@evalops/maestro 0.10.26 → 0.10.29

package/dist/cli.js

@@ -36701,34 +36701,34 @@ import {
   BedrockRuntimeClient,
   ConverseStreamCommand
 } from "@aws-sdk/client-bedrock-runtime";
+import { execFileSync as execFileSync2 } from "node:child_process";
+import { createHash as createHash13 } from "node:crypto";
+import { readFileSync as readFileSync16 } from "node:fs";
+import { resolve as resolvePath } from "node:path";
 import { AsyncLocalStorage as AsyncLocalStorage2 } from "node:async_hooks";
 import { constants as constants2 } from "node:fs";
 import { access as access2, realpath, stat as stat32 } from "node:fs/promises";
 import { basename as basename7, isAbsolute as isAbsolute6, normalize as normalize2, resolve as resolve19, sep as sep2 } from "node:path";
 import { Ajv as Ajv2 } from "ajv";
 import addFormatsModule from "ajv-formats";
-import { readFileSync as readFileSync16 } from "node:fs";
+import { readFileSync as readFileSync17 } from "node:fs";
 import { isAbsolute as isAbsolute7, join as join25 } from "node:path";
 import {
   parse as parseJsonc,
   printParseErrorCode
 } from "jsonc-parser";
-import { existsSync as existsSync22, readFileSync as readFileSync17, statSync as statSync7 } from "node:fs";
+import { existsSync as existsSync22, readFileSync as readFileSync18, statSync as statSync7 } from "node:fs";
 import { dirname as dirname13, join as join26 } from "node:path";
 import { Type as Type6 } from "@sinclair/typebox";
 import { existsSync as existsSync23 } from "node:fs";
 import { join as join27 } from "node:path";
-import { existsSync as existsSync24, readFileSync as readFileSync18, statSync as statSync8 } from "node:fs";
+import { existsSync as existsSync24, readFileSync as readFileSync19, statSync as statSync8 } from "node:fs";
 import { dirname as dirname14, isAbsolute as isAbsolute8, join as join28 } from "node:path";
 import { Value } from "@sinclair/typebox/value";
 import {
   Ajv as Ajv3
 } from "ajv";
 import addFormatsModule2 from "ajv-formats";
-import { execFileSync as execFileSync2 } from "node:child_process";
-import { createHash as createHash13 } from "node:crypto";
-import { readFileSync as readFileSync19 } from "node:fs";
-import { resolve as resolvePath } from "node:path";
 import { Type as Type7 } from "@sinclair/typebox";
 import {
   existsSync as existsSync25,
@@ -37596,13 +37596,17 @@ import {
 import { and as and7, eq as eq9, gt as gt2, lt as lt3, or as or2, sql as sql7 } from "drizzle-orm";
 import crypto9 from "node:crypto";
 import { readFileSync as readFileSync73 } from "node:fs";
+import {
+  assertHeadlessFromAgentMessage as assertHeadlessFromAgentMessage2,
+  assertHeadlessRuntimeStreamEnvelope
+} from "@evalops/contracts";
 import { createHash as createHash25 } from "node:crypto";
 import { readFile as readFile15 } from "node:fs/promises";
 import {
-  assertHeadlessFromAgentMessage as assertHeadlessFromAgentMessage2,
+  assertHeadlessFromAgentMessage as assertHeadlessFromAgentMessage3,
   assertHeadlessRuntimeHeartbeatSnapshot,
   assertHeadlessRuntimeSnapshot,
-  assertHeadlessRuntimeStreamEnvelope,
+  assertHeadlessRuntimeStreamEnvelope as assertHeadlessRuntimeStreamEnvelope2,
   assertHeadlessRuntimeSubscriptionSnapshot
 } from "@evalops/contracts";
 import { and as and8, eq as eq10 } from "drizzle-orm";
@@ -37761,7 +37765,7 @@ import { clearLine, cursorTo } from "node:readline";
 import { createInterface as createInterface3 } from "node:readline/promises";
 import {
   assertHeadlessRuntimeHeartbeatSnapshot as assertHeadlessRuntimeHeartbeatSnapshot2,
-  assertHeadlessRuntimeStreamEnvelope as assertHeadlessRuntimeStreamEnvelope2,
+  assertHeadlessRuntimeStreamEnvelope as assertHeadlessRuntimeStreamEnvelope3,
   assertHeadlessRuntimeSubscriptionSnapshot as assertHeadlessRuntimeSubscriptionSnapshot2,
   headlessProtocolVersion as headlessProtocolVersion2
 } from "@evalops/contracts";
@@ -46296,6 +46300,7 @@ function normalizeDiscoveryEvidence(record) {
     schema: firstString(record, "schema"),
     decision: firstString(record, "decision"),
     reason: firstString(record, "reason"),
+    organizationId: firstString(record, "organizationId", "organization_id"),
     workspaceId: firstString(record, "workspaceId", "workspace_id"),
     capability: firstString(record, "capability"),
     capabilities: stringList2(record, "capabilities"),
@@ -46303,10 +46308,15 @@ function normalizeDiscoveryEvidence(record) {
     a2aSkillId: firstString(record, "a2aSkillId", "a2a_skill_id"),
     taskClass: firstString(record, "taskClass", "task_class"),
     requireA2ADispatch: firstBoolean(record, "requireA2aDispatch", "requireA2ADispatch", "require_a2a_dispatch"),
+    eligibleForDelegation: firstBoolean(record, "eligibleForDelegation", "eligible_for_delegation"),
     surface: firstString(record, "surface"),
     status: firstString(record, "status"),
     candidateCount: firstNumber(record, "candidateCount", "candidate_count"),
     matchedCount: firstNumber(record, "matchedCount", "matched_count"),
+    traceId: firstString(record, "traceId", "trace_id"),
+    spanId: firstString(record, "spanId", "span_id"),
+    requestId: firstString(record, "requestId", "request_id"),
+    observedAt: firstString(record, "observedAt", "observed_at"),
     exclusions: objectList(record, "exclusions")?.map((exclusion) => normalizeDiscoveryExclusion(exclusion)).filter((exclusion) => exclusion !== void 0)
   });
 }
@@ -73037,6 +73047,409 @@ var init_tool_execution_bridge = __esm2(() => {
     "-r"
   ]);
 });
+function hashReusableToolResultSnapshot(value) {
+  return createHash13("sha256").update(value).digest("hex");
+}
+function readGitSnapshotBuffer(cwd, args) {
+  return execFileSync2("git", args, {
+    cwd,
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: REUSABLE_TOOL_RESULT_GIT_SNAPSHOT_TIMEOUT_MS
+  });
+}
+function readGitSnapshotPart(cwd, args) {
+  return readGitSnapshotBuffer(cwd, args).toString("utf8").trim();
+}
+function hashGitSnapshotPart(cwd, args) {
+  return hashReusableToolResultSnapshot(readGitSnapshotBuffer(cwd, args));
+}
+function hashUntrackedGitFiles(root) {
+  const files = readGitSnapshotBuffer(root, [
+    "ls-files",
+    "--others",
+    "--exclude-standard",
+    "-z"
+  ]).toString("utf8").split("\0").filter(Boolean).sort();
+  const hash = createHash13("sha256");
+  for (const file of files) {
+    hash.update(file);
+    hash.update("\0");
+    hash.update(readFileSync16(resolvePath(root, file)));
+    hash.update("\0");
+  }
+  return hash.digest("hex");
+}
+function hasDirtyGitSubmodules(root) {
+  try {
+    return readGitSnapshotPart(root, [
+      "submodule",
+      "foreach",
+      "--recursive",
+      "--quiet",
+      "git status --porcelain=v1 --untracked-files=all"
+    ]).length > 0;
+  } catch {
+    return true;
+  }
+}
+function computeReusableToolResultSnapshot(cwd) {
+  try {
+    const root = readGitSnapshotPart(cwd, ["rev-parse", "--show-toplevel"]);
+    const head = readGitSnapshotPart(cwd, ["rev-parse", "--verify", "HEAD"]);
+    const status = readGitSnapshotPart(root, [
+      "status",
+      "--porcelain=v1",
+      "--untracked-files=all"
+    ]);
+    if (hasDirtyGitSubmodules(root)) {
+      return;
+    }
+    const unstagedDiff = hashGitSnapshotPart(root, [
+      "diff",
+      "--no-ext-diff",
+      "--binary"
+    ]);
+    const stagedDiff = hashGitSnapshotPart(root, [
+      "diff",
+      "--cached",
+      "--no-ext-diff",
+      "--binary"
+    ]);
+    const untracked = hashUntrackedGitFiles(root);
+    return `git:${hashReusableToolResultSnapshot(`${root}
+${head}
+${status}
+${unstagedDiff}
+${stagedDiff}
+${untracked}`)}`;
+  } catch {
+    return;
+  }
+}
+function collectStringValues(value) {
+  if (typeof value === "string") {
+    return [value];
