@hachej/boring-agent 0.1.42 → 0.1.43

package/dist/server/index.js

@@ -13,7 +13,7 @@ import {
   StopPayloadSchema,
   extractToolUiMetadata,
   sanitizeToolUiMetadata2 as sanitizeToolUiMetadata
-} from "../chunk-VQ7VSSSX.js";
+} from "../chunk-YUDMSYAO.js";
 
 // src/server/sandbox/direct/createDirectSandbox.ts
 import { spawn } from "child_process";
@@ -305,10 +305,13 @@ function validateWorkspaceRoot(workspaceRoot) {
 }
 function buildBwrapArgs(workspaceRoot, options) {
   validateWorkspaceRoot(workspaceRoot);
+  const network = options?.network ?? "shared";
   const args = [
     "--unshare-all",
-    "--share-net",
+    ...network === "shared" ? ["--share-net"] : [],
     "--die-with-parent",
+    ...options?.newSession === false ? [] : ["--new-session"],
+    ...options?.dropAllCapabilities ? ["--cap-drop", "ALL"] : [],
     "--tmpfs",
     "/",
     "--proc",
@@ -953,10 +956,45 @@ async function buildGlobalToolMounts(workspaceRoot) {
   }
   return args;
 }
+function positiveInteger(value, name) {
+  if (value === void 0) return void 0;
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return Math.floor(value);
+}
+function buildResourceLimitCommands(limits) {
+  if (!limits) return [];
+  const commands = [];
+  const cpuSeconds = positiveInteger(limits.cpuSeconds, "resourceLimits.cpuSeconds");
+  const fileSizeBlocks = positiveInteger(limits.fileSizeBlocks, "resourceLimits.fileSizeBlocks");
+  const maxProcesses = positiveInteger(limits.maxProcesses, "resourceLimits.maxProcesses");
+  const openFiles = positiveInteger(limits.openFiles, "resourceLimits.openFiles");
+  const virtualMemoryKb = positiveInteger(limits.virtualMemoryKb, "resourceLimits.virtualMemoryKb");
+  if (cpuSeconds !== void 0) commands.push(`ulimit -t ${cpuSeconds}`);
+  if (fileSizeBlocks !== void 0) commands.push(`ulimit -f ${fileSizeBlocks}`);
+  if (maxProcesses !== void 0) commands.push(`ulimit -u ${maxProcesses}`);
+  if (openFiles !== void 0) commands.push(`ulimit -n ${openFiles}`);
+  if (virtualMemoryKb !== void 0) commands.push(`ulimit -v ${virtualMemoryKb}`);
+  return commands;
+}
+function buildCommandArgs(cmd, limits) {
+  const limitCommands = buildResourceLimitCommands(limits);
+  if (limitCommands.length === 0) return ["bash", "-c", cmd];
+  return [
+    "bash",
+    "-c",
+    `${limitCommands.join("\n")}
+exec bash -c "$1"`,
+    "boring-exec",
+    cmd
+  ];
+}
 function createBwrapSandbox(opts = {}) {
+  const sandboxOptions = opts;
   let workspace = null;
-  let hostWorkspaceRoot = opts.hostWorkspaceRoot;
-  let runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
+  let hostWorkspaceRoot = sandboxOptions.hostWorkspaceRoot;
+  let runtimeContext = sandboxOptions.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
   return {
     id: "bwrap",
     placement: "server",
@@ -967,8 +1005,8 @@ function createBwrapSandbox(opts = {}) {
     },
     async init(ctx) {
       workspace = ctx.workspace;
-      hostWorkspaceRoot = opts.hostWorkspaceRoot ?? getNodeWorkspaceHostRoot(ctx.workspace) ?? ctx.workspace.root;
-      runtimeContext = opts.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
+      hostWorkspaceRoot = sandboxOptions.hostWorkspaceRoot ?? getNodeWorkspaceHostRoot(ctx.workspace) ?? ctx.workspace.root;
+      runtimeContext = sandboxOptions.runtimeContext ?? { runtimeCwd: SANDBOX_HOME2 };
       await assertBwrapAvailable();
     },
     async exec(cmd, opts2) {
@@ -981,12 +1019,14 @@ function createBwrapSandbox(opts = {}) {
       const workspaceRoot = hostWorkspaceRoot ?? workspace.root;
       const sandboxCwd = computeSandboxCwd(workspaceRoot, runtimeContext.runtimeCwd, opts2?.cwd);
       const postWorkspaceArgs = await buildGlobalToolMounts(workspaceRoot);
-      const baseArgs = buildBwrapArgs(workspaceRoot, { postWorkspaceArgs });
+      const baseArgs = buildBwrapArgs(workspaceRoot, {
+        postWorkspaceArgs,
+        network: sandboxOptions.network,
+        dropAllCapabilities: sandboxOptions.dropAllCapabilities
+      });
       const args = [
         ...withSandboxCwd(baseArgs, sandboxCwd),
-        "bash",
-        "-c",
-        cmd
+        ...buildCommandArgs(cmd, sandboxOptions.resourceLimits)
       ];
       return await new Promise((resolve11, reject) => {
         const child = spawn2("bwrap", args, {
@@ -1817,6 +1857,492 @@ async function prepareVercelDeploymentSnapshot(opts) {
   });
 }
 
+// src/server/runtime/createServerFileSearch.ts
+var DEFAULT_LIMIT = 500;
+var MAX_LIMIT = 5e3;
+var SEARCH_TIMEOUT_MS = 5e3;
+var SEARCH_MAX_OUTPUT_BYTES = 256e3;
+function shellQuote2(value) {
+  return `'${value.replaceAll("'", "'\\''")}'`;
+}
+function normalizeLimit(limit) {
+  if (typeof limit !== "number" || !Number.isFinite(limit)) {
+    return DEFAULT_LIMIT;
+  }
+  const normalized = Math.trunc(limit);
+  if (normalized <= 0) return DEFAULT_LIMIT;
+  return Math.min(normalized, MAX_LIMIT);
+}
+function buildFindArgs(glob) {
+  const isPathShaped = glob.includes("/") || glob.includes("**");
+  if (!isPathShaped) {
+    return `-iname ${shellQuote2(glob)}`;
+  }
+  let translated = glob.replaceAll("**", "*");
+  translated = translated.replace(/^\/+/, "");
+  if (!translated.startsWith("*")) {
+    translated = `*${translated}`;
+  }
+  return `-ipath ${shellQuote2(translated)}`;
+}
+function createServerFileSearch(workspace, sandbox) {
+  return {
+    async search(glob, limit = DEFAULT_LIMIT) {
+      const safeLimit = normalizeLimit(limit);
+      const command = [
+        "find .",
+        "-maxdepth 10",
+        "\\( -path './.boring-agent' -o -path './.git' -o -path './node_modules' \\) -prune -o",
+        buildFindArgs(glob),
+        "-type f",
+        "-print",
+        `| head -n ${safeLimit}`
+      ].join(" ");
+      const { stdout, exitCode } = await sandbox.exec(command, {
+        cwd: workspace.root,
+        timeoutMs: SEARCH_TIMEOUT_MS,
+        maxOutputBytes: SEARCH_MAX_OUTPUT_BYTES
+      });
+      if (exitCode !== 0) {
+        throw new Error(`file-search failed: exit ${exitCode}`);
+      }
+      const decoded = new TextDecoder().decode(stdout);
+      return decoded.split("\n").map((line) => line.replace(/\r$/, "")).filter((line) => line.length > 0).map((line) => line.replace(/^\.\//, ""));
+    }
+  };
+}
+
+// src/server/sandbox/remote-worker/protocol.ts
+var REMOTE_WORKER_RUNTIME_CWD = "/workspace";
+var REMOTE_WORKER_PROVIDER = "remote-worker";
+var WORKER_INTERNAL_TOKEN_HEADER = "x-boring-internal-token";
+var WORKER_WORKSPACE_ID_HEADER = "x-boring-workspace-id";
+var WORKER_REQUEST_ID_HEADER = "x-boring-request-id";
+
+// src/server/sandbox/remote-worker/createRemoteWorkerSandbox.ts
+function filteredEnv(env) {
+  if (!env) return void 0;
+  return Object.fromEntries(
+    Object.entries(env).filter((entry) => typeof entry[1] === "string")
+  );
+}
+function createRemoteWorkerSandbox(client) {
+  return {
+    id: REMOTE_WORKER_PROVIDER,
+    placement: "remote",
+    provider: REMOTE_WORKER_PROVIDER,
+    capabilities: ["exec"],
+    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+    async init() {
+      await client.health();
+    },
+    async exec(cmd, opts = {}) {
+      const request = {
+        cmd,
+        cwd: opts.cwd,
+        env: filteredEnv(opts.env),
+        timeoutMs: opts.timeoutMs,
+        maxOutputBytes: opts.maxOutputBytes
+      };
+      const startedAt = Date.now();
+      const heartbeat = opts.onHeartbeat ? setInterval(() => opts.onHeartbeat?.(Date.now() - startedAt), 1e3) : null;
+      try {
+        const result = await client.exec(request, { signal: opts.signal });
+        opts.onStdout?.(result.stdout);
+        opts.onStderr?.(result.stderr);
+        return result;
+      } finally {
+        if (heartbeat) clearInterval(heartbeat);
+      }
+    }
+  };
+}
+
+// src/server/sandbox/remote-worker/workerClient.ts
+import { timingSafeEqual } from "crypto";
+var DEFAULT_REQUEST_TIMEOUT_MS = 15e3;
+var DEFAULT_EXEC_TIMEOUT_MS = 3e4;
+var DEFAULT_EXEC_REQUEST_GRACE_MS = 1e4;
+var RemoteWorkerClientError = class extends Error {
+  statusCode;
+  code;
+  details;
+  constructor(message, opts) {
+    super(message);
+    this.name = "RemoteWorkerClientError";
+    this.statusCode = opts.statusCode;
+    this.code = opts.code ?? "remote_worker_error";
+    this.details = opts.details;
+  }
+};
+function requireNonEmpty(value, label) {
+  const trimmed = value.trim();
+  if (!trimmed) throw new Error(`${label} is required for ${REMOTE_WORKER_PROVIDER} mode`);
+  return trimmed;
+}
+function normalizeBaseUrl(value) {
+  return requireNonEmpty(value, "BORING_WORKER_BASE_URL").replace(/\/+$/, "");
+}
+function positiveInteger2(value, fallback, label) {
+  if (value === void 0) return fallback;
+  if (!Number.isFinite(value) || value <= 0) throw new Error(`${label} must be a positive integer`);
+  return Math.trunc(value);
+}
+function encodeWorkspaceId(workspaceId) {
+  return encodeURIComponent(requireNonEmpty(workspaceId, "workspaceId"));
+}
+function bytesToBase64(bytes) {
+  return Buffer.from(bytes).toString("base64");
+}
+function base64ToBytes(value) {
+  return new Uint8Array(Buffer.from(value, "base64"));
+}
+function makeHeaders(opts) {
+  const headers = new Headers();
+  headers.set(WORKER_INTERNAL_TOKEN_HEADER, requireNonEmpty(opts.token, "BORING_WORKER_INTERNAL_TOKEN"));
+  headers.set(WORKER_WORKSPACE_ID_HEADER, requireNonEmpty(opts.workspaceId, "workspaceId"));
+  if (opts.requestId) headers.set(WORKER_REQUEST_ID_HEADER, opts.requestId);
+  if (opts.contentType) headers.set("content-type", opts.contentType);
+  return headers;
+}
+async function parseError(response) {
