@duckmind/dm-linux-x64 0.65.5 → 0.65.6

package/extensions/dm-lens/dist/clients/sanitize.js

@@ -0,0 +1,174 @@
+const ANSI_ESCAPE = /\x1b\[[0-9;]*m/g;
+const ANSI_ESCAPE_EXTENDED = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+const ERROR_INDICATORS = [
+  /\berror\b/i,
+  /\bfailed\b/i,
+  /\bfatal\b/i,
+  /\binvalid\b/i,
+  /\bunexpected\b/i,
+  /\bexpected\b/i,
+  /\bsyntax\b/i,
+  /\bcannot find\b/i,
+  /\bnot found\b/i,
+  /\bno such\b/i
+];
+const DETAIL_PATTERNS = [
+  /^help wanted/i,
+  /^note:/i,
+  /^hint:/i,
+  /^→/,
+  /^\s*at\s+/,
+  /^ {4}/
+];
+export function stripAnsi(text) {
+  return text.replace(ANSI_ESCAPE, "").replace(ANSI_ESCAPE_EXTENDED, "");
+}
+function isErrorLine(line) {
+  const cleanLine = stripAnsi(line).trim();
+  return ERROR_INDICATORS.some((pattern) => pattern.test(cleanLine));
+}
+function isDetailLine(line) {
+  const cleanLine = stripAnsi(line).trim();
+  return DETAIL_PATTERNS.some((pattern) => pattern.test(cleanLine));
+}
+export function sanitizeLine(line) {
+  return stripAnsi(line).replace(/^\s*\[error\]\s*/i, "").replace(/^\s*error:\s*/i, "").replace(/^\s*[×✖✘✗]\s*/u, "").replace(/^\s*[✓✔]\s*/u, "").replace(/\s+/g, " ").trim();
+}
+export function sanitizeOutput(output) {
+  if (!output || typeof output !== "string") {
+    return "";
+  }
+  const lines = output.split(/\r?\n/);
+  const sanitized = lines.map((line) => sanitizeLine(line)).filter((line) => line.length > 0).filter((line) => !isDetailLine(line));
+  return sanitized.join(`
+`);
+}
+export function extractErrorMessage(output) {
+  if (!output || typeof output !== "string") {
+    return;
+  }
+  const lines = output.split(/\r?\n/).map((line) => sanitizeLine(line)).filter((line) => line.length > 0);
+  if (lines.length === 0) {
+    return;
+  }
+  const errorLine = lines.find((line) => isErrorLine(line));
+  if (errorLine) {
+    return errorLine;
+  }
+  const firstMain = lines.find((line) => !isDetailLine(line));
+  return firstMain;
+}
+export function truncateMessage(message, maxLength = 140) {
+  if (message.length <= maxLength) {
+    return message;
+  }
+  return `${message.slice(0, maxLength - 1)}…`;
+}
+export function sanitizeTsDiagnostic(output) {
+  if (!output)
+    return "";
+  const lines = output.split(/\r?\n/).map((line) => stripAnsi(line)).filter((line) => line.length > 0).filter((line) => line.includes("error TS") || line.includes("warning TS"));
+  const fileErrors = lines.filter((line) => /^.+?\([\d,]+\):/.test(line)).map((line) => {
+    const match = line.match(/^(.+?\([\d,]+\):)\s*(.+)/);
+    if (match) {
+      return `${match[1]} ${match[2].trim()}`;
+    }
+    return line.trim();
+  });
+  if (fileErrors.length > 0) {
+    return fileErrors.slice(0, 10).join(`
+`);
+  }
+  return lines.slice(0, 5).join(`
+`);
+}
+function extractDiagnosticLines(output, predicate, maxLines = 10) {
+  if (!output)
+    return "";
+  return output.split(/\r?\n/).map((line) => stripAnsi(line)).filter((line) => line.length > 0).filter(predicate).slice(0, maxLines).join(`
+`);
+}
+function formatJsonDiagnostics(diags, formatter) {
+  return diags.slice(0, 10).map(formatter).join(`
+`);
+}
+export function sanitizeRustOutput(output) {
+  if (!output)
+    return "";
+  return extractDiagnosticLines(output, (line) => {
+    const clean = stripAnsi(line);
+    return isErrorLine(clean) || /^\s*-->\s+/.test(clean);
+  });
+}
+export function sanitizeGoOutput(output) {
+  if (!output)
+    return "";
+  return extractDiagnosticLines(output, (line) => {
+    const clean = stripAnsi(line);
+    return /(?:^\.\/)|(?:\.go:)/.test(clean) || isErrorLine(clean);
+  });
+}
+export function sanitizeBiomeOutput(output) {
+  if (!output)
+    return "";
+  try {
+    const data = JSON.parse(output);
+    if (data.diagnostics && Array.isArray(data.diagnostics)) {
+      return formatJsonDiagnostics(data.diagnostics, (d) => {
+        const loc = d.location;
+        const file = loc?.path ? `${loc.path}` : "";
+        const line = loc?.span?.start?.line ?? 0;
+        const msg = d.message || "";
+        return file ? `${file}:${line + 1} ${msg}` : msg;
+      });
+    }
+  } catch (err) {}
+  return extractDiagnosticLines(output, (line) => {
+    const clean = stripAnsi(line);
+    return isErrorLine(clean) || clean.includes("hint");
+  });
+}
+export function sanitizeRuffOutput(output) {
+  if (!output)
+    return "";
+  try {
+    const data = JSON.parse(output);
+    if (Array.isArray(data)) {
+      return formatJsonDiagnostics(data, (d) => {
+        const row = d.location?.row ?? 0;
+        const col = d.location?.column ?? 0;
+        const code = d.code || "";
+        const msg = d.message || "";
+        return `${row}:${col} [${code}] ${msg}`;
+      });
+    }
+  } catch (err) {}
+  return extractDiagnosticLines(output, (line) => {
+    const clean = stripAnsi(line);
+    return isErrorLine(clean) || /\[(E|W)\d+\]/.test(clean);
+  });
+}
+export function sanitizeToolOutput(output, maxSummaryLength = 140) {
+  if (!output || typeof output !== "string") {
+    return { summary: undefined, details: undefined, truncated: false };
+  }
+  const sanitized = sanitizeOutput(output);
+  const lines = sanitized.split(`
+`).filter((l) => l.length > 0);
+  if (lines.length === 0) {
+    return { summary: undefined, details: undefined, truncated: false };
+  }
+  const summary = extractErrorMessage(output);
+  const truncatedSummary = truncateMessage(summary ?? lines[0], maxSummaryLength);
+  const MAX_DETAIL_LINES = 20;
+  const detailsLines = lines.slice(0, MAX_DETAIL_LINES);
+  const details = detailsLines.join(`
+`);
+  const truncated = lines.length > MAX_DETAIL_LINES;
+  return {
+    summary: truncatedSummary,
+    details: truncated ? `${details}
+... and ${lines.length - MAX_DETAIL_LINES} more lines` : details,
+    truncated
+  };
+}

