@dsh-enhanced/assistant-automations 0.1.65 → 0.1.67

package/lib/native-agent-execution.js

@@ -0,0 +1,922 @@
+import { acceptanceDigest } from '@dsh-enhanced/task-acceptance-contract';
+import { hostAgentToolSchemaDigest } from './host-agent-execution.js';
+import { createHash } from 'node:crypto';
+import { installModelSelection, } from '@deepseek-ai/dsh-agent';
+import { ReasoningEffortId, createUserMessage } from '@deepseek-ai/dsh-llm';
+import { appendPluginRecord, SessionId } from '@deepseek-ai/dsh-session';
+import { resolveLlmRouteCapability } from '@dsh-enhanced/llm-route-capabilities';
+import { HostAutomationExecutorRegistry, HostExecutorRegistryError, } from './host-executors.js';
+import { AutomationRunnerAmbiguousError, AutomationRunnerFailureError, } from './coordinator.js';
+import { isHostAutomationDefinition } from './types.js';
+const usageFields = [
+    'inputTokens',
+    'outputTokens',
+    'cacheReadTokens',
+    'cacheWriteTokens',
+    'reasoningTokens',
+];
+function summarize(events, signal) {
+    let output = '';
+    // Seeded empty, not zeroed: execution evidence must distinguish a provider
+    // that reported zero from one that never supplied usage at all.
+    const usage = {};
+    let turnReason;
+    for (const event of events) {
+        if (event.type === 'assistant/message') {
+            const text = event.data.message.content
+                .filter(block => block.type === 'text')
+                .map(block => block.type === 'text' ? block.text : '')
+                .join('');
+            if (text !== '')
+                output = text;
+            if (event.data.usage !== undefined) {
+                for (const field of usageFields) {
+                    const amount = event.data.usage[field];
+                    if (amount !== undefined)
+                        usage[field] = (usage[field] ?? 0) + amount;
+                }
+            }
+        }
+        if (event.type === 'turn/end')
+            turnReason = event.data.reason;
+    }
+    let outcome = 'unknown';
+    if (signal.aborted)
+        outcome = 'cancelled';
+    else if (typeof turnReason === 'object' && turnReason !== null && 'kind' in turnReason) {
+        const kind = turnReason.kind;
+        if (kind === 'completed' || kind === 'max-tokens')
+            outcome = 'succeeded';
+        else if (kind === 'aborted')
+            outcome = 'cancelled';
+        else if (kind === 'blocked' || kind === 'error')
+            outcome = 'failed';
+    }
+    const turnKind = typeof turnReason === 'object' && turnReason !== null && 'kind' in turnReason
+        ? String(turnReason.kind)
+        : undefined;
+    return { outcome, output, usage, ...(turnKind === undefined ? {} : { turnKind }) };
+}
+function stableFailureCode(error, phase) {
+    if (typeof error === 'object' && error !== null && 'code' in error) {
+        const code = error.code;
+        if (typeof code === 'string' && /^[A-Za-z0-9][A-Za-z0-9._:-]{0,63}$/u.test(code))
+            return code;
+    }
+    const defaults = {
+        preflight: 'preflight-failed',
+        'artifact-write': 'artifact-write-failed',
+        'budget-reservation': 'budget-reservation-failed',
+        'preset-resolution': 'preset-resolution-failed',
+        'agent-creation': 'agent-creation-failed',
+        'agent-disposal': 'agent-disposal-failed',
+        'agent-setup': 'agent-setup-failed',
+        'prompt-submission': 'prompt-submission-failed',
+        'model-execution': 'model-execution-failed',
+        'session-flush': 'session-flush-failed',
+        'budget-settlement': 'budget-settlement-failed',
+    };
+    return defaults[phase] ?? 'runner-failed';
+}
+function failureClass(phase, signal, error) {
+    if (signal.aborted)
+        return 'cancelled';
+    if (phase === 'budget-reservation' || phase === 'budget-settlement')
+        return 'budget';
+    if (typeof error === 'object' && error !== null && 'name' in error
+        && (error.name === 'AssistantPolicyError' || error.name === 'PolicyLedgerError'))
+        return 'policy';
+    if (phase === 'preflight' || phase === 'preset-resolution' || phase === 'agent-setup')
+        return 'configuration';
+    if (phase === 'agent-creation' || phase === 'agent-disposal' || phase === 'session-flush')
+        return 'infrastructure';
+    if (phase === 'prompt-submission' || phase === 'model-execution')
+        return 'provider';
+    return 'unknown';
+}
+function diagnostic(input) {
+    return Object.freeze({
+        schemaVersion: 1,
+        ...input,
+        retryability: input.failureClass === 'none'
+            ? input.sideEffectState === 'none' ? 'safe' : 'unsafe'
+            : input.sideEffectState === 'possible' || input.sideEffectState === 'unknown'
+                ? 'unsafe'
+                : input.failureClass === 'configuration' || input.failureClass === 'policy' || input.failureClass === 'budget'
+                    ? 'after-intervention'
+                    : 'safe',
+    });
+}
+export class AutomationBudgetReplayError extends AutomationRunnerFailureError {
+    reservationStatus;
+    code = 'automation-budget-reservation-replayed';
+    constructor(reservationStatus) {
+        super(`assistant-automations: budget reservation replay is ${reservationStatus}; refusing duplicate execution`, diagnostic({
+            failureClass: 'budget',
+            failurePhase: 'budget-reservation',
+            failureCode: 'automation-budget-reservation-replayed',
+            promptSubmissionState: reservationStatus === 'released' ? 'not-submitted' : 'unknown',
+            sideEffectState: reservationStatus === 'released' ? 'none' : 'unknown',
+            budgetSettlementState: reservationStatus,
+        }));
+        this.reservationStatus = reservationStatus;
+        this.name = 'AutomationBudgetReplayError';
+    }
+}
+export const AUTOMATION_RUN_BUDGET_METRIC = 'automation-runs';
+const RECOVERY_HOST_EXECUTOR_ID = 'assistant-recovery';
+/**
+ * Bind a Host reservation to the exact immutable execution snapshot.  The
+ * digest avoids delimiter collisions in caller-controlled ids while keeping
+ * the Policy ledger key bounded and content-free.
