@fased/fased 0.1.41 → 0.1.42

package/dist/plugin-sdk/agent-scope-BbgPlhtw.js

@@ -0,0 +1,1372 @@
+import { t as createSubsystemLogger } from "./subsystem-DBPNbQDQ.js";
+import { s as resolveStateDir, u as resolveRequiredHomeDir } from "./paths-BEmvSyOV.js";
+import { f as pathExists$1, h as resolveUserPath } from "./utils-CYk9EKoq.js";
+import { S as parseAgentSessionKey, b as isCronSessionKey, l as resolveAgentIdFromSessionKey, s as normalizeAgentId, t as DEFAULT_AGENT_ID, x as isSubagentSessionKey } from "./session-key-HSJ2KQTc.js";
+import { t as runCommandWithTimeout } from "./exec-DQ8j4Fm3.js";
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
+import fs$1 from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+
+//#region src/shared/string-normalization.ts
+function normalizeStringEntries(list) {
+	return (list ?? []).map((entry) => String(entry).trim()).filter(Boolean);
+}
+function normalizeStringEntriesLower(list) {
+	return normalizeStringEntries(list).map((entry) => entry.toLowerCase());
+}
+function normalizeHyphenSlug(raw) {
+	const trimmed = raw?.trim().toLowerCase() ?? "";
+	if (!trimmed) return "";
+	return trimmed.replace(/\s+/g, "-").replace(/[^a-z0-9#@._+-]+/g, "-").replace(/-{2,}/g, "-").replace(/^[-.]+|[-.]+$/g, "");
+}
+function normalizeAtHashSlug(raw) {
+	const trimmed = raw?.trim().toLowerCase() ?? "";
+	if (!trimmed) return "";
+	return trimmed.replace(/^[@#]+/, "").replace(/[\s_]+/g, "-").replace(/[^a-z0-9-]+/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+
+//#endregion
+//#region src/config/model-input.ts
+const MAX_AGENT_MODEL_FALLBACKS = 1;
+function normalizeAgentModelFallbackValues(value) {
+	if (!Array.isArray(value)) return;
+	return value.map((entry) => typeof entry === "string" ? entry.trim() : "").filter(Boolean).slice(0, MAX_AGENT_MODEL_FALLBACKS);
+}
+function resolveAgentModelPrimaryValue(model) {
+	if (typeof model === "string") return model.trim() || void 0;
+	if (!model || typeof model !== "object") return;
+	return model.primary?.trim() || void 0;
+}
+function resolveAgentModelFallbackValues(model) {
+	if (!model || typeof model !== "object") return [];
+	return normalizeAgentModelFallbackValues(model.fallbacks) ?? [];
+}
+function toAgentModelListLike(model) {
+	if (typeof model === "string") {
+		const primary = model.trim();
+		return primary ? { primary } : void 0;
+	}
+	if (!model || typeof model !== "object") return;
+	return model;
+}
+
+//#endregion
+//#region src/agents/skills/filter.ts
+function normalizeSkillFilter(skillFilter) {
+	if (skillFilter === void 0) return;
+	return normalizeStringEntries(skillFilter);
+}
+
+//#endregion
+//#region src/agents/skills/agent-filter.ts
+/**
+* Explicit per-agent skills win when present; otherwise fall back to shared defaults.
+* Unknown agent ids also fall back to defaults so legacy/unresolved callers do not widen access.
+*/
+function resolveEffectiveAgentSkillFilter(cfg, agentId) {
+	if (!cfg) return;
+	const normalizedAgentId = normalizeAgentId(agentId);
+	const agentEntry = cfg.agents?.list?.find((entry) => normalizeAgentId(entry.id) === normalizedAgentId);
+	if (agentEntry && Object.hasOwn(agentEntry, "skills")) return normalizeSkillFilter(agentEntry.skills);
+	return normalizeSkillFilter(cfg.agents?.defaults?.skills);
+}
+
+//#endregion
+//#region src/infra/path-guards.ts
+const NOT_FOUND_CODES = new Set(["ENOENT", "ENOTDIR"]);
+const SYMLINK_OPEN_CODES = new Set([
+	"ELOOP",
+	"EINVAL",
+	"ENOTSUP"
+]);
+const PARENT_SEGMENT_PREFIX = /^\.\.(?:[\\/]|$)/u;
+function normalizeWindowsPathForComparison(input) {
+	let normalized = path.win32.normalize(input);
+	if (normalized.startsWith("\\\\?\\")) {
+		normalized = normalized.slice(4);
+		if (normalized.toUpperCase().startsWith("UNC\\")) normalized = `\\\\${normalized.slice(4)}`;
+	}
+	return normalized.replaceAll("/", "\\").toLowerCase();
+}
+function isNodeError(value) {
+	return Boolean(value && typeof value === "object" && "code" in value);
+}
+function isNotFoundPathError(value) {
+	return isNodeError(value) && typeof value.code === "string" && NOT_FOUND_CODES.has(value.code);
+}
+function isSymlinkOpenError(value) {
+	return isNodeError(value) && typeof value.code === "string" && SYMLINK_OPEN_CODES.has(value.code);
+}
+function isPathInside(root, target) {
+	const resolvedRoot = path.resolve(root);
+	const resolvedTarget = path.resolve(target);
+	if (process.platform === "win32") {
+		const rootForCompare = normalizeWindowsPathForComparison(resolvedRoot);
+		const targetForCompare = normalizeWindowsPathForComparison(resolvedTarget);
+		const relative = path.win32.relative(rootForCompare, targetForCompare);
+		return relative === "" || !PARENT_SEGMENT_PREFIX.test(relative) && !path.win32.isAbsolute(relative);
+	}
+	const relative = path.relative(resolvedRoot, resolvedTarget);
+	return relative === "" || !PARENT_SEGMENT_PREFIX.test(relative) && !path.isAbsolute(relative);
+}
+
+//#endregion
+//#region src/infra/boundary-path.ts
+const BOUNDARY_PATH_ALIAS_POLICIES = {
+	strict: Object.freeze({
+		allowFinalSymlinkForUnlink: false,
+		allowFinalHardlinkForUnlink: false
+	}),
+	unlinkTarget: Object.freeze({
+		allowFinalSymlinkForUnlink: true,
+		allowFinalHardlinkForUnlink: true
+	})
+};
+async function resolveBoundaryPath(params) {
+	const rootPath = path.resolve(params.rootPath);
+	const absolutePath = path.resolve(params.absolutePath);
+	const rootCanonicalPath = params.rootCanonicalPath ? path.resolve(params.rootCanonicalPath) : await resolvePathViaExistingAncestor(rootPath);
+	const lexicalInside = isPathInside(rootPath, absolutePath);
+	const canonicalOutsideLexicalPath = resolveCanonicalOutsideLexicalPath({
+		absolutePath,
+		outsideLexicalCanonicalPath: lexicalInside ? void 0 : await resolvePathViaExistingAncestor(absolutePath)
+	});
+	assertLexicalBoundaryOrCanonicalAlias({
+		skipLexicalRootCheck: params.skipLexicalRootCheck,
+		lexicalInside,
+		canonicalOutsideLexicalPath,
+		rootCanonicalPath,
+		boundaryLabel: params.boundaryLabel,
+		rootPath,
+		absolutePath
+	});
+	if (!lexicalInside) {
+		const canonicalPath = canonicalOutsideLexicalPath;
+		assertInsideBoundary({
+			boundaryLabel: params.boundaryLabel,
+			rootCanonicalPath,
