@hachej/boring-agent 0.1.93 → 0.1.95

package/dist/{lease-BqeCLGPL.d.ts → lease-CusB-uLg.d.ts}

@@ -1,6 +1,6 @@
 import { D as InterruptReceipt, j as StopReceipt, p as AgentDefinitionErrorCode, q as AgentDeploymentErrorCode } from './piChatEvent-BsMp3MSo.js';
 import { p as AgentSendInput, j as AgentEvent } from './harness-Cc48o6uS.js';
-import { b as AgentSessionRef, n as AgentSendReceipt, A as AgentGateway, a as AuthorizedAgentScope } from './errors-C38f6pol.js';
+import { b as AgentSessionRef, n as AgentSendReceipt, A as AgentGateway, a as AuthorizedAgentScope } from './errors-G6T6S7PQ.js';
 import { z } from 'zod';
 import { b as Workspace } from './sandbox-DAD8cWQR.js';
 
@@ -10,6 +10,8 @@ interface WorkspaceAgentDispatcherContext {
 }
 type WorkspaceAgentDispatcherSendInput = Omit<AgentSendInput, 'ctx'>;
 interface WorkspaceAgentDispatcherDispatchInput extends WorkspaceAgentDispatcherSendInput {
+    /** Optional title for a newly created addressed session. */
+    title?: string;
     /** Durable caller-owned idempotency key. */
     requestId: string;
     /** Defaults to requestId. */

package/dist/{piChatSessionService-BrPqKrpY.d.ts → piChatSessionService-C0KbcGw9.d.ts}

@@ -16,6 +16,10 @@ interface PiSessionCreateInit {
     title?: string;
     modelDefault?: ChatModelSelection;
 }
+/** Server-only prompt admission selector; browser schemas never accept requireIdle. */
+type AgentPromptPayload = PromptPayload & {
+    readonly requireIdle?: true;
+};
 type PiChatReplayRangeError = {
     type: 'replay_gap';
     latestSeq: number;
@@ -45,13 +49,15 @@ interface PiChatSessionService {
     readAttachment?(ctx: PiSessionRequestContext, sessionId: string, messageId: string, index: number): Promise<PiChatAttachmentResult>;
     readState(ctx: PiSessionRequestContext, sessionId: string): Promise<PiChatSnapshot>;
     subscribe(ctx: PiSessionRequestContext, sessionId: string, cursor: number, subscriber: PiChatEventSubscriber): Promise<PiChatEventStreamResult>;
-    prompt(ctx: PiSessionRequestContext, sessionId: string, payload: PromptPayload): Promise<PromptReceipt>;
+    prompt(ctx: PiSessionRequestContext, sessionId: string, payload: AgentPromptPayload): Promise<PromptReceipt>;
     followUp(ctx: PiSessionRequestContext, sessionId: string, payload: FollowUpPayload): Promise<FollowUpReceipt>;
     clearQueue(ctx: PiSessionRequestContext, sessionId: string, payload: QueueClearPayload): Promise<QueueClearReceipt>;
     interrupt(ctx: PiSessionRequestContext, sessionId: string, payload: InterruptPayload): Promise<CommandReceipt>;
     stop(ctx: PiSessionRequestContext, sessionId: string, payload: StopPayload): Promise<StopReceipt>;
 }
 interface AgentCoreSessionService extends PiChatSessionService {
+    /** Trusted host-only validation/binding seam; never exposed as an HTTP route. */
+    ensurePiSessionBound?(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
     createSession(ctx: PiSessionRequestContext, init?: PiSessionCreateInit): Promise<SessionSummary>;
     deleteSession(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
     dispose?(): Promise<void>;

package/dist/server/agent-host/testing/gatewayConformance.d.ts

@@ -1,5 +1,5 @@
-import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity } from '../../../errors-C38f6pol.js';
-import { A as AgentGatewayEffect } from '../../../types-uQozUhGt.js';
+import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity } from '../../../errors-G6T6S7PQ.js';
+import { A as AgentGatewayEffect } from '../../../types-C-Eroi__.js';
 import '../../../piChatEvent-BsMp3MSo.js';
 import 'zod';
 import 'fastify';
@@ -8,7 +8,7 @@ import '@mariozechner/pi-coding-agent';
 import '../../../sandbox-DAD8cWQR.js';
 import '@hachej/boring-bash/agent';
 import '@hachej/boring-sandbox/providers/node-workspace';
-import '../../../piChatSessionService-BrPqKrpY.js';
+import '../../../piChatSessionService-C0KbcGw9.js';
 
 /** G1 ships only the embedded bounded-replay contract. */
 type GatewayReplayConformanceLevel = 'B';

