@hearsay-tools/squawk 0.0.0-stage → 0.17.0-pr3058.5683

package/dist/workflows/pasted-content.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pasted-content.js","sourceRoot":"","sources":["../../src/workflows/pasted-content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,0CAA0C,CAAC;AAG5E;0DAC0D;AAE1D;;;;;;GAMG;AACH;;;+EAG+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC;IACjD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY;QACjC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC,CAAC,YAAY;YAC/B,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW;gBAC7B,CAAC,CAAC,WAAW,CAAC;AAClB,CAAC;AAED;;+CAE+C;AAC/C,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE;YAC3C,MAAM,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtD,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/C,CAAC,EAAE,CAAC,CAAC,CAAC;IACR,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AA0BD;;yEAEyE;AACzE,MAAM,UAAU,eAAe,CAAC,UAA+C;IAC7E,OAAO,gBAAgB,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3C,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,EAAE;QACxG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC;AAC/E,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,eAAe,CAAC,OAAiC;IAC/D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAqB,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAkC;IACtE,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,CACL,qBAAqB,WAAW,CAAC,MAAM,eAAe,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI;QAC3F,2BAA2B,IAAI,IAAI;QACnC,0FAA0F;QAC1F,4FAA4F;QAC5F,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED;oDACoD;AACpD,MAAM,UAAU,qBAAqB,CAAC,WAAkC;IACtE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,CAAC,WAAW,CAAC,EAAE,CAAC;AACpE,CAAC"}

package/dist/workflows/question-routing.d.ts

@@ -0,0 +1,16 @@
+import type { ConversationState } from '../contract/index.js';
+import type { RunRecord } from '../runs/store.ts';
+/** Where a worker's question goes (hearsay-tools/cezarion#2410). It has one addressee, its parent:
+ *  the conversation that admits it, a close when either end has stopped, or the reason a live parent
+ *  cannot take it, which Cezar answers. No case hands it to a human. */
+export type WorkerQuestionRouting = {
+    state: ConversationState;
+} | {
+    close: 'worker-stopped' | 'parent-stopped';
+} | {
+    undeliverable: string;
+};
+export declare function workerQuestionRouting(worker: RunRecord, root: RunRecord | undefined, reads: {
+    unreadable(id: string): boolean;
+    parentEnding(root: RunRecord): boolean;
+}): WorkerQuestionRouting;

package/dist/workflows/question-routing.js

@@ -0,0 +1,28 @@
+import { reservedReplies } from '../delegation/questions.js';
+import { inboxSlotsUsed } from '../delegation/conversations.js';
+const LIVE = ['queued', 'running', 'waiting'];
+export function workerQuestionRouting(worker, root, reads) {
+    // Recovery can find a question that never left a worker which has since stopped.
+    if (!LIVE.includes(worker.status) || worker.stopping)
+        return { close: 'worker-stopped' };
+    const parentId = worker.delegation?.role === 'worker' ? worker.delegation.parentRunId : undefined;
+    if (root?.delegation?.role !== 'root') {
+        return parentId !== undefined && reads.unreadable(parentId) ? { undeliverable: 'the parent record cannot be read' } : { close: 'parent-stopped' };
+    }
+    if (!LIVE.includes(root.status) || root.stopping || reads.parentEnding(root))
+        return { close: 'parent-stopped' };
+    // Answering needs the steer grant (`service.send` refuses a reply without it): a root that may not
+    // message its workers cannot take a question either. Provisioned roots hold every grant.
+    if (!root.delegation.permissions.includes('steer'))
+        return { undeliverable: 'the parent may not message its workers' };
+    const state = root.delegation.conversation ?? { messages: [], outcomes: [] };
+    // Room in the ledger for the question AND its reply, beside the replies other open requests
+    // reserve. The reply itself is always admitted to this worker's inbox (service.send).
+    // The parent's inbox slots count those its open peer requests hold for their replies.
+    if (state.messages.length + reservedReplies(state) + 2 > 1024 || inboxSlotsUsed(root) >= 32 ||
+        state.messages.filter(m => m.kind === 'request' && m.state === 'accepted' && !state.outcomes.some(o => o.requestId === m.id)).length >= 32) {
+        return { undeliverable: 'the parent conversation is at capacity' };
+    }
+    return { state };
+}
+//# sourceMappingURL=question-routing.js.map

package/dist/workflows/question-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"question-routing.js","sourceRoot":"","sources":["../../src/workflows/question-routing.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,gCAAgC,CAAC;AAUhE,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;AAE9C,MAAM,UAAU,qBAAqB,CAAC,MAAiB,EAAE,IAA2B,EAAE,KAErF;IACC,iFAAiF;IACjF,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACzF,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,IAAI,IAAI,EAAE,UAAU,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;QACtC,OAAO,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,kCAAkC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACpJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACjH,mGAAmG;IACnG,yFAAyF;IACzF,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,aAAa,EAAE,wCAAwC,EAAE,CAAC;IACvH,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,YAAY,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC7E,4FAA4F;IAC5F,sFAAsF;IACtF,sFAAsF;IACtF,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,EAAE;QACzF,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAC7I,OAAO,EAAE,aAAa,EAAE,wCAAwC,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,CAAC;AACnB,CAAC"}