+			candidatePath: canonicalPath,
+			absolutePath
+		});
+		return buildResolvedBoundaryPath({
+			absolutePath,
+			canonicalPath,
+			rootPath,
+			rootCanonicalPath,
+			kind: await getPathKind(absolutePath, false)
+		});
+	}
+	return resolveBoundaryPathLexicalAsync({
+		params,
+		absolutePath,
+		rootPath,
+		rootCanonicalPath
+	});
+}
+function resolveBoundaryPathSync(params) {
+	const rootPath = path.resolve(params.rootPath);
+	const absolutePath = path.resolve(params.absolutePath);
+	const rootCanonicalPath = params.rootCanonicalPath ? path.resolve(params.rootCanonicalPath) : resolvePathViaExistingAncestorSync(rootPath);
+	const lexicalInside = isPathInside(rootPath, absolutePath);
+	const canonicalOutsideLexicalPath = resolveCanonicalOutsideLexicalPath({
+		absolutePath,
+		outsideLexicalCanonicalPath: lexicalInside ? void 0 : resolvePathViaExistingAncestorSync(absolutePath)
+	});
+	assertLexicalBoundaryOrCanonicalAlias({
+		skipLexicalRootCheck: params.skipLexicalRootCheck,
+		lexicalInside,
+		canonicalOutsideLexicalPath,
+		rootCanonicalPath,
+		boundaryLabel: params.boundaryLabel,
+		rootPath,
+		absolutePath
+	});
+	if (!lexicalInside) {
+		const canonicalPath = canonicalOutsideLexicalPath;
+		assertInsideBoundary({
+			boundaryLabel: params.boundaryLabel,
+			rootCanonicalPath,
+			candidatePath: canonicalPath,
+			absolutePath
+		});
+		return buildResolvedBoundaryPath({
+			absolutePath,
+			canonicalPath,
+			rootPath,
+			rootCanonicalPath,
+			kind: getPathKindSync(absolutePath, false)
+		});
+	}
+	return resolveBoundaryPathLexicalSync({
+		params,
+		absolutePath,
+		rootPath,
+		rootCanonicalPath
+	});
+}
+async function resolveBoundaryPathLexicalAsync(params) {
+	const segments = path.relative(params.rootPath, params.absolutePath).split(path.sep).filter(Boolean);
+	const allowFinalSymlink = params.params.policy?.allowFinalSymlinkForUnlink === true;
+	let canonicalCursor = params.rootCanonicalPath;
+	let lexicalCursor = params.rootPath;
+	let preserveFinalSymlink = false;
+	for (let idx = 0; idx < segments.length; idx += 1) {
+		const segment = segments[idx] ?? "";
+		const isLast = idx === segments.length - 1;
+		lexicalCursor = path.join(lexicalCursor, segment);
+		let stat;
+		try {
+			stat = await fs$1.lstat(lexicalCursor);
+		} catch (error) {
+			if (isNotFoundPathError(error)) {
+				const missingSuffix = segments.slice(idx);
+				canonicalCursor = path.resolve(canonicalCursor, ...missingSuffix);
+				assertInsideBoundary({
+					boundaryLabel: params.params.boundaryLabel,
+					rootCanonicalPath: params.rootCanonicalPath,
+					candidatePath: canonicalCursor,
+					absolutePath: params.absolutePath
+				});
+				break;
+			}
+			throw error;
+		}
+		if (!stat.isSymbolicLink()) {
+			canonicalCursor = path.resolve(canonicalCursor, segment);
+			assertInsideBoundary({
+				boundaryLabel: params.params.boundaryLabel,
+				rootCanonicalPath: params.rootCanonicalPath,
+				candidatePath: canonicalCursor,
+				absolutePath: params.absolutePath
+			});
+			continue;
+		}
+		if (allowFinalSymlink && isLast) {
+			preserveFinalSymlink = true;
+			canonicalCursor = path.resolve(canonicalCursor, segment);
+			assertInsideBoundary({
+				boundaryLabel: params.params.boundaryLabel,
+				rootCanonicalPath: params.rootCanonicalPath,
+				candidatePath: canonicalCursor,
+				absolutePath: params.absolutePath
+			});
+			break;
+		}
+		const linkCanonical = await resolveSymlinkHopPath(lexicalCursor);
+		if (!isPathInside(params.rootCanonicalPath, linkCanonical)) throw symlinkEscapeError({
+			boundaryLabel: params.params.boundaryLabel,
+			rootCanonicalPath: params.rootCanonicalPath,
+			symlinkPath: lexicalCursor
+		});
+		canonicalCursor = linkCanonical;
+		lexicalCursor = linkCanonical;
+	}
+	assertInsideBoundary({
+		boundaryLabel: params.params.boundaryLabel,
+		rootCanonicalPath: params.rootCanonicalPath,
+		candidatePath: canonicalCursor,
+		absolutePath: params.absolutePath
+	});
+	const kind = await getPathKind(params.absolutePath, preserveFinalSymlink);
+	return buildResolvedBoundaryPath({
+		absolutePath: params.absolutePath,
+		canonicalPath: canonicalCursor,
+		rootPath: params.rootPath,
+		rootCanonicalPath: params.rootCanonicalPath,
+		kind
+	});
+}
+function resolveBoundaryPathLexicalSync(params) {
+	const segments = path.relative(params.rootPath, params.absolutePath).split(path.sep).filter(Boolean);
+	const allowFinalSymlink = params.params.policy?.allowFinalSymlinkForUnlink === true;
+	let canonicalCursor = params.rootCanonicalPath;
+	let lexicalCursor = params.rootPath;
+	let preserveFinalSymlink = false;
+	for (let idx = 0; idx < segments.length; idx += 1) {
+		const segment = segments[idx] ?? "";
+		const isLast = idx === segments.length - 1;
+		lexicalCursor = path.join(lexicalCursor, segment);
+		let stat;
+		try {
+			stat = fs.lstatSync(lexicalCursor);
+		} catch (error) {
+			if (isNotFoundPathError(error)) {
+				const missingSuffix = segments.slice(idx);
+				canonicalCursor = path.resolve(canonicalCursor, ...missingSuffix);
+				assertInsideBoundary({
+					boundaryLabel: params.params.boundaryLabel,
+					rootCanonicalPath: params.rootCanonicalPath,
+					candidatePath: canonicalCursor,
+					absolutePath: params.absolutePath
+				});
+				break;
+			}
+			throw error;
+		}
+		if (!stat.isSymbolicLink()) {
+			canonicalCursor = path.resolve(canonicalCursor, segment);
+			assertInsideBoundary({
+				boundaryLabel: params.params.boundaryLabel,
+				rootCanonicalPath: params.rootCanonicalPath,
+				candidatePath: canonicalCursor,
+				absolutePath: params.absolutePath
+			});
+			continue;
+		}
+		if (allowFinalSymlink && isLast) {
+			preserveFinalSymlink = true;
+			canonicalCursor = path.resolve(canonicalCursor, segment);
+			assertInsideBoundary({
+				boundaryLabel: params.params.boundaryLabel,
+				rootCanonicalPath: params.rootCanonicalPath,
+				candidatePath: canonicalCursor,
+				absolutePath: params.absolutePath
+			});
+			break;
+		}
+		const linkCanonical = resolveSymlinkHopPathSync(lexicalCursor);
+		if (!isPathInside(params.rootCanonicalPath, linkCanonical)) throw symlinkEscapeError({
+			boundaryLabel: params.params.boundaryLabel,
+			rootCanonicalPath: params.rootCanonicalPath,