package/dist/server/agent-host/testing/gatewayConformance.js

@@ -286,6 +286,83 @@ function gatewayConformance(options) {
       expect(await connection.stop({ requestId: "stop" })).toEqual(stop);
       await connection.close();
     });
+    it("keeps strict-idle busy admission retryable and idempotent", async () => {
+      const fixture = await options.createFixture();
+      const scope = fixture.issueScope();
+      const ref = await createSession(fixture, scope, "strict-idle-retry");
+      const connection = await fixture.gateway.connectSession({ scope, ref });
+      const input = {
+        kind: "prompt",
+        requestId: "strict-review",
+        clientNonce: "strict-review",
+        content: "model-facing review",
+        displayContent: "Visible review",
+        requireIdle: true
+      };
+      fixture.setActivity(ref, "running");
+      await expectCode(connection.send(input), AgentGatewayErrorCode.AGENT_COMMAND_INVALID_STATE);
+      fixture.setActivity(ref, "idle");
+      const accepted = await connection.send(input);
+      expect(accepted).toMatchObject({ accepted: true, disposition: "prompt" });
+      await expect(connection.send(input)).resolves.toMatchObject({ ...accepted, duplicate: true });
+      await expectCode(
+        connection.send({ ...input, displayContent: "changed payload" }),
+        AgentGatewayErrorCode.AGENT_REQUEST_CONFLICT
+      );
+      await connection.close();
+    });
+    it("admits exactly one of two concurrent strict-idle prompts", async () => {
+      const fixture = await options.createFixture();
+      const scope = fixture.issueScope();
+      const ref = await createSession(fixture, scope, "strict-idle-race");
+      const connection = await fixture.gateway.connectSession({ scope, ref });
+      fixture.setActivity(ref, "idle");
+      const outcome = async (requestId) => {
+        try {
+          await connection.send({
+            kind: "prompt",
+            requestId,
+            clientNonce: requestId,
+            content: requestId,
+            requireIdle: true
+          });
+          return "accepted";
+        } catch (error) {
+          return error.code;
+        }
+      };
+      const outcomes = await Promise.all([outcome("strict-a"), outcome("strict-b")]);
+      expect(outcomes.sort()).toEqual([
+        AgentGatewayErrorCode.AGENT_COMMAND_INVALID_STATE,
+        "accepted"
+      ].sort());
+      await connection.close();
+    });
+    it("keeps ordinary error recovery while strict-idle prompts reject error state", async () => {
+      const fixture = await options.createFixture();
+      const scope = fixture.issueScope();
+      const strictRef = await createSession(fixture, scope, "strict-error");
+      const strictConnection = await fixture.gateway.connectSession({ scope, ref: strictRef });
+      fixture.setActivity(strictRef, "error");
+      await expectCode(strictConnection.send({
+        kind: "prompt",
+        requestId: "strict-error-prompt",
+        clientNonce: "strict-error-prompt",
+        content: "strict",
+        requireIdle: true
+      }), AgentGatewayErrorCode.AGENT_COMMAND_INVALID_STATE);
+      await strictConnection.close();
+      const recoveryRef = await createSession(fixture, scope, "ordinary-error");
+      const recoveryConnection = await fixture.gateway.connectSession({ scope, ref: recoveryRef });
+      fixture.setActivity(recoveryRef, "error");
+      await expect(recoveryConnection.send({
+        kind: "prompt",
+        requestId: "ordinary-recovery",
+        clientNonce: "ordinary-recovery",
+        content: "recover"
+      })).resolves.toMatchObject({ disposition: "prompt" });
+      await recoveryConnection.close();
+    });
     it("covers the complete command-state table and queue selector semantics", async () => {
       const fixture = await options.createFixture();
       const scope = fixture.issueScope();

