@hachej/boring-agent 0.1.103 → 0.1.105

package/dist/front/styles.css

@@ -6,6 +6,7 @@
     --font-sans: var(--font-sans);
     --font-mono: var(--font-mono);
     --color-amber-300: oklch(87.9% 0.169 91.605);
+    --color-amber-400: oklch(82.8% 0.189 84.429);
     --color-amber-500: oklch(76.9% 0.188 70.08);
     --color-amber-600: oklch(66.6% 0.179 58.318);
     --color-emerald-500: oklch(69.6% 0.17 162.48);
@@ -69,6 +70,9 @@
   .collapse {
     visibility: collapse;
   }
+  .invisible {
+    visibility: hidden;
+  }
   .visible {
     visibility: visible;
   }
@@ -2343,6 +2347,9 @@
   .dark\:text-amber-300:is([data-theme="dark"], [data-theme="dark"] *) {
     color: var(--color-amber-300);
   }
+  .dark\:text-amber-400:is([data-theme="dark"], [data-theme="dark"] *) {
+    color: var(--color-amber-400);
+  }
   .dark\:text-zinc-100:is([data-theme="dark"], [data-theme="dark"] *) {
     color: var(--color-zinc-100);
   }
@@ -2593,8 +2600,11 @@
   .top-4 {
     top: calc(var(--spacing) * 4);
   }
-  .top-\[50\%\] {
-    top: 50%;
+  .top-\[calc\(1rem\+env\(safe-area-inset-top\,0px\)\)\] {
+    top: calc(1rem + env(safe-area-inset-top,0px));
+  }
+  .top-\[max\(1rem\,env\(safe-area-inset-top\,0px\)\)\] {
+    top: max(1rem, env(safe-area-inset-top,0px));
   }
   .right-0 {
     right: 0px;
@@ -2605,11 +2615,14 @@
   .right-4 {
     right: calc(var(--spacing) * 4);
   }
+  .right-\[calc\(1rem\+env\(safe-area-inset-right\,0px\)\)\] {
+    right: calc(1rem + env(safe-area-inset-right,0px));
+  }
   .bottom-0 {
     bottom: 0px;
   }
-  .bottom-4 {
-    bottom: calc(var(--spacing) * 4);
+  .bottom-\[calc\(1rem\+env\(safe-area-inset-bottom\,0px\)\)\] {
+    bottom: calc(1rem + env(safe-area-inset-bottom,0px));
   }
   .left-0 {
     left: 0px;
@@ -2617,12 +2630,12 @@
   .left-2 {
     left: calc(var(--spacing) * 2);
   }
-  .left-4 {
-    left: calc(var(--spacing) * 4);
-  }
   .left-\[50\%\] {
     left: 50%;
   }
+  .left-\[calc\(1rem\+env\(safe-area-inset-left\,0px\)\)\] {
+    left: calc(1rem + env(safe-area-inset-left,0px));
+  }
   .z-50 {
     z-index: 50;
   }
@@ -2762,6 +2775,9 @@
   .h-10 {
     height: calc(var(--spacing) * 10);
   }
+  .h-\[100dvh\] {
+    height: 100dvh;
+  }
   .h-\[calc\(100\%-1px\)\] {
     height: calc(100% - 1px);
   }
@@ -2789,6 +2805,9 @@
   .max-h-\[300px\] {
     max-height: 300px;
   }
+  .max-h-\[calc\(100dvh-var\(--keyboard-inset\,0px\)\)\] {
+    max-height: calc(100dvh - var(--keyboard-inset,0px));
+  }
   .min-h-0 {
     min-height: 0px;
   }
@@ -2892,8 +2911,8 @@
     --tw-translate-x: -50%;
     translate: var(--tw-translate-x) var(--tw-translate-y);
   }
-  .translate-y-\[-50\%\] {
-    --tw-translate-y: -50%;
+  .translate-y-0 {
+    --tw-translate-y: 0px;
     translate: var(--tw-translate-x) var(--tw-translate-y);
   }
   .translate-y-\[calc\(-50\%_-_2px\)\] {
@@ -3398,6 +3417,9 @@
   .pt-3 {
     padding-top: calc(var(--spacing) * 3);
   }
+  .pt-\[env\(safe-area-inset-top\,0px\)\] {
+    padding-top: env(safe-area-inset-top,0px);
+  }
   .pr-2 {
     padding-right: calc(var(--spacing) * 2);
   }
@@ -3407,12 +3429,21 @@
   .pr-8 {
     padding-right: calc(var(--spacing) * 8);
   }
+  .pr-\[env\(safe-area-inset-right\,0px\)\] {
+    padding-right: env(safe-area-inset-right,0px);
+  }
   .pb-2 {
     padding-bottom: calc(var(--spacing) * 2);
   }
   .pb-3 {
     padding-bottom: calc(var(--spacing) * 3);
   }
+  .pb-\[calc\(1rem\+env\(safe-area-inset-bottom\,0px\)\)\] {
+    padding-bottom: calc(1rem + env(safe-area-inset-bottom,0px));
+  }
+  .pb-\[env\(safe-area-inset-bottom\,0px\)\] {
+    padding-bottom: env(safe-area-inset-bottom,0px);
+  }
   .pl-2 {
     padding-left: calc(var(--spacing) * 2);
   }
@@ -3422,6 +3453,9 @@
   .pl-8 {
     padding-left: calc(var(--spacing) * 8);
   }
+  .pl-\[env\(safe-area-inset-left\,0px\)\] {
+    padding-left: env(safe-area-inset-left,0px);
+  }
   .text-center {
     text-align: center;
   }
@@ -4221,12 +4255,19 @@
     border-radius: 0;
   }
   @media (width >= 40rem) {
+    .sm\:top-\[50\%\] {
+      top: 50%;
+    }
     .sm\:max-w-lg {
       max-width: var(--container-lg);
     }
     .sm\:max-w-sm {
       max-width: var(--container-sm);
     }
+    .sm\:translate-y-\[-50\%\] {
+      --tw-translate-y: -50%;
+      translate: var(--tw-translate-x) var(--tw-translate-y);
+    }
     .sm\:flex-row {
       flex-direction: row;
     }
@@ -4794,12 +4835,12 @@
   --secondary-foreground: oklch(0.985 0 0);
   --muted: oklch(0.269 0.006 285.885);
   --muted-foreground: oklch(0.708 0.01 286.073);
-  --accent: oklch(0.62 0.14 65);
-  --accent-foreground: oklch(0.12 0.004 285.823);
+  --accent: oklch(0.72 0.13 65);
+  --accent-foreground: oklch(0.18 0.02 65);
   --accent-soft: oklch(0.28 0.04 65);
   --border: oklch(0.269 0.006 285.885);
   --input: oklch(0.269 0.006 285.885);
-  --ring: oklch(0.62 0.14 65);
+  --ring: oklch(0.72 0.13 65);
   --canvas: oklch(0.12 0.004 285.823);
 }
 [data-boring-agent] {
@@ -4886,12 +4927,12 @@
   --secondary-foreground: var(--boring-secondary-foreground, oklch(0.985 0 0));
   --muted: var(--boring-muted, oklch(0.269 0.006 285.885));
   --muted-foreground: var(--boring-muted-foreground, oklch(0.708 0.01 286.073));
-  --accent: var(--boring-accent, oklch(0.62 0.14 65));
-  --accent-foreground: var(--boring-accent-foreground, oklch(0.12 0.004 285.823));
+  --accent: var(--boring-accent, oklch(0.72 0.13 65));
+  --accent-foreground: var(--boring-accent-foreground, oklch(0.18 0.02 65));
   --accent-soft: var(--boring-accent-soft, oklch(0.28 0.04 65));
   --border: var(--boring-border, oklch(0.269 0.006 285.885));
   --input: var(--boring-input, oklch(0.269 0.006 285.885));
-  --ring: var(--boring-ring, oklch(0.62 0.14 65));
+  --ring: var(--boring-ring, oklch(0.72 0.13 65));
   --canvas: var(--boring-canvas, oklch(0.12 0.004 285.823));
   --surface-chat: var(--boring-surface-chat, oklch(0.165 0.004 285.823));
   --boring-agent-user-bg: oklch(from var(--accent) l c h / 0.16);