package/extensions/dm-lens/dist/clients/scan-utils.js

@@ -0,0 +1,7 @@
+import { collectSourceFiles, collectSourceFilesAsync } from "./source-filter.js";
+export function getSourceFiles(dir, _isTsProject) {
+  return collectSourceFiles(dir);
+}
+export function getSourceFilesAsync(dir, _isTsProject) {
+  return collectSourceFilesAsync(dir);
+}

package/extensions/dm-lens/dist/clients/scratch-tree-policy.js

@@ -0,0 +1,57 @@
+import { EXCLUDED_DIRS, getExcludedDirGlobs } from "./file-utils.js";
+import { escapeRegExp } from "./string-utils.js";
+function literalExcludedDirNames() {
+  return EXCLUDED_DIRS.filter((name) => !name.includes("*") && !name.includes("?"));
+}
+export function getScratchTreeGlobPatterns() {
+  return getExcludedDirGlobs();
+}
+export function getScratchTreeDirNames() {
+  return literalExcludedDirNames();
+}
+export function getScratchTreeFnmatchPatterns() {
+  return literalExcludedDirNames().map((name) => `*/${name}/*`);
+}
+export const SECRETS_LANE_SCRATCH_DIR_NAMES = [
+  ".pi",
+  ".omp",
+  ".dm-lens",
+  ".claude",
+  ".codex",
+  ".agents",
+  ".worktrees",
+  ".rescue",
+  ".gstack",
+  ".superpowers",
+  ".guardrails",
+  ".playwright-cli",
+  ".playwright-mcp",
+  ".git",
+  "node_modules",
+  ".turbo",
+  ".cache",
+  ".parcel-cache",
+  ".svelte-kit",
+  ".nuxt",
+  ".yarn",
+  ".pnpm-store",
+  ".gradle",
+  ".next",
+  ".ruff_cache",
+  ".tox",
+  ".pytest_cache",
+  "venv",
+  ".venv",
+  "__pycache__"
+];
+export function getSecretsLaneAllowlistPaths() {
+  return SECRETS_LANE_SCRATCH_DIR_NAMES.map((name) => {
+    const escaped = escapeRegExp(name);
+    return `(?:^|[/\\\\])${escaped}(?:[/\\\\].*)?$`;
+  });
+}
+export function isUnderSecretsLaneScratchTree(relPath) {
+  const names = new Set(SECRETS_LANE_SCRATCH_DIR_NAMES.map((n) => n.toLowerCase()));
+  const segments = relPath.split(/[/\\]/).filter(Boolean);
+  return segments.some((segment) => names.has(segment.toLowerCase()));
+}