package/dist/workflows/run/attachment-writer.d.ts

@@ -0,0 +1,34 @@
+import { type PastedContent, type PersistedAttachment } from '../pasted-content.ts';
+import type { RunModuleContext } from './types.ts';
+interface AttachmentWriterHost {
+    persistAttachment(runId: string, mediaType: string, data: string, namePrefix?: string): PersistedAttachment | null;
+}
+export declare class AttachmentWriter {
+    private readonly context;
+    private readonly host;
+    /** Per-run counter independent of ActiveRun, so queued runs can persist attachments.
+     * Seeded lazily from disk on the first write. */
+    readonly queuedImageSeq: Map<string, number>;
+    constructor(context: RunModuleContext, host: AttachmentWriterHost);
+    /**
+     * Persist every attachment a user message carries — images and files alike (open-mercato/cezar#950) — into the
+     * run's own attachment folder, in the order they were attached. The returned paths are what the
+     * agent is told about; the caller decides which of them also ride along as viewable blocks.
+     */
+    persistPastedAttachments(runId: string, content: readonly PastedContent[]): PersistedAttachment[];
+    /**
+     * Agent screenshot (an image block inside a tool result) or a user attachment —
+     * a pasted screenshot, or since open-mercato/cezar#950 a PDF/TXT/MD file: the base64 data never
+     * enters the NDJSON event log — it lands as a file under
+     * `.ai/cezar/runs/<id>-images/` and the transcript event carries only the name +
+     * serving URL. `namePrefix` distinguishes the two origins on disk
+     * (`screenshot-<n>.<ext>` for agent tool screenshots, `pasted-<n>.<ext>` for user
+     * attachments, open-mercato/cezar#357) and the absolute `path` lets the agent operate on the file
+     * directly (save/attach/upload) — for a non-image attachment that path is the ONLY
+     * way it ever reaches the agent.
+     * Best effort: on failure the attachment is dropped, the transcript still
+     * shows the tool result's `[screenshot]` placeholder (or the image count).
+     */
+    persistAttachment(runId: string, mediaType: string, data: string, namePrefix?: string): PersistedAttachment | null;
+}
+export {};

package/dist/workflows/run/attachment-writer.js

@@ -0,0 +1,98 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { attachmentExtension } from '../../contract/index.js';
+import { attachmentDirectory } from '../attachment-path.js';
+import { highestImageSeq } from '../pasted-content.js';
+export class AttachmentWriter {
+    context;
+    host;
+    /** Per-run counter independent of ActiveRun, so queued runs can persist attachments.
+     * Seeded lazily from disk on the first write. */
+    queuedImageSeq = new Map();
+    constructor(context, host) {
+        this.context = context;
+        this.host = host;
+    }
+    /**
+     * Persist every attachment a user message carries — images and files alike (open-mercato/cezar#950) — into the
+     * run's own attachment folder, in the order they were attached. The returned paths are what the
+     * agent is told about; the caller decides which of them also ride along as viewable blocks.
+     */
+    persistPastedAttachments(runId, content) {
+        return content
+            .map((b) => {
+            const saved = b.type === 'image'
+                ? this.host.persistAttachment(runId, b.source.media_type, b.source.data, 'pasted')
+                : b.type === 'file'
+                    ? this.host.persistAttachment(runId, b.mediaType, b.data, 'pasted')
+                    : null;
+            if (b.type === 'file' && !saved) {
+                this.context.store.appendEvent(runId, {
+                    type: 'note', tone: 'danger',
+                    message: `${b.mediaType} attachment could not be saved — please attach it again`,
+                });
+            }
+            return saved;
+        })
+            .filter((saved) => saved !== null);
+    }
+    /**
+     * Agent screenshot (an image block inside a tool result) or a user attachment —
+     * a pasted screenshot, or since open-mercato/cezar#950 a PDF/TXT/MD file: the base64 data never
+     * enters the NDJSON event log — it lands as a file under
+     * `.ai/cezar/runs/<id>-images/` and the transcript event carries only the name +
+     * serving URL. `namePrefix` distinguishes the two origins on disk
+     * (`screenshot-<n>.<ext>` for agent tool screenshots, `pasted-<n>.<ext>` for user
+     * attachments, open-mercato/cezar#357) and the absolute `path` lets the agent operate on the file
+     * directly (save/attach/upload) — for a non-image attachment that path is the ONLY
+     * way it ever reaches the agent.
+     * Best effort: on failure the attachment is dropped, the transcript still
+     * shows the tool result's `[screenshot]` placeholder (or the image count).
+     */
+    persistAttachment(runId, mediaType, data, namePrefix = 'screenshot') {
+        try {
+            // One mapping, shared with the wire (`packages/contract`): an image keeps the extension it
+            // always had, a file gets `pdf`/`txt`/`md`, and both share the `pasted-<n>` numbering space
+            // below so a `pasted-3.md` can never collide with a `pasted-3.png`.
+            const ext = attachmentExtension(mediaType);
+            const dir = join(this.context.dataDir, 'runs', `${runId}-images`);
+            mkdirSync(dir, { recursive: true });
+            if (!attachmentDirectory(this.context.dataDir, runId))
+                return null;
+            // Seed from the highest numeric suffix already on disk, NOT the file count:
+            // `screenshot-*` and `pasted-*` share one numbering space, so counting would
+            // re-issue a live number after any deletion. Only matters on the first write
+            // of a process (restart case) — afterwards the map is authoritative.
+            let seq = this.queuedImageSeq.get(runId);
+            if (seq === undefined)
+                seq = highestImageSeq(dir);
+            // `persistAttachment` is fully synchronous, so two pastes cannot interleave between
+            // the read of the counter and the write. The exclusive-create flag is the
+            // belt-and-braces guard for a stale seed: it degrades to a renamed file rather
+            // than a silent overwrite.
+            for (let attempt = 0; attempt < 100; attempt += 1) {
+                seq += 1;
+                const name = `${namePrefix}-${seq}.${ext}`;
+                const path = join(dir, name);
+                try {
+                    writeFileSync(path, Buffer.from(data, 'base64'), { flag: 'wx' });
+                }
+                catch (err) {
+                    if (err.code === 'EEXIST')
+                        continue;
+                    throw err;
+                }
+                this.queuedImageSeq.set(runId, seq);
+                // Versioned, because that is the only surface served now. The cockpit still upgrades
+                // the unversioned URLs sitting in OLD transcripts when it renders them
+                // (`resolveApiUrl`), but a URL minted today must be fetchable as written.
+                return { name, url: `/api/v1/runs/${runId}/images/${name}`, path };
+            }
+            return null;
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=attachment-writer.js.map