package/dist/{harness-erpL2SER.d.ts → harness-Dcd08yKr.d.ts}

@@ -1,4 +1,4 @@
-import { n as SessionCtx, c as PiChatEvent, S as SessionStore } from './piChatEvent-g1nIBh44.js';
+import { n as SessionCtx, c as PiChatEvent, S as SessionStore } from './piChatEvent-iNSXiFQq.js';
 import { AgentSessionEvent, PromptOptions } from '@mariozechner/pi-coding-agent';
 
 interface TelemetrySink {

package/dist/{lease-K-EZhdL-.d.ts → lease-DffrPrQn.d.ts}

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import { A as AgentDefinitionErrorCode, o as AgentDeploymentErrorCode } from './piChatEvent-g1nIBh44.js';
+import { A as AgentDefinitionErrorCode, o as AgentDeploymentErrorCode } from './piChatEvent-iNSXiFQq.js';
 import { b as Workspace } from './sandbox-BMhut3kh.js';
 
 interface SandboxHandleRecord {

package/dist/{piChatEvent-g1nIBh44.d.ts → piChatEvent-iNSXiFQq.d.ts}

@@ -226,6 +226,7 @@ interface PiChatSnapshot {
     seq: number;
     status: PiChatStatus;
     activeTurnId?: string;
+    currentModel?: ChatModelSelection;
     messages: BoringChatMessage[];
     queue: {
         followUps: QueuedUserMessage[];
@@ -274,6 +275,10 @@ type PiChatEvent = {
     type: 'agent-start';
     seq: number;
     turnId: string;
+} | {
+    type: 'model-changed';
+    seq: number;
+    currentModel: NonNullable<PiChatSnapshot['currentModel']>;
 } | {
     type: 'agent-end';
     seq: number;

package/dist/{piChatSessionService-DugeRHzb.d.ts → piChatSessionService-DQSQ_kWZ.d.ts}