package/extensions/dm-lens/dist/clients/search-read-registration.js

@@ -0,0 +1,59 @@
+import * as nodeFs from "node:fs";
+import * as path from "node:path";
+import { isPathIgnoredByProject } from "./file-utils.js";
+import { isExternalOrVendorFile } from "./path-utils.js";
+function normalizeMargin(value) {
+  if (value === undefined || !Number.isFinite(value))
+    return;
+  return Math.max(0, Math.floor(value));
+}
+const DEFAULT_CONTEXT_MARGIN = 0;
+export function registerSearchReads(readGuard, locations, opts) {
+  const margin = opts.contextMargin ?? DEFAULT_CONTEXT_MARGIN;
+  const seen = new Set;
+  let recorded = 0;
+  for (const loc of locations) {
+    if (!loc?.file || !Number.isFinite(loc.startLine))
+      continue;
+    const abs = path.isAbsolute(loc.file) ? loc.file : path.resolve(opts.projectRoot, loc.file);
+    if (isExternalOrVendorFile(abs, opts.projectRoot))
+      continue;
+    if (isPathIgnoredByProject(abs, opts.projectRoot, false))
+      continue;
+    try {
+      if (!nodeFs.statSync(abs).isFile())
+        continue;
+    } catch {
+      continue;
+    }
+    const marginBefore = normalizeMargin(loc.contextBefore) ?? margin;
+    const marginAfter = normalizeMargin(loc.contextAfter) ?? margin;
+    const creditReason = marginBefore === 0 && marginAfter === 0 ? "match-lines-only" : loc.contextBefore !== undefined || loc.contextAfter !== undefined ? "delivered-context-flags" : "caller-margin";
+    const start = Math.max(1, Math.floor(loc.startLine) - marginBefore);
+    const endLine = Number.isFinite(loc.endLine) ? loc.endLine : loc.startLine;
+    const end = Math.max(start, Math.floor(endLine) + marginAfter);
+    const limit = end - start + 1;
+    const key = `${abs}:${start}:${limit}`;
+    if (seen.has(key))
+      continue;
+    seen.add(key);
+    readGuard.recordRead({
+      filePath: abs,
+      requestedOffset: start,
+      requestedLimit: limit,
+      effectiveOffset: start,
+      effectiveLimit: limit,
+      expandedByLsp: false,
+      searchCredit: {
+        marginBefore,
+        marginAfter,
+        reason: creditReason
+      },
+      turnIndex: opts.turnIndex,
+      writeIndex: opts.writeIndex,
+      timestamp: Date.now()
+    });
+    recorded++;
+  }
+  return recorded;
+}

