@deepseek-ai/dsh-experimental-webworker-runtime 0.2.1-rc.4 → 0.2.2-alpha.2

package/lib/worker.js

@@ -836,7 +836,7 @@ const EXEC_PATH = "/dsh/bin/node";
 /** Node release whose internal-module members `node-addon-require-builtin` follows in the Worker. */
 const NODE_VERSION = "24.18.0";
 /**
-* Publish `globalThis.process`.
+* Publish `globalThis.process` and Node's `global` alias for the worker lifetime.
 *
 * `versions.node` names the Node release the Worker's `node-addon-require-builtin` internals follow, so Cordis's
 * `ModuleLoader.fromInternal()` reaches them the way it reaches Node's; `execArgv` stays empty, without
@@ -905,6 +905,7 @@ function installProcessGlobal(options) {
 			console.warn(`webworker process: exit(${String(code ?? 0)}) requested; the worker keeps running`);
 		}
 	};
+	globalThis.global = globalThis;
 	globalThis.process = shim;
 	return shim;
 }
@@ -969,7 +970,7 @@ function parseInboundFrame(data) {
 }
 //#endregion
 //#region src/transport/synthetic-http.ts
-const encoder$4 = new TextEncoder();
+const encoder$5 = new TextEncoder();
 /**
 * Build the request/response pair for one tunnel request.
 *
@@ -1033,13 +1034,13 @@ function createSyntheticExchange(frame, sink) {
 				streaming = true;
 				sink.head(status, headers);
 			}
-			sink.chunk(typeof chunk === "string" ? encoder$4.encode(chunk) : chunk);
+			sink.chunk(typeof chunk === "string" ? encoder$5.encode(chunk) : chunk);
 			return true;
 		},
 		end: (body) => {
 			if (finished) return res;
 			finished = true;
-			const bytes = body === void 0 ? void 0 : typeof body === "string" ? encoder$4.encode(body) : body;
+			const bytes = body === void 0 ? void 0 : typeof body === "string" ? encoder$5.encode(body) : body;
 			if (streaming) {
 				if (bytes !== void 0) sink.chunk(bytes);
 				sink.end();
@@ -1088,7 +1089,7 @@ function createSyntheticExchange(frame, sink) {
 }
 /** Host header the synthesized requests carry; the API trust fence requires one. */
 const SYNTHETIC_HOST = "127.0.0.1";
-const encoder$3 = new TextEncoder();
+const encoder$4 = new TextEncoder();
 /**
 * Render a failure with everything nested inside it.
 *
@@ -1342,7 +1343,7 @@ var TunnelServer = class {
 			});
 			return;
 		}
-		const body = toTransferable(encoder$3.encode(message));
+		const body = toTransferable(encoder$4.encode(message));
 		this.send({
 			t: "res",
 			id: frame.id,
@@ -1474,6 +1475,10 @@ var TunnelServer = class {
 				this.serveBoot(frame, sink);
 				return;
 			}
+			if (path === "/__assets__") {
+				this.servePackageAssets(frame, sink);
+				return;
+			}
 			if (path.startsWith(`/api/`)) {
 				await this.serveApi(frame, routed, path, sink);
 				return;
@@ -1539,6 +1544,24 @@ var TunnelServer = class {
 		}
 		buffered.flushTo(sink);
 	}
+	servePackageAssets(frame, sink) {
+		if (this.seams === void 0) throw new Error("webworker tunnel: package assets requested before the host tree is serving");
+		if (frame.method !== "GET") {
+			sink.end({
+				status: 405,
+				headers: { allow: "GET" }
+			});
+			return;
+		}
+		sink.end({
+			status: 200,
+			headers: {
+				"content-type": "application/x-tar",
+				"cache-control": "no-store"
+			},
+			body: this.seams.packageAssets()
+		});
+	}
 	serveBoot(frame, sink) {
 		if (this.seams === void 0) throw new Error("webworker tunnel: boot payload requested before the host tree is serving");
 		if (frame.method !== "GET") {
@@ -1548,7 +1571,7 @@ var TunnelServer = class {
 			});
 			return;
 		}
-		const body = encoder$3.encode(JSON.stringify(this.seams.bootPayload()));
+		const body = encoder$4.encode(JSON.stringify(this.seams.bootPayload()));
 		sink.end({
 			status: 200,
 			headers: {
@@ -1694,14 +1717,104 @@ async function inflateImage(bytes, source) {
 	if (body === null) throw new Error(`webworker image: ${source} produced no readable body`);
 	return await inflateImageStream(body, source);
 }
-new TextEncoder();
-const decoder$1 = new TextDecoder();
+//#endregion
+//#region src/storage/tar.ts
+/**
+* Uncompressed ustar archive: the VFS image format. One fetch delivers the
+* whole tree, and the reader hands out subarray views into the fetched buffer,
+* so mounting copies nothing and no inflate step runs inside the worker.
+*
+* Hand-rolled on purpose: both sides need synchronous in-memory operation and
+* the reader ships inside the worker bundle, where the streaming tar packages
+* would drag Node stream shims back in. The subset is plain ustar — regular
+* files and directories, names up to 255 bytes via the name-prefix split — and
+* anything outside it fails loud on either side.