+  let payload;
+  try {
+    payload = await response.json();
+  } catch {
+  }
+  return new RemoteWorkerClientError(
+    payload?.error?.message ?? `remote worker request failed (${response.status})`,
+    {
+      statusCode: payload?.error?.statusCode ?? response.status,
+      code: payload?.error?.code,
+      details: payload?.error?.details
+    }
+  );
+}
+var RemoteWorkerClient = class {
+  baseUrl;
+  token;
+  workspaceId;
+  requestId;
+  fetchImpl;
+  requestTimeoutMs;
+  execTimeoutMs;
+  execRequestGraceMs;
+  constructor(opts) {
+    this.baseUrl = normalizeBaseUrl(opts.baseUrl);
+    this.token = requireNonEmpty(opts.token, "BORING_WORKER_INTERNAL_TOKEN");
+    this.workspaceId = requireNonEmpty(opts.workspaceId, "workspaceId");
+    this.requestId = opts.requestId;
+    this.fetchImpl = opts.fetchImpl ?? fetch;
+    this.requestTimeoutMs = positiveInteger2(opts.requestTimeoutMs, DEFAULT_REQUEST_TIMEOUT_MS, "requestTimeoutMs");
+    this.execTimeoutMs = positiveInteger2(opts.execTimeoutMs, DEFAULT_EXEC_TIMEOUT_MS, "execTimeoutMs");
+    this.execRequestGraceMs = positiveInteger2(opts.execRequestGraceMs, DEFAULT_EXEC_REQUEST_GRACE_MS, "execRequestGraceMs");
+  }
+  timeoutError(timeoutMs) {
+    return new RemoteWorkerClientError("remote worker request timed out", {
+      statusCode: 504,
+      code: ErrorCode.enum.REMOTE_WORKER_TIMEOUT,
+      details: { timeoutMs, retryable: true }
+    });
+  }
+  abortedError() {
+    return new RemoteWorkerClientError("remote worker request aborted", {
+      statusCode: 499,
+      code: ErrorCode.enum.ABORTED
+    });
+  }
+  async fetchWithTimeout(url, init, timeoutMs) {
+    const controller = new AbortController();
+    let timedOut = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    const upstreamSignal = init.signal;
+    const abortFromUpstream = () => controller.abort();
+    if (upstreamSignal?.aborted) {
+      clearTimeout(timer);
+      throw this.abortedError();
+    }
+    upstreamSignal?.addEventListener("abort", abortFromUpstream, { once: true });
+    try {
+      return await this.fetchImpl(url, { ...init, signal: controller.signal });
+    } catch (error) {
+      if (timedOut) throw this.timeoutError(timeoutMs);
+      if (upstreamSignal?.aborted) throw this.abortedError();
+      throw error;
+    } finally {
+      clearTimeout(timer);
+      upstreamSignal?.removeEventListener("abort", abortFromUpstream);
+    }
+  }
+  async health() {
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/health`, {
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId })
+    }, this.requestTimeoutMs);
+    if (!response.ok) throw await parseError(response);
+  }
+  async workspace(op) {
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/fs`, {
+      method: "POST",
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId, contentType: "application/json" }),
+      body: JSON.stringify(op)
+    }, this.requestTimeoutMs);
+    if (!response.ok) throw await parseError(response);
+    return await response.json();
+  }
+  async exec(input, opts = {}) {
+    const timeoutMs = (input.timeoutMs ?? this.execTimeoutMs) + this.execRequestGraceMs;
+    const response = await this.fetchWithTimeout(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/exec`, {
+      method: "POST",
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId, contentType: "application/json" }),
+      body: JSON.stringify(input),
+      signal: opts.signal
+    }, timeoutMs);
+    if (!response.ok) throw await parseError(response);
+    const body = await response.json();
+    return {
+      stdout: base64ToBytes(body.stdoutBase64),
+      stderr: base64ToBytes(body.stderrBase64),
+      exitCode: body.exitCode,
+      durationMs: body.durationMs,
+      truncated: body.truncated,
+      stdoutEncoding: body.stdoutEncoding,
+      stderrEncoding: body.stderrEncoding
+    };
+  }
+  watch(onEvent, onError) {
+    const controller = new AbortController();
+    void this.consumeEvents(controller.signal, onEvent).catch((error) => {
+      if (!controller.signal.aborted) onError?.(error instanceof Error ? error : new Error(String(error)));
+    });
+    return { close: () => controller.abort() };
+  }
+  async consumeEvents(signal, onEvent) {
+    const response = await this.fetchImpl(`${this.baseUrl}/internal/workspaces/${encodeWorkspaceId(this.workspaceId)}/fs/events`, {
+      headers: makeHeaders({ token: this.token, workspaceId: this.workspaceId, requestId: this.requestId }),
+      signal
+    });
+    if (!response.ok) throw await parseError(response);
+    if (!response.body) throw new RemoteWorkerClientError("remote worker event stream missing body", { statusCode: 502 });
+    const reader = response.body.getReader();
+    const decoder2 = new TextDecoder();
+    let buffer = "";
+    try {
+      for (; ; ) {
+        const { done, value } = await reader.read();
+        if (done) {
+          if (signal.aborted) return;
+          throw new RemoteWorkerClientError("remote worker event stream closed", {
+            statusCode: 502,
+            code: ErrorCode.enum.REMOTE_WORKER_STREAM_CLOSED
+          });
+        }
+        buffer += decoder2.decode(value, { stream: true });
+        let boundary = buffer.indexOf("\n\n");
+        while (boundary >= 0) {
+          const frame = buffer.slice(0, boundary);
+          buffer = buffer.slice(boundary + 2);
+          this.handleSseFrame(frame, onEvent);
+          boundary = buffer.indexOf("\n\n");
+        }
+      }
+    } finally {
+      reader.releaseLock();
+    }
+  }
+  handleSseFrame(frame, onEvent) {
+    let eventName = "message";
+    const dataLines = [];
+    for (const line of frame.split("\n")) {
+      if (line.startsWith(":")) continue;
+      if (line.startsWith("event:")) eventName = line.slice("event:".length).trim();
+      if (line.startsWith("data:")) dataLines.push(line.slice("data:".length).trimStart());
+    }
+    if (eventName !== "change" || dataLines.length === 0) return;
+    const payload = JSON.parse(dataLines.join("\n"));
+    onEvent(payload.event);
+  }
+};
+function encodeBytesForWorker(bytes) {
+  return bytesToBase64(bytes);
+}
+function decodeBytesFromWorker(value) {
+  return base64ToBytes(value);
+}
+function constantTimeTokenEqual(a, b) {
+  if (!a || !b) return false;
+  const aBytes = Buffer.from(a);
+  const bBytes = Buffer.from(b);
+  if (aBytes.length !== bBytes.length) return false;
+  return timingSafeEqual(aBytes, bBytes);
+}
+
+// src/server/workspace/createRemoteWorkerWorkspace.ts
+function expectContent(result) {
+  if ("content" in result && typeof result.content === "string") return result.content;
+  throw new Error("remote worker returned invalid file content response");
+}
+function expectData(result) {
+  if ("dataBase64" in result && typeof result.dataBase64 === "string") return decodeBytesFromWorker(result.dataBase64);
+  throw new Error("remote worker returned invalid binary response");
+}
+function expectStat(result) {
+  if ("stat" in result && result.stat) return result.stat;
+  throw new Error("remote worker returned invalid stat response");
+}
+function expectEntries(result) {
+  if ("entries" in result && Array.isArray(result.entries)) return result.entries;
+  throw new Error("remote worker returned invalid readdir response");
+}
+function createRemoteWatcher(client) {
+  const listeners = /* @__PURE__ */ new Map();
+  let stream = null;
+  let reconnectTimer = null;
+  let closed = false;
+  const clearReconnectTimer = () => {
+    if (!reconnectTimer) return;
+    clearTimeout(reconnectTimer);
+    reconnectTimer = null;
+  };
+  const scheduleReconnect = () => {
+    if (closed || listeners.size === 0 || reconnectTimer) return;
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      ensureStream();
+    }, 1e3);
+  };
+  const handleStreamEnd = () => {
+    stream = null;
+    for (const options of [...listeners.values()]) {
+      try {
+        options?.onControlEvent?.({ type: "resync-required", reason: "remote_worker_stream_closed" });
+      } catch {
+      }
+    }
+    scheduleReconnect();
+  };
+  const ensureStream = () => {
+    if (stream || closed || listeners.size === 0) return;
+    clearReconnectTimer();
+    stream = client.watch((event) => {
+      for (const listener of [...listeners.keys()]) {
+        try {
+          listener(event);
+        } catch {
+        }
+      }
+    }, handleStreamEnd);
+  };
+  return {
+    subscribe(listener, options) {
+      if (closed) return () => {
+      };
+      listeners.set(listener, options);
+      ensureStream();
+      return () => {
+        listeners.delete(listener);
+        if (listeners.size === 0) {
+          clearReconnectTimer();
+          stream?.close();
+          stream = null;
+        }
+      };
+    },
+    close() {
+      if (closed) return;
+      closed = true;
+      listeners.clear();
+      clearReconnectTimer();
+      stream?.close();
+      stream = null;
+    }
+  };
+}
+function createRemoteWorkerWorkspace(client) {
+  let watcher = null;
+  return {
+    root: REMOTE_WORKER_RUNTIME_CWD,
+    runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+    fsCapability: "best-effort",
+    watch() {
+      watcher ??= createRemoteWatcher(client);
+      return watcher;
+    },
+    async readFile(path4) {
+      return expectContent(await client.workspace({ op: "readFile", path: path4 }));
+    },
+    async readBinaryFile(path4) {
+      return expectData(await client.workspace({ op: "readBinaryFile", path: path4 }));
+    },
+    async writeFile(path4, data) {
+      await client.workspace({ op: "writeFile", path: path4, data });