+ */
+function hostBudgetIdempotencyKey(input, immutableDefinitionHash, budgetId) {
+    const digest = createHash('sha256').update(JSON.stringify([
+        'assistant-automations-host-budget/v1',
+        input.automation.id,
+        input.occurrence.id,
+        immutableDefinitionHash,
+        AUTOMATION_RUN_BUDGET_METRIC,
+        budgetId,
+    ])).digest('hex');
+    return `automation-budget:host:v1:${digest}`;
+}
+function exactHostRunnerInput(input) {
+    return input.occurrence.automationId === input.automation.id
+        && input.task.automationId === input.automation.id
+        && input.task.occurrenceId === input.occurrence.id
+        && input.task.status === 'running'
+        && Number.isSafeInteger(input.task.attemptCount)
+        && input.task.attemptCount >= 1;
+}
+function isAuthorizedRecoveryResume(input, definition) {
+    return input.task.attemptCount > 1
+        && input.task.attemptCount <= definition.maxRetries + 1
+        && definition.retrySafety === 'idempotent'
+        && definition.execution.executorId === RECOVERY_HOST_EXECUTOR_ID;
+}
+/** Prove the configured Policy budget uses the fixed per-run unit before reservation. */
+export function assertAutomationRunBudget(policy, budgetId) {
+    const budget = policy.getBudgetConfig(budgetId);
+    if (budget === undefined) {
+        throw new Error(`assistant-automations: budget is not configured: ${budgetId}`);
+    }
+    if (budget.id !== budgetId || budget.metric !== AUTOMATION_RUN_BUDGET_METRIC) {
+        throw new Error(`assistant-automations: budget ${budgetId} must use ${AUTOMATION_RUN_BUDGET_METRIC}, got ${budget.metric}`);
+    }
+    return budget;
+}
+function requireAdapterToolCallProtocol(llm, provider, model, presetId, toolCount) {
+    if (toolCount === 0)
+        return;
+    if (resolveLlmRouteCapability(llm, provider, model)?.toolCalls === 'none') {
+        throw new Error(`assistant-automations: adapter ${provider}/${model} declares no DSH tool-call protocol for preset ${presetId}`);
+    }
+}
+class NativeAgentExecution {
+    ctx;
+    policy;
+    hostContract;
+    allowUnbudgetedExecution;
+    prepareAcceptance;
+    acceptanceEnabled;
+    beforePrompt;
+    maxModelCalls;
+    modelOnly;
+    constructor(ctx, policy, options = {}, hostContract) {
+        this.ctx = ctx;
+        this.policy = policy;
+        this.hostContract = hostContract;
+        this.allowUnbudgetedExecution = options.allowUnbudgetedExecution ?? false;
+        this.prepareAcceptance = options.prepareAcceptance;
+        this.acceptanceEnabled = options.acceptanceEnabled;
+        this.beforePrompt = options.beforePrompt;
+        if (options.maxModelCalls !== undefined && (!Number.isSafeInteger(options.maxModelCalls) || options.maxModelCalls < 1)) {
+            throw new Error('assistant-automations: maxModelCalls must be a positive safe integer');
+        }
+        this.maxModelCalls = options.maxModelCalls;
+        this.modelOnly = options.modelOnly ?? false;
+    }
+    async run(input) {
+        const definition = input.automation.definition;
+        if (isHostAutomationDefinition(definition)) {
+            throw new AutomationRunnerFailureError('assistant-automations: Host definitions require a registered Host executor', diagnostic({
+                failureClass: 'configuration', failurePhase: 'executor-availability',
+                failureCode: 'host-executor-router-missing', promptSubmissionState: 'not-applicable',
+                sideEffectState: 'none', budgetSettlementState: definition.budgetId === undefined
+                    ? 'not-required'
+                    : 'not-reserved',
+            }));
+        }
+        if (this.modelOnly && (definition.allowedTools.length !== 0 || definition.maxToolCalls !== 0)) {
+            throw new AutomationRunnerFailureError('assistant-automations: modelOnly runner requires an empty immutable tool contract', diagnostic({ failureClass: 'configuration', failurePhase: 'preflight', failureCode: 'model-only-tool-contract-invalid',
+                promptSubmissionState: 'not-submitted', sideEffectState: 'none', budgetSettlementState: definition.budgetId === undefined ? 'not-required' : 'not-reserved' }));
+        }
+        const budgetId = definition.budgetId;
+        let reservationId;
+        let reservationSettled = false;
+        let handle;
+        let setupAgent;
+        let agentCreationSubmitted = false;
+        let followupSubmitted = false;
+        let removeAbort;
+        let toolCalls = 0;
+        let phase = 'preflight';
+        let promptSubmissionState = 'not-submitted';
+        let sideEffectState = 'none';
+        let budgetSettlementState = budgetId === undefined
+            ? 'not-required'
+            : 'not-reserved';
+        try {
+            this.hostContract?.deadline.check();
+            const agents = this.ctx.get('agents');
+            const sessions = this.ctx.get('sessions');
+            const tools = this.ctx.get('tools');
+            const llm = this.ctx.get('llm');
+            if (agents === undefined || sessions === undefined || tools === undefined || llm === undefined) {
+                throw new Error('assistant-automations: agents, sessions, and tools services are required');
+            }
+            const allowed = new Set(input.occurrence.dryRun ? [] : definition.allowedTools);
+            if (input.signal.aborted)
+                throw new Error('assistant-automations: run was cancelled before Agent creation');
+            phase = 'budget-reservation';
+            if (budgetId === undefined && !this.allowUnbudgetedExecution) {
+                throw new Error('assistant-automations: a configured budget is required for unattended execution');
+            }
+            if (budgetId !== undefined)
+                assertAutomationRunBudget(this.policy, budgetId);
+            const agentPresets = (this.hostContract ? undefined : this.ctx.get('agentPresets'));
+            phase = 'preset-resolution';
+            const presetId = agentPresets === undefined
+                ? definition.agentPreset
+                : (await agentPresets.resolve(definition.agentPreset)).id;
+            if (budgetId !== undefined) {
+                phase = 'budget-reservation';
+                const reservation = this.policy.reserve({
+                    budgetId,
+                    subject: {
+                        kind: 'background',
+                        id: input.automation.id,
+                        workspace: definition.workspace,
+                        principal: definition.principal,
+                    },
+                    amount: definition.budgetAmount,
+                    idempotencyKey: [
+                        'automation-budget', input.automation.id, input.occurrence.id, AUTOMATION_RUN_BUDGET_METRIC, budgetId,