package/dist/server/index.d.ts

@@ -1,18 +1,18 @@
-import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, R as RuntimeModeAdapter, a as RuntimeModeId, B as BuiltinRuntimeModeId, b as AgentRuntimeHostOperations, c as RuntimeBashStrategy, d as RuntimeFilesystemStrategy, M as ModeContext, e as WorkspaceProvisioningAdapter, f as RuntimeBundle, g as PiHarnessOptions, h as AgentMeteringSink, i as RuntimeFilesystemBinding, j as MeteringErrorLogger, k as ReadyStatusTracker, l as ResolvedAgentRuntimeScope, C as CreateAgentHostOptions, m as CompiledAgentHostAgentSpec, n as AgentRequestLedger, o as AgentEffectAdmission, p as AgentRequestKey, q as CreatedAgentHost, r as AgentFleetCompiler, A as AgentGatewayEffect, s as AgentRequestTarget, t as AgentRequestLedgerRecord, u as AgentRequestFailure, v as AgentHostLegacyRoutePolicy } from '../types-uQozUhGt.js';
-export { w as AgentHostAddressedHttpProjectionOptions, x as AgentHostAgentSpec, y as AgentHostDescription, z as AgentHostHandle, D as AgentHostHttpProjectionOptions, E as AgentHostLegacyHttpProjectionOptions, F as AgentHostLegacyProjectionComposition, G as AgentHostLegacyProjectionLifecycle, H as AgentHostLegacyProjectionRuntime, I as AgentHostLegacyRoutePolicyMountInput, J as ConfiguredAgentHostAgentSpec, L as LegacyDefaultAgentHostSpec, K as MeteringReleaseInput, N as MeteringReleaseReason, O as MeteringReservationResult, Q as MeteringReserveInput, S as MeteringRunKind, T as MeteringRunScope, U as MeteringRunStatus, V as MeteringSettleInput, X as MeteringUsage, Y as MeteringUsageInput, Z as PI_PACKAGE_RESOURCE_FILTERS, _ as PiExtensionFactory, $ as PiPackageSource, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as createResourceSettingsManager, aa as mergePiPackageSources, ab as normalizeMeteringUsage, ac as piPackageSourceKey } from '../types-uQozUhGt.js';
+import { P as ProvisionWorkspaceRuntimeOptions, W as WorkspaceProvisioningResult, R as RuntimeModeAdapter, a as RuntimeModeId, B as BuiltinRuntimeModeId, b as AgentRuntimeHostOperations, c as RuntimeBashStrategy, d as RuntimeFilesystemStrategy, M as ModeContext, e as WorkspaceProvisioningAdapter, f as RuntimeBundle, g as PiHarnessOptions, h as AgentMeteringSink, i as RuntimeFilesystemBinding, j as MeteringErrorLogger, k as ReadyStatusTracker, l as ResolvedAgentRuntimeScope, C as CreateAgentHostOptions, m as CompiledAgentHostAgentSpec, n as AgentRequestLedger, o as AgentEffectAdmission, p as AgentRequestKey, q as CreatedAgentHost, r as AgentFleetCompiler, A as AgentGatewayEffect, s as AgentRequestTarget, t as AgentRequestLedgerRecord, u as AgentRequestFailure, v as AgentHostLegacyRoutePolicy } from '../types-C-Eroi__.js';
+export { w as AgentHostAddressedHttpProjectionOptions, x as AgentHostAgentSpec, y as AgentHostDescription, z as AgentHostHandle, D as AgentHostHttpProjectionOptions, E as AgentHostLegacyHttpProjectionOptions, F as AgentHostLegacyProjectionComposition, G as AgentHostLegacyProjectionLifecycle, H as AgentHostLegacyProjectionRuntime, I as AgentHostLegacyRoutePolicyMountInput, J as ConfiguredAgentHostAgentSpec, L as LegacyDefaultAgentHostSpec, K as MeteringReleaseInput, N as MeteringReleaseReason, O as MeteringReservationResult, Q as MeteringReserveInput, S as MeteringRunKind, T as MeteringRunScope, U as MeteringRunStatus, V as MeteringSettleInput, X as MeteringUsage, Y as MeteringUsageInput, Z as PI_PACKAGE_RESOURCE_FILTERS, _ as PiExtensionFactory, $ as PiPackageSource, a0 as PluginSkillSource, a1 as ResolvedEnvironmentScope, a2 as RuntimeFilesystemBindingOperations, a3 as RuntimeNodePackageSpec, a4 as RuntimeProvisioningContribution, a5 as RuntimePythonSpec, a6 as RuntimeTemplateContribution, a7 as WorkspaceProvisioningExecResult, a8 as compactPiPackages, a9 as createResourceSettingsManager, aa as mergePiPackageSources, ab as normalizeMeteringUsage, ac as piPackageSourceKey } from '../types-C-Eroi__.js';
 import { E as ExecOptions, a as ExecResult, W as WorkspaceChangeEvent, b as Workspace, S as Sandbox } from '../sandbox-DAD8cWQR.js';
 import { R as RemoteWorkerWorkspaceOp, a as RemoteWorkerWorkspaceResult, b as RemoteWorkerExecRequest } from '../middleware-CzW8n7B7.js';
 export { c as REMOTE_WORKER_PROVIDER, d as REMOTE_WORKER_RUNTIME_CWD, e as RemoteWorkerErrorPayload, f as RemoteWorkerExecResponse, g as RemoteWorkerFsEventEnvelope, W as WORKER_INTERNAL_TOKEN_HEADER, h as WORKER_REQUEST_ID_HEADER, i as WORKER_WORKSPACE_ID_HEADER, j as createAgentAuthMiddleware } from '../middleware-CzW8n7B7.js';
 import { SandboxProviderV1, WorkspaceSandboxPairV1 } from '@hachej/boring-sandbox/shared';
-import { S as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, A as AgentDeployment, b as ShareEntryStore, P as PluginRestartWarning, W as WorkspaceAgentDispatcherContext, c as WorkspaceAgentDispatcher, d as ProviderId, e as CredentialFieldId, R as ResolvedCredentialMaterialV1, f as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, g as WorkspaceCredentialAuthorityVerifierV1, h as CredentialConsumerBindingRegistryV1, i as ProviderRegistryV1, j as WorkspaceCredentialResolverV1, k as ProviderCredentialRefV1, l as ResolvedCredentialLeaseV1 } from '../lease-BqeCLGPL.js';
