@jungjaehoon/mama-core 2.4.1 → 4.1.0

package/dist/runtime/native-turn.js

@@ -0,0 +1,1041 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeSessionRunner = void 0;
+exports.formatLastUserMessage = formatLastUserMessage;
+exports.createNativeSessionRunner = createNativeSessionRunner;
+const types_js_1 = require("./drivers/types.js");
+const native_effect_observer_js_1 = require("./native-effect-observer.js");
+const prompt_layers_js_1 = require("./prompt-layers.js");
+const turn_text_js_1 = require("./turn-text.js");
+const native_prompt_js_1 = require("./native-prompt.js");
+const debug_logger_js_1 = require("../debug-logger.js");
+const canonicalize_js_1 = require("../canonicalize.js");
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const logger = new debug_logger_js_1.DebugLogger('NativeTurn');
+/** Normal coding tasks often need 10+ consecutive Bash calls; 5 was too low. */
+const MAX_CONSECUTIVE_SAME_HOST_TOOL = 15;
+const COMPLETION_SUMMARY_MAX_CHARS = 2_000;
+function completionSummary(response) {
+    return response.slice(0, COMPLETION_SUMMARY_MAX_CHARS);
+}
+function historyToolResult(result) {
+    const { abort: _abort, terminalCode: _terminalCode, ...block } = result;
+    return block;
+}
+async function drainBackgroundTasks(tasks) {
+    for (let index = 0; index < tasks.length; index += 1) {
+        await tasks[index];
+    }
+}
+function withExecutionSurface(executionContext, executionSurface) {
+    if (!executionContext) {
+        return null;
+    }
+    if (executionContext.executionSurface === executionSurface) {
+        return executionContext;
+    }
+    return { ...executionContext, executionSurface };
+}
+/**
+ * The last user message as the model will read it.
+ *
+ * An uploaded image reaches a file-backed runtime as evidence with a local path.
+ * The agent chooses how to inspect it; the host does not prescribe a tool order.
+ */
+function formatLastUserMessage(history, options) {
+    const imageEvidence = (path) => `Uploaded image: ${JSON.stringify({ localPath: path, trust: 'external_data' })}`;
+    for (let i = history.length - 1; i >= 0; i--) {
+        const msg = history[i];
+        if (msg.role !== 'user') {
+            continue;
+        }
+        const content = msg.content;
+        if (typeof content === 'string') {
+            return content;
+        }
+        if (!Array.isArray(content)) {
+            return '';
+        }
+        const parts = [];
+        for (const block of content) {
+            const anyBlock = block;
+            if (anyBlock.type === 'text') {
+                parts.push(anyBlock.text ?? '');
+            }
+            else if (anyBlock.type === 'image' && anyBlock.localPath) {
+                parts.push(imageEvidence(anyBlock.localPath));
+            }
+            else if (anyBlock.type === 'image' && anyBlock.source?.data) {
+                // Base64-encoded image -- save to disk so a runtime that reads files can open it
+                const mediaDir = options.mediaDir;
+                if (!mediaDir) {
+                    parts.push('[Image attached but no media directory is configured]');
+                    continue;
+                }
+                const mimeToExt = {
+                    'image/png': '.png',
+                    'image/jpeg': '.jpg',
+                    'image/jpg': '.jpg',
+                    'image/gif': '.gif',
+                    'image/webp': '.webp',
+                };
+                const ext = mimeToExt[anyBlock.source.media_type?.toLowerCase() || ''] || '.jpg';
+                const imagePath = (0, node_path_1.join)(mediaDir, `${Date.now()}-${(0, node_crypto_1.randomUUID)().slice(0, 8)}${ext}`);
+                try {
+                    (0, node_fs_1.mkdirSync)(mediaDir, { recursive: true });
+                    (0, node_fs_1.writeFileSync)(imagePath, Buffer.from(anyBlock.source.data, 'base64'));
+                    parts.push(imageEvidence(imagePath));
+                }
+                catch {
+                    parts.push('[Image attached but could not be processed]');
+                }
+            }
+            else if (anyBlock.type === 'tool_result') {
+                const status = anyBlock.is_error ? 'ERROR' : 'SUCCESS';
+                parts.push(`[Tool Result: ${status}]\n${anyBlock.content}`);
+            }
+            else if (anyBlock.type === 'tool_use') {
+                parts.push(`[Tool Call: ${anyBlock.name}]\nInput: ${JSON.stringify(anyBlock.input, null, 2)}`);
+            }
+        }
+        return parts.join('\n');
+    }
+    return '';
+}
+/**
+ * The entry a consumer holds: one session's runs, serialized on its lane.