+                    ].join(':'),
+                });
+                if (reservation.replayed || reservation.status !== 'reserved') {
+                    throw new AutomationBudgetReplayError(reservation.status);
+                }
+                reservationId = reservation.reservationId;
+                budgetSettlementState = 'reserved';
+            }
+            phase = 'preflight';
+            const globalNames = tools.schemas().map(schema => schema.name);
+            const execution = Object.freeze({
+                mode: input.occurrence.dryRun ? 'preview' : 'production',
+                automationId: input.automation.id,
+                occurrenceId: input.occurrence.id,
+            });
+            if (this.hostContract) {
+                this.hostContract.deadline.check();
+                const contract = this.hostContract.contract;
+                const resolved = await llm.resolveCallConfig({ provider: contract.provider, model: contract.model,
+                    ...(contract.reasoningEffort === undefined ? {} : { reasoningEffort: ReasoningEffortId(contract.reasoningEffort) }), maxTokens: contract.maxOutputTokens }, input.signal);
+                if (resolved.provider !== contract.provider || resolved.model !== contract.model || resolved.reasoningEffort !== contract.reasoningEffort
+                    || resolved.maxTokens !== contract.maxOutputTokens)
+                    throw new Error('assistant-automations: resolved Host supplier differs from frozen contract');
+                this.hostContract.deadline.check();
+            }
+            phase = 'agent-creation';
+            agentCreationSubmitted = true;
+            handle = await agents.create({
+                sessionId: SessionId(input.sessionId),
+                meta: {
+                    cwd: definition.workspace,
+                    agentPreset: presetId,
+                },
+                agentOptions: {
+                    provider: definition.provider,
+                    model: definition.model,
+                    maxTokens: definition.maxOutputTokens,
+                    ...(this.hostContract?.contract.reasoningEffort === undefined ? {} : { reasoningEffort: ReasoningEffortId(this.hostContract.contract.reasoningEffort) }),
+                },
+                signal: input.signal,
+                setup: async (agentCtx, preparedAgent) => {
+                    phase = 'agent-setup';
+                    this.hostContract?.deadline.check();
+                    const agent = preparedAgent;
+                    if (agent === undefined) {
+                        throw new Error('assistant-automations: unpublished Agent identity is missing during setup');
+                    }
+                    if (this.hostContract)
+                        setupAgent = agent;
+                    if (this.hostContract && agent.session.id !== input.sessionId)
+                        throw new Error('assistant-automations: Host Agent session identity differs from occurrence');
+                    if (agent.session.header.cwd !== definition.workspace
+                        || agent.session.header.agentPreset !== presetId) {
+                        throw new Error('assistant-automations: background Agent identity does not match the immutable definition');
+                    }
+                    agentCtx.provide('assistantAutomationExecution', execution);
+                    let modelCalls = 0;
+                    const maxModelCalls = this.maxModelCalls;
+                    const beforePrompt = this.beforePrompt;
+                    const strict = this.hostContract;
+                    agentCtx.on('llm/stream', async function* (_options, next) {
+                        if (strict && _options.sessionId !== agent.session.id) {
+                            yield* next();
+                            return;
+                        }
+                        if (strict) {
+                            strict.deadline.check();
+                            _options.signal?.throwIfAborted();
+                            const contract = strict.contract;
+                            if (_options.provider !== contract.provider || _options.model !== contract.model
+                                || _options.reasoningEffort !== contract.reasoningEffort || _options.maxTokens !== contract.maxOutputTokens
+                                || hostAgentToolSchemaDigest(_options.tools ?? []) !== contract.toolSchemaDigest
+                                || hostAgentToolSchemaDigest(agentCtx.tools.schemas(agent)) !== contract.toolSchemaDigest) {
+                                agent.cancel({ kind: 'hook', reason: 'host-agent-request-contract-drift' });
+                                throw new Error('assistant-automations: actual Host request differs from frozen contract');
+                            }
+                        }
+                        if (maxModelCalls !== undefined && modelCalls >= maxModelCalls) {
+                            throw new Error('assistant-automations: immutable model-call budget exhausted');
+                        }
+                        beforePrompt?.();
+                        strict?.deadline.authorize?.();
+                        modelCalls += 1;
+                        if (!strict) {
+                            yield* next();
+                            return;
+                        }
+                        let outputBytes = 0;
+                        for await (const chunk of next()) {
+                            if (strict) {
+                                strict.deadline.check();
+                                if (chunk.type === 'text-delta' || chunk.type === 'reasoning-delta')
+                                    outputBytes += Buffer.byteLength(chunk.text);
+                                else if (chunk.type === 'tool-call-delta')
+                                    outputBytes += Buffer.byteLength(chunk.argumentsDelta);
+                                if (outputBytes > strict.contract.maxOutputTokens * 32 || chunk.type === 'usage' && (chunk.usage.outputTokens ?? 0) > strict.contract.maxOutputTokens) {
+                                    agent.cancel({ kind: 'hook', reason: 'host-agent-output-limit' });
+                                    throw new Error('assistant-automations: Host Agent output limit exceeded');
+                                }
+                            }
+                            yield chunk;
+                        }
+                        strict?.deadline.check();
+                    });
+                    // Host tools must retain the principal frozen in the authorized
+                    // occurrence. Ordinary DshRunner keeps its historical initiator.