package/dist/workflows/run/attachment-writer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachment-writer.js","sourceRoot":"","sources":["../../../src/workflows/run/attachment-writer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0CAA0C,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAgD,MAAM,sBAAsB,CAAC;AAOrG,MAAM,OAAO,gBAAgB;IAKE,OAAO;IAAqC,IAAI;IAJ7E;qDACiD;IACxC,cAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEpD,YAA6B,OAAyB,EAAmB,IAA0B;uBAAtE,OAAO;oBAAqC,IAAI;IAAyB,CAAC;IAEvG;;;;OAIG;IACH,wBAAwB,CACtB,KAAa,EACb,OAAiC;QAEjC,OAAO,OAAO;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,KAAK,OAAO;gBAC9B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAClF,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM;oBACjB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC;oBACnE,CAAC,CAAC,IAAI,CAAC;YACX,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;oBACpC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ;oBAC5B,OAAO,EAAE,GAAG,CAAC,CAAC,SAAS,yDAAyD;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,KAAK,EAAgC,EAAE,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC;IACrE,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,iBAAiB,CACf,KAAa,EACb,SAAiB,EACjB,IAAY,EACZ,UAAU,GAAW,YAAY;QAEjC,IAAI,CAAC;YACH,2FAA2F;YAC3F,4FAA4F;YAC5F,oEAAoE;YACpE,MAAM,GAAG,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;YAClE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnE,4EAA4E;YAC5E,6EAA6E;YAC7E,6EAA6E;YAC7E,qEAAqE;YACrE,IAAI,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,GAAG,KAAK,SAAS;gBAAE,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;YAClD,oFAAoF;YACpF,0EAA0E;YAC1E,+EAA+E;YAC/E,2BAA2B;YAC3B,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;gBAClD,GAAG,IAAI,CAAC,CAAC;gBACT,MAAM,IAAI,GAAG,GAAG,UAAU,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;gBAC7B,IAAI,CAAC;oBACH,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnE,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;wBAAE,SAAS;oBAC/D,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBACpC,qFAAqF;gBACrF,uEAAuE;gBACvE,0EAA0E;gBAC1E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,gBAAgB,KAAK,WAAW,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC;YACrE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAEF"}