+* @module @deepseek-ai/dsh-experimental-webworker-runtime/src/storage/tar
+*/
+const encoder$3 = new TextEncoder();
+const decoder$2 = new TextDecoder();
 const BLOCK = 512;
+/** Write an octal field: zero-padded digits with a terminating NUL. */
+function writeOctal(header, offset, length, value) {
+	header.set(encoder$3.encode(value.toString(8).padStart(length - 1, "0")), offset);
+}
+/**
+* Split an entry name into the ustar name and prefix fields.
+* @param name - Full entry name.
+* @returns The two fields; the prefix is empty when the name fits directly.
+* @throws When no slash yields name ≤ 100 and prefix ≤ 155 bytes: the entry
+* cannot be archived and a silently truncated name would corrupt the image.
+*/
+function splitName(name) {
+	if (encoder$3.encode(name).length <= 100) return {
+		name,
+		prefix: ""
+	};
+	for (let index = name.length - 1; index > 0; index -= 1) {
+		if (name[index] !== "/") continue;
+		const prefix = name.slice(0, index);
+		const rest = name.slice(index + 1);
+		if (encoder$3.encode(rest).length <= 100 && encoder$3.encode(prefix).length <= 155) return {
+			name: rest,
+			prefix
+		};
+	}
+	throw new Error(`vfs tar: entry name does not fit the ustar name+prefix split: ${name}`);
+}
+/**
+* Pack entries into one uncompressed ustar archive.
+*
+* Entries keep their given order; names ending in a slash become directory
+* entries. Contents are written verbatim — compression belongs to the HTTP
+* transport, not to the archive.
+* @param files - Entry name to content bytes.
+* @returns The archive bytes.
+*/
+function packTar(files) {
+	const chunks = [];
+	for (const [entryName, bytes] of Object.entries(files)) {
+		const directory = entryName.endsWith("/");
+		const size = directory ? 0 : bytes.length;
+		const { name, prefix } = splitName(entryName);
+		const header = new Uint8Array(BLOCK);
+		header.set(encoder$3.encode(name), 0);
+		writeOctal(header, 100, 8, directory ? 493 : 420);
+		writeOctal(header, 108, 8, 0);
+		writeOctal(header, 116, 8, 0);
+		writeOctal(header, 124, 12, size);
+		writeOctal(header, 136, 12, 0);
+		header.fill(32, 148, 156);
+		header[156] = directory ? 53 : 48;
+		header.set(encoder$3.encode("ustar"), 257);
+		header.set(encoder$3.encode("00"), 263);
+		header.set(encoder$3.encode(prefix), 345);
+		let checksum = 0;
+		for (const byte of header) checksum += byte;
+		header.set(encoder$3.encode(checksum.toString(8).padStart(6, "0")), 148);
+		header[154] = 0;
+		header[155] = 32;
+		chunks.push(header);
+		if (size > 0) {
+			chunks.push(bytes);
+			const padding = size % BLOCK;
+			if (padding !== 0) chunks.push(new Uint8Array(BLOCK - padding));
+		}
+	}
+	chunks.push(new Uint8Array(BLOCK * 2));
+	const total = chunks.reduce((sum, chunk) => sum + chunk.length, 0);
+	const archive = new Uint8Array(total);
+	let offset = 0;
+	for (const chunk of chunks) {
+		archive.set(chunk, offset);
+		offset += chunk.length;
+	}
+	return archive;
+}
 /** @returns The NUL-terminated string in one header field. */
 function readField(header, offset, length) {
 	let end = offset;
 	while (end < offset + length && header[end] !== 0) end += 1;
-	return decoder$1.decode(header.subarray(offset, end));
+	return decoder$2.decode(header.subarray(offset, end));
 }
 /**
 * Parse an uncompressed ustar archive.
@@ -1745,8 +1858,8 @@ function parseTar(archive) {
 * authority when an asynchronous durable sink mirrors selected subtrees.
 * @module @deepseek-ai/dsh-experimental-webworker-runtime/src/storage/memory
 */
-const decoder = new TextDecoder();
-const encoder$1 = new TextEncoder();
+const decoder$1 = new TextDecoder();
+const encoder$2 = new TextEncoder();
 /** Creation default for files, Node's `0o666` under the classic `022` umask. */
 const DEFAULT_FILE_MODE = 420;
 /** Creation default for directories, Node's `0o777` under the classic `022` umask. */
@@ -2072,7 +2185,7 @@ var MemoryVfs = class {
 			if (this.directories.has(target)) fail("EISDIR", "read", target);
 			fail("ENOENT", "open", target);
 		}
-		return encodingOf$1(options) === void 0 ? node.bytes : decoder.decode(node.bytes);
+		return encodingOf$1(options) === void 0 ? node.bytes : decoder$1.decode(node.bytes);
 	}
 	/**
 	* Report whether a path exists.
