@guuey/host 0.1.0 → 0.2.0

package/dist/options.js

@@ -1,248 +0,0 @@
-import { GUUEY_DEFAULT_SYSTEM_PROMPT, defaultModelFor } from "@guuey/config";
-/**
- * Default Claude model — only used when the snapshot omits `model`. Derived
- * from the `@guuey/config` registry (single source of truth per the
- * model-release playbook §8 item A) rather than a bare literal, so a
- * registry default change propagates here automatically.
- */
-const DEFAULT_MODEL = defaultModelFor("claude-agent-sdk");
-/** Default cap on agent-loop turns per user message (matches the SDK/runner default). */
-const DEFAULT_MAX_TURNS = 25;
-/**
- * Env-var names the Router injects so agent code reaches the home/app layers
- * portably. Host-owned copies of `@guuey/fs`'s `ENV_HOME_DIR`/`ENV_APP_DIR`
- * (trivial string literals — not imported, to keep this package OSS-legal).
- */
-export const ENV_HOME_DIR = "GUUEY_HOME_DIR";
-export const ENV_APP_DIR = "GUUEY_APP_DIR";
-/**
- * File tools enabled when GuueyFS layers are bound. `Bash` is added separately
- * (see {@link BASH_TOOL}) so the two are independently testable.
- */
-const FS_TOOLS = ["Read", "Write", "Edit", "Glob", "Grep"];
-/**
- * Real shell exec, enabled alongside the file tools when GuueyFS layers are
- * bound. Unlike the source runner — which enabled `Bash` only when the SDK's OWN
- * `sandbox:{}` block was on — this host runs entirely INSIDE the Router's
- * bubblewrap jail, so the OS isolation is always present whenever fs is bound.
- * The SDK `sandbox:{}` block is therefore NOT set here (it would spawn a nested
- * bubblewrap inside the Router's bwrap); the Router's bwrap IS the isolation.
- */
-const BASH_TOOL = "Bash";
-/**
- * Build the Claude Agent SDK `Options` for one invoke. Pure: all disk/env access
- * is injected via {@link BuildOptionsContext}. Throws on an unresolved `{file}`
- * system prompt or a missing API key (the same loud failures the source had).
- */
-export function buildOptions(snapshot, ctx) {
-    const apiKey = ctx.apiKey;
-    const baseUrl = ctx.baseUrl;
-    const authToken = ctx.authToken;
-    // Require either the loopback proxy credentials (hosted/broker path) or a
-    // direct API key (local-dev fallback). Neither → fail loudly.
-    if (!((baseUrl !== undefined && authToken !== undefined) || apiKey)) {
-        throw new Error("@guuey/host: either (baseUrl + authToken) for the managed-LLM proxy, " +
-            "or ANTHROPIC_API_KEY for local dev, is required.");
-    }
-    // Snapshots reach the worker fully resolved — the CLI's loader inlines any
-    // `{file}` system prompt before upload. A `{file}` reaching the worker means
-    // someone hit the API directly with an un-resolved snapshot; reject loudly.
-    if (snapshot.systemPrompt !== undefined && typeof snapshot.systemPrompt !== "string") {
-        throw new Error(`@guuey/host: snapshot.systemPrompt must be a resolved string (got ${JSON.stringify(snapshot.systemPrompt)}). The CLI inlines {file} references before upload; workers never read the filesystem.`);
-    }
-    const mcpServers = resolveMcpServers(ctx);
-    const allowedTools = buildAllowedTools(snapshot, Object.keys(mcpServers), Boolean(ctx.fs));
-    const systemPrompt = withContextPreamble(snapshot.systemPrompt ?? GUUEY_DEFAULT_SYSTEM_PROMPT, ctx.history, ctx.priorMemory, ctx.priorState);
-    const model = snapshot.model ?? DEFAULT_MODEL;
-    const maxTurns = snapshot.runtime?.maxTurns ?? DEFAULT_MAX_TURNS;
-    const fs = ctx.fs;
-    // Build the subprocess env. Two mutually-exclusive paths:
-    //
-    //  - Proxy path (baseUrl + authToken present): route the Claude CLI
-    //    subprocess through the managed-LLM broker. baseUrl + authToken are
-    //    spread LAST so a builder's snapshot.env cannot override them.