+                    const unbindInitiator = this.policy.bindInitiator(agent, 'background', strict ? definition.principal : undefined);
+                    agentCtx.effect(() => unbindInitiator, 'assistant-automations.background-initiator');
+                    const delivery = this.ctx.get('assistantDelivery');
+                    // Approval delegation is independent from ordinary run-result
+                    // delivery. Legacy definitions retain their historical route.
+                    const bindingId = definition.approvalBindingId ?? definition.deliveryBindingId;
+                    if (bindingId !== undefined && typeof delivery?.bindAgentApprovalRoute === 'function') {
+                        const unbindApproval = delivery.bindAgentApprovalRoute(agent, { bindingId });
+                        agentCtx.effect(() => unbindApproval, 'assistant-automations.approval-route');
+                    }
+                    installModelSelection(agentCtx, {
+                        current: {
+                            provider: definition.provider,
+                            model: definition.model,
+                            ...(this.hostContract?.contract.reasoningEffort === undefined ? {} : { reasoningEffort: ReasoningEffortId(this.hostContract.contract.reasoningEffort) }),
+                        },
+                        assembled: undefined,
+                    });
+                    if (!this.modelOnly)
+                        await agentPresets?.mount(agentCtx, presetId);
+                    const mountedNames = agentCtx.tools.schemas(agent).map(schema => schema.name);
+                    for (const name of allowed) {
+                        if (!mountedNames.includes(name)) {
+                            throw new Error(`assistant-automations: unknown allowlist tool after preset mount: ${name}`);
+                        }
+                    }
+                    // Scoped preset tools cannot be removed by DSH restrictions. Mask
+                    // inherited global tools here and let the final immutable allowlist
+                    // assertion fail closed for any scoped tool outside the contract.
+                    const denied = globalNames.filter(name => !allowed.has(name));
+                    if (denied.length > 0)
+                        agentCtx.tools.restrict({ deny: denied });
+                    const finalSchemas = agentCtx.tools.schemas(agent);
+                    const outsideAllowlist = finalSchemas.map(schema => schema.name).filter(name => !allowed.has(name));
+                    if (outsideAllowlist.length > 0) {
+                        throw new Error(`assistant-automations: preset ${presetId} exposes tools outside the immutable allowlist: ${outsideAllowlist.join(', ')}`);
+                    }
+                    if (strict) {
+                        if (finalSchemas.length !== allowed.size || hostAgentToolSchemaDigest(finalSchemas) !== strict.contract.toolSchemaDigest)
+                            throw new Error('assistant-automations: Host tool schemas differ from frozen contract');
+                        appendPluginRecord(agent.session, 'plugin:assistant-automations/host-agent-contract', {
+                            protocol: 'assistant-automations/host-agent-contract/v1', contract: strict.contract, contractDigest: strict.digest,
+                            automationId: execution.automationId, occurrenceId: execution.occurrenceId, sessionId: input.sessionId,
+                        });
+                    }
+                    requireAdapterToolCallProtocol(llm, definition.provider, definition.model, presetId, finalSchemas.length);
+                    agentCtx.tools.guard((execution) => {
+                        if (strict && execution.agent !== agent)
+                            return undefined;
+                        if (strict) {
+                            strict.deadline.authorize?.();
+                            strict.deadline.check();
+                            if (hostAgentToolSchemaDigest(agentCtx.tools.schemas(agent)) !== strict.contract.toolSchemaDigest)
+                                return 'assistant-automations: Host tool schemas drifted';
+                        }
+                        if (!allowed.has(execution.name))
+                            return 'assistant-automations: tool is outside the immutable allowlist';
+                        if (toolCalls >= definition.maxToolCalls) {
+                            return 'assistant-automations: immutable tool-call budget exhausted';
+                        }
+                        toolCalls += 1;
+                        return undefined;
+                    });
+                },
+            });
+            if (this.hostContract && (handle.agent !== setupAgent || handle.agent.session.id !== input.sessionId))
+                throw new Error('assistant-automations: returned Host Agent identity differs from setup');
+            if (this.hostContract && input.signal.aborted) {
+                await handle.dispose();
+                handle = undefined;
+                throw new Error('assistant-automations: late Host Agent creation rejected');
+            }
+            sideEffectState = 'possible';
+            const agent = handle.agent;
+            this.hostContract?.deadline.observe(() => {
+                // Only committed native assistant-message usage is counted: this is an observed lower bound, never a total bill.
+                const usage = { toolCalls };
+                for (const event of agent.session.snapshotEvents()) {
+                    if (event.type !== 'assistant/message' || event.data.usage === undefined)
+                        continue;
+                    for (const field of usageFields) {
+                        const amount = event.data.usage[field];
+                        if (amount !== undefined && Number.isSafeInteger(amount) && amount >= 0) {
+                            const sum = Number(usage[field] ?? 0) + amount;
+                            if (Number.isSafeInteger(sum))
+                                usage[field] = sum;
+                        }
+                    }
+                }
+                return { outcome: 'unknown', output: '', usage, sessionId: agent.session.id, quiescent: false };
+            });
+            const evolution = this.ctx.get('assistantEvolution');
+            if (!this.hostContract && execution.mode === 'production'
+                && typeof evolution?.injectAutomationGuidance === 'function') {
+                evolution.injectAutomationGuidance(agent, execution);
+            }
+            // Resolve the real Delivery owner only after setup installed the immutable
+            // approval binding.  Never derive an acceptance principal from the
+            // definition's display principal or any model-controlled value.