@@ -2362,7 +2475,7 @@ var MemoryVfs = class {
 		}
 		const previous = this.files.get(target);
 		const mode = previous?.mode ?? (options?.mode !== void 0 ? options.mode & 511 : DEFAULT_FILE_MODE);
-		const bytes = typeof data === "string" ? encoder$1.encode(data) : data;
+		const bytes = typeof data === "string" ? encoder$2.encode(data) : data;
 		if (previous !== void 0) {
 			this.replaceFile(previous, bytes);
 			return;
@@ -2434,7 +2547,7 @@ var MemoryVfs = class {
 		};
 		return {
 			write: async (data) => {
-				const bytes = typeof data === "string" ? encoder$1.encode(data) : data;
+				const bytes = typeof data === "string" ? encoder$2.encode(data) : data;
 				const descriptor = current("write");
 				const offset = descriptor.append ? descriptor.stat().size : position;
 				const bytesWritten = descriptor.write(offset, bytes);
@@ -2442,7 +2555,7 @@ var MemoryVfs = class {
 				return { bytesWritten };
 			},
 			writeFile: async (data) => {
-				const bytes = typeof data === "string" ? encoder$1.encode(data) : data;
+				const bytes = typeof data === "string" ? encoder$2.encode(data) : data;
 				const descriptor = current("write");
 				const offset = descriptor.append ? descriptor.stat().size : position;
 				position = offset + descriptor.write(offset, bytes);
@@ -2451,7 +2564,7 @@ var MemoryVfs = class {
 				const descriptor = current("read");
 				const bytes = descriptor.read(position, Math.max(0, descriptor.stat().size - position));
 				position += bytes.length;
-				return encodingOf$1(options) === void 0 ? bytes : decoder.decode(bytes);
+				return encodingOf$1(options) === void 0 ? bytes : decoder$1.decode(bytes);
 			},
 			truncate: async (length = 0) => {
 				current("ftruncate").truncate(length);
@@ -2546,7 +2659,7 @@ var MemoryVfs = class {
 		const target = this.key(path);
 		this.requireArrived("open", target);
 		const existing = this.files.get(target);
-		const addition = typeof data === "string" ? encoder$1.encode(data) : data;
+		const addition = typeof data === "string" ? encoder$2.encode(data) : data;
 		if (existing === void 0) {
 			this.writeFileSync(target, addition);
 			return;
@@ -2788,7 +2901,7 @@ var MemoryVfs = class {
 		this.seedDirectory(dirname$1(target));
 		this.deferred.delete(target);
 		this.setFile(target, {
-			bytes: typeof data === "string" ? encoder$1.encode(data) : data,
+			bytes: typeof data === "string" ? encoder$2.encode(data) : data,
 			mtimeMs: options.mtimeMs ?? this.touch(target),
 			mode: (options.mode ?? DEFAULT_FILE_MODE) & 511,
 			paths: void 0
@@ -2943,6 +3056,50 @@ const XDG_OPEN_EXECUTABLE = {
 	}
 };
 //#endregion
+//#region src/package-assets.ts
+/**
+* Package assets for the preview page. A Client bundle names each image as a
+* document-relative reference, `plugins/<package>/assets/<path>`, and resolves
+* it through the module loader's synchronous `require.asset`. The page of the
+* Worker preview cannot request such a URL itself, so the Worker hands it every
+* asset the image holds in one archive and the page maps each reference to a
+* Blob URL before any bundle runs.
+* @module @deepseek-ai/dsh-experimental-webworker-runtime/src/package-assets
+*/
+/** Entries of one directory. */
+function entriesOf(vfs, directory) {
+	return vfs.readdirSync(directory, { withFileTypes: true });
+}
+/** Files under one directory, as `/`-separated paths relative to it. */
+function filesBelow(vfs, directory, prefix = "") {
+	return entriesOf(vfs, directory).flatMap((entry) => entry.isDirectory() ? filesBelow(vfs, join$1(directory, entry.name), `${prefix}${entry.name}/`) : entry.isFile() ? [`${prefix}${entry.name}`] : []);
+}
+/** Installed package directories under `node_modules`, scoped ones included. */
+function packageDirectories(vfs, modules) {
+	if (!vfs.existsSync(modules)) return [];
+	return entriesOf(vfs, modules).filter((entry) => entry.isDirectory()).flatMap((entry) => entry.name.startsWith("@") ? entriesOf(vfs, join$1(modules, entry.name)).filter((scoped) => scoped.isDirectory()).map((scoped) => join$1(modules, entry.name, scoped.name)) : [join$1(modules, entry.name)]);
+}
+/**
+* Archive every file a package of the image publishes through `"./assets/*": "./lib/assets/*"`.
+* @param vfs - Mounted image filesystem.
+* @param root - Image root holding `node_modules`.
+* @returns An uncompressed tar whose entries are named `plugins/<package>/assets/<path>` with the path unencoded,
+* so every name fits the ustar limits the base image already met.
+*/
+function packPackageAssets(vfs, root) {
+	const files = {};
+	for (const directory of packageDirectories(vfs, join$1(root, "node_modules"))) {
+		const manifestPath = join$1(directory, "package.json");
+		if (!vfs.existsSync(manifestPath)) continue;
+		const manifest = JSON.parse(vfs.readFileSync(manifestPath, "utf8"));
+		if (typeof manifest.name !== "string" || manifest.exports?.["./assets/*"] !== "./lib/assets/*") continue;
+		const assets = join$1(directory, "lib", "assets");
+		if (!vfs.existsSync(assets)) continue;
+		for (const path of filesBelow(vfs, assets)) files[`plugins/${manifest.name}/assets/${path}`] = vfs.readFileSync(join$1(assets, path));
+	}
+	return packTar(files);
+}
+//#endregion
 //#region src/image-manifest.ts
 /**
 * The base image's manifest: what the packer records about one image and what
@@ -3118,7 +3275,8 @@ function createWorkerHost(options) {
 			const peer = connection.browserPeer;
 			tunnel.serve({
 				directFetch: (request) => handler.fetch(request, peer),
-				bootPayload: () => readBootPayload(ctx),
+				bootPayload: () => readBootPayload(ctx, peer),
+				packageAssets: () => packPackageAssets(mounted, root),
 				openStream: (endpoint, payload, uplink, signal) => typertGateway.wireStream.open(endpoint, payload, uplink, peer, signal),
 				streamFailure: typertGateway.wireStream.failure
 			});
@@ -3260,12 +3418,13 @@ function prepareProfile(appBoot, vfs, manifest, root, env) {
 * from the in-process webserver service, never from the API surface, because
 * the page has no Cordis tree yet.