-    //    ANTHROPIC_API_KEY is intentionally absent — the proxy owns auth.
-    //    CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC suppresses telemetry pings
-    //    that would bypass the proxy.
-    //
-    //  - Local-dev fallback (only apiKey present): pass the real key directly.
-    //    The guard above guarantees apiKey is non-null on this branch.
-    // Explicit Record<string, string> annotation prevents TypeScript from widening
-    // the ternary to a union `{ K: string } | {}`, which would make spread targets
-    // produce optional-undefined keys that conflict with Record<string, string>.
-    const fsEnv = fs
-        ? { [ENV_HOME_DIR]: fs.home, [ENV_APP_DIR]: fs.app }
-        : {};
-    let env;
-    if (baseUrl !== undefined && authToken !== undefined) {
-        env = {
-            ...(snapshot.env ?? {}),
-            ...fsEnv,
-            ANTHROPIC_BASE_URL: baseUrl,
-            ANTHROPIC_AUTH_TOKEN: authToken,
-            CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1",
-        };
-    }
-    else {
-        // apiKey is guaranteed non-null by the guard; the if-check narrows the type.
-        if (!apiKey)
-            throw new Error("unreachable: apiKey guard should have prevented this path");
-        env = {
-            ANTHROPIC_API_KEY: apiKey,
-            ...(snapshot.env ?? {}),
-            ...fsEnv,
-        };
-    }
-    // Whether the operator pinned a Claude permission mode in agent.json. When
-    // set we forward it verbatim and let the SDK's mode govern the posture; when
-    // unset we install the auto-allow `canUseTool` below so the default no-code
-    // agent's Bash runs prompt-free (a never-answered prompt would hang the pod).
-    const explicitMode = snapshot.claude?.permissions?.mode;
-    const options = {
-        model,
-        mcpServers,
-        allowedTools,
-        // With GuueyFS layers bound, expose the file tools PLUS real `Bash`; without
-        // them this is byte-identical to the source (purely MCP-driven). `Bash` is
-        // safe here because the host already runs inside the Router's bubblewrap
-        // jail — that bwrap, NOT the SDK's own `sandbox:{}` block, is the isolation.
-        tools: fs ? [...FS_TOOLS, BASH_TOOL] : [],
-        // Settings isolation. Empty array = "no filesystem settings loaded" — guards
-        // against a future SDK change auto-pulling `~/.claude/settings.json` and
-        // leaking the operator's logged-in Claude Code MCPs into the tool catalog.
-        settingSources: [],
-        strictMcpConfig: true,
-        maxTurns,
-        env,
-        systemPrompt,
-        // GuueyFS binding (opt-in): session dir as cwd, home+app as extra roots.
-        ...(fs ? { cwd: fs.session, additionalDirectories: [fs.home, fs.app] } : {}),
-        // Permission posture. Two mutually-exclusive paths:
-        //
-        //  - Operator pinned `claude.permissions.mode` → forward it verbatim; the
-        //    operator owns the posture (e.g. `acceptEdits`).
-        //  - No explicit mode + fs bound → install an auto-allow `canUseTool`. In
-        //    the SDK permission flow (hooks → deny → allow → ask → mode/canUseTool),
-        //    `default` mode with no callback routes Bash subcommands through an
-        //    interactive permission prompt — which, in this headless ephemeral pod,
-        //    no one answers, so the agent would HANG. The auto-allow callback short-
-        //    circuits that: every tool the model picks (already constrained to
-        //    `tools`/`allowedTools` + `settingSources:[]` + `strictMcpConfig`) is
-        //    allowed without a prompt. This is safe precisely because the Router's
-        //    bubblewrap jail is the real isolation boundary — NOT the SDK's own
-        //    `sandbox:{}` block (which is intentionally absent to avoid a nested
-        //    bwrap inside the Router's bwrap). We do NOT use `bypassPermissions`
-        //    here: it requires `allowDangerouslySkipPermissions` and globally
-        //    disables hooks/deny-rule evaluation, whereas the callback keeps the
-        //    deny/hook stages intact while only collapsing the final ask stage.