+            if (execution.mode === 'production' && this.prepareAcceptance !== undefined && this.acceptanceEnabled?.() === true) {
+                const delivery = this.ctx.get('assistantDelivery');
+                let owner;
+                let binding;
+                if (typeof delivery?.prepareAgentApproval === 'function') {
+                    try {
+                        const route = delivery.prepareAgentApproval(agent, {
+                            sourceId: 'dsh-enhanced-assistant-verifier',
+                        });
+                        if (route.routeVersion !== 2 || route.sourceId !== 'dsh-enhanced-assistant-verifier'
+                            || route.workspace !== definition.workspace || route.bindingId.trim() === ''
+                            || !Number.isSafeInteger(route.bindingVersion) || route.bindingVersion < 1
+                            || !Number.isSafeInteger(route.bindingGeneration) || route.bindingGeneration < 1
+                            || route.principalRecordId.trim() === '' || !Number.isSafeInteger(route.principalVersion)
+                            || route.principalVersion < 1) {
+                            throw new Error('assistant-automations: Delivery acceptance owner route is invalid');
+                        }
+                        owner = Object.freeze({ principalRecordId: route.principalRecordId, principalVersion: route.principalVersion });
+                        binding = Object.freeze({ id: route.bindingId, version: route.bindingVersion, generation: route.bindingGeneration });
+                    }
+                    catch (error) {
+                        // The sink decides whether a missing authenticated owner is an
+                        // optional no-profile skip or a required fail-closed boundary.
+                        if (typeof error !== 'object' || error === null
+                            || !('code' in error) || error.code !== 'missing-binding')
+                            throw error;
+                    }
+                }
+                this.prepareAcceptance({ taskId: input.task.id, automationId: input.automation.id,
+                    scope: Object.freeze({ workspace: definition.workspace, preset: presetId }), objective: definition.prompt,
+                    ...(owner === undefined ? {} : { owner }), ...(binding === undefined ? {} : { binding }),
+                });
+            }
+            const abort = () => agent.cancel({ kind: 'hook', reason: 'assistant-automations-signal' });
+            input.signal.addEventListener('abort', abort, { once: true });
+            removeAbort = () => input.signal.removeEventListener('abort', abort);
+            this.beforePrompt?.();
+            this.hostContract?.deadline.authorize?.();
+            this.hostContract?.deadline.check();
+            phase = 'prompt-submission';
+            promptSubmissionState = 'unknown';
+            agent.followup(createUserMessage({
+                content: [{ type: 'text', text: definition.prompt }],
+                source: {
+                    kind: 'assistant-automations',
+                    form: 'notice',
+                    summary: `Automation: ${definition.name}`,
+                },
+            }));
+            promptSubmissionState = 'submitted';
+            followupSubmitted = true;
+            phase = 'model-execution';
+            await agent.whenIdle();
+            this.hostContract?.deadline.check();
+            const summary = summarize(agent.session.snapshotEvents(), input.signal);
+            if (this.hostContract && summary.turnKind === 'max-tokens')
+                summary.outcome = 'failed';
+            sideEffectState = 'possible';
+            phase = 'session-flush';
+            await sessions.flush(agent.session);
+            if (reservationId !== undefined) {
+                phase = 'budget-settlement';
+                this.policy.finalize(reservationId, definition.budgetAmount);
+                reservationSettled = true;
+                budgetSettlementState = 'finalized';
+            }
+            const classified = summary.outcome === 'succeeded'
+                ? { failureClass: 'none', failurePhase: 'none', failureCode: 'none' }
+                : summary.outcome === 'cancelled'
+                    ? { failureClass: 'cancelled', failurePhase: 'model-execution', failureCode: 'agent-turn-cancelled' }
+                    : summary.outcome === 'unknown'
+                        ? { failureClass: 'execution', failurePhase: 'model-execution', failureCode: 'agent-turn-unknown' }
+                        : {
+                            failureClass: 'execution',
+                            failurePhase: 'model-execution',
+                            failureCode: summary.turnKind === 'blocked' ? 'agent-turn-blocked' : 'agent-turn-failed',
+                        };
+            const completed = {
+                outcome: summary.outcome,
+                output: summary.output,
+                usage: { ...summary.usage, toolCalls },
+                sessionId: input.sessionId,
+                diagnostic: diagnostic({
+                    ...classified,
+                    promptSubmissionState,
+                    sideEffectState,
+                    budgetSettlementState,
+                }),
+                quiescent: !input.signal.aborted,
+            };
+            removeAbort?.();
+            removeAbort = undefined;
+            phase = 'agent-disposal';
+            await handle?.dispose();
+            handle = undefined;
+            this.hostContract?.deadline.check();
+            return completed;
+        }
+        catch (error) {
+            if (error instanceof AutomationBudgetReplayError)
+                throw error;
+            let caught = error;
+            if (reservationId !== undefined && !reservationSettled) {
+                try {
+                    if (!agentCreationSubmitted) {
+                        this.policy.release(reservationId);
+                        budgetSettlementState = 'released';
+                    }
+                    else {
+                        this.policy.finalize(reservationId, definition.budgetAmount);
+                        budgetSettlementState = 'finalized';
+                    }
+                    reservationSettled = true;
+                }
+                catch (settlementError) {
+                    phase = 'budget-settlement';
+                    budgetSettlementState = 'unknown';
+                    sideEffectState = agentCreationSubmitted