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap((item) => collectStringValues(item));
+  }
+  return [];
+}
+function isRepoRelativePathArgument(value) {
+  const trimmed = value.trim();
+  if (trimmed.length === 0) {
+    return false;
+  }
+  if (trimmed.startsWith("/") || trimmed.startsWith("~") || trimmed.startsWith("\\\\") || /^[A-Za-z]:[\\/]/.test(trimmed)) {
+    return false;
+  }
+  return !trimmed.split(/[\\/]+/).includes("..");
+}
+function isGitIgnoredRepoPath(cwd, repoPath) {
+  try {
+    readGitSnapshotPart(cwd, ["check-ignore", "--quiet", "--", repoPath]);
+    return true;
+  } catch (error) {
+    if (typeof error === "object" && error !== null && "status" in error && error.status === 1) {
+      return false;
+    }
+    return true;
+  }
+}
+function isToolCallIncludingIgnoredPaths(toolCall) {
+  const toolName = toolCall.name.toLowerCase();
+  const args = toolCall.arguments;
+  if (!args || typeof args !== "object" || Array.isArray(args)) {
+    return false;
+  }
+  const record = args;
+  if (toolName === "status") {
+    return record.includeIgnored === true || record.include_ignored === true;
+  }
+  if (toolName === "search" || toolName === "parallel_ripgrep") {
+    return record.useGitIgnore === false || record.use_git_ignore === false;
+  }
+  return false;
+}
+function hasRepoScopedReusableArguments(toolCall, cwd) {
+  const toolName = toolCall.name.toLowerCase();
+  if (isToolCallIncludingIgnoredPaths(toolCall)) {
+    return false;
+  }
+  const argumentNames = REPO_PATH_ARGUMENTS_BY_TOOL.get(toolName) ?? [];
+  if (argumentNames.length === 0) {
+    return true;
+  }
+  const args = toolCall.arguments;
+  if (!args || typeof args !== "object" || Array.isArray(args)) {
+    return !REQUIRED_REPO_PATH_ARGUMENT_TOOLS.has(toolName);
+  }
+  const pathValues = argumentNames.flatMap((name) => collectStringValues(args[name]));
+  if (pathValues.length === 0 && REQUIRED_REPO_PATH_ARGUMENT_TOOLS.has(toolName)) {
+    return false;
+  }
+  return pathValues.every((pathValue) => isRepoRelativePathArgument(pathValue) && !isGitIgnoredRepoPath(cwd, pathValue));
+}
+function isGitSnapshotReusableToolCall(tool, toolCall, cwd) {
+  if (tool.source !== void 0 || tool.annotations?.openWorldHint === true || tool.executionLocation === "client") {
+    return false;
+  }
+  if (!GIT_SNAPSHOT_REUSABLE_TOOL_NAMES.has(tool.name.toLowerCase())) {
+    return false;
+  }
+  if (!isReadOnlyTool(tool.name, tool.annotations, tool.source)) {
+    return false;
+  }
+  return hasRepoScopedReusableArguments(toolCall, cwd);
+}
+function getReusableToolDefinitionIdentity(value) {
+  const existing = reusableToolDefinitionIdentities.get(value);
+  if (existing !== void 0) {
+    return existing;
+  }
+  reusableToolDefinitionIdentityCounter += 1;
+  reusableToolDefinitionIdentities.set(value, reusableToolDefinitionIdentityCounter);
+  return reusableToolDefinitionIdentityCounter;
+}
+function getReusableToolFunctionIdentity(value) {
+  return typeof value === "function" ? getReusableToolDefinitionIdentity(value) : void 0;
+}
+function getReusableToolRegistrySignature(tools) {
+  return stableStringify(tools.map((tool) => ({
+    allowedCallers: tool.allowedCallers,
+    annotations: tool.annotations,
+    deferApiDefinition: tool.deferApiDefinition,
+    description: tool.description,
+    executeIdentity: getReusableToolFunctionIdentity(tool.execute),
+    executionLocation: tool.executionLocation,
+    getActivityDescriptionIdentity: getReusableToolFunctionIdentity(tool.getActivityDescription),
+    getDisplayNameIdentity: getReusableToolFunctionIdentity(tool.getDisplayName),
+    getToolUseSummaryIdentity: getReusableToolFunctionIdentity(tool.getToolUseSummary),
+    inputExamples: tool.inputExamples,
+    label: tool.label,
+    maxRetries: tool.maxRetries,
+    name: tool.name,
+    parameters: tool.parameters,
+    retryDelayMs: tool.retryDelayMs,
+    shouldRetryIdentity: getReusableToolFunctionIdentity(tool.shouldRetry),
+    source: tool.source,
+    toolIdentity: getReusableToolDefinitionIdentity(tool),
+    toolType: tool.toolType
+  })));
+}
+function createToolMetadataCache(tools, reusableToolResultCwd = process.cwd()) {
+  const definitions = new Map(tools.map((tool) => [tool.name, tool]));
+  return {
+    definitions,
+    reusableToolResultCwd,
+    lookupCount: 0,
+    get(toolName) {
+      this.lookupCount += 1;
+      return definitions.get(toolName);
+    }
+  };
+}
+function getToolDefinition(lookup2, toolName) {
+  if ("get" in lookup2 && !Array.isArray(lookup2)) {
+    return lookup2.get(toolName);
+  }
+  return lookup2.find((candidate) => candidate.name === toolName);
+}
+function getReusableToolResultCacheKey(toolCall, tools) {
+  const tool = getToolDefinition(tools, toolCall.name);
+  const cwd = "reusableToolResultCwd" in tools ? tools.reusableToolResultCwd : process.cwd();
+  if (!tool || tool.annotations?.destructiveHint === true) {
+    return;
+  }
+  if (!isReadOnlyTool(tool.name, tool.annotations, tool.source)) {
+    return;
+  }
+  const toolName = tool.name.toLowerCase();
+  const cacheKey = `${toolCall.name}:${stableStringify(toolCall.arguments)}`;
+  if (NETWORK_BACKED_REUSABLE_TOOL_DENYLIST.has(toolName)) {
+    return;
+  }
+  if (isGitSnapshotReusableToolCall(tool, toolCall, cwd)) {
+    return `${GIT_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX}${cacheKey}`;
+  }
+  if (tool.source !== void 0 || GIT_SNAPSHOT_REUSABLE_TOOL_NAMES.has(toolName) || tool.annotations?.openWorldHint === true || tool.executionLocation === "client") {
+    return;
+  }
+  return `${RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX}${cacheKey}`;
+}
+function isReadOnlyToolCallForCacheInvalidation(toolCall, tools) {
+  const tool = getToolDefinition(tools, toolCall.name);
+  return tool ? isReadOnlyTool(tool.name, tool.annotations, tool.source) : false;
+}
+function cloneToolResultForCache(message) {
+  return {
+    ...message,
+    content: message.content.map((item) => ({ ...item }))
+  };
+}
+function cloneToolOutcomeForCall(outcome, toolCall, timestamp3) {
+  return {
+    message: {
+      ...outcome.message,
+      toolCallId: toolCall.id,
+      toolName: toolCall.name,
+      content: outcome.message.content.map((item) => ({ ...item })),
+      timestamp: timestamp3
+    },
+    isError: outcome.isError
+  };
+}
+function resolvePlatformToolExecutionBridge(option) {
+  if (option === false) {
+    return;
+  }
+  return option ?? getDefaultPlatformToolExecutionBridge();
+}
+async function recordReusableToolExecutionBridgeOutput({
+  bridge,
+  plan,
+  outcome,
+  durationMs,
+  signal
+}) {
+  if (!bridge || !plan) {
+    return outcome;
+  }
+  const observed = plan.kind === "observe" ? await bridge.recordObservation(plan, outcome.message, signal) : void 0;
+  const governedOutput = plan.kind === "governed" ? await bridge.recordGovernedOutput(plan, outcome.message, durationMs, signal) : void 0;
+  return {
+    ...outcome,
+    ...buildObservedResultMetadata(plan, observed ?? governedOutput)
+  };
+}
+function hasReusableToolResultState(cacheKey, cache4, pending, policyCheckedKeys, pendingSafetyChecks) {
+  return cache4.has(cacheKey) || pending.has(cacheKey) || policyCheckedKeys.has(cacheKey) || (pendingSafetyChecks.get(cacheKey) ?? 0) > 0;
+}
+function incrementPendingReusableToolSafetyCheck(cacheKey, pendingSafetyChecks) {
+  if (!cacheKey) {
+    return;
+  }
+  pendingSafetyChecks.set(cacheKey, (pendingSafetyChecks.get(cacheKey) ?? 0) + 1);
+}
+function decrementPendingReusableToolSafetyCheck(cacheKey, pendingSafetyChecks) {
+  if (!cacheKey) {
+    return;
+  }
+  const nextCount = (pendingSafetyChecks.get(cacheKey) ?? 0) - 1;
+  if (nextCount <= 0) {
+    pendingSafetyChecks.delete(cacheKey);
+    return;
+  }
+  pendingSafetyChecks.set(cacheKey, nextCount);
+}