@@ -1,4 +1,4 @@
-import { a as SessionListOptions, b as SessionSummary, C as ChatModelSelection, P as PiChatSnapshot, c as PiChatEvent, d as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt } from './piChatEvent-g1nIBh44.js';
+import { a as SessionListOptions, b as SessionSummary, C as ChatModelSelection, P as PiChatSnapshot, c as PiChatEvent, d as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, h as CommandReceipt, i as StopPayload, j as StopReceipt } from './piChatEvent-iNSXiFQq.js';
 
 interface PiSessionRequestContext {
     workspaceId?: string;

package/dist/server/agent-host/testing/gatewayConformance.d.ts

@@ -1,11 +1,11 @@
-import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity } from '../../../errors-szpcDUFQ.js';
-import { A as AgentGatewayEffect } from '../../../types-BnjMLAd5.js';
-import '../../../piChatEvent-g1nIBh44.js';
+import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity } from '../../../errors-DH7C01Pm.js';
+import { A as AgentGatewayEffect } from '../../../types-BTsdaAQ2.js';
+import '../../../piChatEvent-iNSXiFQq.js';
 import 'zod';
 import 'fastify';
-import '../../../harness-erpL2SER.js';
+import '../../../harness-Dcd08yKr.js';
 import '@mariozechner/pi-coding-agent';
-import '../../../file-search-BXdSm-Yq.js';
+import '../../../file-search-qcD5zItr.js';
 import '../../../sandbox-BMhut3kh.js';
 import '@hachej/boring-bash/agent';
 import '@hachej/boring-sandbox/providers/node-workspace';

package/dist/server/agent-host/testing/gatewayConformance.js

@@ -5,7 +5,7 @@ import {
   AGENT_GATEWAY_ERROR_CODES,
   AgentGatewayError,
   AgentGatewayErrorCode
-} from "../../../chunk-7QM22DU7.js";
+} from "../../../chunk-6DRHERVK.js";
 import "../../../chunk-YGRQ4Q5P.js";
 import "../../../chunk-K25PK5EC.js";
 

