@fungi.computer/truffle 0.4.0 → 0.6.0

package/dist/private-invocation-computer.js

@@ -17,7 +17,7 @@ import { z } from "zod";
 import { backgroundExecInput, backgroundExecOutput, callBackgroundExec, } from "./private-local-computer-processes.js";
 import { capturePrivateLocalExecPath, parsePrivateLocalExecPath, } from "./private-local-exec-path.js";
 import { combinedArgvBytes, launchCwdSchema, launchStdinSchema, maximumLaunchTextLength, } from "./private-local-exec-launch.js";
-import { privateLocalExecEnvironment } from "./private-local-exec-environment.js";
+import { privateLocalExecEnvironment, privateLocalExecEnvironmentInput, } from "./private-local-exec-environment.js";
 import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
 const maximumStreamBytes = 64 * 1_024;
 /** Room inside the stream cap for the visible truncation marker. */
@@ -50,6 +50,7 @@ const runCommonFields = {
         .strictObject({ justification: z.string().min(1).max(2048) })
         .optional(),
     cwd: launchCwdSchema.optional(),
+    env: privateLocalExecEnvironmentInput.optional(),
     // Accepted up to the full invocation deadline and silently clamped to
     // maximumCommandTimeoutMs (see runCommandAtInvocationBoundary); rejecting
     // outright here would just trade one confusing failure for another.
@@ -139,10 +140,12 @@ export const shellOutput = z.union([
 /** Run the recorded command through the normal bounded process door, without a sandbox.
  * The host supplies the captured PATH and canonical cwd; the record supplies the
  * exact original request. No model invocation can call this door directly. */
-export async function dispatchApprovedLocalExec(input, cwd, executionPath, home, processes, mode) {
+export async function dispatchApprovedLocalExec(input, cwd, executionPath, home, processes, mode, 
+/** Only inline rule matches have a live execute sink; ledger dispatch does not. */
+sink) {
     const request = shellInput.parse(input);
     if (request.operation === "run") {
-        const result = await runCommandAtInvocationBoundary(request, cwd, executionPath, home, new AbortController().signal);
+        const result = await runCommandAtInvocationBoundary(request, cwd, executionPath, home, new AbortController().signal, undefined, sink);
         return execOutput.parse({
             ...result,
             sandbox: { mode, likelyDenied: false, ranOutsideSandbox: true },
@@ -316,9 +319,13 @@ function nativeGroupFinalizer(process) {
         })));
     })));
 }
-function captureBoundedOutput(stream) {
+function captureBoundedOutput(stream, name, output) {
     const initial = { chunks: [], byteLength: 0, totalBytes: 0 };
-    return Stream.runFold(stream, () => initial, (captured, chunk) => {
+    return Stream.runFold(output === undefined
+        ? stream
+        : Stream.tap(stream, (bytes) => Effect.sync(() => {
+            output.write(name, bytes);
+        })), () => initial, (captured, chunk) => {
         const remaining = keptStreamBytes - captured.byteLength;
         const totalBytes = captured.totalBytes + chunk.byteLength;
         if (remaining <= 0)
@@ -406,7 +413,7 @@ function buildRunCommand(request, cwd, executionPath, home, sandbox) {
         HOME: home,
         XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR,
         DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS,
-    });
+    }, request.env);
     // Effect's own default stdin is an open "pipe" that nothing closes, so an
     // executable that reads stdin (`cat`, `python3 -`) would otherwise hang
     // for the full timeout. "ignore" gives it immediate EOF, matching the
@@ -446,14 +453,14 @@ function isMissingExecutableFailure(cause) {
         (cause.reason._tag === "NotFound" ||
             cause.reason._tag === "PermissionDenied"));
 }
-async function runCommandAtInvocationBoundary(request, cwd, executionPath, home, signal, sandbox) {
+async function runCommandAtInvocationBoundary(request, cwd, executionPath, home, signal, sandbox, output) {
     const processCommand = buildRunCommand(request, cwd, executionPath, home, sandbox);
     const timeoutMs = Math.min(request.timeoutMs, maximumCommandTimeoutMs);
     try {
         return await runPrivateInvocationProcess(processCommand, signal, timeoutMs, {
             requestedMs: request.timeoutMs,
             describeCommand: () => describeRunRequest(request),
-        });
+        }, output);
     }
     catch (cause) {
         // Spawning the direct form's named executable can fail at the OS level
@@ -475,7 +482,7 @@ async function runCommandAtInvocationBoundary(request, cwd, executionPath, home,
     }
 }
 /** Shared bounded native process owner; callers supply argv/stdin, never shell interpolation. */
-export function runPrivateInvocationProcess(processCommand, signal, timeoutMs, describe) {
+export function runPrivateInvocationProcess(processCommand, signal, timeoutMs, describe, output) {
     return Effect.runPromise(Effect.scoped(Effect.gen(function* () {
         const startedAt = yield* Clock.currentTimeMillis;
         const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
@@ -483,8 +490,8 @@ export function runPrivateInvocationProcess(processCommand, signal, timeoutMs, d
         const process = yield* Effect.acquireRelease(executor.spawn(processCommand), nativeGroupFinalizer).pipe(Effect.provideService(Scope.Scope, processScope));
         // Keep both readers alive when the exit wait times out. Killing and
         // reaping the owned group closes the pipes, preserving bounded output.
-        const stdoutFiber = yield* Effect.forkChild(captureBoundedOutput(process.stdout));
-        const stderrFiber = yield* Effect.forkChild(captureBoundedOutput(process.stderr));
+        const stdoutFiber = yield* Effect.forkChild(captureBoundedOutput(process.stdout, "stdout", output));
+        const stderrFiber = yield* Effect.forkChild(captureBoundedOutput(process.stderr, "stderr", output));
         const exited = yield* timeoutMs === undefined
             ? Effect.map(process.exitCode, Option.some)
             : Effect.timeoutOption(process.exitCode, timeoutMs);
@@ -519,7 +526,7 @@ async function execute(root, executionPath, home, request, context, sandbox, mod
     context.signal.throwIfAborted();
     const cwd = await resolveCwd(root, request.cwd);
     context.signal.throwIfAborted();
-    const result = await runCommandAtInvocationBoundary(request, cwd, executionPath, home, context.signal, sandbox);
+    const result = await runCommandAtInvocationBoundary(request, cwd, executionPath, home, context.signal, sandbox, context.output);
     return execOutput.parse({
         ...result,
         sandbox: {
@@ -614,7 +621,7 @@ currentMode = () => "full-access", stageEscape, runPolicy) {
                 return result;
             }
             if (processes !== undefined) {
-                const output = await callBackgroundExec(processes, request, (requested) => resolveCwd(root, requested), path, context.signal, sandbox);
+                const output = await callBackgroundExec(processes, request, (requested) => resolveCwd(root, requested), path, context.signal, sandbox, context.output);
                 return jsonValueSchema.parse("text" in output
                     ? {
                         ...output,

