefined ? undefined : serializeSessionRunError(error);
+                const message = error instanceof Error
+                    ? error.message
+                    : error !== undefined
+                        ? String(error)
+                        : "process died during hosted execution";
+                yield persistWrite(Object.assign(Object.assign({ sessionPublicId: current.sessionPublicId, executionId: current.executionId, writtenAt: new Date().toISOString(), sessionId: current.sessionId, turnStatus: "error", durationMs: Math.max(0, Date.now() - current.startedAt), abortReason: reason, processDeath: true, message }, (serialized === undefined ? {} : { error: serialized })), { logs: snapshotSessionRunLogs((_b = (_a = input.snapshotLogs) === null || _a === void 0 ? void 0 : _a.call(input)) !== null && _b !== void 0 ? _b : []) }));
+            });
+        },
+    };
+}
+/**
+ * Same selection as the conversation mirror: architecture-v2 hosted
+ * engines (generation env set). Store ids resolve lazily from env or the
+ * task-bind files under `/run/cursor/secrets`. Self-hosted and v1 stay on
+ * local disk / today's behavior.
+ */
+export function selectSessionRunLogStore(input) {
+    var _a;
+    if (input.project.agent.architecture !== "v2") {
+        return undefined;
+    }
+    const env = (_a = input.env) !== null && _a !== void 0 ? _a : process.env;
+    if (env[AGENT_SERVE_GENERATION_ENV_VAR] === undefined) {
+        return undefined;
+    }
+    const envSnapshot = env;
+    return createSessionRunLogStore(Object.assign({ sink: cursorHostedFiles({
+            resolveStoreSourceId: () => cursorFrameworkStoreSourceId(envSnapshot),
+            resolveApiKey: () => { var _a; return (_a = resolveApiKeySync()) === null || _a === void 0 ? void 0 : _a.apiKey; },
+        }), agentName: input.project.name, logger: input.logger }, (input.snapshotLogs === undefined
+        ? {}
+        : { snapshotLogs: input.snapshotLogs })));
+}

package/dist/internal/tool-policy.d.ts

@@ -21,14 +21,22 @@ export type ToolDecision =
     result: ToolExecuteResult;
 }
 /**
- * Do not run it; fail the call with this message. Only ever produced in a
- * dry run, for an MCP tool nothing classifies: stubbing it would let the
- * run reach a confident conclusion from no data, and running it could leak
- * a real write — refusing is the one failure that is loud.
+ * Do not run it; fail the call with this message. Only produced in a dry
+ * run, for an MCP tool nothing classifies: stubbing it would let the run
+ * reach a confident conclusion from no data, and running it could leak a
+ * real write — refusing is the one failure that is loud.
  */
  | {
     kind: "refuse";
     message: string;
+}
+/**
+ * Do not run it; the `asOf` session was asked to read without absolute
+ * bounds, which would read the present.
+ */
+ | {
+    kind: "unbounded";
+    message: string;
 };
 /** What a policy decision needs to know about the call. */
 export interface ToolCallFacts {
@@ -50,12 +58,16 @@ export interface ToolCallFacts {
     /** What a stubbed write should answer with, if the tool supplied one. */
     dryRunResult?: ToolExecuteResult | ((input: never) => ToolExecuteResult);
     /**
-     * Validated input, as the tool body would receive it. Only read by a
-     * per-call `effect` predicate and by a `dryRunResult` function, so a caller
-     * with neither — a bridged MCP tool, which carries no declaration at all —
-     * can omit it.
+     * Validated input, as the tool body would receive it. Read by a per-call
+     * `effect` predicate, a `dryRunResult` function, and the {@link timeArgs}
+     * bound check, so a caller with none of those — a bridged MCP tool, which
+     * carries no declaration at all — can omit it.
      */
     input?: unknown;
+    /** The session's frozen instant, when it has one. */
+    asOf?: string;
+    /** The tool's declared time-bound argument names, if it made them. */
+    timeArgs?: readonly string[];
 }
 /**
  * The effect of one specific call.

package/dist/internal/tool-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-policy.d.ts","sourceRoot":"","sources":["../../src/internal/tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAErB,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,yBAAyB;AACvB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE;AACjB,uDAAuD;GACrD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE;AAC/C;;;;;GAKG;GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAExC,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAC7D,yEAAyE;IACzE,YAAY,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,iBAAiB,CAAC,CAAC;IACzE;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAUD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,SAAS,EAChD,KAAK,EAAE,OAAO,GACb,UAAU,CAIZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,kBAAkB,GAAG,SAAS,GAC1C,UAAU,GAAG,SAAS,CAiBxB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC,EACvE,KAAK,EAAE,OAAO,GACb,UAAU,GAAG,SAAS,CAKxB;AAkBD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,YAAY,CA2BjE"}
+{"version":3,"file":"tool-policy.d.ts","sourceRoot":"","sources":["../../src/internal/tool-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,kBAAkB,EAClB,UAAU,EACV,qBAAqB,EACrB,iBAAiB,EAClB,MAAM,aAAa,CAAC;AAGrB,6CAA6C;AAC7C,MAAM,MAAM,YAAY;AACtB,yBAAyB;AACvB;IAAE,IAAI,EAAE,KAAK,CAAA;CAAE;AACjB,uDAAuD;GACrD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,iBAAiB,CAAA;CAAE;AAC/C;;;;;GAKG;GACD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACrC;;;GAGG;GACD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,WAAW,aAAa;IAC5B,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,8CAA8C;IAC9C,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,SAAS,CAAC;IACjD;;;;;;OAMG;IACH,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAC7D,yEAAyE;IACzE,YAAY,CAAC,EAAE,iBAAiB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,KAAK,iBAAiB,CAAC,CAAC;IACzE;;;;;OAKG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sEAAsE;IACtE,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9B;AAUD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG,SAAS,EAChD,KAAK,EAAE,OAAO,GACb,UAAU,CAIZ;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CACvC,WAAW,EAAE,kBAAkB,GAAG,SAAS,GAC1C,UAAU,GAAG,SAAS,CAiBxB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,aAAa,GAAG,YAAY,CAAC,EACvE,KAAK,EAAE,OAAO,GACb,UAAU,GAAG,SAAS,CAKxB;AAkBD,4EAA4E;AAC5E,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,YAAY,CAuCjE"}

package/dist/internal/tool-policy.js

@@ -8,6 +8,7 @@
  * decision lives here, in one pure function, and every path asks it rather
  * than re-implementing it.
  */
+import { timeArgViolation } from "./as-of.js";
 /**
  * What a stubbed write answers. Deliberately not self-describing: a model told
  * mid-turn that its writes are not real starts hedging its conclusions, and
@@ -79,6 +80,16 @@ function unclassifiedRefusal(toolName) {
 }
 /** Decide what to do with one tool call. Pure; no I/O, no session state. */
 export function decideToolCall(facts) {
+    // Before the dry-run split: a frozen session bounds its reads whether or
+    // not its writes are stubbed.
+    if (facts.asOf !== undefined &&
+        facts.timeArgs !== undefined &&
+        facts.timeArgs.length > 0) {
+        const violation = timeArgViolation(facts.input, facts.timeArgs, facts.asOf);
+        if (violation !== undefined) {
+            return { kind: "unbounded", message: violation };
+        }
+    }
     if (!facts.dryRun) {
         return { kind: "run" };
     }