+    },
+    async writeBinaryFile(path4, data) {
+      await client.workspace({ op: "writeBinaryFile", path: path4, dataBase64: encodeBytesForWorker(data) });
+    },
+    async readFileWithStat(path4) {
+      const result = await client.workspace({ op: "readFileWithStat", path: path4 });
+      if ("content" in result && "stat" in result) return { content: result.content, stat: result.stat };
+      throw new Error("remote worker returned invalid readFileWithStat response");
+    },
+    async writeFileWithStat(path4, data) {
+      return expectStat(await client.workspace({ op: "writeFileWithStat", path: path4, data }));
+    },
+    async writeBinaryFileWithStat(path4, data) {
+      return expectStat(await client.workspace({ op: "writeBinaryFileWithStat", path: path4, dataBase64: encodeBytesForWorker(data) }));
+    },
+    async unlink(path4) {
+      await client.workspace({ op: "unlink", path: path4 });
+    },
+    async readdir(path4) {
+      return expectEntries(await client.workspace({ op: "readdir", path: path4 }));
+    },
+    async stat(path4) {
+      return expectStat(await client.workspace({ op: "stat", path: path4 }));
+    },
+    async mkdir(path4, opts) {
+      await client.workspace({ op: "mkdir", path: path4, recursive: opts?.recursive });
+    },
+    async rename(from, to) {
+      await client.workspace({ op: "rename", from, to });
+    }
+  };
+}
+
+// src/server/runtime/modes/remote-worker.ts
+function requireOption(value, name) {
+  const trimmed = value?.trim();
+  if (!trimmed) throw new Error(`${name} is required for remote-worker mode`);
+  return trimmed;
+}
+function createRemoteWorkerModeAdapter(opts = {}) {
+  return {
+    id: REMOTE_WORKER_PROVIDER,
+    workspaceFsCapability: "best-effort",
+    async create(ctx) {
+      const workspaceId = requireOption(ctx.workspaceId ?? ctx.sessionId, "workspaceId");
+      const client = new RemoteWorkerClient({
+        baseUrl: requireOption(opts.baseUrl ?? getEnv("BORING_WORKER_BASE_URL"), "BORING_WORKER_BASE_URL"),
+        token: requireOption(opts.token ?? getEnv("BORING_WORKER_INTERNAL_TOKEN"), "BORING_WORKER_INTERNAL_TOKEN"),
+        workspaceId,
+        requestId: ctx.requestId,
+        fetchImpl: opts.fetchImpl
+      });
+      const workspace = createRemoteWorkerWorkspace(client);
+      const sandbox = createRemoteWorkerSandbox(client);
+      await sandbox.init?.({ workspace, sessionId: ctx.sessionId });
+      return {
+        runtimeContext: { runtimeCwd: REMOTE_WORKER_RUNTIME_CWD },
+        workspace,
+        sandbox,
+        fileSearch: createServerFileSearch(workspace, sandbox)
+      };
+    }
+  };
+}
+
 // src/server/http/routes/file.ts
 import { dirname as dirname5, extname as extname2, relative as relative4 } from "path/posix";
 
@@ -2851,7 +3377,7 @@ function cloneStat(stat11) {
 function cloneEntries(entries) {
   return entries.map((entry) => ({ name: entry.name, kind: entry.kind }));
 }
-function shellQuote2(value) {
+function shellQuote3(value) {
   return `'${value.replace(/'/g, `'\\''`)}'`;
 }
 async function runJson(sandbox, script) {
@@ -2931,7 +3457,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
   async function assertRealPathWithinSandboxRoot(sandboxPath) {
     const isWithinRoot = await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote2(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote2(sandboxPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=fs.realpathSync(process.argv[1]); const target=fs.realpathSync(process.argv[2]); const rel=path.relative(root,target); process.stdout.write(JSON.stringify(rel===''||(!rel.startsWith('..')&&!path.isAbsolute(rel))))`)} ${shellQuote3(VERCEL_SANDBOX_REMOTE_ROOT)} ${shellQuote3(sandboxPath)}`
     );
     if (!isWithinRoot) {
       throw Object.assign(new Error("resolved path escapes workspace root"), { code: EPERM_CODE2 });
@@ -2940,7 +3466,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
   async function isSandboxSymlink(sandboxPath) {
     return await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote2(sandboxPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); process.stdout.write(JSON.stringify(fs.lstatSync(process.argv[1]).isSymbolicLink()))`)} ${shellQuote3(sandboxPath)}`
     );
   }
   async function listDescendantPaths(relPath, sandboxPath) {
@@ -2960,7 +3486,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
     }
     return await runJson(
       remote,
-      `node -e ${shellQuote2(`const fs=require('fs'); const path=require('path'); const root=process.argv[1]; const relRoot=process.argv[2]; function walk(abs,rel){ const s=fs.statSync(abs); if(!s.isDirectory()) return []; const out=[]; for (const entry of fs.readdirSync(abs,{withFileTypes:true})) { const childRel=rel==='.'?entry.name:rel+'/'+entry.name; out.push(childRel); if(entry.isDirectory()) out.push(...walk(path.join(abs,entry.name),childRel)); } return out; } process.stdout.write(JSON.stringify(walk(root,relRoot)))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(relPath)}`
+      `node -e ${shellQuote3(`const fs=require('fs'); const path=require('path'); const root=process.argv[1]; const relRoot=process.argv[2]; function walk(abs,rel){ const s=fs.statSync(abs); if(!s.isDirectory()) return []; const out=[]; for (const entry of fs.readdirSync(abs,{withFileTypes:true})) { const childRel=rel==='.'?entry.name:rel+'/'+entry.name; out.push(childRel); if(entry.isDirectory()) out.push(...walk(path.join(abs,entry.name),childRel)); } return out; } process.stdout.write(JSON.stringify(walk(root,relRoot)))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(relPath)}`
     );
   }
   return {
@@ -3053,7 +3579,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const version = metadataVersion;
       const result = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); const content=fs.readFileSync(p,'utf8'); process.stdout.write(JSON.stringify({content,stat:{size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}}))`)} ${shellQuote2(sandboxPath)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); const content=fs.readFileSync(p,'utf8'); process.stdout.write(JSON.stringify({content,stat:{size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}}))`)} ${shellQuote3(sandboxPath)}`
       );
       if (metadataVersion === version) {
         statCache.set(sandboxPath, result.stat);
@@ -3081,7 +3607,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
           };
         })() : await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
         statCache.set(sandboxPath, writtenStat2);
         emitChange({ op: "write", path: relPath, mtimeMs: writtenStat2.mtimeMs });
@@ -3090,7 +3616,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const encoded = payload.toString("base64");
       const writtenStat = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(encoded)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(encoded)}`
       );
       invalidateMetadataCache();
       statCache.set(sandboxPath, writtenStat);
@@ -3119,7 +3645,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
           };
         })() : await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
         statCache.set(sandboxPath, writtenStat2);
         emitChange({ op: "write", path: relPath, mtimeMs: writtenStat2.mtimeMs });
@@ -3128,7 +3654,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const encoded = payload.toString("base64");
       const writtenStat = await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)} ${shellQuote2(encoded)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const data=Buffer.from(process.argv[2],'base64'); fs.writeFileSync(p,data); const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)} ${shellQuote3(encoded)}`
       );
       invalidateMetadataCache();
       statCache.set(sandboxPath, writtenStat);
@@ -3144,7 +3670,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       await assertRealPathWithinSandboxRoot(sandboxPath);
       const descendantPaths = await isSandboxSymlink(sandboxPath) ? [] : await listDescendantPaths(relPath, sandboxPath);
       if (remote.fs?.rm) await remote.fs.rm(sandboxPath, { recursive: true, force: false });
-      else await runShell(remote, `rm -r -- ${shellQuote2(sandboxPath)}`);
+      else await runShell(remote, `rm -r -- ${shellQuote3(sandboxPath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "unlink", path: relPath });
@@ -3162,7 +3688,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
         kind: entry.isDirectory() ? "dir" : "file"
       })) : await runJson(
         remote,
-        `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const entries=fs.readdirSync(p,{withFileTypes:true}).map((e)=>({name:e.name,kind:e.isDirectory()?'dir':'file'})); process.stdout.write(JSON.stringify(entries))`)} ${shellQuote2(sandboxPath)}`
+        `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const entries=fs.readdirSync(p,{withFileTypes:true}).map((e)=>({name:e.name,kind:e.isDirectory()?'dir':'file'})); process.stdout.write(JSON.stringify(entries))`)} ${shellQuote3(sandboxPath)}`
       );
       if (metadataVersion === version) {
         readdirCache.set(sandboxPath, mappedEntries);
@@ -3185,7 +3711,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       } else {
         mappedStat = await runJson(
           remote,
-          `node -e ${shellQuote2(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote2(sandboxPath)}`
+          `node -e ${shellQuote3(`const fs=require('fs'); const p=process.argv[1]; const s=fs.statSync(p); process.stdout.write(JSON.stringify({size:s.size,mtimeMs:s.mtimeMs,kind:s.isDirectory()?'dir':'file'}))`)} ${shellQuote3(sandboxPath)}`
