@finalai/final-agent-provider 0.10.1 → 0.11.0

package/dist/modules/runtime/remote-host.mjs

@@ -1,387 +0,0 @@
-import { RequestError } from "@agentclientprotocol/sdk/experimental/v2";
-import {
-  AcpTransport,
-  BaseCapability,
-  BaseToolProvision,
-  CredentialDelivery,
-  CredentialRoute,
-  formatProviderRef,
-  harnessDescriptionSchema,
-  InferenceCredentialKind,
-  InstructionRole,
-  packageRef,
-  SandboxWire
-} from "@finalai/agent-provider";
-import { createNodeClientTlsFetch } from "@finalai/websockets/node-client-tls";
-import { createHmac } from "node:crypto";
-import * as z from "zod";
-import { toJsonObject } from "../harnesses/config-fields.mjs";
-import {
-  resolveRemoteClientTls
-} from "../harnesses/remote-client-tls.mjs";
-const unavailableSchema = z.object({
-  code: z.literal("harness_unavailable"),
-  executable: z.string(),
-  foundVersion: z.string().nullable(),
-  requiredVersion: z.string(),
-  detail: z.string()
-});
-const unavailableOf = (text) => {
-  try {
-    return unavailableSchema.safeParse(JSON.parse(text)).data ?? null;
-  } catch {
-    return null;
-  }
-};
-const DEFAULT_HEALTH_TIMEOUT_MS = 5e3;
-const DEFAULT_REGISTER_TIMEOUT_MS = 1e4;
-const DEFAULT_CLOSE_TIMEOUT_MS = 15e3;
-const PROGRAM_CONFIG_HEADER = "x-final-program-config";
-const HEALTH_TOKEN_HEADER = "x-final-health-token";
-const CLOSE_TOKEN_HEADER = "x-final-close-token";
-const healthTokenFor = (args) => createHmac("sha256", args.hop).update(`final-harness-health:${args.id}`).digest("base64url");
-const closeTokenFor = (args) => createHmac("sha256", args.hop).update(`final-harness-close:${args.id}`).digest("base64url");
-const PROGRAM_CONFIGS_PATH = "/v1/program-configs/";
-var RemoteProgram = /* @__PURE__ */ ((RemoteProgram2) => {
-  RemoteProgram2["ClaudeCode"] = "claude-code";
-  RemoteProgram2["Codex"] = "codex";
-  RemoteProgram2["Pi"] = "pi";
-  return RemoteProgram2;
-})(RemoteProgram || {});
-const formatRemoteRef = (args) => args.closeToken != null && args.healthToken != null ? `${args.id}|${args.healthToken}|${args.closeToken}|${args.url}` : args.healthToken == null ? `${args.id}|${args.url}` : `${args.id}|${args.healthToken}|${args.url}`;
-const HEALTH_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;
-const parseRemoteRef = (ref) => {
-  const bar = ref.indexOf("|");
-  if (bar < 0) return { id: ref, url: null, healthToken: null, closeToken: null };
-  const id = ref.slice(0, bar);
-  const rest = ref.slice(bar + 1);
-  const next = rest.indexOf("|");
-  const token = next < 0 ? null : rest.slice(0, next);
-  if (token == null || !HEALTH_TOKEN_PATTERN.test(token))
-    return { id, url: rest, healthToken: null, closeToken: null };
-  const remaining = rest.slice(next + 1);
-  const separator = remaining.indexOf("|");
-  const closeToken = separator < 0 ? null : remaining.slice(0, separator);
-  return closeToken != null && HEALTH_TOKEN_PATTERN.test(closeToken) ? { id, url: remaining.slice(separator + 1), healthToken: token, closeToken } : { id, url: remaining, healthToken: token, closeToken: null };
-};
-const transportForUrl = (url) => /^wss?:\/\//.test(url) ? AcpTransport.Ws : AcpTransport.Http;
-const httpUrlOf = (url) => url.replace(/^ws(s?):\/\//, (_match, secure) => `http${secure}://`);
-const runtimeUrlFor = (args) => {
-  const endpoint = new URL(httpUrlOf(args.url));
-  if (endpoint.pathname !== "/") endpoint.pathname = endpoint.pathname.replace(/\/+$/, "");
-  return new URL(args.path.replace(/^\/+/, ""), endpoint).toString();
-};
-const healthUrlFor = (url) => runtimeUrlFor({ url, path: "healthz" });
-const programConfigUrlFor = (args) => runtimeUrlFor({ url: args.url, path: `${PROGRAM_CONFIGS_PATH}${encodeURIComponent(args.id)}` });
-const resolveSecretRef = async (args) => {
-  const value = await args.secrets.get(args.ref.secretKey);
-  if (value == null || value.length === 0) {
-    throw new Error(
-      `${args.specifier}: secret '${args.ref.secretKey}' for ${args.field} is not bound`
-    );
-  }
-  return value;
-};
-const buildRemoteProgramConfig = (args) => {
-  const settings = args.spec.settings(args.open.config);
-  const description = args.spec.description;
-  const routesTargets = description.consumes.includes(SandboxWire.HandleRpc);
-  const baseTools = {};
-  for (const capability of Object.values(BaseCapability)) {
-    const endpoint = args.open.baseTools[capability];
-    const declaration = description.baseTools[capability];
-    if (declaration == null) continue;
-    if (endpoint != null) {
-      baseTools[capability] = { provision: declaration.provision, target: endpoint.target };
-      continue;
-    }
-    if (declaration.provision === BaseToolProvision.Bound) continue;
-    const onHost = args.open.manifest.tools.host?.includes(capability) === true;
-    const unroutedTarget = args.open.manifest.tools.base[capability] != null && !routesTargets;
-    if (onHost || unroutedTarget) {
-      baseTools[capability] = { provision: declaration.provision, target: null };
-    }
-  }
-  const delivery = description.inference.delivery;
-  const modelGrant = args.open.credentials.grants.find(
-    (grant) => grant.route === CredentialRoute.Model
-  );
-  const sandboxGrant = args.open.credentials.grants.find(
-    (grant) => grant.route === CredentialRoute.Sandbox
-  );
-  return {
-    attachments: (() => {
-      const grant = args.open.credentials.grants.find(
-        (entry) => entry.route === CredentialRoute.Mcp
-      );
-      return grant == null ? null : {
-        url: `${args.open.credentials.brokerUrl.replace(/\/+$/, "")}/attachment`,
-        token: grant.token
-      };
-    })(),
-    version: 1,
-    program: args.spec.program,
-    cwd: settings.cwd,
-    executable: settings.executable,
-    model: settings.model,
-    reasoning: settings.reasoning,
-    permissionMode: settings.permissionMode,
-    approvalPolicy: settings.approvalPolicy,
-    sandboxMode: settings.sandboxMode,
-    allowedTools: settings.allowedTools,
-    instructions: settings.instructions.filter((fragment) => fragment.role === InstructionRole.System).map((fragment) => ({ role: fragment.role, content: fragment.content })),
-    skills: settings.skills,
-    baseTools,
-    sandboxes: Object.fromEntries(
-      Object.entries(args.open.sandboxes).map(([target, endpoint]) => [
-        target,
-        {
-          bindingId: endpoint.bindingId,
-          capabilities: [...endpoint.capabilities],
-          rpc: endpoint.rpc,
-          mcp: endpoint.mcp
-        }
-      ])
-    ),
-    toolPolicy: { ...args.open.manifest.toolPolicy },
-    // The harness's own login (`credentials.harness()`) is configured by its
-    // user, not by Final: nothing is handed over and the CLI's settings apply.