-        ...(explicitMode
-            ? { permissionMode: explicitMode }
-            : fs
-                ? { canUseTool: autoAllowTool }
-                : {}),
-        ...(ctx.abortController ? { abortController: ctx.abortController } : {}),
-    };
-    return options;
-}
-/**
- * Auto-allow permission callback. Installed when fs is bound and the operator
- * did NOT pin `claude.permissions.mode`, so the default no-code agent's `Bash`
- * (and the file tools) run prompt-free. Returns `{ behavior: 'allow' }` for
- * every request, passing the input through unchanged.
- *
- * Safe because the model's tool surface is already locked down BEFORE the
- * callback ever fires — `tools`/`allowedTools` cap which tools exist,
- * `settingSources:[]` blocks filesystem-loaded settings, `strictMcpConfig`
- * pins the MCP catalog — and the real OS isolation is the Router's bubblewrap
- * jail this whole process runs inside. The callback only collapses the SDK's
- * final interactive "ask" stage (which would otherwise hang a headless pod);
- * the earlier hook/deny-rule stages of the permission flow still run.
- */
-export const autoAllowTool = (_toolName, input) => Promise.resolve({ behavior: "allow", updatedInput: input });
-/**
- * Map the Router-resolved cred files to the framework-neutral SdkMcpServer map.
- * The Router (credential-broker) owns ALL resolution — default, federation, mint,
- * env-substitution; this worker just reads `<session>/.guuey/credentials/*.json`
- * (via ctx.listCredentials) and shapes each entry. Keyed by the server name.
- */
-export function resolveMcpServers(ctx) {
-    const out = {};
-    for (const { name, cred } of ctx.listCredentials()) {
-        out[name] = {
-            type: cred.transport,
-            url: cred.url,
-            // Declared MCP servers ARE this agent's tool surface. Without
-            // alwaysLoad the CLI defers MCP tools behind its ToolSearch built-in —
-            // absent here (tools: []) — leaving the model tool-less. Empirically
-            // load-bearing; mirrors the scaffold template's worker (see
-            // create-agentic-app templates-src claude worker.ts).
-            alwaysLoad: true,
-            ...(Object.keys(cred.headers).length > 0 ? { headers: cred.headers } : {}),
-        };
-    }
-    return out;
-}
-/**
- * Build the SDK's `allowedTools` array. MCP tools are auto-namespaced by the SDK
- * as `mcp__<server>__<tool>`; we can't enumerate the namespaces ahead of time,
- * so the allowlist is necessarily wildcard-ish.
- *
- * - explicit `tools.allowlist` → pass those literal names through.
- * - else → allow every tool from every declared server via `mcp__<server>`.
- *
- * When GuueyFS layers are bound, the file tools AND `Bash` join the allowlist
- * (an allow rule in the SDK permission flow), so the model may use them
- * alongside the MCP allowlist. The auto-allow `canUseTool` (or the operator's
- * pinned mode) governs whether those still prompt — see `buildOptions`.
- */
-function buildAllowedTools(snapshot, declaredServerNames, fsBound) {
-    const explicit = snapshot.tools?.allowlist;
-    const base = explicit && explicit.length > 0
-        ? explicit.slice()
-        : declaredServerNames.map((s) => `mcp__${s}`);
-    return fsBound ? [...base, ...FS_TOOLS, BASH_TOOL] : base;
-}
-/**
- * Render prior context sections (conversation history, thread memory, working
- * state) as a preamble and prepend to the system prompt. The SDK's `query()`
- * accepts only the current `input` as `prompt`, so feeding context here is how
- * an ephemeral worker gives the model memory across invokes.
- *
- * Empty sections are omitted; if all inputs are empty/undefined the original
- * system prompt is returned unchanged. Exported for unit testing + reuse by the
- * worker loop.