package/extensions/dm-lens/dist/clients/secret-findings.js

@@ -0,0 +1,69 @@
+import { normalizeFilePath } from "./path-utils.js";
+const SECRET_RULE_PATTERN = /hardcoded|secret|password|credential/i;
+export function isSecretWarning(warning) {
+  const id = `${warning.rule ?? ""} ${warning.code ?? ""}`;
+  return SECRET_RULE_PATTERN.test(id);
+}
+export function secretLocationKey(file, line) {
+  return `${normalizeFilePath(file)}:${line}`;
+}
+export function fromGitleaks(findings) {
+  return findings.map((f) => ({
+    file: f.file,
+    line: f.startLine,
+    sources: ["gitleaks"],
+    rule: f.ruleId,
+    description: f.description
+  }));
+}
+export function fromTrivySecrets(findings) {
+  return findings.map((f) => ({
+    file: f.file,
+    line: f.line,
+    sources: ["trivy"],
+    rule: f.ruleId,
+    description: f.title
+  }));
+}
+export function fromAstGrepWarnings(warnings) {
+  const out = [];
+  for (const w of warnings) {
+    if (!isSecretWarning(w) || typeof w.line !== "number")
+      continue;
+    out.push({
+      file: w.filePath,
+      line: w.line,
+      sources: ["ast-grep"],
+      rule: w.rule ?? w.code ?? "hardcoded-secret",
+      description: w.message
+    });
+  }
+  return out;
+}
+const SOURCE_PRIORITY = {
+  gitleaks: 0,
+  trivy: 1,
+  "ast-grep": 2
+};
+function sortSources(sources) {
+  return [...new Set(sources)].sort((a, b) => SOURCE_PRIORITY[a] - SOURCE_PRIORITY[b]);
+}
+export function dedupeSecretFindings(findings) {
+  const byKey = new Map;
+  for (const f of findings) {
+    const key = secretLocationKey(f.file, f.line);
+    const incoming = sortSources(f.sources);
+    const existed = byKey.get(key);
+    if (!existed) {
+      byKey.set(key, { ...f, sources: incoming });
+      continue;
+    }
+    const existingTop = SOURCE_PRIORITY[existed.sources[0]];
+    existed.sources = sortSources([...existed.sources, ...incoming]);
+    if (SOURCE_PRIORITY[incoming[0]] < existingTop) {
+      existed.rule = f.rule;
+    }
+    existed.description ??= f.description;
+  }
+  return [...byKey.values()];
+}