+			symlinkPath: lexicalCursor
+		});
+		canonicalCursor = linkCanonical;
+		lexicalCursor = linkCanonical;
+	}
+	assertInsideBoundary({
+		boundaryLabel: params.params.boundaryLabel,
+		rootCanonicalPath: params.rootCanonicalPath,
+		candidatePath: canonicalCursor,
+		absolutePath: params.absolutePath
+	});
+	const kind = getPathKindSync(params.absolutePath, preserveFinalSymlink);
+	return buildResolvedBoundaryPath({
+		absolutePath: params.absolutePath,
+		canonicalPath: canonicalCursor,
+		rootPath: params.rootPath,
+		rootCanonicalPath: params.rootCanonicalPath,
+		kind
+	});
+}
+function resolveCanonicalOutsideLexicalPath(params) {
+	return params.outsideLexicalCanonicalPath ?? params.absolutePath;
+}
+function assertLexicalBoundaryOrCanonicalAlias(params) {
+	if (params.skipLexicalRootCheck || params.lexicalInside) return;
+	if (isPathInside(params.rootCanonicalPath, params.canonicalOutsideLexicalPath)) return;
+	throw pathEscapeError({
+		boundaryLabel: params.boundaryLabel,
+		rootPath: params.rootPath,
+		absolutePath: params.absolutePath
+	});
+}
+function buildResolvedBoundaryPath(params) {
+	return {
+		absolutePath: params.absolutePath,
+		canonicalPath: params.canonicalPath,
+		rootPath: params.rootPath,
+		rootCanonicalPath: params.rootCanonicalPath,
+		relativePath: relativeInsideRoot(params.rootCanonicalPath, params.canonicalPath),
+		exists: params.kind.exists,
+		kind: params.kind.kind
+	};
+}
+async function resolvePathViaExistingAncestor(targetPath) {
+	const normalized = path.resolve(targetPath);
+	let cursor = normalized;
+	const missingSuffix = [];
+	while (!isFilesystemRoot(cursor) && !await pathExists(cursor)) {
+		missingSuffix.unshift(path.basename(cursor));
+		const parent = path.dirname(cursor);
+		if (parent === cursor) break;
+		cursor = parent;
+	}
+	if (!await pathExists(cursor)) return normalized;
+	try {
+		const resolvedAncestor = path.resolve(await fs$1.realpath(cursor));
+		if (missingSuffix.length === 0) return resolvedAncestor;
+		return path.resolve(resolvedAncestor, ...missingSuffix);
+	} catch {
+		return normalized;
+	}
+}
+function resolvePathViaExistingAncestorSync(targetPath) {
+	const normalized = path.resolve(targetPath);
+	let cursor = normalized;
+	const missingSuffix = [];
+	while (!isFilesystemRoot(cursor) && !fs.existsSync(cursor)) {
+		missingSuffix.unshift(path.basename(cursor));
+		const parent = path.dirname(cursor);
+		if (parent === cursor) break;
+		cursor = parent;
+	}
+	if (!fs.existsSync(cursor)) return normalized;
+	try {
+		const resolvedAncestor = path.resolve(fs.realpathSync(cursor));
+		if (missingSuffix.length === 0) return resolvedAncestor;
+		return path.resolve(resolvedAncestor, ...missingSuffix);
+	} catch {
+		return normalized;
+	}
+}
+async function getPathKind(absolutePath, preserveFinalSymlink) {
+	try {
+		return {
+			exists: true,
+			kind: toResolvedKind(preserveFinalSymlink ? await fs$1.lstat(absolutePath) : await fs$1.stat(absolutePath))
+		};
+	} catch (error) {
+		if (isNotFoundPathError(error)) return {
+			exists: false,
+			kind: "missing"
+		};
+		throw error;
+	}
+}
+function getPathKindSync(absolutePath, preserveFinalSymlink) {
+	try {
+		return {
+			exists: true,
+			kind: toResolvedKind(preserveFinalSymlink ? fs.lstatSync(absolutePath) : fs.statSync(absolutePath))
+		};
+	} catch (error) {
+		if (isNotFoundPathError(error)) return {
+			exists: false,
+			kind: "missing"
+		};
+		throw error;
+	}
+}
+function toResolvedKind(stat) {
+	if (stat.isFile()) return "file";
+	if (stat.isDirectory()) return "directory";
+	if (stat.isSymbolicLink()) return "symlink";
+	return "other";
+}
+function relativeInsideRoot(rootPath, targetPath) {
+	const relative = path.relative(path.resolve(rootPath), path.resolve(targetPath));
+	if (!relative || relative === ".") return "";
+	if (relative.startsWith("..") || path.isAbsolute(relative)) return "";
+	return relative;
+}
+function assertInsideBoundary(params) {
+	if (isPathInside(params.rootCanonicalPath, params.candidatePath)) return;
+	throw new Error(`Path resolves outside ${params.boundaryLabel} (${shortPath(params.rootCanonicalPath)}): ${shortPath(params.absolutePath)}`);
+}
+function pathEscapeError(params) {
+	return /* @__PURE__ */ new Error(`Path escapes ${params.boundaryLabel} (${shortPath(params.rootPath)}): ${shortPath(params.absolutePath)}`);
+}
+function symlinkEscapeError(params) {
+	return /* @__PURE__ */ new Error(`Symlink escapes ${params.boundaryLabel} (${shortPath(params.rootCanonicalPath)}): ${shortPath(params.symlinkPath)}`);
+}
+function shortPath(value) {
+	const home = os.homedir();
+	if (value.startsWith(home)) return `~${value.slice(home.length)}`;
+	return value;
+}
+function isFilesystemRoot(candidate) {
+	return path.parse(candidate).root === candidate;
+}
+async function pathExists(targetPath) {
+	try {
+		await fs$1.lstat(targetPath);
+		return true;
+	} catch (error) {
+		if (isNotFoundPathError(error)) return false;
+		throw error;
+	}
+}
+async function resolveSymlinkHopPath(symlinkPath) {
+	try {
+		return path.resolve(await fs$1.realpath(symlinkPath));
+	} catch (error) {
+		if (!isNotFoundPathError(error)) throw error;
+		const linkTarget = await fs$1.readlink(symlinkPath);
+		return resolvePathViaExistingAncestor(path.resolve(path.dirname(symlinkPath), linkTarget));
+	}
+}
+function resolveSymlinkHopPathSync(symlinkPath) {
+	try {
+		return path.resolve(fs.realpathSync(symlinkPath));
+	} catch (error) {
+		if (!isNotFoundPathError(error)) throw error;
+		const linkTarget = fs.readlinkSync(symlinkPath);
+		return resolvePathViaExistingAncestorSync(path.resolve(path.dirname(symlinkPath), linkTarget));
+	}
+}
+
+//#endregion
+//#region src/infra/file-identity.ts
+function isZero(value) {
+	return value === 0 || value === 0n;
+}
+function sameFileIdentity$1(left, right, platform = process.platform) {
+	if (left.ino !== right.ino) return false;
+	if (left.dev === right.dev) return true;
+	return platform === "win32" && (isZero(left.dev) || isZero(right.dev));
+}
+
+//#endregion
+//#region src/infra/safe-open-sync.ts
+function isExpectedPathError(error) {
+	const code = typeof error === "object" && error !== null && "code" in error ? String(error.code) : "";