- */
-export function withContextPreamble(systemPrompt, history, priorMemory, priorState) {
-    const sections = [];
-    if (history && history.length > 0) {
-        sections.push([
-            "Prior conversation with this user, for context. Continue naturally;",
-            "do not repeat it back verbatim.",
-            "<conversation_history>",
-            ...history.map((m) => `${roleLabel(m.role)}: ${m.text}`),
-            "</conversation_history>",
-        ].join("\n"));
-    }
-    if (priorMemory && priorMemory.length > 0) {
-        sections.push([
-            "Facts you previously recorded for this thread. Treat as known.",
-            "<thread_memory>",
-            ...priorMemory.map((m) => `${m.key ?? "(unkeyed)"}: ${JSON.stringify(m.value)}`),
-            "</thread_memory>",
-        ].join("\n"));
-    }
-    if (priorState !== undefined) {
-        sections.push([
-            "Your working state carried from the previous turn.",
-            "<working_state>",
-            JSON.stringify(priorState, null, 2),
-            "</working_state>",
-        ].join("\n"));
-    }
-    if (sections.length === 0)
-        return systemPrompt;
-    return `${sections.join("\n\n")}\n\n${systemPrompt}`;
-}
-function roleLabel(role) {
-    return role === "agent" ? "Assistant" : "User";
-}

package/dist/run-openai.d.ts

@@ -1,65 +0,0 @@
-/**
- * The OpenAI (`@openai/agents`) arm of the universal host loop. Mirrors
- * `run.ts`'s `runInvoke` shape: one invoke → an `@openai/agents` `Agent` built
- * from the snapshot, run streamed, each raw `RunStreamEvent` emitted to fd-3 as
- * a `native('openai-agents-sdk', …)` WorkerEvent (the Router dispatches them to
- * the `@silverprotocol/openai-agents` normalizer). On clean completion it emits
- * `done`; on `MaxTurnsExceededError` it emits the `__host_error__` sentinel the
- * normalizer maps to `turn.error` (code `max_turns`), THEN `done(..,"max_turns")`;
- * on any other failure it emits `error`. Never throws — every failure path is a
- * terminal event so the Router always sees one. Emits `hello` FIRST (§8 item B)
- * — the SDK-version handshake.
- *
- * `run` (the `@openai/agents` runner) is injected so the loop is unit-testable
- * without a live model — the entrypoint (`index.ts`) passes the real SDK `run`.
- *
- * Snapshot → Agent mapping:
- *  - `model`        → `snapshot.model` (or the SDK's own default when absent —
- *                     NOT Claude's; this is the OpenAI path).
- *  - `instructions` → `systemPrompt` + the §1.4 context preamble (reuses
- *                     `withContextPreamble`, identical to the Claude path).
- *  - `mcpServers`   → the framework-neutral `resolveMcpServers` output (same
- *                     federation/env-substitution as Claude), each `http`/`sse`
- *                     entry → an `MCPServerStreamableHttp` carrying its
- *                     `Authorization` (and any other) header via `requestInit`.
- *  - `maxTurns`     → `snapshot.runtime?.maxTurns` (passed to `run(...)`; the SDK
- *                     THROWS `MaxTurnsExceededError` from `stream.completed`).
- *  - API key        → `OPENAI_API_KEY` (the Router sets it at pod boot), applied
- *                     globally via `setDefaultOpenAIKey` by the entrypoint.
- */
-import { Agent, type RunStreamEvent } from "@openai/agents";
-import type { Emitter } from "@guuey/worker";
-import type { HostInvoke, HostRuntime } from "./run.js";
-import { type GuueyAgent } from "@guuey/config";
-/**
- * The streamed-result surface the loop CONSUMES — exactly the three members it
- * reads off the `@openai/agents` `StreamedRunResult`: async iteration over raw
- * events, `completed` (which THROWS `MaxTurnsExceededError`), and the resolved
- * `finalOutput`. A minimal structural interface (NOT the full `StreamedRunResult`
- * class) so the real runner result AND a test fake both satisfy it without a cast
- * — `StreamedRunResult` has private fields, so a plain object could never match
- * the class, but it DOES match this read-only projection.
- */
-export interface OpenaiRunResult extends AsyncIterable<RunStreamEvent> {
-    readonly completed: Promise<void>;
-    /** Resolved text output for the default text-output Agent (or `undefined`). */
-    readonly finalOutput?: string | undefined;
-}
-/**
- * The `run` surface the loop needs — the real `@openai/agents` `run` (streamed
- * overload) satisfies it (its `StreamedRunResult` is assignable to
- * {@link OpenaiRunResult}). Injected so the loop is testable without a live model.