-    credentials: delivery === CredentialDelivery.AtOpen && args.open.credentials.atOpen?.kind !== InferenceCredentialKind.HarnessOwned ? args.open.credentials.atOpen : null,
-    broker: delivery === CredentialDelivery.PerRequest && modelGrant != null ? {
-      url: args.open.credentials.brokerUrl,
-      token: modelGrant.token,
-      sandboxToken: sandboxGrant?.token ?? null,
-      harnessSessionId: args.open.harnessSessionId
-    } : null,
-    refresh: args.open.credentials.refresh
-  };
-};
-const createRemoteHarness = (spec, config = {}) => {
-  const fetchImpl = config.fetch ?? fetch;
-  const fetchFor = (tls) => tls == null ? fetchImpl : config.tlsFetch?.(tls) ?? createNodeClientTlsFetch({ tls });
-  const now = config.now ?? Date.now;
-  const healthTimeoutMs = config.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;
-  const registerTimeoutMs = config.registerTimeoutMs ?? DEFAULT_REGISTER_TIMEOUT_MS;
-  const clientTls = /* @__PURE__ */ new Map();
-  const register = async (args) => {
-    const source = args.open.forkSource;
-    const forkSource = source == null ? null : parseRemoteRef(source.ref.harnessSessionRef);
-    if (source != null && (!spec.description.supports.fork || formatProviderRef(source.ref.harness) !== formatProviderRef(packageRef(spec.specifier))))
-      throw new Error(`${spec.specifier}: the source does not support this harness's native fork`);
-    if (forkSource != null && (forkSource.id === args.id || forkSource.url !== args.url))
-      throw new Error(
-        `${spec.specifier}: a fork requires a distinct registration on the source host`
-      );
-    const target = programConfigUrlFor({ url: args.url, id: args.id });
-    const registration = {
-      program: toJsonObject(buildRemoteProgramConfig({ spec, open: args.open }))
-    };
-    if (source != null && forkSource != null)
-      registration["forkSource"] = {
-        programConfigId: forkSource.id,
-        sessionId: source.acpSessionId,
-        childSessionId: args.open.session.sessionId
-      };
-    let response;
-    try {
-      response = await fetchFor(args.tls)(target, {
-        method: "PUT",
-        headers: { authorization: `Bearer ${args.hop}`, "content-type": "application/json" },
-        body: JSON.stringify(registration),
-        signal: AbortSignal.timeout(registerTimeoutMs)
-      });
-    } catch (error) {
-      throw new Error(
-        `${spec.specifier}: registering the program config failed: ${error instanceof Error ? error.message : String(error)}`
-      );
-    }
-    const body = await response.text().catch(() => "");
-    if (!response.ok) {
-      const unavailable = unavailableOf(body);
-      if (unavailable != null) throw RequestError.internalError(unavailable, unavailable.detail);
-      throw new Error(
-        `${spec.specifier}: the runtime refused the program config (HTTP ${response.status}) ${body.slice(0, 200)}`.trim()
-      );
-    }
-  };
-  const endpointFor = async (args) => {
-    const settings = spec.settings(args.open.config);
-    const hop = await resolveSecretRef({
-      specifier: spec.specifier,
-      field: "hop",
-      ref: settings.hop,
-      secrets: args.open.secrets
-    });
-    const { id } = parseRemoteRef(args.ref.harnessSessionRef);
-    const tls = await resolveRemoteClientTls({
-      config: settings.tls,
-      secrets: args.open.secrets,
-      url: settings.url
-    });
-    await register({ url: settings.url, hop, id, open: args.open, tls });
-    if (tls != null) clientTls.set(id, tls);
-    else clientTls.delete(id);
-    return {
-      // Re-minted on every open and resume: a rotated hop or a legacy ref gets a current token.
-      ref: {
-        ...args.ref,
-        harnessSessionRef: formatRemoteRef({
-          id,
-          url: settings.url,
-          healthToken: healthTokenFor({ hop, id }),
-          closeToken: closeTokenFor({ hop, id })
-        })
-      },
-      transport: transportForUrl(settings.url),
-      url: settings.url,
-      tls,
-      headers: { authorization: `Bearer ${hop}`, [PROGRAM_CONFIG_HEADER]: id }
-    };
-  };
-  return {
-    describe: async (binding) => {
-      if (binding == null) return spec.description;
-      const settings = spec.settings(binding.config);
-      const hop = await resolveSecretRef({
-        specifier: spec.specifier,
-        field: "hop",
-        ref: settings.hop,
-        secrets: binding.secrets
-      });
-      const tls = await resolveRemoteClientTls({
-        config: settings.tls,
-        secrets: binding.secrets,
-        url: settings.url
-      });
-      const response = await fetchFor(tls)(
-        runtimeUrlFor({ url: settings.url, path: "v1/describe" }),
-        {
-          method: "POST",
-          headers: { authorization: `Bearer ${hop}`, "content-type": "application/json" },
-          body: JSON.stringify({ program: { executable: settings.executable } }),
-          signal: AbortSignal.timeout(registerTimeoutMs)
-        }
-      );
-      const text = await response.text();
-      if (!response.ok) {
-        const unavailable = unavailableOf(text);
-        if (unavailable != null) throw RequestError.internalError(unavailable, unavailable.detail);
-        throw new Error(
-          `${spec.specifier}: describe failed (HTTP ${response.status}) ${text.slice(0, 200)}`
-        );
-      }
-      const description = harnessDescriptionSchema.parse(JSON.parse(text));
-      return {
-        ...description,
-        configSchema: spec.description.configSchema,
-        trust: spec.description.trust,
-        inference: spec.description.inference,
-        consumes: spec.description.consumes
-      };
-    },
-    open: async (args) => {
-      const ref = {
-        harness: packageRef(spec.specifier),
-        // endpointFor() completes the ref with the url and health token.
-        harnessSessionRef: args.harnessSessionId,
-        generation: 1
-      };
-      return endpointFor({ open: args, ref });
-    },
-    // The runtime resumes the program's own session (Claude Code session, Codex
-    // rollout); re-registering hands it the fresh grants.
-    resume: async (args) => endpointFor({ open: args, ref: args.ref }),
-    park: async () => void 0,
-    close: async (ref, options) => {
-      const { id, url: retainedUrl, closeToken } = parseRemoteRef(ref.harnessSessionRef);
-      const context = options?.context;
-      const settings = context == null ? null : spec.settings(context.config);
-      const url = retainedUrl ?? settings?.url ?? null;
-      if (url == null) {
-        if (options?.force === true)
-          throw new Error(`${spec.specifier}: the legacy ref must be resumed before forced close`);
-        return;
-      }
-      const hop = context == null || settings == null ? null : await context.secrets.get(settings.hop.secretKey);
-      const scopedToken = hop == null || hop.length === 0 ? closeToken : closeTokenFor({ hop, id });
-      if (scopedToken == null) {
-        if (options?.force === true)
-          throw new Error(
-            `${spec.specifier}: the legacy ref needs close context or resume before forced close`
-          );
-        return;
-      }
-      const tls = context == null || settings == null ? clientTls.get(id) : await resolveRemoteClientTls({
-        config: settings.tls,
-        secrets: context.secrets,
-        url
-      });
-      const response = await fetchFor(tls)(programConfigUrlFor({ url, id }), {
-        method: "DELETE",
