@junando/webhook 0.12.2 → 0.13.0

package/dist/node-DdUjbr7d.cjs

@@ -0,0 +1,2703 @@
+const require_rolldown_runtime = require('./rolldown-runtime-BDXX5GFZ.cjs');
+const require_sdk = require('./sdk-DKBOmAd5.cjs');
+require('./node-CaH-Nh2c.cjs');
+let node_crypto = require("node:crypto");
+node_crypto = require_rolldown_runtime.__toESM(node_crypto, 1);
+let node_fs = require("node:fs");
+node_fs = require_rolldown_runtime.__toESM(node_fs, 1);
+let node_path = require("node:path");
+node_path = require_rolldown_runtime.__toESM(node_path, 1);
+let node_fs_promises = require("node:fs/promises");
+node_fs_promises = require_rolldown_runtime.__toESM(node_fs_promises, 1);
+let node_child_process = require("node:child_process");
+node_child_process = require_rolldown_runtime.__toESM(node_child_process, 1);
+let node_readline = require("node:readline");
+node_readline = require_rolldown_runtime.__toESM(node_readline, 1);
+let node_util = require("node:util");
+node_util = require_rolldown_runtime.__toESM(node_util, 1);
+let node_stream = require("node:stream");
+node_stream = require_rolldown_runtime.__toESM(node_stream, 1);
+
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/lib/transform-json-schema.mjs
+const SUPPORTED_STRING_FORMATS = new Set([
+	"date-time",
+	"time",
+	"date",
+	"duration",
+	"email",
+	"hostname",
+	"uri",
+	"ipv4",
+	"ipv6",
+	"uuid"
+]);
+function deepClone(obj) {
+	return JSON.parse(JSON.stringify(obj));
+}
+function transformJSONSchema(jsonSchema) {
+	const workingCopy = deepClone(jsonSchema);
+	return _transformJSONSchema(workingCopy);
+}
+function _transformJSONSchema(jsonSchema) {
+	const strictSchema = {};
+	const ref = require_sdk.pop(jsonSchema, "$ref");
+	if (ref !== undefined) {
+		strictSchema["$ref"] = ref;
+		return strictSchema;
+	}
+	const defs = require_sdk.pop(jsonSchema, "$defs");
+	if (defs !== undefined) {
+		const strictDefs = {};
+		strictSchema["$defs"] = strictDefs;
+		for (const [name, defSchema] of Object.entries(defs)) {
+			strictDefs[name] = _transformJSONSchema(defSchema);
+		}
+	}
+	const type = require_sdk.pop(jsonSchema, "type");
+	const anyOf = require_sdk.pop(jsonSchema, "anyOf");
+	const oneOf = require_sdk.pop(jsonSchema, "oneOf");
+	const allOf = require_sdk.pop(jsonSchema, "allOf");
+	if (Array.isArray(anyOf)) {
+		strictSchema["anyOf"] = anyOf.map((variant) => _transformJSONSchema(variant));
+	} else if (Array.isArray(oneOf)) {
+		strictSchema["anyOf"] = oneOf.map((variant) => _transformJSONSchema(variant));
+	} else if (Array.isArray(allOf)) {
+		strictSchema["allOf"] = allOf.map((entry) => _transformJSONSchema(entry));
+	} else {
+		if (type === undefined) {
+			throw new Error("JSON schema must have a type defined if anyOf/oneOf/allOf are not used");
+		}
+		strictSchema["type"] = type;
+	}
+	const description = require_sdk.pop(jsonSchema, "description");
+	if (description !== undefined) {
+		strictSchema["description"] = description;
+	}
+	const title = require_sdk.pop(jsonSchema, "title");
+	if (title !== undefined) {
+		strictSchema["title"] = title;
+	}
+	if (type === "object") {
+		const properties = require_sdk.pop(jsonSchema, "properties") || {};
+		strictSchema["properties"] = Object.fromEntries(Object.entries(properties).map(([key, propSchema]) => [key, _transformJSONSchema(propSchema)]));
+		require_sdk.pop(jsonSchema, "additionalProperties");
+		strictSchema["additionalProperties"] = false;
+		const required = require_sdk.pop(jsonSchema, "required");
+		if (required !== undefined) {
+			strictSchema["required"] = required;
+		}
+	} else if (type === "string") {
+		const format = require_sdk.pop(jsonSchema, "format");
+		if (format !== undefined && SUPPORTED_STRING_FORMATS.has(format)) {
+			strictSchema["format"] = format;
+		} else if (format !== undefined) {
+			jsonSchema["format"] = format;
+		}
+	} else if (type === "array") {
+		const items = require_sdk.pop(jsonSchema, "items");
+		if (items !== undefined) {
+			strictSchema["items"] = _transformJSONSchema(items);
+		}
+		const minItems = require_sdk.pop(jsonSchema, "minItems");
+		if (minItems !== undefined && (minItems === 0 || minItems === 1)) {
+			strictSchema["minItems"] = minItems;
+		} else if (minItems !== undefined) {
+			jsonSchema["minItems"] = minItems;
+		}
+	}
+	if (Object.keys(jsonSchema).length > 0) {
+		const existingDescription = strictSchema["description"];
+		strictSchema["description"] = (existingDescription ? existingDescription + "\n\n" : "") + "{" + Object.entries(jsonSchema).map(([key, value]) => `${key}: ${JSON.stringify(value)}`).join(", ") + "}";
+	}
+	return strictSchema;
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/helpers/beta/json-schema.mjs
+/**
+* Creates a Tool with a provided JSON schema that can be passed
+* to the `.toolRunner()` method. The schema is used to automatically validate
+* the input arguments for the tool.
+*/
+function betaTool(options) {
+	if (options.inputSchema.type !== "object") {
+		throw new Error(`JSON schema for tool "${options.name}" must be an object, but got ${options.inputSchema.type}`);
+	}
+	return {
+		type: "custom",
+		name: options.name,
+		input_schema: options.inputSchema,
+		description: options.description,
+		run: options.run,
+		parse: (content) => content,
+		...options.close ? { close: options.close } : {}
+	};
+}
+/**
+* Creates a JSON schema output format object from the given JSON schema.
+* If this is passed to the `.parse()` method then the response message will contain a
+* `.parsed_output` property that is the result of parsing the content with the given JSON schema.
+*
+*/
+function betaJSONSchemaOutputFormat(jsonSchema, options) {
+	if (jsonSchema.type !== "object") {
+		throw new Error(`JSON schema for tool must be an object, but got ${jsonSchema.type}`);
+	}
+	const transform = options?.transform ?? true;
+	if (transform) {
+		jsonSchema = transformJSONSchema(jsonSchema);
+	}
+	return {
+		type: "json_schema",
+		schema: { ...jsonSchema },
+		parse: (content) => {
+			try {
+				return JSON.parse(content);
+			} catch (error) {
+				throw new require_sdk.AnthropicError(`Failed to parse structured output: ${error}`);
+			}
+		}
+	};
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/tools/agent-toolset/fs-util.mjs
+/**
+* Shared, Node-only filesystem helpers for the agent toolset's file tools:
+* path confinement (symlink-aware), an atomic write, and language-independent
+* error messages. Kept out of `node.ts` so the tool implementations stay focused
+* and these helpers can be reused by every file tool.
+*/
+const fs$1 = node_fs.promises;
+/** Mode for directories the file tools create: owner-only under any umask, like the memory tool. */
+const DIR_CREATE_MODE = 448;
+/**
+* Mode for files the file tools create: owner-only, so other local users can't
+* read what an agent wrote. A file that already exists keeps its own mode.
+*/
+const FILE_CREATE_MODE = 384;
+/** True when `p` is `root` itself or lexically contained within it. */
+function isWithin(root, p) {
+	const rel = node_path.relative(root, p);
+	return rel === "" || !rel.startsWith(".." + node_path.sep) && rel !== ".." && !node_path.isAbsolute(rel);
+}
+/**
+* The first entry of `roots` whose canonical form contains the
+* already-canonical `target`, returned as configured; `undefined` when none
+* does. Each root goes through {@link canonicalize} at check time, exactly like
+* the workdir in {@link confineToRoot}, so granting access (`allowedRoots`)
+* and refusing writes (`readOnlyRoots`) can never resolve the same entry two
+* different ways.
+*/
+async function containingRoot(roots, target) {
+	for (const root of roots) {
+		if (isWithin(await canonicalize(node_path.resolve(root)), target)) return root;
+	}
+	return undefined;
+}
+/** Matches Linux MAXSYMLINKS, the threshold at which `realpath` itself reports ELOOP. */
+const MAX_SYMLINK_HOPS = 40;
+/** The `code` of a Node system error, or `undefined` for anything else. */
+function errnoCode(err) {
+	const code = err?.code;
+	return typeof code === "string" ? code : undefined;
+}
+/**
+* Fully resolve `abs`: `realpath` the longest existing ancestor and re-append
+* the rest, but never re-append a component that is itself a symlink — read the
+* link and continue from its target instead. This handles paths being created
+* (write/edit) without letting a symlink leaf (e.g. a dangling one pointing
+* outside a confinement root) slip through unresolved.
+*
+* Returns a symlink-free path or throws an errno-carrying error (`ELOOP` for a
+* cycle or more than {@link MAX_SYMLINK_HOPS} links, the `lstat`/`realpath`
+* error for an unreadable component); it never returns `abs` unresolved. Only
+* symlink hops count against the cap, so any depth of not-yet-existing
+* directories still resolves.
+*/
+async function canonicalize(abs) {
+	const tail = [];
+	let prefix = abs;
+	let hops = 0;
+	for (;;) {
+		let real;
+		try {
+			real = await fs$1.realpath(prefix);
+		} catch (realpathErr) {
+			let isLink;
+			try {
+				isLink = (await fs$1.lstat(prefix)).isSymbolicLink();
+			} catch (lstatErr) {
+				const code = errnoCode(lstatErr);
+				if (code !== "ENOENT" && code !== "ENOTDIR") throw lstatErr;
+				const parent = node_path.dirname(prefix);
+				if (parent === prefix) throw lstatErr;
+				tail.push(node_path.basename(prefix));
+				prefix = parent;
+				continue;
+			}
+			if (!isLink) throw realpathErr;
+			if (++hops > MAX_SYMLINK_HOPS) {
+				throw Object.assign(new Error("too many levels of symbolic links"), { code: "ELOOP" });
+			}
+			prefix = node_path.resolve(node_path.dirname(prefix), await fs$1.readlink(prefix));
+			continue;
+		}
+		return tail.length ? node_path.join(real, ...tail.reverse()) : real;
+	}
+}
+/**
+* Resolve `p` against `root` and confine it to `root` or one of `allowedRoots`
+* (absolute paths, resolved at check time exactly like `root`).
+*
+* Absolute and relative inputs go through the same canonicalise-then-contain
+* check — an absolute path that lands inside a permitted root is accepted,
+* only paths that resolve *outside* all of them are rejected. Every symlink in
+* `p` (including the leaf, even a dangling one) is resolved before the
+* confinement check, and the resolved path is what the caller then operates
+* on, so a symlink inside `root` that points outside it can neither pass the
+* check nor be followed afterwards. `..` is collapsed lexically before any
+* symlink is followed. A path that cannot be resolved (symlink loop, unreadable
+* component) is rejected with a `ToolError` naming `p`, never the host's
+* absolute path.
+*
+* Residual TOCTOU: a component could still be swapped for a symlink between this
+* call and the eventual `fs` operation. Closing that fully needs per-component
+* `O_NOFOLLOW`/`openat`, which Node does not expose ergonomically; this is why a
+* sandbox is still recommended for the toolset as a whole.
+*/
+async function confineToRoot(root, p, opts) {
+	const allowedRoots = opts?.allowedRoots ?? [];
+	const realRoot = await canonicalize(node_path.resolve(root));
+	let real;
+	try {
+		real = await canonicalize(node_path.resolve(realRoot, p));
+	} catch (err) {
+		throw new require_sdk.ToolError(fsErrorMessage(err, `path ${JSON.stringify(p)}`));
+	}
+	if (isWithin(realRoot, real) || await containingRoot(allowedRoots, real) !== undefined) {
+		return real;
+	}
+	const permitted = allowedRoots.length ? "the session's working directory and its other permitted directories" : "the session's working directory";
+	throw new require_sdk.ToolError(`path ${JSON.stringify(p)} is outside ${permitted}`);
+}
+/**
+* Atomically write `content` to `targetPath`: write a sibling temp file, fsync
+* it, then rename over the target. The rename is atomic on most filesystems, so
+* a crash mid-write never leaves the target half-written.
+*
+* A new file is created {@link FILE_CREATE_MODE}; an existing one keeps its
+* permission bits (the rename replaces the inode, so they are copied onto the
+* temp file first) — an edit must not strip `+x` or sharing the owner chose.
+*/
+async function atomicWriteFile(targetPath, content) {
+	const dir = node_path.dirname(targetPath);
+	const tempPath = node_path.join(dir, `.tmp-${process.pid}-${node_crypto.randomUUID()}`);
+	const existingMode = await fs$1.stat(targetPath).then((st) => st.mode & 511, () => undefined);
+	let handle;
+	try {
+		handle = await fs$1.open(tempPath, "wx", 384);
+		if (existingMode !== undefined) await handle.chmod(existingMode);
+		await handle.writeFile(content, "utf-8");
+		await handle.sync();
+		await handle.close();
+		handle = undefined;
+		await fs$1.rename(tempPath, targetPath);
+	} catch (err) {
+		if (handle) await handle.close().catch(() => {});
+		await fs$1.unlink(tempPath).catch(() => {});
+		throw err;
+	}
+}
+/**
+* Map a thrown filesystem error to a consistent, language-independent message,
+* so the model sees the same wording regardless of the runtime (Node's raw
+* `ENOENT: no such file...` text would otherwise leak through). Codes we don't
+* special-case render as the bare code, never Node's message, which embeds the
+* host's absolute path.