- */
-export type OpenaiRunFn = (agent: Agent, input: string, options: {
-    stream: true;
-    maxTurns?: number;
-}) => Promise<OpenaiRunResult>;
-/**
- * Run one invoke through `@openai/agents`. Emits `native` per `RunStreamEvent`,
- * `done` on completion (with the `max_turns` sentinel + reason on a turn-cap),
- * `error` on a build failure or any non-max-turns throw. Never throws.
- */
-export declare function runInvokeOpenai(snapshot: GuueyAgent & {
-    framework?: string;
-}, invoke: HostInvoke, runtime: HostRuntime, emit: Emitter, run: OpenaiRunFn): Promise<void>;
-//# sourceMappingURL=run-openai.d.ts.map

package/dist/run-openai.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run-openai.d.ts","sourceRoot":"","sources":["../src/run-openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,EACL,KAAK,EAIL,KAAK,cAAc,EACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAa,MAAM,eAAe,CAAC;AAOxD,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAA+B,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AAQ7E;;;;;;;;GAQG;AACH,MAAM,WAAW,eAAgB,SAAQ,aAAa,CAAC,cAAc,CAAC;IACpE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3C;AAED;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,CACxB,KAAK,EAAE,KAAK,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,EAAE;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KACzC,OAAO,CAAC,eAAe,CAAC,CAAC;AAgB9B;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,UAAU,GAAG;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EAC7C,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CA4Gf"}

package/dist/run-openai.js

@@ -1,207 +0,0 @@
-/**
- * The OpenAI (`@openai/agents`) arm of the universal host loop. Mirrors
- * `run.ts`'s `runInvoke` shape: one invoke → an `@openai/agents` `Agent` built
- * from the snapshot, run streamed, each raw `RunStreamEvent` emitted to fd-3 as
- * a `native('openai-agents-sdk', …)` WorkerEvent (the Router dispatches them to
- * the `@silverprotocol/openai-agents` normalizer). On clean completion it emits
- * `done`; on `MaxTurnsExceededError` it emits the `__host_error__` sentinel the
- * normalizer maps to `turn.error` (code `max_turns`), THEN `done(..,"max_turns")`;
- * on any other failure it emits `error`. Never throws — every failure path is a
- * terminal event so the Router always sees one. Emits `hello` FIRST (§8 item B)
- * — the SDK-version handshake.
- *
- * `run` (the `@openai/agents` runner) is injected so the loop is unit-testable
- * without a live model — the entrypoint (`index.ts`) passes the real SDK `run`.
- *
- * Snapshot → Agent mapping:
- *  - `model`        → `snapshot.model` (or the SDK's own default when absent —
- *                     NOT Claude's; this is the OpenAI path).
- *  - `instructions` → `systemPrompt` + the §1.4 context preamble (reuses
- *                     `withContextPreamble`, identical to the Claude path).
- *  - `mcpServers`   → the framework-neutral `resolveMcpServers` output (same
- *                     federation/env-substitution as Claude), each `http`/`sse`
- *                     entry → an `MCPServerStreamableHttp` carrying its
- *                     `Authorization` (and any other) header via `requestInit`.
- *  - `maxTurns`     → `snapshot.runtime?.maxTurns` (passed to `run(...)`; the SDK
- *                     THROWS `MaxTurnsExceededError` from `stream.completed`).
- *  - API key        → `OPENAI_API_KEY` (the Router sets it at pod boot), applied
- *                     globally via `setDefaultOpenAIKey` by the entrypoint.
- */
-import { Agent, MaxTurnsExceededError, MCPServerStreamableHttp, } from "@openai/agents";
-import { resolveMcpServers, withContextPreamble, } from "./options.js";
-import { GUUEY_DEFAULT_SYSTEM_PROMPT } from "@guuey/config";
-import { resolveSdkVersion } from "./sdk-version.js";
-/** The framework tag this arm runs — matches the `AgentFramework` enum value. */
-const OPENAI_FRAMEWORK = "openai-agents-sdk";
-/** The npm package whose installed version is this framework's `hello.sdkVersion`. */
-const OPENAI_SDK_PACKAGE = "@openai/agents";
-/**
- * Run one invoke through `@openai/agents`. Emits `native` per `RunStreamEvent`,
- * `done` on completion (with the `max_turns` sentinel + reason on a turn-cap),
- * `error` on a build failure or any non-max-turns throw. Never throws.