package/extensions/dm-lens/dist/clients/security-scan-client.js

@@ -0,0 +1,208 @@
+import * as path from "node:path";
+import { createSubsystemLogger } from "./extension-log.js";
+import { probeToolAsync } from "./tool-probe.js";
+import { classifyProbeFailure, createAvailabilityLatch, describeInstallAttempt, describeProbeEvidence, logAvailabilityDecision, startHostStallSampler } from "./dispatch/runners/utils/availability-policy.js";
+import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
+import { createSingleFlight } from "./single-flight.js";
+const securityProbeFlights = createAvailabilityProbeFlight();
+
+export class SecurityScanClient {
+  toolName;
+  availabilityLatch = createAvailabilityLatch();
+  get available() {
+    return this.availabilityLatch.read();
+  }
+  set available(value) {
+    if (value === true) {
+      this.availabilityLatch.noteAvailable();
+      return;
+    }
+    if (value !== false) {
+      this.availabilityLatch.reset();
+      return;
+    }
+    this.availabilityLatch.noteUnavailable("missing", "not-found");
+    this.logDurableAbsence();
+  }
+  noteDurableAbsence(evidence, options = {}) {
+    this.availabilityLatch.noteUnavailable("missing", "not-found");
+    this.logDurableAbsence(evidence, options.elapsedMs);
+  }
+  logDurableAbsence(evidence, elapsedMs = 0) {
+    logAvailabilityDecision({
+      tool: this.toolName,
+      producer: "security-scan",
+      verdict: "unavailable",
+      outcome: "missing",
+      cause: "not-found",
+      elapsedMs,
+      latched: true,
+      classifiedBy: "caller",
+      ...evidence !== undefined && { evidence }
+    });
+  }
+  lastProbeOutcome = null;
+  ensureFlight = createSingleFlight();
+  inFlight = new Map;
+  binaryPath = null;
+  log;
+  constructor(toolName, verbose = false) {
+    this.toolName = toolName;
+    this.log = verbose ? createSubsystemLogger(toolName) : () => {};
+  }
+  async ensureAvailable() {
+    if (this.available !== null)
+      return this.available;
+    return this.ensureFlight.run("availability", () => this.doEnsureAvailable());
+  }
+  async probeVersion(versionArgs) {
+    const sampler = startHostStallSampler();
+    const startedAt = Date.now();
+    let probe;
+    let hostStallMs;
+    let resolvedBinaryPath = null;
+    let probeJoined = false;
+    try {
+      const shared = securityProbeFlights.run(`security:${this.toolName}|${versionArgs.join("|")}`, async () => {
+        const { findManagedToolBinary } = await import("./installer/index.js");
+        const managed = await findManagedToolBinary(this.toolName);
+        return {
+          probe: await probeToolAsync(managed ?? this.toolName, versionArgs, {
+            timeout: 5000
+          }),
+          binaryPath: managed ?? null
+        };
+      });
+      probeJoined = shared.joined;
+      const flightResult = await shared.promise;
+      probe = flightResult.probe;
+      resolvedBinaryPath = flightResult.binaryPath;
+      if (!probe.error && probe.status === 0 && flightResult.binaryPath) {
+        this.binaryPath = flightResult.binaryPath;
+      }
+    } finally {
+      hostStallMs = sampler.stop();
+    }
+    const elapsedMs = Date.now() - startedAt;
+    if (!probe.error && probe.status === 0) {
+      this.lastProbeOutcome = "success";
+      this.log(`${this.toolName} found: ${probe.stdout.trim().split(`
+`)[0]}`);
+      logAvailabilityDecision({
+        tool: this.toolName,
+        producer: "security-scan",
+        verdict: "available",
+        outcome: "success",
+        cause: "ok",
+        elapsedMs,
+        latched: true,
+        hostStallMs,
+        budgetMs: 5000,
+        classifiedBy: probeJoined ? "joined" : "probe",
+        evidence: {
+          ...describeProbeEvidence(probe),
+          ...resolvedBinaryPath && {
+            binary: path.basename(resolvedBinaryPath),
+            source: "managed-dir"
+          }
+        }
+      });
+      return true;
+    }
+    const { outcome, cause, evidence } = classifyProbeFailure(probe, {
+      hostStallMs
+    });
+    this.lastProbeOutcome = outcome;
+    const retryAfterMs = outcome === "transient" ? this.availabilityLatch.noteUnavailable("transient", cause) : 0;
+    logAvailabilityDecision({
+      tool: this.toolName,
+      producer: "security-scan",
+      verdict: "unavailable",
+      outcome,
+      cause,
+      elapsedMs,
+      latched: outcome !== "transient",
+      hostStallMs,
+      ...retryAfterMs > 0 && { retryAfterMs },
+      budgetMs: 5000,
+      classifiedBy: probeJoined ? "joined" : "probe",
+      evidence: {
+        ...evidence,
+        ...resolvedBinaryPath && {
+          binary: path.basename(resolvedBinaryPath),
+          source: "managed-dir"
+        }
+      }
+    });
+    return false;
+  }
+  probeWasTransient() {
+    return this.lastProbeOutcome === "transient";
+  }
+  markTransientlyUnavailable(cause = "probe-timeout", opts) {
+    return this.availabilityLatch.noteUnavailable("transient", cause, opts);
+  }
+  latchedCause() {
+    return this.availabilityLatch.getCause();
+  }
+  getAvailabilityVerdict() {
+    return {
+      outcome: this.availabilityLatch.getOutcome(),
+      cause: this.availabilityLatch.getCause(),
+      retryAtMs: this.availabilityLatch.getRetryAtMs()
+    };
+  }
+  async ensureViaInstaller(versionArgs) {
+    if (await this.probeVersion(versionArgs)) {
+      this.available = true;
+      return true;
+    }
+    if (this.probeWasTransient()) {
+      this.log(`${this.toolName} availability probe timed out; not installing, will retry`);
+      return false;
+    }
+    this.log(`${this.toolName} not found, attempting auto-install`);
+    const { ensureTool, getInstallAttempt } = await import("./installer/index.js");
+    const installStartedAt = Date.now();
+    const installed = await ensureTool(this.toolName);
+    if (!installed) {
+      const attempt = getInstallAttempt(this.toolName);
+      this.log(attempt?.outcome === "failed" ? `${this.toolName} auto-install failed: ${attempt.reason ?? "unknown reason"}` : `${this.toolName} auto-install did not run: ${attempt?.reason ?? "no attempt recorded"}`);
+      this.noteDurableAbsence(describeInstallAttempt(attempt), {
+        elapsedMs: Date.now() - installStartedAt
+      });
+      return false;
+    }
+    this.binaryPath = installed;
+    this.available = true;
+    this.log(`${this.toolName} auto-installed at ${installed}`);
+    logAvailabilityDecision({
+      tool: this.toolName,
+      verdict: "available",
+      outcome: "success",
+      cause: "ok",
+      elapsedMs: Date.now() - installStartedAt,
+      latched: true,
+      classifiedBy: "caller",
+      evidence: {
+        install: "succeeded",
+        binary: path.basename(installed),
+        source: "managed-dir"
+      }
+    });
+    return true;
+  }
+  dedupeScan(key, run) {
+    const existing = this.inFlight.get(key);
+    if (existing) {
+      this.log(`Scan already in flight for ${key}; sharing result`);
+      return existing;
+    }
+    const promise = run().finally(() => {
+      if (this.inFlight.get(key) === promise)
+        this.inFlight.delete(key);
+    });
+    this.inFlight.set(key, promise);
+    return promise;
+  }
+}