 * @param ctx - Booted host context.
+* @param peer - the browser Peer the page speaks for.
 * @returns Boot payload for `GET /__boot__`.
 */
-function readBootPayload(ctx) {
+function readBootPayload(ctx, peer) {
 	const webServer = ctx.get("webServer");
 	if (webServer === void 0) throw new Error("webworker host: no webServer service, so the page cannot receive its boot injections");
-	return { injections: webServer.collectIndexInjections() };
+	return { injections: webServer.collectIndexInjections(peer) };
 }
 //#endregion
 //#region ../../../node_modules/.pnpm/base64-js@1.5.1/node_modules/base64-js/index.js
@@ -4725,6 +4884,28 @@ var buffer_exports = /* @__PURE__ */ __exportAll({
 	kMaxLength: () => import_buffer.kMaxLength
 });
 var import_buffer = require_buffer();
+const encoder$1 = new TextEncoder();
+const decoder = new TextDecoder("utf-8", { ignoreBOM: true });
+const UTF8 = /^utf-?8$/i;
+const packageFrom = import_buffer.Buffer.from.bind(import_buffer.Buffer);
+const bufferPrototype = import_buffer.Buffer.prototype;
+const packageToString = bufferPrototype.toString;
+/** Whether an omitted or string encoding argument names UTF-8. */
+function isUtf8(encoding) {
+	return encoding === void 0 || typeof encoding === "string" && UTF8.test(encoding);
+}
+import_buffer.Buffer.from = function from(value, encodingOrOffset, length) {
+	if (typeof value === "string" && isUtf8(encodingOrOffset)) {
+		const bytes = encoder$1.encode(value);
+		return packageFrom(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+	}
+	return packageFrom(value, encodingOrOffset, length);
+};
+bufferPrototype.toString = function toString(encoding, start, end) {
+	if (start === void 0 && end === void 0 && isUtf8(encoding)) return decoder.decode(this);
+	return packageToString.call(this, encoding, start, end);
+};
+Reflect.set(bufferPrototype, "toLocaleString", bufferPrototype.toString);
 Object.defineProperty(globalThis, "Buffer", {
 	value: import_buffer.Buffer,
 	writable: true,
@@ -4777,9 +4958,10 @@ var buffer_default = {
 * itself back over whoever came after it. The three slots are separate for the same reason — a restored
 * copy pushed onto the folding stack could unwind another boundary's entry.
 *
-* A snapshot with no stores at all is `undefined`, and the hook layer then wraps
-* nothing: a callback registered outside every boundary keeps inheriting the
-* enclosing boundary rather than being masked to `undefined`. `__snapshotAll` is
+* A snapshot with no stores or explicit contexts is `undefined`, and the hook layer
+* then wraps nothing: a callback registered outside every boundary keeps inheriting
+* the enclosing boundary. Explicit empty contexts retain their `undefined` stores,
+* so deferred callbacks cannot inherit unrelated work. `__snapshotAll` is
 * the transformer-facing counterpart and always captures every instance, including
 * the ones reading `undefined`, because a resumed frame must see exactly what it
 * saw at its pause point.
@@ -4942,13 +5124,13 @@ var AsyncLocalStorage = class AsyncLocalStorage {
 	/**
 	* Copy every live instance's current store. Not part of the Node face: this is
 	* the shim's own mechanism, kept in the class so the overlay stays private.
-	* @returns the snapshot, or undefined when no instance has a store.
+	* @returns the snapshot, or undefined when no instance has a store or explicit context.
 	*/
 	static captureContext() {
 		let captured;
 		for (const instance of instances) {
 			const store = instance.getStore();
-			if (store === void 0) continue;
+			if (store === void 0 && instance.overlay === void 0 && instance.resumed === void 0 && instance.ambients.length === 0 && instance.entries.length === 0) continue;
 			captured ??= [];
 			captured.push({
 				instance,
@@ -5006,8 +5188,8 @@ var AsyncLocalStorage = class AsyncLocalStorage {
 };
 /**
 * Copy every live instance's current store.
-* @returns the snapshot, or undefined when no instance has a store (the hook
-* layer then wraps nothing and callbacks inherit the stack top).
+* @returns the snapshot, or undefined when no instance has a store or explicit
+* context (the hook layer then wraps nothing and callbacks inherit the stack top).