package/dist/server/index.d.ts

@@ -1,21 +1,22 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionFileRef, C as ConfiguredAgentHostAgentSpec, h as AgentHostAgentSpec, i as RuntimeBundle, j as PiHarnessOptions, k as AgentMeteringSink, l as RuntimeFilesystemBinding, m as CreatedAgentHost, n as MeteringErrorLogger, o as ReadyStatusTracker, p as CreateAgentHostOptions, q as CompiledAgentHostAgentSpec, r as AgentRequestLedger, s as AgentEffectAdmission, t as AuthorizedEnvironmentIntent, u as AgentHostEnvironmentScope, v as ResolvedAgentRuntimeScope, w as AgentRequestKey, x as AgentRequestLedgerPrepareResult, y as AgentRequestFailure, z as AgentRequestLedgerRecord, D as AgentFleetCompiler, E as AgentRequestTarget, F as RuntimeFilesystemAccessDecision } from '../types-BnjMLAd5.js';
-export { A as AgentGatewayEffect, G as AgentHostDescription, H as AgentHostDirectProjectionOptions, I as AgentHostDispatcherRunInput, J as AgentHostEnvironmentLease, K as AgentHostHandle, L as LegacyDefaultAgentHostSpec, N as MeteringReleaseInput, O as MeteringReleaseReason, Q as MeteringReservationResult, S as MeteringReserveInput, T as MeteringRunKind, U as MeteringRunScope, V as MeteringRunStatus, X as MeteringSettleInput, Y as MeteringUsage, Z as MeteringUsageInput, _ as PI_PACKAGE_RESOURCE_FILTERS, $ as PiExtensionFactory, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as mergePiPackageSources, aa as normalizeMeteringUsage, ab as piPackageSourceKey } from '../types-BnjMLAd5.js';
+import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, a as PiPackageSource, R as RuntimeModeAdapter, b as RuntimeModeId, B as BuiltinRuntimeModeId, c as AgentRuntimeHostOperations, d as RuntimeBashStrategy, e as RuntimeFilesystemStrategy, M as ModeContext, f as WorkspaceProvisioningAdapter, g as AgentInstructionSource, C as ConfiguredAgentHostAgentSpec, h as AgentInstructionFileRef, i as AgentHostAgentSpec, j as RuntimeBundle, k as PiHarnessOptions, l as AgentMeteringSink, m as RuntimeFilesystemBinding, n as CreatedAgentHost, o as MeteringErrorLogger, p as ReadyStatusTracker, q as CreateAgentHostOptions, r as CompiledAgentHostAgentSpec, s as AgentRequestLedger, t as AgentEffectAdmission, u as AuthorizedEnvironmentIntent, v as AgentHostEnvironmentScope, w as ResolvedAgentRuntimeScope, x as AgentRequestKey, y as AgentRequestLedgerPrepareResult, z as AgentRequestFailure, D as AgentRequestLedgerRecord, E as AgentFleetCompiler, F as AgentRequestTarget, G as RuntimeFilesystemAccessDecision } from '../types-BTsdaAQ2.js';
+export { A as AgentGatewayEffect, H as AgentHostDescription, I as AgentHostDirectProjectionOptions, J as AgentHostDispatcherRunInput, K as AgentHostEnvironmentLease, L as AgentHostHandle, N as LegacyDefaultAgentHostSpec, O as MeteringReleaseInput, Q as MeteringReleaseReason, S as MeteringReservationResult, T as MeteringReserveInput, U as MeteringRunKind, V as MeteringRunScope, X as MeteringRunStatus, Y as MeteringSettleInput, Z as MeteringUsage, _ as MeteringUsageInput, $ as PI_PACKAGE_RESOURCE_FILTERS, a0 as PiExtensionFactory, a1 as PluginSkillSource, a2 as ResolvedEnvironmentScope, a3 as RuntimeFilesystemBindingOperations, a4 as RuntimeNodePackageSpec, a5 as RuntimeProvisioningContribution, a6 as RuntimePythonSpec, a7 as RuntimeTemplateContribution, a8 as WorkspaceProvisioningExecResult, a9 as compactPiPackages, aa as mergePiPackageSources, ab as normalizeMeteringUsage, ac as piPackageSourceKey } from '../types-BTsdaAQ2.js';
 import { d as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, c as Sandbox } from '../sandbox-BMhut3kh.js';
 export { h as RuntimeFilesystemCapability } from '../sandbox-BMhut3kh.js';
 import { b as RemoteWorkerHealthResponse, R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, c as RemoteWorkerExecRequest } from '../middleware-CaAEXpi5.js';
 export { d as REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY, e as REMOTE_WORKER_PROVIDER, f as REMOTE_WORKER_RUNTIME_CWD, g as RemoteWorkerErrorPayload, h as RemoteWorkerExecResponse, i as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, j as WORKER_REQUEST_ID_HEADER, k as WORKER_WORKSPACE_ID_HEADER, l as createAgentAuthMiddleware } from '../middleware-CaAEXpi5.js';
 import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
-import { F as SandboxHandleStore, k as CompiledAgentBundle, a as Sha256Digest, i as AgentDeployment, M as ShareEntryStore, y as ProviderId, c as CredentialFieldId, B as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, X as WorkspaceCredentialAuthorityVerifierV1, n as CredentialConsumerBindingRegistryV1, z as ProviderRegistryV1, Y as WorkspaceCredentialResolverV1, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../lease-K-EZhdL-.js';
-import { y as ErrorCode, n as SessionCtx, c as PiChatEvent, S as SessionStore, a as SessionListOptions, b as SessionSummary, P as PiChatSnapshot, d as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-g1nIBh44.js';
-import { x as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, i as AgentGatewayErrorDTO, p as AgentSessionSummary, o as AgentSessionStateSnapshot, l as AgentSessionConnection } from '../errors-szpcDUFQ.js';
-import { d as AgentActor, j as AgentEvent, v as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-erpL2SER.js';
-export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-erpL2SER.js';
+import { BwrapSandboxProviderOptions } from '@hachej/boring-sandbox/providers/bwrap';