         );
       }
       if (metadataVersion === version) {
@@ -3196,9 +3722,9 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
     async mkdir(relPath, opts) {
       const sandboxPath = toSandboxPath(relPath);
       if (remote.fs?.mkdir) await remote.fs.mkdir(sandboxPath, { recursive: opts?.recursive ?? false });
-      else if (opts?.recursive) await runShell(remote, `mkdir -p -- ${shellQuote2(sandboxPath)}`);
+      else if (opts?.recursive) await runShell(remote, `mkdir -p -- ${shellQuote3(sandboxPath)}`);
       else if (remote.mkDir) await remote.mkDir(sandboxPath);
-      else await runShell(remote, `mkdir -- ${shellQuote2(sandboxPath)}`);
+      else await runShell(remote, `mkdir -- ${shellQuote3(sandboxPath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "mkdir", path: relPath });
@@ -3207,7 +3733,7 @@ function createVercelSandboxWorkspace(sandbox, workspaceOpts = {}) {
       const fromSandboxPath = toSandboxPath(fromRelPath);
       const toSandboxAbsolutePath = toSandboxPath(toRelPath2);
       if (remote.fs?.rename) await remote.fs.rename(fromSandboxPath, toSandboxAbsolutePath);
-      else await runShell(remote, `mv -- ${shellQuote2(fromSandboxPath)} ${shellQuote2(toSandboxAbsolutePath)}`);
+      else await runShell(remote, `mv -- ${shellQuote3(fromSandboxPath)} ${shellQuote3(toSandboxAbsolutePath)}`);
       invalidateMetadataCache();
       workspaceOpts.onMutation?.();
       emitChange({ op: "rename", path: toRelPath2, oldPath: fromRelPath });
@@ -4061,61 +4587,6 @@ import { spawnSync } from "child_process";
 // src/server/runtime/modes/direct.ts
 import { mkdir as mkdir8 } from "fs/promises";
 
-// src/server/runtime/createServerFileSearch.ts
-var DEFAULT_LIMIT = 500;
-var MAX_LIMIT = 5e3;
-var SEARCH_TIMEOUT_MS = 5e3;
-var SEARCH_MAX_OUTPUT_BYTES = 256e3;
-function shellQuote3(value) {
-  return `'${value.replaceAll("'", "'\\''")}'`;
-}
-function normalizeLimit(limit) {
-  if (typeof limit !== "number" || !Number.isFinite(limit)) {
-    return DEFAULT_LIMIT;
-  }
-  const normalized = Math.trunc(limit);
-  if (normalized <= 0) return DEFAULT_LIMIT;
-  return Math.min(normalized, MAX_LIMIT);
-}
-function buildFindArgs(glob) {
-  const isPathShaped = glob.includes("/") || glob.includes("**");
-  if (!isPathShaped) {
-    return `-iname ${shellQuote3(glob)}`;
-  }
-  let translated = glob.replaceAll("**", "*");
-  translated = translated.replace(/^\/+/, "");
-  if (!translated.startsWith("*")) {
-    translated = `*${translated}`;
-  }
-  return `-ipath ${shellQuote3(translated)}`;
-}
-function createServerFileSearch(workspace, sandbox) {
-  return {
-    async search(glob, limit = DEFAULT_LIMIT) {
-      const safeLimit = normalizeLimit(limit);
-      const command = [
-        "find .",
-        "-maxdepth 10",
-        "\\( -path './.boring-agent' -o -path './.git' -o -path './node_modules' \\) -prune -o",
-        buildFindArgs(glob),
-        "-type f",
-        "-print",
-        `| head -n ${safeLimit}`
-      ].join(" ");
-      const { stdout, exitCode } = await sandbox.exec(command, {
-        cwd: workspace.root,
-        timeoutMs: SEARCH_TIMEOUT_MS,
-        maxOutputBytes: SEARCH_MAX_OUTPUT_BYTES
-      });
-      if (exitCode !== 0) {
-        throw new Error(`file-search failed: exit ${exitCode}`);
-      }
-      const decoded = new TextDecoder().decode(stdout);
-      return decoded.split("\n").map((line) => line.replace(/\r$/, "")).filter((line) => line.length > 0).map((line) => line.replace(/^\.\//, ""));
-    }
-  };
-}
-
 // src/server/workspace/provision.ts
 import { cp as cp2 } from "fs/promises";
 async function copyTemplate(templatePath, workspaceRoot) {
@@ -6190,6 +6661,11 @@ var INFOMANIAK_PROVIDER = "infomaniak";
 var INFOMANIAK_API_BASE = "https://api.infomaniak.com";
 var DEFAULT_CUSTOM_MODEL_MAX_TOKENS = 16384;
 var DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW = 2e5;
+var DEFAULT_INFOMANIAK_MODELS = [
+  "moonshotai/Kimi-K2.6",
+  "nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B-FP8",
+  "Qwen/Qwen3.5-122B-A10B-FP8"
+];
 function clean(value) {
   const trimmed = value?.trim();
   return trimmed && trimmed.length > 0 ? trimmed : void 0;
@@ -6213,6 +6689,19 @@ function readModelInput(name) {
   const parsed = raw.split(",").map((part) => part.trim()).filter((part) => part === "text" || part === "image");
   return parsed.length > 0 ? parsed : ["text"];
 }
+function readMaxTokensField(name, fallback = "max_completion_tokens") {
+  const raw = clean(getEnv(name));
+  return raw === "max_tokens" || raw === "max_completion_tokens" ? raw : fallback;
+}
+function buildOpenAICompletionsCompat(envPrefix, defaults = {}) {
+  return {
+    supportsStore: readBoolean(`${envPrefix}_SUPPORTS_STORE`, defaults.supportsStore ?? false),
+    supportsDeveloperRole: readBoolean(`${envPrefix}_SUPPORTS_DEVELOPER_ROLE`, defaults.supportsDeveloperRole ?? true),
+    supportsReasoningEffort: readBoolean(`${envPrefix}_SUPPORTS_REASONING_EFFORT`, defaults.supportsReasoningEffort ?? true),
+    supportsUsageInStreaming: readBoolean(`${envPrefix}_SUPPORTS_USAGE_IN_STREAMING`, defaults.supportsUsageInStreaming ?? true),
+    maxTokensField: readMaxTokensField(`${envPrefix}_MAX_TOKENS_FIELD`, defaults.maxTokensField)
+  };
+}
 function readApiKeyEnv(candidates) {
   for (const candidate of candidates) {
     const envName = clean(candidate);
@@ -6225,31 +6714,23 @@ function buildOpenAICompatibleProviderConfig(opts) {
     baseUrl: opts.baseUrl,
     apiKey: opts.apiKeyEnv,
     api: "openai-completions",
-    models: [
-      {
-        id: opts.modelId,
-        name: opts.modelName ?? opts.modelId,
-        api: "openai-completions",
-        reasoning: readBoolean(`${opts.envPrefix}_REASONING`, true),
-        input: readModelInput(`${opts.envPrefix}_INPUT`),
-        cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
-        contextWindow: readPositiveInt(
-          `${opts.envPrefix}_CONTEXT_WINDOW`,
-          DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW
-        ),
-        maxTokens: readPositiveInt(
-          `${opts.envPrefix}_MAX_TOKENS`,
-          DEFAULT_CUSTOM_MODEL_MAX_TOKENS
-        ),
-        compat: {
-          supportsStore: false,
-          supportsDeveloperRole: true,
-          supportsReasoningEffort: true,
-          supportsUsageInStreaming: true,
-          maxTokensField: "max_completion_tokens"
-        }
-      }
-    ]
+    models: opts.models.map((model) => ({
+      id: model.id,
+      name: model.name ?? model.id,
+      api: "openai-completions",
+      reasoning: readBoolean(`${opts.envPrefix}_REASONING`, true),
+      input: readModelInput(`${opts.envPrefix}_INPUT`),
+      cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 },
+      contextWindow: readPositiveInt(
+        `${opts.envPrefix}_CONTEXT_WINDOW`,
+        DEFAULT_CUSTOM_MODEL_CONTEXT_WINDOW
+      ),
+      maxTokens: readPositiveInt(
+        `${opts.envPrefix}_MAX_TOKENS`,
+        DEFAULT_CUSTOM_MODEL_MAX_TOKENS
+      ),
+      compat: buildOpenAICompletionsCompat(opts.envPrefix, opts.compatDefaults)
+    }))
   };
 }
 function readInfomaniakBaseUrl() {
@@ -6259,25 +6740,46 @@ function readInfomaniakBaseUrl() {
   if (!productId) return void 0;
   return `${INFOMANIAK_API_BASE}/2/ai/${productId}/openai/v1`;
 }
+function readInfomaniakModelIds() {
+  const configured = clean(getEnv("BORING_AGENT_INFOMANIAK_MODELS"))?.split(",").map((part) => part.trim()).filter(Boolean);
+  const ids = configured?.length ? configured : [...DEFAULT_INFOMANIAK_MODELS];
+  const legacyModel = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL"));
+  if (legacyModel && !ids.includes(legacyModel)) ids.push(legacyModel);
+  return Array.from(new Set(ids));
+}
 function readInfomaniakProvider() {
-  const modelId = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL")) ?? clean(getEnv("BORING_AGENT_DEFAULT_MODEL_ID"));
+  const modelIds = readInfomaniakModelIds();
+  const defaultModelId = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL")) ?? clean(getEnv("BORING_AGENT_DEFAULT_MODEL_ID")) ?? modelIds[0];
   const baseUrl = readInfomaniakBaseUrl();
   const apiKeyEnv = readApiKeyEnv([
     clean(getEnv("BORING_AGENT_INFOMANIAK_API_KEY_ENV")) ?? "",
     "INFOMANIAK_API_TOKEN",
     "BORING_AGENT_INFOMANIAK_API_KEY"
   ]);
-  if (!modelId || !baseUrl || !apiKeyEnv) return void 0;
+  if (!defaultModelId || !baseUrl || !apiKeyEnv) return void 0;
   const provider = clean(getEnv("BORING_AGENT_INFOMANIAK_PROVIDER")) ?? INFOMANIAK_PROVIDER;
+  const modelName = clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL_NAME"));
+  const models = modelIds.map((id) => {
+    const model = { id };
+    if (id === defaultModelId && modelName) model.name = modelName;
+    return model;
+  });
+  if (!models.some((model) => model.id === defaultModelId)) {
+    models.push({ id: defaultModelId, name: modelName });
+  }
   return {
     provider,
-    model: { provider, id: modelId },
+    models: models.map((model) => ({ provider, id: model.id })),
+    defaultModel: { provider, id: defaultModelId },
     config: buildOpenAICompatibleProviderConfig({
-      modelId,
-      modelName: clean(getEnv("BORING_AGENT_INFOMANIAK_MODEL_NAME")),
+      models,
       apiKeyEnv,
       baseUrl,
-      envPrefix: "BORING_AGENT_INFOMANIAK"
+      envPrefix: "BORING_AGENT_INFOMANIAK",
+      // Infomaniak's OpenAI-compatible chat endpoint rejects OpenAI's newer
+      // `developer` role (surfacing as "400 Unexpected message role"). Hosts
+      // can opt back in with BORING_AGENT_INFOMANIAK_SUPPORTS_DEVELOPER_ROLE=1.