+*/
+function fsErrorMessage(err, file) {
+	const code = errnoCode(err);
+	switch (code) {
+		case "ENOENT": return `${file}: no such file or directory`;
+		case "EACCES":
+		case "EPERM": return `${file}: permission denied`;
+		case "ENOTDIR": return `${file}: not a directory`;
+		case "EISDIR": return `${file}: is a directory`;
+		case "ELOOP": return `${file}: too many levels of symbolic links`;
+		case "ENAMETOOLONG": return `${file}: file name too long`;
+		case "ENOSPC": return `${file}: no space left on device`;
+		case "EMFILE":
+		case "ENFILE": return `${file}: too many open files`;
+		default: return `${file}: ${code !== undefined ? `i/o error (${code})` : "i/o error"}`;
+	}
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/tools/agent-toolset/skills.mjs
+/**
+* Node-only skill plumbing for the agent toolset: downloading a session
+* agent's skills into the workdir and extracting the archives. Kept in its own
+* file because it is a distinct concern from the tool implementations in
+* `node.ts` — distinct enough, and large enough, to review on its own.
+*/
+const fs = node_fs.promises;
+const execFileAsync = node_util.promisify(node_child_process.execFile);
+/**
+* Download the session agent's skills into `{ctx.workdir}/skills/<name>/`.
+*
+* No-op (returns a no-op cleanup) unless `ctx.client` is set together with
+* `ctx.session` (or the deprecated `ctx.sessionId`). Reads the resolved agent
+* off the session and, for each skill, fetches its files via
+* `client.beta.skills.versions.download` and extracts the archive (a zip or
+* tar.* archive) into a directory named after the skill. A failure on one skill
+* is logged and does not block the others. Call this before starting the
+* session tool runner (e.g. right after the bash session / workdir is ready).
+*
+* Pass `ctx.session`. A session's resources cannot change while it runs, so the
+* caller fetches it once and shares that snapshot with the memory-store
+* download — the two can then never disagree about the attached resources.
+*
+* `ctx.sessionId` is deprecated: it costs an extra `sessions.retrieve` round
+* trip on every call, and a caller that uses it for both this and the
+* memory-store download fetches the session twice. It remains supported for
+* callers written before `session` existed.
+*
+* Returns a cleanup function that removes the skill directories this call
+* created — call it once the work item is done so downloaded skills do not
+* accumulate in the workdir across sessions.
+*/
+async function setupSkills(ctx) {
+	const { client, sessionId } = ctx;
+	if (!client) return async () => {};
+	const log = require_sdk.loggerFor(client);
+	let session = ctx.session;
+	if (!session) {
+		if (sessionId === undefined) return async () => {};
+		log.warn("AgentToolContext.sessionId is deprecated and costs an extra session fetch; " + "fetch the session once and set `session` instead", { component: "agent-tool-context" });
+		session = await client.beta.sessions.retrieve(sessionId);
+	}
+	const skillsRoot = node_path.resolve(ctx.workdir, "skills");
+	const created = [];
+	for (const skill of session.agent.skills) {
+		try {
+			const version = await client.beta.skills.versions.retrieve(skill.version, { skill_id: skill.skill_id });
+			let dirname = node_path.basename(version.name.trim());
+			if (dirname === "" || dirname === "." || dirname === "..") dirname = skill.skill_id;
+			const dest = node_path.resolve(skillsRoot, dirname);
+			if (dest !== skillsRoot && !dest.startsWith(skillsRoot + node_path.sep)) {
+				log.warn("skill name escapes the skills dir; skipping", {
+					component: "agent-tool-context",
+					name: version.name
+				});
+				continue;
+			}
+			const resp = await client.beta.skills.versions.download(version.id, { skill_id: skill.skill_id });
+			await fs.rm(dest, {
+				recursive: true,
+				force: true
+			});
+			await fs.mkdir(dest, {
+				recursive: true,
+				mode: 448
+			});
+			created.push(dest);
+			await extractSkillArchive(resp, dest);
+			log.info("downloaded skill", {
+				component: "agent-tool-context",
+				skill_id: skill.skill_id,
+				version: version.id,
+				dest
+			});
+		} catch (e) {
+			log.warn("failed to download skill", {
+				component: "agent-tool-context",
+				skill_id: skill.skill_id,
+				error: String(e)
+			});
+		}
+	}
+	return async () => {
+		for (const dest of created) {
+			await fs.rm(dest, {
+				recursive: true,
+				force: true
+			}).catch((e) => {
+				log.warn("failed to clean up skill", {
+					component: "agent-tool-context",
+					dest,
+					error: String(e)
+				});
+			});
+		}
+	};
+}
+/** Reject archive members that are absolute or contain a `..` component. */
+function assertSafeMemberNames(names) {
+	for (const raw of names) {
+		const entry = raw.trim();
+		if (!entry) continue;
+		if (node_path.isAbsolute(entry) || entry.split(/[\\/]/).includes("..")) {
+			throw new require_sdk.AnthropicError(`refusing to extract unsafe archive member: ${entry}`);
+		}
+	}
+}
+const INCONSISTENT_LISTING = "skill archive listing is inconsistent; refusing to extract";
+/**
+* Type chars (first byte of each `ls`-style line from `unzip -Z` / `tar -tvf`)
+* that denote a regular file or directory. `zipinfo` prints `?` for entries
+* with no Unix type bits, which `unzip` extracts as regular files; GNU tar
+* prints `C` for contiguous files. Everything else — `l` symlink, `h`
+* hardlink, `b`/`c` device, `p` fifo, `s` socket, unknown tar types — is a
+* special member.
+*/
+const PLAIN_TYPE_CHARS = {
+	unzip: new Set([
+		"-",
+		"d",
+		"?"
+	]),
+	tar: new Set([
+		"-",
+		"d",
+		"C"
+	])
+};
+function listingLines(listing) {
+	const lines = listing.split("\n");
+	if (lines[lines.length - 1] === "") lines.pop();
+	return lines;
+}
+/**
+* A special member is excluded by handing its listed name back to the CLI as
+* a pattern, so the name must be byte-identical to what is stored. `tar`,
+* `bsdtar` and `unzip` print bytes they cannot show literally as `\ooo`, `^X`
+* or `#U` escapes, or as raw non-ASCII; any such name cannot be excluded
+* reliably. A leading `-` would let `unzip` parse the pattern as an option.
+*/
+function canExcludeVerbatim(cmd, name) {
+	return /^[\x20-\x7E]+$/.test(name) && !/[\\^#]/.test(name) && !(cmd === "unzip" && name.startsWith("-"));
+}
+/**
+* Pair an archive's name listing (`unzip -Z1` / `tar -tf`) with its typed
+* listing (`unzip -Z --h --t` / `tar -tvf`) and split the members into plain
+* (regular file or directory) and special (everything else). Special members
+* are excluded from extraction rather than rejected; the archive is refused
+* only when the two listings disagree in length or a special member's name
+* cannot be passed back to the CLI verbatim (see {@link canExcludeVerbatim}).
+*/
+function classifyArchiveListing(cmd, names, typed) {
+	const nameLines = listingLines(names);
+	const typedLines = listingLines(typed);
+	if (nameLines.length !== typedLines.length) throw new require_sdk.AnthropicError(INCONSISTENT_LISTING);
+	const plain = [];
+	const special = [];
+	nameLines.forEach((name, i) => {
+		if (PLAIN_TYPE_CHARS[cmd].has(typedLines[i].charAt(0))) {
+			plain.push(name);
+			return;
+		}
+		if (!canExcludeVerbatim(cmd, name)) {
+			throw new require_sdk.AnthropicError(`refusing to extract archive: cannot safely exclude member ${JSON.stringify(name)}`);
+		}
+		special.push(name);
+	});
+	return {
+		plain,
+		special
+	};
+}
+/**
+* Walk `dir` with `lstat` semantics and reject anything that is not a regular
+* file or directory. Never follows a link and never descends into anything
+* but a real directory.
+*/
+async function assertOnlyPlainEntries(dir) {
+	for (const entry of await fs.readdir(dir, { withFileTypes: true })) {
+		if (entry.isDirectory()) await assertOnlyPlainEntries(node_path.join(dir, entry.name));
+		else if (!entry.isFile()) throw new require_sdk.AnthropicError(INCONSISTENT_LISTING);
+	}
+}
+/**
+* Run an archive CLI (`unzip` for zip archives, `tar` for everything else),
+* returning its stdout. Both binaries must be on `PATH`; a missing one would
+* otherwise surface as an opaque `ENOENT` spawn failure, so it is turned into a
+* clear, specific error naming the missing command.
+*/
+async function runArchiveTool(cmd, args) {
+	try {
+		const { stdout } = await execFileAsync(cmd, args);
+		return stdout;
+	} catch (e) {
+		if (errnoCode(e) === "ENOENT") {
+			throw new require_sdk.AnthropicError(`skill extraction requires the \`${cmd}\` command, but it was not found on PATH`);
+		}
+		throw e;
+	}
+}
+/**
+* The single top-level directory shared by every entry in an archive listing,
+* or `''` if entries don't all live under one common directory. Skill bundles
+* are packaged wrapped in one directory named after the skill (e.g.
+* `pdf/SKILL.md`, `pdf/scripts/...`); the extractor strips it so contents land
+* directly in the skill's dir instead of a redundant nested `<skill>/<skill>/`
+* level. A flat or multi-root archive yields `''`.
+*/
+function archiveTopDir(names) {
+	let top;
+	let nested = false;
+	for (const raw of names) {
+		const parts = raw.trim().split("/").filter((p) => p !== "" && p !== ".");
+		if (parts.length === 0) continue;
+		const first = parts[0];
+		if (top === undefined) top = first;
+		else if (first !== top) return "";
+		if (parts.length > 1) nested = true;
+	}
+	return top !== undefined && nested ? top : "";
+}
+/**
+* Extract a skill download (a zip or tar.* archive) into `dest`. Streams the
+* response body straight to a temp file beside `dest` (so the whole archive is
+* never buffered in memory — skills can contain large binaries), then shells out
+* to `unzip`/`tar` — consistent with the rest of the toolset, which already
+* invokes `bash` and `rg`. Both `unzip` and `tar` must be available on `PATH`; a
+* missing binary surfaces as a clear error (see {@link runArchiveTool}). Refuses
+* any member that would escape `dest` (zip-slip / tar-slip): skill archives
+* come from the API, but skills can be third-party. Members that are not a
+* regular file or directory (symlink, hardlink, device, fifo) are excluded
+* from extraction rather than rejected; an archive whose special members
+* cannot be excluded reliably is refused (see {@link classifyArchiveListing}).
+* `tar` matches exclusions unanchored, so a plain member sharing a special
+* member's name may be dropped too. The staging tree is verified to hold only
+* regular files and directories before anything is promoted into `dest`.
+*
+* The skill bundle's single wrapper directory is stripped: the archive is
+* extracted into a staging dir and the wrapper's contents are promoted into
+* `dest`, so files land at `dest/SKILL.md` rather than a doubled
+* `dest/<skill>/SKILL.md` (`unzip` has no `--strip-components`, so this is
+* done uniformly by staging + promote rather than per-tool flags).
+*/
+async function extractSkillArchive(resp, dest) {
+	const tmp = node_path.join(dest, `.skill-archive-${process.pid}-${Date.now()}`);
+	if (!resp.body) {
+		throw new require_sdk.AnthropicError("skill download response had no body");
+	}
+	await node_stream.promises.pipeline(node_stream.Readable.fromWeb(resp.body), node_fs.createWriteStream(tmp));
+	const stage = node_path.join(node_path.dirname(dest), `.skill-stage-${process.pid}-${Date.now()}`);
+	const excludeFile = node_path.join(node_path.dirname(dest), `.skill-exclude-${process.pid}-${Date.now()}`);
+	try {
+		const head = await readHead(tmp, 4);
+		const isZip = head.length >= 4 && head[0] === 80 && head[1] === 75 && head[2] === 3 && head[3] === 4;
+		const archiveCmd = isZip ? "unzip" : "tar";
+		const names = await runArchiveTool(archiveCmd, isZip ? ["-Z1", tmp] : ["-tf", tmp]);
+		const typed = await runArchiveTool(archiveCmd, isZip ? [
+			"-Z",
+			"--h",
+			"--t",
+			tmp
+		] : ["-tvf", tmp]);
+		const { plain, special } = classifyArchiveListing(archiveCmd, names, typed);
+		assertSafeMemberNames([...plain, ...special]);
+		const top = archiveTopDir(plain);
+		await fs.mkdir(stage, {
+			recursive: true,
+			mode: 448
+		});
+		if (plain.length > 0) {
+			await runArchiveTool(archiveCmd, await extractArgs(archiveCmd, tmp, stage, special, excludeFile));
+		}
+		await assertOnlyPlainEntries(stage);
+		const srcRoot = top ? node_path.join(stage, top) : stage;
+		const entries = await fs.readdir(srcRoot).catch((e) => {
+			throw errnoCode(e) === "ENOENT" ? new require_sdk.AnthropicError(INCONSISTENT_LISTING) : e;
+		});
+		for (const entry of entries) {
+			await fs.rename(node_path.join(srcRoot, entry), node_path.join(dest, entry));
+		}
+	} finally {
+		await fs.rm(tmp, { force: true });
+		await fs.rm(excludeFile, { force: true });
+		await fs.rm(stage, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+/**
+* Arguments that extract `archive` into `stage` while excluding every member
+* in `special`. Names are glob-escaped because both CLIs treat exclusions as
+* patterns; `tar` reads them from `excludeFile`, `unzip` takes them after
+* `-x`, which must follow `-d` so no pattern is parsed as an option.
+*/
+async function extractArgs(cmd, archive, stage, special, excludeFile) {
+	const patterns = special.map((name) => name.replace(/[*?[\\]/g, "\\$&"));
+	if (cmd === "unzip") {
+		return [
+			"-oq",
+			archive,
+			"-d",
+			stage,
+			...patterns.length > 0 ? ["-x", ...patterns] : []
+		];
+	}
+	if (patterns.length === 0) return [
+		"-xf",
+		archive,
+		"-C",
+		stage
+	];
+	await fs.writeFile(excludeFile, patterns.join("\n") + "\n", {
+		flag: "wx",
+		mode: 384
+	});
+	return [
+		"-xf",
+		archive,
+		"-C",
+		stage,
+		"-X",
+		excludeFile
+	];
+}
+/** Read the first `n` bytes of `file`. */
+async function readHead(file, n) {
+	const handle = await fs.open(file, "r");
+	try {
+		const buf = Buffer.alloc(n);
+		const { bytesRead } = await handle.read(buf, 0, n, 0);
+		return buf.subarray(0, bytesRead);
+	} finally {
+		await handle.close();
+	}
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/internal/file-store.mjs
+/**
+* `FileStore` — one confined folder; a relative path cannot escape it.