+import { F as SandboxHandleStore, k as CompiledAgentBundle, a as Sha256Digest, i as AgentDeployment, M as ShareEntryStore, y as ProviderId, c as CredentialFieldId, B as ResolvedCredentialMaterialV1, d as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, X as WorkspaceCredentialAuthorityVerifierV1, n as CredentialConsumerBindingRegistryV1, z as ProviderRegistryV1, Y as WorkspaceCredentialResolverV1, P as ProviderCredentialRefV1, R as ResolvedCredentialLeaseV1 } from '../lease-DffrPrQn.js';
+import { y as ErrorCode, n as SessionCtx, c as PiChatEvent, S as SessionStore, a as SessionListOptions, b as SessionSummary, P as PiChatSnapshot, d as PromptPayload, e as PromptReceipt, F as FollowUpPayload, f as FollowUpReceipt, Q as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-iNSXiFQq.js';
+import { x as JsonValue, A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, i as AgentGatewayErrorDTO, p as AgentSessionSummary, o as AgentSessionStateSnapshot, l as AgentSessionConnection } from '../errors-DH7C01Pm.js';
+import { d as AgentActor, j as AgentEvent, v as TelemetrySink, s as AgentTool, D as AgentHarnessFactory, A as AgentHarness } from '../harness-Dcd08yKr.js';
+export { u as AgentConfig, E as AgentHarnessFactoryInput } from '../harness-Dcd08yKr.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { FastifyRequest, FastifyInstance, FastifyPluginCallback } from 'fastify';
-import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult } from '../piChatSessionService-DugeRHzb.js';
-import { c as WorkspaceAgentDirectRunInput, W as WorkspaceAgentDirectRunCallback, f as WorkspaceAgentDispatcherContext, e as WorkspaceAgentDispatcher, i as WorkspaceAgentGatewayBinding } from '../file-search-BXdSm-Yq.js';
-export { L as LeaseBoundWorkspaceAgent } from '../file-search-BXdSm-Yq.js';
+import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult } from '../piChatSessionService-DQSQ_kWZ.js';
+import { c as WorkspaceAgentDirectRunInput, W as WorkspaceAgentDirectRunCallback, f as WorkspaceAgentDispatcherContext, e as WorkspaceAgentDispatcher, i as WorkspaceAgentGatewayBinding } from '../file-search-qcD5zItr.js';
+export { L as LeaseBoundWorkspaceAgent } from '../file-search-qcD5zItr.js';
 import { SettingsManager } from '@mariozechner/pi-coding-agent';
 import '@hachej/boring-bash/agent';
 import '@hachej/boring-sandbox/providers/node-workspace';
@@ -221,6 +222,7 @@ declare function createProviderRuntimeModeAdapter(options: ProviderRuntimeModeAd
 declare const sandboxRuntimeHostOperations: AgentRuntimeHostOperations;
 interface SandboxRuntimeModeOptions {
     readonly sandboxHandleStore?: SandboxHandleStore;
+    readonly bwrap?: BwrapSandboxProviderOptions;
 }
 /** Built-in runtime layout root without exposing provider package constants to consumers. */
 declare function resolveBuiltinRuntimeLayoutRoot(mode: BuiltinRuntimeModeId, workspaceRoot: string): string;
@@ -297,10 +299,11 @@ interface TrustedAgentInstructionAppendix {
 interface TrustedAuthoredAgentPolicy {
     readonly fallbackLabel?: string;
     /**
-     * Workspace-relative authored instruction sources for this agent, supplied
-     * by the trusted composer that actually knows where they live.
+     * Authored instruction sources for this agent as host absolute paths,
+     * supplied by the trusted composer that actually knows where they live.
+     * Addressing them against a served workspace root is a per-request concern.
      */
-    readonly instructionFiles?: readonly AgentInstructionFileRef[];
+    readonly instructionSources?: readonly AgentInstructionSource[];
     readonly instructionAppendices?: readonly TrustedAgentInstructionAppendix[];
     readonly plugins?: readonly {
         readonly name: string;
@@ -364,22 +367,6 @@ interface DiscoveredAgentPackageDescriptor {
 interface LoadConfiguredAgentFleetOptions {
     /** Plugin-manager scan descriptors injected by the workspace/CLI boot layer. */
     readonly discoveredPackages: readonly DiscoveredAgentPackageDescriptor[];
-    /**
-     * Root of the workspace the `user` filesystem serves, or `null` when the
-     * host resolves a DIFFERENT root per request (core, the CLI hub) and so has
-     * no single one at fleet-composition time.
-     *
-     * Required, because published `instructionFiles` are addressed relative to
-     * it and only the caller knows it. It is NOT derivable from the discovered
-     * package roots: a fleet can be composed from packages that live outside
-     * the workspace root, and guessing produced well-formed paths that
-     * resolved to nothing.
-     *
-     * `null` is not a soft option — it makes the host structurally unable to
-     * publish a ref it cannot guarantee, which is the honest answer for
-     * per-workspace roots.
-     */
-    readonly workspaceRoot: string | null;
     /** Path to `.agents/factory/fleet.yaml`. */
     readonly fleetConfigPath: string;
     /** Path to `.agents/factory/policy.yaml` (read for `models.seats` tiers). */
@@ -392,7 +379,7 @@ interface LoadConfiguredAgentFleetOptions {
     /** Overridable for tests; defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
 }
-type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED' | 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
+type FleetLoaderDiagnosticCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_PERSONA_INVALID' | 'AGENT_FLEET_SEAT_SKILL_DIGEST_MISMATCH' | 'AGENT_DEFINITION_ID_CONFLICT' | 'AGENT_DEFINITION_UNSEATED'>;
 interface FleetLoaderDiagnostic {
     readonly seat?: string;
     readonly agentTypeId: string;
@@ -428,6 +415,40 @@ declare class FleetConfigError extends Error {
  */
 declare function loadConfiguredAgentFleet(options: LoadConfiguredAgentFleetOptions): Promise<LoadConfiguredAgentFleetResult>;
 