+import { S as SandboxHandleStore, C as CompiledAgentBundle, a as Sha256Digest, A as AgentDeployment, b as ShareEntryStore, P as PluginRestartWarning, W as WorkspaceAgentDispatcherContext, c as WorkspaceAgentDispatcher, d as ProviderId, e as CredentialFieldId, R as ResolvedCredentialMaterialV1, f as AuthorizedWorkspaceCredentialScopeV1, V as VerifiedWorkspaceCredentialAuthorityV1, g as WorkspaceCredentialAuthorityVerifierV1, h as CredentialConsumerBindingRegistryV1, i as ProviderRegistryV1, j as WorkspaceCredentialResolverV1, k as ProviderCredentialRefV1, l as ResolvedCredentialLeaseV1 } from '../lease-CusB-uLg.js';
 import { s as AgentConfig, b as Agent, d as AgentActor, j as AgentEvent, t as AgentTool, u as AgentHarnessFactory, T as TelemetrySink, A as AgentHarness } from '../harness-Cc48o6uS.js';
 export { v as AgentHarnessFactoryInput } from '../harness-Cc48o6uS.js';
 import { b as PiChatEvent, E as ErrorCode, l as SessionCtx, S as SessionStore, m as SessionListOptions, k as SessionSummary, n as PiChatSnapshot, c as PromptPayload, d as PromptReceipt, F as FollowUpPayload, e as FollowUpReceipt, f as QueueClearPayload, g as QueueClearReceipt, I as InterruptPayload, i as StopPayload, j as StopReceipt } from '../piChatEvent-BsMp3MSo.js';
-import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, d as AgentSessionSummary, e as AgentSessionStateSnapshot, f as AgentSessionConnection, J as JsonValue, g as AgentGatewayErrorDTO } from '../errors-C38f6pol.js';
+import { A as AgentGateway, a as AuthorizedAgentScope, b as AgentSessionRef, c as AgentSessionActivity, V as VerifiedAgentScopeClaim, d as AgentSessionSummary, e as AgentSessionStateSnapshot, f as AgentSessionConnection, J as JsonValue, g as AgentGatewayErrorDTO } from '../errors-G6T6S7PQ.js';
 import { IncomingMessage, ServerResponse } from 'node:http';
 import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import { FastifyRequest, FastifyInstance, FastifyPluginAsync } from 'fastify';
-import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult, a as AgentEffectAdmission$1 } from '../piChatSessionService-BrPqKrpY.js';
+import { i as PiSessionRequestContext, g as PiChatSessionService, h as PiSessionCreateInit, e as PiChatEventSubscriber, P as PiChatEventStreamResult, a as AgentEffectAdmission$1 } from '../piChatSessionService-C0KbcGw9.js';
 import { BoringAgentRuntimePaths } from '@hachej/boring-sandbox/providers/node-workspace';
 import '@hachej/boring-bash/agent';
 import '@mariozechner/pi-coding-agent';
@@ -558,9 +558,39 @@ interface RuntimeEnvContribution {
 interface WorkspaceAgentDispatcherResolveOptions {
     request?: FastifyRequest;
 }
+interface PiSessionVisibleUserTurnTarget {
+    /** Advisory snapshot; sendIfIdle is the authoritative atomic admission. */
+    isIdle(): Promise<boolean>;
+    sendIfIdle(input: {
+        /** Stable across busy/transient retries; also used as the Pi client nonce. */
+        requestId: string;
+        message: string;
+        displayMessage?: string;
+    }): Promise<{
+        status: 'accepted';
+        cursor: number;
+        duplicate?: boolean;
+    } | {
+        status: 'busy';
+    } | {
+        status: 'gone';
+    }>;
+}
+interface BoundPiSession {
+    /** Trusted target closed over one exact logical Pi session. */
+    visibleUserMessageTarget: PiSessionVisibleUserTurnTarget;
+}
 interface WorkspaceAgentDispatcherBinding {
     dispatcher: WorkspaceAgentDispatcher;
     workspace: Workspace;
+    /**
+     * Trusted host seam used by local integrations that must bind durable work
+     * to the exact logical Pi session before accepting it.
+     */
+    bindPiSession?(sessionId: string, sessionCtx?: {
+        workspaceId?: string;
+        userId?: string;
+    }): Promise<BoundPiSession>;
 }
 interface WorkspaceAgentDispatcherResolver {
     resolve(ctx: WorkspaceAgentDispatcherContext, options?: WorkspaceAgentDispatcherResolveOptions): Promise<WorkspaceAgentDispatcher>;
@@ -721,6 +751,7 @@ declare class HarnessPiChatService implements PiChatSessionService {
     }>;
     readState(ctx: PiSessionRequestContext, sessionId: string): Promise<PiChatSnapshot>;
     private readStateBeforeDispose;
+    private canRefreshFromPersistedState;
     private harnessMayHaveLiveSession;
     private readPersistedState;
     subscribe(ctx: PiSessionRequestContext, sessionId: string, cursor: number, subscriber: PiChatEventSubscriber): Promise<PiChatEventStreamResult>;
@@ -759,6 +790,12 @@ declare class HarnessPiChatService implements PiChatSessionService {
     private createChannelOnce;
     private buildChannel;
     private readDurableLatestPiChatSeq;
+    /**
+     * Validate the persisted session identity and instantiate its lazily-created
+     * Pi adapter under the same full cache key. This is intentionally a narrow
+     * trusted-host seam rather than another browser route.
+     */
+    ensurePiSessionBound(ctx: PiSessionRequestContext, sessionId: string): Promise<void>;
     private assertCanAccessSession;
     private sessionKey;
 }
@@ -861,6 +898,7 @@ interface CreateValidatingAgentFleetCompilerOptions {
  */
 declare function createValidatingAgentFleetCompiler(options: CreateValidatingAgentFleetCompilerOptions): AgentFleetCompiler;
 