 */
 function captureAsyncContext() {
 	return AsyncLocalStorage.captureContext();
@@ -13652,17 +13834,27 @@ var perf_hooks_exports = /* @__PURE__ */ __exportAll({
 	default: () => perf_hooks_default,
 	performance: () => performance$1
 });
-const MODULE$9 = "node:perf_hooks";
+const MODULE$10 = "node:perf_hooks";
 /** Same clock object the worker global exposes. */
 const performance$1 = globalThis.performance;
 /** Observation of performance entries has no consumer here. */
-const PerformanceObserver = notImplementedFail(MODULE$9, "PerformanceObserver");
+const PerformanceObserver = notImplementedFail(MODULE$10, "PerformanceObserver");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var perf_hooks_default = {
 	performance: performance$1,
 	PerformanceObserver
 };
 //#endregion
+//#region src/node/builtin_modules/implemented/string_decoder.ts
+var string_decoder_exports = /* @__PURE__ */ __exportAll({
+	StringDecoder: () => import_string_decoder.StringDecoder,
+	__esModule: () => true,
+	default: () => string_decoder_default
+});
+var import_string_decoder = require_string_decoder();
+/** CommonJS-compatible namespace for default imports. */
+var string_decoder_default = { StringDecoder: import_string_decoder.StringDecoder };
+//#endregion
 //#region src/node/builtin_modules/implemented/stream/promises.ts
 /** Promise-based stream completion and pipelines from the shared readable-stream implementation. */
 var promises_exports$1 = /* @__PURE__ */ __exportAll({
@@ -14027,7 +14219,7 @@ var zlib_exports = /* @__PURE__ */ __exportAll({
 	zstdDecompress: () => zstdDecompress,
 	zstdDecompressSync: () => zstdDecompressSync
 });
-const MODULE$8 = "node:zlib";
+const MODULE$9 = "node:zlib";
 /** Zstandard parameter/flush constants read at module scope by the JSONL backend. */
 const constants = {
 	ZSTD_c_compressionLevel: 100,
@@ -14041,13 +14233,13 @@ const constants = {
 	Z_FINISH: 4
 };
 /** One-shot Zstandard compression (unavailable; the composition writes plaintext logs). */
-const zstdCompressSync = notImplementedFail(MODULE$8, "zstdCompressSync");
+const zstdCompressSync = notImplementedFail(MODULE$9, "zstdCompressSync");
 /** One-shot Zstandard decompression (unavailable; the worker never reads compressed logs). */
-const zstdDecompressSync = notImplementedFail(MODULE$8, "zstdDecompressSync");
+const zstdDecompressSync = notImplementedFail(MODULE$9, "zstdDecompressSync");
 /** Callback form of {@link zstdCompressSync} (`promisify`'d at module scope by the backend). */
-const zstdCompress = notImplementedFail(MODULE$8, "zstdCompress");
+const zstdCompress = notImplementedFail(MODULE$9, "zstdCompress");
 /** Callback form of {@link zstdDecompressSync}. */
-const zstdDecompress = notImplementedFail(MODULE$8, "zstdDecompress");
+const zstdDecompress = notImplementedFail(MODULE$9, "zstdDecompress");
 /**
 * Streaming Zstandard decoder placeholder: the returned object deliberately
 * lacks Node's private `_handle`/`_writeState` members, which is the signal the
@@ -14058,15 +14250,15 @@ function createZstdDecompress() {
 	return { close: () => {} };
 }
 /** Streaming Zstandard encoder (unavailable; the backend only needs one-shot). */
-const createZstdCompress = notImplementedFail(MODULE$8, "createZstdCompress");
+const createZstdCompress = notImplementedFail(MODULE$9, "createZstdCompress");
 /** gzip family (unavailable; no consumer in the reachable tree). */
-const gzip = notImplementedFail(MODULE$8, "gzip");
+const gzip = notImplementedFail(MODULE$9, "gzip");
 /** gzip sync counterpart. */
-const gzipSync = notImplementedFail(MODULE$8, "gzipSync");
+const gzipSync = notImplementedFail(MODULE$9, "gzipSync");
 /** gunzip counterpart. */
-const gunzip = notImplementedFail(MODULE$8, "gunzip");
+const gunzip = notImplementedFail(MODULE$9, "gunzip");
 /** gunzip sync counterpart. */
-const gunzipSync = notImplementedFail(MODULE$8, "gunzipSync");
+const gunzipSync = notImplementedFail(MODULE$9, "gunzipSync");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var zlib_default = {
 	constants,
@@ -21364,7 +21556,7 @@ var child_process_exports = /* @__PURE__ */ __exportAll({
 	spawn: () => spawn$1,
 	spawnSync: () => spawnSync
 });
-const MODULE$7 = "node:child_process";
+const MODULE$8 = "node:child_process";
 /**
 * The readable half of a pipe: `data` events carrying Buffers, `end`, and a
 * `destroy` that stops delivery.