+*
+* Beta scope: symlinks are refused or skipped wherever the store meets them,
+* but there is no hardening against a process racing the store's own
+* syscalls; fsync durability, non-POSIX hosts, and read-size caps are out of
+* scope.
+*/
+const fsp = node_fs.promises;
+const C = node_fs.constants;
+const OWNER_ONLY_DIR_MODE = 448;
+const OWNER_ONLY_FILE_MODE = 384;
+const OWNER_ONLY_EXEC_MODE = 448;
+const O_NOFOLLOW = C.O_NOFOLLOW ?? 0;
+const O_NONBLOCK = C.O_NONBLOCK ?? 0;
+/** A refused operation — input the store will not act on. OS errors propagate with their `.code`. */
+var FileStoreError = class extends Error {
+	constructor(reason, relPath) {
+		super(`path ${JSON.stringify(relPath)} ${reason}`);
+		this.name = "FileStoreError";
+		this.reason = reason;
+		this.relPath = relPath;
+	}
+};
+FileStoreError.ESCAPES_ROOT = "escapes the store root";
+FileStoreError.IS_A_SYMLINK = "is a symlink";
+FileStoreError.NOT_A_FILE = "is not a regular file";
+FileStoreError.NOT_A_DIRECTORY = "is not a directory";
+FileStoreError.NOT_UTF8 = "is not valid utf-8";
+FileStoreError.MOVE_DESTINATION_EXISTS = "already exists";
+/** Resolve `root`; creates nothing — only {@link FileStore.createRoot} makes the folder. */
+async function openFileStore(root, opts) {
+	return FileStore.open(root, opts);
+}
+/**
+* True for a path usable verbatim as a store location: absolute, with no `..`
+* components. Paths are judged in POSIX terms — they are wire values naming
+* locations inside a POSIX container, not host-native paths.
+*/
+function isPathLegal(p) {
+	return p.startsWith("/") && !p.split("/").includes("..");
+}
+/**
+* One confined folder of regular files.
+*
+* Every `relPath` is relative to the root (a leading `/` also means the root)
+* and refused with {@link FileStoreError} when it escapes. The store holds
+* regular files only: symlinks are refused on read and skipped by listings —
+* {@link findSymlinks} reports them. A `relPath` resolving to the root itself
+* is banned by this interface: `put` and `get` refuse it, `move` and `remove`
+* do nothing. A store opened with `utf8: true` refuses binary content the
+* same way — on `put` of such bytes and on `get` of such a file. Only
+* {@link createRoot} makes the root: writes create directories below it,
+* never the root itself, so a root removed while the store is open stays
+* removed and the write fails with `ENOENT`.
+*/
+var FileStore = class FileStore {
+	/** @internal — use {@link FileStore.open} / {@link openFileStore}. */
+	constructor(root, removedOnDispose, utf8Only = false) {
+		/** `hashtree`'s advisory cache; every hit re-validates against a fresh stat. */
+		this.hashes = new Map();
+		this.rootPath = root;
+		this.removedOnDispose = removedOnDispose;
+		this.decoder = utf8Only ? new TextDecoder("utf-8", { fatal: true }) : undefined;
+	}
+	/** Resolve `root`; creates nothing — only {@link createRoot} makes the folder. */
+	static async open(root, opts) {
+		if (!platformSupported()) {
+			throw new Error("FileStore requires O_NOFOLLOW support on this platform");
+		}
+		let removedOnDispose = false;
+		try {
+			await fsp.lstat(root);
+		} catch (e) {
+			if (e.code !== "ENOENT") throw e;
+			removedOnDispose = true;
+		}
+		return new FileStore(node_path.resolve(root), removedOnDispose, opts?.utf8 ?? false);
+	}
+	/** Create the root directory and any missing ancestors; already existing is fine. */
+	async createRoot() {
+		await makeDirAndAncestors(this.rootPath);
+	}
+	/** The resolved root, and what {@link dispose} will do to it. */
+	root() {
+		return {
+			path: this.rootPath,
+			removedOnDispose: this.removedOnDispose
+		};
+	}
+	/**
+	* Remove the root iff `open` created it; pre-existing roots are kept.
+	*
+	* Wired to `Symbol.asyncDispose` at runtime when the host provides it, so
+	* `await using` works on engines with explicit resource management.
+	*/
+	async dispose() {
+		if (!this.removedOnDispose) return;
+		await fsp.rm(this.rootPath, {
+			recursive: true,
+			force: true
+		});
+	}
+	/**
+	* Write `data` (`string` UTF-8 or bytes) atomically to the file at `relPath`.
+	*
+	* Missing directories below the root are created; a missing root is not —
+	* the write fails with `ENOENT`.
+	*/
+	async put(relPath, data, opts) {
+		const tail = relPath.replace(/\\/g, "/");
+		if (tail.endsWith("/") || tail.endsWith("/.") || tail === "" || tail === ".") {
+			throw new FileStoreError(FileStoreError.NOT_A_FILE, relPath);
+		}
+		const dest = this.resolveUnderRoot(relPath);
+		const payload = typeof data === "string" ? require_sdk.encodeUTF8(data) : data;
+		this.requireUtf8(relPath, payload);
+		await makeDirsBelowRoot(this.rootPath, node_path.dirname(dest));
+		await replaceViaTemp(dest, payload, opts?.executable ?? false);
+	}
+	/** The file's bytes; `null` when absent. */
+	async get(relPath) {
+		const dest = this.resolveUnderRoot(relPath);
+		let handle;
+		try {
+			handle = await openRegularFile(relPath, dest);
+		} catch (e) {
+			if (e.code === "ENOENT") return null;
+			throw e;
+		}
+		let data;
+		try {
+			const buf = await handle.readFile();
+			data = new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+		} finally {
+			await handle.close();
+		}
+		this.requireUtf8(relPath, data);
+		return data;
+	}
+	/** The relative path of every file under the directory `under`. */
+	async ls(under = "/") {
+		const base = this.resolveUnderRoot(under);
+		return new Set((await filenamesInDir(this.rootPath, under, base)).map(([rel]) => rel));
+	}
+	/**
+	* Every symlink under `under` — listings skip them and reads refuse them,
+	* so a caller that must know they exist asks here.
+	*/
+	async findSymlinks(under = "/") {
+		const base = this.resolveUnderRoot(under);
+		return symlinksInDir(this.rootPath, under, base);
+	}
+	/**
+	* `{relPath: sha256Hex}` of every file under the directory `under`.
+	*
+	* Unchanged files — same size, mtime, and ctime since the last call —
+	* reuse their recorded hash instead of being re-read.
+	*/
+	async hashtree(under = "/") {
+		const base = this.resolveUnderRoot(under);
+		const walkStartNs = _internals.nowNs();
+		const out = Object.create(null);
+		for (const [rel, full] of await filenamesInDir(this.rootPath, under, base)) {
+			const sha = await this.hashViaCache(rel, full, walkStartNs);
+			if (sha !== null) out[rel] = sha;
+		}
+		return out;
+	}
+	/** One file's sha256; `null` when absent. Shares {@link hashtree}'s cache. */
+	async hashFile(relPath) {
+		const dest = this.resolveUnderRoot(relPath);
+		let st;
+		try {
+			st = await fsp.lstat(dest, { bigint: true });
+		} catch (e) {
+			if (e.code === "ENOENT") return null;
+			throw e;
+		}
+		if (st.isSymbolicLink()) throw new FileStoreError(FileStoreError.IS_A_SYMLINK, relPath);
+		if (!st.isFile()) throw new FileStoreError(FileStoreError.NOT_A_FILE, relPath);
+		const rel = node_path.relative(this.rootPath, dest).split(node_path.sep).join("/");
+		return this.hashViaCache(rel, dest, _internals.nowNs());
+	}
+	/**
+	* Rename `src` to `dst`; an existing `dst` is refused. The banned store
+	* root as either end does nothing.
+	*/
+	async move(src, dst) {
+		const s = this.resolveUnderRoot(src);
+		const d = this.resolveUnderRoot(dst);
+		if (s === this.rootPath || d === this.rootPath) return;
+		const dstExists = await fsp.stat(d).then(() => true, () => false);
+		if (dstExists) throw new FileStoreError(FileStoreError.MOVE_DESTINATION_EXISTS, dst);
+		await makeDirsBelowRoot(this.rootPath, node_path.dirname(d));
+		await fsp.rename(s, d);
+	}
+	/** Delete a file or subtree; absent — and the banned store root — do nothing. */
+	async remove(relPath) {
+		const dest = this.resolveUnderRoot(relPath);
+		if (dest === this.rootPath) return;
+		let st;
+		try {
+			st = await fsp.lstat(dest, { bigint: true });
+		} catch (e) {
+			if (e.code === "ENOENT") return;
+			throw e;
+		}
+		if (st.isDirectory()) {
+			await fsp.rm(dest, {
+				recursive: true,
+				force: true
+			});
+		} else {
+			try {
+				await fsp.unlink(dest);
+			} catch (e) {
+				if (e.code !== "ENOENT") throw e;
+			}
+		}
+	}
+	resolveUnderRoot(relPath) {
+		const norm = relPath.replace(/\\/g, "/").replace(/^\/+/, "");
+		const parts = norm.split("/").filter((p) => p !== "" && p !== ".");
+		if (node_path.posix.isAbsolute(norm) || parts.includes("..")) {
+			throw new FileStoreError(FileStoreError.ESCAPES_ROOT, relPath);
+		}
+		return parts.length === 0 ? this.rootPath : node_path.join(this.rootPath, ...parts);
+	}
+	requireUtf8(relPath, data) {
+		if (!this.decoder) return;
+		try {
+			this.decoder.decode(data);
+		} catch {
+			throw new FileStoreError(FileStoreError.NOT_UTF8, relPath);
+		}
+	}
+	async hashViaCache(rel, full, walkStartNs) {
+		let st;
+		try {
+			st = await fsp.lstat(full, { bigint: true });
+		} catch (e) {
+			if (e.code === "ENOENT") return null;
+			throw e;
+		}
+		if (!st.isFile()) return null;
+		const cached = this.hashes.get(rel);
+		let sha;
+		if (cached !== undefined && unchangedSinceHashed(cached, st)) {
+			sha = cached.sha;
+		} else {
+			try {
+				sha = await _internals.hashFile(full);
+			} catch (e) {
+				const code = e.code;
+				if (code === "ENOENT" || e instanceof FileStoreError) return null;
+				if (code === "ELOOP" || code === "EMLINK") return null;
+				throw e;
+			}
+		}
+		if (oldEnoughToCache(st, walkStartNs)) {
+			this.hashes.set(rel, {
+				mtimeNs: st.mtimeNs,
+				ctimeNs: st.ctimeNs,
+				size: st.size,
+				sha
+			});
+		}
+		return sha;
+	}
+};
+FileStore.isPathLegal = isPathLegal;
+function platformSupported() {
+	return O_NOFOLLOW !== 0;
+}
+async function makeDirAndAncestors(dir) {
+	const missing = [];
+	let current = dir;
+	for (;;) {
+		try {
+			await fsp.stat(current);
+			break;
+		} catch (e) {
+			const code = e.code;
+			if (code !== "ENOENT" && code !== "ENOTDIR" && code !== "ELOOP") throw e;
+		}
+		missing.push(current);
+		const parent = node_path.dirname(current);
+		if (parent === current) break;
+		current = parent;
+	}
+	for (const directory of missing.reverse()) {
+		try {
+			await fsp.mkdir(directory, { mode: OWNER_ONLY_DIR_MODE });
+		} catch (e) {
+			if (e.code !== "EEXIST") throw e;
+		}
+	}
+}
+async function makeDirsBelowRoot(root, dir) {
+	const below = node_path.relative(root, dir);
+	if (below === "") return;
+	let current = root;
+	for (const part of below.split(node_path.sep)) {
+		current = node_path.join(current, part);
+		try {
+			await fsp.mkdir(current, { mode: OWNER_ONLY_DIR_MODE });
+		} catch (e) {
+			if (e.code !== "EEXIST") throw e;
+		}
+	}
+}
+async function replaceViaTemp(dest, data, isExecutable) {
+	const mode = isExecutable ? OWNER_ONLY_EXEC_MODE : OWNER_ONLY_FILE_MODE;
+	const tmp = node_path.join(node_path.dirname(dest), `.fs-${node_crypto.randomBytes(8).toString("hex")}.tmp`);
+	let handle;
+	try {
+		handle = await fsp.open(tmp, C.O_WRONLY | C.O_CREAT | C.O_EXCL | O_NOFOLLOW, mode);
+		await handle.writeFile(data);
+		await handle.close();
+		handle = undefined;
+		await fsp.rename(tmp, dest);
+	} catch (err) {
+		if (handle) await handle.close().catch(() => {});
+		await fsp.unlink(tmp).catch(() => {});
+		throw err;
+	}
+}
+async function openRegularFile(relPath, dest) {
+	let handle;
+	try {
+		handle = await fsp.open(dest, C.O_RDONLY | O_NOFOLLOW | O_NONBLOCK);
+	} catch (e) {
+		const code = e.code;
+		if (code === "ELOOP" || code === "EMLINK") {
+			throw new FileStoreError(FileStoreError.IS_A_SYMLINK, relPath);
+		}
+		throw e;
+	}
+	try {
+		const st = await handle.stat();
+		if (!st.isFile()) throw new FileStoreError(FileStoreError.NOT_A_FILE, relPath);
+	} catch (e) {
+		await handle.close().catch(() => {});
+		throw e;
+	}
+	return handle;
+}
+/** sha256 of a file's contents, streamed — constant memory on any file size. */
+async function hashFile(full) {
+	const digest = node_crypto.createHash("sha256");
+	const handle = await openRegularFile(node_path.basename(full), full);
+	const buf = new Uint8Array(1024 * 1024);
+	try {
+		for (;;) {
+			const { bytesRead } = await handle.read(buf, 0, buf.length);
+			if (bytesRead === 0) break;
+			digest.update(buf.subarray(0, bytesRead));
+		}
+	} finally {
+		await handle.close();
+	}
+	return digest.digest("hex");
+}
+/**
+* `[rel, path]` for every regular file under the directory `base`; an absent
+* `base` is empty, a present non-directory is refused. The walk never
+* descends symlinked directories.