+      compatDefaults: { supportsDeveloperRole: false, supportsReasoningEffort: false }
     })
   };
 }
@@ -6290,12 +6792,15 @@ function readCustomProvider() {
     "BORING_AGENT_CUSTOM_MODEL_API_KEY"
   ]);
   if (!provider || !modelId || !baseUrl || !apiKeyEnv) return void 0;
+  const modelName = clean(getEnv("BORING_AGENT_CUSTOM_MODEL_NAME"));
+  const model = { id: modelId };
+  if (modelName) model.name = modelName;
   return {
     provider,
-    model: { provider, id: modelId },
+    models: [{ provider, id: modelId }],
+    defaultModel: { provider, id: modelId },
     config: buildOpenAICompatibleProviderConfig({
-      modelId,
-      modelName: clean(getEnv("BORING_AGENT_CUSTOM_MODEL_NAME")),
+      models: [model],
       apiKeyEnv,
       baseUrl,
       envPrefix: "BORING_AGENT_CUSTOM_MODEL"
@@ -6309,7 +6814,7 @@ function registerConfiguredModelProviders(registry) {
     if (!provider) continue;
     if (seen.has(provider.provider)) continue;
     registry.registerProvider(provider.provider, provider.config);
-    registered.push(provider.model);
+    registered.push(...provider.models);
     seen.add(provider.provider);
   }
   return registered;
@@ -6337,7 +6842,7 @@ function readConfiguredDefaultModel() {
   if (explicitProvider && explicitId) {
     return { provider: explicitProvider, id: explicitId };
   }
-  return readPiSettingsDefaultModel() ?? readInfomaniakProvider()?.model ?? readCustomProvider()?.model;
+  return readPiSettingsDefaultModel() ?? readInfomaniakProvider()?.defaultModel ?? readCustomProvider()?.defaultModel;
 }
 
 // src/server/piPackages.ts
@@ -7191,10 +7696,10 @@ function vercelBashOps(sandbox, opts = {}) {
   return {
     exec(command, cwd, { onData, signal, timeout, env }) {
       const effectiveEnv = opts.mergeEnv ? opts.mergeEnv(env) : env;
-      const filteredEnv = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
+      const filteredEnv2 = effectiveEnv ? Object.fromEntries(Object.entries(effectiveEnv).filter((e) => e[1] != null)) : void 0;
       return sandbox.exec(command, {
         cwd,
-        env: filteredEnv,
+        env: filteredEnv2,
         signal,
         timeoutMs: timeout ? timeout * 1e3 : void 0,
         onStdout: (chunk) => onData(Buffer.from(chunk)),
@@ -7578,8 +8083,7 @@ function adaptPiTool(piTool) {
 }
 function buildFilesystemAgentTools(bundle) {
   const cwd = bundle.workspace.root;
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
-  if (bundle.sandbox.provider === "vercel-sandbox") {
+  if (bundle.sandbox.provider === "vercel-sandbox" || bundle.sandbox.provider === "remote-worker") {
     return [
       adaptPiTool(createReadToolDefinition(cwd, { operations: vercelReadOps(bundle.workspace) })),
       adaptPiTool(createWriteToolDefinition(cwd, { operations: vercelWriteOps(bundle.workspace) })),
@@ -7589,6 +8093,7 @@ function buildFilesystemAgentTools(bundle) {
       adaptPiTool(createLsToolDefinition(cwd, { operations: vercelLsOps(bundle.workspace) }))
     ];
   }
+  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   const ops = boundFs(storageRoot, { runtimeRoot: cwd });
   return [
     adaptPiTool(createReadToolDefinition(cwd, { operations: ops.read })),
@@ -7724,9 +8229,9 @@ function directSpawnHook(workspaceRoot, runtime) {
 }
 var VERCEL_SAFE_DEFAULT_PATH = "/vercel/runtimes/node24/bin:/vercel/runtimes/node22/bin:/usr/local/bin:/usr/bin:/bin";
 function bashOptionsForMode(bundle, runtime) {
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   switch (bundle.sandbox.provider) {
     case "vercel-sandbox":
+    case "remote-worker":
       return {
         operations: vercelBashOps(bundle.sandbox, {
           // The pi bash tool's env may include the host process env. Never
@@ -7735,16 +8240,20 @@ function bashOptionsForMode(bundle, runtime) {
           mergeEnv: () => mergeRuntimeEnv(runtime, { PATH: VERCEL_SAFE_DEFAULT_PATH })
         })
       };
-    case "bwrap":
+    case "bwrap": {
+      const storageRoot = getRuntimeBundleStorageRoot(bundle);
       return {
         operations: createLocalBashOperations(),
         spawnHook: bwrapSpawnHook(storageRoot, runtime)
       };
-    default:
+    }
+    default: {
+      const storageRoot = getRuntimeBundleStorageRoot(bundle);
       return {
         operations: createLocalBashOperations(),
         spawnHook: directSpawnHook(storageRoot, runtime)
       };
+    }
   }
 }
 function isRuntimeReady(readiness) {
@@ -7921,9 +8430,21 @@ var DEFAULT_BUFFER_SIZE = 1e3;
 function createFsEventBroadcaster(watcher, opts = {}) {
   const bufferSize = opts.bufferSize ?? DEFAULT_BUFFER_SIZE;
   const buffer = [];
-  const listeners = /* @__PURE__ */ new Set();
+  const listeners = /* @__PURE__ */ new Map();
   let nextSeq = 1;
   let closed = false;
+  let gapAfterSeq = null;
+  const handleControlEvent = (event) => {
+    if (closed || event.type !== "resync-required") return;
+    gapAfterSeq = nextSeq - 1;
+    buffer.length = 0;
+    for (const { onResyncRequired } of [...listeners.values()]) {
+      try {
+        onResyncRequired?.();
+      } catch {
+      }
+    }
+  };
   const watcherUnsub = watcher.subscribe((change) => {
     if (closed) return;
     const env = {
@@ -7934,13 +8455,13 @@ function createFsEventBroadcaster(watcher, opts = {}) {
     };
     buffer.push(env);
     if (buffer.length > bufferSize) buffer.shift();
-    for (const l of [...listeners]) {
+    for (const l of [...listeners.keys()]) {
       try {
         l(env);
       } catch {
       }
     }
-  });
+  }, { onControlEvent: handleControlEvent });
   return {
     subscribe(listener, sopts) {
       if (closed) {
@@ -7951,13 +8472,13 @@ function createFsEventBroadcaster(watcher, opts = {}) {
       let resyncRequired = false;
       if (typeof sopts?.lastSeenSeq === "number" && sopts.lastSeenSeq > 0) {
         const head = buffer.length > 0 ? buffer[0].seq : nextSeq;
-        if (sopts.lastSeenSeq < head - 1) {
+        if (gapAfterSeq != null && sopts.lastSeenSeq <= gapAfterSeq || sopts.lastSeenSeq < head - 1) {
           resyncRequired = true;
         } else {
           replay = buffer.filter((e) => e.seq > sopts.lastSeenSeq);
         }
       }
-      listeners.add(listener);
+      listeners.set(listener, { onResyncRequired: sopts?.onResyncRequired });
       return {
         replay,
         resyncRequired,
@@ -8030,7 +8551,10 @@ function fsEventsRoutes(app, opts, done) {
     try {
       sub = entry.broadcaster.subscribe(
         (env) => writeChange(reply.raw, env),
-        lastSeenSeq != null ? { lastSeenSeq } : void 0
+        {
+          ...lastSeenSeq != null ? { lastSeenSeq } : {},
+          onResyncRequired: () => writeSse(reply.raw, "resync-required", {})
+        }
       );
     } catch (error) {
       releaseBroadcaster(workspaceId, entry);
@@ -8041,10 +8565,6 @@ function fsEventsRoutes(app, opts, done) {
     }
     if (sub.resyncRequired) {
       writeSse(reply.raw, "resync-required", {});
-      sub.unsubscribe();
-      releaseBroadcaster(workspaceId, entry);
-      reply.raw.end();
-      return;
     }
     for (const env of sub.replay) writeChange(reply.raw, env);
     const heartbeat = setInterval(() => {
@@ -8684,6 +9204,7 @@ function statusCodeFromError(err) {
   }
   const parsedCode = ErrorCode.safeParse(err?.code);
   if (parsedCode.success && parsedCode.data === ErrorCode.enum.SESSION_NOT_FOUND) return 404;
+  if (parsedCode.success && parsedCode.data === ErrorCode.enum.PAYMENT_REQUIRED) return 402;
   return 500;
 }
 
@@ -9129,9 +9650,10 @@ function gitRoutes(app, opts, done) {
     if (path4 === null) return;
     const workspaceRoot = await resolveWorkspaceRoot(request);
     if (!workspaceRoot) {
-      return reply.code(500).send({
-        error: { code: ERROR_CODE_INTERNAL, message: "workspace root unavailable" }
-      });
+      return {
+        enabled: false,
+        reason: "Git file URLs are unavailable for this runtime."
+      };
     }
     try {
       return await resolveGitFileUrl(workspaceRoot, path4);
@@ -9523,7 +10045,9 @@ var PiChatEventMapper = class {
         const mapped = [
           ...this.mapAgentEndFinalAssistant(event, turnId),
           ...this.mapAgentEndError(event, turnId, status),
-          this.event({ type: "agent-end", turnId, status })
+          // willRetry marks a non-terminal end (auto-retry coming) so once-per-settle
+          // consumers can ignore it; mirrors mapAgentEndError's own willRetry gate.
+          this.event({ type: "agent-end", turnId, status, ...event.willRetry === true ? { willRetry: true } : {} })
         ];
         this.activeAssistantMessageId = void 0;
         this.toolCallMessageIds.clear();
@@ -10222,6 +10746,454 @@ function messageCreatedAtMs(message) {
   return Number.isFinite(timestamp) ? timestamp : void 0;
 }
 
+// src/server/pi-chat/metering.ts
+var meteringLogger = createLogger("pi-chat-metering");
+var defaultMeteringErrorLogger = (message, error) => {
+  meteringLogger.warn(message, { error });
+};
+function promptRunId(sessionId, clientNonce) {
+  return `pi-run:${sessionId}:prompt:${clientNonce}`;
+}
+function followUpRunId(sessionId, clientNonce, clientSeq) {
+  return `pi-run:${sessionId}:followup:${clientNonce}:${clientSeq}`;
+}
+function followUpMatches(run2, selector) {
+  const fu = run2.followUp;
+  if (!fu) return false;
+  if (selector.clientNonce !== void 0) return fu.clientNonce === selector.clientNonce;
+  if (selector.clientSeq !== void 0) return fu.clientSeq === selector.clientSeq;
+  return false;
+}
+function takeQueuedFollowUp(state, selector) {
+  const index = state.queued.findIndex((run2) => followUpMatches(run2, selector));
+  if (index < 0) return void 0;
+  return state.queued.splice(index, 1)[0];
+}
+function isRecord3(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function readTokenCount(value) {
+  return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : 0;
+}
+function normalizeMeteringUsage(value) {
+  if (!isRecord3(value)) return void 0;
+  const cost = isRecord3(value.cost) ? value.cost : {};
+  return {
+    input: readTokenCount(value.input),
+    output: readTokenCount(value.output),
+    cacheRead: readTokenCount(value.cacheRead),
+    cacheWrite: readTokenCount(value.cacheWrite),
+    cost: {
+      input: readTokenCount(cost.input),
+      output: readTokenCount(cost.output),
+      cacheRead: readTokenCount(cost.cacheRead),
+      cacheWrite: readTokenCount(cost.cacheWrite),
+      total: readTokenCount(cost.total)
+    }
+  };
+}
+var PiChatMeteringCoordinator = class {
+  sessions = /* @__PURE__ */ new Map();
+  inflightOps = /* @__PURE__ */ new Set();
+  runInstances = 0;
+  sink;
+  logError;
+  constructor(sink, logError) {
+    this.sink = sink;
+    this.logError = logError ?? defaultMeteringErrorLogger;
+  }
+  /** Reserve a prompt run. Throws (fail closed) when the sink rejects. */
+  async reservePrompt(input) {
+    const state = this.sessionState(input.sessionId);
+    const runId = promptRunId(input.sessionId, input.clientNonce);
+    const existing = this.findRun(state, runId);
+    if (existing) {
+      await existing.reservation;
+      return "duplicate";
+    }
+    const run2 = this.createRun(input, "prompt", runId);
+    state.pendingPrompts.push(run2);
+    return this.materializeReservation(state, run2, input);
+  }
+  /** Reserve a follow-up run. Throws (fail closed) when the sink rejects.