+function clearReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
+  cache4.clear();
+  pending.clear();
+  policyCheckedKeys.clear();
+  pendingSafetyChecks.clear();
+  cacheGeneration.value += 1;
+}
+function clearRunScopedReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
+  let cleared = false;
+  for (const key of cache4.keys()) {
+    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
+      cache4.delete(key);
+      cleared = true;
+    }
+  }
+  for (const key of pending.keys()) {
+    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
+      pending.delete(key);
+      cleared = true;
+    }
+  }
+  for (const key of policyCheckedKeys) {
+    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
+      policyCheckedKeys.delete(key);
+      cleared = true;
+    }
+  }
+  for (const key of pendingSafetyChecks.keys()) {
+    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
+      pendingSafetyChecks.delete(key);
+      cleared = true;
+    }
+  }
+  if (cleared) {
+    cacheGeneration.value += 1;
+  }
+}
+function invalidateReusableToolResultsAfterMutation(toolCall, tools, cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
+  if (isReadOnlyToolCallForCacheInvalidation(toolCall, tools)) {
+    return;
+  }
+  clearReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration);
+}
+function hasPendingMutatingToolExecution(pendingExecutions, tools) {
+  return pendingExecutions.some((execution) => !isReadOnlyToolCallForCacheInvalidation(execution.toolCall, tools));
+}
+function trackReusableToolResult(cacheKey, executionPromise, cache4, pending, policyCheckedKeys, cacheGeneration) {
+  const trackedGeneration = cacheGeneration?.value;
+  const trackedPromise = executionPromise.then((outcome) => {
+    if (!outcome.isError && outcome.message.isError !== true && (cacheGeneration === void 0 || cacheGeneration.value === trackedGeneration)) {
+      cache4.set(cacheKey, {
+        message: cloneToolResultForCache(outcome.message)
+      });
+    } else {
+      policyCheckedKeys?.delete(cacheKey);
+    }
+    return outcome;
+  }).catch((error) => {
+    policyCheckedKeys?.delete(cacheKey);
+    throw error;
+  }).finally(() => {
+    if (pending.get(cacheKey) === trackedPromise) {
+      pending.delete(cacheKey);
+    }
+  });
+  pending.set(cacheKey, trackedPromise);
+  return trackedPromise;
+}
+var REUSABLE_TOOL_RESULT_GIT_SNAPSHOT_TIMEOUT_MS = 5e3;
+var GIT_SNAPSHOT_REUSABLE_TOOL_NAMES;
+var REPO_PATH_ARGUMENTS_BY_TOOL;
+var GIT_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX = "git:";
+var RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX = "run:";
+var NETWORK_BACKED_REUSABLE_TOOL_DENYLIST;
+var REQUIRED_REPO_PATH_ARGUMENT_TOOLS;
+var reusableToolDefinitionIdentities;
+var reusableToolDefinitionIdentityCounter = 0;
+var init_reusable_tool_results = __esm2(() => {
+  init_parallel_execution();
+  init_tool_execution_bridge();
+  GIT_SNAPSHOT_REUSABLE_TOOL_NAMES = /* @__PURE__ */ new Set([
+    "read",
+    "ls",
+    "list",
+    "glob",
+    "find",
+    "grep",
+    "search",
+    "parallel_ripgrep",
+    "diff",
+    "status"
+  ]);
+  REPO_PATH_ARGUMENTS_BY_TOOL = /* @__PURE__ */ new Map([
+    ["read", ["path", "file_path"]],
+    ["ls", ["path", "dir", "directory"]],
+    ["list", ["path", "dir", "directory"]],
+    ["glob", ["path", "cwd", "root", "glob"]],
+    ["find", ["path", "cwd", "root", "glob"]],
+    ["grep", ["path", "paths", "glob"]],
+    ["search", ["path", "paths", "glob"]],
+    ["parallel_ripgrep", ["path", "paths", "glob"]],
+    ["diff", ["path", "paths", "cwd"]],
+    ["status", ["path", "paths", "cwd"]]
+  ]);
+  NETWORK_BACKED_REUSABLE_TOOL_DENYLIST = /* @__PURE__ */ new Set(["extract_document"]);
+  REQUIRED_REPO_PATH_ARGUMENT_TOOLS = /* @__PURE__ */ new Set(["read", "ls", "list"]);
+  reusableToolDefinitionIdentities = /* @__PURE__ */ new WeakMap();
+});
 function isComposerError(error) {
   return error instanceof ComposerError;
 }
@@ -80904,7 +81317,7 @@ function substituteFileRefs(text2, configDir) {
         filePath = join25(configDir, filePath);
       }
       try {
-        const fileContent = readFileSync16(filePath, "utf-8").trim();
+        const fileContent = readFileSync17(filePath, "utf-8").trim();
         const escaped = JSON.stringify(fileContent).slice(1, -1);
         processedLine = processedLine.replace(match[0], escaped);
       } catch (error) {
@@ -81051,7 +81464,7 @@ function readJsonFile(filePath) {
     if (cached && cached.mtimeMs === stats2.mtimeMs) {
       return cached.data;
     }
-    const data = readFileSync17(filePath, "utf-8");
+    const data = readFileSync18(filePath, "utf-8");
     fileSnapshots.set(filePath, { mtimeMs: stats2.mtimeMs, data });
     return data;
   } catch {
@@ -81475,7 +81888,7 @@ function validateConfig3() {
     }
     result2.summary.configFiles.push(path23);
     try {
-      const raw = readFileSync18(path23, "utf-8");
+      const raw = readFileSync19(path23, "utf-8");
       const fileMatches = [...raw.matchAll(/\{file:([^}]+)\}/g)];
       for (const match of fileMatches) {
         const matchedPath = match[1];
@@ -81569,7 +81982,7 @@ function inspectConfig() {
   for (const path23 of paths) {
     if (!existsSync24(path23))
       continue;
-    const raw = readFileSync18(path23, "utf-8");
+    const raw = readFileSync19(path23, "utf-8");
     const fileMatches = [...raw.matchAll(/\{file:([^}]+)\}/g)];
     for (const match of fileMatches) {
       const matchedPath = match[1];
@@ -81598,7 +82011,7 @@ function inspectConfig() {
   for (const path23 of paths) {
     if (!existsSync24(path23))
       continue;
-    const raw = readFileSync18(path23, "utf-8");
+    const raw = readFileSync19(path23, "utf-8");
     const envMatches = [...raw.matchAll(/\{env:([^}]+)\}/g)];
     for (const match of envMatches) {
       const envVar = match[1];
@@ -83317,369 +83730,6 @@ async function waitForNextExecutionOrUpdate(pendingExecutions, updateQueue) {
   }
   return next;
 }
-function hashReusableToolResultSnapshot(value) {
-  return createHash13("sha256").update(value).digest("hex");
-}
-function readGitSnapshotBuffer(cwd, args) {
-  return execFileSync2("git", args, {
-    cwd,
-    stdio: ["ignore", "pipe", "ignore"],
-    timeout: REUSABLE_TOOL_RESULT_GIT_SNAPSHOT_TIMEOUT_MS
-  });
-}
-function readGitSnapshotPart(cwd, args) {
-  return readGitSnapshotBuffer(cwd, args).toString("utf8").trim();
-}
-function hashGitSnapshotPart(cwd, args) {
-  return hashReusableToolResultSnapshot(readGitSnapshotBuffer(cwd, args));
-}
-function hashUntrackedGitFiles(root) {
-  const files = readGitSnapshotBuffer(root, [
-    "ls-files",
-    "--others",
-    "--exclude-standard",
-    "-z"
-  ]).toString("utf8").split("\0").filter(Boolean).sort();
-  const hash = createHash13("sha256");
-  for (const file of files) {
-    hash.update(file);
-    hash.update("\0");
-    hash.update(readFileSync19(resolvePath(root, file)));
-    hash.update("\0");
-  }
-  return hash.digest("hex");
-}
-function hasDirtyGitSubmodules(root) {
-  try {
-    return readGitSnapshotPart(root, [
-      "submodule",
-      "foreach",
-      "--recursive",
-      "--quiet",
-      "git status --porcelain=v1 --untracked-files=all"
-    ]).length > 0;
-  } catch {
-    return true;
-  }
-}
-function computeReusableToolResultSnapshot(cwd) {
-  try {
-    const root = readGitSnapshotPart(cwd, ["rev-parse", "--show-toplevel"]);
-    const head = readGitSnapshotPart(cwd, ["rev-parse", "--verify", "HEAD"]);
-    const status = readGitSnapshotPart(root, [
-      "status",
-      "--porcelain=v1",
-      "--untracked-files=all"
-    ]);
-    if (hasDirtyGitSubmodules(root)) {
-      return;
-    }
-    const unstagedDiff = hashGitSnapshotPart(root, [
-      "diff",
-      "--no-ext-diff",
-      "--binary"
-    ]);