+	return code === "ENOENT" || code === "ENOTDIR" || code === "ELOOP";
+}
+function sameFileIdentity(left, right) {
+	return sameFileIdentity$1(left, right);
+}
+function openVerifiedFileSync(params) {
+	const ioFs = params.ioFs ?? fs;
+	const openReadFlags = ioFs.constants.O_RDONLY | (typeof ioFs.constants.O_NOFOLLOW === "number" ? ioFs.constants.O_NOFOLLOW : 0);
+	let fd = null;
+	try {
+		if (params.rejectPathSymlink) {
+			if (ioFs.lstatSync(params.filePath).isSymbolicLink()) return {
+				ok: false,
+				reason: "validation"
+			};
+		}
+		const realPath = params.resolvedPath ?? ioFs.realpathSync(params.filePath);
+		const preOpenStat = ioFs.lstatSync(realPath);
+		if (!preOpenStat.isFile()) return {
+			ok: false,
+			reason: "validation"
+		};
+		if (params.rejectHardlinks && preOpenStat.nlink > 1) return {
+			ok: false,
+			reason: "validation"
+		};
+		if (params.maxBytes !== void 0 && preOpenStat.size > params.maxBytes) return {
+			ok: false,
+			reason: "validation"
+		};
+		fd = ioFs.openSync(realPath, openReadFlags);
+		const openedStat = ioFs.fstatSync(fd);
+		if (!openedStat.isFile()) return {
+			ok: false,
+			reason: "validation"
+		};
+		if (params.rejectHardlinks && openedStat.nlink > 1) return {
+			ok: false,
+			reason: "validation"
+		};
+		if (params.maxBytes !== void 0 && openedStat.size > params.maxBytes) return {
+			ok: false,
+			reason: "validation"
+		};
+		if (!sameFileIdentity(preOpenStat, openedStat)) return {
+			ok: false,
+			reason: "validation"
+		};
+		const opened = {
+			ok: true,
+			path: realPath,
+			fd,
+			stat: openedStat
+		};
+		fd = null;
+		return opened;
+	} catch (error) {
+		if (isExpectedPathError(error)) return {
+			ok: false,
+			reason: "path",
+			error
+		};
+		return {
+			ok: false,
+			reason: "io",
+			error
+		};
+	} finally {
+		if (fd !== null) ioFs.closeSync(fd);
+	}
+}
+
+//#endregion
+//#region src/infra/boundary-file-read.ts
+function canUseBoundaryFileOpen(ioFs) {
+	return typeof ioFs.openSync === "function" && typeof ioFs.closeSync === "function" && typeof ioFs.fstatSync === "function" && typeof ioFs.lstatSync === "function" && typeof ioFs.realpathSync === "function" && typeof ioFs.readFileSync === "function" && typeof ioFs.constants === "object" && ioFs.constants !== null;
+}
+function openBoundaryFileSync(params) {
+	const ioFs = params.ioFs ?? fs;
+	const absolutePath = path.resolve(params.absolutePath);
+	let resolvedPath;
+	let rootRealPath;
+	try {
+		const resolved = resolveBoundaryPathSync({
+			absolutePath,
+			rootPath: params.rootPath,
+			rootCanonicalPath: params.rootRealPath,
+			boundaryLabel: params.boundaryLabel,
+			skipLexicalRootCheck: params.skipLexicalRootCheck
+		});
+		resolvedPath = resolved.canonicalPath;
+		rootRealPath = resolved.rootCanonicalPath;
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "validation",
+			error
+		};
+	}
+	const opened = openVerifiedFileSync({
+		filePath: absolutePath,
+		resolvedPath,
+		rejectHardlinks: params.rejectHardlinks ?? true,
+		maxBytes: params.maxBytes,
+		ioFs
+	});
+	if (!opened.ok) return opened;
+	return {
+		ok: true,
+		path: opened.path,
+		fd: opened.fd,
+		stat: opened.stat,
+		rootRealPath
+	};
+}
+async function openBoundaryFile(params) {
+	try {
+		await resolveBoundaryPath({
+			absolutePath: params.absolutePath,
+			rootPath: params.rootPath,
+			rootCanonicalPath: params.rootRealPath,
+			boundaryLabel: params.boundaryLabel,
+			policy: params.aliasPolicy,
+			skipLexicalRootCheck: params.skipLexicalRootCheck
+		});
+	} catch (error) {
+		return {
+			ok: false,
+			reason: "validation",
+			error
+		};
+	}
+	return openBoundaryFileSync(params);
+}
+
+//#endregion
+//#region src/infra/fased-root.ts
+const CORE_PACKAGE_NAMES = new Set(["fased", "@fased/fased"]);
+async function readPackageName(dir) {
+	try {
+		const raw = await fs$1.readFile(path.join(dir, "package.json"), "utf-8");
+		const parsed = JSON.parse(raw);
+		return typeof parsed.name === "string" ? parsed.name : null;
+	} catch {
+		return null;
+	}
+}
+function readPackageNameSync(dir) {
+	try {
+		const raw = fs.readFileSync(path.join(dir, "package.json"), "utf-8");
+		const parsed = JSON.parse(raw);
+		return typeof parsed.name === "string" ? parsed.name : null;
+	} catch {
+		return null;
+	}
+}
+async function findPackageRoot(startDir, maxDepth = 12) {
+	for (const current of iterAncestorDirs(startDir, maxDepth)) {
+		const name = await readPackageName(current);
+		if (name && CORE_PACKAGE_NAMES.has(name)) return current;
+	}
+	return null;
+}
+function findPackageRootSync(startDir, maxDepth = 12) {
+	for (const current of iterAncestorDirs(startDir, maxDepth)) {
+		const name = readPackageNameSync(current);
+		if (name && CORE_PACKAGE_NAMES.has(name)) return current;
+	}
+	return null;
+}
+function* iterAncestorDirs(startDir, maxDepth) {
+	let current = path.resolve(startDir);
+	for (let i = 0; i < maxDepth; i += 1) {
+		yield current;
+		const parent = path.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+}
+function candidateDirsFromArgv1(argv1) {
+	const normalized = path.resolve(argv1);
+	const candidates = [path.dirname(normalized)];
+	try {
+		const resolved = fs.realpathSync(normalized);
+		if (resolved !== normalized) candidates.push(path.dirname(resolved));
+	} catch {}
+	const parts = normalized.split(path.sep);
+	const binIndex = parts.lastIndexOf(".bin");
+	if (binIndex > 0 && parts[binIndex - 1] === "node_modules") {
+		const binName = path.basename(normalized);
+		const nodeModulesDir = parts.slice(0, binIndex).join(path.sep);
+		candidates.push(path.join(nodeModulesDir, binName));
+	}
+	return candidates;
+}
+async function resolveFasedAgentPackageRoot(opts) {
+	for (const candidate of buildCandidates(opts)) {
+		const found = await findPackageRoot(candidate);
+		if (found) return found;
+	}
+	return null;
+}
+function resolveFasedAgentPackageRootSync(opts) {
+	for (const candidate of buildCandidates(opts)) {
+		const found = findPackageRootSync(candidate);
+		if (found) return found;
+	}
+	return null;
+}
+function buildCandidates(opts) {
+	const candidates = [];
+	if (opts.moduleUrl) candidates.push(path.dirname(fileURLToPath(opts.moduleUrl)));