package/dist/workflows/run/auto-resume.d.ts

@@ -0,0 +1,91 @@
+import type { RunRecord, RunStore } from '../../runs/store.ts';
+import type { ContinueRunOptions } from '../continuation-admission.ts';
+import type { RunExitId } from '../../runs/run-exits.ts';
+import type { RunModuleContext } from './types.ts';
+interface AutoResumeHost {
+    move(runId: string, exit: RunExitId, patch: Omit<Parameters<RunStore['updateRun']>[1], 'status'>): RunRecord | undefined;
+    continueRun(runId: string, opts: ContinueRunOptions, deferForCapacity: boolean): {
+        ok: boolean;
+        error?: string;
+    };
+    pump(): Promise<void>;
+}
+/**
+ * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * The wait is the provider's own reset instant plus this grace: resuming AT the boundary races the
+ * provider's clock (and its rounding), and one failed resume costs the whole window over again.
+ * Thirty seconds is cheap next to five hours and long enough to be past any sane skew.
+ */
+export declare const AUTO_RESUME_GRACE_MS = 30000;
+/**
+ * Consecutive automatic resumes allowed without a human turn. A resume can only fire after a real
+ * reset instant, so this is not a throttle — it is the backstop for the pathological case (a
+ * provider that answers "limit reached, retry now" in a loop), and it is deliberately generous
+ * enough to sit through a couple of days of five-hour windows.
+ */
+export declare const MAX_AUTO_RESUMES = 12;
+/**
+ * How long a missed deadline stays worth acting on. The promise is "we pick this up when the
+ * window reopens" — kept across a restart or an overnight close, which is the case the feature
+ * exists for. A day later it is no longer that promise: the user has moved on, and a task
+ * springing back to life is a surprise rather than a service. Such a deadline is retired with a
+ * note instead of fired, so the only tasks a sweep can revive are ones someone is still waiting on.
+ */
+export declare const AUTO_RESUME_MISSED_WINDOW_MS: number;
+export declare class AutoResumeScheduler {
+    private readonly context;
+    private readonly host;
+    /** Armed usage-limit resumes, keyed by run id (spec
+     *  2026-08-03-auto-resume-after-usage-limit). The DEADLINE itself lives on the record
+     *  (`autoResumeAt`) — this map holds only the process-local timer, so a restart rebuilds it
+     *  from the record rather than losing the wait. Runs here are `failed` and therefore NOT in
+     *  `active`, which is why the timer cannot live on an `ActiveRun` like the monitoring one. */
+    readonly autoResumeTimers: Map<string, NodeJS.Timeout>;
+    constructor(context: RunModuleContext, host: AutoResumeHost);
+    dispose(): void;
+    /**
+     * A run just failed: if the provider said "usage limit, back at T", promise to resume it at
+     * `T + AUTO_RESUME_GRACE_MS` instead of leaving the task dead until someone notices.
+     *
+     * Every refusal below is silent-but-honest — the run stays `failed` with its Continue button,
+     * which is exactly the pre-feature behavior — except the safety cap, which says so on the
+     * transcript, because a run that stops resuming itself needs to explain why.
+     */
+    scheduleAutoResumeIfLimited(runId: string): void;
+    /** Publish the deadline on the record (the cockpit's only source) and arm the timer for it. The
+     *  run waits for it (hearsay-tools/cezarion#1236): `waiting`, its error kept for a withdrawal. */
+    private armAutoResume;
+    /**
+     * The window has reopened. Re-check the record synchronously — hours may have passed, and the
+     * user may have continued, deleted or cancelled the run in them — then hand the resume to the
+     * ordinary queued-continuation path so it obeys both concurrency caps like any other work.
+     */
+    private fireAutoResume;
+    /**
+     * Reconcile process-local resume timers from durable records on pump and recovery. Retire
+     * appointments when disabled or invalid; do not leave a deadline with no wake source.
+     */
+    reconcileAutoResumes(): void;
+    /**
+     * The PER-TASK off switch (`DELETE /api/v1/runs/:id/auto-resume`, and the archive route):
+     * stop resuming THIS task, without touching the workspace setting or any other task.
+     *
+     * Idempotent — a run with nothing pending answers the same way, because "this task will not
+     * resume itself" is equally true either way. Returns false only when the run does not exist,
+     * which is the route's 404.
+     */
+    cancelAutoResume(runId: string): boolean;
+    /** Retire a pending resume — timer, deadline and counter. The counter goes too because every
+     *  caller is a fresh epoch: a human Continue, or a resume that re-stamps its own count. */
+    clearAutoResume(runId: string): void;
+    /**
+     * Withdraw a pending resume without continuing the run: a per-task cancel, the setting switched
+     * off, a missed window, the cap, or a resume that could not start. A run on hold settles
+     * `failed` with the error it kept, the state it was in before it waited (owner,
+     * 2026-10-21). Its waits stay as a failed run's do: open ones armed, resolved ones owed to the
+     * next Continue.
+     */
+    private withdrawAutoResume;
+}
+export {};