package/dist/private-local-agent-control.d.ts

@@ -36,11 +36,13 @@ export type LocalArchiveRequest = Readonly<{
  * creating Agent, so the directory owner can hold the created Agent to what
  * the creator holds; its archive names who archives.
  */
-export type LocalAgentControlDirectory = Omit<AgentControlDirectory, "create" | "list" | "archive" | "unarchive"> & Readonly<{
+export type LocalAgentControlDirectory = Omit<AgentControlDirectory, "create" | "list" | "archive" | "unarchive" | "answer" | "escalate"> & Readonly<{
     list: (signal: AbortSignal, options?: Readonly<{
         archived?: boolean;
     }>) => Promise<readonly LocalAgentControlAgent[]>;
     create: (input: LocalCreateRequest, signal: AbortSignal) => Promise<AgentControlAgent>;
+    answer: (input: Parameters<NonNullable<AgentControlDirectory["answer"]>>[0], senderAgentId: string, senderSessionId: string, signal: AbortSignal) => ReturnType<NonNullable<AgentControlDirectory["answer"]>>;
+    escalate: (input: Parameters<NonNullable<AgentControlDirectory["escalate"]>>[0], senderAgentId: string, senderSessionId: string, signal: AbortSignal) => ReturnType<NonNullable<AgentControlDirectory["escalate"]>>;
     archive: (input: LocalArchiveRequest, signal: AbortSignal) => Promise<void>;
     unarchive: (input: LocalArchiveRequest, signal: AbortSignal) => Promise<void>;
 }>;
@@ -75,6 +77,8 @@ export declare function createPrivateLocalAgentControl(input: Readonly<{
         }>) => Promise<readonly AgentControlAgent[]>;
         send?: (input: import("@fungi.computer/shiitake/agent-control").AgentDelegationInput, sourceSessionId: string, signal: AbortSignal, invocation?: import("@fungi.computer/shiitake/agent-control").AgentDelegationInvocation) => Promise<import("@fungi.computer/shiitake").Accepted | import("@fungi.computer/shiitake").Held>;
         recall?: (input: import("@fungi.computer/shiitake/agent-control").AgentRecallInput, sourceSessionId: string, signal: AbortSignal) => Promise<import("@fungi.computer/shiitake").CancelResult>;
+        answer?: (input: import("@fungi.computer/shiitake/agent-control").AgentControlAnswerInput, senderSessionId: string, signal: AbortSignal) => Promise<import("@fungi.computer/shiitake/agent-control").AgentControlAnswerOutput>;
+        escalate?: (input: import("@fungi.computer/shiitake/agent-control").AgentControlEscalateInput, senderSessionId: string, signal: AbortSignal) => Promise<import("@fungi.computer/shiitake/agent-control").AgentControlEscalateOutput>;
         create?: (input: Readonly<{
             requestId: string;
             name?: string;

package/dist/private-local-agent-control.js

@@ -8,7 +8,7 @@ import { createConversationAgents } from "@fungi.computer/shiitake-extensions/ro
 export function createPrivateLocalAgentControl(input) {
     const conversations = createConversationAgents(input.storage);
     function bound(parentSessionId) {
-        const { create, archive, unarchive } = input.directory;
+        const { create, archive, unarchive, answer, escalate } = input.directory;
         const by = { kind: "agent", agentId: input.agentId };
         return {
             ...input.directory,
@@ -23,6 +23,16 @@ export function createPrivateLocalAgentControl(input) {
                     createdBySessionId: parentSessionId,
                 }, signal);
             },
+            answer: (request, sourceSessionId, signal) => parentSessionId === undefined
+                ? Promise.resolve({ status: "refused", reason: "no_provenance" })
+                : sourceSessionId !== parentSessionId
+                    ? Promise.resolve({ status: "refused", reason: "not_sender" })
+                    : answer(request, input.agentId, parentSessionId, signal),
+            escalate: (request, sourceSessionId, signal) => parentSessionId === undefined
+                ? Promise.resolve({ status: "refused", reason: "no_provenance" })
+                : sourceSessionId !== parentSessionId
+                    ? Promise.resolve({ status: "refused", reason: "not_sender" })
+                    : escalate(request, input.agentId, parentSessionId, signal),
         };
     }
     const control = conversations.control(bound);

package/dist/private-local-auth-rpc.d.ts

@@ -87,8 +87,13 @@ declare const wireResultSchema: z.ZodUnion<readonly [z.ZodDiscriminatedUnion<[z.
         category: z.ZodLiteral<"cancelled">;
     }, z.core.$strict>, z.ZodObject<{
         category: z.ZodLiteral<"no-key-entered">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"prompt-failed">;
+    }, z.core.$strict>, z.ZodObject<{
+        category: z.ZodLiteral<"missing-authorization-code">;
     }, z.core.$strict>, z.ZodObject<{
         category: z.ZodLiteral<"unknown">;
+        errorName: z.ZodString;
     }, z.core.$strict>], "category">;
 }, z.core.$strict>]>;
 declare class AuthPromptTarget extends RpcTarget {