+	if (opts.argv1) candidates.push(...candidateDirsFromArgv1(opts.argv1));
+	if (opts.cwd) candidates.push(opts.cwd);
+	return candidates;
+}
+
+//#endregion
+//#region src/agents/workspace-templates.ts
+const FALLBACK_TEMPLATE_DIR = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../docs/reference/templates");
+let cachedTemplateDir;
+let resolvingTemplateDir;
+async function resolveWorkspaceTemplateDir(opts) {
+	if (cachedTemplateDir) return cachedTemplateDir;
+	if (resolvingTemplateDir) return resolvingTemplateDir;
+	resolvingTemplateDir = (async () => {
+		const moduleUrl = opts?.moduleUrl ?? import.meta.url;
+		const argv1 = opts?.argv1 ?? process.argv[1];
+		const cwd = opts?.cwd ?? process.cwd();
+		const packageRoot = await resolveFasedAgentPackageRoot({
+			moduleUrl,
+			argv1,
+			cwd
+		});
+		const candidates = [
+			packageRoot ? path.join(packageRoot, "docs", "reference", "templates") : null,
+			cwd ? path.resolve(cwd, "docs", "reference", "templates") : null,
+			FALLBACK_TEMPLATE_DIR
+		].filter(Boolean);
+		for (const candidate of candidates) if (await pathExists$1(candidate)) {
+			cachedTemplateDir = candidate;
+			return candidate;
+		}
+		cachedTemplateDir = candidates[0] ?? FALLBACK_TEMPLATE_DIR;
+		return cachedTemplateDir;
+	})();
+	try {
+		return await resolvingTemplateDir;
+	} finally {
+		resolvingTemplateDir = void 0;
+	}
+}
+
+//#endregion
+//#region src/agents/workspace.ts
+function resolveDefaultAgentWorkspaceDir(env = process.env, homedir = os.homedir) {
+	const home = resolveRequiredHomeDir(env, homedir);
+	const profile = env.FASED_PROFILE?.trim();
+	if (profile && profile.toLowerCase() !== "default") return path.join(home, ".fased", `workspace-${profile}`);
+	return path.join(home, ".fased", "workspace");
+}
+const DEFAULT_AGENT_WORKSPACE_DIR = resolveDefaultAgentWorkspaceDir();
+const DEFAULT_AGENTS_FILENAME = "AGENTS.md";
+const DEFAULT_SOUL_FILENAME = "SOUL.md";
+const DEFAULT_TOOLS_FILENAME = "TOOLS.md";
+const DEFAULT_IDENTITY_FILENAME = "IDENTITY.md";
+const DEFAULT_USER_FILENAME = "USER.md";
+const DEFAULT_HEARTBEAT_FILENAME = "HEARTBEAT.md";
+const DEFAULT_BOOTSTRAP_FILENAME = "BOOTSTRAP.md";
+const DEFAULT_MEMORY_FILENAME = "MEMORY.md";
+const DEFAULT_MEMORY_ALT_FILENAME = "memory.md";
+const WORKSPACE_STATE_DIRNAME = ".fased";
+const WORKSPACE_STATE_FILENAME = "workspace-state.json";
+const WORKSPACE_STATE_VERSION = 1;
+const DEFAULT_MEMORY_CONTENT = "# Memory\n\n";
+const workspaceTemplateCache = /* @__PURE__ */ new Map();
+let gitAvailabilityPromise = null;
+const MAX_WORKSPACE_BOOTSTRAP_FILE_BYTES = 2 * 1024 * 1024;
+const BUILTIN_WORKSPACE_TEMPLATES = {
+	[DEFAULT_AGENTS_FILENAME]: `# AGENTS.md
+
+This workspace belongs to a Fased Agent. Keep durable operating notes here.
+`,
+	[DEFAULT_SOUL_FILENAME]: `# SOUL.md
+
+Use this file for durable tone and behavior preferences. Do not store secrets.
+`,
+	[DEFAULT_TOOLS_FILENAME]: `# TOOLS.md
+
+Use this file for workspace-specific tool notes, limits, and preferences. Do not store secrets.
+`,
+	[DEFAULT_IDENTITY_FILENAME]: `# IDENTITY.md - Agent Identity
+
+- **Name:**
+- **Theme:**
+- **Emoji:**
+- **Avatar:**
+`,
+	[DEFAULT_USER_FILENAME]: `# USER.md - User Profile
+
+- **Name:**
+- **Preferred address:**
+- **Pronouns:** _(optional)_
+- **Timezone:**
+- **Notes:**
+
+## Preferences
+
+Add durable preferences here. Do not store secrets.
+`,
+	[DEFAULT_HEARTBEAT_FILENAME]: `# HEARTBEAT.md
+
+# Keep this file empty, or with comments only, to skip heartbeat work.
+`,
+	[DEFAULT_BOOTSTRAP_FILENAME]: `# BOOTSTRAP.md - First Run
+
+Use this file while the workspace is new. Ask what to call the user, what to call the agent, and what tone the user wants. Update IDENTITY.md, USER.md, and SOUL.md, then delete BOOTSTRAP.md.
+`
+};
+const workspaceFileCache = /* @__PURE__ */ new Map();
+function workspaceFileIdentity(stat, canonicalPath) {
+	return `${canonicalPath}|${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeMs}`;
+}
+async function readWorkspaceFileWithGuards(params) {
+	const opened = await openBoundaryFile({
+		absolutePath: params.filePath,
+		rootPath: params.workspaceDir,
+		boundaryLabel: "workspace root",
+		maxBytes: MAX_WORKSPACE_BOOTSTRAP_FILE_BYTES
+	});
+	if (!opened.ok) {
+		workspaceFileCache.delete(params.filePath);
+		return opened;
+	}
+	const identity = workspaceFileIdentity(opened.stat, opened.path);
+	const cached = workspaceFileCache.get(params.filePath);
+	if (cached && cached.identity === identity) {
+		fs.closeSync(opened.fd);
+		return {
+			ok: true,
+			content: cached.content
+		};
+	}
+	try {
+		const content = fs.readFileSync(opened.fd, "utf-8");
+		workspaceFileCache.set(params.filePath, {
+			content,
+			identity
+		});
+		return {
+			ok: true,
+			content
+		};
+	} catch (error) {
+		workspaceFileCache.delete(params.filePath);
+		return {
+			ok: false,
+			reason: "io",
+			error
+		};
+	} finally {
+		fs.closeSync(opened.fd);
+	}
+}
+function stripFrontMatter(content) {
+	if (!content.startsWith("---")) return content;
+	const endIndex = content.indexOf("\n---", 3);
+	if (endIndex === -1) return content;
+	const start = endIndex + 4;
+	let trimmed = content.slice(start);
+	trimmed = trimmed.replace(/^\s+/, "");
+	return trimmed;
+}
+async function loadTemplate(name) {
+	const cached = workspaceTemplateCache.get(name);
+	if (cached) return cached;
+	const pending = (async () => {
+		const templateDir = await resolveWorkspaceTemplateDir();
+		const templatePath = path.join(templateDir, name);
+		try {
+			return stripFrontMatter(await fs$1.readFile(templatePath, "utf-8"));
+		} catch {
+			const fallback = BUILTIN_WORKSPACE_TEMPLATES[name];
+			if (fallback) return fallback;
+			throw new Error(`Missing workspace template: ${name} (${templatePath}). Ensure docs/reference/templates are packaged.`);
+		}
+	})();
+	workspaceTemplateCache.set(name, pending);
+	try {
+		return await pending;
+	} catch (error) {
+		workspaceTemplateCache.delete(name);
+		throw error;
+	}
+}
+async function writeFileIfMissing(filePath, content) {
+	try {
+		await fs$1.writeFile(filePath, content, {
+			encoding: "utf-8",
+			flag: "wx"
+		});
+		return true;
+	} catch (err) {
+		if (err.code !== "EEXIST") throw err;