@@ -21629,7 +21821,7 @@ function spawnSync(program, args = []) {
 	if (executable !== void 0) {
 		const result = executable.runSync(args);
 		if (result.kind === "asynchronous") {
-			const error = /* @__PURE__ */ new Error(`${MODULE$7}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`);
+			const error = /* @__PURE__ */ new Error(`${MODULE$8}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`);
 			return {
 				pid: -1,
 				status: null,
@@ -21659,7 +21851,7 @@ function spawnSync(program, args = []) {
 			]
 		};
 	}
-	const error = standardPrograms().has(program) ? /* @__PURE__ */ new Error(`${MODULE$7}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`) : spawnEnoent(program);
+	const error = standardPrograms().has(program) ? /* @__PURE__ */ new Error(`${MODULE$8}.spawnSync cannot run ${program} in the worker host: commands run asynchronously`) : spawnEnoent(program);
 	return {
 		pid: -1,
 		status: null,
@@ -21736,11 +21928,11 @@ function execute(argv, options, callback) {
 	return child;
 }
 /** Run a command line synchronously (unavailable: the interpreter is asynchronous). */
-const execSync = notImplementedFail(MODULE$7, "execSync");
+const execSync = notImplementedFail(MODULE$8, "execSync");
 /** Run one program synchronously (unavailable: the interpreter is asynchronous). */
-const execFileSync = notImplementedFail(MODULE$7, "execFileSync");
+const execFileSync = notImplementedFail(MODULE$8, "execFileSync");
 /** Start a Node child (unavailable: the worker cannot create another Node runtime). */
-const fork = notImplementedFail(MODULE$7, "fork");
+const fork = notImplementedFail(MODULE$8, "fork");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var child_process_default = {
 	spawn: spawn$1,
@@ -21852,17 +22044,17 @@ var sqlite_exports = /* @__PURE__ */ __exportAll({
 	backup: () => backup,
 	default: () => sqlite_default
 });
-const MODULE$6 = "node:sqlite";
+const MODULE$7 = "node:sqlite";
 /** Synchronous database handle (unavailable). */
-const DatabaseSync = notImplementedFail(MODULE$6, "DatabaseSync");
+const DatabaseSync = notImplementedFail(MODULE$7, "DatabaseSync");
 /** Prepared statement handle (unavailable). */
-const StatementSync = notImplementedFail(MODULE$6, "StatementSync");
+const StatementSync = notImplementedFail(MODULE$7, "StatementSync");
 /**
 * Backup helper (unavailable).
 * @returns Never — it throws naming the unavailable member.
 */
 function backup() {
-	throw notAvailableError(MODULE$6, "backup");
+	throw notAvailableError(MODULE$7, "backup");
 }
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var sqlite_default = {
@@ -21887,19 +22079,19 @@ var vm_exports = /* @__PURE__ */ __exportAll({
 	runInNewContext: () => runInNewContext,
 	runInThisContext: () => runInThisContext
 });
-const MODULE$5 = "node:vm";
+const MODULE$6 = "node:vm";
 /** Compiled script (unavailable). */
-const Script = notImplementedFail(MODULE$5, "Script");
+const Script = notImplementedFail(MODULE$6, "Script");
 /** Context creation (unavailable). */
-const createContext = notImplementedFail(MODULE$5, "createContext");
+const createContext = notImplementedFail(MODULE$6, "createContext");
 /** In-context evaluation (unavailable). */
-const runInContext = notImplementedFail(MODULE$5, "runInContext");
+const runInContext = notImplementedFail(MODULE$6, "runInContext");
 /** New-context evaluation (unavailable). */
-const runInNewContext = notImplementedFail(MODULE$5, "runInNewContext");
+const runInNewContext = notImplementedFail(MODULE$6, "runInNewContext");
 /** This-context evaluation (unavailable). */
-const runInThisContext = notImplementedFail(MODULE$5, "runInThisContext");
+const runInThisContext = notImplementedFail(MODULE$6, "runInThisContext");
 /** Context predicate (unavailable). */
-const isContext = notImplementedFail(MODULE$5, "isContext");
+const isContext = notImplementedFail(MODULE$6, "isContext");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var vm_default = {
 	Script,
@@ -21910,6 +22102,18 @@ var vm_default = {
 	isContext
 };
 //#endregion
+//#region src/node/builtin_modules/mock/repl.ts
+/** Node REPL imports are available for packaging; starting a native REPL requires a Node Host. */
+var repl_exports = /* @__PURE__ */ __exportAll({
+	__esModule: () => true,
+	default: () => repl_default,
+	start: () => start
+});
+/** REPL construction is unavailable in the browser worker. */
+const start = notImplementedFail("node:repl", "start");
+/** CommonJS export for the REPL member used by the Node PTC evaluator. */
+var repl_default = { start };
+//#endregion
 //#region src/node/builtin_modules/mock/worker_threads.ts
 /**
 * `node:worker_threads` stub. Nested workers are unsupported, so the workflow