+                        ? 'possible'
+                        : promptSubmissionState === 'not-submitted' ? 'none' : 'unknown';
+                    caught = new AutomationRunnerAmbiguousError(`assistant-automations: conservative budget settlement failed: ${settlementError instanceof Error ? settlementError.message : String(settlementError)}`, {
+                        cause: settlementError,
+                        diagnostic: diagnostic({
+                            failureClass: 'budget',
+                            failurePhase: 'budget-settlement',
+                            failureCode: stableFailureCode(settlementError, 'budget-settlement'),
+                            promptSubmissionState,
+                            sideEffectState,
+                            budgetSettlementState,
+                        }),
+                    });
+                }
+            }
+            if (caught instanceof AutomationRunnerAmbiguousError)
+                throw caught;
+            sideEffectState = agentCreationSubmitted
+                ? 'possible'
+                : promptSubmissionState === 'not-submitted' ? 'none' : 'unknown';
+            const receipt = diagnostic({
+                failureClass: failureClass(phase, input.signal, caught),
+                failurePhase: phase,
+                failureCode: stableFailureCode(caught, phase),
+                promptSubmissionState,
+                sideEffectState,
+                budgetSettlementState,
+            });
+            if (followupSubmitted || promptSubmissionState !== 'not-submitted') {
+                throw new AutomationRunnerAmbiguousError(`assistant-automations: Agent execution may have produced side effects: ${caught instanceof Error ? caught.message : String(caught)}`, { cause: caught, diagnostic: receipt });
+            }
+            throw new AutomationRunnerFailureError(caught instanceof Error ? caught.message : String(caught), receipt, { cause: caught });
+        }
+        finally {
+            removeAbort?.();
+            try {
+                await handle?.dispose();
+            }
+            catch {
+                // Preserve the original typed failure; cleanup is secondary evidence.
+            }
+        }
+    }
+}
+/** Original public runner options and acceptance/guidance/settlement behavior. */
+export class DshAutomationRunner extends NativeAgentExecution {
+    constructor(ctx, policy, options = {}) { super(ctx, policy, options); }
+}
+/** Internal Host path: outer HostRunner alone reserves and settles the occurrence. */
+export function runHostNativeAgent(ctx, policy, input, contract, contractDigest, signal, deadline) {
+    if (!isHostAutomationDefinition(input.automation.definition) || acceptanceDigest(contract) !== contractDigest)
+        throw new Error('assistant-automations: invalid Host native execution');
+    const { execution: _execution, budgetId: _budgetId, budgetAmount: _budgetAmount, ...control } = input.automation.definition;
+    const definition = { ...control, provider: contract.provider, model: contract.model, prompt: contract.prompt,
+        allowedTools: contract.allowedTools, maxToolCalls: contract.maxToolCalls, maxOutputTokens: contract.maxOutputTokens };
+    return new NativeAgentExecution(ctx, policy, { allowUnbudgetedExecution: true, maxModelCalls: contract.maxModelCalls }, { contract, digest: contractDigest, deadline })
+        .run({ ...input, signal, automation: { ...input.automation, definition } });
+}
+/** Executes immutable Host contracts without creating an Agent or model turn. */
+export class HostAutomationRunner {
+    registry;
+    policy;
+    allowUnbudgetedExecution;
+    #hostAgentKey;
+    constructor(registry, policy, options = {}, hostAgentKey) {
+        this.registry = registry;
+        this.policy = policy;
+        this.#hostAgentKey = hostAgentKey;
+        this.allowUnbudgetedExecution = options.allowUnbudgetedExecution ?? false;
+    }
+    async run(input) {
+        const definition = input.automation.definition;
+        if (!isHostAutomationDefinition(definition)) {
+            throw new AutomationRunnerFailureError('assistant-automations: Agent definition reached the Host runner', Object.freeze({
+                schemaVersion: 1, failureClass: 'configuration', failurePhase: 'preflight',
+                failureCode: 'host-runner-surface-mismatch', promptSubmissionState: 'not-applicable',
+                sideEffectState: 'none', retryability: 'after-intervention',
+                budgetSettlementState: 'not-required',
+            }));
+        }
+        const budgetSettlementStateBeforeReservation = definition.budgetId === undefined ? 'not-required' : 'not-reserved';
+        if (!exactHostRunnerInput(input)) {
+            throw new AutomationRunnerFailureError('assistant-automations: Host runner input identity is not exact', this.hostDiagnostic(definition, {
+                failureClass: 'configuration', failurePhase: 'preflight',
+                failureCode: 'host-runner-identity-mismatch', sideEffectState: 'none',
+                retryability: 'after-intervention',
+                budgetSettlementState: budgetSettlementStateBeforeReservation,
+            }));
+        }
+        const retryAttempt = input.task.attemptCount > 1;
+        const authorizedRecoveryResume = isAuthorizedRecoveryResume(input, definition);
+        if (retryAttempt && !authorizedRecoveryResume) {
+            throw new AutomationRunnerFailureError('assistant-automations: Host retry is not an exact idempotent Recovery resume', this.hostDiagnostic(definition, {
+                failureClass: 'configuration', failurePhase: 'preflight',
+                failureCode: 'host-recovery-resume-not-authorized', sideEffectState: 'none',
+                retryability: 'after-intervention',
+                budgetSettlementState: budgetSettlementStateBeforeReservation,
+            }));
+        }
+        const immutableDefinitionHash = definitionHash(definition);
+        const proof = this.registry.prove(definition.execution);
+        if (!proof.available || definitionHash(definition) !== immutableDefinitionHash) {
+            throw new AutomationRunnerFailureError('assistant-automations: exact Host executor is unavailable', this.hostDiagnostic(definition, {
+                failureClass: 'configuration', failurePhase: 'executor-availability',
+                failureCode: proof.available ? 'host-runner-identity-mismatch' : proof.reasonCode, sideEffectState: 'none', retryability: 'after-intervention',