-        headers: { [CLOSE_TOKEN_HEADER]: scopedToken, "content-type": "application/json" },
-        body: JSON.stringify({ force: options?.force === true }),
-        signal: AbortSignal.timeout(config.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS)
-      });
-      const body = await response.text();
-      if (!response.ok && response.status !== 404)
-        throw new Error(
-          `${spec.specifier}: remote close failed (HTTP ${response.status}) ${body.slice(0, 200)}`
-        );
-      clientTls.delete(id);
-    },
-    health: async (ref, context) => {
-      const { id, url, healthToken } = parseRemoteRef(ref.harnessSessionRef);
-      const checkedAt = new Date(now()).toISOString();
-      if (url == null)
-        return { ok: false, detail: "harness session ref has no runtime url", checkedAt };
-      try {
-        const headers = new Headers({ [PROGRAM_CONFIG_HEADER]: id });
-        if (healthToken != null) headers.set(HEALTH_TOKEN_HEADER, healthToken);
-        const tls = context == null ? void 0 : await resolveRemoteClientTls({
-          config: spec.settings(context.config).tls,
-          secrets: context.secrets,
-          url
-        });
-        const response = await fetchFor(tls)(healthUrlFor(url), {
-          method: "GET",
-          headers,
-          signal: AbortSignal.timeout(healthTimeoutMs)
-        });
-        const body = await response.text();
-        const unavailable = response.ok ? null : unavailableOf(body);
-        return response.ok ? { ok: true, checkedAt } : {
-          ok: false,
-          detail: unavailable?.detail ?? `healthz returned HTTP ${response.status}`,
-          checkedAt
-        };
-      } catch (error) {
-        return {
-          ok: false,
-          detail: `healthz failed: ${error instanceof Error ? error.message : String(error)}`,
-          checkedAt
-        };
-      }
-    }
-  };
-};
-import { REMOTE_URL_SCHEMES, remoteUrlJson, remoteUrlZod } from "../harnesses/remote-url.mjs";
-export {
-  CLOSE_TOKEN_HEADER,
-  HEALTH_TOKEN_HEADER,
-  PROGRAM_CONFIG_HEADER,
-  REMOTE_URL_SCHEMES,
-  RemoteProgram,
-  buildRemoteProgramConfig,
-  closeTokenFor,
-  createRemoteHarness,
-  formatRemoteRef,
-  healthTokenFor,
-  healthUrlFor,
-  parseRemoteRef,
-  programConfigUrlFor,
-  remoteUrlJson,
-  remoteUrlZod,
-  resolveSecretRef,
-  transportForUrl
-};
-//# sourceMappingURL=remote-host.mjs.map

package/dist/modules/runtime/remote-host.mjs.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../../src/runtime/remote-host.ts"],
-  "sourcesContent": ["import { RequestError } from '@agentclientprotocol/sdk/experimental/v2';\n\nimport {\n  AcpTransport,\n  BaseCapability,\n  BaseToolProvision,\n  CredentialDelivery,\n  CredentialRoute,\n  formatProviderRef,\n  harnessDescriptionSchema,\n  InferenceCredentialKind,\n  InstructionRole,\n  packageRef,\n  SandboxWire,\n  type HarnessClientTlsIface,\n  type HarnessDescriptionIface,\n  type HarnessEndpointIface,\n  type HarnessHealthIface,\n  type HarnessIface,\n  type HarnessSessionRefIface,\n  type InstructionFragmentIface,\n  type JsonObject,\n  type OpenHarnessSessionArgsIface,\n  type ResumeHarnessSessionArgsIface,\n  type SecretReaderIface,\n  type SkillBundleIface,\n  type ToolApproval,\n} from '@finalai/agent-provider';\n\nimport { createNodeClientTlsFetch } from '@finalai/websockets/node-client-tls';\n\nimport { createHmac } from 'node:crypto';\n\nimport * as z from 'zod';\n\nimport { toJsonObject, type SecretRefIface } from \"../harnesses/config-fields.mjs\";\n\nimport {\n  resolveRemoteClientTls,\n  type RemoteClientTlsInputIface,\n} from \"../harnesses/remote-client-tls.mjs\";\n\nconst unavailableSchema = z.object({\n  code: z.literal('harness_unavailable'),\n  executable: z.string(),\n  foundVersion: z.string().nullable(),\n  requiredVersion: z.string(),\n  detail: z.string(),\n});\n\nconst unavailableOf = (text: string) => {\n  try {\n    return unavailableSchema.safeParse(JSON.parse(text)).data ?? null;\n  } catch {\n    return null;\n  }\n};\n\nconst DEFAULT_HEALTH_TIMEOUT_MS = 5_000;\n\nconst DEFAULT_REGISTER_TIMEOUT_MS = 10_000;\n\nconst DEFAULT_CLOSE_TIMEOUT_MS = 15_000;\n\n// Authentication modes supported by remote harness servers.\nexport const PROGRAM_CONFIG_HEADER = 'x-final-program-config';\n\nexport const HEALTH_TOKEN_HEADER = 'x-final-health-token';\n\nexport const CLOSE_TOKEN_HEADER = 'x-final-close-token';\n\n// The runtime's registration-scoped health credential (HMAC of the registration id under the\n// hop token): health(ref) has no secrets, so open/resume put it in the ref instead of the hop.\nexport const healthTokenFor = (args: { hop: string; id: string }): string =>\n  createHmac('sha256', args.hop).update(`final-harness-health:${args.id}`).digest('base64url');\n\nexport const closeTokenFor = (args: { hop: string; id: string }): string =>\n  createHmac('sha256', args.hop).update(`final-harness-close:${args.id}`).digest('base64url');\n\nconst PROGRAM_CONFIGS_PATH = '/v1/program-configs/';\n\nexport enum RemoteProgram {\n  ClaudeCode = 'claude-code',\n  Codex = 'codex',\n  Pi = 'pi',\n}\n\nexport interface RemoteHarnessFactoryConfigIface {\n  fetch?: typeof fetch;\n  tlsFetch?: (tls: HarnessClientTlsIface) => typeof fetch;\n  // Test seams.\n  now?: () => number;\n  newId?: () => string;\n  healthTimeoutMs?: number;\n  registerTimeoutMs?: number;\n  closeTimeoutMs?: number;\n}\n\nexport interface RemoteSettingsIface {\n  url: string;\n  tls: RemoteClientTlsInputIface | null;\n  hop: SecretRefIface;\n  cwd: string | null;\n  executable: string | null;\n  model: string | null;\n  reasoning: string | null;\n  permissionMode: string | null;\n  approvalPolicy: string | null;\n  sandboxMode: string | null;\n  allowedTools: string[] | null;\n  instructions: InstructionFragmentIface[];\n  skills: SkillBundleIface[];\n}\n\nexport interface RemoteProgramSpecIface {\n  specifier: string;\n  program: RemoteProgram;\n  description: HarnessDescriptionIface;\n  settings: (config: OpenHarnessSessionArgsIface['config']) => RemoteSettingsIface;\n}\n\n// The provider-private program config this harness registers with the runtime\n// Remote harness program configuration, version 1.\n// `credentials`, `broker` and `refresh` carry route grants (and, for at-open\n// harnesses, the resolved model credential); they travel only between this\n// provider and the runtime, over the hop-authenticated registration.\nexport interface RemoteProgramConfigIface {\n  version: 1;\n  program: RemoteProgram;\n  // Absolute path on the runtime host; null = the runtime's own working directory.\n  cwd: string | null;\n  executable: string | null;\n  model: string | null;\n  reasoning: string | null;\n  permissionMode: string | null;\n  approvalPolicy: string | null;\n  sandboxMode: string | null;\n  allowedTools: string[] | null;\n  // System fragments only; user fragments arrive as _final/session/observe.\n  instructions: Pick<InstructionFragmentIface, 'role' | 'content'>[];\n  skills: SkillBundleIface[];\n  // Declared capabilities this harness provides, with the target a bound one\n  // routes to; null runs it natively on the host. A host-disableable capability\n  // absent here must be disabled through the program's own allow-lists.