+*/
+async function filenamesInDir(root, under, base) {
+	if (!await requireDir(under, base)) return [];
+	const out = [];
+	await walk$1(base, (full, entry) => {
+		if (entry.isFile()) out.push([node_path.relative(root, full).split(node_path.sep).join("/"), full]);
+	});
+	out.sort();
+	return out;
+}
+async function symlinksInDir(root, under, base) {
+	const relOf = (full) => node_path.relative(root, full).split(node_path.sep).join("/");
+	let st;
+	try {
+		st = await fsp.lstat(base, { bigint: true });
+	} catch (e) {
+		const code = e.code;
+		if (code === "ENOENT" || code === "ENOTDIR") return new Set();
+		throw e;
+	}
+	if (st.isSymbolicLink()) return new Set([relOf(base)]);
+	if (!st.isDirectory()) throw new FileStoreError(FileStoreError.NOT_A_DIRECTORY, under);
+	const out = new Set();
+	await walk$1(base, (full, entry) => {
+		if (entry.isSymbolicLink()) out.add(relOf(full));
+	});
+	return out;
+}
+/** `false` when `base` is absent, refused when present but not a directory. */
+async function requireDir(under, base) {
+	let st;
+	try {
+		st = await fsp.lstat(base, { bigint: true });
+	} catch (e) {
+		const code = e.code;
+		if (code === "ENOENT" || code === "ENOTDIR") return false;
+		throw e;
+	}
+	if (!st.isDirectory()) throw new FileStoreError(FileStoreError.NOT_A_DIRECTORY, under);
+	return true;
+}
+/** Visit every entry under `base` without descending symlinked directories. */
+async function walk$1(base, visit) {
+	const stack = [base];
+	while (stack.length) {
+		const dir = stack.pop();
+		let entries;
+		try {
+			entries = await fsp.readdir(dir, { withFileTypes: true });
+		} catch (e) {
+			if (e.code === "ENOENT") continue;
+			throw e;
+		}
+		for (const entry of entries) {
+			const full = node_path.join(dir, entry.name);
+			visit(full, entry);
+			if (entry.isDirectory() && !entry.isSymbolicLink()) stack.push(full);
+		}
+	}
+}
+function unchangedSinceHashed(cached, st) {
+	return st.mtimeNs === cached.mtimeNs && st.ctimeNs === cached.ctimeNs && st.size === cached.size;
+}
+function oldEnoughToCache(st, walkStartNs) {
+	const newestNs = st.mtimeNs > st.ctimeNs ? st.mtimeNs : st.ctimeNs;
+	return newestNs < walkStartNs - _internals.timestampTrustMarginNs;
+}
+const TIMESTAMP_TRUST_MARGIN_NS = 2000000000n;
+/** Test seam — the hasher, the trust margin, and the walk clock. @internal */
+const _internals = {
+	hashFile,
+	timestampTrustMarginNs: TIMESTAMP_TRUST_MARGIN_NS,
+	nowNs: () => BigInt(Date.now()) * 1000000n
+};
+const LocalFileStore = FileStore;
+const asyncDispose = Symbol.asyncDispose;
+if (asyncDispose) {
+	Object.defineProperty(FileStore.prototype, asyncDispose, {
+		value: FileStore.prototype.dispose,
+		configurable: true,
+		writable: true
+	});
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/tools/agent-toolset/memories.mjs
+/**
+* Session-level memory-store download and sync.
+*
+* A session may have several memory stores attached. This module resolves
+* where each store's folder goes on disk, opens a {@link LocalFileStore}
+* there, and reconciles each folder with its remote store — the merge rules
+* live on {@link SessionMemoryStores}.
+*
+* Node-only (it sits on the filesystem-backed FileStore); like `skills.ts`,
+* it is reachable through the shimmed `node.ts` entry point.
+*/
+var _SessionMemoryStores_instances;
+var _SessionMemoryStores_client;
+var _SessionMemoryStores_workdir;
+var _SessionMemoryStores_syncIntervalMs;
+var _SessionMemoryStores_syncDeletions;
+var _SessionMemoryStores_log;
+var _SessionMemoryStores_lastSyncAt;
+var _SessionMemoryStores_finished;
+var _SessionMemoryStores_stores;
+var _SessionMemoryStores_storeRoot;
+var _SessionMemoryStores_scanMarker;
+var _SessionMemoryStores_syncStore;
+var _SessionMemoryStores_flushStore;
+var _SessionMemoryStores_recover;
+var _SessionMemoryStores_stampAndPull;
+var _SessionMemoryStores_syncPath;
+var _SessionMemoryStores_removeLocal;
+var _SessionMemoryStores_write;
+var _SessionMemoryStores_pullAll;
+var _SessionMemoryStores_uploadAll;
+var _SessionMemoryStores_listMemories;
+var _SessionMemoryStores_upload;
+var _SessionMemoryStores_corroboratedDelete;
+var _SessionMemoryStores_deleteRemote;
+/**
+* Time bound the worker puts on each teardown pass — the final
+* {@link SessionMemoryStores.finish}, then {@link SessionMemoryStores.flushWrites} —
+* so a slow server cannot stall teardown.
+*/
+const MEMORY_FLUSH_TIMEOUT_MS = 3e4;
+/**
+* Marker file stamped into every store folder; a sync trusts the folder only
+* when it matches. Never itself syncs.
+*/
+const MARKER_PATH = ".anthropic-memory-store";
+const MARKER_VERSION = 1;
+function markerSha(memoryStoreId) {
+	return node_crypto.createHash("sha256").update(`version ${MARKER_VERSION}\n${memoryStoreId}`, "utf-8").digest("hex");
+}
+/** How long a file must stay missing locally before its server delete goes out. */
+const DELETE_CORROBORATION_MS = 3e4;
+/**
+* Page sizes for memory listings — the API's maximum per view: `basic` pages
+* carry up to 100 items, `full` pages are capped by the server.
+*/
+const LIST_PAGE_SIZE = 100;
+const FULL_LIST_PAGE_SIZE = 20;
+/**
+* How many single-memory content fetches may be in flight at once during one
+* store's pull pass. A sync rarely pulls more than a handful of memories, so
+* a higher cap buys nothing in the common case.
+*/
+const FETCH_CONCURRENCY = 16;
+/**
+* How many uploads one store's flush keeps in flight. At ~0.3s per upload,
+* 32 clears the server's 2000-memories-per-store cap inside
+* {@link MEMORY_FLUSH_TIMEOUT_MS}.
+*/
+const UPLOAD_CONCURRENCY = 32;
+/**
+* Per-sync remote-delete cap bounds. The floor lets a small store's
+* deletes clear in one pass; the ceiling caps damage on large ones.
+*/
+const DELETE_CAP_FLOOR = 8;
+const DELETE_CAP_CEILING = 50;
+/**
+* A session's memory stores could not be mounted.
+*
+* Thrown by {@link SessionMemoryStores.download} when a store cannot be
+* materialised on disk, and by the environment worker when a work item for a
+* session that has memory stores carried no sessions token to reach them with.
+*/
+var SessionMemoryError = class extends require_sdk.AnthropicError {
+	constructor(message, cause) {
+		super(message);
+		this.name = "SessionMemoryError";
+		if (cause !== undefined) this.cause = cause;
+	}
+};
+/** One sync's remote-delete gate and counters. */
+var DeletePass = class {
+	constructor(mode, cap, waiveWindow) {
+		this.mode = mode;
+		this.cap = cap;
+		this.waiveWindow = waiveWindow;
+		this.attempted = 0;
+		this.capped = 0;
+		this.suppressed = 0;
+	}
+	takeSlot() {
+		if (this.attempted >= this.cap) {
+			this.capped++;
+			return false;
+		}
+		this.attempted++;
+		return true;
+	}
+};
+/**
+* The memory stores attached to one session, materialised on disk.
+*
+* {@link SessionMemoryStores.download} opens a {@link LocalFileStore} at each
+* attached store's directory (its `mount_path`, or a workdir fallback — see
+* {@link SessionMemoryStores.download}), pulls its memories, and records each
+* one's `content_sha256` as the sync baseline. Each sync
+* ({@link SessionMemoryStores.syncIfDue} on the worker's cadence,
+* {@link SessionMemoryStores.finish} once at the end) reconciles disk against
+* server, per store and per path:
+*
+* - a memory changed only remotely is written to disk;
+* - a file changed only locally is uploaded — an update with a
+*   `content_sha256` precondition, or a create for a new file;
+* - a file changed on both sides logs a warning and takes the server version;
+* - a file the server refuses (too large, invalid content) is skipped —
+*   warned once and retried only after the file changes; other files keep
+*   syncing;
+* - a file deleted locally is deleted on the server after a delay and a
+*   re-check — never on the first sync that notices, and only up to a
+*   per-sync cap. `syncDeletions` gates it;
+* - a memory deleted on the server is deleted on disk — unless the local
+*   file holds un-pushed edits: a writable store re-creates the memory
+*   from the file, a read-only one keeps the file unsynced;
+* - a store attached read-only pulls but never pushes.
+*
+* A download pulls the whole store, so it lists with content included. The
+* recurring syncs instead run two phases: a content-free listing (paths and
+* shas) drives the merge decisions, then only the memories actually being
+* written to disk are fetched, a bounded number at a time. A sync that finds
+* nothing changed moves no content at all.
+*
+* A file whose write to disk failed is never in the baseline, so its absence
+* reads as a failed download — it is pulled again, never deleted. A write
+* never re-creates a store folder that vanished mid-sync: it fails, and the
+* next sync's scan finds whatever is at the path by then — nothing
+* (re-downloaded) or someone else's files (left alone) — under the rules
+* below.
+*
+* A store folder that loses its {@link MARKER_PATH} marker, is emptied,
+* or vanishes is re-downloaded rather than treated as a mass local
+* delete; a folder whose marker names another store is left as found —
+* nothing pushed, nothing deleted.
+*
+* Two things about the store's directory make
+* {@link SessionMemoryStores.download} refuse the session outright, with
+* {@link SessionMemoryError}: a `mount_path` that is not a clean absolute
+* path, and a directory already sitting at that path.
+*
+* {@link SessionMemoryStores.download} throws on the first store it cannot
+* materialise. The syncs never throw: mid-session, one bad store or one bad
+* file is logged and the rest continue. Instances are not safe for concurrent
+* use. The worker builds one on its token-scoped sub-client (the memory
+* endpoints reject the environment key): `syncIfDue` after each tool call,
+* `finish` once at a clean end, a bounded {@link SessionMemoryStores.flushWrites}
+* in every teardown, `dispose` last.
+*/
+var SessionMemoryStores = class {
+	constructor(client, opts) {
+		_SessionMemoryStores_instances.add(this);
+		_SessionMemoryStores_client.set(this, void 0);
+		_SessionMemoryStores_workdir.set(this, void 0);
+		_SessionMemoryStores_syncIntervalMs.set(this, void 0);
+		_SessionMemoryStores_syncDeletions.set(this, void 0);
+		_SessionMemoryStores_log.set(this, void 0);
+		_SessionMemoryStores_lastSyncAt.set(this, void 0);
+		_SessionMemoryStores_finished.set(this, false);
+		_SessionMemoryStores_stores.set(this, []);
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_client, client, "f");
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_workdir, opts.workdir, "f");
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_syncIntervalMs, opts.syncIntervalMs ?? 15e3, "f");
+		require_sdk.checkMemorySyncInterval(require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_syncIntervalMs, "f"), "syncIntervalMs");
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_syncDeletions, opts.syncDeletions ?? "enabled", "f");
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_log, require_sdk.loggerFor(client), "f");
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_lastSyncAt, Date.now(), "f");
+	}
+	/**
+	* Every attached store's root directory.
+	*
+	* The worker lists these as the file tools' allowed roots so a store
+	* mounted outside the workdir stays reachable.
+	*/
+	get roots() {
+		return require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f").map((s) => s.files.root().path);
+	}
+	/**
+	* Root directories of stores attached read-only.
+	*
+	* The file tools consult this to refuse writes into read-only stores.
+	*/
+	get readOnlyRoots() {
+		return require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f").filter((s) => s.readOnly).map((s) => s.files.root().path);
+	}
+	/**
+	* Download every attached store's memories to disk.
+	*
+	* `session` arrives already fetched — one snapshot shared with the skills
+	* download, so the two cannot disagree about the resources.
+	*/
+	async download(session) {
+		for (const resource of session.resources) {
+			if (resource.type !== "memory_store") continue;
+			const root = require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_storeRoot).call(this, resource);
+			let store;
+			try {
+				store = {
+					memoryStoreId: resource.memory_store_id,
+					files: await LocalFileStore.open(root, { utf8: true }),
+					readOnly: resource.access === "read_only",
+					baseline: new Map(),
+					refusedShas: new Map(),
+					pendingDeletes: new Map()
+				};
+				if (!store.files.root().removedOnDispose) {
+					throw new SessionMemoryError(`something already exists at the memory store's path: ${root} ` + `(memory_store_id=${resource.memory_store_id}); ` + "it must not exist when the session starts");
+				}
+				try {
+					await store.files.createRoot();
+				} catch (e) {
+					if (!isErrno(e)) throw e;
+					throw new SessionMemoryError(`cannot create the memory store's folder: ${root} ` + `(memory_store_id=${resource.memory_store_id}): ${e}; ` + "the worker host must make this mount path writable", e);
+				}
+				await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_stampAndPull).call(this, store);
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").info("downloaded memories", {
+					count: store.baseline.size,
+					memory_store_id: store.memoryStoreId,
+					dest: store.files.root().path
+				});
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f").push(store);
+			} catch (e) {
+				if (store) await store.files.dispose().catch(() => {});
+				if (e instanceof SessionMemoryError) throw e;
+				throw new SessionMemoryError(`failed to download memory store memory_store_id=${resource.memory_store_id}: ${e}`, e);
+			}
+		}
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_lastSyncAt, Date.now(), "f");
+	}
+	/**
+	* The session's last sync — skips the delete wait, so calling it twice
+	* would undo the protection; it throws instead.