-    const stagedDiff = hashGitSnapshotPart(root, [
-      "diff",
-      "--cached",
-      "--no-ext-diff",
-      "--binary"
-    ]);
-    const untracked = hashUntrackedGitFiles(root);
-    return `git:${hashReusableToolResultSnapshot(`${root}
-${head}
-${status}
-${unstagedDiff}
-${stagedDiff}
-${untracked}`)}`;
-  } catch {
-    return;
-  }
-}
-function collectStringValues(value) {
-  if (typeof value === "string") {
-    return [value];
-  }
-  if (Array.isArray(value)) {
-    return value.flatMap((item) => collectStringValues(item));
-  }
-  return [];
-}
-function isRepoRelativePathArgument(value) {
-  const trimmed = value.trim();
-  if (trimmed.length === 0) {
-    return false;
-  }
-  if (trimmed.startsWith("/") || trimmed.startsWith("~") || trimmed.startsWith("\\\\") || /^[A-Za-z]:[\\/]/.test(trimmed)) {
-    return false;
-  }
-  return !trimmed.split(/[\\/]+/).includes("..");
-}
-function isGitIgnoredRepoPath(cwd, repoPath) {
-  try {
-    readGitSnapshotPart(cwd, ["check-ignore", "--quiet", "--", repoPath]);
-    return true;
-  } catch (error) {
-    if (typeof error === "object" && error !== null && "status" in error && error.status === 1) {
-      return false;
-    }
-    return true;
-  }
-}
-function isToolCallIncludingIgnoredPaths(toolCall) {
-  const toolName = toolCall.name.toLowerCase();
-  const args = toolCall.arguments;
-  if (!args || typeof args !== "object" || Array.isArray(args)) {
-    return false;
-  }
-  const record = args;
-  if (toolName === "status") {
-    return record.includeIgnored === true || record.include_ignored === true;
-  }
-  if (toolName === "search" || toolName === "parallel_ripgrep") {
-    return record.useGitIgnore === false || record.use_git_ignore === false;
-  }
-  return false;
-}
-function hasRepoScopedReusableArguments(toolCall, cwd) {
-  const toolName = toolCall.name.toLowerCase();
-  if (isToolCallIncludingIgnoredPaths(toolCall)) {
-    return false;
-  }
-  const argumentNames = REPO_PATH_ARGUMENTS_BY_TOOL.get(toolName) ?? [];
-  if (argumentNames.length === 0) {
-    return true;
-  }
-  const args = toolCall.arguments;
-  if (!args || typeof args !== "object" || Array.isArray(args)) {
-    return !REQUIRED_REPO_PATH_ARGUMENT_TOOLS.has(toolName);
-  }
-  const pathValues = argumentNames.flatMap((name) => collectStringValues(args[name]));
-  if (pathValues.length === 0 && REQUIRED_REPO_PATH_ARGUMENT_TOOLS.has(toolName)) {
-    return false;
-  }
-  return pathValues.every((pathValue) => isRepoRelativePathArgument(pathValue) && !isGitIgnoredRepoPath(cwd, pathValue));
-}
-function isGitSnapshotReusableToolCall(tool, toolCall, cwd) {
-  if (tool.source !== void 0 || tool.annotations?.openWorldHint === true || tool.executionLocation === "client") {
-    return false;
-  }
-  if (!GIT_SNAPSHOT_REUSABLE_TOOL_NAMES.has(tool.name.toLowerCase())) {
-    return false;
-  }
-  if (!isReadOnlyTool(tool.name, tool.annotations, tool.source)) {
-    return false;
-  }
-  return hasRepoScopedReusableArguments(toolCall, cwd);
-}
-function getReusableToolDefinitionIdentity(value) {
-  const existing = reusableToolDefinitionIdentities.get(value);
-  if (existing !== void 0) {
-    return existing;
-  }
-  reusableToolDefinitionIdentityCounter += 1;
-  reusableToolDefinitionIdentities.set(value, reusableToolDefinitionIdentityCounter);
-  return reusableToolDefinitionIdentityCounter;
-}
-function getReusableToolFunctionIdentity(value) {
-  return typeof value === "function" ? getReusableToolDefinitionIdentity(value) : void 0;
-}
-function getReusableToolRegistrySignature(tools) {
-  return stableStringify(tools.map((tool) => ({
-    allowedCallers: tool.allowedCallers,
-    annotations: tool.annotations,
-    deferApiDefinition: tool.deferApiDefinition,
-    description: tool.description,
-    executeIdentity: getReusableToolFunctionIdentity(tool.execute),
-    executionLocation: tool.executionLocation,
-    getActivityDescriptionIdentity: getReusableToolFunctionIdentity(tool.getActivityDescription),
-    getDisplayNameIdentity: getReusableToolFunctionIdentity(tool.getDisplayName),
-    getToolUseSummaryIdentity: getReusableToolFunctionIdentity(tool.getToolUseSummary),
-    inputExamples: tool.inputExamples,
-    label: tool.label,
-    maxRetries: tool.maxRetries,
-    name: tool.name,
-    parameters: tool.parameters,
-    retryDelayMs: tool.retryDelayMs,
-    shouldRetryIdentity: getReusableToolFunctionIdentity(tool.shouldRetry),
-    source: tool.source,
-    toolIdentity: getReusableToolDefinitionIdentity(tool),
-    toolType: tool.toolType
-  })));
-}
-function createToolMetadataCache(tools, reusableToolResultCwd = process.cwd()) {
-  const definitions = new Map(tools.map((tool) => [tool.name, tool]));
-  return {
-    definitions,
-    reusableToolResultCwd,
-    lookupCount: 0,
-    get(toolName) {
-      this.lookupCount += 1;
-      return definitions.get(toolName);
-    }
-  };
-}
-function getToolDefinition(lookup2, toolName) {
-  if ("get" in lookup2 && !Array.isArray(lookup2)) {
-    return lookup2.get(toolName);
-  }
-  return lookup2.find((candidate) => candidate.name === toolName);
-}
-function getReusableToolResultCacheKey(toolCall, tools) {
-  const tool = getToolDefinition(tools, toolCall.name);
-  const cwd = "reusableToolResultCwd" in tools ? tools.reusableToolResultCwd : process.cwd();
-  if (!tool || tool.annotations?.destructiveHint === true) {
-    return;
-  }
-  if (!isReadOnlyTool(tool.name, tool.annotations, tool.source)) {
-    return;
-  }
-  const toolName = tool.name.toLowerCase();
-  const cacheKey = `${toolCall.name}:${stableStringify(toolCall.arguments)}`;
-  if (NETWORK_BACKED_REUSABLE_TOOL_DENYLIST.has(toolName)) {
-    return;
-  }
-  if (isGitSnapshotReusableToolCall(tool, toolCall, cwd)) {
-    return `${GIT_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX}${cacheKey}`;
-  }
-  if (tool.source !== void 0 || GIT_SNAPSHOT_REUSABLE_TOOL_NAMES.has(toolName) || tool.annotations?.openWorldHint === true || tool.executionLocation === "client") {
-    return;
-  }
-  return `${RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX}${cacheKey}`;
-}
-function isReadOnlyToolCallForCacheInvalidation(toolCall, tools) {
-  const tool = getToolDefinition(tools, toolCall.name);
-  return tool ? isReadOnlyTool(tool.name, tool.annotations, tool.source) : false;
-}
-function cloneToolResultForCache(message) {
-  return {
-    ...message,
-    content: message.content.map((item) => ({ ...item }))
-  };
-}
-function cloneToolOutcomeForCall(outcome, toolCall, timestamp3) {
-  return {
-    message: {
-      ...outcome.message,
-      toolCallId: toolCall.id,
-      toolName: toolCall.name,
-      content: outcome.message.content.map((item) => ({ ...item })),
-      timestamp: timestamp3
-    },
-    isError: outcome.isError
-  };
-}
-function resolvePlatformToolExecutionBridge(option) {
-  if (option === false) {
-    return;
-  }
-  return option ?? getDefaultPlatformToolExecutionBridge();
-}
-async function recordReusableToolExecutionBridgeOutput({
-  bridge,
-  plan,
-  outcome,
-  durationMs,
-  signal
-}) {
-  if (!bridge || !plan) {
-    return outcome;
-  }
-  const observed = plan.kind === "observe" ? await bridge.recordObservation(plan, outcome.message, signal) : void 0;
-  const governedOutput = plan.kind === "governed" ? await bridge.recordGovernedOutput(plan, outcome.message, durationMs, signal) : void 0;
-  return {
-    ...outcome,
-    ...buildObservedResultMetadata(plan, observed ?? governedOutput)
-  };
-}
-function hasReusableToolResultState(cacheKey, cache4, pending, policyCheckedKeys, pendingSafetyChecks) {
-  return cache4.has(cacheKey) || pending.has(cacheKey) || policyCheckedKeys.has(cacheKey) || (pendingSafetyChecks.get(cacheKey) ?? 0) > 0;
-}
-function incrementPendingReusableToolSafetyCheck(cacheKey, pendingSafetyChecks) {