\n  baseTools: Record<string, { provision: BaseToolProvision; target: string | null }>;\n  sandboxes: Record<\n    string,\n    {\n      bindingId: string;\n      capabilities: string[];\n      rpc: { url: string; token: string; expiresAt: string } | null;\n      mcp: { url: string; token: string; expiresAt: string } | null;\n    }\n  >;\n  toolPolicy: Record<string, ToolApproval>;\n  attachments: { url: string; token: string } | null;\n  // In the remote program configuration, the model credential\n  // handed over at open (claude-code, codex), or the broker `model` route grant\n  // for per-request programs (pi), which post to `<broker.url>/model`.\n  credentials: OpenHarnessSessionArgsIface['credentials']['atOpen'];\n  // `sandboxToken` is the broker `sandbox` route grant, for renewing sandbox endpoints.\n  broker: {\n    url: string;\n    token: string;\n    sandboxToken: string | null;\n    harnessSessionId: string;\n  } | null;\n  // The grant's standard refresh route: the runtime pulls the next generation\n  // of `credentials` and `broker` from it before they expire.\n  refresh: OpenHarnessSessionArgsIface['credentials']['refresh'];\n}\n\nexport type RemoteOpenArgsIface = OpenHarnessSessionArgsIface;\n\nexport type RemoteHarnessIface = HarnessIface;\n\n// Scoped capabilities survive a session-service restart without retaining the hop or TLS keys.\nexport const formatRemoteRef = (args: {\n  id: string;\n  url: string;\n  healthToken: string | null;\n  closeToken?: string | null;\n}): string =>\n  args.closeToken != null && args.healthToken != null\n    ? `${args.id}|${args.healthToken}|${args.closeToken}|${args.url}`\n    : args.healthToken == null\n      ? `${args.id}|${args.url}`\n      : `${args.id}|${args.healthToken}|${args.url}`;\n\nconst HEALTH_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/u;\n\nexport interface RemoteRefIface {\n  id: string;\n  url: string | null;\n  healthToken: string | null;\n  closeToken: string | null;\n}\n\nexport const parseRemoteRef = (ref: string): RemoteRefIface => {\n  const bar = ref.indexOf('|');\n  if (bar < 0) return { id: ref, url: null, healthToken: null, closeToken: null };\n  const id = ref.slice(0, bar);\n  const rest = ref.slice(bar + 1);\n  const next = rest.indexOf('|');\n  const token = next < 0 ? null : rest.slice(0, next);\n  if (token == null || !HEALTH_TOKEN_PATTERN.test(token))\n    return { id, url: rest, healthToken: null, closeToken: null };\n  const remaining = rest.slice(next + 1);\n  const separator = remaining.indexOf('|');\n  const closeToken = separator < 0 ? null : remaining.slice(0, separator);\n  return closeToken != null && HEALTH_TOKEN_PATTERN.test(closeToken)\n    ? { id, url: remaining.slice(separator + 1), healthToken: token, closeToken }\n    : { id, url: remaining, healthToken: token, closeToken: null };\n};\n\nexport const transportForUrl = (url: string): AcpTransport.Ws | AcpTransport.Http =>\n  /^wss?:\\/\\//.test(url) ? AcpTransport.Ws : AcpTransport.Http;\n\nconst httpUrlOf = (url: string): string =>\n  url.replace(/^ws(s?):\\/\\//, (_match, secure) => `http${secure}://`);\n\n// Lifecycle routes are siblings of /acp, including a reverse proxy's path prefix.\nconst runtimeUrlFor = (args: { url: string; path: string }): string => {\n  const endpoint = new URL(httpUrlOf(args.url));\n  if (endpoint.pathname !== '/') endpoint.pathname = endpoint.pathname.replace(/\\/+$/, '');\n  return new URL(args.path.replace(/^\\/+/, ''), endpoint).toString();\n};\n\nexport const healthUrlFor = (url: string): string => runtimeUrlFor({ url, path: 'healthz' });\n\nexport const programConfigUrlFor = (args: { url: string; id: string }): string =>\n  runtimeUrlFor({ url: args.url, path: `${PROGRAM_CONFIGS_PATH}${encodeURIComponent(args.id)}` });\n\nexport const resolveSecretRef = async (args: {\n  specifier: string;\n  field: string;\n  ref: SecretRefIface;\n  secrets: SecretReaderIface;\n}): Promise<string> => {\n  const value = await args.secrets.get(args.ref.secretKey);\n  if (value == null || value.length === 0) {\n    throw new Error(\n      `${args.specifier}: secret '${args.ref.secretKey}' for ${args.field} is not bound`,\n    );\n  }\n  return value;\n};\n\nexport const buildRemoteProgramConfig = (args: {\n  spec: RemoteProgramSpecIface;\n  open: OpenHarnessSessionArgsIface;\n}): RemoteProgramConfigIface => {\n  const settings = args.spec.settings(args.open.config);\n  const description = args.spec.description;\n  // A capability bound to a resolved target routes there. One declared on the\n  // harness host (`harnessHost`), or bound to a target a harness that cannot\n  // route it ignores (not reboundable), runs natively on the host.\n  const routesTargets = description.consumes.includes(SandboxWire.HandleRpc);\n  const baseTools: RemoteProgramConfigIface['baseTools'] = {};\n  for (const capability of Object.values(BaseCapability)) {\n    const endpoint = args.open.baseTools[capability];\n    const declaration = description.baseTools[capability];\n    if (declaration == null) continue;\n    if (endpoint != null) {\n      baseTools[capability] = { provision: declaration.provision, target: endpoint.target };\n      continue;\n    }\n    if (declaration.provision === BaseToolProvision.Bound) continue;\n    const onHost = args.open.manifest.tools.host?.includes(capability) === true;\n    const unroutedTarget = args.open.manifest.tools.base[capability] != null && !routesTargets;\n    if (onHost || unroutedTarget) {\n      baseTools[capability] = { provision: declaration.provision, target: null };\n    }\n  }\n  const delivery = description.inference.delivery;\n  const modelGrant = args.open.credentials.grants.find(\n    (grant) => grant.route === CredentialRoute.Model,\n  );\n  // The broker's sandbox route renews sandbox endpoints; it accepts only this grant.\n  const sandboxGrant = args.open.credentials.grants.find(\n    (grant) => grant.route === CredentialRoute.Sandbox,\n  );\n  return {\n    attachments: (() => {\n      const grant = args.open.credentials.grants.find(\n        (entry) => entry.route === CredentialRoute.Mcp,\n      );\n      return grant == null\n        ? null\n        : {\n            url: `${args.open.credentials.brokerUrl.replace(/\\/+$/, '')}/attachment`,\n            token: grant.token,\n          };\n    })(),\n    version: 1,\n    program: args.spec.program,\n    cwd: settings.cwd,\n    executable: settings.executable,\n    model: settings.model,\n    reasoning: settings.reasoning,\n    permissionMode: settings.permissionMode,\n    approvalPolicy: settings.approvalPolicy,\n    sandboxMode: settings.sandboxMode,\n    allowedTools: settings.allowedTools,\n    instructions: settings.instructions\n      .filter((fragment) => fragment.role === InstructionRole.System)\n      .map((fragment) => ({ role: fragment.role, content: fragment.content })),\n    skills: settings.skills,\n    baseTools,\n    sandboxes: Object.fromEntries(\n      Object.entries(args.open.sandboxes).map(([target, endpoint]) => [\n        target,\n        {\n          bindingId: endpoint.bindingId,\n          capabilities: [...endpoint.capabilities],\n          rpc: endpoint.rpc,\n          mcp: endpoint.mcp,\n        },\n      ]),\n    ),\n    toolPolicy: { ...args.open.manifest.toolPolicy },\n    // The harness's own login (`credentials.harness()`) is configured by its\n    // user, not by Final: nothing is handed over and the CLI's settings apply.\n    credentials:\n      delivery === CredentialDelivery.AtOpen &&\n      args.open.credentials.atOpen?.kind !