package/dist/private-local-auth-rpc.js

@@ -80,6 +80,24 @@ const eventSchema = z.discriminatedUnion("type", [
     }),
 ]);
 const answerSchema = z.string().max(localAuthInputLimit);
+const errorNameSchema = z.string().regex(/^[A-Za-z][A-Za-z0-9_]{0,63}$/u);
+/** A class name only: anything else (or a non-Error) is named generically. */
+function errorNameOf(cause) {
+    if (!(cause instanceof Error))
+        return "NonError";
+    const name = errorNameSchema.safeParse(cause.name);
+    return name.success ? name.data : "Error";
+}
+/**
+ * The person's own dialog could not show or answer a provider question (for
+ * example the prompt failed the renderer's contract). Fixed text, no cause.
+ */
+class LocalAuthPromptFailed extends Error {
+    constructor() {
+        super("Authentication prompt failed");
+        this.name = "LocalAuthPromptFailed";
+    }
+}
 /**
  * The closed set of failures that cross the service. Provider errors can
  * contain credential material, so no free text, cause or provider message
@@ -98,7 +116,13 @@ const localAuthFailureSchema = z.discriminatedUnion("category", [
     }),
     z.strictObject({ category: z.literal("cancelled") }),
     z.strictObject({ category: z.literal("no-key-entered") }),
-    z.strictObject({ category: z.literal("unknown") }),
+    z.strictObject({ category: z.literal("prompt-failed") }),
+    z.strictObject({ category: z.literal("missing-authorization-code") }),
+    z.strictObject({
+        category: z.literal("unknown"),
+        /** The thrown value's class name only, e.g. `TypeError`; never its message. */
+        errorName: errorNameSchema,
+    }),
 ]);
 const wireResultSchema = z.union([
     authResultSchema,
@@ -110,6 +134,7 @@ const wireResultSchema = z.union([
 /** Pi 1.3.0's fixed error prefixes; never retain a provider body suffix. */
 const callbackPortInUse = /^Port \d+ is in use\b/u;
 const oauthStateMismatch = "OAuth state mismatch";
+const missingAuthorizationCode = "Missing authorization code";
 const openAITokenRequestFailed = /^OpenAI OAuth token request failed \(([1-5]\d{2})\)/u;
 function classifyFailure(cause, aborted) {
     if (aborted)
@@ -133,7 +158,14 @@ function classifyFailure(cause, aborted) {
         return { category: "callback-port-in-use" };
     if (cause instanceof Error && cause.message === oauthStateMismatch)
         return { category: "oauth-state-mismatch" };
-    return { category: "unknown" };
+    if (cause instanceof LocalAuthPromptFailed)
+        return { category: "prompt-failed" };
+    if (cause instanceof Error && cause.message === missingAuthorizationCode)
+        return { category: "missing-authorization-code" };
+    return {
+        category: "unknown",
+        errorName: errorNameOf(cause),
+    };
 }
 /** Fixed wording per category; the dialog shows exactly this. */
 function failureText(failure) {
@@ -164,8 +196,12 @@ function failureText(failure) {
             return "Authentication cancelled";
         case "no-key-entered":
             return new LocalAuthRefusal().message;
+        case "prompt-failed":
+            return "The sign-in dialog could not show the provider's question (prompt-failed). Nothing was saved.";
+        case "missing-authorization-code":
+            return "No authorization code was found in what was pasted. Paste the code or the full redirect URL.";
         case "unknown":
-            return "Local authentication failed";
+            return `Local authentication failed (unknown: ${failure.errorName}). Nothing was saved.`;
     }
 }
 /** The client-side error for one typed failure; its message is fixed text. */
@@ -333,7 +369,13 @@ export class PrivateLocalAuthTarget extends RpcTarget {
                         try {
                             if (promptSignal.aborted)
                                 cancel();
-                            return answerSchema.parse(await pending.result());
+                            const answer = await pending.result().then((value) => ({ value }), (cause) => ({ cause }));
+                            if ("cause" in answer) {
+                                promptSignal.throwIfAborted();
+                                // The presenter's error text is not trusted to be secret-free.
+                                throw new LocalAuthPromptFailed();
+                            }
+                            return answerSchema.parse(answer.value);
                         }
                         finally {
                             promptSignal.removeEventListener("abort", cancel);

package/dist/private-local-client-version.js

@@ -5,7 +5,9 @@ import { basename, dirname, join } from "node:path";
 import { promisify } from "node:util";
 import { z } from "zod";
 const execute = promisify(execFile);
-const queryOptions = { timeout: 2_000, maxBuffer: 4_096 };
+// A compiled launcher cold-starts a Bun process; 2s sat at twice its quiet-box
+// time and killed the query on a loaded box.
+const queryOptions = { timeout: 10_000, maxBuffer: 4_096 };
 const buildId = z.string().regex(/^[a-f0-9]{64}$/u);
 function installedLauncherOnPath() {
     return new Promise((resolve, reject) => {