+		return false;
+	}
+}
+async function fileExists(filePath) {
+	try {
+		await fs$1.access(filePath);
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function ensureMemoryRoots(dir) {
+	await fs$1.mkdir(path.join(dir, "memory"), { recursive: true });
+	await writeFileIfMissing(path.join(dir, DEFAULT_MEMORY_FILENAME), DEFAULT_MEMORY_CONTENT);
+}
+function resolveWorkspaceStatePath(dir) {
+	return path.join(dir, WORKSPACE_STATE_DIRNAME, WORKSPACE_STATE_FILENAME);
+}
+function parseWorkspaceOnboardingState(raw) {
+	try {
+		const parsed = JSON.parse(raw);
+		if (!parsed || typeof parsed !== "object") return null;
+		return {
+			version: WORKSPACE_STATE_VERSION,
+			bootstrapSeededAt: typeof parsed.bootstrapSeededAt === "string" ? parsed.bootstrapSeededAt : void 0,
+			onboardingCompletedAt: typeof parsed.onboardingCompletedAt === "string" ? parsed.onboardingCompletedAt : void 0
+		};
+	} catch {
+		return null;
+	}
+}
+async function readWorkspaceOnboardingState(statePath) {
+	try {
+		return parseWorkspaceOnboardingState(await fs$1.readFile(statePath, "utf-8")) ?? { version: WORKSPACE_STATE_VERSION };
+	} catch (err) {
+		if (err.code !== "ENOENT") throw err;
+		return { version: WORKSPACE_STATE_VERSION };
+	}
+}
+async function writeWorkspaceOnboardingState(statePath, state) {
+	await fs$1.mkdir(path.dirname(statePath), { recursive: true });
+	const payload = `${JSON.stringify(state, null, 2)}\n`;
+	const tmpPath = `${statePath}.tmp-${process.pid}-${Date.now().toString(36)}`;
+	try {
+		await fs$1.writeFile(tmpPath, payload, { encoding: "utf-8" });
+		await fs$1.rename(tmpPath, statePath);
+	} catch (err) {
+		await fs$1.unlink(tmpPath).catch(() => {});
+		throw err;
+	}
+}
+async function hasGitRepo(dir) {
+	try {
+		await fs$1.stat(path.join(dir, ".git"));
+		return true;
+	} catch {
+		return false;
+	}
+}
+async function isGitAvailable() {
+	if (gitAvailabilityPromise) return gitAvailabilityPromise;
+	gitAvailabilityPromise = (async () => {
+		try {
+			return (await runCommandWithTimeout(["git", "--version"], { timeoutMs: 2e3 })).code === 0;
+		} catch {
+			return false;
+		}
+	})();
+	return gitAvailabilityPromise;
+}
+async function ensureGitRepo(dir, isBrandNewWorkspace) {
+	if (!isBrandNewWorkspace) return;
+	if (await hasGitRepo(dir)) return;
+	if (!await isGitAvailable()) return;
+	try {
+		await runCommandWithTimeout(["git", "init"], {
+			cwd: dir,
+			timeoutMs: 1e4
+		});
+	} catch {}
+}
+async function ensureAgentWorkspace(params) {
+	const dir = resolveUserPath(params?.dir?.trim() ? params.dir.trim() : DEFAULT_AGENT_WORKSPACE_DIR);
+	await fs$1.mkdir(dir, { recursive: true });
+	if (!params?.ensureBootstrapFiles) return { dir };
+	const agentsPath = path.join(dir, DEFAULT_AGENTS_FILENAME);
+	const soulPath = path.join(dir, DEFAULT_SOUL_FILENAME);
+	const toolsPath = path.join(dir, DEFAULT_TOOLS_FILENAME);
+	const identityPath = path.join(dir, DEFAULT_IDENTITY_FILENAME);
+	const userPath = path.join(dir, DEFAULT_USER_FILENAME);
+	const heartbeatPath = path.join(dir, DEFAULT_HEARTBEAT_FILENAME);
+	const bootstrapPath = path.join(dir, DEFAULT_BOOTSTRAP_FILENAME);
+	const statePath = resolveWorkspaceStatePath(dir);
+	const isBrandNewWorkspace = await (async () => {
+		const templatePaths = [
+			agentsPath,
+			soulPath,
+			toolsPath,
+			identityPath,
+			userPath,
+			heartbeatPath
+		];
+		const userContentPaths = [
+			path.join(dir, "memory"),
+			path.join(dir, DEFAULT_MEMORY_FILENAME),
+			path.join(dir, ".git")
+		];
+		const paths = [...templatePaths, ...userContentPaths];
+		return (await Promise.all(paths.map(async (p) => {
+			try {
+				await fs$1.access(p);
+				return true;
+			} catch {
+				return false;
+			}
+		}))).every((v) => !v);
+	})();
+	const agentsTemplate = await loadTemplate(DEFAULT_AGENTS_FILENAME);
+	const soulTemplate = await loadTemplate(DEFAULT_SOUL_FILENAME);
+	const toolsTemplate = await loadTemplate(DEFAULT_TOOLS_FILENAME);
+	const identityTemplate = await loadTemplate(DEFAULT_IDENTITY_FILENAME);
+	const userTemplate = await loadTemplate(DEFAULT_USER_FILENAME);
+	const heartbeatTemplate = await loadTemplate(DEFAULT_HEARTBEAT_FILENAME);
+	await writeFileIfMissing(agentsPath, agentsTemplate);
+	await writeFileIfMissing(soulPath, soulTemplate);
+	await writeFileIfMissing(toolsPath, toolsTemplate);
+	await writeFileIfMissing(identityPath, identityTemplate);
+	await writeFileIfMissing(userPath, userTemplate);
+	await writeFileIfMissing(heartbeatPath, heartbeatTemplate);
+	let state = await readWorkspaceOnboardingState(statePath);
+	let stateDirty = false;
+	const markState = (next) => {
+		state = {
+			...state,
+			...next
+		};
+		stateDirty = true;
+	};
+	const nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+	let bootstrapExists = await fileExists(bootstrapPath);
+	if (!state.bootstrapSeededAt && bootstrapExists) markState({ bootstrapSeededAt: nowIso() });
+	if (!state.onboardingCompletedAt && state.bootstrapSeededAt && !bootstrapExists) markState({ onboardingCompletedAt: nowIso() });
+	if (!state.bootstrapSeededAt && !state.onboardingCompletedAt && !bootstrapExists) {
+		const [identityContent, userContent] = await Promise.all([fs$1.readFile(identityPath, "utf-8"), fs$1.readFile(userPath, "utf-8")]);
+		const hasUserContent = await (async () => {
+			const indicators = [
+				path.join(dir, "memory"),
+				path.join(dir, DEFAULT_MEMORY_FILENAME),
+				path.join(dir, ".git")
+			];
+			for (const indicator of indicators) try {
+				await fs$1.access(indicator);
+				return true;
+			} catch {}
+			return false;
+		})();
+		if (identityContent !== identityTemplate || userContent !== userTemplate || hasUserContent) markState({ onboardingCompletedAt: nowIso() });
+		else {
+			if (!await writeFileIfMissing(bootstrapPath, await loadTemplate(DEFAULT_BOOTSTRAP_FILENAME))) bootstrapExists = await fileExists(bootstrapPath);
+			else bootstrapExists = true;
+			if (bootstrapExists && !state.bootstrapSeededAt) markState({ bootstrapSeededAt: nowIso() });
+		}
+	}
+	if (stateDirty) await writeWorkspaceOnboardingState(statePath, state);
+	await ensureMemoryRoots(dir);
+	await ensureGitRepo(dir, isBrandNewWorkspace);
+	return {
+		dir,
+		agentsPath,
+		soulPath,
+		toolsPath,