== InferenceCredentialKind.HarnessOwned\n        ? args.open.credentials.atOpen\n        : null,\n    broker:\n      delivery === CredentialDelivery.PerRequest && modelGrant != null\n        ? {\n            url: args.open.credentials.brokerUrl,\n            token: modelGrant.token,\n            sandboxToken: sandboxGrant?.token ?? null,\n            harnessSessionId: args.open.harnessSessionId,\n          }\n        : null,\n    refresh: args.open.credentials.refresh,\n  };\n};\n\nexport const createRemoteHarness = (\n  spec: RemoteProgramSpecIface,\n  config: RemoteHarnessFactoryConfigIface = {},\n): RemoteHarnessIface => {\n  const fetchImpl = config.fetch ?? fetch;\n  const fetchFor = (tls: HarnessClientTlsIface | undefined) =>\n    tls == null ? fetchImpl : (config.tlsFetch?.(tls) ?? createNodeClientTlsFetch({ tls }));\n  const now = config.now ?? Date.now;\n  const healthTimeoutMs = config.healthTimeoutMs ?? DEFAULT_HEALTH_TIMEOUT_MS;\n  const registerTimeoutMs = config.registerTimeoutMs ?? DEFAULT_REGISTER_TIMEOUT_MS;\n  const clientTls = new Map<string, HarnessClientTlsIface>();\n\n  // Registers the program config (fresh credentials included) under the\n  // harness session's id; the runtime applies it to session/new and\n  // session/resume on connections that name it.\n  const register = async (args: {\n    url: string;\n    hop: string;\n    id: string;\n    open: OpenHarnessSessionArgsIface;\n    tls?: HarnessClientTlsIface;\n  }): Promise<void> => {\n    const source = args.open.forkSource;\n    const forkSource = source == null ? null : parseRemoteRef(source.ref.harnessSessionRef);\n    if (\n      source != null &&\n      (!spec.description.supports.fork ||\n        formatProviderRef(source.ref.harness) !== formatProviderRef(packageRef(spec.specifier)))\n    )\n      throw new Error(`${spec.specifier}: the source does not support this harness's native fork`);\n    if (forkSource != null && (forkSource.id === args.id || forkSource.url !== args.url))\n      throw new Error(\n        `${spec.specifier}: a fork requires a distinct registration on the source host`,\n      );\n    const target = programConfigUrlFor({ url: args.url, id: args.id });\n    const registration: JsonObject = {\n      program: toJsonObject(buildRemoteProgramConfig({ spec, open: args.open })),\n    };\n    if (source != null && forkSource != null)\n      registration['forkSource'] = {\n        programConfigId: forkSource.id,\n        sessionId: source.acpSessionId,\n        childSessionId: args.open.session.sessionId,\n      };\n    let response: Response;\n    try {\n      response = await fetchFor(args.tls)(target, {\n        method: 'PUT',\n        headers: { authorization: `Bearer ${args.hop}`, 'content-type': 'application/json' },\n        body: JSON.stringify(registration),\n        signal: AbortSignal.timeout(registerTimeoutMs),\n      });\n    } catch (error) {\n      throw new Error(\n        `${spec.specifier}: registering the program config failed: ${error instanceof Error ? error.message : String(error)}`,\n      );\n    }\n    const body = await response.text().catch(() => '');\n    if (!response.ok) {\n      const unavailable = unavailableOf(body);\n      if (unavailable != null) throw RequestError.internalError(unavailable, unavailable.detail);\n      throw new Error(\n        `${spec.specifier}: the runtime refused the program config (HTTP ${response.status}) ${body.slice(0, 200)}`.trim(),\n      );\n    }\n  };\n\n  const endpointFor = async (args: {\n    open: OpenHarnessSessionArgsIface;\n    ref: HarnessSessionRefIface;\n  }): Promise<HarnessEndpointIface> => {\n    const settings = spec.settings(args.open.config);\n    const hop = await resolveSecretRef({\n      specifier: spec.specifier,\n      field: 'hop',\n      ref: settings.hop,\n      secrets: args.open.secrets,\n    });\n    const { id } = parseRemoteRef(args.ref.harnessSessionRef);\n    const tls = await resolveRemoteClientTls({\n      config: settings.tls,\n      secrets: args.open.secrets,\n      url: settings.url,\n    });\n    await register({ url: settings.url, hop, id, open: args.open, tls });\n    if (tls != null) clientTls.set(id, tls);\n    else clientTls.delete(id);\n    return {\n      // Re-minted on every open and resume: a rotated hop or a legacy ref gets a current token.\n      ref: {\n        ...args.ref,\n        harnessSessionRef: formatRemoteRef({\n          id,\n          url: settings.url,\n          healthToken: healthTokenFor({ hop, id }),\n          closeToken: closeTokenFor({ hop, id }),\n        }),\n      },\n      transport: transportForUrl(settings.url),\n      url: settings.url,\n      tls,\n      headers: { authorization: `Bearer ${hop}`, [PROGRAM_CONFIG_HEADER]: id },\n    };\n  };\n\n  return {\n    describe: async (binding) => {\n      if (binding == null) return spec.description;\n      const settings = spec.settings(binding.config);\n      const hop = await resolveSecretRef({\n        specifier: spec.specifier,\n        field: 'hop',\n        ref: settings.hop,\n        secrets: binding.secrets,\n      });\n      const tls = await resolveRemoteClientTls({\n        config: settings.tls,\n        secrets: binding.secrets,\n        url: settings.url,\n      });\n      const response = await fetchFor(tls)(\n        runtimeUrlFor({ url: settings.url, path: 'v1/describe' }),\n        {\n          method: 'POST',\n          headers: { authorization: `Bearer ${hop}`, 'content-type': 'application/json' },\n          body: JSON.stringify({ program: { executable: settings.executable } }),\n          signal: AbortSignal.timeout(registerTimeoutMs),\n        },\n      );\n      const text = await response.text();\n      if (!response.ok) {\n        const unavailable = unavailableOf(text);\n        if (unavailable != null) throw RequestError.internalError(unavailable, unavailable.detail);\n        throw new Error(\n          `${spec.specifier}: describe failed (HTTP ${response.status}) ${text.slice(0, 200)}`,\n        );\n      }\n      const description = harnessDescriptionSchema.parse(JSON.parse(text));\n      return {\n        ...description,\n        configSchema: spec.description.configSchema,\n        trust: spec.description.trust,\n        inference: spec.description.inference,\n        consumes: spec.description.consumes,\n      };\n    },\n    open: async (args) => {\n      const ref: HarnessSessionRefIface = {\n        harness: packageRef(spec.specifier),\n        // endpointFor() completes the ref with the url and health token.\n        harnessSessionRef: args.harnessSessionId,\n        generation: 1,\n      };\n      return endpointFor({ open: args, ref });\n    },\n    // The runtime resumes the program's own session (Claude Code session, Codex\n    // rollout); re-registering hands it the fresh grants.