- */
-export async function runInvokeOpenai(snapshot, invoke, runtime, emit, run) {
-    // The SDK-version handshake (§8 item B, additive-optional) — ALWAYS the
-    // first event of this invoke's fd-3 stream, before any native/turn event.
-    // `sdkVersion` is resolved at runtime, never hardcoded; `null` (SDK not
-    // resolvable) is tolerated by the Router.
-    emit.hello(OPENAI_FRAMEWORK, OPENAI_SDK_PACKAGE, resolveSdkVersion(OPENAI_SDK_PACKAGE));
-    // The host runs inside the Router's bubblewrap jail with NO IRSA; a federated
-    // MCP server reads its Router-written credential file. `resolveMcpServers`
-    // needs the same per-invoke context the Claude path builds.
-    const ctx = {
-        input: invoke.input,
-        identity: invoke.identity,
-        fs: invoke.fs,
-        history: invoke.history,
-        listCredentials: runtime.listCredentials,
-        ...(runtime.apiKey !== undefined ? { apiKey: runtime.apiKey } : {}),
-        ...(invoke.priorMemory !== undefined ? { priorMemory: invoke.priorMemory } : {}),
-        ...(invoke.priorState !== undefined ? { priorState: invoke.priorState } : {}),
-    };
-    // Build the Agent (+ connect its MCP servers). A build failure (e.g. an
-    // unresolved {file} system prompt, or an unsupported MCP arm) is a terminal
-    // `error` — never a throw out of this function.
-    let instructions;
-    let mcpServers;
-    try {
-        // Snapshots reach the worker fully resolved — the CLI inlines any `{file}`
-        // system prompt before upload. A non-string reaching the worker means a
-        // direct API hit with an un-resolved snapshot; reject loudly (same as Claude).
-        if (snapshot.systemPrompt !== undefined && typeof snapshot.systemPrompt !== "string") {
-            throw new Error(`@guuey/host: snapshot.systemPrompt must be a resolved string (got ${JSON.stringify(snapshot.systemPrompt)}). The CLI inlines {file} references before upload; workers never read the filesystem.`);
-        }
-        instructions = withContextPreamble(snapshot.systemPrompt ?? GUUEY_DEFAULT_SYSTEM_PROMPT, ctx.history, ctx.priorMemory, ctx.priorState);
-        mcpServers = buildOpenaiMcpServers(ctx);
-    }
-    catch (err) {
-        emit.error(err instanceof Error ? err.message : String(err));
-        return;
-    }
-    try {
-        for (const server of mcpServers) {
-            await server.connect();
-        }
-    }
-    catch (err) {
-        await closeAll(mcpServers);
-        emit.error(err instanceof Error ? err.message : String(err));
-        return;
-    }
-    try {
-        const maxTurns = snapshot.runtime?.maxTurns;
-        // `MCPServerStreamableHttp` IS an `MCPServer`; the Agent's `mcpServers` field
-        // is `MCPServer[]` — widen via the interface (no cast; structural subtype).
-        const servers = mcpServers;
-        const agent = new Agent({
-            name: "guuey-agent",
-            instructions,
-            mcpServers: servers,
-            ...(snapshot.model !== undefined ? { model: snapshot.model } : {}),
-        });
-        const stream = await run(agent, invoke.input, {
-            stream: true,
-            ...(maxTurns !== undefined ? { maxTurns } : {}),
-        });
-        // Drive the stream: each raw event crosses the wire as native.
-        for await (const ev of stream) {
-            emit.native(OPENAI_FRAMEWORK, toJson(ev));
-        }
-        // The runner THROWS `MaxTurnsExceededError` from `completed` AFTER the stream
-        // ends. Catch it specifically → feed the normalizer the `__host_error__`
-        // sentinel, then a terminal `done(.., "max_turns")`. Other throws → `error`.