+	*/
+	async finish() {
+		if (require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_finished, "f")) {
+			throw new require_sdk.AnthropicError("finish() was already called: it is the session's last sync and runs once");
+		}
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_finished, true, "f");
+		await this.syncAll(true);
+	}
+	/** @internal — reconcile every store once; the tests' deterministic driver */
+	async syncAll(final) {
+		await Promise.all(require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f").map((store) => require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_syncStore).call(this, store, final)));
+		require_sdk.__classPrivateFieldSet(this, _SessionMemoryStores_lastSyncAt, Date.now(), "f");
+	}
+	/** Sync when `syncIntervalMs` has elapsed since the last one. Never throws. */
+	async syncIfDue() {
+		if (Date.now() - require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_lastSyncAt, "f") < require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_syncIntervalMs, "f")) return;
+		await this.syncAll(false);
+	}
+	/**
+	* Upload new and changed files; send no deletes and pull nothing.
+	*
+	* The push-only rescue pass for a session ending on an error or
+	* cancel — best-effort, bounded by the caller: once `signal` aborts no
+	* further upload starts, each store cut off part-way logs how many
+	* changed files it had not finished uploading, and this resolves without
+	* waiting for requests already in flight. Each store uploads up to
+	* {@link UPLOAD_CONCURRENCY} files at a time. Skips read-only stores,
+	* refused files, files the server already holds, and folders that fail
+	* the marker check. Never throws.
+	*/
+	async flushWrites(signal) {
+		await Promise.all(require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f").map((store) => require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_flushStore).call(this, store, signal)));
+	}
+	/**
+	* Remove every store directory that {@link SessionMemoryStores.download}
+	* created. Pre-existing directories are left alone — that is
+	* {@link FileStore.dispose}'s own rule. A folder that fails the marker
+	* check is kept too — sync left it as found, so must dispose.
+	*/
+	async dispose() {
+		for (const store of require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_stores, "f")) {
+			const root = store.files.root();
+			try {
+				const scan = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_scanMarker).call(this, store);
+				if (!scan.markerOk && Object.keys(scan.files).length > 0) {
+					require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`${scan.distrustReason}; leaving the memory store folder on disk`, {
+						root: root.path,
+						memory_store_id: store.memoryStoreId
+					});
+					continue;
+				}
+				await store.files.dispose();
+			} catch (e) {
+				if (!(e instanceof FileStoreError) && !isErrno(e)) throw e;
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to remove the memory store folder", {
+					root: store.files.root().path,
+					memory_store_id: store.memoryStoreId,
+					error: String(e)
+				});
+				continue;
+			}
+			if (root.removedOnDispose) {
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").info("removed memory store dir", {
+					dest: root.path,
+					memory_store_id: store.memoryStoreId
+				});
+			}
+		}
+	}
+};
+_SessionMemoryStores_client = new WeakMap(), _SessionMemoryStores_workdir = new WeakMap(), _SessionMemoryStores_syncIntervalMs = new WeakMap(), _SessionMemoryStores_syncDeletions = new WeakMap(), _SessionMemoryStores_log = new WeakMap(), _SessionMemoryStores_lastSyncAt = new WeakMap(), _SessionMemoryStores_finished = new WeakMap(), _SessionMemoryStores_stores = new WeakMap(), _SessionMemoryStores_instances = new WeakSet(), _SessionMemoryStores_storeRoot = function _SessionMemoryStores_storeRoot(resource) {
+	if (resource.mount_path) {
+		if (!isPathLegal(resource.mount_path)) {
+			throw new SessionMemoryError(`memory store mount_path is not a clean absolute path: ${JSON.stringify(resource.mount_path)} ` + `(memory_store_id=${resource.memory_store_id})`);
+		}
+		return resource.mount_path;
+	}
+	return node_path.join(require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_workdir, "f"), "memory", resource.name || resource.memory_store_id);
+}, _SessionMemoryStores_scanMarker = async function _SessionMemoryStores_scanMarker(store) {
+	const local = await store.files.hashtree();
+	const marker = local[MARKER_PATH];
+	delete local[MARKER_PATH];
+	if (marker === markerSha(store.memoryStoreId)) {
+		return {
+			files: local,
+			markerOk: true,
+			distrustReason: null
+		};
+	}
+	return {
+		files: local,
+		markerOk: false,
+		distrustReason: marker !== undefined ? "the marker file does not match this store" : "the marker file is gone"
+	};
+}, _SessionMemoryStores_syncStore = async function _SessionMemoryStores_syncStore(store, final) {
+	try {
+		const scan = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_scanMarker).call(this, store);
+		const local = scan.files;
+		if (!scan.markerOk) {
+			if (Object.keys(local).length > 0) {
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`${scan.distrustReason}; leaving the memory store folder as found and not syncing`, {
+					root: store.files.root().path,
+					memory_store_id: store.memoryStoreId
+				});
+				return;
+			}
+			await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_recover).call(this, store, "the folder or its marker is gone");
+			return;
+		}
+		if (Object.keys(local).length === 0 && store.baseline.size > 1) {
+			await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_recover).call(this, store, "every memory file is gone at once");
+			return;
+		}
+		const remote = new Map();
+		for await (const [rel, item] of require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_listMemories).call(this, store.memoryStoreId)) {
+			remote.set(rel, item);
+		}
+		const deletes = new DeletePass(require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_syncDeletions, "f"), Math.max(DELETE_CAP_FLOOR, Math.min(DELETE_CAP_CEILING, Math.floor(store.baseline.size / 4))), final);
+		const pulls = [];
+		const baseline = new Map();
+		const paths = [...new Set([
+			...remote.keys(),
+			...Object.keys(local),
+			...store.baseline.keys()
+		])].sort();
+		for (const rel of paths) {
+			const remoteItem = remote.get(rel);
+			const localSha = local[rel];
+			const baseSha = store.baseline.get(rel);
+			let sha;
+			if (localSha === undefined && baseSha !== undefined && remoteItem !== undefined && remoteItem.content_sha256 === baseSha && !store.readOnly) {
+				sha = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_corroboratedDelete).call(this, store, rel, remoteItem, baseSha, deletes);
+			} else {
+				sha = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_syncPath).call(this, store, rel, remoteItem, localSha, pulls);
+			}
+			if (sha !== undefined) baseline.set(rel, sha);
+		}
+		store.baseline = baseline;
+		await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_pullAll).call(this, store, pulls);
+		if (deletes.suppressed > 0) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").debug("remote deletes are disabled; locally deleted memories stay on the server", {
+				count: deletes.suppressed,
+				memory_store_id: store.memoryStoreId
+			});
+		}
+		if (deletes.capped > 0) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`delete cap reached: ${deletes.mode === "log_only" ? "would send" : "sent"} ` + `${deletes.attempted} deletes, held ${deletes.capped} for later syncs`, { memory_store_id: store.memoryStoreId });
+		}
+	} catch (e) {
+		require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory sync failed", {
+			memory_store_id: store.memoryStoreId,
+			error: String(e)
+		});
+	}
+}, _SessionMemoryStores_flushStore = async function _SessionMemoryStores_flushStore(store, signal) {
+	const dirty = new Map();
+	const unsent = new Set();
+	const push = async () => {
+		if (store.readOnly) return;
+		const scan = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_scanMarker).call(this, store);
+		if (!scan.markerOk) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`${scan.distrustReason}; not uploading anything from the memory store folder`, {
+				root: store.files.root().path,
+				memory_store_id: store.memoryStoreId
+			});
+			return;
+		}
+		for (const [rel, sha] of Object.entries(scan.files)) {
+			if (sha !== store.baseline.get(rel) && store.refusedShas.get(rel) !== sha) {
+				dirty.set(rel, sha);
+				unsent.add(rel);
+			}
+		}
+		if (dirty.size === 0 || signal?.aborted) return;
+		const remote = new Map();
+		for await (const [rel, item] of require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_listMemories).call(this, store.memoryStoreId)) {
+			if (signal?.aborted) return;
+			remote.set(rel, item);
+		}
+		const uploads = [];
+		for (const rel of [...dirty.keys()].sort()) {
+			const localSha = dirty.get(rel);
+			const baseSha = store.baseline.get(rel);
+			const existing = remote.get(rel);
+			if (existing !== undefined && existing.content_sha256 === localSha) {
+				store.baseline.set(rel, existing.content_sha256);
+				unsent.delete(rel);
+				continue;
+			}
+			if (existing !== undefined && existing.content_sha256 !== baseSha) {
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory changed both locally and remotely; the flush leaves the remote version", {
+					path: rel,
+					memory_store_id: store.memoryStoreId
+				});
+				unsent.delete(rel);
+				continue;
+			}
+			uploads.push([
+				rel,
+				localSha,
+				existing
+			]);
+		}
+		await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_uploadAll).call(this, store, uploads, unsent, signal);
+	};
+	try {
+		await settledOrAborted(push(), signal);
+		if (signal?.aborted && unsent.size > 0) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`memory flush cut off part-way; ${unsent.size} of ${dirty.size} changed files had not finished uploading`, { memory_store_id: store.memoryStoreId });
+		}
+	} catch (e) {
+		require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory flush failed", {
+			memory_store_id: store.memoryStoreId,
+			error: String(e)
+		});
+	}
+}, _SessionMemoryStores_recover = async function _SessionMemoryStores_recover(store, reason) {
+	require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn(`${reason}; re-downloading the memory store folder instead of syncing`, {
+		root: store.files.root().path,
+		memory_store_id: store.memoryStoreId
+	});
+	await store.files.createRoot();
+	await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_stampAndPull).call(this, store);
+}, _SessionMemoryStores_stampAndPull = async function _SessionMemoryStores_stampAndPull(store) {
+	store.baseline = new Map();
+	store.pendingDeletes.clear();
+	await store.files.put(MARKER_PATH, `version ${MARKER_VERSION}\n${store.memoryStoreId}`);
+	for await (const [rel, item] of require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_listMemories).call(this, store.memoryStoreId, "full")) {
+		if (await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_write).call(this, store, rel, item.content ?? "")) {
+			store.baseline.set(rel, item.content_sha256);
+		}
+	}
+}, _SessionMemoryStores_syncPath = async function _SessionMemoryStores_syncPath(store, rel, remote, localSha, pulls) {
+	const baseSha = store.baseline.get(rel);
+	if (localSha !== undefined) {
+		store.pendingDeletes.delete(rel);
+	}
+	if (!remote) {
+		if (localSha === undefined) {
+			store.pendingDeletes.delete(rel);
+			return undefined;
+		}
+		if (baseSha !== undefined) {
+			if (localSha === baseSha) {
+				const fresh = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_removeLocal).call(this, store, rel, baseSha);
+				if (fresh === undefined) return undefined;
+				if (fresh === baseSha) return baseSha;
+				localSha = fresh;
+			}
+			if (store.readOnly) {
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory deleted remotely but edited locally; keeping the file, " + "which a read-only store cannot push", {
+					path: rel,
+					memory_store_id: store.memoryStoreId
+				});
+			} else if (store.refusedShas.get(rel) !== localSha) {
+				require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").info("memory deleted remotely but edited locally; re-creating it from the file", {
+					path: rel,
+					memory_store_id: store.memoryStoreId
+				});
+			}
+		}
+		if (store.readOnly) return undefined;
+		if (store.refusedShas.get(rel) === localSha) return undefined;
+		return await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_upload).call(this, store, rel, localSha, undefined);
+	}
+	const remoteSha = remote.content_sha256;
+	const remoteChanged = remoteSha !== baseSha;
+	const locallyEdited = localSha !== undefined && localSha !== baseSha && localSha !== remoteSha;
+	const localChanged = !store.readOnly && locallyEdited;
+	if (localSha === undefined && baseSha !== undefined) {
+		if (remoteChanged) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory deleted locally but changed remotely; restoring the remote version", {
+				path: rel,
+				memory_store_id: store.memoryStoreId
+			});
+			store.pendingDeletes.delete(rel);
+			pulls.push([rel, remote]);
+		}
+		return baseSha;
+	}
+	if (remoteChanged) {
+		if (localSha === remoteSha) return remoteSha;
+		if (locallyEdited) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory changed both locally and remotely; keeping the remote version", {
+				path: rel,
+				memory_store_id: store.memoryStoreId
+			});
+		}
+		pulls.push([rel, remote]);
+		return baseSha;
+	}
+	if (localChanged) {
+		if (store.refusedShas.get(rel) === localSha) return remoteSha;
+		return await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_upload).call(this, store, rel, localSha, remote) ?? remoteSha;
+	}
+	return remoteSha;
+}, _SessionMemoryStores_removeLocal = async function _SessionMemoryStores_removeLocal(store, rel, expectSha) {
+	let freshSha;
+	try {
+		freshSha = await store.files.hashFile(rel);
+	} catch (e) {
+		if (!(e instanceof FileStoreError) && !isErrno(e)) throw e;