\n    resume: async (args: ResumeHarnessSessionArgsIface) =>\n      endpointFor({ open: args, ref: args.ref }),\n    park: async () => undefined,\n    close: async (ref, options) => {\n      const { id, url: retainedUrl, closeToken } = parseRemoteRef(ref.harnessSessionRef);\n      const context = options?.context;\n      const settings = context == null ? null : spec.settings(context.config);\n      const url = retainedUrl ?? settings?.url ?? null;\n      if (url == null) {\n        if (options?.force === true)\n          throw new Error(`${spec.specifier}: the legacy ref must be resumed before forced close`);\n        return;\n      }\n      const hop =\n        context == null || settings == null\n          ? null\n          : await context.secrets.get(settings.hop.secretKey);\n      const scopedToken = hop == null || hop.length === 0 ? closeToken : closeTokenFor({ hop, id });\n      if (scopedToken == null) {\n        if (options?.force === true)\n          throw new Error(\n            `${spec.specifier}: the legacy ref needs close context or resume before forced close`,\n          );\n        return;\n      }\n      const tls =\n        context == null || settings == null\n          ? clientTls.get(id)\n          : await resolveRemoteClientTls({\n              config: settings.tls,\n              secrets: context.secrets,\n              url,\n            });\n      const response = await fetchFor(tls)(programConfigUrlFor({ url, id }), {\n        method: 'DELETE',\n        headers: { [CLOSE_TOKEN_HEADER]: scopedToken, 'content-type': 'application/json' },\n        body: JSON.stringify({ force: options?.force === true }),\n        signal: AbortSignal.timeout(config.closeTimeoutMs ?? DEFAULT_CLOSE_TIMEOUT_MS),\n      });\n      const body = await response.text();\n      if (!response.ok && response.status !== 404)\n        throw new Error(\n          `${spec.specifier}: remote close failed (HTTP ${response.status}) ${body.slice(0, 200)}`,\n        );\n      clientTls.delete(id);\n    },\n    health: async (ref, context): Promise<HarnessHealthIface> => {\n      const { id, url, healthToken } = parseRemoteRef(ref.harnessSessionRef);\n      const checkedAt = new Date(now()).toISOString();\n      if (url == null)\n        return { ok: false, detail: 'harness session ref has no runtime url', checkedAt };\n      try {\n        const headers = new Headers({ [PROGRAM_CONFIG_HEADER]: id });\n        if (healthToken != null) headers.set(HEALTH_TOKEN_HEADER, healthToken);\n        const tls =\n          context == null\n            ? undefined\n            : await resolveRemoteClientTls({\n                config: spec.settings(context.config).tls,\n                secrets: context.secrets,\n                url,\n              });\n        const response = await fetchFor(tls)(healthUrlFor(url), {\n          method: 'GET',\n          headers,\n          signal: AbortSignal.timeout(healthTimeoutMs),\n        });\n        const body = await response.text();\n        const unavailable = response.ok ? null : unavailableOf(body);\n        return response.ok\n          ? { ok: true, checkedAt }\n          : {\n              ok: false,\n              detail: unavailable?.detail ?? `healthz returned HTTP ${response.status}`,\n              checkedAt,\n            };\n      } catch (error) {\n        return {\n          ok: false,\n          detail: `healthz failed: ${error instanceof Error ? error.message : String(error)}`,\n          checkedAt,\n        };\n      }\n    },\n  };\n};\nexport { REMOTE_URL_SCHEMES, remoteUrlJson, remoteUrlZod } from \"../harnesses/remote-url.mjs\";\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AAEP,SAAS,gCAAgC;AAEzC,SAAS,kBAAkB;AAE3B,YAAY,OAAO;AAEnB,SAAS,oBAAyC;AAElD;AAAA,EACE;AAAA,OAEK;AAEP,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,MAAM,EAAE,QAAQ,qBAAqB;AAAA,EACrC,YAAY,EAAE,OAAO;AAAA,EACrB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,iBAAiB,EAAE,OAAO;AAAA,EAC1B,QAAQ,EAAE,OAAO;AACnB,CAAC;AAED,MAAM,gBAAgB,CAAC,SAAiB;AACtC,MAAI;AACF,WAAO,kBAAkB,UAAU,KAAK,MAAM,IAAI,CAAC,EAAE,QAAQ;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,MAAM,4BAA4B;AAElC,MAAM,8BAA8B;AAEpC,MAAM,2BAA2B;AAG1B,MAAM,wBAAwB;AAE9B,MAAM,sBAAsB;AAE5B,MAAM,qBAAqB;AAI3B,MAAM,iBAAiB,CAAC,SAC7B,WAAW,UAAU,KAAK,GAAG,EAAE,OAAO,wBAAwB,KAAK,EAAE,EAAE,EAAE,OAAO,WAAW;AAEtF,MAAM,gBAAgB,CAAC,SAC5B,WAAW,UAAU,KAAK,GAAG,EAAE,OAAO,uBAAuB,KAAK,EAAE,EAAE,EAAE,OAAO,WAAW;AAE5F,MAAM,uBAAuB;AAEtB,IAAK,gBAAL,kBAAKA,mBAAL;AACL,EAAAA,eAAA,gBAAa;AACb,EAAAA,eAAA,WAAQ;AACR,EAAAA,eAAA,QAAK;AAHK,SAAAA;AAAA,GAAA;AAgGL,MAAM,kBAAkB,CAAC,SAM9B,KAAK,cAAc,QAAQ,KAAK,eAAe,OAC3C,GAAG,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,UAAU,IAAI,KAAK,GAAG,KAC7D,KAAK,eAAe,OAClB,GAAG,KAAK,EAAE,IAAI,KAAK,GAAG,KACtB,GAAG,KAAK,EAAE,IAAI,KAAK,WAAW,IAAI,KAAK,GAAG;AAElD,MAAM,uBAAuB;AAStB,MAAM,iBAAiB,CAAC,QAAgC;AAC7D,QAAM,MAAM,IAAI,QAAQ,GAAG;AAC3B,MAAI,MAAM,EAAG,QAAO,EAAE,IAAI,KAAK,KAAK,MAAM,aAAa,MAAM,YAAY,KAAK;AAC9E,QAAM,KAAK,IAAI,MAAM,GAAG,GAAG;AAC3B,QAAM,OAAO,IAAI,MAAM,MAAM,CAAC;AAC9B,QAAM,OAAO,KAAK,QAAQ,GAAG;AAC7B,QAAM,QAAQ,OAAO,IAAI,OAAO,KAAK,MAAM,GAAG,IAAI;AAClD,MAAI,SAAS,QAAQ,CAAC,qBAAqB,KAAK,KAAK;AACnD,WAAO,EAAE,IAAI,KAAK,MAAM,aAAa,MAAM,YAAY,KAAK;AAC9D,QAAM,YAAY,KAAK,MAAM,OAAO,CAAC;AACrC,QAAM,YAAY,UAAU,QAAQ,GAAG;AACvC,QAAM,aAAa,YAAY,IAAI,OAAO,UAAU,MAAM,GAAG,SAAS;AACtE,SAAO,cAAc,QAAQ,qBAAqB,KAAK,UAAU,IAC7D,EAAE,IAAI,KAAK,UAAU,MAAM,YAAY,CAAC,GAAG,aAAa,OAAO,WAAW,IAC1E,EAAE,IAAI,KAAK,WAAW,aAAa,OAAO,YAAY,KAAK;AACjE;AAEO,MAAM,kBAAkB,CAAC,QAC9B,aAAa,KAAK,GAAG,IAAI,aAAa,KAAK,aAAa;AAE1D,MAAM,YAAY,CAAC,QACjB,IAAI,QAAQ,gBAAgB,CAAC,QAAQ,WAAW,OAAO,MAAM,KAAK;AAGpE,MAAM,gBAAgB,CAAC,SAAgD;AACrE,QAAM,WAAW,IAAI,IAAI,UAAU,KAAK,GAAG,CAAC;AAC5C,MAAI,SAAS,aAAa,IAAK,UAAS,WAAW,SAAS,SAAS,QAAQ,QAAQ,EAAE;AACvF,SAAO,IAAI,IAAI,KAAK,KAAK,QAAQ,QAAQ,EAAE,GAAG,QAAQ,EAAE,SAAS;AACnE;AAEO,MAAM,eAAe,CAAC,QAAwB,cAAc,EAAE,KAAK,MAAM,UAAU,CAAC;AAEpF,MAAM,sBAAsB,CAAC,SAClC,cAAc,EAAE,KAAK,KAAK,KAAK,MAAM,GAAG,oBAAoB,GAAG,mBAAmB,KAAK,EAAE,CAAC,GAAG,CAAC;AAEzF,MAAM,mBAAmB,OAAO,SAKhB;AACrB,QAAM,QAAQ,MAAM,KAAK,QAAQ,IAAI,KAAK,IAAI,SAAS;AACvD,MAAI,SAAS,QAAQ,MAAM,WAAW,GAAG;AACvC,UAAM,IAAI;AAAA,MACR,GAAG,KAAK,SAAS,aAAa,KAAK,IAAI,SAAS,SAAS,KAAK,KAAK;AAAA,IACrE;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,2BAA2B,CAAC,SAGT;AAC9B,QAAM,WAAW,KAAK,KAAK,SAAS,KAAK,KAAK,MAAM;AACpD,QAAM,cAAc,KAAK,KAAK;AAI9B,QAAM,gBAAgB,YAAY,SAAS,SAAS,YAAY,SAAS;AACzE,QAAM,YAAmD,CAAC;AAC1D,aAAW,cAAc,OAAO,OAAO,cAAc,GAAG;AACtD,UAAM,WAAW,KAAK,KAAK,UAAU,UAAU;AAC/C,UAAM,cAAc,YAAY,UAAU,UAAU;AACpD,QAAI,eAAe,KAAM;AACzB,QAAI,YAAY,MAAM;AACpB,gBAAU,UAAU,IAAI,EAAE,WAAW,YAAY,WAAW,QAAQ,SAAS,OAAO;AACpF;AAAA,IACF;AACA,QAAI,YAAY,cAAc,kBAAkB,MAAO;AACvD,UAAM,SAAS,KAAK,KAAK,SAAS,MAAM,MAAM,SAAS,UAAU,MAAM;AACvE,UAAM,iBAAiB,KAAK,KAAK,SAAS,MAAM,KAAK,UAAU,KAAK,QAAQ,CAAC;AAC7E,QAAI,UAAU,gBAAgB;AAC5B,gBAAU,UAAU,IAAI,EAAE,WAAW,YAAY,WAAW,QAAQ,KAAK;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,WAAW,YAAY,UAAU;AACvC,QAAM,aAAa,KAAK,KAAK,YAAY,OAAO;AAAA,IAC9C,CAAC,UAAU,MAAM,UAAU,gBAAgB;AAAA,EAC7C;AAEA,QAAM,eAAe,KAAK,KAAK,YAAY,OAAO;AAAA,IAChD,CAAC,UAAU,MAAM,UAAU,gBAAgB;AAAA,EAC7C;AACA,SAAO;AAAA,IACL,cAAc,MAAM;AAClB,YAAM,QAAQ,KAAK,KAAK,YAAY,OAAO;AAAA,QACzC,CAAC,UAAU,MAAM,UAAU,gBAAgB;AAAA,MAC7C;AACA,aAAO,SAAS,OACZ,OACA;AAAA,QACE,KAAK,GAAG,KAAK,KAAK,YAAY,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAAA,QAC3D,OAAO,MAAM;AAAA,MACf;AAAA,IACN,GAAG;AAAA,IACH,SAAS;AAAA,IACT,SAAS,KAAK,KAAK;AAAA,IACnB,KAAK,SAAS;AAAA,IACd,YAAY,SAAS;AAAA,IACrB,OAAO,SAAS;AAAA,IAChB,WAAW,SAAS;AAAA,IACpB,gBAAgB,SAAS;AAAA,IACzB,gBAAgB,SAAS;AAAA,IACzB,aAAa,SAAS;AAAA,IACtB,cAAc,SAAS;AAAA,IACvB,cAAc,SAAS,aACpB,OAAO,CAAC,aAAa,SAAS,SAAS,gBAAgB,MAAM,EAC7D,IAAI,CAAC,cAAc,EAAE,MAAM,SAAS,MAAM,SAAS,SAAS,QAAQ,EAAE;AAAA,IACzE,QAAQ,SAAS;AAAA,IACjB;AAAA,IACA,WAAW,OAAO;AAAA,MAChB,OAAO,QAAQ,KAAK,KAAK,SAAS,EAAE,IAAI,CAAC,CAAC,QAAQ,QAAQ,MAAM;AAAA,QAC9D;AAAA,QACA;AAAA,UACE,WAAW,SAAS;AAAA,UACpB,cAAc,CAAC,GAAG,SAAS,YAAY;AAAA,UACvC,KAAK,SAAS;AAAA,UACd,KAAK,SAAS;AAAA,QAChB;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,YAAY,EAAE,GAAG,KAAK,KAAK,SAAS,WAAW;AAAA;AAAA;AAAA,IAG/C,aACE,aAAa,mBAAmB,UAChC,KAAK,KAAK,YAAY,QAAQ,SAAS,wBAAwB,eAC3D,KAAK,KAAK,YAAY,SACtB;AAAA,IACN,QACE,aAAa,mBAAmB,cAAc,cAAc,OACxD;AAAA,MACE,KAAK,KAAK,KAAK,YAAY;AAAA,MAC3B,OAAO,WAAW;AAAA,MAClB,cAAc,cAAc,SAAS;AAAA,MACrC,kBAAkB,KAAK,KAAK;AAAA,IAC9B,IACA;AAAA,IACN,SAAS,KAAK,KAAK,YAAY;AAAA,EACjC;AACF;AAEO,MAAM,sBAAsB,CACjC,MACA,SAA0C,CAAC,MACpB;AACvB,QAAM,YAAY,OAAO,SAAS;AAClC,