-        try {
-            await stream.completed;
-        }
-        catch (err) {
-            if (err instanceof MaxTurnsExceededError) {
-                // The `__host_error__` sentinel — a fresh object literal so it is checked
-                // directly against `JsonValue` (the `native` payload type). Shape is the
-                // BINDING contract {@link HostErrorSentinel}.
-                emit.native(OPENAI_FRAMEWORK, {
-                    type: "__host_error__",
-                    code: "max_turns",
-                    message: err.message,
-                });
-                emit.done(finalText(stream), "max_turns");
-                return;
-            }
-            throw err;
-        }
-        emit.done(finalText(stream), "end_turn");
-    }
-    catch (err) {
-        emit.error(err instanceof Error ? err.message : String(err));
-    }
-    finally {
-        await closeAll(mcpServers);
-    }
-}
-/**
- * The agent's final text output, or `""` when absent (a tool-only turn, or a
- * turn cut short by `max_turns`). For the default text-output Agent `finalOutput`
- * is `string | undefined`.
- */
-function finalText(stream) {
-    const out = stream.finalOutput;
-    return typeof out === "string" ? out : "";
-}
-/**
- * Translate the framework-neutral resolved MCP map → connected-capable
- * `MCPServerStreamableHttp` instances. Each `http`/`sse` entry's `headers`
- * (typically `{ authorization: 'Bearer <token>' }`, from the federation
- * credential file or `${env.NAME}` substitution) ride on the underlying MCP
- * transport's `RequestInit.headers` via `requestInit`.
- *
- * The cred dir only yields `http`/`sse` servers (the Router resolves all
- * transport to one of those two); the `stdio` arm below is unreachable
- * defensive code — kept so a future schema change can't silently drop a server.
- */
-function buildOpenaiMcpServers(ctx) {
-    const resolved = resolveMcpServers(ctx);
-    const servers = [];
-    for (const [name, entry] of Object.entries(resolved)) {
-        servers.push(toOpenaiMcpServer(name, entry));
-    }
-    return servers;
-}
-/**
- * One resolved `SdkMcpServer` → an `MCPServerStreamableHttp`. Both `http` and
- * `sse` arms map to the StreamableHTTP server (the SDK's HTTP MCP transport);
- * the `stdio` arm is unreachable (`resolveMcpServers` rejects colocated before
- * we get here) — handled with a loud throw so a future schema change can't
- * silently drop a server.
- */
-function toOpenaiMcpServer(name, entry) {
-    if (entry.type === "stdio") {
-        throw new Error(`mcpServers["${name}"]: stdio (colocated) MCP is not supported on the OpenAI host path.`);
-    }
-    const headers = entry.headers;
-    return new MCPServerStreamableHttp({
-        url: entry.url,
-        name,
-        ...(headers && Object.keys(headers).length > 0 ? { requestInit: { headers } } : {}),
-        // `customDataExtractor` (agents 0.12+) is the ONLY channel that carries an
-        // MCP tool result's `structuredContent` onto the wire (`item.customData`)
-        // WITHOUT leaking it into model-visible text — without this, the ggui cache
-        // marker never reaches the normalizer and render metering goes blind.
-        // Mirrors the verified silverprotocol capture-agent wiring; the facet reads
-        // `item.customData.structuredContent`.
-        customDataExtractor: (context) => context.structuredContent !== undefined
-            ? { structuredContent: context.structuredContent }
-            : undefined,
-    });
-}
-/** Best-effort close of every connected MCP server (release the transport). */
-async function closeAll(servers) {
-    await Promise.allSettled(servers.map((s) => s.close()));
-}
-/**
- * Coerce one `RunStreamEvent` to the `JsonValue` the `native` event carries.
- * Stream events are plain JSON-serializable objects; the round-trip drops any
- * non-JSON surface and yields the exact shape the Router's normalizer parses off
- * the wire. Mirrors `run.ts`'s `toJson`.