package/dist/private-local-computer-processes.d.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import type { LocalSandboxLaunch } from "./private-invocation-computer.js";
+import type { InvocationContext } from "@fungi.computer/mycelium";
 declare const processSchema: z.ZodObject<{
     id: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-computer-process", "process", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-computer-process", "process", 1>, string>>;
     command: z.ZodString;
@@ -92,11 +93,13 @@ export type PrivateLocalProcessCommandSpec = Readonly<{
     readonly kind: "shell";
     readonly command: string;
     readonly stdin?: string;
+    readonly env?: Readonly<Record<string, string>>;
 } | {
     readonly kind: "direct";
     readonly executable: string;
     readonly args: readonly string[];
     readonly stdin?: string;
+    readonly env?: Readonly<Record<string, string>>;
 }>;
 /** One Session's (or invocation's) view of the host's background processes. */
 export type PrivateLocalProcessScope = Readonly<{
@@ -104,7 +107,7 @@ export type PrivateLocalProcessScope = Readonly<{
     status: (id: string) => PrivateLocalProcess;
     list: () => readonly PrivateLocalProcess[];
     read: (id: string, offset: number, maxBytes: number) => Promise<z.output<typeof readOutput>>;
-    wait: (id: string, timeoutMs: number, signal: AbortSignal) => Promise<z.output<typeof waitOutput>>;
+    wait: (id: string, timeoutMs: number, signal: AbortSignal, output?: InvocationContext["output"]) => Promise<z.output<typeof waitOutput>>;
     kill: (id: string) => Promise<z.output<typeof killOutput>>;
 }>;
 /** The host's one background-process owner. */
@@ -133,6 +136,7 @@ export declare const backgroundExecInput: z.ZodUnion<readonly [z.ZodObject<{
     }, z.core.$strict>>;
     command: z.ZodString;
     stdin: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     cwd: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     operation: z.ZodLiteral<"start">;
@@ -142,6 +146,7 @@ export declare const backgroundExecInput: z.ZodUnion<readonly [z.ZodObject<{
     executable: z.ZodString;
     args: z.ZodDefault<z.ZodArray<z.ZodString>>;
     stdin: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     cwd: z.ZodOptional<z.ZodString>;
 }, z.core.$strict>, z.ZodObject<{
     id: z.ZodString & z.ZodType<import("@fungi.computer/cairn").CairnId<"local-computer-process", "process", 1>, string, z.core.$ZodTypeInternals<import("@fungi.computer/cairn").CairnId<"local-computer-process", "process", 1>, string>>;
@@ -213,5 +218,5 @@ export declare const backgroundExecOutput: z.ZodUnion<readonly [z.ZodObject<{
     }, z.core.$strict>>;
 }, z.core.$strict>]>;
 /** Reuse Session ownership and logs; a wait deadline never cancels the command. */
-export declare function callBackgroundExec(scope: PrivateLocalProcessScope, request: z.output<typeof backgroundExecInput>, resolveCwd: (requested: string | undefined) => Promise<string>, executionPath: string, signal: AbortSignal, sandbox?: LocalSandboxLaunch): Promise<z.output<typeof backgroundExecOutput>>;
+export declare function callBackgroundExec(scope: PrivateLocalProcessScope, request: z.output<typeof backgroundExecInput>, resolveCwd: (requested: string | undefined) => Promise<string>, executionPath: string, signal: AbortSignal, sandbox?: LocalSandboxLaunch, sink?: InvocationContext["output"]): Promise<z.output<typeof backgroundExecOutput>>;
 export {};