-  if (!cacheKey) {
-    return;
-  }
-  pendingSafetyChecks.set(cacheKey, (pendingSafetyChecks.get(cacheKey) ?? 0) + 1);
-}
-function decrementPendingReusableToolSafetyCheck(cacheKey, pendingSafetyChecks) {
-  if (!cacheKey) {
-    return;
-  }
-  const nextCount = (pendingSafetyChecks.get(cacheKey) ?? 0) - 1;
-  if (nextCount <= 0) {
-    pendingSafetyChecks.delete(cacheKey);
-    return;
-  }
-  pendingSafetyChecks.set(cacheKey, nextCount);
-}
-function clearReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
-  cache4.clear();
-  pending.clear();
-  policyCheckedKeys.clear();
-  pendingSafetyChecks.clear();
-  cacheGeneration.value += 1;
-}
-function clearRunScopedReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
-  let cleared = false;
-  for (const key of cache4.keys()) {
-    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
-      cache4.delete(key);
-      cleared = true;
-    }
-  }
-  for (const key of pending.keys()) {
-    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
-      pending.delete(key);
-      cleared = true;
-    }
-  }
-  for (const key of policyCheckedKeys) {
-    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
-      policyCheckedKeys.delete(key);
-      cleared = true;
-    }
-  }
-  for (const key of pendingSafetyChecks.keys()) {
-    if (key.startsWith(RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX)) {
-      pendingSafetyChecks.delete(key);
-      cleared = true;
-    }
-  }
-  if (cleared) {
-    cacheGeneration.value += 1;
-  }
-}
-function invalidateReusableToolResultsAfterMutation(toolCall, tools, cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration) {
-  if (isReadOnlyToolCallForCacheInvalidation(toolCall, tools)) {
-    return;
-  }
-  clearReusableToolResultState(cache4, pending, policyCheckedKeys, pendingSafetyChecks, cacheGeneration);
-}
-function hasPendingMutatingToolExecution(pendingExecutions, tools) {
-  return pendingExecutions.some((execution) => !isReadOnlyToolCallForCacheInvalidation(execution.toolCall, tools));
-}
-function trackReusableToolResult(cacheKey, executionPromise, cache4, pending, policyCheckedKeys, cacheGeneration) {
-  const trackedGeneration = cacheGeneration?.value;
-  const trackedPromise = executionPromise.then((outcome) => {
-    if (!outcome.isError && outcome.message.isError !== true && (cacheGeneration === void 0 || cacheGeneration.value === trackedGeneration)) {
-      cache4.set(cacheKey, {
-        message: cloneToolResultForCache(outcome.message)
-      });
-    } else {
-      policyCheckedKeys?.delete(cacheKey);
-    }
-    return outcome;
-  }).catch((error) => {
-    policyCheckedKeys?.delete(cacheKey);
-    throw error;
-  }).finally(() => {
-    if (pending.get(cacheKey) === trackedPromise) {
-      pending.delete(cacheKey);
-    }
-  });
-  pending.set(cacheKey, trackedPromise);
-  return trackedPromise;
-}
 var AgentEventQueue = class {
   events = [];
   pending;
@@ -85289,15 +85339,6 @@ var ProviderTransport = class _ProviderTransport {
   }
 };
 var logger69;
-var REUSABLE_TOOL_RESULT_GIT_SNAPSHOT_TIMEOUT_MS = 5e3;
-var GIT_SNAPSHOT_REUSABLE_TOOL_NAMES;
-var REPO_PATH_ARGUMENTS_BY_TOOL;
-var GIT_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX = "git:";
-var RUN_SCOPED_REUSABLE_TOOL_RESULT_KEY_PREFIX = "run:";
-var NETWORK_BACKED_REUSABLE_TOOL_DENYLIST;
-var REQUIRED_REPO_PATH_ARGUMENT_TOOLS;
-var reusableToolDefinitionIdentities;
-var reusableToolDefinitionIdentityCounter = 0;
 var init_transport = __esm2(() => {
   init_env_vars();
   init_hooks();
@@ -85316,38 +85357,11 @@ var init_transport = __esm2(() => {
   init_cost_tracker();
   init_training();
   init_keys();
-  init_tool_execution_bridge();
+  init_reusable_tool_results();
   init_tool_execution();
   init_tool_safety_pipeline();
   init_transport_utils();
   logger69 = createLogger("transport");
-  GIT_SNAPSHOT_REUSABLE_TOOL_NAMES = /* @__PURE__ */ new Set([
-    "read",
-    "ls",
-    "list",
-    "glob",
-    "find",
-    "grep",
-    "search",
-    "parallel_ripgrep",
-    "diff",
-    "status"
-  ]);
-  REPO_PATH_ARGUMENTS_BY_TOOL = /* @__PURE__ */ new Map([
-    ["read", ["path", "file_path"]],
-    ["ls", ["path", "dir", "directory"]],
-    ["list", ["path", "dir", "directory"]],
-    ["glob", ["path", "cwd", "root", "glob"]],
-    ["find", ["path", "cwd", "root", "glob"]],
-    ["grep", ["path", "paths", "glob"]],
-    ["search", ["path", "paths", "glob"]],
-    ["parallel_ripgrep", ["path", "paths", "glob"]],
-    ["diff", ["path", "paths", "cwd"]],
-    ["status", ["path", "paths", "cwd"]]
-  ]);
-  NETWORK_BACKED_REUSABLE_TOOL_DENYLIST = /* @__PURE__ */ new Set(["extract_document"]);
-  REQUIRED_REPO_PATH_ARGUMENT_TOOLS = /* @__PURE__ */ new Set(["read", "ls", "list"]);
-  reusableToolDefinitionIdentities = /* @__PURE__ */ new WeakMap();
 });
 function StringEnum(values, options) {
   const enumValues = Array.from(values);
@@ -160221,6 +160235,15 @@ var init_ripgrep_utils = __esm2(() => {
     }), { minItems: 1 })
   ]));
 });
+function shellQuoteArg(value) {
+  if (/^[A-Za-z0-9_/:=.,@%+-]+$/.test(value)) {
+    return value;
+  }
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+function formatRipgrepCommand(args) {
+  return ["rg", ...args].map(shellQuoteArg).join(" ");
+}
 function mergeRanges(ranges) {
   const sorted = [...ranges].sort((a, b) => a.start - b.start);
   const merged = [];
@@ -160428,7 +160451,7 @@ var init_parallel_ripgrep = __esm2(() => {
       let truncatedByBytes = false;
       const ripgrepCalls = patterns.map(async (pattern) => {
         const args = [...baseArgs, "--", pattern, ...pathArgs];
-        commands.push(["rg", ...args].join(" "));
+        commands.push(formatRipgrepCommand(args));
         const result2 = await runRipgrep(args, signal, commandCwd);
         truncatedByBytes ||= result2.truncated;
         return { pattern, result: result2 };
@@ -160438,7 +160461,7 @@ var init_parallel_ripgrep = __esm2(() => {
         results = await Promise.all(ripgrepCalls);
       } catch (error) {
         const reason = error instanceof Error ? error.message : `Unknown error: ${String(error)}`;
-        return respond.text(`ripgrep failed
+        return respond.error(`ripgrep failed
 
 ${reason}`).detail({
           commands,
@@ -171992,6 +172015,209 @@ var init_runtime_events = __esm2(() => {
   logger161 = createLogger("agent:swarm:runtime-events");
   runtimeEventHandlers = /* @__PURE__ */ new Set();
 });
+function createConnectionId() {
+  return `conn_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+function createSubscriptionId() {
+  return `sub_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
+}
+var HeadlessSubscriberMailbox = class {
+  id;
+  role;
+  explicit;
+  connectionId;
+  optOutNotifications;
+  listeners = /* @__PURE__ */ new Set();
+  queue = [];
+  queuedReset = null;
+  detachedAt;
+  attached = false;
+  allowRawAgentEvents;
+  constructor(id, role, explicit, connectionId, optOutNotifications = [], allowRawAgentEvents = false) {
+    this.id = id;
+    this.role = role;
+    this.explicit = explicit;
+    this.connectionId = connectionId;
+    this.optOutNotifications = optOutNotifications;
+    this.detachedAt = explicit ? Date.now() : null;
+    this.allowRawAgentEvents = allowRawAgentEvents;
+  }
+  onAvailable(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  enqueue(envelope, createReset) {
+    if (this.shouldFilterEnvelope(envelope)) {
+      return;
+    }
+    this.queue.push(envelope);
+    if (this.queue.length > MAX_SUBSCRIBER_MAILBOX_EVENTS) {
+      this.queue.length = 0;
+      this.queuedReset = createReset("lagged");
+    }
+    this.emit();
+  }
+  next() {
+    const next = this.queuedReset ?? this.queue.shift() ?? null;
+    if (next?.type === "reset") {
+      this.queuedReset = null;
+    }
+    return next;