+		identityPath,
+		userPath,
+		heartbeatPath,
+		bootstrapPath
+	};
+}
+async function resolveMemoryBootstrapEntries(resolvedDir) {
+	const candidates = [DEFAULT_MEMORY_FILENAME, DEFAULT_MEMORY_ALT_FILENAME];
+	const entries = [];
+	for (const name of candidates) {
+		const filePath = path.join(resolvedDir, name);
+		try {
+			await fs$1.access(filePath);
+			entries.push({
+				name,
+				filePath
+			});
+		} catch {}
+	}
+	if (entries.length <= 1) return entries;
+	const seen = /* @__PURE__ */ new Set();
+	const deduped = [];
+	for (const entry of entries) {
+		let key = entry.filePath;
+		try {
+			key = await fs$1.realpath(entry.filePath);
+		} catch {}
+		if (seen.has(key)) continue;
+		seen.add(key);
+		deduped.push(entry);
+	}
+	return deduped;
+}
+async function loadWorkspaceBootstrapFiles(dir) {
+	const resolvedDir = resolveUserPath(dir);
+	const entries = [
+		{
+			name: DEFAULT_AGENTS_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_AGENTS_FILENAME)
+		},
+		{
+			name: DEFAULT_SOUL_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_SOUL_FILENAME)
+		},
+		{
+			name: DEFAULT_TOOLS_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_TOOLS_FILENAME)
+		},
+		{
+			name: DEFAULT_IDENTITY_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_IDENTITY_FILENAME)
+		},
+		{
+			name: DEFAULT_USER_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_USER_FILENAME)
+		},
+		{
+			name: DEFAULT_HEARTBEAT_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_HEARTBEAT_FILENAME)
+		},
+		{
+			name: DEFAULT_BOOTSTRAP_FILENAME,
+			filePath: path.join(resolvedDir, DEFAULT_BOOTSTRAP_FILENAME)
+		}
+	];
+	entries.push(...await resolveMemoryBootstrapEntries(resolvedDir));
+	const result = [];
+	for (const entry of entries) {
+		const loaded = await readWorkspaceFileWithGuards({
+			filePath: entry.filePath,
+			workspaceDir: resolvedDir
+		});
+		if (loaded.ok) result.push({
+			name: entry.name,
+			path: entry.filePath,
+			content: loaded.content,
+			missing: false
+		});
+		else result.push({
+			name: entry.name,
+			path: entry.filePath,
+			missing: true
+		});
+	}
+	return result;
+}
+const MINIMAL_BOOTSTRAP_ALLOWLIST = new Set([
+	DEFAULT_AGENTS_FILENAME,
+	DEFAULT_TOOLS_FILENAME,
+	DEFAULT_SOUL_FILENAME,
+	DEFAULT_IDENTITY_FILENAME,
+	DEFAULT_USER_FILENAME
+]);
+function filterBootstrapFilesForSession(files, sessionKey) {
+	if (!sessionKey || !isSubagentSessionKey(sessionKey) && !isCronSessionKey(sessionKey)) return files;
+	return files.filter((file) => MINIMAL_BOOTSTRAP_ALLOWLIST.has(file.name));
+}
+
+//#endregion
+//#region src/agents/agent-scope.ts
+let log = null;
+function getLog() {
+	log ??= createSubsystemLogger("agent-scope");
+	return log;
+}
+/** Strip null bytes from paths to prevent ENOTDIR errors. */
+function stripNullBytes(s) {
+	return s.replace(/\0/g, "");
+}
+let defaultAgentWarned = false;
+function listAgentEntries(cfg) {
+	const list = cfg.agents?.list;
+	if (!Array.isArray(list)) return [];
+	return list.filter((entry) => Boolean(entry && typeof entry === "object"));
+}
+function listAgentIds(cfg) {
+	const agents = listAgentEntries(cfg);
+	if (agents.length === 0) return [DEFAULT_AGENT_ID];
+	const seen = /* @__PURE__ */ new Set();
+	const ids = [];
+	for (const entry of agents) {
+		const id = normalizeAgentId(entry?.id);
+		if (seen.has(id)) continue;
+		seen.add(id);
+		ids.push(id);
+	}
+	return ids.length > 0 ? ids : [DEFAULT_AGENT_ID];
+}
+function resolveDefaultAgentId(cfg) {
+	const agents = listAgentEntries(cfg);
+	if (agents.length === 0) return DEFAULT_AGENT_ID;
+	const defaults = agents.filter((agent) => agent?.default);
+	if (defaults.length > 1 && !defaultAgentWarned) {
+		defaultAgentWarned = true;
+		getLog().warn("Multiple agents marked default=true; using the first entry as default.");
+	}
+	const chosen = (defaults[0] ?? agents[0])?.id?.trim();
+	return normalizeAgentId(chosen || DEFAULT_AGENT_ID);
+}
+function resolveSessionAgentIds(params) {
+	const defaultAgentId = resolveDefaultAgentId(params.config ?? {});
+	const explicitAgentIdRaw = typeof params.agentId === "string" ? params.agentId.trim().toLowerCase() : "";
+	const explicitAgentId = explicitAgentIdRaw ? normalizeAgentId(explicitAgentIdRaw) : null;
+	const sessionKey = params.sessionKey?.trim();
+	const normalizedSessionKey = sessionKey ? sessionKey.toLowerCase() : void 0;
+	const parsed = normalizedSessionKey ? parseAgentSessionKey(normalizedSessionKey) : null;
+	return {
+		defaultAgentId,
+		sessionAgentId: explicitAgentId ?? (parsed?.agentId ? normalizeAgentId(parsed.agentId) : defaultAgentId)
+	};
+}
+function resolveSessionAgentId(params) {
+	return resolveSessionAgentIds(params).sessionAgentId;
+}
+function resolveAgentEntry(cfg, agentId) {
+	const id = normalizeAgentId(agentId);
+	return listAgentEntries(cfg).find((entry) => normalizeAgentId(entry.id) === id);
+}
+function resolveAgentConfig(cfg, agentId) {
+	const entry = resolveAgentEntry(cfg, normalizeAgentId(agentId));
+	if (!entry) return;
+	return {
+		name: typeof entry.name === "string" ? entry.name : void 0,
+		workspace: typeof entry.workspace === "string" ? entry.workspace : void 0,
+		agentDir: typeof entry.agentDir === "string" ? entry.agentDir : void 0,
+		activeModelProvider: typeof entry.activeModelProvider === "string" ? entry.activeModelProvider : void 0,
+		modelProviders: entry.modelProviders && typeof entry.modelProviders === "object" ? entry.modelProviders : void 0,
+		model: typeof entry.model === "string" || entry.model && typeof entry.model === "object" ? entry.model : void 0,
+		taskModels: entry.taskModels && typeof entry.taskModels === "object" ? entry.taskModels : void 0,
+		thinkingDefault: entry.thinkingDefault,
+		verboseDefault: cfg.agents?.defaults?.verboseDefault,
+		reasoningDefault: entry.reasoningDefault,
+		fastModeDefault: entry.fastModeDefault,
+		skills: Array.isArray(entry.skills) ? entry.skills : void 0,
+		memorySearch: entry.memorySearch,
+		humanDelay: entry.humanDelay,
+		heartbeat: entry.heartbeat,
+		identity: entry.identity,
+		groupChat: entry.groupChat,
+		subagents: typeof entry.subagents === "object" && entry.subagents ? entry.subagents : void 0,
+		sandbox: entry.sandbox,