package/dist/workflows/run/auto-resume.js

@@ -0,0 +1,247 @@
+import { isUsageLimitHold } from '../../contract/index.js';
+import { parseUsageLimit } from '../../core/usage-limit.js';
+import { formatWakeInstant } from '../run-scheduling.js';
+/**
+ * Auto-resume after a provider usage limit (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * The wait is the provider's own reset instant plus this grace: resuming AT the boundary races the
+ * provider's clock (and its rounding), and one failed resume costs the whole window over again.
+ * Thirty seconds is cheap next to five hours and long enough to be past any sane skew.
+ */
+export const AUTO_RESUME_GRACE_MS = 30_000;
+/**
+ * Consecutive automatic resumes allowed without a human turn. A resume can only fire after a real
+ * reset instant, so this is not a throttle — it is the backstop for the pathological case (a
+ * provider that answers "limit reached, retry now" in a loop), and it is deliberately generous
+ * enough to sit through a couple of days of five-hour windows.
+ */
+export const MAX_AUTO_RESUMES = 12;
+/**
+ * How long a missed deadline stays worth acting on. The promise is "we pick this up when the
+ * window reopens" — kept across a restart or an overnight close, which is the case the feature
+ * exists for. A day later it is no longer that promise: the user has moved on, and a task
+ * springing back to life is a surprise rather than a service. Such a deadline is retired with a
+ * note instead of fired, so the only tasks a sweep can revive are ones someone is still waiting on.
+ */
+export const AUTO_RESUME_MISSED_WINDOW_MS = 24 * 60 * 60_000;
+const AUTO_RESUME_PROMPT = 'The provider usage limit that interrupted this task has reset. Read the handoff file (HSQ_HANDOFF_FILE (CEZ_HANDOFF_FILE fallback)) to recover context, then continue the task from where you left off.';
+export class AutoResumeScheduler {
+    context;
+    host;
+    /** Armed usage-limit resumes, keyed by run id (spec
+     *  2026-08-03-auto-resume-after-usage-limit). The DEADLINE itself lives on the record
+     *  (`autoResumeAt`) — this map holds only the process-local timer, so a restart rebuilds it
+     *  from the record rather than losing the wait. Runs here are `failed` and therefore NOT in
+     *  `active`, which is why the timer cannot live on an `ActiveRun` like the monitoring one. */
+    autoResumeTimers = new Map();
+    constructor(context, host) {
+        this.context = context;
+        this.host = host;
+    }
+    dispose() {
+        for (const timer of this.autoResumeTimers.values())
+            clearTimeout(timer);
+        this.autoResumeTimers.clear();
+    }
+    /**
+     * A run just failed: if the provider said "usage limit, back at T", promise to resume it at
+     * `T + AUTO_RESUME_GRACE_MS` instead of leaving the task dead until someone notices.
+     *
+     * Every refusal below is silent-but-honest — the run stays `failed` with its Continue button,
+     * which is exactly the pre-feature behavior — except the safety cap, which says so on the
+     * transcript, because a run that stops resuming itself needs to explain why.
+     */
+    scheduleAutoResumeIfLimited(runId) {
+        if (this.autoResumeTimers.has(runId))
+            return; // already promised
+        const run = this.context.store.getRun(runId);
+        if (!run || run.status !== 'failed')
+            return;
+        // Archiving IS resigning from a task. Reviving one because a window happened to reopen would
+        // be the feature working against the clearest signal the user can give it.
+        if (run.archived)
+            return;
+        const limit = parseUsageLimit(run.error);
+        if (!limit)
+            return;
+        if (!this.context.semaphore.autoResumeOnUsageLimit())
+            return;
+        // No session to resume = nothing this feature can do; `continueRun` would refuse anyway.
+        if (!run.steps.some((step) => step.sessionId))
+            return;
+        const attempts = run.autoResumeAttempts ?? 0;
+        if (attempts >= MAX_AUTO_RESUMES) {
+            this.context.store.appendEvent(runId, {
+                type: 'note',
+                message: `automatic resume cap reached (${MAX_AUTO_RESUMES}) — continue this task manually`,
+            });
+            return;
+        }
+        const wakeAt = new Date(limit.resetAt.getTime() + AUTO_RESUME_GRACE_MS);
+        this.armAutoResume(runId, wakeAt.getTime());
+        this.context.store.appendEvent(runId, {
+            type: 'lifecycle',
+            message: `usage limit reached — resuming automatically at ${formatWakeInstant(wakeAt)}`,
+        });
+    }
+    /** Publish the deadline on the record (the cockpit's only source) and arm the timer for it. The
+     *  run waits for it (hearsay-tools/cezarion#1236): `waiting`, its error kept for a withdrawal. */
+    armAutoResume(runId, deadline) {
+        this.host.move(runId, 'hold', { autoResumeAt: new Date(deadline).toISOString() });
+        const timer = setTimeout(() => this.fireAutoResume(runId), Math.max(0, deadline - Date.now()));
+        timer.unref?.();
+        this.autoResumeTimers.set(runId, timer);
+    }
+    /**
+     * The window has reopened. Re-check the record synchronously — hours may have passed, and the
+     * user may have continued, deleted or cancelled the run in them — then hand the resume to the
+     * ordinary queued-continuation path so it obeys both concurrency caps like any other work.
+     */
+    fireAutoResume(runId) {
+        this.autoResumeTimers.delete(runId);
+        const run = this.context.store.getRun(runId);
+        if (!run || !isUsageLimitHold(run))
+            return;
+        // Belt and braces against the one gap `reconcileAutoResumes` cannot close: the setting going
+        // off in the window between the last pump and this tick.
+        if (!this.context.semaphore.autoResumeOnUsageLimit()) {
+            this.withdrawAutoResume(runId, 'automatic resume cancelled — auto-resume is switched off');
+            return;
+        }
+        const attempts = (run.autoResumeAttempts ?? 0) + 1;
+        // `continueRun` retires the pending resume (timer + record fields) on the way in — this is a
+        // resume, not a user turn, so the counter is put back straight after.
+        const resumed = this.host.continueRun(runId, { text: AUTO_RESUME_PROMPT }, true);
+        if (!resumed.ok) {
+            // Refusals happen before `continueRun` retires anything, so the deadline is still on the
+            // record — and a deadline in the past is a promise the cockpit keeps displaying and the
+            // engine will never keep. Retire it here instead, and say why.
+            this.withdrawAutoResume(runId, `automatic resume could not start — ${resumed.error ?? 'unknown'}`);
+            return;
+        }
+        this.context.store.updateRun(runId, { autoResumeAttempts: attempts });
+        this.context.store.appendEvent(runId, {
+            type: 'lifecycle',
+            message: `usage limit reset — resuming automatically (${attempts}/${MAX_AUTO_RESUMES})`,