+type InstructionRefWithholdingCode = Extract<ErrorCode, 'AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE'>;
+interface WithheldInstructionRef {
+    readonly code: InstructionRefWithholdingCode;
+    /** Host absolute path of the authored source that could not be addressed. */
+    readonly absolutePath: string;
+    readonly message: string;
+}
+interface ResolvedInstructionFileRefs {
+    readonly refs: readonly AgentInstructionFileRef[];
+    readonly withheld: readonly WithheldInstructionRef[];
+}
+/**
+ * Addresses authored instruction sources against the workspace root a SINGLE
+ * request is served from, which is the only moment a multi-workspace host
+ * (the CLI hub, core) knows one — composition time sees a fleet shared by
+ * every workspace (gh-1189).
+ *
+ * Publication is deterministic and fails closed: a ref is emitted only when
+ * the source canonically resolves inside the served root AND composes a path
+ * the client-side openable-resource guard accepts. Anything else is withheld
+ * with the stable `AGENT_FLEET_SEAT_INSTRUCTIONS_PATH_UNPUBLISHABLE` code, so
+ * the invariant from #1176 holds: a rendered link always resolves.
+ *
+ * Canonicalization (not lexical containment) on BOTH sides is the point:
+ * dotfile managers make a symlinked `.agents` ordinary, and a lexical check
+ * would call `~/project/.agents -> ~/dotfiles/agents` "inside the workspace"
+ * and publish a link the `user` filesystem cannot open.
+ */
+declare function resolveAgentInstructionFileRefs(input: {
+    readonly sources: readonly AgentInstructionSource[] | undefined;
+    /** Root the `user` filesystem serves for THIS request, when the host resolved one. */
+    readonly workspaceRoot: string | null | undefined;
+}): Promise<ResolvedInstructionFileRefs>;
+
 declare const LEGACY_DEFAULT_AGENT_FLEET: readonly AgentHostAgentSpec[];
 interface ResolveDefaultAgentFleetOptions {
     /**
@@ -437,16 +458,6 @@ interface ResolveDefaultAgentFleetOptions {
     readonly repositoryRoot?: string;
     /** Asset-manager scan results supplied by the workspace/CLI boot layer. */
     readonly discoveredPackages?: readonly DiscoveredAgentPackageDescriptor[];
-    /**
-     * Root of the workspace the `user` filesystem serves, or `null` when the
-     * host resolves one per request. Explicit rather than defaulted, because it
-     * is a DIFFERENT root from `repositoryRoot` in every multi-workspace host —
-     * the two only coincide in the single-root dogfood/playground case.
-     * Personas outside it are not published as openable instruction refs (see
-     * `loadConfiguredAgentFleet`): a well-formed path the workbench cannot open
-     * is worse than no link.
-     */
-    readonly workspaceRoot: string | null;
     /** Overridable for tests; defaults to `process.env`. */
     readonly env?: NodeJS.ProcessEnv;
 }
@@ -1104,7 +1115,7 @@ interface AgentHostRuntime {
     readonly effectAdmission: AgentEffectAdmission;
     readonly activity: AgentSessionActivityIndex;
     readonly shutdownGraceMs: number;
-    listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim): Promise<readonly SessionSummary[]>;
+    listSessionSummaries(agentTypeId: string, scope: AuthorizedAgentScope, claim: VerifiedAgentScopeClaim, options?: SessionListOptions): Promise<readonly SessionSummary[]>;
     isDraining(): boolean;
     assertOpen(): void;
     verify(scope: AuthorizedAgentScope): Promise<VerifiedAgentScopeClaim>;
@@ -1475,4 +1486,4 @@ declare function createInMemoryCredentialBackendV1(entries: readonly InMemoryCre
 