QAAM,WAAW,CAAC,QAChB,OAAO,OAAO,YAAa,OAAO,WAAW,GAAG,KAAK,yBAAyB,EAAE,IAAI,CAAC;AACvF,QAAM,MAAM,OAAO,OAAO,KAAK;AAC/B,QAAM,kBAAkB,OAAO,mBAAmB;AAClD,QAAM,oBAAoB,OAAO,qBAAqB;AACtD,QAAM,YAAY,oBAAI,IAAmC;AAKzD,QAAM,WAAW,OAAO,SAMH;AACnB,UAAM,SAAS,KAAK,KAAK;AACzB,UAAM,aAAa,UAAU,OAAO,OAAO,eAAe,OAAO,IAAI,iBAAiB;AACtF,QACE,UAAU,SACT,CAAC,KAAK,YAAY,SAAS,QAC1B,kBAAkB,OAAO,IAAI,OAAO,MAAM,kBAAkB,WAAW,KAAK,SAAS,CAAC;AAExF,YAAM,IAAI,MAAM,GAAG,KAAK,SAAS,0DAA0D;AAC7F,QAAI,cAAc,SAAS,WAAW,OAAO,KAAK,MAAM,WAAW,QAAQ,KAAK;AAC9E,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,SAAS;AAAA,MACnB;AACF,UAAM,SAAS,oBAAoB,EAAE,KAAK,KAAK,KAAK,IAAI,KAAK,GAAG,CAAC;AACjE,UAAM,eAA2B;AAAA,MAC/B,SAAS,aAAa,yBAAyB,EAAE,MAAM,MAAM,KAAK,KAAK,CAAC,CAAC;AAAA,IAC3E;AACA,QAAI,UAAU,QAAQ,cAAc;AAClC,mBAAa,YAAY,IAAI;AAAA,QAC3B,iBAAiB,WAAW;AAAA,QAC5B,WAAW,OAAO;AAAA,QAClB,gBAAgB,KAAK,KAAK,QAAQ;AAAA,MACpC;AACF,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,SAAS,KAAK,GAAG,EAAE,QAAQ;AAAA,QAC1C,QAAQ;AAAA,QACR,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG,IAAI,gBAAgB,mBAAmB;AAAA,QACnF,MAAM,KAAK,UAAU,YAAY;AAAA,QACjC,QAAQ,YAAY,QAAQ,iBAAiB;AAAA,MAC/C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,SAAS,4CAA4C,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MACrH;AAAA,IACF;AACA,UAAM,OAAO,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,EAAE;AACjD,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,cAAc,cAAc,IAAI;AACtC,UAAI,eAAe,KAAM,OAAM,aAAa,cAAc,aAAa,YAAY,MAAM;AACzF,YAAM,IAAI;AAAA,QACR,GAAG,KAAK,SAAS,kDAAkD,SAAS,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC,GAAG,KAAK;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,OAAO,SAGU;AACnC,UAAM,WAAW,KAAK,SAAS,KAAK,KAAK,MAAM;AAC/C,UAAM,MAAM,MAAM,iBAAiB;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,KAAK,SAAS;AAAA,MACd,SAAS,KAAK,KAAK;AAAA,IACrB,CAAC;AACD,UAAM,EAAE,GAAG,IAAI,eAAe,KAAK,IAAI,iBAAiB;AACxD,UAAM,MAAM,MAAM,uBAAuB;AAAA,MACvC,QAAQ,SAAS;AAAA,MACjB,SAAS,KAAK,KAAK;AAAA,MACnB,KAAK,SAAS;AAAA,IAChB,CAAC;AACD,UAAM,SAAS,EAAE,KAAK,SAAS,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC;AACnE,QAAI,OAAO,KAAM,WAAU,IAAI,IAAI,GAAG;AAAA,QACjC,WAAU,OAAO,EAAE;AACxB,WAAO;AAAA;AAAA,MAEL,KAAK;AAAA,QACH,GAAG,KAAK;AAAA,QACR,mBAAmB,gBAAgB;AAAA,UACjC;AAAA,UACA,KAAK,SAAS;AAAA,UACd,aAAa,eAAe,EAAE,KAAK,GAAG,CAAC;AAAA,UACvC,YAAY,cAAc,EAAE,KAAK,GAAG,CAAC;AAAA,QACvC,CAAC;AAAA,MACH;AAAA,MACA,WAAW,gBAAgB,SAAS,GAAG;AAAA,MACvC,KAAK,SAAS;AAAA,MACd;AAAA,MACA,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,CAAC,qBAAqB,GAAG,GAAG;AAAA,IACzE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,OAAO,YAAY;AAC3B,UAAI,WAAW,KAAM,QAAO,KAAK;AACjC,YAAM,WAAW,KAAK,SAAS,QAAQ,MAAM;AAC7C,YAAM,MAAM,MAAM,iBAAiB;AAAA,QACjC,WAAW,KAAK;AAAA,QAChB,OAAO;AAAA,QACP,KAAK,SAAS;AAAA,QACd,SAAS,QAAQ;AAAA,MACnB,CAAC;AACD,YAAM,MAAM,MAAM,uBAAuB;AAAA,QACvC,QAAQ,SAAS;AAAA,QACjB,SAAS,QAAQ;AAAA,QACjB,KAAK,SAAS;AAAA,MAChB,CAAC;AACD,YAAM,WAAW,MAAM,SAAS,GAAG;AAAA,QACjC,cAAc,EAAE,KAAK,SAAS,KAAK,MAAM,cAAc,CAAC;AAAA,QACxD;AAAA,UACE,QAAQ;AAAA,UACR,SAAS,EAAE,eAAe,UAAU,GAAG,IAAI,gBAAgB,mBAAmB;AAAA,UAC9E,MAAM,KAAK,UAAU,EAAE,SAAS,EAAE,YAAY,SAAS,WAAW,EAAE,CAAC;AAAA,UACrE,QAAQ,YAAY,QAAQ,iBAAiB;AAAA,QAC/C;AAAA,MACF;AACA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,cAAc,cAAc,IAAI;AACtC,YAAI,eAAe,KAAM,OAAM,aAAa,cAAc,aAAa,YAAY,MAAM;AACzF,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,SAAS,2BAA2B,SAAS,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,QACpF;AAAA,MACF;AACA,YAAM,cAAc,yBAAyB,MAAM,KAAK,MAAM,IAAI,CAAC;AACnE,aAAO;AAAA,QACL,GAAG;AAAA,QACH,cAAc,KAAK,YAAY;AAAA,QAC/B,OAAO,KAAK,YAAY;AAAA,QACxB,WAAW,KAAK,YAAY;AAAA,QAC5B,UAAU,KAAK,YAAY;AAAA,MAC7B;AAAA,IACF;AAAA,IACA,MAAM,OAAO,SAAS;AACpB,YAAM,MAA8B;AAAA,QAClC,SAAS,WAAW,KAAK,SAAS;AAAA;AAAA,QAElC,mBAAmB,KAAK;AAAA,QACxB,YAAY;AAAA,MACd;AACA,aAAO,YAAY,EAAE,MAAM,MAAM,IAAI,CAAC;AAAA,IACxC;AAAA;AAAA;AAAA,IAGA,QAAQ,OAAO,SACb,YAAY,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,IAC3C,MAAM,YAAY;AAAA,IAClB,OAAO,OAAO,KAAK,YAAY;AAC7B,YAAM,EAAE,IAAI,KAAK,aAAa,WAAW,IAAI,eAAe,IAAI,iBAAiB;AACjF,YAAM,UAAU,SAAS;AACzB,YAAM,WAAW,WAAW,OAAO,OAAO,KAAK,SAAS,QAAQ,MAAM;AACtE,YAAM,MAAM,eAAe,UAAU,OAAO;AAC5C,UAAI,OAAO,MAAM;AACf,YAAI,SAAS,UAAU;AACrB,gBAAM,IAAI,MAAM,GAAG,KAAK,SAAS,sDAAsD;AACzF;AAAA,MACF;AACA,YAAM,MACJ,WAAW,QAAQ,YAAY,OAC3B,OACA,MAAM,QAAQ,QAAQ,IAAI,SAAS,IAAI,SAAS;AACtD,YAAM,cAAc,OAAO,QAAQ,IAAI,WAAW,IAAI,aAAa,cAAc,EAAE,KAAK,GAAG,CAAC;AAC5F,UAAI,eAAe,MAAM;AACvB,YAAI,SAAS,UAAU;AACrB,gBAAM,IAAI;AAAA,YACR,GAAG,KAAK,SAAS;AAAA,UACnB;AACF;AAAA,MACF;AACA,YAAM,MACJ,WAAW,QAAQ,YAAY,OAC3B,UAAU,IAAI,EAAE,IAChB,MAAM,uBAAuB;AAAA,QAC3B,QAAQ,SAAS;AAAA,QACjB,SAAS,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AACP,YAAM,WAAW,MAAM,SAAS,GAAG,EAAE,oBAAoB,EAAE,KAAK,GAAG,CAAC,GAAG;AAAA,QACrE,QAAQ;AAAA,QACR,SAAS,EAAE,CAAC,kBAAkB,GAAG,aAAa,gBAAgB,mBAAmB;AAAA,QACjF,MAAM,KAAK,UAAU,EAAE,OAAO,SAAS,UAAU,KAAK,CAAC;AAAA,QACvD,QAAQ,YAAY,QAAQ,OAAO,kBAAkB,wBAAwB;AAAA,MAC/E,CAAC;AACD,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAI,CAAC,SAAS,MAAM,SAAS,WAAW;AACtC,cAAM,IAAI;AAAA,UACR,GAAG,KAAK,SAAS,+BAA+B,SAAS,MAAM,KAAK,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,QACxF;AACF,gBAAU,OAAO,EAAE;AAAA,IACrB;AAAA,IACA,QAAQ,OAAO,KAAK,YAAyC;AAC3D,YAAM,EAAE,IAAI,KAAK,YAAY,IAAI,eAAe,IAAI,iBAAiB;AACrE,YAAM,YAAY,IAAI,KAAK,IAAI,CAAC,EAAE,YAAY;AAC9C,UAAI,OAAO;AACT,eAAO,EAAE,IAAI,OAAO,QAAQ,0CAA0C,UAAU;AAClF,UAAI;AACF,cAAM,UAAU,IAAI,QAAQ,EAAE,CAAC,qBAAqB,GAAG,GAAG,CAAC;AAC3D,YAAI,eAAe,KAAM,SAAQ,IAAI,qBAAqB,WAAW;AACrE,cAAM,MACJ,WAAW,OACP,SACA,MAAM,uBAAuB;AAAA,UAC3B,QAAQ,KAAK,SAAS,QAAQ,MAAM,EAAE;AAAA,UACtC,SAAS,QAAQ;AAAA,UACjB;AAAA,QACF,CAAC;AACP,cAAM,WAAW,MAAM,SAAS,GAAG,EAAE,aAAa,GAAG,GAAG;AAAA,UACtD,QAAQ;AAAA,UACR;AAAA,UACA,QAAQ,YAAY,QAAQ,eAAe;AAAA,QAC7C,CAAC;AACD,cAAM,OAAO,MAAM,SAAS,KAAK;AACjC,cAAM,cAAc,SAAS,KAAK,OAAO,cAAc,IAAI;AAC3D,eAAO,SAAS,KACZ,EAAE,IAAI,MAAM,UAAU,IACtB;AAAA,UACE,IAAI;AAAA,UACJ,QAAQ,aAAa,UAAU,yBAAyB,SAAS,MAAM;AAAA,UACvE;AAAA,QACF;AAAA,MACN,SAAS,OAAO;AACd,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,mBAAmB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,UACjF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AACA,SAAS,oBAAoB,eAAe,oBAAoB;",
-  "names": ["RemoteProgram"]
-}

package/dist/modules/runtime/remote-pi.d.mts

@@ -1,5 +0,0 @@
-import { type JsonObject, type OpenHarnessSessionArgsIface } from '@finalai/agent-provider';
-import { type RemoteHarnessFactoryConfigIface, type RemoteHarnessIface } from "./remote-host.mjs";
-export declare const programConfig: (args: OpenHarnessSessionArgsIface) => JsonObject;
-export declare const createRemotePiHarness: (config?: RemoteHarnessFactoryConfigIface) => RemoteHarnessIface;
-export * from "../harnesses/remote-pi.mjs";

package/dist/modules/runtime/remote-pi.mjs

@@ -1,44 +0,0 @@
-import {} from "@finalai/agent-provider";
-import { parseHarnessConfig, toJsonObject } from "../harnesses/config-fields.mjs";
-import {
-  buildRemoteProgramConfig,
-  createRemoteHarness,
-  RemoteProgram
-} from "./remote-host.mjs";
-import { SPECIFIER, remotePiConfigSchema, REMOTE_PI_DESCRIPTION } from "../harnesses/remote-pi.mjs";
-const spec = {
-  specifier: SPECIFIER,
-  program: RemoteProgram.Pi,
-  description: REMOTE_PI_DESCRIPTION,
-  settings: (raw) => {
-    const parsed = parseHarnessConfig({
-      specifier: SPECIFIER,
-      schema: remotePiConfigSchema,
-      config: raw
-    });
-    return {
-      url: parsed.url,
-      tls: parsed.tls ?? null,
-      hop: parsed.hop,
-      cwd: parsed.cwd ?? null,
-      executable: parsed.executable ?? null,
-      // The runtime's Pi program takes `<provider>/<vendor model id>`.