+        });
+        // A deferred continuation only ENQUEUES itself; the queue moves when something pumps it, and
+        // `recover()` — the other deferring caller — pumps once after its whole bulk sweep. A timer
+        // firing on its own has no such follow-up, so without this the resumed run sits at `queued`
+        // until some unrelated run happens to finish. This is the pump for it.
+        void this.host.pump();
+    }
+    /**
+     * Reconcile process-local resume timers from durable records on pump and recovery. Retire
+     * appointments when disabled or invalid; do not leave a deadline with no wake source.
+     */
+    reconcileAutoResumes() {
+        if (!this.context.semaphore.autoResumeOnUsageLimit()) {
+            // Sweep the RECORDS, not the timer map. A record promising a resume that no timer is
+            // holding is the exact population this method exists for, and it is also the one the
+            // setting can be switched off in front of: cezar restarted while it was off, the config
+            // was hand-edited, or the project context was disposed mid-wait. Retiring only the armed
+            // timers leaves such a record with a live `autoResumeAt`, which `accountHolds()` reads as
+            // a deadline hold — so nothing new starts on that account, `rescueStalledQueue` treats the
+            // phantom appointment as a legitimate reason to sit still, and the cockpit shows a
+            // `scheduled` row for a resume that will never come. `clearAutoResume` covers the armed
+            // ones too, so this one loop is the whole cancellation. It reads any resume time, not
+            // `isUsageLimitHold`, so a stale one is retired too.
+            const pending = new Set([
+                ...this.autoResumeTimers.keys(),
+                ...this.context.store.listRuns().filter((run) => run.autoResumeAt !== undefined).map((run) => run.id),
+            ]);
+            for (const runId of pending)
+                this.withdrawAutoResume(runId, 'automatic resume cancelled — auto-resume is switched off');
+            return;
+        }
+        for (const run of this.context.store.listRuns()) {
+            if (!isUsageLimitHold(run))
+                continue;
+            if (this.autoResumeTimers.has(run.id))
+                continue;
+            const deadline = Date.parse(run.autoResumeAt);
+            // A deadline that is unreadable, belongs to a run that has spent its cap, or belongs to a
+            // task the user has archived is retired rather than re-armed: it can only mislead. One
+            // that has just passed arms at zero — the window is open, which is the point.
+            if (run.archived
+                || !Number.isFinite(deadline)
+                || (run.autoResumeAttempts ?? 0) >= MAX_AUTO_RESUMES) {
+                this.withdrawAutoResume(run.id);
+                continue;
+            }
+            // …and one missed by more than a day is retired loudly: reviving a task from another era
+            // is a surprise, not a service, and this is what keeps a sweep from resurrecting every
+            // limit-stopped task a user has long since walked away from.
+            if (Date.now() - deadline > AUTO_RESUME_MISSED_WINDOW_MS) {
+                this.withdrawAutoResume(run.id, 'automatic resume expired — its window reopened over a day ago; continue this task manually');
+                continue;
+            }
+            this.armAutoResume(run.id, deadline);
+        }
+    }
+    /**
+     * The PER-TASK off switch (`DELETE /api/v1/runs/:id/auto-resume`, and the archive route):
+     * stop resuming THIS task, without touching the workspace setting or any other task.
+     *
+     * Idempotent — a run with nothing pending answers the same way, because "this task will not
+     * resume itself" is equally true either way. Returns false only when the run does not exist,
+     * which is the route's 404.
+     */
+    cancelAutoResume(runId) {
+        const run = this.context.store.getRun(runId);
+        if (!run)
+            return false;
+        // Any resume time, not `isUsageLimitHold`: a withdrawal also retires one a record kept by mistake.
+        const pending = run.autoResumeAt !== undefined || this.autoResumeTimers.has(runId);
+        this.withdrawAutoResume(runId, pending ? 'automatic resume cancelled for this task' : undefined);
+        if (pending) {
+            // This run may have been the last thing holding its account's queue — nothing else will
+            // notice, since the hold is derived and its release is not an event.
+            void this.host.pump();
+        }
+        return true;
+    }
+    /** Retire a pending resume — timer, deadline and counter. The counter goes too because every
+     *  caller is a fresh epoch: a human Continue, or a resume that re-stamps its own count. */
+    clearAutoResume(runId) {
+        const timer = this.autoResumeTimers.get(runId);
+        if (timer)
+            clearTimeout(timer);
+        this.autoResumeTimers.delete(runId);
+        const run = this.context.store.getRun(runId);
+        if (!run)
+            return;
+        // A continuation's own status write retires the appointment of a run on hold
+        // (hearsay-tools/cezarion#1236): clearing it first would show a waiting run with no
+        // appointment, which reads as Needs you, for the moment between the two writes.
+        if (isUsageLimitHold(run)) {
+            if (run.autoResumeAttempts !== undefined)
+                this.context.store.updateRun(runId, { autoResumeAttempts: undefined });
+            return;
+        }
+        // Any resume time, not `isUsageLimitHold`: it retires a stale one too.
+        if (run.autoResumeAt !== undefined || run.autoResumeAttempts !== undefined) {
+            this.context.store.updateRun(runId, { autoResumeAt: undefined, autoResumeAttempts: undefined });
+        }
+    }
+    /**
+     * Withdraw a pending resume without continuing the run: a per-task cancel, the setting switched
+     * off, a missed window, the cap, or a resume that could not start. A run on hold settles
+     * `failed` with the error it kept, the state it was in before it waited (owner,
+     * 2026-10-21). Its waits stay as a failed run's do: open ones armed, resolved ones owed to the
+     * next Continue.
+     */
+    withdrawAutoResume(runId, note) {
+        // Committed first: a store that cannot write throws here with the timer still armed, and the
+        // note is written only once the withdrawal is on disk (hearsay-tools/cezarion#1236).
+        if (this.context.store.getRun(runId))
+            this.context.store.commitAutoResumeWithdrawal(runId);
+        const timer = this.autoResumeTimers.get(runId);
+        if (timer)
+            clearTimeout(timer);
+        this.autoResumeTimers.delete(runId);
+        if (note && this.context.store.getRun(runId))
+            this.context.store.appendEvent(runId, { type: 'note', message: note });
+    }
+}
+//# sourceMappingURL=auto-resume.js.map