 declare function withResolvedCredential<T>(resolver: WorkspaceCredentialResolverV1, workspace: AuthorizedWorkspaceCredentialScopeV1, ref: ProviderCredentialRefV1, fn: (lease: ResolvedCredentialLeaseV1) => T | Promise<T>): Promise<T>;
 
-export { AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, LEGACY_DEFAULT_AGENT_FLEET, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, MeteringErrorLogger, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };
+export { AgentDirectoryCompilerError, type AgentDirectoryCompilerErrorCode, type AgentDirectoryCompilerPublicErrorCode, AgentEffectAdmission, AgentFleetCompilationError, AgentFleetCompilationErrorCode, AgentFleetCompiler, type AgentFleetPluginBindingContract, AgentHarnessFactory, AgentHostAgentSpec, type AgentHostEnvironmentHttpProjectionOptions, AgentHostEnvironmentScope, AgentInstructionFileRef, AgentInstructionSource, AgentMeteringSink, AgentRequestKey, AgentRequestLedger, AgentRequestLedgerPrepareResult, AgentRequestLedgerRecord, AgentRuntimeHostOperations, AuthoredAgentMaterializationError, type AuthoredAgentMaterializationErrorCode, type AuthoredAgentSourceV1, AuthorizedAgentScope, AuthorizedEnvironmentIntent, type AuthorizedSessionRunDetails, BuiltinRuntimeModeId, CompiledAgentHostAgentSpec, ConfiguredAgentHostAgentSpec, CreateAgentHostOptions, type CreateConfiguredAgentHostAgentSpecInput, type CreateStandaloneAgentHostAppOptions, type CreateValidatingAgentFleetCompilerOptions, CreatedAgentHost, type CredentialStoreBackendV1, DEFAULT_PI_RESOURCE_DIGEST_LIMITS, DEFAULT_READONLY_WORKSPACE_PATHS, type DeploymentSnapshotProvider, type DeploymentSnapshotRecipe, type DeploymentSnapshotResult, type DeploymentSnapshotStatus, type DiscoveredAgentPackageDescriptor, EmbeddedAgentGateway, type FakeAuthorityVerifierGrantV1, FleetConfigError, type FleetConfigErrorCode, type FleetLoaderDiagnostic, type FleetLoaderDiagnosticCode, type FleetSeatBinding, type FleetSkillBinding, type HostSideCredentialResolverOptionsV1, InMemoryAgentRequestLedger, type InMemoryCredentialBackendEntryV1, LEGACY_DEFAULT_AGENT_FLEET, type LoadConfiguredAgentFleetOptions, type LoadConfiguredAgentFleetResult, MANAGED_AGENT_MCP_DELIVERY_RULE, MANAGED_AGENT_MCP_ORIGIN_SURFACE, type ManagedAgentArtifact, type ManagedAgentArtifactCandidate, type ManagedAgentArtifactRef, type ManagedAgentBoundRunnerWorkspace, type ManagedAgentCollectArtifactsInput, type ManagedAgentDelegateInput, type ManagedAgentDelegateProgress, type ManagedAgentDelegateRequestContext, type ManagedAgentDelegateResult, type ManagedAgentDelegateRunInput, type ManagedAgentDelegateRunner, type ManagedAgentDelegateStatus, type ManagedAgentDelegateStatusResult, ManagedAgentMcpDelegateController, type ManagedAgentMcpDelegateOptions, ManagedAgentMcpError, type ManagedAgentMcpHttpHandlerOptions, type ManagedAgentMcpServerOptions, type ManagedAgentSafeError, type ManagedAgentWorkspaceResolutionInput, type MaterializeAgentDirectoryInput, MeteringErrorLogger, ModeContext, type ModelTierCandidate, PiHarnessOptions, PiPackageSource, type PiResourceDigestInput, type PiResourceDigestLimits, type PiResourceSet, type ProvisionRuntimeWorkspaceOptions, ProvisionWorkspaceRuntimeOptions, type ProvisioningArtifactRequest, RUNTIME_FILESYSTEM_BINDING_DUPLICATE_CODE, RUNTIME_READONLY_FILESYSTEM_POLICY_INVALID_CODE, RemoteWorkerClient, RemoteWorkerClientError, type RemoteWorkerClientOptions, RemoteWorkerExecRequest, type RemoteWorkerModeAdapterOptions, RemoteWorkerWorkspaceOp, RemoteWorkerWorkspaceResult, type ResolveDefaultAgentFleetOptions, type ResolvedAgent, type ResolvedAgentDigestInput, ResolvedAgentRuntimeScope, type ResolvedInstructionFileRefs, RuntimeBundle, type RuntimeEnvContribution, type RuntimeEnvContributionContext, RuntimeFilesystemAccessDecision, RuntimeFilesystemBinding, RuntimeFilesystemBindingConfigurationError, RuntimeModeAdapter, RuntimeModeId, type RuntimeReadonlyFilesystemPolicy, RuntimeReadonlyFilesystemPolicyError, type RuntimeWorkspaceProvisioningResult, type SandboxRuntimeModeOptions, type ShareEntryMcpResourceOptions, type SkillMetadataFrontmatter, SqliteAgentRequestLedger, TrustedAgentCompositionError, type TrustedAgentInstructionAppendix, type TrustedAuthoredAgentPolicy, UV_SETUP_COMMANDS, VerifiedAgentScopeClaim, type WithheldInstructionRef, type WorkspaceAgentDispatcherBinding, type WorkspaceAgentDispatcherResolveOptions, type WorkspaceAgentDispatcherResolver, WorkspaceProvisioningAdapter, WorkspaceProvisioningResult, applyCspHeaders, autoDetectMode, buildDeploymentSnapshotRecipe, compileAgentDirectory, compilePersonaPackageDirectory, constantTimeTokenEqual, createAgentHost, createBlaxelSandboxModeAdapter, createBoundWorkspaceAgentDispatcher, createConfiguredAgentHostAgentSpec, createDirectModeAdapter, createEnvironmentProvisioningFingerprint, createFakeAuthorityVerifierV1, createHostSideCredentialResolverV1, createInMemoryCredentialBackendV1, createLocalModeAdapter, createManagedAgentMcpDelegateController, createManagedAgentMcpHttpHandler, createManagedAgentMcpServer, createPiResourceDigestFence, createPiResourceDigestInput, createPluginDiagnosticsTool, createProviderRuntimeModeAdapter, createRemoteWorkerModeAdapter, createRemoteWorkerSandbox, createRemoteWorkerWorkspace, createResolvedAgentDigest, createResolvedRuntimeScopeIdentity, createResourceSettingsManager, createSandboxRuntimeModeAdapter, createStandaloneAgentHostApp, createUserFilesystemBinding, createValidatingAgentFleetCompiler, createVercelSandboxModeAdapter, decodeBytesFromWorker, deepLinkRoutes, digestPiResourceInputs, encodeBytesForWorker, hasBwrap, loadConfiguredAgentFleet, materializeAgentDirectory, mergeRuntimeFilesystemBindings, normalizeRuntimeReadonlyFilesystemPolicy, parseSkillMetadataFrontmatter, prepareDeploymentSnapshot, projectAuthorizedSessionRunDetails, provisionRuntimeWorkspace, provisionWorkspaceRuntime, registerAgentHostEnvironmentRoutes, registerShareEntryResources, resolveAgentDeployment, resolveAgentInstructionFileRefs, resolveBuiltinRuntimeLayoutRoot, resolveDefaultAgentFleet, resolveMode, resolveRuntimeReadonlyFilesystemAccess, resolveWorkspaceRoot, sandboxRuntimeHostOperations, shareResourceUri, withResolvedCredential, withRuntimeEnvContributions };