+   * Returns 'duplicate' when this selector already has a tracked/consumed run. */
+  async reserveFollowUp(input) {
+    const state = this.sessionState(input.sessionId);
+    const runId = followUpRunId(input.sessionId, input.clientNonce, input.clientSeq);
+    const existing = this.findRun(state, runId);
+    if (existing) {
+      await existing.reservation;
+      return "duplicate";
+    }
+    if (state.consumedFollowUpNonces.has(input.clientNonce)) return "duplicate";
+    const run2 = this.createRun(input, "followup", runId);
+    run2.followUp = { clientNonce: input.clientNonce, clientSeq: input.clientSeq };
+    state.queued.push(run2);
+    return this.materializeReservation(state, run2, input);
+  }
+  /**
+   * Acquire the reservation for a freshly-registered run. The reserve is put on
+   * the run's ops chain so a concurrent release/settle is ordered strictly
+   * after the reservation row exists. Returns 'cancelled' (skip execution) when
+   * a concurrent stop/interrupt/delete terminated the run while the reserve was
+   * in flight; throws (fail closed) when the sink rejects.
+   */
+  async materializeReservation(state, run2, input) {
+    run2.reservation = this.applyReservation(run2, input);
+    const reserveOp = run2.reservation.catch(() => {
+    });
+    run2.ops = reserveOp;
+    this.inflightOps.add(reserveOp);
+    void reserveOp.finally(() => this.inflightOps.delete(reserveOp));
+    try {
+      await run2.reservation;
+    } catch (err) {
+      this.removeReservingRun(state, run2, input.sessionId);
+      throw err;
+    }
+    return run2.terminal ? "cancelled" : "created";
+  }
+  /** True while a non-terminal prompt run exists for this nonce (accept →
+   * agent-end). Used to suppress duplicate-nonce execution for the full run
+   * lifetime, not just until the user message-start is consumed. */
+  hasPromptRun(sessionId, clientNonce) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return false;
+    const run2 = this.findRun(state, promptRunId(sessionId, clientNonce));
+    return run2 !== void 0 && !run2.terminal;
+  }
+  /** True while a non-terminal follow-up run exists for this selector (queued
+   * or consumed-and-active). Used to suppress duplicate follow-up enqueues. */
+  hasFollowUpRun(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return false;
+    if (selector.clientNonce !== void 0 && state.consumedFollowUpNonces.has(selector.clientNonce)) return true;
+    if (state.queued.some((run2) => followUpMatches(run2, selector))) return true;
+    const active = state.active;
+    return active !== void 0 && !active.terminal && active.followUp !== void 0 && followUpMatches(active, selector);
+  }
+  /** The accepted prompt failed before/without running (sync throw or run rejection). */
+  failPromptRun(sessionId, clientNonce) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const runId = promptRunId(sessionId, clientNonce);
+    const pendingIndex = state.pendingPrompts.findIndex((run2) => run2.scope.runId === runId);
+    if (pendingIndex >= 0) {
+      const [run2] = state.pendingPrompts.splice(pendingIndex, 1);
+      if (run2) this.finishRun(run2, "error");
+    } else if (state.active?.scope.runId === runId) {
+      this.finishRun(state.active, "error");
+      state.active = void 0;
+    }
+    this.pruneSession(sessionId, state);
+  }
+  /** A queued follow-up was rejected by the adapter before being queued. */
+  failFollowUpRun(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    this.release(run2, "run-rejected");
+    this.pruneSession(sessionId, state);
+  }
+  /**
+   * A queued follow-up is being re-posted as a plain prompt (interrupt
+   * fallback for runtimes without continueQueuedFollowUp). No
+   * `followup-consumed` event will arrive, so bind its reservation to the
+   * next agent-start instead.
+   */
+  promoteQueuedToPrompt(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    state.pendingPrompts.push(run2);
+  }
+  /**
+   * A promoted-to-prompt follow-up failed before agent-start (the fallback
+   * repost rejected). Release its reservation instead of stranding it in
+   * pendingPrompts, where a later agent-start would otherwise misattribute
+   * usage to it.
+   */
+  failPromotedFollowUp(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state || selector.clientNonce === void 0 || selector.clientSeq === void 0) return;
+    const runId = followUpRunId(sessionId, selector.clientNonce, selector.clientSeq);
+    const index = state.pendingPrompts.findIndex((run3) => run3.scope.runId === runId);
+    if (index < 0) return;
+    const [run2] = state.pendingPrompts.splice(index, 1);
+    if (run2) this.release(run2, "run-rejected");
+    this.pruneSession(sessionId, state);
+  }
+  /**
+   * Release prompt runs reserved but not yet bound to an agent-start —
+   * e.g. a stop/interrupt landing in the window between acceptance and the
+   * native agent_start. Without this they would sit `active` in the store
+   * until their TTL, holding the user's balance. No charge.
+   */
+  releasePending(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const run2 of state.pendingPrompts) this.release(run2, "cancelled");
+    state.pendingPrompts = [];
+    this.pruneSession(sessionId, state);
+  }
+  /** Queue cleared via selector or entirely; release affected reservations. */
+  releaseQueued(sessionId, selector) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    if (selector) {
+      const run2 = takeQueuedFollowUp(state, selector);
+      if (run2) this.release(run2, "queue-cleared");
+    } else {
+      for (const run2 of state.queued) this.release(run2, "queue-cleared");
+      state.queued = [];
+    }
+    this.pruneSession(sessionId, state);
+  }
+  /** Session deleted: tear down every non-terminal run without charging. */
+  releaseSession(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const run2 of state.queued) this.release(run2, "cancelled");
+    for (const run2 of state.pendingPrompts) this.release(run2, "cancelled");
+    if (state.active) this.finishRun(state.active, "aborted");
+    this.sessions.delete(sessionId);
+  }
+  /**
+   * Feed one native adapter event and its mapped PiChatEvents through the
+   * correlation state machine. Must be called after the mapped events were
+   * published (the mapper assigns turn ids during mapping).
+   */
+  observe(sessionId, nativeEvent, mappedEvents) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return;
+    for (const event of mappedEvents) {
+      switch (event.type) {
+        case "agent-start": {
+          let next = state.pendingPrompts.shift();
+          while (next && next.terminal) next = state.pendingPrompts.shift();
+          if (next) {
+            if (state.active && !state.active.terminal) this.finishRun(state.active, "ok");
+            state.active = next;
+          }
+          break;
+        }
+        case "message-start": {
+          if (event.role === "user" && event.clientSeq !== void 0) {
+            this.consumeFollowUp(state, event);
+          }
+          break;
+        }
+        case "followup-consumed": {
+          this.consumeFollowUp(state, event);
+          break;
+        }
+        case "auto-retry-start": {
+          if (state.active) {
+            state.active.recordedMessageIds.clear();
+            state.active.lastIdlessUsageKey = void 0;
+          }
+          break;
+        }
+        case "agent-end": {
+          this.harvestAgentEndUsage(state, nativeEvent);
+          if (isRecord3(nativeEvent) && nativeEvent.willRetry === true) break;
+          if (state.active && !state.active.terminal) this.finishRun(state.active, event.status);
+          state.active = void 0;
+          break;
+        }
+        default:
+          break;
+      }
+    }
+    this.observeMessageEndUsage(state, nativeEvent);
+    this.pruneSession(sessionId, state);
+  }
+  /** Promote a queued follow-up to the active run, settling the previous one. */
+  consumeFollowUp(state, selector) {
+    const run2 = takeQueuedFollowUp(state, selector);
+    if (!run2) return;
+    if (run2.followUp?.clientNonce) state.consumedFollowUpNonces.add(run2.followUp.clientNonce);
+    if (state.active && !state.active.terminal) this.finishRun(state.active, "ok");
+    state.active = run2;
+  }
+  /** Test/diagnostic hook: resolves after every queued sink call settles. */
+  async flush() {
+    while (this.inflightOps.size > 0) {
+      await Promise.all([...this.inflightOps]);
+    }
+  }
+  observeMessageEndUsage(state, nativeEvent) {
+    if (!isRecord3(nativeEvent) || nativeEvent.type !== "message_end") return;
+    this.recordAssistantUsage(state, nativeEvent.message);
+  }
+  /**
+   * Some failure/abort paths never emit message_end; the final assistant
+   * message (and its usage) only rides on agent_end's messages array. Runs
+   * with already-recorded usage dedupe via recordedMessageIds.