package/dist/workflows/run/auto-resume.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-resume.js","sourceRoot":"","sources":["../../../src/workflows/run/auto-resume.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAG5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAUzD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE7D,MAAM,kBAAkB,GACtB,yMAAyM,CAAC;AAE5M,MAAM,OAAO,mBAAmB;IAQD,OAAO;IAAqC,IAAI;IAP7E;;;;kGAI8F;IACrF,gBAAgB,GAAG,IAAI,GAAG,EAA0B,CAAC;IAE9D,YAA6B,OAAyB,EAAmB,IAAoB;uBAAhE,OAAO;oBAAqC,IAAI;IAAmB,CAAC;IAEjG,OAAO;QACL,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxE,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAChC,CAAC;IAED;;;;;;;OAOG;IACH,2BAA2B,CAAC,KAAa;QACvC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,mBAAmB;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO;QAC5C,6FAA6F;QAC7F,2EAA2E;QAC3E,IAAI,GAAG,CAAC,QAAQ;YAAE,OAAO;QACzB,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK;YAAE,OAAO;QACnB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE;YAAE,OAAO;QAC7D,yFAAyF;QACzF,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO;QACtD,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC;QAC7C,IAAI,QAAQ,IAAI,gBAAgB,EAAE,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;gBACpC,IAAI,EAAE,MAAM;gBACZ,OAAO,EAAE,iCAAiC,gBAAgB,iCAAiC;aAC5F,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,oBAAoB,CAAC,CAAC;QACxE,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;YACpC,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,mDAAmD,iBAAiB,CAAC,MAAM,CAAC,EAAE;SACxF,CAAC,CAAC;IACL,CAAC;IAED;sGACkG;IAC1F,aAAa,CAAC,KAAa,EAAE,QAAgB;QACnD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC/F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACK,cAAc,CAAC,KAAa;QAClC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;YAAE,OAAO;QAC3C,6FAA6F;QAC7F,yDAAyD;QACzD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACrD,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,0DAA0D,CAAC,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,6FAA6F;QAC7F,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,yFAAyF;YACzF,wFAAwF;YACxF,+DAA+D;YAC/D,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,sCAAsC,OAAO,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;YACnG,OAAO;QACT,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,kBAAkB,EAAE,QAAQ,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE;YACpC,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,+CAA+C,QAAQ,IAAI,gBAAgB,GAAG;SACxF,CAAC,CAAC;QACH,6FAA6F;QAC7F,4FAA4F;QAC5F,4FAA4F;QAC5F,uEAAuE;QACvE,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,oBAAoB;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,CAAC;YACrD,qFAAqF;YACrF,qFAAqF;YACrF,wFAAwF;YACxF,yFAAyF;YACzF,0FAA0F;YAC1F,2FAA2F;YAC3F,mFAAmF;YACnF,wFAAwF;YACxF,sFAAsF;YACtF,qDAAqD;YACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;gBACtB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE;gBAC/B,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;aACtG,CAAC,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,OAAO;gBAAE,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,0DAA0D,CAAC,CAAC;YACxH,OAAO;QACT,CAAC;QACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAChD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACrC,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAE,SAAS;YAChD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YAC9C,0FAA0F;YAC1F,uFAAuF;YACvF,8EAA8E;YAC9E,IACE,GAAG,CAAC,QAAQ;mBACT,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;mBAC1B,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC,IAAI,gBAAgB,EACpD,CAAC;gBACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChC,SAAS;YACX,CAAC;YACD,yFAAyF;YACzF,uFAAuF;YACvF,6DAA6D;YAC7D,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,4BAA4B,EAAE,CAAC;gBACzD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,EAAE,EAAE,4FAA4F,CAAC,CAAC;gBAC9H,SAAS;YACX,CAAC;YACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,gBAAgB,CAAC,KAAa;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QACvB,mGAAmG;QACnG,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnF,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACjG,IAAI,OAAO,EAAE,CAAC;YACZ,wFAAwF;YACxF,qEAAqE;YACrE,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;+FAC2F;IAC3F,eAAe,CAAC,KAAa;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,OAAO;QACjB,6EAA6E;QAC7E,oFAAoF;QACpF,gFAAgF;QAChF,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS;gBAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;YACjH,OAAO;QACT,CAAC;QACD,uEAAuE;QACvE,IAAI,GAAG,CAAC,YAAY,KAAK,SAAS,IAAI,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAAE,CAAC;YAC3E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,SAAS,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,kBAAkB,CAAC,KAAa,EAAE,IAAa;QACrD,6FAA6F;QAC7F,qFAAqF;QACrF,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACvH,CAAC;CACF"}