+  }
+  attach() {
+    this.attached = true;
+    this.detachedAt = null;
+    this.emit();
+  }
+  detach() {
+    this.attached = false;
+    this.detachedAt = Date.now();
+  }
+  touch() {
+    if (this.explicit && !this.attached) {
+      this.detachedAt = Date.now();
+    }
+  }
+  isExpired(now2 = Date.now()) {
+    return this.explicit && !this.attached && this.detachedAt !== null && now2 - this.detachedAt > MAX_SUBSCRIPTION_IDLE_MS;
+  }
+  isAttached() {
+    return this.attached;
+  }
+  allowsRawAgentEvents() {
+    return this.allowRawAgentEvents;
+  }
+  setAllowRawAgentEvents(value) {
+    this.allowRawAgentEvents = value;
+  }
+  emit() {
+    for (const listener of this.listeners) {
+      listener();
+    }
+  }
+  shouldFilterEnvelope(envelope) {
+    if (envelope.type === "heartbeat") {
+      return this.optOutNotifications.includes("heartbeat");
+    }
+    if (envelope.type !== "message") {
+      return false;
+    }
+    if (envelope.message.type === "raw_agent_event" && !this.allowRawAgentEvents) {
+      return true;
+    }
+    if (this.optOutNotifications.length === 0) {
+      return false;
+    }
+    switch (envelope.message.type) {
+      case "status":
+        return this.optOutNotifications.includes("status");
+      case "connection_info":
+        return this.optOutNotifications.includes("connection_info");
+      case "compaction":
+        return this.optOutNotifications.includes("compaction");
+      default:
+        return false;
+    }
+  }
+};
+var HeadlessRuntimeBroker = class {
+  nextCursor = 1;
+  listeners = /* @__PURE__ */ new Set();
+  events = [];
+  publishEnvelope(envelope) {
+    assertHeadlessRuntimeStreamEnvelope(envelope, "headless runtime stream envelope");
+    this.events.push(envelope);
+    while (this.events.length > MAX_BUFFERED_EVENTS) {
+      this.events.shift();
+    }
+    for (const listener of this.listeners) {
+      listener(envelope);
+    }
+    return envelope;
+  }
+  publish(message) {
+    const envelope = this.createMessageEnvelope(message);
+    return this.publishEnvelope(envelope);
+  }
+  createPrivateMessage(message) {
+    return this.createMessageEnvelope(message);
+  }
+  createMessageEnvelope(message) {
+    assertHeadlessFromAgentMessage2(message, "headless runtime message");
+    const envelope = {
+      type: "message",
+      cursor: this.nextCursor++,
+      message
+    };
+    return envelope;
+  }
+  publishSnapshot(createSnapshot) {
+    const cursor = this.nextCursor++;
+    const envelope = {
+      type: "snapshot",
+      snapshot: createSnapshot(cursor)
+    };
+    return this.publishEnvelope(envelope);
+  }
+  currentCursor() {
+    return this.nextCursor - 1;
+  }
+  restoreFromSnapshot(snapshot) {
+    const envelope = {
+      type: "reset",
+      reason: "restored_from_snapshot",
+      snapshot
+    };
+    assertHeadlessRuntimeStreamEnvelope(envelope, "headless runtime restore envelope");
+    this.events.length = 0;
+    this.events.push(envelope);
+    this.nextCursor = Math.max(1, snapshot.cursor + 1);
+  }
+  replayFrom(cursor) {
+    if (this.events.length === 0) {
+      return [];
+    }
+    const first = this.events[0];
+    const earliest = this.getEnvelopeCursor(first) ?? this.nextCursor;
+    if (cursor < earliest - 1) {
+      if (first?.type === "reset" && first.reason === "restored_from_snapshot") {
+        return [...this.events];
+      }
+      return null;
+    }
+    return this.events.filter((event) => (this.getEnvelopeCursor(event) ?? 0) > cursor);
+  }
+  subscribe(listener) {
+    this.listeners.add(listener);
+    return () => {
+      this.listeners.delete(listener);
+    };
+  }
+  getEnvelopeCursor(envelope) {
+    if (!envelope) {
+      return;
+    }
+    switch (envelope.type) {
+      case "message":
+        return envelope.cursor;
+      case "heartbeat":
+        return envelope.cursor;
+      case "snapshot":
+      case "reset":
+        return envelope.snapshot.cursor;
+    }
+  }
+};
+var MAX_BUFFERED_EVENTS;
+var MAX_SUBSCRIBER_MAILBOX_EVENTS;
+var MAX_SUBSCRIPTION_IDLE_MS;
+var init_broker = __esm2(() => {
+  MAX_BUFFERED_EVENTS = Number.parseInt(process.env.MAESTRO_HEADLESS_RUNTIME_EVENT_BUFFER || "", 10) || 512;
+  MAX_SUBSCRIBER_MAILBOX_EVENTS = Number.parseInt(process.env.MAESTRO_HEADLESS_SUBSCRIBER_QUEUE || "", 10) || 128;
+  MAX_SUBSCRIPTION_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_SUBSCRIPTION_IDLE_MS || "", 10) || 30 * 1e3;
+});
 function jsonRecordArray(value) {
   return Array.isArray(value) ? value.filter((item) => typeof item === "object" && item !== null && !Array.isArray(item)) : [];
 }
@@ -175098,201 +175324,6 @@ async function loadHostedRunnerRestoreManifest(path3) {
   }
   return restore;
 }
-function createConnectionId() {
-  return `conn_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-}
-function createSubscriptionId() {
-  return `sub_${Date.now()}_${Math.random().toString(36).slice(2, 10)}`;
-}
-var HeadlessSubscriberMailbox = class {
-  id;
-  role;
-  explicit;
-  connectionId;
-  optOutNotifications;
-  listeners = /* @__PURE__ */ new Set();
-  queue = [];
-  queuedReset = null;
-  detachedAt;
-  attached = false;
-  allowRawAgentEvents;
-  constructor(id, role, explicit, connectionId, optOutNotifications = [], allowRawAgentEvents = false) {
-    this.id = id;
-    this.role = role;
-    this.explicit = explicit;
-    this.connectionId = connectionId;
-    this.optOutNotifications = optOutNotifications;
-    this.detachedAt = explicit ? Date.now() : null;
-    this.allowRawAgentEvents = allowRawAgentEvents;
-  }
-  onAvailable(listener) {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
-  }
-  enqueue(envelope, createReset) {
-    if (this.shouldFilterEnvelope(envelope)) {
-      return;
-    }
-    this.queue.push(envelope);
-    if (this.queue.length > MAX_SUBSCRIBER_MAILBOX_EVENTS) {
-      this.queue.length = 0;
-      this.queuedReset = createReset("lagged");
-    }
-    this.emit();
-  }
-  next() {
-    const next = this.queuedReset ?? this.queue.shift() ?? null;
-    if (next?.type === "reset") {
-      this.queuedReset = null;
-    }
-    return next;
-  }
-  attach() {
-    this.attached = true;
-    this.detachedAt = null;
-    this.emit();
-  }
-  detach() {
-    this.attached = false;
-    this.detachedAt = Date.now();
-  }
-  touch() {
-    if (this.explicit && !this.attached) {
-      this.detachedAt = Date.now();
-    }
-  }
-  isExpired(now2 = Date.now()) {
-    return this.explicit && !this.attached && this.detachedAt !== null && now2 - this.detachedAt > MAX_SUBSCRIPTION_IDLE_MS;
-  }
-  isAttached() {
-    return this.attached;
-  }
-  allowsRawAgentEvents() {
-    return this.allowRawAgentEvents;
-  }
-  setAllowRawAgentEvents(value) {
-    this.allowRawAgentEvents = value;
-  }
-  emit() {
-    for (const listener of this.listeners) {
-      listener();
-    }
-  }
-  shouldFilterEnvelope(envelope) {
-    if (envelope.type === "heartbeat") {
-      return this.optOutNotifications.includes("heartbeat");
-    }
-    if (envelope.type !== "message") {
-      return false;
-    }
-    if (envelope.message.type === "raw_agent_event" && !this.allowRawAgentEvents) {
-      return true;
-    }
-    if (this.optOutNotifications.length === 0) {
-      return false;
-    }
-    switch (envelope.message.type) {
-      case "status":
-        return this.optOutNotifications.includes("status");
-      case "connection_info":
-        return this.optOutNotifications.includes("connection_info");
-      case "compaction":
-        return this.optOutNotifications.includes("compaction");
-      default:
-        return false;
-    }
-  }
-};
-var HeadlessRuntimeBroker = class {
-  nextCursor = 1;
-  listeners = /* @__PURE__ */ new Set();
-  events = [];
-  publishEnvelope(envelope) {