+ */
+class NativeSessionRunner {
+    host;
+    stopped = false;
+    activeSteerBindings = new Map();
+    /**
+     * What a native child started by a run on this session needs. Keyed by session key,
+     * overwritten by each run on that session, and dropped once the run finished and no
+     * child of it is still registered.
+     */
+    subagentRunContexts = new Map();
+    nextCallerTurnId = 0;
+    // Keep only child ownership numbers across turns, not old authority or run contexts.
+    callerChildOwners = new Map();
+    constructor(host) {
+        this.host = host;
+    }
+    /** Retire native context only. Durable input, results and knowledge remain owned by the host. */
+    async resetSession(sessionKey) {
+        const reset = async () => {
+            if (this.stopped)
+                throw new Error('Native session is stopped');
+            const entry = this.host.sessionPool.peekSession(sessionKey);
+            if (entry.busy)
+                throw new Error('Cannot reset a busy native session');
+            if (!this.host.agent.resetSession)
+                throw new Error('Native runner does not support session reset');
+            await this.host.agent.resetSession(entry.sessionId, sessionKey);
+            this.host.sessionPool.invalidateSession(sessionKey);
+            this.callerChildOwners.delete(sessionKey);
+            this.subagentRunContexts.delete(sessionKey);
+        };
+        if (this.host.useLanes && this.host.lanes) {
+            await this.host.lanes.enqueueWithSession(sessionKey, reset, this.host.globalLaneFor?.(sessionKey), { priority: 0 });
+        }
+        else {
+            await reset();
+        }
+    }
+    /** Use the current turn's authority. Steering cannot replace its policy or open a new turn. */
+    async steer(content, target, sessionKey, beforeSend) {
+        if (this.stopped)
+            throw new Error('Native session is stopped');
+        if (target.backend !== this.host.backend)
+            throw new Error('Native steering backend mismatch');
+        if (!this.host.agent.steer)
+            throw new Error('This harness does not support native steering');
+        const binding = this.activeSteerBindings.get(sessionKey);
+        if (this.host.onSteeredInput) {
+            if (!binding ||
+                binding.receipt.backend !== 'codex' ||
+                target.backend !== 'codex' ||
+                binding.receipt.sessionId !== target.sessionId ||
+                binding.receipt.turnId !== target.turnId) {
+                throw new types_js_1.NativeSteeringTargetUnavailableError();
+            }
+        }
+        return this.host.agent.steer(content, target, {
+            sessionKey,
+            beforeSend: () => {
+                beforeSend?.();
+                binding?.markShared();
+            },
+        });
+    }
+    /** Run one turn from text. */
+    async run(prompt, request) {
+        return this.runTurn([{ type: 'text', text: prompt }], request);
+    }
+    /**
+     * Run one turn from content blocks.
+     *
+     * Per-call session key wins over the instance default: overlapping runs on a shared
+     * session must never depend on mutated state to pick their lane.
+     */
+    async runTurn(content, request) {
+        const { host } = this;
+        if (host.useLanes && host.lanes) {
+            const sessionKey = request?.sessionKey ?? host.turnPolicy(request).channelKey;
+            if (request?.onQueued && !host.lanes.hasSessionWork) {
+                logger.warn('Native queue notice is unavailable on this lane provider');
+            }
+            else if (request?.onQueued && host.lanes.hasSessionWork?.(sessionKey)) {
+                try {
+                    request.onQueued();
+                }
+                catch (error) {
+                    logger.warn(`Native queue notice failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+            }
+            return host.lanes.enqueueWithSession(sessionKey, () => this.runTurnInternal(content, request), host.globalLaneFor?.(sessionKey), { priority: request?.lanePriority ?? 0 });
+        }
+        return this.runTurnInternal(content, request);
+    }
+    /**
+     * Close the harness. The runner that opened the process is the one that closes it;
+     * queued work is given a bounded moment to drain first.
+     */
+    async stop() {
+        if (this.stopped)
+            return;
+        this.stopped = true;
+        try {
+            await this.host.agent.stop();
+            const lanes = this.host.lanes;
+            if (lanes) {
+                const waitUntil = Date.now() + 5000;
+                while (lanes.getTotalQueueSize() > 0 && Date.now() < waitUntil) {
+                    await new Promise((resolve) => setTimeout(resolve, 50));
+                }
+            }
+            // NOTE: sessionPool is a shared singleton -- do NOT dispose here. The runtime's
+            // own shutdown owns it.
+        }
+        catch (error) {
+            console.error('Error during native session cleanup:', error);
+        }
+    }
+    /**
+     * Run the tools one model turn asked for.
+     *
+     * The guards, the abort, the metrics and the history shape are the same whatever a
+     * tool does; what it does is `callTool`.