package/dist/workflows/run/cezar-tools.d.ts

@@ -0,0 +1,45 @@
+import type { acquireCiResources } from '../../ci-wait/resources.ts';
+import { type PreviewHostLike } from '../../preview/registration.ts';
+import type { RunStore, RunRecord } from '../../runs/store.ts';
+import type { ActiveRun } from '../active-run.ts';
+import type { AutomationToolService, RunModuleContext } from './types.ts';
+import type { CezarToolHandlers } from '../../ci-wait/controller.ts';
+import { type CezarWaitRequestInput, type CezarAskRequest, type CezarDoneRequest, type CezarDoneAnswer, type WaitVia, type HumanWaitEntry, type PrWaitEntry, type TimerWaitEntry, type WorkerWaitEntry, type ProcessWaitEntry, type PeerWaitEntry } from '../../contract/index.js';
+import type { PreviewServeRequest, PreviewServeResult, PreviewStopRequest, PreviewStopResult } from '../../contract/index.js';
+export declare class AutomationToolsSlot {
+    private readonly cockpitAttached;
+    constructor(_context: RunModuleContext, cockpitAttached: () => boolean);
+    private automationTools?;
+    private automationToolsWaiters;
+    setAutomationTools(tools: AutomationToolService | undefined): void;
+    awaitAutomationTools(signal: AbortSignal): Promise<AutomationToolService | undefined>;
+}
+export type ToolHost = {
+    store: RunStore;
+    registerWait(runId: string, request: CezarWaitRequestInput, via: WaitVia, generation: string, signal?: AbortSignal): Promise<PrWaitEntry | TimerWaitEntry | WorkerWaitEntry | ProcessWaitEntry | PeerWaitEntry>;
+    registerAsk(runId: string, request: CezarAskRequest, generation: string, signal?: AbortSignal): Promise<HumanWaitEntry>;
+    cancelWait(runId: string, waitId: string, generation: string): {
+        cancelled: true;
+    } | {
+        cancelled: false;
+        code: 'not_found' | 'already_resolved' | 'human_question';
+    };
+    acceptDone(runId: string, generation: string, request: CezarDoneRequest, signal?: AbortSignal): CezarDoneAnswer;
+    registerPreviewServer(runId: string, request: PreviewServeRequest, signal?: AbortSignal): Promise<PreviewServeResult>;
+    stopPreviewServer(runId: string, request: PreviewStopRequest, signal?: AbortSignal): Promise<PreviewStopResult>;
+    awaitAutomationTools(signal: AbortSignal): Promise<AutomationToolService | undefined>;
+};
+export declare function cezarToolHandlers(runId: string, generation: string, host: ToolHost): CezarToolHandlers;
+export declare function toolSessionRefusal(run: RunRecord | undefined, state: ActiveRun | undefined, active: ActiveRun | undefined, generation: string, signal: AbortSignal | undefined, disposed: boolean): "capability_revoked" | "finish_requested" | "generation_mismatch" | "manager_disposed" | "run_cancelled" | "run_missing" | "run_not_running" | "run_stopping" | "session_closed" | "session_replaced" | undefined;
+export interface CiSessionHost {
+    active: ReadonlyMap<string, ActiveRun>;
+    ciResources(): ReturnType<typeof acquireCiResources>;
+    cezarToolHandlers(runId: string, generation: string): CezarToolHandlers;
+    preview(): PreviewHostLike | undefined;
+    cockpit(): {
+        origin: string;
+        projectId: string;
+    } | undefined;
+}
+/** Provision the same capability and descriptor on every start, Continue and recovered launch. */
+export declare function provisionCiSession(context: RunModuleContext, host: CiSessionHost, runId: string, state: ActiveRun): Promise<import("../../ci-wait/controller.ts").CiToolSession | undefined>;