+type RetryableSessionGuard = () => Promise<AgentGatewayErrorDTO | undefined>;
 declare class EmbeddedAgentGateway implements AgentGateway {
     private readonly runtime;
     private readonly cursorSecret;
@@ -912,10 +950,12 @@ declare class EmbeddedAgentGateway implements AgentGateway {
         readonly requestId: string;
         readonly payload: JsonValue;
         readonly action: () => Promise<unknown>;
+        readonly retryableGuard?: RetryableSessionGuard;
     }): Promise<unknown>;
     private effect;
     private replayReceipt;
     private failure;
+    private promptAdmission;
     private withWriter;
     private encodeCursor;
     private decodeCursor;

package/dist/server/index.js

@@ -62,7 +62,7 @@ import {
   sandboxRuntimeHostOperations,
   shareResourceUri,
   withResolvedCredential
-} from "../chunk-4TKUT7IL.js";
+} from "../chunk-2EMAKBVR.js";
 import {
   PI_PACKAGE_RESOURCE_FILTERS,
   compactPiPackages,
@@ -70,7 +70,7 @@ import {
   mergePiPackageSources,
   piPackageSourceKey
 } from "../chunk-2TMS2RU2.js";
-import "../chunk-CJ2BW2W2.js";
+import "../chunk-EOMY2HDT.js";
 import "../chunk-NITBKFG6.js";
 import "../chunk-AQBXNPMD.js";
 import "../chunk-WSQ5QNIY.js";