+		return expectSha;
+	}
+	if (freshSha === null) return undefined;
+	if (freshSha !== expectSha) return freshSha;
+	try {
+		await store.files.remove(rel);
+	} catch (e) {
+		if (!(e instanceof FileStoreError) && !isErrno(e)) throw e;
+		require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to remove memory deleted remotely", {
+			path: rel,
+			memory_store_id: store.memoryStoreId,
+			error: String(e)
+		});
+		return expectSha;
+	}
+	return undefined;
+}, _SessionMemoryStores_write = async function _SessionMemoryStores_write(store, rel, content) {
+	try {
+		await store.files.put(rel, content);
+	} catch (e) {
+		if (!(e instanceof FileStoreError) && !isErrno(e)) throw e;
+		require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to write memory", {
+			path: rel,
+			memory_store_id: store.memoryStoreId,
+			error: String(e)
+		});
+		return false;
+	}
+	return true;
+}, _SessionMemoryStores_pullAll = async function _SessionMemoryStores_pullAll(store, pulls) {
+	if (pulls.length === 0) return;
+	const pullOne = async (rel, listed) => {
+		let item;
+		try {
+			item = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_client, "f").beta.memoryStores.memories.retrieve(listed.id, {
+				memory_store_id: store.memoryStoreId,
+				view: "full"
+			});
+		} catch (e) {
+			if (require_sdk.isStatus(e, 404)) return;
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to fetch memory content", {
+				path: rel,
+				memory_store_id: store.memoryStoreId,
+				error: String(e)
+			});
+			return;
+		}
+		if (await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_write).call(this, store, rel, item.content ?? "")) {
+			store.baseline.set(rel, item.content_sha256);
+		}
+	};
+	const queue = pulls[Symbol.iterator]();
+	const worker = async () => {
+		for (const [rel, listed] of queue) await pullOne(rel, listed);
+	};
+	await Promise.all(Array.from({ length: Math.min(FETCH_CONCURRENCY, pulls.length) }, worker));
+}, _SessionMemoryStores_uploadAll = async function _SessionMemoryStores_uploadAll(store, uploads, unsent, signal) {
+	const queue = uploads[Symbol.iterator]();
+	const worker = async () => {
+		for (const [rel, localSha, existing] of queue) {
+			if (signal?.aborted) return;
+			const sha = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_upload).call(this, store, rel, localSha, existing);
+			unsent.delete(rel);
+			if (sha !== undefined) store.baseline.set(rel, sha);
+		}
+	};
+	await Promise.all(Array.from({ length: Math.min(32, uploads.length) }, worker));
+}, _SessionMemoryStores_listMemories = async function* _SessionMemoryStores_listMemories(memoryStoreId, view = "basic") {
+	const limit = view === "basic" ? LIST_PAGE_SIZE : FULL_LIST_PAGE_SIZE;
+	for await (const item of require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_client, "f").beta.memoryStores.memories.list(memoryStoreId, {
+		view,
+		limit
+	})) {
+		if (item.type !== "memory") continue;
+		const rel = item.path.replace(/^\/+/, "");
+		if (rel === ".anthropic-memory-store") {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("the server listed the reserved marker path; skipping", {
+				path: item.path,
+				memory_store_id: memoryStoreId
+			});
+			continue;
+		}
+		yield [rel, item];
+	}
+}, _SessionMemoryStores_upload = async function _SessionMemoryStores_upload(store, rel, localSha, existing) {
+	try {
+		const data = await store.files.get(rel);
+		if (data === null) return undefined;
+		const content = require_sdk.decodeUTF8(data);
+		const item = existing ? await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_client, "f").beta.memoryStores.memories.update(existing.id, {
+			memory_store_id: store.memoryStoreId,
+			content,
+			precondition: {
+				type: "content_sha256",
+				content_sha256: existing.content_sha256
+			}
+		}) : await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_client, "f").beta.memoryStores.memories.create(store.memoryStoreId, {
+			path: "/" + rel,
+			content
+		});
+		store.refusedShas.delete(rel);
+		return item.content_sha256;
+	} catch (e) {
+		if (existing && require_sdk.isStatus(e, 404)) {
+			return await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_upload).call(this, store, rel, localSha, undefined);
+		}
+		const permanent = e instanceof FileStoreError || require_sdk.isStatus(e, 400) || require_sdk.isStatus(e, 413);
+		if (existing && require_sdk.isStatus(e, 409)) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory changed both locally and remotely; the upload was refused and the local edit loses", {
+				path: rel,
+				memory_store_id: store.memoryStoreId
+			});
+		} else if (permanent && localSha !== undefined) {
+			store.refusedShas.set(rel, localSha);
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("the server rejected this memory file, so it stays un-synced until its content changes", {
+				path: rel,
+				memory_store_id: store.memoryStoreId,
+				rejection: String(e)
+			});
+		} else {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to upload memory", {
+				path: rel,
+				memory_store_id: store.memoryStoreId,
+				error: String(e)
+			});
+		}
+		return undefined;
+	}
+}, _SessionMemoryStores_corroboratedDelete = async function _SessionMemoryStores_corroboratedDelete(store, rel, remote, baseSha, deletes) {
+	if (deletes.mode === "disabled") {
+		deletes.suppressed++;
+		return baseSha;
+	}
+	let firstAbsent = store.pendingDeletes.get(rel);
+	if (firstAbsent === undefined) {
+		firstAbsent = Date.now();
+		store.pendingDeletes.set(rel, firstAbsent);
+	}
+	if (!deletes.waiveWindow && Date.now() - firstAbsent < 3e4) {
+		return baseSha;
+	}
+	let markerOk;
+	let stillAbsent;
+	try {
+		markerOk = await store.files.hashFile(MARKER_PATH) === markerSha(store.memoryStoreId);
+		stillAbsent = await store.files.hashFile(rel) === null;
+	} catch (e) {
+		if (!(e instanceof FileStoreError) && !isErrno(e)) throw e;
+		markerOk = stillAbsent = false;
+	}
+	if (!markerOk) return baseSha;
+	if (!stillAbsent) {
+		store.pendingDeletes.delete(rel);
+		return baseSha;
+	}
+	if (!deletes.takeSlot()) return baseSha;
+	if (deletes.mode === "log_only") {
+		require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").info("log-only: sync would delete this memory on the server", {
+			path: rel,
+			memory_store_id: store.memoryStoreId
+		});
+		return baseSha;
+	}
+	const sha = await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_instances, "m", _SessionMemoryStores_deleteRemote).call(this, store, rel, remote, baseSha);
+	if (sha === undefined) {
+		store.pendingDeletes.delete(rel);
+	}
+	return sha;
+}, _SessionMemoryStores_deleteRemote = async function _SessionMemoryStores_deleteRemote(store, rel, remote, baseSha) {
+	try {
+		await require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_client, "f").beta.memoryStores.memories.delete(remote.id, {
+			memory_store_id: store.memoryStoreId,
+			expected_content_sha256: baseSha
+		});
+	} catch (e) {
+		if (require_sdk.isStatus(e, 404)) return undefined;
+		if (require_sdk.isStatus(e, 409) || require_sdk.isStatus(e, 412)) {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("memory deleted locally but changed remotely; keeping the remote version", {
+				path: rel,
+				memory_store_id: store.memoryStoreId
+			});
+		} else {
+			require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").warn("failed to delete memory", {
+				path: rel,
+				memory_store_id: store.memoryStoreId,
+				error: String(e)
+			});
+		}
+		return baseSha;
+	}
+	require_sdk.__classPrivateFieldGet(this, _SessionMemoryStores_log, "f").info("propagated local deletion", {
+		path: rel,
+		memory_store_id: store.memoryStoreId
+	});
+	return undefined;
+};
+/**
+* True for a thrown value shaped like a Node filesystem error. Shape-checked,
+* not `instanceof Error` — fs errors can come from another realm.
+*/
+function isErrno(e) {
+	return typeof e === "object" && e !== null && typeof e.code === "string";
+}
+/**
+* Resolve when `p` settles, or as soon as `signal` aborts. A rejection from
+* `p` before the abort propagates; one after it is dropped.
+*/
+async function settledOrAborted(p, signal) {
+	if (!signal) {
+		await p;
+		return;
+	}
+	let onAbort;
+	const aborted = new Promise((resolve) => {
+		onAbort = resolve;
+		if (signal.aborted) resolve();
+	});
+	signal.addEventListener("abort", onAbort, { once: true });
+	try {
+		await Promise.race([p, aborted]);
+	} finally {
+		signal.removeEventListener("abort", onAbort);
+	}
+}
+
+//#endregion
+//#region ../../node_modules/.pnpm/@anthropic-ai+sdk@0.124.0_zod@4.5.4/node_modules/@anthropic-ai/sdk/tools/agent-toolset/node.mjs
+/**
+* Node implementation of the `agent_toolset_20260401` tools — `bash`, `read`,
+* `write`, `edit`, `glob`, `grep` — plus the workdir/skills
+* {@link AgentToolContext}.
+*
+* This mirrors `@anthropic-ai/sdk/tools/memory/node`: it is the explicit,
+* Node-only entry point for these implementations. Importing it pulls in
+* `node:child_process`, `node:fs`, etc., so it is kept separate from the rest of
+* the SDK — depending on it is an opt-in.
+*
+* **Node 22+ is required** for this module: the `glob` tool uses the native
+* `fs.glob`, added in Node 22. The rest of the SDK still supports Node 18+; only
+* the agent toolset has this requirement.
+*
+* The result of {@link betaAgentToolset20260401} is a plain `BetaRunnableTool[]`;
+* hand it to any tool runner — `client.beta.messages.toolRunner({ …, tools })`
+* for the Messages API, or `client.beta.sessions.events.toolRunner({ …, tools })`
+* for a managed-agents session:
+*
+* ```ts
+* import { betaAgentToolset20260401 } from '@anthropic-ai/sdk/tools/agent-toolset/node';
+*
+* const tools = betaAgentToolset20260401({ workdir: '/work' });
+* const tools2 = betaAgentToolset20260401({ workdir: '/work' }).filter((t) => t.name !== 'bash');
+* ```
+*
+* Trust model: the file tools confine to `workdir` plus any `allowedRoots`
+* (symlink-aware) and are safe without a sandbox; `bash` is unrestricted and
+* should run inside one. See {@link AgentToolContext}.
+*/
+var _BashSession_instances;
+var _BashSession_proc;
+var _BashSession_buf;
+var _BashSession_truncated;
+var _BashSession_closed;
+var _BashSession_waiting;
+var _BashSession_append;
+var _LineRangeCollector_instances;
+var _LineRangeCollector_filePath;
+var _LineRangeCollector_startLine;
+var _LineRangeCollector_endLine;
+var _LineRangeCollector_start;
+var _LineRangeCollector_end;
+var _LineRangeCollector_limit;
+var _LineRangeCollector_line;
+var _LineRangeCollector_collected;
+var _LineRangeCollector_collectedBytes;
+var _LineRangeCollector_collect;
+var _LineRangeCollector_overLimitError;
+const BASH_OUTPUT_LIMIT = 100 * 1024;
+const BASH_DEFAULT_TIMEOUT_MS = 12e4;
+const DEFAULT_MAX_FILE_BYTES = 256 * 1024;
+const READ_STREAM_CHUNK_BYTES = 64 * 1024;
+const NEWLINE = Buffer.from("\n");
+const GREP_OUTPUT_LIMIT = 100 * 1024;
+const GREP_MAX_LINE_LENGTH = 2e3;
+const GLOB_RESULT_LIMIT = 200;
+/**
+* A bash command exceeded its `timeoutMs`. Carries the timeout so a caller can
+* tell it apart from an abort without matching on the message text.
+*/
+var BashTimeoutError = class extends require_sdk.AnthropicError {
+	constructor(timeoutMs) {
+		super(`bash command timed out after ${timeoutMs}ms`);
+		this.name = "BashTimeoutError";
+		this.timeoutMs = timeoutMs;
+	}
+};
+const ANSI_RE = /\x1b\[[0-9;?]*[ -/]*[@-~]/g;
+const fsGlob = node_fs_promises.glob;
+function resolveMaxBytes(configured) {
+	return configured === undefined ? DEFAULT_MAX_FILE_BYTES : configured;
+}
+/**
+* Throw when the deprecated {@link AgentToolContext.unrestrictedPaths} was
+* passed at all. Nothing else reads that property.
+*/
+function rejectUnrestrictedPaths(value) {
+	if (value === undefined) return;
+	throw new require_sdk.AnthropicError("The `unrestrictedPaths` option you passed to the agent toolset (AgentToolContext) is no longer " + "supported. The toolset's file tools (read, write, edit, glob, grep) are now always confined to " + "the working directory plus the directories listed in `allowedRoots`. Remove `unrestrictedPaths` " + "from your context; to let the file tools reach any other directory, add it to `allowedRoots`.");
+}
+/**
+* Returns the `agent_toolset_20260401` implementations bound to `ctx`. The
+* result is a plain array of `BetaRunnableTool`; filter or extend it before
+* handing it to a tool runner:
+*
+* ```ts
+* const tools = [...betaAgentToolset20260401(ctx), myCustomTool];
+* const tools = betaAgentToolset20260401(ctx).filter((t) => t.name !== 'grep');
+* ```
+*
+* Concurrency note: `client.beta.sessions.events.toolRunner` dispatches a
+* session's tool calls serially (the sessions API delivers one `agent.tool_use`
+* at a time). `client.beta.messages.toolRunner` runs a turn's `tool.run` calls
+* via `Promise.all`. The toolset below is safe under either model —
+* {@link betaBashTool} serializes its persistent shell internally and the FS
+* tools are independent per call — but {@link betaEditTool}/{@link betaWriteTool}
+* cannot synchronize concurrent writes to the *same* file across processes, so a
+* multi-edit turn touching one path is still subject to inherent FS lost-update
+* races. Custom tools that close over mutable state should do their own queueing.
+*/
+function betaAgentToolset20260401(ctx) {
+	return [
+		betaBashTool(ctx),
+		betaReadTool(ctx),
+		betaWriteTool(ctx),
+		betaEditTool(ctx),
+		betaGlobTool(ctx),
+		betaGrepTool(ctx)
+	];
+}
+/**
+* Resolve `p` against `ctx.workdir`; reject results outside `ctx.workdir` and
+* `ctx.allowedRoots`. Absolute and relative inputs go through the same
+* canonicalise-then-contain check — an absolute path that lands inside a
+* permitted root is accepted, only paths that resolve *outside* all of them
+* are rejected. Every symlink in `p` (including the leaf, even a dangling one)
+* is resolved before the check, and the resolved path is what the tool then
+* operates on, so a symlink inside the workdir that points outside it can
+* neither pass the check nor be followed afterwards. See the trust model on
+* {@link AgentToolContext}.