@@ -21930,17 +22134,17 @@ var worker_threads_exports = /* @__PURE__ */ __exportAll({
 	threadId: () => 0,
 	workerData: () => void 0
 });
-const MODULE$4 = "node:worker_threads";
+const MODULE$5 = "node:worker_threads";
 /** Worker-thread construction (unavailable). */
-const Worker$1 = notImplementedFail(MODULE$4, "Worker");
+const Worker$1 = notImplementedFail(MODULE$5, "Worker");
 /** Channel construction (unavailable). */
-const MessageChannel = notImplementedFail(MODULE$4, "MessageChannel");
+const MessageChannel = notImplementedFail(MODULE$5, "MessageChannel");
 /** Port construction (unavailable). */
-const MessagePort = notImplementedFail(MODULE$4, "MessagePort");
+const MessagePort = notImplementedFail(MODULE$5, "MessagePort");
 /** Object transfer marking (unavailable). */
-const markAsUntransferable = notImplementedFail(MODULE$4, "markAsUntransferable");
+const markAsUntransferable = notImplementedFail(MODULE$5, "markAsUntransferable");
 /** Port receiving on a message channel (unavailable). */
-const receiveMessageOnPort = notImplementedFail(MODULE$4, "receiveMessageOnPort");
+const receiveMessageOnPort = notImplementedFail(MODULE$5, "receiveMessageOnPort");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var worker_threads_default = {
 	Worker: Worker$1,
@@ -21993,7 +22197,7 @@ var koffi_exports = /* @__PURE__ */ __exportAll({
 	struct: () => struct,
 	types: () => types
 });
-const MODULE$3 = "koffi";
+const MODULE$4 = "koffi";
 /** Primitive sizes koffi's own x64 ABI reports. */
 const PRIMITIVES = {
 	void: 0,
@@ -22103,15 +22307,15 @@ const koffi = {
 	},
 	sizeof: (target) => typeOf(target).size,
 	alignof: (target) => typeOf(target).alignment,
-	load: notImplementedFail(MODULE$3, "load"),
-	alloc: notImplementedFail(MODULE$3, "alloc"),
-	free: notImplementedFail(MODULE$3, "free"),
-	decode: notImplementedFail(MODULE$3, "decode"),
-	encode: notImplementedFail(MODULE$3, "encode"),
-	address: notImplementedFail(MODULE$3, "address"),
-	register: notImplementedFail(MODULE$3, "register"),
-	unregister: notImplementedFail(MODULE$3, "unregister"),
-	call: notImplementedFail(MODULE$3, "call")
+	load: notImplementedFail(MODULE$4, "load"),
+	alloc: notImplementedFail(MODULE$4, "alloc"),
+	free: notImplementedFail(MODULE$4, "free"),
+	decode: notImplementedFail(MODULE$4, "decode"),
+	encode: notImplementedFail(MODULE$4, "encode"),
+	address: notImplementedFail(MODULE$4, "address"),
+	register: notImplementedFail(MODULE$4, "register"),
+	unregister: notImplementedFail(MODULE$4, "unregister"),
+	call: notImplementedFail(MODULE$4, "call")
 };
 //#endregion
 //#region src/node/external_packages/libreoffice-kit.ts
@@ -22136,11 +22340,11 @@ var node_pty_exports = /* @__PURE__ */ __exportAll({
 	open: () => open,
 	spawn: () => spawn
 });
-const MODULE$2 = "node-pty";
+const MODULE$3 = "node-pty";
 /** Spawn a pseudo-terminal (unavailable). */
-const spawn = notImplementedFail(MODULE$2, "spawn");
+const spawn = notImplementedFail(MODULE$3, "spawn");
 /** Open a pseudo-terminal pair (unavailable). */
-const open = notImplementedFail(MODULE$2, "open");
+const open = notImplementedFail(MODULE$3, "open");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var node_pty_default = {
 	spawn,
@@ -22261,17 +22465,17 @@ var pi_ai_exports = /* @__PURE__ */ __exportAll({
 	openAICompletionsApi: () => openAICompletionsApi,
 	openAIResponsesApi: () => openAIResponsesApi
 });
-const MODULE$1 = "@earendil-works/pi-ai";
+const MODULE$2 = "@earendil-works/pi-ai";
 /** Provider factory (unavailable). */
-const createProvider = notImplementedFail(MODULE$1, "createProvider");
+const createProvider = notImplementedFail(MODULE$2, "createProvider");
 /** Model-list factory (unavailable). */
-const createModels = notImplementedFail(MODULE$1, "createModels");
+const createModels = notImplementedFail(MODULE$2, "createModels");
 /** Thinking-level catalog (unavailable). */
-const getSupportedThinkingLevels = notImplementedFail(MODULE$1, "getSupportedThinkingLevels");
+const getSupportedThinkingLevels = notImplementedFail(MODULE$2, "getSupportedThinkingLevels");
 /** Context-overflow predicate (unavailable). */
-const isContextOverflow = notImplementedFail(MODULE$1, "isContextOverflow");
+const isContextOverflow = notImplementedFail(MODULE$2, "isContextOverflow");
 /** Collection of every builtin provider (unavailable). */
-const builtinModels = notImplementedFail(MODULE$1, "builtinModels");
+const builtinModels = notImplementedFail(MODULE$2, "builtinModels");
 /**
 * Preview provider ids, in catalog order. This fixed subset must use valid
 * installed pi-ai identifiers so the adapter can attach authentication metadata.