package/dist/server/worker/index.js

@@ -1,9 +1,9 @@
 import {
   WORKER_INTERNAL_TOKEN_HEADER,
   constantTimeTokenEqual
-} from "../../chunk-4TKUT7IL.js";
+} from "../../chunk-2EMAKBVR.js";
 import "../../chunk-2TMS2RU2.js";
-import "../../chunk-CJ2BW2W2.js";
+import "../../chunk-EOMY2HDT.js";
 import "../../chunk-NITBKFG6.js";
 import "../../chunk-AQBXNPMD.js";
 import "../../chunk-WSQ5QNIY.js";

package/dist/shared/index.d.ts

@@ -1,13 +1,13 @@
 import { t as AgentTool } from '../harness-Cc48o6uS.js';
 export { c as AGENT_NOT_IMPLEMENTED_UNTIL_T1, b as Agent, d as AgentActor, e as AgentCoreHarness, f as AgentCoreHarnessFactory, g as AgentCorePromptInput, h as AgentCoreSessionAdapter, i as AgentCoreSessionSnapshot, j as AgentEvent, A as AgentHarness, k as AgentMessageContent, l as AgentMessagePart, m as AgentNotImplementedError, a as AgentReadiness, n as AgentReadinessStatus, o as AgentResolveInputResponse, x as AgentRuntimeAdapter, p as AgentSendInput, q as AgentStartReceipt, r as AgentStreamOptions, s as CoreAgentConfig, J as JSONSchema, M as MessageAttachment, R as RunContext, S as SendMessageInput, y as TelemetryEvent, T as TelemetrySink, z as ToolExecContext, B as ToolResult, C as noopTelemetry, D as safeCapture, E as sessionStreamPath } from '../harness-Cc48o6uS.js';
-import { m as SchemaValidationError, n as AgentSchemaIssue, a as Sha256Digest, o as AgentSchemaValidationResult, p as CredentialConsumerBindingId, e as CredentialFieldId, k as ProviderCredentialRefV1, f as AuthorizedWorkspaceCredentialScopeV1 } from '../lease-BqeCLGPL.js';
-export { q as AgentDefinition, r as AgentDefinitionDigestAsset, s as AgentDefinitionReference, t as AgentDefinitionValidationError, A as AgentDeployment, u as AgentDeploymentValidationError, v as CommandNotifyPayload, C as CompiledAgentBundle, w as CompiledAgentDefinition, x as CreateShareEntryInput, h as CredentialConsumerBindingRegistryV1, y as CredentialConsumerBindingV1, z as CredentialConsumerKindV1, B as CredentialDeliveryV1, D as CredentialFieldDefinitionV1, E as ExternalManagedAccountReferenceDefinitionV1, I as InMemoryShareEntryStore, O as OpaqueRefSchema, F as OpaqueShareLocatorIdSchema, G as PROVIDER_CREDENTIAL_REF_VERSION, H as ProviderCategoryV1, J as ProviderCredentialDefinitionV1, K as ProviderCredentialRefFactoryV1, L as ProviderDefinitionV1, d as ProviderId, i as ProviderRegistryV1, l as ResolvedCredentialLeaseV1, R as ResolvedCredentialMaterialV1, M as SandboxHandleRecord, S as SandboxHandleStore, N as Sha256DigestSchema, Q as ShareEntryErrorCode, T as ShareEntryProvenance, U as ShareEntryProvenanceSchema, X as ShareEntryResolution, b as ShareEntryStore, Y as ShareEntryTombstone, Z as ShareEntryV1, _ as ShareEntryV1Schema, $ as ShareEntryValidationError, V as VerifiedWorkspaceCredentialAuthorityV1, a0 as VerifiedWorkspaceCredentialPrincipalV1, a1 as WORKSPACE_AGENT_PLUGINS_RELOADED_EVENT, a2 as WORKSPACE_COMMAND_NOTIFY_EVENT, a3 as WorkspaceAgentDispatch, c as WorkspaceAgentDispatcher, W as WorkspaceAgentDispatcherContext, a4 as WorkspaceAgentDispatcherDispatchInput, a5 as WorkspaceAgentDispatcherSendInput, a6 as WorkspaceAgentGatewayBinding, g as WorkspaceCredentialAuthorityVerifierV1, j as WorkspaceCredentialResolverV1, a7 as createAgentAssetDigest, a8 as createAgentDefinitionDigest, a9 as createAgentDeploymentDigest, aa as createCredentialConsumerBindingRegistryV1, ab as createProviderCredentialRefFactoryV1, ac as createProviderRegistryV1, ad as resolveShareEntry, ae as validateAgentDefinition, af as validateAgentDeployment } from '../lease-BqeCLGPL.js';
+import { m as SchemaValidationError, n as AgentSchemaIssue, a as Sha256Digest, o as AgentSchemaValidationResult, p as CredentialConsumerBindingId, e as CredentialFieldId, k as ProviderCredentialRefV1, f as AuthorizedWorkspaceCredentialScopeV1 } from '../lease-CusB-uLg.js';
+export { q as AgentDefinition, r as AgentDefinitionDigestAsset, s as AgentDefinitionReference, t as AgentDefinitionValidationError, A as AgentDeployment, u as AgentDeploymentValidationError, v as CommandNotifyPayload, C as CompiledAgentBundle, w as CompiledAgentDefinition, x as CreateShareEntryInput, h as CredentialConsumerBindingRegistryV1, y as CredentialConsumerBindingV1, z as CredentialConsumerKindV1, B as CredentialDeliveryV1, D as CredentialFieldDefinitionV1, E as ExternalManagedAccountReferenceDefinitionV1, I as InMemoryShareEntryStore, O as OpaqueRefSchema, F as OpaqueShareLocatorIdSchema, G as PROVIDER_CREDENTIAL_REF_VERSION, H as ProviderCategoryV1, J as ProviderCredentialDefinitionV1, K as ProviderCredentialRefFactoryV1, L as ProviderDefinitionV1, d as ProviderId, i as ProviderRegistryV1, l as ResolvedCredentialLeaseV1, R as ResolvedCredentialMaterialV1, M as SandboxHandleRecord, S as SandboxHandleStore, N as Sha256DigestSchema, Q as ShareEntryErrorCode, T as ShareEntryProvenance, U as ShareEntryProvenanceSchema, X as ShareEntryResolution, b as ShareEntryStore, Y as ShareEntryTombstone, Z as ShareEntryV1, _ as ShareEntryV1Schema, $ as ShareEntryValidationError, V as VerifiedWorkspaceCredentialAuthorityV1, a0 as VerifiedWorkspaceCredentialPrincipalV1, a1 as WORKSPACE_AGENT_PLUGINS_RELOADED_EVENT, a2 as WORKSPACE_COMMAND_NOTIFY_EVENT, a3 as WorkspaceAgentDispatch, c as WorkspaceAgentDispatcher, W as WorkspaceAgentDispatcherContext, a4 as WorkspaceAgentDispatcherDispatchInput, a5 as WorkspaceAgentDispatcherSendInput, a6 as WorkspaceAgentGatewayBinding, g as WorkspaceCredentialAuthorityVerifierV1, j as WorkspaceCredentialResolverV1, a7 as createAgentAssetDigest, a8 as createAgentDefinitionDigest, a9 as createAgentDeploymentDigest, aa as createCredentialConsumerBindingRegistryV1, ab as createProviderCredentialRefFactoryV1, ac as createProviderRegistryV1, ad as resolveShareEntry, ae as validateAgentDefinition, af as validateAgentDeployment } from '../lease-CusB-uLg.js';
 import { b as Workspace, S as Sandbox } from '../sandbox-DAD8cWQR.js';
 export { e as Entry, E as ExecOptions, a as ExecResult, I as IsolatedCodeInput, f as IsolatedCodeOutput, g as SandboxCapability, d as Stat, c as WorkspaceRuntimeContext, h as WorkspaceWatchControlEvent } from '../sandbox-DAD8cWQR.js';
 import { B as BoringChatPart, T as ToolUiMetadata, A as AgentConsumptionErrorCode } from '../piChatEvent-BsMp3MSo.js';
 export { p as AgentDefinitionErrorCode, q as AgentDeploymentErrorCode, r as ApiErrorPayload, s as ApiErrorPayloadSchema, t as ApiErrorResponse, u as ApiErrorResponseSchema, a as BoringChatMessage, v as ChatAttachmentPayload, C as ChatError, o as ChatModelSelection, w as ChatSubmitPayload, h as CommandReceipt, x as ERROR_CODES, E as ErrorCode, y as ErrorLogFields, z as ErrorLogFieldsSchema, F as FollowUpPayload, e as FollowUpReceipt, I as InterruptPayload, D as InterruptReceipt, b as PiChatEvent, G as PiChatHeartbeatFrame, n as PiChatSnapshot, P as PiChatStatus, H as PiChatStreamFrame, c as PromptPayload, d as PromptReceipt, f as QueueClearPayload, g as QueueClearReceipt, Q as QueuedUserMessage, l as SessionCtx, J as SessionDetail, S as SessionStore, k as SessionSummary, i as StopPayload, j as StopReceipt, K as ThinkingLevel, L as extractToolUiMetadata, M as isToolUiMetadata } from '../piChatEvent-BsMp3MSo.js';
-import { F as FileSearch } from '../errors-C38f6pol.js';
-export { i as AGENT_GATEWAY_ERROR_CODES, j as AgentFollowUpCommand, A as AgentGateway, k as AgentGatewayError, l as AgentGatewayErrorCode, g as AgentGatewayErrorDTO, m as AgentPromptCommand, h as AgentScopeVerifier, n as AgentSendReceipt, c as AgentSessionActivity, f as AgentSessionConnection, o as AgentSessionEvent, p as AgentSessionPage, b as AgentSessionRef, e as AgentSessionStateSnapshot, d as AgentSessionSummary, q as AgentSummary, r as AuthSubjectId, a as AuthorizedAgentScope, s as AuthorizedAgentSessionQuery, C as ConnectAgentSessionInput, t as CreateAgentSessionInput, D as DeleteAgentSessionInput, I as IdempotentAgentControl, u as IdempotentAgentSend, v as IdempotentQueueClear, w as JsonPrimitive, x as JsonSafe, J as JsonValue, L as ListAgentsInput, R as ReadAgentSessionStateInput, y as RenameAgentSessionInput, V as VerifiedAgentScopeClaim, W as WorkspaceScopeId } from '../errors-C38f6pol.js';
+import { F as FileSearch } from '../errors-G6T6S7PQ.js';
+export { i as AGENT_GATEWAY_ERROR_CODES, j as AgentFollowUpCommand, A as AgentGateway, k as AgentGatewayError, l as AgentGatewayErrorCode, g as AgentGatewayErrorDTO, m as AgentPromptCommand, h as AgentScopeVerifier, n as AgentSendReceipt, c as AgentSessionActivity, f as AgentSessionConnection, o as AgentSessionEvent, p as AgentSessionPage, b as AgentSessionRef, e as AgentSessionStateSnapshot, d as AgentSessionSummary, q as AgentSummary, r as AuthSubjectId, a as AuthorizedAgentScope, s as AuthorizedAgentSessionQuery, C as ConnectAgentSessionInput, t as CreateAgentSessionInput, D as DeleteAgentSessionInput, I as IdempotentAgentControl, u as IdempotentAgentSend, v as IdempotentQueueClear, w as JsonPrimitive, x as JsonSafe, J as JsonValue, L as ListAgentsInput, R as ReadAgentSessionStateInput, y as RenameAgentSessionInput, V as VerifiedAgentScopeClaim, W as WorkspaceScopeId } from '../errors-G6T6S7PQ.js';
 import { z } from 'zod';
 import '@mariozechner/pi-coding-agent';
 