+*
+* Residual TOCTOU: a component could still be swapped for a symlink between this
+* call and the eventual `fs` operation. Closing that fully needs per-component
+* `O_NOFOLLOW`/`openat`, which Node does not expose ergonomically; the same
+* residual exposure exists in `tools/memory/node` and is why a sandbox is still
+* recommended for the toolset as a whole.
+*/
+async function resolvePath(ctx, p) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return confineToRoot(ctx.workdir, p, { allowedRoots: ctx.allowedRoots ?? [] });
+}
+/**
+* The read-only root `target` falls under, or `undefined`. `target` arrives
+* fully canonicalized (from {@link resolvePath}), so each root is
+* canonicalized too — a root recorded through a symlinked workdir must still
+* match the resolved write target.
+*/
+function readOnlyRootFor(ctx, target) {
+	return containingRoot(ctx.readOnlyRoots ?? [], target);
+}
+/**
+* Build the environment for the spawned bash shell. The runner process holds
+* Anthropic credentials in `ANTHROPIC_*` env vars — the API key, the auth token,
+* and the per-work session token among them. `bash` runs an unrestricted shell,
+* so any command the agent runs could read those straight out of `process.env`;
+* strip the whole `ANTHROPIC_*` namespace from the child's environment.
+* Everything else (PATH, HOME, locale, …) is passed through unchanged.
+*
+* Passing an explicit `env` to {@link AgentToolContext} does NOT add to this
+* default — it FULLY REPLACES it. The provided mapping becomes the entire bash
+* environment verbatim; nothing here is merged in, so callers who want the
+* scrubbed process environment plus extras must build that mapping themselves.
+*/
+function scrubbedShellEnv() {
+	const env = {};
+	for (const [key, value] of Object.entries(process.env)) {
+		if (key.startsWith("ANTHROPIC_")) continue;
+		env[key] = value;
+	}
+	return env;
+}
+/**
+* A persistent /bin/bash process. State (cwd, env, background jobs) survives
+* across exec() calls. Uses pipes rather than a PTY so input is never echoed.
+*/
+var BashSession = class {
+	constructor(dir, env = scrubbedShellEnv()) {
+		_BashSession_instances.add(this);
+		_BashSession_proc.set(this, void 0);
+		_BashSession_buf.set(this, "");
+		_BashSession_truncated.set(this, false);
+		_BashSession_closed.set(this, false);
+		_BashSession_waiting.set(this, null);
+		require_sdk.__classPrivateFieldSet(this, _BashSession_proc, node_child_process.spawn("/bin/bash", ["--noprofile", "--norc"], {
+			cwd: dir,
+			env: {
+				...env,
+				PS1: "",
+				PS2: "",
+				TERM: "dumb"
+			},
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			detached: true
+		}), "f");
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stdout.setEncoding("utf8");
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stderr.setEncoding("utf8");
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stdout.on("data", (d) => require_sdk.__classPrivateFieldGet(this, _BashSession_instances, "m", _BashSession_append).call(this, d));
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stderr.on("data", (d) => require_sdk.__classPrivateFieldGet(this, _BashSession_instances, "m", _BashSession_append).call(this, d));
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").once("close", () => {
+			require_sdk.__classPrivateFieldSet(this, _BashSession_closed, true, "f");
+			const w = require_sdk.__classPrivateFieldGet(this, _BashSession_waiting, "f");
+			require_sdk.__classPrivateFieldSet(this, _BashSession_waiting, null, "f");
+			w?.resolve();
+		});
+	}
+	/** Whether the underlying shell process has exited. */
+	get closed() {
+		return require_sdk.__classPrivateFieldGet(this, _BashSession_closed, "f");
+	}
+	async exec(command, opts = {}) {
+		if (require_sdk.__classPrivateFieldGet(this, _BashSession_closed, "f")) {
+			throw new require_sdk.AnthropicError("bash session terminated");
+		}
+		const timeoutMs = opts.timeoutMs ?? BASH_DEFAULT_TIMEOUT_MS;
+		const signal = opts.signal;
+		signal?.throwIfAborted();
+		require_sdk.__classPrivateFieldSet(this, _BashSession_buf, "", "f");
+		require_sdk.__classPrivateFieldSet(this, _BashSession_truncated, false, "f");
+		const sentinel = `__ANT_CMD_${node_crypto.randomUUID()}_DONE__`;
+		const sentinelSplit = `${sentinel.slice(0, 8)}''${sentinel.slice(8)}`;
+		const wrapped = `{ ${command}\n} </dev/null 2>&1; printf '\\n${sentinelSplit}%d\\n' $?\n`;
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stdin.write(wrapped);
+		if (require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").indexOf(sentinel) < 0) {
+			const { promise: sentinelSeen, resolve } = require_sdk.promiseWithResolvers();
+			require_sdk.__classPrivateFieldSet(this, _BashSession_waiting, {
+				sentinel,
+				resolve
+			}, "f");
+			let timer;
+			let onAbort;
+			try {
+				await Promise.race([
+					sentinelSeen,
+					new Promise((_, reject) => {
+						timer = setTimeout(() => reject(new BashTimeoutError(timeoutMs)), timeoutMs);
+					}),
+					new Promise((_, reject) => {
+						if (!signal) return;
+						onAbort = () => reject(signal.reason);
+						signal.addEventListener("abort", onAbort, { once: true });
+					})
+				]);
+			} finally {
+				if (timer) clearTimeout(timer);
+				if (onAbort && signal) signal.removeEventListener("abort", onAbort);
+				require_sdk.__classPrivateFieldSet(this, _BashSession_waiting, null, "f");
+			}
+		}
+		const idx = require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").indexOf(sentinel);
+		if (idx < 0) {
+			throw new require_sdk.AnthropicError("bash session terminated");
+		}
+		const tail = require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").slice(idx + sentinel.length);
+		const m = tail.match(/^(-?\d+)/);
+		const exitCode = m ? parseInt(m[1], 10) : -1;
+		let out = require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").slice(0, idx).replace(ANSI_RE, "").replace(/\n+$/, "");
+		if (require_sdk.__classPrivateFieldGet(this, _BashSession_truncated, "f")) {
+			out = `[output truncated]\n${out}`;
+		}
+		return {
+			output: out,
+			exitCode
+		};
+	}
+	close() {
+		if (require_sdk.__classPrivateFieldGet(this, _BashSession_closed, "f")) return;
+		require_sdk.__classPrivateFieldSet(this, _BashSession_closed, true, "f");
+		const w = require_sdk.__classPrivateFieldGet(this, _BashSession_waiting, "f");
+		require_sdk.__classPrivateFieldSet(this, _BashSession_waiting, null, "f");
+		w?.resolve();
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stdout.destroy();
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stderr.destroy();
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").stdin.destroy();
+		try {
+			process.kill(-require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").pid, "SIGKILL");
+		} catch {
+			require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").kill("SIGKILL");
+		}
+		require_sdk.__classPrivateFieldGet(this, _BashSession_proc, "f").unref();
+	}
+};
+_BashSession_proc = new WeakMap(), _BashSession_buf = new WeakMap(), _BashSession_truncated = new WeakMap(), _BashSession_closed = new WeakMap(), _BashSession_waiting = new WeakMap(), _BashSession_instances = new WeakSet(), _BashSession_append = function _BashSession_append(d) {
+	require_sdk.__classPrivateFieldSet(this, _BashSession_buf, require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f") + d, "f");
+	if (require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").length > BASH_OUTPUT_LIMIT) {
+		require_sdk.__classPrivateFieldSet(this, _BashSession_buf, require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").slice(require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").length - BASH_OUTPUT_LIMIT), "f");
+		require_sdk.__classPrivateFieldSet(this, _BashSession_truncated, true, "f");
+	}
+	if (require_sdk.__classPrivateFieldGet(this, _BashSession_waiting, "f") && require_sdk.__classPrivateFieldGet(this, _BashSession_buf, "f").indexOf(require_sdk.__classPrivateFieldGet(this, _BashSession_waiting, "f").sentinel) >= 0) {
+		const w = require_sdk.__classPrivateFieldGet(this, _BashSession_waiting, "f");
+		require_sdk.__classPrivateFieldSet(this, _BashSession_waiting, null, "f");
+		w.resolve();
+	}
+};
+function betaBashTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	let session;
+	let tail = Promise.resolve();
+	return betaTool({
+		name: "bash",
+		description: "Run a bash command in a persistent shell. State (cwd, env vars) persists across calls.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				command: {
+					type: "string",
+					description: "The command to run"
+				},
+				restart: {
+					type: "boolean",
+					description: "Restart the persistent shell before running"
+				},
+				timeout_ms: {
+					type: "integer",
+					description: "Per-call timeout in milliseconds"
+				}
+			}
+		},
+		run: async ({ command, restart, timeout_ms }, context) => {
+			const prev = tail;
+			const gate = require_sdk.promiseWithResolvers();
+			tail = gate.promise;
+			try {
+				await prev;
+			} catch {}
+			try {
+				if (restart) {
+					session?.close();
+					session = undefined;
+				}
+				if (!command) {
+					if (restart) return "bash session restarted";
+					throw new require_sdk.ToolError("bash: command is required");
+				}
+				session ?? (session = new BashSession(ctx.workdir, ctx.env));
+				try {
+					const { output, exitCode } = await session.exec(command, {
+						timeoutMs: timeout_ms ?? BASH_DEFAULT_TIMEOUT_MS,
+						signal: context?.signal
+					});
+					if (exitCode !== 0) throw new require_sdk.ToolError(output || `exit ${exitCode}`);
+					return output;
+				} catch (e) {
+					if (e instanceof require_sdk.ToolError) throw e;
+					session.close();
+					session = undefined;
+					throw new require_sdk.ToolError(`bash: ${e instanceof Error ? e.message : String(e)}`);
+				}
+			} finally {
+				gate.resolve();
+			}
+		},
+		close: () => {
+			session?.close();
+			session = undefined;
+		}
+	});
+}
+function betaReadTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return betaTool({
+		name: "read",
+		description: "Read a UTF-8 text file relative to the workdir.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				file_path: { type: "string" },
+				view_range: {
+					type: "array",
+					items: { type: "integer" },
+					description: "[start_line, end_line] 1-indexed inclusive"
+				}
+			},
+			required: ["file_path"]
+		},
+		run: async ({ file_path, view_range }) => {
+			if (!file_path) throw new require_sdk.ToolError("read: file_path is required");
+			const abs = await resolvePath(ctx, file_path);
+			if (view_range?.length && view_range.length !== 2) {
+				throw new require_sdk.ToolError("read: view_range must be [start_line, end_line]");
+			}
+			let data;
+			try {
+				const st = await node_fs_promises.stat(abs);
+				if (!st.isFile()) {
+					throw new require_sdk.ToolError(`read: ${file_path} is not a regular file`);
+				}
+				const limit = resolveMaxBytes(ctx.maxFileBytes);
+				if (limit !== null && st.size > limit) {
+					if (!view_range?.length) {
+						throw new require_sdk.ToolError(`read: ${file_path} is ${st.size} bytes, exceeds ${limit}-byte limit. ` + "Use the view_range parameter to read specific line ranges, e.g. view_range: [1, 500].");
+					}
+					const [startLine, endLine] = view_range;
+					return await readRangeStreaming(abs, file_path, startLine, endLine, limit);
+				}
+				data = await node_fs_promises.readFile(abs, "utf8");
+			} catch (e) {
+				if (e instanceof require_sdk.ToolError) throw e;
+				throw new require_sdk.ToolError(`read: ${fsErrorMessage(e, file_path)}`);
+			}
+			if (!view_range?.length) return data;
+			const [startLine, endLine] = view_range;
+			const lines = data.split("\n");
+			const start = Math.max(0, startLine - 1);
+			const end = endLine > 0 ? endLine : lines.length;
+			return lines.slice(start, end).join("\n");
+		}
+	});
+}
+/** Returns lines `[startLine, endLine]` of the file at `abs`, capping the selected bytes at `limit`. */
+async function readRangeStreaming(abs, filePath, startLine, endLine, limit) {
+	const lines = new LineRangeCollector(filePath, startLine, endLine, limit);
+	if (lines.rangeIsEmpty()) return "";
+	const stream = node_fs.createReadStream(abs, { highWaterMark: READ_STREAM_CHUNK_BYTES });
+	try {
+		for await (const chunk of stream) {
+			lines.collectFrom(chunk);
+			if (lines.rangeIsCollected()) break;
+		}
+	} finally {
+		stream.destroy();
+	}
+	return lines.text();
+}
+/** Collects the bytes of lines `[startLine, endLine]` from consecutive file chunks, capped at `limit`. */
+var LineRangeCollector = class {
+	constructor(filePath, startLine, endLine, limit) {
+		_LineRangeCollector_instances.add(this);
+		_LineRangeCollector_filePath.set(this, void 0);
+		_LineRangeCollector_startLine.set(this, void 0);
+		_LineRangeCollector_endLine.set(this, void 0);
+		_LineRangeCollector_start.set(this, void 0);
+		_LineRangeCollector_end.set(this, void 0);
+		_LineRangeCollector_limit.set(this, void 0);
+		_LineRangeCollector_line.set(this, 0);
+		_LineRangeCollector_collected.set(this, []);
+		_LineRangeCollector_collectedBytes.set(this, 0);
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_filePath, filePath, "f");
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_startLine, startLine, "f");
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_endLine, endLine, "f");
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_start, Math.max(0, startLine - 1), "f");
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_end, endLine > 0 ? endLine : Infinity, "f");
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_limit, limit, "f");
+	}
+	rangeIsEmpty() {
+		return require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_end, "f") <= require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_start, "f");
+	}
+	rangeIsCollected() {
+		return require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_line, "f") >= require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_end, "f");
+	}
+	collectFrom(chunk) {
+		var _a;
+		let lineStart = 0;
+		while (lineStart < chunk.length && !this.rangeIsCollected()) {
+			const newline = chunk.indexOf(10, lineStart);
+			const lineEnd = newline < 0 ? chunk.length : newline;