package/extensions/dm-lens/dist/clients/session-event-guard.js

@@ -0,0 +1,111 @@
+import { emitBounded } from "./bounded-telemetry.js";
+import { recordDegradationOnce } from "./degradation-ledger.js";
+import { bounded } from "./deadline-utils.js";
+import { HOOK_WALL_BUDGET_MS } from "./hook-budgets.js";
+import { probeCtxActive } from "./session-lifecycle.js";
+import { runWithTurnContext } from "./turn-context.js";
+function stableSessionId(ctx) {
+  try {
+    return ctx?.sessionManager?.getSessionId?.();
+  } catch {
+    recordDegradationOnce({
+      kind: "turn-context-identity-fallback",
+      subject: "session-event-guard",
+      reason: "stable session identity resolution failed; using detached turn context"
+    });
+    return;
+  }
+}
+export function isStaleExtensionCtxError(err) {
+  return err instanceof Error && err.message.includes("stale after session replacement or reload");
+}
+function recordStaleSkip(eventName, detectedAt) {
+  emitBounded("session_event_stale_ctx_skip", eventName, {
+    durationMs: 0,
+    metadata: { event: eventName, detectedAt }
+  }, {
+    ledgerKind: "extension-ctx-stale",
+    risingEdgePer: "identity",
+    reason: `${eventName} skipped: extension ctx is stale (${detectedAt})`
+  });
+}
+export function surfaceHandlerCrash(handler, err, options = {}) {
+  try {
+    options.dbg?.(`${handler} crashed: ${err}`);
+    options.dbg?.(`${handler} crash stack: ${err?.stack}`);
+  } catch {}
+  recordDegradationOnce({
+    kind: "hook-handler-crash",
+    subject: handler,
+    reason: `${handler} handler crashed and was swallowed: ${String(err)}`
+  });
+  if (process.env.VITEST && options.rethrow !== false)
+    throw err;
+}
+function isThenable(value) {
+  return typeof value?.then === "function";
+}
+function guardSessionEvent(eventName, handler, onStaleResult, options) {
+  const defaultBudgetKey = (eventName) => {
+    if (eventName === "tool_result")
+      return "tool_result_edit";
+    if (eventName === "session_start" || eventName === "turn_end" || eventName === "agent_end" || eventName === "agent_settled")
+      return eventName;
+    return;
+  };
+  const skip = (event, detectedAt) => {
+    recordStaleSkip(eventName, detectedAt);
+    try {
+      options.dbg?.(`${eventName} skipped: extension ctx is stale after session replacement or reload`);
+    } catch {}
+    return onStaleResult(event);
+  };
+  return (event, ctx) => {
+    if (probeCtxActive(ctx) === false)
+      return skip(event, "pre-dispatch");
+    try {
+      let signal;
+      try {
+        signal = ctx?.signal;
+      } catch (err) {
+        if (isStaleExtensionCtxError(err))
+          return Promise.resolve(skip(event, "mid-handler"));
+        const crashOptions = {};
+        if (options.dbg !== undefined)
+          crashOptions.dbg = options.dbg;
+        surfaceHandlerCrash(eventName, err, crashOptions);
+        return Promise.resolve(onStaleResult(event));
+      }
+      const result = runWithTurnContext(stableSessionId(ctx), () => handler(event, ctx));
+      if (isThenable(result)) {
+        const recovered = Promise.resolve(result).catch((err) => {
+          if (isStaleExtensionCtxError(err))
+            return skip(event, "mid-handler");
+          throw err;
+        });
+        const budget = typeof options.budgetKey === "function" ? options.budgetKey(event, ctx) : options.budgetKey ?? defaultBudgetKey(eventName);
+        if (budget === undefined)
+          return recovered;
+        return bounded(recovered, {
+          ms: HOOK_WALL_BUDGET_MS[budget],
+          signal: budget === "agent_settled" ? undefined : signal,
+          hook: budget,
+          label: "registered-handler"
+        });
+      }
+      return result;
+    } catch (err) {
+      if (isStaleExtensionCtxError(err))
+        return skip(event, "mid-handler");
+      throw err;
+    }
+  };
+}
+export function wrapSessionEventHandler(eventName, handler, options = {}) {
+  return guardSessionEvent(eventName, handler, () => {
+    return;
+  }, options);
+}
+export function wrapSessionEventHandlerWithResult(eventName, handler, options) {
+  return guardSessionEvent(eventName, handler, options.onStaleResult, options);
+}