package/dist/{types-uQozUhGt.d.ts → types-C-Eroi__.d.ts}

@@ -1,13 +1,13 @@
 import * as fastify from 'fastify';
 import { FastifyRequest, FastifyPluginAsync } from 'fastify';
 import { w as ToolReadinessRequirement, T as TelemetrySink, b as Agent, A as AgentHarness, t as AgentTool, u as AgentHarnessFactory } from './harness-Cc48o6uS.js';
-import { F as FileSearch, b as AgentSessionRef, V as VerifiedAgentScopeClaim, g as AgentGatewayErrorDTO, J as JsonValue, a as AuthorizedAgentScope, A as AgentGateway, h as AgentScopeVerifier } from './errors-C38f6pol.js';
+import { F as FileSearch, b as AgentSessionRef, V as VerifiedAgentScopeClaim, g as AgentGatewayErrorDTO, J as JsonValue, a as AuthorizedAgentScope, A as AgentGateway, h as AgentScopeVerifier } from './errors-G6T6S7PQ.js';
 import { o as ChatModelSelection } from './piChatEvent-BsMp3MSo.js';
 import { b as Workspace, c as WorkspaceRuntimeContext, S as Sandbox } from './sandbox-DAD8cWQR.js';
 import { RuntimeHostOperations } from '@hachej/boring-bash/agent';
 import { CreateNodeWorkspaceOptions, BoringAgentRuntimePaths } from '@hachej/boring-sandbox/providers/node-workspace';
 import { PackageSource, ExtensionFactory, SettingsManager } from '@mariozechner/pi-coding-agent';
-import { A as AgentCoreSessionService, g as PiChatSessionService } from './piChatSessionService-BrPqKrpY.js';
+import { A as AgentCoreSessionService, g as PiChatSessionService } from './piChatSessionService-C0KbcGw9.js';
 
 /**
  * Generic metering seam for hosts that bill native Pi usage.