+			if (require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_line, "f") >= require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_start, "f")) {
+				require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_instances, "m", _LineRangeCollector_collect).call(this, chunk.subarray(lineStart, lineEnd), newline >= 0);
+			}
+			if (newline < 0) break;
+			require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_line, (_a = require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_line, "f"), _a++, _a), "f");
+			lineStart = newline + 1;
+		}
+	}
+	text() {
+		return Buffer.concat(require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collected, "f"), require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collectedBytes, "f")).toString("utf8");
+	}
+};
+_LineRangeCollector_filePath = new WeakMap(), _LineRangeCollector_startLine = new WeakMap(), _LineRangeCollector_endLine = new WeakMap(), _LineRangeCollector_start = new WeakMap(), _LineRangeCollector_end = new WeakMap(), _LineRangeCollector_limit = new WeakMap(), _LineRangeCollector_line = new WeakMap(), _LineRangeCollector_collected = new WeakMap(), _LineRangeCollector_collectedBytes = new WeakMap(), _LineRangeCollector_instances = new WeakSet(), _LineRangeCollector_collect = function _LineRangeCollector_collect(lineBytes, newlineTerminated) {
+	require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collected, "f").push(lineBytes);
+	require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_collectedBytes, require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collectedBytes, "f") + lineBytes.length, "f");
+	if (newlineTerminated && require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_line, "f") + 1 < require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_end, "f")) {
+		require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collected, "f").push(NEWLINE);
+		require_sdk.__classPrivateFieldSet(this, _LineRangeCollector_collectedBytes, require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collectedBytes, "f") + NEWLINE.length, "f");
+	}
+	if (require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_collectedBytes, "f") > require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_limit, "f")) throw require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_instances, "m", _LineRangeCollector_overLimitError).call(this);
+}, _LineRangeCollector_overLimitError = function _LineRangeCollector_overLimitError() {
+	if (require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_end, "f") - require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_start, "f") === 1) {
+		return new require_sdk.ToolError(`read: line ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_start, "f") + 1} of ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_filePath, "f")} alone exceeds ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_limit, "f")}-byte limit. ` + "The read tool cannot return part of a line, so view_range cannot narrow this further.");
+	}
+	return new require_sdk.ToolError(`read: view_range [${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_startLine, "f")}, ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_endLine, "f")}] of ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_filePath, "f")} exceeds ${require_sdk.__classPrivateFieldGet(this, _LineRangeCollector_limit, "f")}-byte limit. ` + "Narrow the view_range to read a smaller portion.");
+};
+function betaWriteTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return betaTool({
+		name: "write",
+		description: "Write a UTF-8 text file relative to the workdir, creating parent directories as needed.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				file_path: { type: "string" },
+				content: { type: "string" }
+			},
+			required: ["file_path", "content"]
+		},
+		run: async ({ file_path, content }) => {
+			if (!file_path) throw new require_sdk.ToolError("write: file_path is required");
+			const abs = await resolvePath(ctx, file_path);
+			const ro = await readOnlyRootFor(ctx, abs);
+			if (ro !== undefined) {
+				throw new require_sdk.ToolError(`write: ${file_path} is inside read-only directory ${ro}`);
+			}
+			try {
+				await node_fs_promises.mkdir(node_path.dirname(abs), {
+					recursive: true,
+					mode: 448
+				});
+				await atomicWriteFile(abs, content ?? "");
+			} catch (e) {
+				throw new require_sdk.ToolError(`write: ${fsErrorMessage(e, file_path)}`);
+			}
+			return `wrote ${Buffer.byteLength(content ?? "")} bytes to ${file_path}`;
+		}
+	});
+}
+function betaEditTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return betaTool({
+		name: "edit",
+		description: "Replace old_string with new_string in a file. old_string must be unique unless replace_all.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				file_path: { type: "string" },
+				old_string: { type: "string" },
+				new_string: { type: "string" },
+				replace_all: { type: "boolean" }
+			},
+			required: [
+				"file_path",
+				"old_string",
+				"new_string"
+			]
+		},
+		run: async ({ file_path, old_string, new_string, replace_all }) => {
+			if (!file_path) throw new require_sdk.ToolError("edit: file_path is required");
+			if (!old_string) throw new require_sdk.ToolError("edit: old_string is required");
+			const abs = await resolvePath(ctx, file_path);
+			const ro = await readOnlyRootFor(ctx, abs);
+			if (ro !== undefined) {
+				throw new require_sdk.ToolError(`edit: ${file_path} is inside read-only directory ${ro}`);
+			}
+			let data;
+			try {
+				const st = await node_fs_promises.stat(abs);
+				if (!st.isFile()) {
+					throw new require_sdk.ToolError(`edit: ${file_path} is not a regular file`);
+				}
+				const limit = resolveMaxBytes(ctx.maxFileBytes);
+				if (limit !== null && st.size > limit) {
+					throw new require_sdk.ToolError(`edit: ${file_path} is ${st.size} bytes, exceeds ${limit}-byte limit. ` + "The edit tool loads the whole file and cannot modify a file this large.");
+				}
+				data = await node_fs_promises.readFile(abs, "utf8");
+			} catch (e) {
+				if (e instanceof require_sdk.ToolError) throw e;
+				throw new require_sdk.ToolError(`edit: ${fsErrorMessage(e, file_path)}`);
+			}
+			const count = data.split(old_string).length - 1;
+			if (count === 0) throw new require_sdk.ToolError(`edit: old_string not found in ${file_path}`);
+			let updated;
+			if (replace_all) {
+				updated = data.split(old_string).join(new_string);
+			} else {
+				if (count > 1) throw new require_sdk.ToolError(`edit: old_string appears ${count} times in ${file_path} (must be unique)`);
+				updated = data.replace(old_string, () => new_string);
+			}
+			try {
+				await atomicWriteFile(abs, updated);
+			} catch (e) {
+				throw new require_sdk.ToolError(`edit: write: ${fsErrorMessage(e, file_path)}`);
+			}
+			return `edited ${file_path} (${replace_all ? count : 1} replacement(s))`;
+		}
+	});
+}
+/**
+* Best-effort: stops `fs.glob` from walking out of the root via a literal or
+* brace-expanded `..`. The realpath post-filter in {@link betaGlobTool} is the
+* boundary; this only avoids the walk.
+*/
+function patternCanAscend(pattern) {
+	return pattern.split(/[\\/{},]/).includes("..");
+}
+function betaGlobTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return betaTool({
+		name: "glob",
+		description: "Match files under the workdir against a glob pattern. Results are mtime-sorted, newest first.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				pattern: { type: "string" },
+				path: {
+					type: "string",
+					description: "Directory to search in. Defaults to the workdir."
+				}
+			},
+			required: ["pattern"]
+		},
+		run: async ({ pattern, path: searchPath }) => {
+			if (!pattern) throw new require_sdk.ToolError("glob: pattern is required");
+			if (node_path.isAbsolute(pattern)) {
+				throw new require_sdk.ToolError("glob: absolute pattern not permitted; pass a relative pattern (and optionally path)");
+			}
+			if (patternCanAscend(pattern)) {
+				throw new require_sdk.ToolError("glob: \"..\" is not permitted in the pattern");
+			}
+			const root = searchPath ? await resolvePath(ctx, searchPath) : node_path.resolve(ctx.workdir);
+			const realRoot = searchPath ? root : await canonicalize(root);
+			const matches = [];
+			let remaining = WALK_MAX_ENTRIES;
+			try {
+				for await (const entry of fsGlob(pattern, {
+					cwd: root,
+					withFileTypes: true,
+					exclude: (d) => d.name === ".git" || d.name === "node_modules"
+				})) {
+					if (remaining-- <= 0) break;
+					if (!entry.isFile()) continue;
+					const full = node_path.join(entry.parentPath, entry.name);
+					let real;
+					try {
+						real = await node_fs_promises.realpath(full);
+					} catch {
+						continue;
+					}
+					if (!isWithin(realRoot, real)) continue;
+					let mtime = 0;
+					try {
+						mtime = (await node_fs_promises.stat(full)).mtimeMs;
+					} catch {}
+					matches.push({
+						path: full,
+						mtime
+					});
+				}
+			} catch (e) {
+				throw new require_sdk.ToolError(`glob: ${e instanceof Error ? e.message : String(e)}`);
+			}
+			if (matches.length === 0) return "no matches";
+			matches.sort((a, b) => b.mtime - a.mtime);
+			return matches.slice(0, GLOB_RESULT_LIMIT).map((m) => m.path).join("\n");
+		}
+	});
+}
+function betaGrepTool(ctx) {
+	rejectUnrestrictedPaths(ctx.unrestrictedPaths);
+	return betaTool({
+		name: "grep",
+		description: "Search file contents for a regex. Uses ripgrep if available, otherwise a built-in walker.",
+		inputSchema: {
+			type: "object",
+			properties: {
+				pattern: { type: "string" },
+				path: { type: "string" }
+			},
+			required: ["pattern"]
+		},
+		run: async ({ pattern, path: p }, context) => {
+			if (!pattern) throw new require_sdk.ToolError("grep: pattern is required");
+			let searchPath = node_path.resolve(ctx.workdir);
+			if (p) searchPath = await resolvePath(ctx, p);
+			const rg = await findRg();
+			return rg ? runRipgrep(rg, pattern, searchPath, context?.signal) : runWalkGrep(pattern, searchPath, context?.signal);
+		}
+	});
+}
+function runRipgrep(rg, pattern, searchPath, signal) {
+	return new Promise((resolve, reject) => {
+		const proc = node_child_process.spawn(rg, [
+			"-n",
+			"--no-heading",
+			"-e",
+			pattern,
+			"--",
+			searchPath
+		], { ...signal ? { signal } : {} });
+		let out = "";
+		let errOut = "";
+		let truncated = false;
+		proc.stdout.on("data", (d) => {
+			if (truncated) return;
+			out += d;
+			if (out.length > GREP_OUTPUT_LIMIT) {
+				truncated = true;
+				out = out.slice(0, GREP_OUTPUT_LIMIT);
+				proc.kill("SIGKILL");
+			}
+		});
+		proc.stderr.on("data", (d) => errOut += d);
+		proc.on("close", (code) => {
+			if (signal?.aborted) return reject(new require_sdk.ToolError("grep: aborted"));
+			if (truncated) return resolve(out + `\n[output truncated at ${GREP_OUTPUT_LIMIT} bytes]`);
+			if (code === 0) return resolve(out);
+			if (code === 1) return resolve("no matches");
+			reject(new require_sdk.ToolError(`grep: rg failed: ${errOut || `exit ${code}`}`));
+		});
+		proc.on("error", (e) => {
+			if (signal?.aborted) return reject(new require_sdk.ToolError("grep: aborted"));
+			reject(new require_sdk.ToolError(`grep: rg failed: ${e.message}`));
+		});
+	});
+}
+async function runWalkGrep(pattern, root, signal) {
+	let re;
+	try {
+		re = new RegExp(pattern);
+	} catch (e) {
+		throw new require_sdk.ToolError(`grep: invalid regex: ${e instanceof Error ? e.message : String(e)}`);
+	}
+	const hits = [];
+	let budget = GREP_OUTPUT_LIMIT;
+	const push = (line) => {
+		budget -= line.length + 1;
+		if (budget < 0) {
+			hits.push(`[output truncated at ${GREP_OUTPUT_LIMIT} bytes]`);
+			return false;
+		}
+		hits.push(line);
+		return true;
+	};
+	const stat = await node_fs_promises.stat(root).catch(() => null);
+	if (stat?.isFile()) {
+		await grepFile(root, re, push);
+	} else {
+		await walk(root, "", (rel) => grepFile(node_path.join(root, rel), re, push), signal);
+	}
+	if (signal?.aborted) throw new require_sdk.ToolError("grep: aborted");
+	if (hits.length === 0) return "no matches";
+	return hits.join("\n");
+}
+async function grepFile(file, re, push) {
+	const stream = node_fs.createReadStream(file, { encoding: "utf8" });
+	const rl = node_readline.createInterface({
+		input: stream,
+		crlfDelay: Infinity
+	});
+	let i = 0;
+	try {
+		for await (const line of rl) {
+			i++;
+			if (line.length > GREP_MAX_LINE_LENGTH) continue;
+			if (re.test(line) && !push(`${file}:${i}:${line}`)) return false;
+		}
+	} catch {} finally {
+		stream.destroy();
+	}
+	return true;
+}
+const WALK_MAX_DEPTH = 40;
+const WALK_MAX_ENTRIES = 5e4;
+/**
+* Bounded recursive walk. `fn` may return `false` to abort. Only real
+* directories are descended into and only real files are handed to `fn` —
+* symlinks (and devices/fifos/sockets) are skipped entirely so a symlink inside
+* the root cannot be followed out of it.
+*/
+async function walk(root, rel, fn, signal) {
+	let remaining = WALK_MAX_ENTRIES;
+	async function inner(rel, depth) {
+		if (depth > WALK_MAX_DEPTH) return true;
+		if (signal?.aborted) return false;
+		let entries;
+		try {
+			entries = await node_fs_promises.readdir(node_path.join(root, rel), { withFileTypes: true });
+		} catch {
+			return true;
+		}
+		for (const e of entries) {
+			if (e.name === ".git" || e.name === "node_modules") continue;
+			if (remaining-- <= 0) return false;
+			if (signal?.aborted) return false;
+			const childRel = rel ? node_path.join(rel, e.name) : e.name;
+			if (e.isDirectory()) {
+				if (!await inner(childRel, depth + 1)) return false;
+			} else if (e.isFile()) {
+				if (await fn(childRel) === false) return false;
+			}
+		}
+		return true;
+	}
+	await inner(rel, 0);
+}
+async function findRg() {
+	const dirs = (process.env["PATH"] ?? "").split(node_path.delimiter);
+	for (const d of dirs) {
+		const candidate = node_path.join(d, "rg");
+		try {
+			await node_fs_promises.access(candidate, node_fs.constants.X_OK);
+			return candidate;
+		} catch {}
+	}
+	return null;
+}
+
+//#endregion
+exports.MEMORY_FLUSH_TIMEOUT_MS = MEMORY_FLUSH_TIMEOUT_MS;
+exports.SessionMemoryError = SessionMemoryError;
+exports.SessionMemoryStores = SessionMemoryStores;
+exports.betaAgentToolset20260401 = betaAgentToolset20260401;
+exports.setupSkills = setupSkills;