package/dist/private-local-computer-processes.js

@@ -7,7 +7,7 @@ import { setTimeout as delay } from "node:timers/promises";
 import { defineIdFamily } from "@fungi.computer/cairn";
 import { z } from "zod";
 import { combinedArgvBytes, launchCwdSchema, launchStdinSchema, maximumLaunchTextLength, } from "./private-local-exec-launch.js";
-import { privateLocalExecEnvironment } from "./private-local-exec-environment.js";
+import { privateLocalExecEnvironment, privateLocalExecEnvironmentInput, } from "./private-local-exec-environment.js";
 import { capturePrivateLocalConfigRoot } from "./private-local-config-root.js";
 import { Writable } from "node:stream";
 /**
@@ -70,6 +70,7 @@ const shellStartInput = z.strictObject({
         .optional(),
     command: z.string().min(1).max(maximumLaunchTextLength),
     stdin: launchStdinSchema.optional(),
+    env: privateLocalExecEnvironmentInput.optional(),
     cwd: launchCwdSchema.optional(),
 });
 /** The direct form of background `start`: argv run with no shell interpretation. */
@@ -82,6 +83,7 @@ const directStartInput = z
     executable: z.string().min(1),
     args: z.array(z.string()).default([]),
     stdin: launchStdinSchema.optional(),
+    env: privateLocalExecEnvironmentInput.optional(),
     cwd: launchCwdSchema.optional(),
 })
     .refine((value) => combinedArgvBytes(value.executable, value.args) <=
@@ -166,18 +168,18 @@ function groupAlive(groupId) {
     }
 }
 function toCommandSpec(request) {
-    if ("command" in request) {
-        const spec = { kind: "shell", command: request.command };
-        return request.stdin === undefined
-            ? spec
-            : { ...spec, stdin: request.stdin };
-    }
-    const spec = {
-        kind: "direct",
-        executable: request.executable,
-        args: request.args,
-    };
-    return request.stdin === undefined ? spec : { ...spec, stdin: request.stdin };
+    let spec = "command" in request
+        ? { kind: "shell", command: request.command }
+        : {
+            kind: "direct",
+            executable: request.executable,
+            args: request.args,
+        };
+    if (request.stdin !== undefined)
+        spec = { ...spec, stdin: request.stdin };
+    if (request.env !== undefined)
+        spec = { ...spec, env: request.env };
+    return spec;
 }
 /**
  * A one-line, human-readable label for a spec; never used for execution.
@@ -221,6 +223,7 @@ class ManagedProcess {
     #signal = null;
     #endedAt = null;
     #leaderExited = false;
+    #output = new Map();
     command;
     constructor(spec, cwd, logDirectory, executionPath, home, launch) {
         this.spec = spec;
@@ -234,7 +237,7 @@ class ManagedProcess {
             HOME: home,
             XDG_RUNTIME_DIR: process.env.XDG_RUNTIME_DIR,
             DBUS_SESSION_BUS_ADDRESS: process.env.DBUS_SESSION_BUS_ADDRESS,
-        });
+        }, spec.env);
         if (launch !== undefined) {
             delete env.XDG_RUNTIME_DIR;
             delete env.DBUS_SESSION_BUS_ADDRESS;
@@ -300,11 +303,12 @@ class ManagedProcess {
             pid !== undefined && Number.isSafeInteger(pid) && pid > 1
                 ? pid
                 : undefined;
-        const append = (chunk) => {
-            this.#append(chunk);
-        };
-        this.#child.stdout?.on("data", append);
-        this.#child.stderr?.on("data", append);
+        this.#child.stdout?.on("data", (chunk) => {
+            this.#append(chunk, "stdout");
+        });
+        this.#child.stderr?.on("data", (chunk) => {
+            this.#append(chunk, "stderr");