- */
-function toJson(ev) {
-    return JSON.parse(JSON.stringify(ev));
-}

package/dist/run.d.ts

@@ -1,72 +0,0 @@
-/**
- * The testable core of the worker loop. `runInvoke` runs one invoke through the
- * Claude Agent SDK and emits each native `SDKMessage` to fd-3 as a `native`
- * WorkerEvent (the Router dispatches them to the matching normalizer). On the
- * SDK result message it emits `done`; on a throw or a framework-gate violation
- * it emits `error`. Emits `hello` FIRST (§8 item B) — the SDK-version handshake.
- *
- * `query` is injected so the loop is unit-testable without a live model. The
- * worker entrypoint (`index.ts`) passes the real `@anthropic-ai/claude-agent-sdk`
- * `query`.
- */
-import type { Options, SDKMessage } from "@anthropic-ai/claude-agent-sdk";
-import type { Emitter, Fs, HistoryMessage, Identity, JsonValue } from "@guuey/worker";
-import { buildOptions, type CredentialFile, type PriorMemoryRecord } from "./options.js";
-/**
- * The invoke this host consumes. A superset of `@guuey/worker`'s `Invoke`:
- * `priorMemory`/`priorState` are the §1.4 push-by-value context the worker reads
- * for the preamble (the Worker Protocol `Invoke` is EXTENDED with these in
- * Task 3; until then the worker loop parses them off the raw control line).
- */
-export interface HostInvoke {
-    input: string;
-    identity: Identity;
-    fs: Fs;
-    history: HistoryMessage[];
-    priorMemory?: PriorMemoryRecord[];
-    priorState?: JsonValue;
-}
-/** Per-process config the worker resolves once at boot. */
-export interface HostRuntime {
-    /**
-     * Anthropic API key — local-dev fallback when `baseUrl`+`authToken` are
-     * absent. One of (`baseUrl`+`authToken`) or `apiKey` must be provided;
-     * `buildOptions` throws at invoke time if neither is present.
-     */
-    apiKey?: string;
-    /**
-     * Loopback proxy base URL (hosted/broker mode). Task 8 injects this as
-     * `ANTHROPIC_BASE_URL` via `buildWorkerEnv`. When set together with
-     * `authToken`, the Claude CLI subprocess routes through the managed-LLM
-     * broker; the real API key is intentionally absent to prevent leaks.
-     */
-    baseUrl?: string;
-    /**
-     * Opaque session token for the loopback proxy (hosted/broker mode). Task 8
-     * injects this as `ANTHROPIC_AUTH_TOKEN`. Required when `baseUrl` is set.
-     */
-    authToken?: string;
-    /**
-     * Returns every credential the Router broker wrote to
-     * `<sessionDir>/.guuey/credentials/` this invoke. Injected so the run path
-     * stays pure (no disk access inside `runInvoke`).
-     */
-    listCredentials: () => Array<{
-        name: string;
-        cred: CredentialFile;
-    }>;
-}
-/** The `query` surface the loop needs — the real SDK `query` satisfies it. */
-export type QueryFn = (params: {
-    prompt: string;
-    options: Options;
-}) => AsyncIterable<SDKMessage>;
-/**
- * Run one invoke. Emits `native` per SDKMessage, `done` on the result, `error`
- * on a framework-gate violation or a thrown error. Never throws — every failure
- * path becomes an `error` event so the Router always sees a terminal event.
- */
-export declare function runInvoke(snapshot: {
-    framework?: string;
-} & Parameters<typeof buildOptions>[0], invoke: HostInvoke, runtime: HostRuntime, emit: Emitter, query: QueryFn): Promise<void>;
-//# sourceMappingURL=run.d.ts.map

package/dist/run.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAc,MAAM,eAAe,CAAC;AAClG,OAAO,EACL,YAAY,EAEZ,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAQtB;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,EAAE,EAAE,EAAE,CAAC;IACP,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,iBAAiB,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,SAAS,CAAC;CACxB;AAED,2DAA2D;AAC3D,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,eAAe,EAAE,MAAM,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACtE;AAED,8EAA8E;AAC9E,MAAM,MAAM,OAAO,GAAG,CAAC,MAAM,EAAE;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;CAClB,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;AA0BhC;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC,EACrE,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,WAAW,EACpB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,IAAI,CAAC,CAgDf"}