+                budgetSettlementState: definition.budgetId === undefined ? 'not-required' : 'not-reserved',
+            }));
+        }
+        const budgetId = definition.budgetId;
+        let reservationId;
+        let budgetSettlementState = budgetId === undefined
+            ? 'not-required'
+            : 'not-reserved';
+        let replayedFinalizedRecoveryBudget = false;
+        let executionStarted = false;
+        let settlementAttempted = false;
+        let nativeResult;
+        try {
+            if (budgetId === undefined && !this.allowUnbudgetedExecution) {
+                throw new AutomationRunnerFailureError('assistant-automations: a configured budget is required for unattended Host execution', this.hostDiagnostic(definition, {
+                    failureClass: 'budget', failurePhase: 'budget-reservation',
+                    failureCode: 'automation-budget-required', sideEffectState: 'none',
+                    retryability: 'after-intervention', budgetSettlementState,
+                }));
+            }
+            if (budgetId !== undefined) {
+                assertAutomationRunBudget(this.policy, budgetId);
+                const reservation = this.policy.reserve({
+                    budgetId,
+                    subject: {
+                        kind: 'background', id: input.automation.id,
+                        workspace: definition.workspace, principal: definition.principal,
+                    },
+                    amount: definition.budgetAmount,
+                    idempotencyKey: hostBudgetIdempotencyKey(input, immutableDefinitionHash, budgetId),
+                });
+                if (reservation.status === 'finalized'
+                    && reservation.replayed
+                    && authorizedRecoveryResume) {
+                    // Recovery owns an idempotent, durable operation ledger. A crash can
+                    // happen after that operation and its exact budget were finalized but
+                    // before Automations committed the terminal run. Invoke the exact
+                    // executor again only to read/replay its durable terminal result; the
+                    // already-finalized reservation must never be settled a second time.
+                    replayedFinalizedRecoveryBudget = true;
+                    budgetSettlementState = 'finalized';
+                }
+                else if (reservation.status !== 'reserved') {
+                    const uncertain = reservation.status !== 'released';
+                    throw new AutomationRunnerFailureError('assistant-automations: Host budget reservation was replayed', this.hostDiagnostic(definition, {
+                        failureClass: 'budget', failurePhase: 'budget-reservation',
+                        failureCode: 'automation-budget-reservation-replayed',
+                        sideEffectState: uncertain ? 'unknown' : 'none',
+                        retryability: uncertain ? 'unsafe' : 'after-intervention',
+                        budgetSettlementState: reservation.status,
+                    }));
+                }
+                else {
+                    reservationId = reservation.reservationId;
+                    budgetSettlementState = 'reserved';
+                }
+                if (!replayedFinalizedRecoveryBudget && reservation.replayed && !authorizedRecoveryResume) {
+                    // A replay on the first attempt is concurrent/duplicate execution,
+                    // not crash recovery. Keep the original reservation untouched.
+                    reservationId = undefined;
+                    throw new AutomationRunnerFailureError('assistant-automations: Host budget reservation was replayed outside Recovery resume', this.hostDiagnostic(definition, {
+                        failureClass: 'budget', failurePhase: 'budget-reservation',
+                        failureCode: 'automation-budget-reservation-replayed',
+                        sideEffectState: 'unknown', retryability: 'unsafe',
+                        budgetSettlementState: 'reserved',
+                    }));
+                }
+                if (!replayedFinalizedRecoveryBudget && !reservation.replayed && authorizedRecoveryResume) {
+                    // A recovered attempt must see the exact prior reservation. A fresh
+                    // receipt proves the immutable definition/key changed (or no prior
+                    // execution reached the budget boundary), so it cannot resume this
+                    // occurrence. Release only the newly created reservation.
+                    try {
+                        const released = this.policy.release(reservation.reservationId);
+                        if (released.status !== 'released') {
+                            throw new Error('assistant-automations: fresh Recovery retry reservation was not released');
+                        }
+                        budgetSettlementState = 'released';
+                        reservationId = undefined;
+                    }
+                    catch (error) {
+                        budgetSettlementState = 'unknown';
+                        reservationId = undefined;
+                        throw new AutomationRunnerAmbiguousError('assistant-automations: fresh Recovery retry reservation could not be released', {
+                            cause: error,
+                            diagnostic: this.hostDiagnostic(definition, {
+                                failureClass: 'budget', failurePhase: 'budget-settlement',
+                                failureCode: 'budget-settlement-failed', sideEffectState: 'unknown',
+                                retryability: 'unsafe', budgetSettlementState,
+                            }),
+                        });
+                    }
+                    throw new AutomationRunnerFailureError('assistant-automations: Recovery resume did not replay the exact immutable budget key', this.hostDiagnostic(definition, {
+                        failureClass: 'budget', failurePhase: 'budget-reservation',
+                        failureCode: 'host-recovery-resume-key-mismatch', sideEffectState: 'none',
+                        retryability: 'after-intervention', budgetSettlementState,
+                    }));
+                }
+            }
+            // Availability is proved again after claim and immediately before any
+            // Host execution. The reservation above is the only intervening effect.