-      model: parsed.model ?? null,
-      reasoning: parsed.reasoning ?? null,
-      permissionMode: parsed.permissionMode ?? null,
-      approvalPolicy: null,
-      sandboxMode: null,
-      allowedTools: null,
-      instructions: parsed.instructions,
-      skills: []
-    };
-  }
-};
-const programConfig = (args) => toJsonObject(buildRemoteProgramConfig({ spec, open: args }));
-const createRemotePiHarness = (config = {}) => createRemoteHarness(spec, config);
-export * from "../harnesses/remote-pi.mjs";
-export {
-  createRemotePiHarness,
-  programConfig
-};
-//# sourceMappingURL=remote-pi.mjs.map

package/dist/modules/runtime/remote-pi.mjs.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../../src/runtime/remote-pi.ts"],
-  "sourcesContent": ["import { type JsonObject, type OpenHarnessSessionArgsIface } from '@finalai/agent-provider';\nimport { parseHarnessConfig, toJsonObject } from \"../harnesses/config-fields.mjs\";\n\nimport {\n  buildRemoteProgramConfig,\n  createRemoteHarness,\n  RemoteProgram,\n  type RemoteHarnessFactoryConfigIface,\n  type RemoteHarnessIface,\n  type RemoteProgramSpecIface,\n} from \"./remote-host.mjs\";\nimport { SPECIFIER, remotePiConfigSchema, REMOTE_PI_DESCRIPTION } from \"../harnesses/remote-pi.mjs\";\n\nconst spec: RemoteProgramSpecIface = {\n  specifier: SPECIFIER,\n  program: RemoteProgram.Pi,\n  description: REMOTE_PI_DESCRIPTION,\n  settings: (raw) => {\n    const parsed = parseHarnessConfig({\n      specifier: SPECIFIER,\n      schema: remotePiConfigSchema,\n      config: raw,\n    });\n    return {\n      url: parsed.url,\n      tls: parsed.tls ?? null,\n      hop: parsed.hop,\n      cwd: parsed.cwd ?? null,\n      executable: parsed.executable ?? null,\n      // The runtime's Pi program takes `<provider>/<vendor model id>`.\n      model: parsed.model ?? null,\n      reasoning: parsed.reasoning ?? null,\n      permissionMode: parsed.permissionMode ?? null,\n      approvalPolicy: null,\n      sandboxMode: null,\n      allowedTools: null,\n      instructions: parsed.instructions,\n      skills: [],\n    };\n  },\n};\n\n// The program config this harness registers with the runtime.\nexport const programConfig = (args: OpenHarnessSessionArgsIface): JsonObject =>\n  toJsonObject(buildRemoteProgramConfig({ spec, open: args }));\n\nexport const createRemotePiHarness = (\n  config: RemoteHarnessFactoryConfigIface = {},\n): RemoteHarnessIface => createRemoteHarness(spec, config);\n\nexport * from \"../harnesses/remote-pi.mjs\";\n"],
-  "mappings": "AAAA,eAAkE;AAClE,SAAS,oBAAoB,oBAAoB;AAEjD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AACP,SAAS,WAAW,sBAAsB,6BAA6B;AAEvE,MAAM,OAA+B;AAAA,EACnC,WAAW;AAAA,EACX,SAAS,cAAc;AAAA,EACvB,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ;AACjB,UAAM,SAAS,mBAAmB;AAAA,MAChC,WAAW;AAAA,MACX,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,MACL,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO,OAAO;AAAA,MACnB,KAAK,OAAO;AAAA,MACZ,KAAK,OAAO,OAAO;AAAA,MACnB,YAAY,OAAO,cAAc;AAAA;AAAA,MAEjC,OAAO,OAAO,SAAS;AAAA,MACvB,WAAW,OAAO,aAAa;AAAA,MAC/B,gBAAgB,OAAO,kBAAkB;AAAA,MACzC,gBAAgB;AAAA,MAChB,aAAa;AAAA,MACb,cAAc;AAAA,MACd,cAAc,OAAO;AAAA,MACrB,QAAQ,CAAC;AAAA,IACX;AAAA,EACF;AACF;AAGO,MAAM,gBAAgB,CAAC,SAC5B,aAAa,yBAAyB,EAAE,MAAM,MAAM,KAAK,CAAC,CAAC;AAEtD,MAAM,wBAAwB,CACnC,SAA0C,CAAC,MACpB,oBAAoB,MAAM,MAAM;AAEzD,cAAc;",
-  "names": []
-}

package/dist/modules/sandboxes/guide.d.mts

@@ -1,35 +0,0 @@
-import { NetworkPolicy, type SandboxGuidesIface, type SandboxGuideVersionIface } from '@finalai/agent-provider';
-import { ComputerWorkspacePolicy, type ComputerEnvironmentOptions, type ComputerParametersIface, type ComputerRepositoryIface, type ComputerTemplateIface } from "./environment.mjs";
-export type ComputerGuideVersionIface = SandboxGuideVersionIface;
-export interface ResolvedNetworkPolicyIface {
-    mode: NetworkPolicy;
-    allow: string[];
-}
-export interface ResolvedComputerParametersIface {
-    repositories: ComputerRepositoryIface[];
-    variables: string[];
-    workspace: ComputerWorkspacePolicy;
-    networkPolicy: ResolvedNetworkPolicyIface;
-    env: Record<string, string>;
-}
-export interface ResolvedComputerSpecIface {
-    image: string;
-    template: ComputerTemplateIface;
-    parameters: ResolvedComputerParametersIface;
-    guide: Pick<ComputerGuideVersionIface, 'guideId' | 'versionId' | 'slug' | 'title' | 'number' | 'preparedArtifact'> | null;
-    instructionsMarkdown: string | null;
-}
-export declare const DEFAULT_COMPUTER_IMAGE = "lineage:sandbox";
-export interface ComputerBuildInputsIface {
-    image: string;
-    template: ComputerTemplateIface;
-    diskGb: number | null;
-}
-export declare const computerNeedsBuild: (inputs: Pick<ComputerBuildInputsIface, "template">) => boolean;
-export declare const computeComputerArtifactKey: (inputs: ComputerBuildInputsIface) => Promise<string>;
-export declare const mergeComputerParameters: (base: ComputerParametersIface, override: ComputerParametersIface) => ResolvedComputerParametersIface;
-export declare const resolveComputerSpec: (args: {
-    options: ComputerEnvironmentOptions;
-    guides: SandboxGuidesIface;
-    defaultImage: string;
-}) => Promise<ResolvedComputerSpecIface>;