+		tools: entry.tools
+	};
+}
+function resolveAgentSkillsFilter(cfg, agentId) {
+	return resolveEffectiveAgentSkillFilter(cfg, agentId);
+}
+function resolveModelPrimary(raw) {
+	if (typeof raw === "string") return raw.trim() || void 0;
+	if (!raw || typeof raw !== "object") return;
+	const primary = raw.primary;
+	if (typeof primary !== "string") return;
+	return primary.trim() || void 0;
+}
+function normalizeModelProviderId(providerId) {
+	if (typeof providerId !== "string") return;
+	return providerId.trim().toLowerCase() || void 0;
+}
+function modelProviderFromRef(value) {
+	const trimmed = value?.trim();
+	if (!trimmed) return;
+	const index = trimmed.indexOf("/");
+	return index > 0 ? normalizeModelProviderId(trimmed.slice(0, index)) : void 0;
+}
+function resolveEntryActiveModelProvider(entry) {
+	const providers = entry?.modelProviders && typeof entry.modelProviders === "object" ? entry.modelProviders : {};
+	const active = normalizeModelProviderId(entry?.activeModelProvider);
+	if (active) return active;
+	const legacyProvider = modelProviderFromRef(resolveModelPrimary(entry?.model));
+	if (legacyProvider) return legacyProvider;
+	return Object.keys(providers)[0];
+}
+function resolveProviderScopedPrimary(entry) {
+	const providerId = resolveEntryActiveModelProvider(entry);
+	if (!providerId || !entry?.modelProviders) return;
+	const direct = entry.modelProviders[providerId]?.primary?.trim();
+	if (direct) return direct;
+	return (Object.entries(entry.modelProviders).find(([key]) => normalizeModelProviderId(key) === providerId)?.[1])?.primary?.trim() || void 0;
+}
+function resolveAgentExplicitModelPrimary(cfg, agentId) {
+	const entry = resolveAgentConfig(cfg, agentId);
+	return resolveModelPrimary(entry?.model) ?? resolveProviderScopedPrimary(entry);
+}
+function resolveAgentEffectiveModelPrimary(cfg, agentId) {
+	return resolveAgentExplicitModelPrimary(cfg, agentId) ?? resolveModelPrimary(cfg.agents?.defaults?.model);
+}
+function resolveAgentModelFallbacksOverride(cfg, agentId) {
+	const entry = resolveAgentConfig(cfg, agentId);
+	const raw = entry?.model;
+	if (typeof raw === "string") return;
+	if (raw && typeof raw === "object" && Object.hasOwn(raw, "fallbacks")) return normalizeAgentModelFallbackValues(raw.fallbacks);
+	if (raw && typeof raw === "object") return;
+	const providerId = resolveEntryActiveModelProvider(entry);
+	const providerConfig = providerId ? entry?.modelProviders?.[providerId] : void 0;
+	if (providerConfig && Object.hasOwn(providerConfig, "fallbacks")) return normalizeAgentModelFallbackValues(providerConfig.fallbacks);
+}
+function resolveFallbackAgentId(params) {
+	const explicitAgentId = typeof params.agentId === "string" ? params.agentId.trim() : "";
+	if (explicitAgentId) return normalizeAgentId(explicitAgentId);
+	return resolveAgentIdFromSessionKey(params.sessionKey);
+}
+function resolveRunModelFallbacksOverride(params) {
+	if (!params.cfg) return;
+	return resolveAgentModelFallbacksOverride(params.cfg, resolveFallbackAgentId({
+		agentId: params.agentId,
+		sessionKey: params.sessionKey
+	}));
+}
+function hasConfiguredModelFallbacks(params) {
+	const fallbacksOverride = resolveRunModelFallbacksOverride(params);
+	const defaultFallbacks = resolveAgentModelFallbackValues(params.cfg?.agents?.defaults?.model);
+	return (fallbacksOverride ?? defaultFallbacks).length > 0;
+}
+function resolveEffectiveModelFallbacks(params) {
+	const agentFallbacksOverride = resolveAgentModelFallbacksOverride(params.cfg, params.agentId);
+	if (!params.hasSessionModelOverride) return agentFallbacksOverride;
+	const defaultFallbacks = resolveAgentModelFallbackValues(params.cfg.agents?.defaults?.model);
+	return agentFallbacksOverride ?? defaultFallbacks;
+}
+function resolveAgentWorkspaceDir(cfg, agentId) {
+	const id = normalizeAgentId(agentId);
+	const configured = resolveAgentConfig(cfg, id)?.workspace?.trim();
+	if (configured) return stripNullBytes(resolveUserPath(configured));
+	const defaultAgentId = resolveDefaultAgentId(cfg);
+	const fallback = cfg.agents?.defaults?.workspace?.trim();
+	if (id === defaultAgentId) {
+		if (fallback) return stripNullBytes(resolveUserPath(fallback));
+		return stripNullBytes(resolveDefaultAgentWorkspaceDir(process.env));
+	}
+	if (fallback) return stripNullBytes(path.join(resolveUserPath(fallback), id));
+	const stateDir = resolveStateDir(process.env);
+	return stripNullBytes(path.join(stateDir, `workspace-${id}`));
+}
+function resolveAgentDir(cfg, agentId, env = process.env) {
+	const id = normalizeAgentId(agentId);
+	const configured = resolveAgentConfig(cfg, id)?.agentDir?.trim();
+	if (configured) return resolveUserPath(configured, env);
+	const root = resolveStateDir(env);
+	return path.join(root, "agents", id, "agent");
+}
+
+//#endregion
+export { openBoundaryFileSync as A, MAX_AGENT_MODEL_FALLBACKS as B, ensureAgentWorkspace as C, resolveFasedAgentPackageRootSync as D, resolveFasedAgentPackageRoot as E, isNotFoundPathError as F, normalizeHyphenSlug as G, resolveAgentModelPrimaryValue as H, isPathInside as I, normalizeStringEntries as K, isSymlinkOpenError as L, BOUNDARY_PATH_ALIAS_POLICIES as M, resolveBoundaryPath as N, canUseBoundaryFileOpen as O, resolvePathViaExistingAncestorSync as P, resolveEffectiveAgentSkillFilter as R, DEFAULT_USER_FILENAME as S, loadWorkspaceBootstrapFiles as T, toAgentModelListLike as U, resolveAgentModelFallbackValues as V, normalizeAtHashSlug as W, DEFAULT_BOOTSTRAP_FILENAME as _, resolveAgentDir as a, DEFAULT_SOUL_FILENAME as b, resolveAgentSkillsFilter as c, resolveEffectiveModelFallbacks as d, resolveRunModelFallbacksOverride as f, DEFAULT_AGENT_WORKSPACE_DIR as g, DEFAULT_AGENTS_FILENAME as h, resolveAgentConfig as i, sameFileIdentity$1 as j, openBoundaryFile as k, resolveAgentWorkspaceDir as l, resolveSessionAgentIds as m, listAgentEntries as n, resolveAgentEffectiveModelPrimary as o, resolveSessionAgentId as p, normalizeStringEntriesLower as q, listAgentIds as r, resolveAgentModelFallbacksOverride as s, hasConfiguredModelFallbacks as t, resolveDefaultAgentId as u, DEFAULT_HEARTBEAT_FILENAME as v, filterBootstrapFilesForSession as w, DEFAULT_TOOLS_FILENAME as x, DEFAULT_IDENTITY_FILENAME as y, normalizeSkillFilter as z };