-    assertHeadlessRuntimeStreamEnvelope(envelope, "headless runtime stream envelope");
-    this.events.push(envelope);
-    while (this.events.length > MAX_BUFFERED_EVENTS) {
-      this.events.shift();
-    }
-    for (const listener of this.listeners) {
-      listener(envelope);
-    }
-    return envelope;
-  }
-  publish(message) {
-    const envelope = this.createMessageEnvelope(message);
-    return this.publishEnvelope(envelope);
-  }
-  createPrivateMessage(message) {
-    return this.createMessageEnvelope(message);
-  }
-  createMessageEnvelope(message) {
-    assertHeadlessFromAgentMessage2(message, "headless runtime message");
-    const envelope = {
-      type: "message",
-      cursor: this.nextCursor++,
-      message
-    };
-    return envelope;
-  }
-  publishSnapshot(createSnapshot) {
-    const cursor = this.nextCursor++;
-    const envelope = {
-      type: "snapshot",
-      snapshot: createSnapshot(cursor)
-    };
-    return this.publishEnvelope(envelope);
-  }
-  currentCursor() {
-    return this.nextCursor - 1;
-  }
-  restoreFromSnapshot(snapshot) {
-    const envelope = {
-      type: "reset",
-      reason: "restored_from_snapshot",
-      snapshot
-    };
-    assertHeadlessRuntimeStreamEnvelope(envelope, "headless runtime restore envelope");
-    this.events.length = 0;
-    this.events.push(envelope);
-    this.nextCursor = Math.max(1, snapshot.cursor + 1);
-  }
-  replayFrom(cursor) {
-    if (this.events.length === 0) {
-      return [];
-    }
-    const first = this.events[0];
-    const earliest = this.getEnvelopeCursor(first) ?? this.nextCursor;
-    if (cursor < earliest - 1) {
-      if (first?.type === "reset" && first.reason === "restored_from_snapshot") {
-        return [...this.events];
-      }
-      return null;
-    }
-    return this.events.filter((event) => (this.getEnvelopeCursor(event) ?? 0) > cursor);
-  }
-  subscribe(listener) {
-    this.listeners.add(listener);
-    return () => {
-      this.listeners.delete(listener);
-    };
-  }
-  getEnvelopeCursor(envelope) {
-    if (!envelope) {
-      return;
-    }
-    switch (envelope.type) {
-      case "message":
-        return envelope.cursor;
-      case "heartbeat":
-        return envelope.cursor;
-      case "snapshot":
-      case "reset":
-        return envelope.snapshot.cursor;
-    }
-  }
-};
 var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
   translator = new HeadlessProtocolTranslator();
   broker = new HeadlessRuntimeBroker();
@@ -175949,7 +175980,7 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
       next: () => subscriber.next(),
       onAvailable: (listener) => subscriber.onAvailable(listener),
       enqueue: (envelope) => {
-        assertHeadlessRuntimeStreamEnvelope(envelope, "headless attached subscription envelope");
+        assertHeadlessRuntimeStreamEnvelope2(envelope, "headless attached subscription envelope");
         subscriber.enqueue(envelope, (reason) => this.buildResetEnvelope(reason));
       },
       close: () => {
@@ -176079,7 +176110,7 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
       type: "heartbeat",
       cursor: this.broker.currentCursor()
     };
-    assertHeadlessRuntimeStreamEnvelope(envelope, "headless runtime heartbeat envelope");
+    assertHeadlessRuntimeStreamEnvelope2(envelope, "headless runtime heartbeat envelope");
     return envelope;
   }
   heartbeatConnection(input) {
@@ -176434,7 +176465,7 @@ var HeadlessSessionRuntime = class _HeadlessSessionRuntime {
     }
   }
   publish(message) {
-    assertHeadlessFromAgentMessage2(message, "headless runtime message");
+    assertHeadlessFromAgentMessage3(message, "headless runtime message");
     if (message.type === "server_request") {
       this.publishedServerRequestIds.add(message.request_id);
     } else if (message.type === "server_request_resolved") {
@@ -176794,9 +176825,6 @@ var HeadlessRuntimeService = class {
   }
 };
 var logger163;
-var MAX_BUFFERED_EVENTS;
-var MAX_SUBSCRIBER_MAILBOX_EVENTS;
-var MAX_SUBSCRIPTION_IDLE_MS;
 var CONNECTION_HEARTBEAT_INTERVAL_MS;
 var MAX_CONNECTION_IDLE_MS;
 var MAX_IDLE_MS;
@@ -176823,13 +176851,11 @@ var init_headless_runtime_service = __esm2(() => {
   init_approval_service();
   init_circuit_breaker2();
   init_client_tools_service();
+  init_broker();
   init_hosted_agent_runtime_progress();
   init_server_request_manager();
   init_tool_retry_service();
   logger163 = createLogger("server:headless-runtime");
-  MAX_BUFFERED_EVENTS = Number.parseInt(process.env.MAESTRO_HEADLESS_RUNTIME_EVENT_BUFFER || "", 10) || 512;
-  MAX_SUBSCRIBER_MAILBOX_EVENTS = Number.parseInt(process.env.MAESTRO_HEADLESS_SUBSCRIBER_QUEUE || "", 10) || 128;
-  MAX_SUBSCRIPTION_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_SUBSCRIPTION_IDLE_MS || "", 10) || 30 * 1e3;
   CONNECTION_HEARTBEAT_INTERVAL_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_CONNECTION_HEARTBEAT_INTERVAL_MS || "", 10) || 15 * 1e3;
   MAX_CONNECTION_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_CONNECTION_IDLE_MS || "", 10) || CONNECTION_HEARTBEAT_INTERVAL_MS * 3;
   MAX_IDLE_MS = Number.parseInt(process.env.MAESTRO_HEADLESS_RUNTIME_IDLE_MS || "", 10) || 30 * 60 * 1e3;
@@ -196885,6 +196911,59 @@ function isTerminalCandidate(entry2) {
 function runStepStateForEntry(entry2) {
   return entry2.state === "blocked" ? "failed" : entry2.state;
 }
+function firstEvidenceId2(entry2, kind) {
+  return entry2.evidence.find((anchor) => anchor.kind === kind)?.id;
+}
+function evidenceRefForAnchor(anchor) {
+  switch (anchor.kind) {
+    case "timeline_item":
+      return `timeline-item:${anchor.id}`;
+    case "tool_call":
+      return `tool-call:${anchor.id}`;
+    case "tool_execution":
+      return `tool-execution:${anchor.id}`;
+    case "approval_request":
+      return `approval-request:${anchor.id}`;
+    case "pending_request":
+      return `pending-request:${anchor.id}`;
+    case "agent_run":
+      return `agent-run:${anchor.id}`;
+    case "parent_agent_run":
+      return `parent-agent-run:${anchor.id}`;
+    case "child_agent_run":
+      return `child-agent-run:${anchor.id}`;
+    default:
+      return `${anchor.kind}:${anchor.id}`;
+  }
+}
+function uniqueStrings3(values) {
+  return values.filter((value, index2) => {
+    return typeof value === "string" && value.length > 0 && values.indexOf(value) === index2;
+  });
+}
+function evidenceRefsForEntry(entry2) {
+  return uniqueStrings3([
+    `trajectory-event:${entry2.trajectoryEventId}`,
+    ...entry2.timelineItemId ? [`timeline-item:${entry2.timelineItemId}`] : [],
+    ...entry2.evidence.map(evidenceRefForAnchor)
+  ]);
+}
+function workItemPayloadForEntry(sessionId, entry2) {
+  return {
+    maestroSessionId: sessionId,
+    ledgerEntryId: entry2.id,
+    trajectoryEventId: entry2.trajectoryEventId,
+    eventType: entry2.type,
+    phase: entry2.phase,
+    actor: entry2.actor,
+    source: entry2.source,
+    state: entry2.state,
+    ...entry2.timelineItemId ? { timelineItemId: entry2.timelineItemId } : {},
+    ...entry2.toolName ? { toolName: entry2.toolName } : {},
+    ...entry2.summary ? { summary: entry2.summary } : {},
+    ...entry2.relatedIds.length > 0 ? { relatedIds: entry2.relatedIds } : {}
+  };
+}
 function terminalEntry(entries) {
   const last = entries.at(-1);
   if (!last || !isTerminalState(last.state))
@@ -196944,6 +197023,9 @@ function buildPromotionPlan(runId, sessionId, generatedAt, entries) {
     }
   ];
   for (const entry2 of entries) {
+    const toolExecutionId = firstEvidenceId2(entry2, "tool_execution");
+    const evidenceRefs = evidenceRefsForEntry(entry2);
+    const waitId = entry2.platformShape.waitType ? entry2.id : void 0;
     operations.push({
       operation: "record_run_step",
       id: `promote:${entry2.id}:step`,