package/dist/server/index.js

@@ -80,6 +80,7 @@ import {
   registerAgentHostEnvironmentRoutes,
   registerShareEntryResources,
   resolveAgentDeployment,
+  resolveAgentInstructionFileRefs,
   resolveBuiltinRuntimeLayoutRoot,
   resolveDefaultAgentFleet,
   resolveMode,
@@ -89,18 +90,18 @@ import {
   shareResourceUri,
   withResolvedCredential,
   withRuntimeEnvContributions
-} from "../chunk-6WKQ4FC4.js";
+} from "../chunk-LFN45QDZ.js";
 import {
   PI_PACKAGE_RESOURCE_FILTERS,
   compactPiPackages,
   createResourceSettingsManager,
   mergePiPackageSources,
   piPackageSourceKey
-} from "../chunk-TW7G33QH.js";
+} from "../chunk-F2OJI2LX.js";
 import "../chunk-JNEKOVMJ.js";
 import "../chunk-4IQ4HHBG.js";
 import "../chunk-WSQ5QNIY.js";
-import "../chunk-7QM22DU7.js";
+import "../chunk-6DRHERVK.js";
 import "../chunk-YGRQ4Q5P.js";
 import "../chunk-K25PK5EC.js";
 export {
@@ -190,6 +191,7 @@ export {
   registerAgentHostEnvironmentRoutes,
   registerShareEntryResources,
   resolveAgentDeployment,
+  resolveAgentInstructionFileRefs,
   resolveBuiltinRuntimeLayoutRoot,
   resolveDefaultAgentFleet,
   resolveMode,

package/dist/server/worker/index.js

@@ -2,12 +2,12 @@ import {
   REMOTE_WORKER_EXCLUSIVE_BINARY_CREATE_CAPABILITY,
   WORKER_INTERNAL_TOKEN_HEADER,
   constantTimeTokenEqual
-} from "../../chunk-6WKQ4FC4.js";
-import "../../chunk-TW7G33QH.js";
+} from "../../chunk-LFN45QDZ.js";
+import "../../chunk-F2OJI2LX.js";
 import "../../chunk-JNEKOVMJ.js";
 import "../../chunk-4IQ4HHBG.js";
 import "../../chunk-WSQ5QNIY.js";
-import "../../chunk-7QM22DU7.js";
+import "../../chunk-6DRHERVK.js";
 import "../../chunk-YGRQ4Q5P.js";
 import "../../chunk-K25PK5EC.js";