+   */
+  harvestAgentEndUsage(state, nativeEvent) {
+    if (!isRecord3(nativeEvent) || !Array.isArray(nativeEvent.messages)) return;
+    for (let index = nativeEvent.messages.length - 1; index >= 0; index -= 1) {
+      const message = nativeEvent.messages[index];
+      if (!isRecord3(message) || message.role !== "assistant") continue;
+      this.recordAssistantUsage(state, message, { isAgentEndFinal: true });
+      return;
+    }
+  }
+  recordAssistantUsage(state, message, opts = {}) {
+    if (!isRecord3(message) || message.role !== "assistant") return;
+    const usage = normalizeMeteringUsage(message.usage);
+    if (!usage) return;
+    const run2 = state.active ?? state.pendingPrompts[0];
+    if (!run2 || run2.terminal) {
+      this.logError("assistant usage arrived with no reserved run; usage not metered", { messageRole: "assistant" });
+      return;
+    }
+    const messageId = typeof message.id === "string" && message.id.length > 0 ? message.id : void 0;
+    if (messageId) {
+      if (run2.recordedMessageIds.has(messageId)) return;
+      run2.recordedMessageIds.add(messageId);
+    } else {
+      const stopReason2 = typeof message.stopReason === "string" ? message.stopReason : "";
+      const signature = `sig:${usage.input}:${usage.output}:${usage.cacheRead}:${usage.cacheWrite}:${usage.cost.total}:${stopReason2}`;
+      if (opts.isAgentEndFinal && signature === run2.lastIdlessUsageKey) return;
+      run2.lastIdlessUsageKey = signature;
+    }
+    run2.usageCount += 1;
+    const model = typeof message.model === "string" && message.model.length > 0 ? message.model : void 0;
+    const provider = typeof message.provider === "string" && message.provider.length > 0 ? message.provider : void 0;
+    const stopReason = typeof message.stopReason === "string" ? message.stopReason : void 0;
+    const usageId = messageId ? `pi-usage:${run2.scope.sessionId}:message:${messageId}` : run2.reservationId ? `pi-usage:reservation:${run2.reservationId}:${run2.usageCount}` : `pi-usage:${run2.scope.runId}:${run2.instanceId}:${run2.usageCount}`;
+    this.enqueue(
+      run2,
+      async () => {
+        try {
+          const result = await this.sink.recordUsage({
+            ...run2.scope,
+            reservationId: run2.reservationId,
+            usageId,
+            messageId,
+            model: model || provider ? { provider, id: model } : void 0,
+            usage,
+            stopReason
+          });
+          if (result.billedMicros > 0) run2.billableUsageCount += 1;
+        } catch (error) {
+          const couldBill = usage.input + usage.output + usage.cacheRead + usage.cacheWrite > 0 || usage.cost.total > 0;
+          if (couldBill) run2.usageWriteFailed = true;
+          throw error;
+        }
+      },
+      "recordUsage failed"
+    );
+  }
+  /** Build a run synchronously (no await) so it can be registered before the
+   * reserve sink call, closing the concurrent-duplicate race. */
+  createRun(input, kind, runId) {
+    return {
+      scope: {
+        workspaceId: input.workspaceId,
+        userId: input.userId,
+        sessionId: input.sessionId,
+        runId,
+        source: "pi-chat"
+      },
+      kind,
+      reservationId: void 0,
+      instanceId: this.runInstances += 1,
+      usageCount: 0,
+      billableUsageCount: 0,
+      recordedMessageIds: /* @__PURE__ */ new Set(),
+      lastIdlessUsageKey: void 0,
+      usageWriteFailed: false,
+      reservation: Promise.resolve(),
+      terminal: false,
+      ops: Promise.resolve()
+    };
+  }
+  /** Acquire the host reservation; throws (fail closed) on a rejecting sink. */
+  async applyReservation(run2, input) {
+    const result = await this.sink.reserveRun({
+      ...run2.scope,
+      kind: run2.kind,
+      message: input.message,
+      model: input.model
+    });
+    run2.reservationId = result?.reservationId;
+  }
+  /** Remove a still-reserving run whose reservation failed, from either list. */
+  removeReservingRun(state, run2, sessionId) {
+    const pendingIndex = state.pendingPrompts.indexOf(run2);
+    if (pendingIndex >= 0) state.pendingPrompts.splice(pendingIndex, 1);
+    const queuedIndex = state.queued.indexOf(run2);
+    if (queuedIndex >= 0) state.queued.splice(queuedIndex, 1);
+    this.pruneSession(sessionId, state);
+  }
+  findRun(state, runId) {
+    if (state.active && !state.active.terminal && state.active.scope.runId === runId) return state.active;
+    const pending = state.pendingPrompts.find((run2) => run2.scope.runId === runId);
+    if (pending) return pending;
+    return state.queued.find((run2) => run2.scope.runId === runId);
+  }
+  finishRun(run2, status) {
+    if (run2.terminal) return;
+    run2.terminal = true;
+    this.enqueue(
+      run2,
+      () => {
+        if (run2.usageWriteFailed) {
+          return this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason: "usage-write-failed" });
+        }
+        if (run2.billableUsageCount > 0) {
+          return this.sink.settleRun({ ...run2.scope, reservationId: run2.reservationId, status });
+        }
+        const didPaidWork = status === "ok";
+        if (didPaidWork) {
+          return this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason: "fallback-hold-charge" });
+        }
+        return this.sink.releaseRun({
+          ...run2.scope,
+          reservationId: run2.reservationId,
+          reason: status === "error" ? "error-before-usage" : "cancelled"
+        });
+      },
+      "finishRun failed"
+    );
+  }
+  release(run2, reason) {
+    if (run2.terminal) return;
+    run2.terminal = true;
+    this.enqueue(
+      run2,
+      () => this.sink.releaseRun({ ...run2.scope, reservationId: run2.reservationId, reason }),
+      "releaseRun failed"
+    );
+  }
+  enqueue(run2, op, failureMessage) {
+    const chained = run2.ops.then(op).catch((error) => {
+      this.logError(`${failureMessage} (run ${run2.scope.runId})`, error);
+    });
+    run2.ops = chained;
+    this.inflightOps.add(chained);
+    void chained.finally(() => this.inflightOps.delete(chained));
+  }
+  sessionState(sessionId) {
+    let state = this.sessions.get(sessionId);
+    if (!state) {
+      state = { pendingPrompts: [], queued: [], consumedFollowUpNonces: /* @__PURE__ */ new Set() };
+      this.sessions.set(sessionId, state);
+    }
+    return state;
+  }
+  pruneSession(sessionId, state) {
+    if (!state.active && state.pendingPrompts.length === 0 && state.queued.length === 0 && state.consumedFollowUpNonces.size === 0) {
+      this.sessions.delete(sessionId);
+    }
+  }
+};
+
 // src/server/pi-chat/harnessPiChatService.ts
 var HarnessPiChatService = class {
   harness;
@@ -10237,10 +11209,16 @@ var HarnessPiChatService = class {
   activePromptRuns = /* @__PURE__ */ new Map();
   syntheticPromptFailures = /* @__PURE__ */ new Map();
   activeSyntheticPromptErrors = /* @__PURE__ */ new Map();
+  metering;
   constructor(options) {
     this.harness = options.harness;
     this.sessionStore = options.sessionStore;
     this.workdir = options.workdir;
+    this.metering = options.metering ? new PiChatMeteringCoordinator(options.metering, options.meteringLogger) : void 0;
+  }
+  /** Test/diagnostic hook: resolves once queued metering sink calls settle. */
+  async flushMetering() {
+    await this.metering?.flush();
   }
   async listSessions(ctx, options) {
     return this.sessionStore.list(toSessionCtx(ctx), options);
@@ -10249,8 +11227,16 @@ var HarnessPiChatService = class {
     return this.sessionStore.create(toSessionCtx(ctx), init);
   }
   async deleteSession(ctx, sessionId) {
-    this.channels.get(sessionId)?.unsubscribe();
+    const channel = this.channels.get(sessionId);
+    if (channel) {
+      const activeRun = this.activePromptRuns.get(sessionId);
+      await channel.adapter.abort();
+      await activeRun?.catch(() => {
+      });
+    }
+    channel?.unsubscribe();
     this.channels.delete(sessionId);
+    this.metering?.releaseSession(sessionId);
     this.messageMetadata.clearSession(sessionId);
     this.syntheticPromptFailures.delete(sessionId);
     this.activeSyntheticPromptErrors.delete(sessionId);
@@ -10300,16 +11286,35 @@ var HarnessPiChatService = class {
   async prompt(ctx, sessionId, payload) {
     const adapter = await this.getAdapter(ctx, sessionId, payload);
     await this.ensureChannel(ctx, sessionId, adapter);
+    const outcome = await this.metering?.reservePrompt({
+      workspaceId: ctx.workspaceId,
+      userId: ctx.authSubject,
+      sessionId,
+      clientNonce: payload.clientNonce,
+      message: payload.message,
+      model: payload.model
+    }) ?? "created";
+    if (outcome === "duplicate") {
+      return {
+        accepted: true,
+        cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0,
+        clientNonce: payload.clientNonce,
+        duplicate: true
+      };
+    }
+    if (outcome === "cancelled") throw promptCancelledError();
     this.messageMetadata.recordPrompt(sessionId, payload);
     const channel = this.channels.get(sessionId);
     const receiptCursor = nextPromptReceiptCursor(channel);
     try {
       const run2 = this.trackActiveRun(sessionId, adapter.prompt(toPiPromptInput(payload)));
       run2.catch((error) => {
+        this.metering?.failPromptRun(sessionId, payload.clientNonce);
         if (!this.messageMetadata.hasPrompt(sessionId, { clientNonce: payload.clientNonce, displayText: payload.displayMessage ?? payload.message })) return;
         this.publishPromptRunError(sessionId, channel, payload, error);
       });
     } catch (err) {
+      this.metering?.failPromptRun(sessionId, payload.clientNonce);
       this.messageMetadata.removePrompt(sessionId, { clientNonce: payload.clientNonce });
       throw err;
     }
@@ -10318,6 +11323,25 @@ var HarnessPiChatService = class {
   async followUp(ctx, sessionId, payload) {
     const adapter = await this.getAdapter(ctx, sessionId, payload.message);
     await this.ensureChannel(ctx, sessionId, adapter);
+    const outcome = await this.metering?.reserveFollowUp({
+      workspaceId: ctx.workspaceId,
+      userId: ctx.authSubject,
+      sessionId,
+      clientNonce: payload.clientNonce,
+      clientSeq: payload.clientSeq,
+      message: payload.message
+    }) ?? "created";
+    if (outcome === "duplicate") {
+      return {
+        accepted: true,
+        queued: true,
+        cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0,
+        clientNonce: payload.clientNonce,
+        clientSeq: payload.clientSeq,
+        duplicate: true
+      };
+    }
+    if (outcome === "cancelled") throw promptCancelledError();
     this.messageMetadata.recordFollowUp(sessionId, payload);
     try {
       await adapter.followUp(payload.message, {
@@ -10326,6 +11350,7 @@ var HarnessPiChatService = class {
         clientSeq: payload.clientSeq
       });
     } catch (err) {
+      this.metering?.failFollowUpRun(sessionId, payload);
       this.messageMetadata.removeFollowUp(sessionId, payload);
       throw err;
     }
@@ -10337,10 +11362,14 @@ var HarnessPiChatService = class {
       const before = adapter.readSnapshot().followUpMessages.length;
       adapter.clearFollowUp(payload);
       const after = adapter.readSnapshot().followUpMessages.length;