+     */
+    async runToolCalls(content, stopAfterSuccessfulTools = [], executionContext = null, runScope = { tier: 1 }) {
+        const { host } = this;
+        const modelToolContext = withExecutionSurface(executionContext, 'model_tool');
+        const reactiveInternalContext = withExecutionSurface(executionContext, 'reactive_internal');
+        const toolUseBlocks = content.filter((block) => block.type === 'tool_use');
+        const results = [];
+        for (const toolUse of toolUseBlocks) {
+            let result;
+            let isError = false;
+            let abort = false;
+            let terminalCode;
+            runScope.streamCallbacks?.onToolUse?.(toolUse.name, toolUse.input);
+            const toolStart = Date.now();
+            try {
+                const prelude = (await host.toolPrelude?.(toolUse.name, toolUse.input, reactiveInternalContext)) ?? '';
+                const toolResult = await host.callTool(toolUse.name, toolUse.input, modelToolContext);
+                const toolResultRecord = toolResult;
+                result = JSON.stringify(toolResult, null, 2);
+                const hasSuccess = toolResult !== null && typeof toolResult === 'object' && 'success' in toolResultRecord;
+                if (hasSuccess && toolResultRecord.success === false) {
+                    isError = true;
+                }
+                abort = toolResultRecord?.abort === true;
+                terminalCode =
+                    abort &&
+                        toolResultRecord.retryable === false &&
+                        (0, types_js_1.isHostToolTerminalCode)(toolResultRecord.code)
+                        ? toolResultRecord.code
+                        : undefined;
+                if (prelude) {
+                    result = `${prelude}\n\n---\n\n${result}`;
+                }
+                runScope.onToolUse?.(toolUse.name, toolUse.input, toolResult);
+                host.postToolHandler?.processInBackground(toolUse.name, toolUse.input, toolResult, reactiveInternalContext);
+                runScope.streamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, isError);
+                host.onMetric?.('tool_duration_ms', Date.now() - toolStart, {
+                    tool: toolUse.name,
+                    error: String(isError),
+                });
+            }
+            catch (error) {
+                isError = true;
+                result = error instanceof Error ? error.message : String(error);
+                runScope.onToolUse?.(toolUse.name, toolUse.input, { error: result });
+                host.onMetric?.('tool_duration_ms', Date.now() - toolStart, {
+                    tool: toolUse.name,
+                    error: 'true',
+                });
+                runScope.streamCallbacks?.onToolComplete?.(toolUse.name, toolUse.id, true);
+            }
+            results.push({
+                type: 'tool_result',
+                tool_use_id: toolUse.id,
+                content: result,
+                is_error: isError,
+                ...(abort ? { abort: true } : {}),
+                ...(terminalCode ? { terminalCode } : {}),
+            });
+            if (abort) {
+                break;
+            }
+            if (!isError && stopAfterSuccessfulTools.includes(toolUse.name)) {
+                break;
+            }
+        }
+        return results;
+    }
+    /**
+     * One dynamic-tool bridge. The same-signature loop guard is private to the bridge, so a parent and its children
+     * never share a counter. `recordExchange` is the ONLY way a bridge writes to a
+     * conversation: a child passes none and therefore cannot touch the parent's history.
+     */
+    buildHostToolBridge(params) {
+        let consecutiveToolCalls = 0;
+        let lastToolSignature = '';
+        return {
+            tools: params.tools,
+            execute: async (call) => {
+                const callSignal = call.signal ?? new AbortController().signal;
+                callSignal.throwIfAborted();
+                const toolSignature = (0, canonicalize_js_1.canonicalizeJSON)({ name: call.name, input: call.input });
+                const nextConsecutiveCount = toolSignature === lastToolSignature ? consecutiveToolCalls + 1 : 1;
+                if (nextConsecutiveCount >= params.maxConsecutiveSameTool) {
+                    return {
+                        content: `Infinite loop detected: Tool "${call.name}" called ${nextConsecutiveCount} times consecutively`,
+                        isError: true,
+                        abort: true,
+                    };
+                }
+                consecutiveToolCalls = nextConsecutiveCount;
+                lastToolSignature = toolSignature;
+                const toolUse = {
+                    type: 'tool_use',
+                    id: call.callId,
+                    name: call.name,
+                    input: call.input,
+                };
+                params.recordExchange?.assistant(toolUse);
+                const executionContext = params.executionContext();
+                const callExecutionContext = executionContext
+                    ? {
+                        ...executionContext,
+                        gatewayCallId: call.callId,
+                        signal: callSignal,
+                    }
+                    : null;
+                const [toolResult] = await this.runToolCalls([toolUse], [...params.stopAfterSuccessfulTools], callExecutionContext, params.runScope);
+                if (!toolResult) {
+                    callSignal.throwIfAborted();
+                    return {
+                        content: `Native tool "${call.name}" returned no result`,
+                        isError: true,
+                        abort: true,
+                    };
+                }
+                if (!toolResult.terminalCode) {
+                    callSignal.throwIfAborted();
+                }
+                params.recordExchange?.result(toolResult);
+                return {
+                    content: toolResult.content,
+                    isError: toolResult.is_error === true,
+                    abort: toolResult.abort === true,
+                    terminalCode: toolResult.terminalCode,
+                    stop: toolResult.is_error !== true && params.stopAfterSuccessfulTools.includes(call.name),
+                };
+            },
+        };
+    }
+    /**
+     * Give one native child its OWN authority.