@@ -22348,11 +22552,11 @@ function getAllBuiltinModels() {
 	return [];
 }
 /** Anthropic messages API binding (unavailable). */
-const anthropicMessagesApi = notImplementedFail(MODULE$1, "anthropicMessagesApi");
+const anthropicMessagesApi = notImplementedFail(MODULE$2, "anthropicMessagesApi");
 /** OpenAI completions API binding (unavailable). */
-const openAICompletionsApi = notImplementedFail(MODULE$1, "openAICompletionsApi");
+const openAICompletionsApi = notImplementedFail(MODULE$2, "openAICompletionsApi");
 /** OpenAI responses API binding (unavailable). */
-const openAIResponsesApi = notImplementedFail(MODULE$1, "openAIResponsesApi");
+const openAIResponsesApi = notImplementedFail(MODULE$2, "openAIResponsesApi");
 /** CommonJS default export: the members `require()` hands a caller of this module. */
 var pi_ai_default = {
 	createProvider,
@@ -22368,6 +22572,74 @@ var pi_ai_default = {
 	openAIResponsesApi
 };
 //#endregion
+//#region src/node/external_packages/pi-coding-agent.ts
+/** Pi's native SDK loads for plugin metadata, but agent and tool operations require a Node Host. */
+var pi_coding_agent_exports = /* @__PURE__ */ __exportAll({
+	ModelRegistry: () => ModelRegistry,
+	ModelRuntime: () => ModelRuntime,
+	ProjectTrustStore: () => ProjectTrustStore,
+	SessionManager: () => SessionManager,
+	SettingsManager: () => SettingsManager,
+	__esModule: () => true,
+	createAgentSessionFromServices: () => createAgentSessionFromServices,
+	createAgentSessionServices: () => createAgentSessionServices,
+	createBashToolDefinition: () => createBashToolDefinition,
+	createMcpExtension: () => createMcpExtension,
+	default: () => pi_coding_agent_default,
+	defineTool: () => defineTool,
+	getAgentDir: () => getAgentDir,
+	initTheme: () => initTheme,
+	resolveCliModel: () => resolveCliModel
+});
+const MODULE$1 = "@earendil-works/pi-coding-agent";
+/** Agent directory discovery (unavailable). */
+const getAgentDir = notImplementedFail(MODULE$1, "getAgentDir");
+/** Theme initialization (unavailable). */
+const initTheme = notImplementedFail(MODULE$1, "initTheme");
+/** Agent session service creation (unavailable). */
+const createAgentSessionServices = notImplementedFail(MODULE$1, "createAgentSessionServices");
+/** Agent session creation from services (unavailable). */
+const createAgentSessionFromServices = notImplementedFail(MODULE$1, "createAgentSessionFromServices");
+/** Bash tool definition creation (unavailable). */
+const createBashToolDefinition = notImplementedFail(MODULE$1, "createBashToolDefinition");
+/** MCP extension creation (unavailable). */
+const createMcpExtension = notImplementedFail(MODULE$1, "createMcpExtension");
+/** Tool definition (unavailable). */
+const defineTool = notImplementedFail(MODULE$1, "defineTool");
+/** CLI model selection (unavailable). */
+const resolveCliModel = notImplementedFail(MODULE$1, "resolveCliModel");
+/** Model registry construction (unavailable). */
+const ModelRegistry = notImplementedFail(MODULE$1, "ModelRegistry");
+/** Project trust store construction (unavailable). */
+const ProjectTrustStore = notImplementedFail(MODULE$1, "ProjectTrustStore");
+/** Model runtime construction and creation (unavailable). */
+const ModelRuntime = Object.assign(notImplementedFail(MODULE$1, "ModelRuntime"), { create: notImplementedFail(MODULE$1, "ModelRuntime.create") });
+/** Settings manager construction and creation (unavailable). */
+const SettingsManager = Object.assign(notImplementedFail(MODULE$1, "SettingsManager"), { create: notImplementedFail(MODULE$1, "SettingsManager.create") });
+/** Session manager construction and storage operations (unavailable). */
+const SessionManager = Object.assign(notImplementedFail(MODULE$1, "SessionManager"), {
+	create: notImplementedFail(MODULE$1, "SessionManager.create"),
+	open: notImplementedFail(MODULE$1, "SessionManager.open"),
+	inMemory: notImplementedFail(MODULE$1, "SessionManager.inMemory"),
+	list: notImplementedFail(MODULE$1, "SessionManager.list")
+});
+/** CommonJS default export: the members `require()` hands a caller of this module. */
+var pi_coding_agent_default = {
+	getAgentDir,
+	initTheme,
+	createAgentSessionServices,
+	createAgentSessionFromServices,
+	createBashToolDefinition,
+	createMcpExtension,
+	defineTool,
+	resolveCliModel,
+	ModelRegistry,
+	ProjectTrustStore,
+	ModelRuntime,
+	SettingsManager,
+	SessionManager
+};
+//#endregion
 //#region src/node/external_packages/ripgrep.ts
 var ripgrep_exports = /* @__PURE__ */ __exportAll({
 	__esModule: () => true,
@@ -22462,6 +22734,7 @@ const Server = WebSocketServer;
 /** Package or subpath specifiers served from the worker bundle instead of the VFS. */
 const REPLACED_EXTERNAL_PACKAGES = [
 	"@earendil-works/pi-ai",
+	"@earendil-works/pi-coding-agent",
 	"@vscode/ripgrep",
 	"@deepseek-ai/libreoffice-kit",
 	"@deepseek-ai/node-addon-system/flock",
@@ -22517,8 +22790,10 @@ const BUILTINS = {
 	path: () => path_exports,
 	"path/posix": () => path_exports,
 	perf_hooks: () => perf_hooks_exports,
+	repl: () => repl_exports,
 	sqlite: () => sqlite_exports,
 	stream: () => stream_exports,
+	string_decoder: () => string_decoder_exports,
 	"stream/promises": () => promises_exports$1,
 	"timers/promises": () => promises_exports,
 	tty: () => tty_exports,
@@ -22541,7 +22816,8 @@ const EXTERNALS = {
 	"node-addon-require-builtin": () => node_addon_require_builtin_exports,
 	"ws": () => ws_exports,
 	"@vscode/ripgrep": () => ripgrep_exports,
-	"@earendil-works/pi-ai": () => pi_ai_exports
+	"@earendil-works/pi-ai": () => pi_ai_exports,
+	"@earendil-works/pi-coding-agent": () => pi_coding_agent_exports
 };
 /**
 * Prefixes whose every subpath resolves to one replacement module. The loader