@@ -196966,7 +197048,12 @@ function buildPromotionPlan(runId, sessionId, generatedAt, entries) {
         kind: entry2.platformShape.workItemKind,
         state: entry2.state,
         title: entry2.title,
-        timestamp: entry2.timestamp
+        timestamp: entry2.timestamp,
+        ...waitId ? { waitId } : {},
+        ...toolExecutionId ? { toolExecutionId } : {},
+        evidenceRefs,
+        completionGate: "maestro_agent_runtime_ledger_recorded",
+        payload: workItemPayloadForEntry(sessionId, entry2)
       }
     });
     if (entry2.platformShape.waitType) {
@@ -197205,6 +197292,23 @@ function buildCoverage(counts, promptContext, contextManifest) {
     mcpContext: contextManifest.mcpServers > 0 || promptContext.mcpServers > 0
   };
 }
+function buildDurabilitySummary(input) {
+  const sessionFilePresent = typeof input.sessionFile === "string" && input.sessionFile.length > 0;
+  const contextManifestPresent = input.contextManifest.protocolVersion !== void 0;
+  const replayDeterministic = input.agentRuntimeLedger.replay.deterministic;
+  return {
+    reconstructable: sessionFilePresent && input.counts.timelineItems > 0 && replayDeterministic,
+    sessionFilePresent,
+    resumeSummaryPresent: typeof input.session.resumeSummary === "string" && input.session.resumeSummary.trim().length > 0,
+    memoryExtractionHashPresent: typeof input.session.memoryExtractionHash === "string" && input.session.memoryExtractionHash.trim().length > 0,
+    contextManifestPresent,
+    compactionCheckpoints: input.counts.byType["compaction.created"] ?? 0,
+    pendingRequests: input.counts.byType["wait.pending"] ?? 0,
+    agentRuntimeLedgerEntries: input.agentRuntimeLedger.counts.entries,
+    replayDeterministic,
+    promotionIdempotencyKey: input.agentRuntimeLedger.promotion.idempotencyKey
+  };
+}
 async function buildRunReconstructionReport(sessionId, options = {}) {
   const manager = new SessionManager(false, void 0, {
     sessionDir: options.sessionDir
@@ -197263,6 +197367,12 @@ async function buildRunReconstructionReport(sessionId, options = {}) {
   if (session.summary) {
     sessionReport.summary = session.summary;
   }
+  if (session.resumeSummary) {
+    sessionReport.resumeSummary = session.resumeSummary;
+  }
+  if (session.memoryExtractionHash) {
+    sessionReport.memoryExtractionHash = session.memoryExtractionHash;
+  }
   if (header?.cwd) {
     sessionReport.cwd = header.cwd;
   }
@@ -197281,7 +197391,14 @@ async function buildRunReconstructionReport(sessionId, options = {}) {
     trajectoryReplay,
     trajectoryScore,
     trajectoryInspection,
-    agentRuntimeLedger
+    agentRuntimeLedger,
+    durability: buildDurabilitySummary({
+      sessionFile,
+      session,
+      counts,
+      contextManifest,
+      agentRuntimeLedger
+    })
   };
 }
 function renderCoverage(coverage) {
@@ -197325,6 +197442,7 @@ function renderRunReconstruction(report) {
     `Trajectory score: ${report.trajectoryScore.counts.failed} failed, ${report.trajectoryScore.counts.warnings} warnings across ${report.trajectoryScore.counts.rules} rule(s)`,
     `Replay lab: ${report.trajectoryInspection.counts.jumpTargets} event/source jump target(s), redaction=${report.trajectoryInspection.redaction.default}`,
     `AgentRuntime ledger: ${report.agentRuntimeLedger.counts.entries} entries, ${report.agentRuntimeLedger.counts.promotionOperations} dry-run promotion op(s), replay deterministic=${report.agentRuntimeLedger.replay.deterministic ? "yes" : "no"}`,
+    `Durability: reconstructable=${report.durability.reconstructable ? "yes" : "no"}, resume summary=${report.durability.resumeSummaryPresent ? "yes" : "no"}, memory hash=${report.durability.memoryExtractionHashPresent ? "yes" : "no"}, checkpoints=${report.durability.compactionCheckpoints}, pending waits=${report.durability.pendingRequests}`,
     `Coverage: ${renderCoverage(report.coverage)}`,
     `Prompt context: ${report.promptContext.entries} entries (${report.promptContext.projectDocs} docs, ${report.promptContext.mcpServers} MCP servers)`,
     `Context manifest: ${report.contextManifest.entries} entries (${report.contextManifest.projectDocs} docs, ${report.contextManifest.mcpServers} MCP servers, ${report.contextManifest.mcpResources} resources, ${report.contextManifest.mcpPrompts} prompts, ${report.contextManifest.diagnostics} diagnostics)`,
@@ -197828,7 +197946,7 @@ async function streamAttachEvents(context2, handlers, signal) {
       buffer = parsed.remainder;
       for (const event of parsed.events) {
         const payload = JSON.parse(event.data);
-        assertHeadlessRuntimeStreamEnvelope2(payload, "remote runner headless stream event");
+        assertHeadlessRuntimeStreamEnvelope3(payload, "remote runner headless stream event");
         switch (payload.type) {
           case "message":
             handlers.onMessage(payload.message);
@@ -199706,7 +199824,7 @@ function summarizeOperatingPlaneInspection(inspection, options = {}) {
     contractVersion: inspection.contract_version,
     generatedAt: inspection.generated_at,
     runCount: inspection.runs.length,
-    unavailableSources: uniqueStrings3(inspection.unavailable_sources),
+    unavailableSources: uniqueStrings4(inspection.unavailable_sources),
     runs: runs.map(summarizeOperatingPlaneRun)
   };
 }
@@ -199769,8 +199887,8 @@ function summarizeOperatingPlaneRun(run2) {
     proofPresent,
     proofMissing,
     evidenceRefs: summarizeEvidenceRefs(run2.evidence_refs),
-    nextActions: uniqueStrings3(run2.work_items?.map((item) => oneLine(item.next_action))),
-    blockers: uniqueStrings3(run2.work_items?.map((item) => oneLine(item.blocker))),
+    nextActions: uniqueStrings4(run2.work_items?.map((item) => oneLine(item.next_action))),
+    blockers: uniqueStrings4(run2.work_items?.map((item) => oneLine(item.blocker))),
     withheld: operatingPlaneWithheldReasons(run2),
     usage: summarizeUsage(run2.usage)
   });
@@ -199787,7 +199905,7 @@ function summarizeProof(run2) {
     { label: "cost", value: proof?.cost_attributed }
   ];
   const proofPresent = fields.filter((field) => field.value === true).map((field) => field.label);
-  const proofMissing = uniqueStrings3([
+  const proofMissing = uniqueStrings4([
     ...fields.filter((field) => field.value !== true).map((field) => field.label),
     ...proof?.missing_proof ?? [],
     proof ? void 0 : "value_proof unavailable"
@@ -199825,7 +199943,7 @@ function operatingPlaneIdentitySubject(run2) {
   ]);
 }
 function operatingPlaneWithheldReasons(run2) {
-  return uniqueStrings3([
+  return uniqueStrings4([
     ...run2.withholding_reasons ?? [],
     run2.redaction_count && run2.redaction_count > 0 ? `${run2.redaction_count} ${pluralize("redaction", run2.redaction_count)}` : void 0,
     ...run2.unavailable_sources ?? []
@@ -199838,7 +199956,7 @@ function formatEvidenceRef(evidence2) {
     evidence2.uri ? `uri ${evidence2.uri}` : void 0,
     evidence2.revision ? `revision ${evidence2.revision}` : void 0
   ];
-  return `${evidence2.id} (${uniqueStrings3(details).join(", ")})`;
+  return `${evidence2.id} (${uniqueStrings4(details).join(", ")})`;
 }
 function formatUsage(usage4) {
   const parts = [
@@ -199848,7 +199966,7 @@ function formatUsage(usage4) {
     typeof usage4.estimatedCostMicros === "number" ? `${usage4.estimatedCostMicros} cost micros` : void 0,
     usage4.currency
   ];
-  return uniqueStrings3(parts).join(", ") || void 0;
+  return uniqueStrings4(parts).join(", ") || void 0;
 }
 function firstString5(values) {
   for (const value of values) {
@@ -199868,7 +199986,7 @@ function pushLine(lines, label, value) {
     lines.push(`${label}: ${value}`);
   }
 }
-function uniqueStrings3(values) {
+function uniqueStrings4(values) {
   const seen = /* @__PURE__ */ new Set();
   const normalized = [];
   for (const value of values ?? []) {