package/docs/AGENT_GATEWAY_V0.md

@@ -0,0 +1,152 @@
+# AgentGateway v0 — the session contract
+
+**Kind:** technical contract. **Governs:** the gateway surface only.
+**Does not govern:** sequencing (see `docs/DIRECTION.md`), architecture rulings
+(see `docs/DECISIONS.md`), or history (see `docs/issues/909/plan.md`).
+
+This file supersedes `docs/issues/909/plan.md` §6 as the binding description of
+the gateway contract. §6 was written before implementation and drifted; it is
+retained there as a historical record, not as a build target.
+
+Source of truth is the code: `packages/agent/src/shared/gateway/types.ts` and
+`errors.ts`. If this file and those files disagree, the code wins and this file
+is a bug. Keep them together — that colocation is the point. The v0 contract
+lived in an issue folder nobody updated, and it silently stopped matching the
+types within one release.
+
+## Scope discipline
+
+`AuthorizedAgentScope` is an **issuer-owned runtime capability, not a transport
+DTO**. It carries a `unique symbol` brand, so it cannot be forged by spreading
+an object across a boundary. It must be re-checked against issuer identity and
+current membership on every use — possession is not authorization.
+
+```ts
+interface AuthorizedAgentScope {
+  readonly workspaceScopeId: WorkspaceScopeId
+  readonly authSubjectId: AuthSubjectId
+  readonly [authorizedAgentScope]: true   // brand
+}
+```
+
+Only the app-owned verifier returns identity facts, as
+`VerifiedAgentScopeClaim`. `AgentSessionRef` deliberately carries **no
+`hostId`** — session refs are `{ agentTypeId, sessionId }` and nothing else.
+
+## The 7 methods (+ close)
+
+```ts
+interface AgentGateway {
+  listAgents(input: ListAgentsInput): Promise<readonly AgentSummary[]>
+  listSessions(input: AuthorizedAgentSessionQuery): Promise<AgentSessionPage>
+  createSession(input: CreateAgentSessionInput): Promise<AgentSessionRef>
+  connectSession(input: ConnectAgentSessionInput): Promise<AgentSessionConnection>
+  readSessionState(input: ReadAgentSessionStateInput): Promise<AgentSessionStateSnapshot>
+  renameSession(input: RenameAgentSessionInput): Promise<AgentSessionSummary>
+  deleteSession(input: DeleteAgentSessionInput): Promise<void>
+  close(): Promise<void>
+}
+```
+
+### Input DTOs — scope is NESTED
+
+**This is the correction.** §6 froze the scope fields as inherited
+(`interface CreateAgentSessionInput extends AuthorizedAgentScope`). The shipped
+contract nests scope under its own field on **every** input:
+
+```ts
+interface ListAgentsInput            { scope }
+interface AuthorizedAgentSessionQuery{ scope; agentTypeId?; cursor?; limit? }
+interface CreateAgentSessionInput    { scope; agentTypeId; requestId; title? }
+interface ConnectAgentSessionInput   { scope; ref; cursor? }
+interface ReadAgentSessionStateInput { scope; ref }
+interface RenameAgentSessionInput    { scope; ref; requestId; title }
+interface DeleteAgentSessionInput    { scope; ref; requestId }
+```
+
+Nesting keeps the branded capability a single indivisible value instead of
+scattering its fields across every DTO, which is why callers adopted it. Code
+written against §6's inherited form does not typecheck.
+
+Note `listAgents` takes `ListAgentsInput`, not a bare `AuthorizedAgentScope`.
+
+### Output DTOs
+
+`AgentSummary` (`agentTypeId`, `label`, `description?`, `definition?{version,digest}`),
+`AgentSessionSummary` (`ref`, `title`, `status`, `createdAt`, `updatedAt`),
+`AgentSessionPage` (`sessions`, `nextCursor?`), and the receipts
+(`CommandReceipt`, `AgentSendReceipt`, `QueueClearReceipt`, `StopReceipt`) are
+unchanged from §6, field for field.
+
+Session activity is the extracted alias `AgentSessionActivity`:
+`'idle' | 'running' | 'aborting' | 'error'`.
+
+`AgentSessionStateSnapshot.state` is **`JsonSafe<PiChatSnapshot>`**, not the raw
+snapshot §6 named — the transport boundary is expressed in the type.
+
+`JsonSafe<T>` itself differs from §6's version: it hoists `unknown extends T` to
+the top, maps functions to `never`, and terminates non-object/non-array at
+`never`. Read it from `types.ts`; do not reimplement it from memory.
+
+### Commands
+
+`AgentPromptCommand` and `AgentFollowUpCommand` both require
+**`{ requestId, clientNonce, content }`** — there is no `text` or `kind:'user'`
+shorthand. Prompts add `displayContent?`, `model?`, `thinkingLevel?`,
+`attachments?`; follow-ups add `clientSeq`.
+
+## Error codes
+
+Thirteen, exhaustive, order-stable, exported as both a const map and
+`AGENT_GATEWAY_ERROR_CODES`:
+
+`AGENT_TYPE_UNKNOWN` · `AGENT_SESSION_NOT_FOUND` · `AGENT_SCOPE_DENIED` ·
+`AGENT_SESSION_REPLAY_GAP` · `AGENT_SESSION_CURSOR_AHEAD` ·
+`AGENT_SESSION_CURSOR_EXPIRED` · `AGENT_SESSION_CURSOR_INVALID` ·
+`AGENT_REQUEST_CONFLICT` · `AGENT_REQUEST_OUTCOME_UNKNOWN` ·
+`AGENT_COMMAND_INVALID_STATE` · `AGENT_SESSION_RUNTIME_SCOPE_MISMATCH` ·
+`AGENT_SHARED_ENVIRONMENT_UNAVAILABLE` · `AGENT_GATEWAY_CLOSED`
+
+HTTP mapping lives in `server/agent-host/httpProjection.ts`
+(`statusForGatewayError`). Note `AGENT_SESSION_RUNTIME_SCOPE_MISMATCH`,
+`AGENT_REQUEST_CONFLICT` and `AGENT_COMMAND_INVALID_STATE` project to **409**.
+
+## Conformance levels
+
+- **Level B** — bounded replay within a process lifetime, plus snapshot
+  rehydrate. This is what ships. A cursor older than the replay window, or one
+  from before a restart, yields `REPLAY_GAP` / `CURSOR_AHEAD` and the client
+  refetches state. Never a silent gap.
+- **Level D** — durable replay across restarts and processes. Specified,
+  deliberately skipped, and owner-annotated in
+  `server/agent-host/testing/gatewayConformance.ts`. Owned by the streaming
+  lane (#1009).
+
+The suite is parameterized by `replayLevel`/`paginationLevel`; a Level D host
+must pass the same file with the flag raised.
+
+## Keyset pagination
+
+Cursors are HMAC-signed and bound to scope and filter; tampering or reuse under
+a different filter yields `AGENT_SESSION_CURSOR_INVALID`. Ordering is total, so
+a session mutated between pages shifts predictably rather than vanishing.
+
+## Known descope
+
+§10 of the 909 plan carries an unchecked acceptance box demanding recursive
+JSON/size/depth validation of attachment and path leaves on the transport
+boundary. §6.4 descoped exactly that to v2, and the conformance suite skips it
+(`v2 remote wire validates JSON event leaves, paths, depth, and size`). The
+plan is internally inconsistent on this point; the descope is what shipped.
+Anything relying on recursive leaf validation must not assume it exists.
+
+## Construction
+
+`createAgentHost()` is the single construction funnel — see
+`server/agent-host/createAgentHost.ts` and Decision 29. It is a
+deployment-static composition helper that returns a gateway and a `close()`; it
+is **not** the AgentHost deployment/publication machinery that Decisions 25–28
+rejected. Future internal/external host tiers belong to #905, not here.
+
+`scripts/check-alignment-invariants.mjs` enforces that nothing outside an
+allowlist calls it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hachej/boring-agent",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "type": "module",
   "license": "MIT",
   "description": "Pane-embeddable coding agent. Ships direct/local/vercel-sandbox execution modes behind one interface.",
@@ -91,9 +91,9 @@
     "use-stick-to-bottom": "^1.1.6",
     "yaml": "^2.9.0",
     "zod": "^3.25.76",
-    "@hachej/boring-sandbox": "0.1.93",
-    "@hachej/boring-bash": "0.1.93",
-    "@hachej/boring-ui-kit": "0.1.93"
+    "@hachej/boring-bash": "0.1.95",
+    "@hachej/boring-ui-kit": "0.1.95",
+    "@hachej/boring-sandbox": "0.1.95"
   },
   "devDependencies": {
     "@vercel/sandbox": "2.7.1",