+            const exactProof = this.registry.prove(definition.execution);
+            if (!exactProof.available
+                || !proof.available
+                || exactProof.registrationToken !== proof.registrationToken
+                || definitionHash(definition) !== immutableDefinitionHash) {
+                throw new HostExecutorRegistryError('stale-registration', 'Host executor changed between availability proof and execution');
+            }
+            executionStarted = true;
+            let hostResult = await this.registry.execute(exactProof, {
+                occurrenceId: input.occurrence.id,
+                automationId: input.automation.id,
+                definitionHash: immutableDefinitionHash,
+                executionMode: input.occurrence.dryRun ? 'preview' : 'production',
+                targetScope: definition.execution.targetScope,
+                principal: definition.principal,
+                ownerRouteId: definition.execution.ownerRouteId,
+                activationNonce: definition.execution.activationNonce,
+                catalogDigest: definition.execution.catalogDigest,
+                signal: input.signal,
+            }, this.#hostAgentKey === undefined ? undefined : { key: this.#hostAgentKey, input,
+                freshReservation: reservationId !== undefined && !replayedFinalizedRecoveryBudget, onNativeResult: result => { nativeResult = result; } });
+            if (nativeResult !== undefined && nativeResult.quiescent !== true)
+                throw new Error('assistant-automations: native Host execution remains ambiguous');
+            if (nativeResult?.outcome === 'unknown')
+                hostResult = Object.freeze({ outcome: 'unknown', failureClass: 'unknown',
+                    failurePhase: 'host-execution', failureCode: 'host-agent-unknown', sideEffectState: 'unknown', retryability: 'unsafe' });
+            if (reservationId !== undefined) {
+                settlementAttempted = true;
+                this.policy.finalize(reservationId, definition.budgetAmount);
+                budgetSettlementState = 'finalized';
+            }
+            // Reserving/finalizing a durable budget is itself an external effect.
+            const sideEffectState = nativeResult?.outcome === 'unknown' ? 'unknown'
+                : reservationId === undefined && !replayedFinalizedRecoveryBudget ? hostResult.sideEffectState : 'possible';
+            const retryability = sideEffectState === 'none' ? hostResult.retryability : 'unsafe';
+            return {
+                outcome: hostResult.outcome,
+                output: `Host execution terminal code: ${hostResult.failureCode}`,
+                usage: nativeResult?.usage ?? {},
+                ...(nativeResult === undefined ? {} : { unverifiedObjective: true }),
+                ...(nativeResult?.sessionId === undefined ? {} : { sessionId: nativeResult.sessionId }),
+                ...(nativeResult?.quiescent === undefined ? {} : { quiescent: nativeResult.quiescent }),
+                diagnostic: Object.freeze({
+                    schemaVersion: 1,
+                    failureClass: hostResult.failureClass,
+                    failurePhase: hostResult.failurePhase,
+                    failureCode: hostResult.failureCode,
+                    promptSubmissionState: 'not-applicable',
+                    sideEffectState,
+                    retryability,
+                    budgetSettlementState,
+                }),
+            };
+        }
+        catch (error) {
+            if (!executionStarted && (error instanceof AutomationRunnerFailureError || error instanceof AutomationRunnerAmbiguousError))
+                throw error;
+            let settlementFailed = settlementAttempted && budgetSettlementState === 'reserved';
+            if (settlementFailed)
+                budgetSettlementState = 'unknown';
+            if (reservationId !== undefined && budgetSettlementState === 'reserved' && !settlementAttempted) {
+                try {
+                    // Once the registry invocation boundary may have been crossed, settle
+                    // conservatively so a crash/retry cannot obtain a second occurrence cap.
+                    settlementAttempted = true;
+                    if (executionStarted) {
+                        this.policy.finalize(reservationId, definition.budgetAmount);
+                        budgetSettlementState = 'finalized';
+                    }
+                    else {
+                        this.policy.release(reservationId);
+                        budgetSettlementState = 'released';
+                    }
+                }
+                catch {
+                    settlementFailed = true;
+                    budgetSettlementState = 'unknown';
+                }
+            }
+            const sideEffectState = executionStarted || settlementFailed
+                ? 'unknown'
+                : budgetSettlementState === 'released' || budgetSettlementState === 'not-required'
+                    ? 'none'
+                    : 'unknown';
+            const receipt = this.hostDiagnostic(definition, {
+                failureClass: settlementFailed ? 'budget' : 'infrastructure',
+                failurePhase: settlementFailed ? 'budget-settlement' : 'host-execution',
+                failureCode: settlementFailed
+                    ? 'budget-settlement-failed'
+                    : error instanceof HostExecutorRegistryError ? error.code : 'host-executor-failed',
+                sideEffectState,
+                retryability: sideEffectState === 'none' ? 'safe' : 'unsafe',
+                budgetSettlementState,
+            });
+            if (nativeResult !== undefined) {
+                return { outcome: 'unknown', unverifiedObjective: true, output: 'Host execution remains unknown; native usage is an observed lower bound',
+                    usage: Object.freeze({ ...nativeResult.usage, observedPartial: true }),
+                    ...(nativeResult.sessionId === undefined ? {} : { sessionId: nativeResult.sessionId }),
+                    quiescent: false, diagnostic: receipt };
+            }
+            if (sideEffectState !== 'none') {
+                throw new AutomationRunnerAmbiguousError('assistant-automations: Host execution may have produced external effects', { cause: error, diagnostic: receipt });
+            }
+            throw new AutomationRunnerFailureError('assistant-automations: Host execution failed before external effects', receipt, { cause: error });
+        }
+    }
+    hostDiagnostic(_definition, value) {
+        return Object.freeze({ schemaVersion: 1, promptSubmissionState: 'not-applicable', ...value });
+    }
+}
+/** Preserves the legacy Agent runner while routing Host definitions explicitly. */
+export class RoutedAutomationRunner {
+    agent;
+    host;
+    constructor(agent, host) {
+        this.agent = agent;
+        this.host = host;
+    }
+    run(input) {
+        return isHostAutomationDefinition(input.automation.definition)
+            ? this.host.run(input)
+            : this.agent.run(input);
+    }
+}
+function definitionHash(definition) {
+    return createHash('sha256').update(JSON.stringify(definition)).digest('hex');
+}
+//# sourceMappingURL=native-agent-execution.js.map