+        });
         this.#child.on("error", (error) => {
             this.#append(Buffer.from(`\n[fungi: process failed: ${error.message}]\n`));
             this.#finish(closed.resolve);
@@ -327,7 +331,7 @@ class ManagedProcess {
     get running() {
         return this.#endedAt === null;
     }
-    #append(chunk) {
+    #append(chunk, stream = "stderr") {
         const fd = this.#fd;
         if (fd === undefined)
             return;
@@ -342,6 +346,22 @@ class ManagedProcess {
             writeSync(fd, kept, first, kept.byteLength - first, 0);
         this.#logBytes += chunk.byteLength;
         this.#logTruncated = this.#logBytes > maximumLogBytes;
+        for (const output of this.#output.keys())
+            output.write(stream, chunk);
+    }
+    /** Observe only new chunks during this wait; no extra pipe reader or replay. */
+    observeOutput(output) {
+        if (output !== undefined)
+            this.#output.set(output, (this.#output.get(output) ?? 0) + 1);
+        return () => {
+            if (output === undefined)
+                return;
+            const remaining = (this.#output.get(output) ?? 1) - 1;
+            if (remaining === 0)
+                this.#output.delete(output);
+            else
+                this.#output.set(output, remaining);
+        };
     }
     /** Read atomically with appends, including a wrap in circular storage. */
     read(offset, maxBytes) {
@@ -504,8 +524,10 @@ export function createPrivateLocalComputerProcesses(root, home = capturePrivateL
             status: (id) => find(id).snapshot(),
             list: () => [...(scopes.get(key)?.values() ?? [])].map((r) => r.snapshot()),
             read: (id, offset, maxBytes) => Promise.resolve(find(id).read(offset, maxBytes)),
-            wait: async (id, timeoutMs, signal) => {
+            wait: async (id, timeoutMs, signal, output) => {
+                signal.throwIfAborted();
                 const record = find(id);
+                const stopOutput = record.observeOutput(output);
                 const controller = new AbortController();
                 const abandon = () => {
                     controller.abort();
@@ -519,6 +541,7 @@ export function createPrivateLocalComputerProcesses(root, home = capturePrivateL
                     return waitOutput.parse({ process: record.snapshot(), timedOut });
                 }
                 finally {
+                    stopOutput();
                     signal.removeEventListener("abort", abandon);
                     controller.abort();
                 }
@@ -589,7 +612,7 @@ const backgroundResult = readOutput.extend({
 });
 export const backgroundExecOutput = z.union([backgroundResult, listOutput]);
 /** Reuse Session ownership and logs; a wait deadline never cancels the command. */
-export async function callBackgroundExec(scope, request, resolveCwd, executionPath, signal, sandbox) {
+export async function callBackgroundExec(scope, request, resolveCwd, executionPath, signal, sandbox, sink) {
     signal.throwIfAborted();
     if (request.operation === "list")
         return { processes: [...scope.list()] };
@@ -605,7 +628,8 @@ export async function callBackgroundExec(scope, request, resolveCwd, executionPa
         }
         case "wait":
             id = request.id;
-            timedOut = (await scope.wait(id, request.timeoutMs, signal)).timedOut;
+            timedOut = (await scope.wait(id, request.timeoutMs, signal, sink))
+                .timedOut;
             break;
         case "kill":
             id = request.id;