-      if (after < before) this.messageMetadata.removeFollowUp(sessionId, payload);
+      if (after < before) {
+        this.messageMetadata.removeFollowUp(sessionId, payload);
+        this.metering?.releaseQueued(sessionId, payload);
+      }
       return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, cleared: Math.max(0, before - after) };
     }
     const clearedQueue = this.clearAllFollowUps(adapter, sessionId);
+    this.metering?.releaseQueued(sessionId);
     return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, cleared: clearedQueue.length };
   }
   async interrupt(ctx, sessionId, _payload) {
@@ -10353,12 +11382,15 @@ var HarnessPiChatService = class {
     if (wasActive) await adapter.abort();
     await activeRun?.catch(() => {
     });
+    this.metering?.releasePending(sessionId);
     if (nextFollowUp) await this.autoPostInterruptedFollowUp(sessionId, adapter, nextFollowUp);
     return { accepted: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0 };
   }
   async stop(ctx, sessionId, _payload) {
     const adapter = await this.getAdapter(ctx, sessionId, "");
     const clearedQueue = this.clearAllFollowUps(adapter, sessionId);
+    this.metering?.releaseQueued(sessionId);
+    this.metering?.releasePending(sessionId);
     await adapter.abort();
     return { accepted: true, stopped: true, cursor: this.channels.get(sessionId)?.buffer.latestSeq ?? 0, clearedQueue: buildPiChatQueuedFollowUps(sessionId, clearedQueue) };
   }
@@ -10380,13 +11412,24 @@ var HarnessPiChatService = class {
     const metadata = this.messageMetadata.findFollowUpForQueueItem(sessionId, followUp);
     this.messageMetadata.recordConsumingFollowUp(sessionId, followUp, metadata?.serverText);
     if (adapter.continueQueuedFollowUp) {
-      await this.trackActiveRun(sessionId, adapter.continueQueuedFollowUp());
+      try {
+        await this.trackActiveRun(sessionId, adapter.continueQueuedFollowUp());
+      } catch (err) {
+        this.metering?.failFollowUpRun(sessionId, followUp);
+        throw err;
+      }
       return;
     }
     if (!this.canClearAutoPostedFollowUpForFallback(adapter, followUp)) {
       throw new AutoPostFollowUpError("Cannot auto-post queued follow-up because this runtime cannot safely remove only the consumed queued item.");
     }
-    await this.runPrompt(sessionId, adapter, metadata?.serverText ?? followUp.displayText);
+    this.metering?.promoteQueuedToPrompt(sessionId, followUp);
+    try {
+      await this.runPrompt(sessionId, adapter, metadata?.serverText ?? followUp.displayText);
+    } catch (err) {
+      this.metering?.failPromotedFollowUp(sessionId, followUp);
+      throw err;
+    }
     this.clearAutoPostedFollowUpForFallback(sessionId, adapter, followUp);
   }
   async runPrompt(sessionId, adapter, input) {
@@ -10531,10 +11574,14 @@ var HarnessPiChatService = class {
     const channel = { buffer, adapter, unsubscribe: () => {
     }, mapper, messageTurnIds: /* @__PURE__ */ new Map() };
     const unsubscribe = adapter.subscribe((event) => {
-      for (const mapped of mapper.map(event)) {
+      const mappedEvents = mapper.map(event);
+      const enrichedEvents = [];
+      for (const mapped of mappedEvents) {
         const enriched = this.messageMetadata.enrichEvent(sessionId, mapped);
+        enrichedEvents.push(enriched);
         this.publishChannelEvent(sessionId, channel, enriched);
       }
+      this.metering?.observe(sessionId, event, enrichedEvents);
     });
     channel.unsubscribe = unsubscribe;
     this.channels.set(sessionId, channel);
@@ -10543,6 +11590,13 @@ var HarnessPiChatService = class {
 };
 var AutoPostFollowUpError = class extends Error {
 };
+function promptCancelledError() {
+  return Object.assign(new Error("request cancelled before execution"), {
+    statusCode: 409,
+    code: ErrorCode.enum.ABORTED,
+    retryable: true
+  });
+}
 function nextPromptReceiptCursor(channel) {
   return (channel?.buffer.latestSeq ?? 0) + 1;
 }
@@ -10675,7 +11729,8 @@ async function createAgentApp(opts = {}) {
     templatePath
   });
   const pluginTools = [];
-  if (modeAdapter.workspaceFsCapability === "strong") {
+  const externalPluginsEnabled = opts.externalPlugins !== false;
+  if (externalPluginsEnabled && modeAdapter.workspaceFsCapability === "strong") {
     const pluginResult = await loadPlugins({ cwd: workspaceRoot });
     if (pluginResult.errors.length > 0) {
       for (const e of pluginResult.errors) {
@@ -10706,13 +11761,13 @@ async function createAgentApp(opts = {}) {
     ...opts.disableDefaultFileTools ? [] : buildFilesystemAgentTools(runtimeBundle),
     ...opts.extraTools ?? [],
     ...pluginTools,
-    createPluginDiagnosticsTool({
+    ...externalPluginsEnabled ? [createPluginDiagnosticsTool({
       getLastReloadDiagnostics: () => lastReloadDiagnostics,
       getHarness: () => harnessRef,
       ...opts.getPluginDiagnostics ? {
         getPluginErrors: () => opts.getPluginDiagnostics({ workspaceId: sessionId, workspaceRoot })
       } : {}
-    })
+    })] : []
   ];
   const harnessFactory = opts.harnessFactory ?? ((input) => createPiCodingAgentHarness({
     ...input,
@@ -10751,11 +11806,17 @@ async function createAgentApp(opts = {}) {
   await app.register(fsEventsRoutes, { workspace: runtimeBundle.workspace });
   await app.register(treeRoutes, { workspace: runtimeBundle.workspace });
   await app.register(searchRoutes, { fileSearch: runtimeBundle.fileSearch });
-  await app.register(gitRoutes, { getWorkspaceRoot: () => getRuntimeBundleStorageRoot(runtimeBundle) });
+  await app.register(gitRoutes, {
+    getWorkspaceRoot: () => {
+      if (runtimeBundle.sandbox.provider === "remote-worker") return void 0;
+      return getRuntimeBundleStorageRoot(runtimeBundle);
+    }
+  });
   const piChatService = new HarnessPiChatService({
     harness,
     sessionStore: harness.sessions,
-    workdir: runtimeBundle.workspace.root
+    workdir: runtimeBundle.workspace.root,
+    metering: opts.metering
   });
   await app.register(piChatRoutes, { service: piChatService });
   await app.register(systemPromptRoutes, { harness });
@@ -10892,7 +11953,6 @@ function basenameForUpload2(filename) {
 }
 function buildUploadAgentTools(bundle) {
   const { workspace } = bundle;
-  const storageRoot = getRuntimeBundleStorageRoot(bundle);
   return [
     {
       name: "upload_file",
@@ -10921,7 +11981,7 @@ function buildUploadAgentTools(bundle) {
         const rawDir = typeof input.directory === "string" ? input.directory.trim() : "";
         const dir = rawDir ? rawDir.replace(/^\.\/+/, "").replace(/\/+$/, "") : DEFAULT_UPLOAD_DIR;
         try {
-          const bytes = workspace.readBinaryFile ? Buffer.from(await workspace.readBinaryFile(filePath)) : await readFile12(join14(storageRoot, filePath));
+          const bytes = workspace.readBinaryFile ? Buffer.from(await workspace.readBinaryFile(filePath)) : await readFile12(join14(getRuntimeBundleStorageRoot(bundle), filePath));
           if (bytes.byteLength === 0 || bytes.byteLength > MAX_UPLOAD_BYTES2) {
             return {
               content: [{ type: "text", text: `file must be between 1 byte and ${MAX_UPLOAD_BYTES2} bytes` }],
@@ -11075,6 +12135,7 @@ var registerAgentRoutes = async (app, opts) => {
   });
   const requestScopedRuntime = typeof opts.getWorkspaceId === "function" || typeof opts.getWorkspaceRoot === "function" || typeof opts.getTemplatePath === "function" || typeof opts.getPi === "function" || typeof opts.getSessionNamespace === "function" || typeof opts.getSystemPromptDynamic === "function";
   const sessionChangesTracker = new InMemorySessionChangesTracker();
+  const externalPluginsEnabled = opts.externalPlugins !== false;
   const runtimeBindings = /* @__PURE__ */ new Map();
   const MAX_RUNTIME_BINDINGS = 256;
   function evictRuntimeBindings() {
@@ -11258,17 +12319,17 @@ var registerAgentRoutes = async (app, opts) => {
       }),
       ...buildFilesystemAgentTools(runtimeBundle),
       ...buildUploadAgentTools(runtimeBundle),
-      createPluginDiagnosticsTool({
+      ...externalPluginsEnabled ? [createPluginDiagnosticsTool({
         // `binding` is assigned later in this function; read through thunks.
         getLastReloadDiagnostics: () => binding?.lastReloadDiagnostics ?? [],
         getHarness: () => binding?.harness,
         ...opts.getPluginDiagnostics ? {
           getPluginErrors: () => opts.getPluginDiagnostics({ workspaceId, workspaceRoot: root })
         } : {}
-      })
+      })] : []
     ];
     const pluginTools = [];
-    if (modeAdapter.workspaceFsCapability === "strong") {
+    if (externalPluginsEnabled && modeAdapter.workspaceFsCapability === "strong") {
       const pluginResult = await loadPlugins({ cwd: root });
       if (pluginResult.errors.length > 0) {
         for (const e of pluginResult.errors) {
@@ -11527,7 +12588,11 @@ var registerAgentRoutes = async (app, opts) => {
     getFileSearch: async (request) => (await getBindingForRequest(request)).runtimeBundle.fileSearch
   });
   await app.register(gitRoutes, {
-    getWorkspaceRoot: async (request) => getRuntimeBundleStorageRoot((await getBindingForRequest(request)).runtimeBundle)
+    getWorkspaceRoot: async (request) => {
+      const bundle = (await getBindingForRequest(request)).runtimeBundle;
+      if (bundle.sandbox.provider === "remote-worker") return void 0;
+      return getRuntimeBundleStorageRoot(bundle);
+    }
   });
   await app.register(piChatRoutes, {
     getService: async (request) => {
@@ -11535,7 +12600,8 @@ var registerAgentRoutes = async (app, opts) => {
       binding.piChatService ??= new HarnessPiChatService({
         harness: binding.harness,
         sessionStore: binding.harness.sessions,
-        workdir: binding.runtimeBundle.workspace.root
+        workdir: binding.runtimeBundle.workspace.root,
+        metering: opts.metering
       });
       return binding.piChatService;
     }
@@ -11624,10 +12690,17 @@ var registerAgentRoutes = async (app, opts) => {
 export {
   FileHandleStore,
   PI_PACKAGE_RESOURCE_FILTERS,
+  REMOTE_WORKER_PROVIDER,
+  REMOTE_WORKER_RUNTIME_CWD,
+  RemoteWorkerClient,
+  RemoteWorkerClientError,
   UV_SETUP_COMMANDS,
   VERCEL_PROVISIONING_CACHE_ROOT,
   VERCEL_SANDBOX_WORKSPACE_ROOT,
   UV_SETUP_COMMANDS as VERCEL_UV_SETUP_COMMANDS,
+  WORKER_INTERNAL_TOKEN_HEADER,
+  WORKER_REQUEST_ID_HEADER,
+  WORKER_WORKSPACE_ID_HEADER,
   applyCspHeaders,
   autoDetectMode,
   bakeSnapshotIfNeeded,
@@ -11635,21 +12708,28 @@ export {
   buildPackageHash,
   buildSnapshotRecipeHash,
   compactPiPackages,
+  constantTimeTokenEqual,
   createAgentApp,
   createBwrapSandbox,
   createDirectSandbox,
   createLogger,
   createNodeWorkspace,
+  createRemoteWorkerModeAdapter,
+  createRemoteWorkerSandbox,
+  createRemoteWorkerWorkspace,
   createResourceSettingsManager,
   createVercelDeploymentSnapshotProvider,
   createVercelProvisioningAdapter,
   createVercelSandboxWorkspace,
+  decodeBytesFromWorker,
+  encodeBytesForWorker,
   fileRoutes,
   getBoringAgentPathEntries,
   getBoringAgentRuntimeEnv,
   getBoringAgentRuntimePaths,
   hasBwrap,
   mergePiPackageSources,
+  normalizeMeteringUsage,
   piPackageSourceKey,
   prepareDeploymentSnapshot,
   prepareVercelDeploymentSnapshot,