package/dist/private-local-delegation.d.ts

@@ -28,9 +28,27 @@ export declare function createPrivateLocalDelegation(input: Readonly<{
         name: string;
     }[] | undefined>) | undefined;
     accept: (mail: BirdDogMail, meta?: BirdDogMail["meta"], reply?: VerifiedAgentReply) => Promise<Accepted>;
+    /**
+     * What happens to items a child left waiting on this Agent when the work
+     * that was told about them ends. Without it a host leaves them to expire.
+     */
+    unattended?: Readonly<{
+        /** Exact settled facts of one command of this Agent's own Sessions. */
+        readSettlement: (sessionId: string, commandId: string) => Promise<CommandSettlement | undefined>;
+        /**
+         * Pass one child item on to a person, as this Agent's Session that was
+         * told about it. A child that already moved on answers that and nothing changes.
+         */
+        escalate: (item: Readonly<{
+            agentId: string;
+            sessionId: string;
+            itemId: string;
+        }>, receiverSessionId: string) => Promise<void>;
+    }>;
 }>): {
     send: (task: AgentDelegationInput, sourceSessionId: string, signal: AbortSignal, invocation?: AgentDelegationInvocation) => Promise<DelegationReceipt>;
     recall: (task: AgentRecallInput, sourceSessionId: string, signal: AbortSignal) => Promise<CancelResult>;
     receive: (mail: BirdDogMail) => Promise<Accepted>;
+    close: () => Promise<void>;
     outstanding: () => Promise<import("@fungi.computer/shiitake/fleet").OutstandingDelegation | undefined>;
 };