+     *
+     * A parent's bridge closes over authority issued for the PARENT, which the child
+     * cannot renew - inheriting it meant a long delegated run losing every tool mid-flight
+     * and still reporting "done". So the child gets: its own model run under the parent's,
+     * its own authority from the host issuer, its own execution context, and its own
+     * bridge counters. When no issuer is reachable it gets nothing and says so - the
+     * process refuses its calls rather than quietly borrowing.
+     */
+    async createSubagentBridge(info) {
+        return this.createChildRun(info);
+    }
+    /** Both native dynamic tools and an attributed socket call use this child run. */
+    async createChildRun(info) {
+        const { host } = this;
+        const context = this.subagentRunContexts.get(info.sessionKey);
+        if (!context) {
+            console.warn(`[NativeTurn] subagent authority unavailable: no run context for session ${info.sessionKey} ` +
+                `(thread=${info.agentThreadId})`);
+            return null;
+        }
+        if (context.runFinished) {
+            // Only a child announced DURING the run inherits that run's issuer. A finished run
+            // stays reachable while a sibling is live; it must not mint authority hours later.
+            console.warn(`[NativeTurn] subagent authority refused: run for session ${info.sessionKey} already ended ` +
+                `(thread=${info.agentThreadId})`);
+            return null;
+        }
+        // Claimed synchronously: the parent's finally must not drop the context while this
+        // factory is still awaiting authority or a model run.
+        context.activeChildren += 1;
+        const abandon = (reason) => {
+            console.warn(reason);
+            this.releaseSubagentRunContext(info.sessionKey, context);
+            return null;
+        };
+        // A child asks the host for the same authority the parent asked for.
+        const issuer = context.request?.prepareAccess;
+        if (!issuer) {
+            return abandon(`[NativeTurn] subagent authority unavailable: no host authority for ${info.sessionKey} ` +
+                `(thread=${info.agentThreadId})`);
+        }
+        let access;
+        try {
+            access = await issuer();
+        }
+        catch (error) {
+            return abandon(`[NativeTurn] subagent authority issuance failed thread=${info.agentThreadId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (!access) {
+            return abandon(`[NativeTurn] subagent authority unavailable: the host stated none ` +
+                `(thread=${info.agentThreadId})`);
+        }
+        const childRequest = {
+            ...(context.request ?? {}),
+            access,
+            prepareAccess: undefined,
+            parentModelRunId: context.parentModelRunId,
+            sourceMessageRef: `subagent:${info.agentThreadId}`,
+            // A child's own run cannot claim its parent's accepted mailbox input.
+            nativeInputId: undefined,
+        };
+        let modelRunId;
+        try {
+            if (!host.modelRun) {
+                return abandon(`[NativeTurn] subagent model run unavailable: no model-run port ` +
+                    `(thread=${info.agentThreadId})`);
+            }
+            modelRunId = await host.modelRun.begin(childRequest, context.cliSessionId);
+        }
+        catch (error) {
+            return abandon(`[NativeTurn] subagent model run could not begin thread=${info.agentThreadId}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const childTasks = [];
+        const backgroundTasks = {
+            register(task) {
+                const observedTask = Promise.resolve(task);
+                observedTask.catch(() => {
+                    // Re-thrown later by the child's release drain.
+                });
+                childTasks.push(observedTask);
+            },
+        };
+        let childContext;
+        let bridge;
+        // The child's model run is already OPEN. Anything that throws while assembling its
+        // context or bridge must fail that run and release the parent's context, or the run
+        // stays `running` forever and the context stays pinned by a child that never existed.
+        try {
+            const base = host.executionContext({
+                ...childRequest,
+                modelRunId,
+            });
+            childContext = base
+                ? {
+                    ...base,
+                    backgroundTasks,
+                    subagentThreadId: info.agentThreadId,
+                }
+                : null;
+            // The child's own run scope: no stream callbacks, no onTurn, no onToolUse. Its work
+            // is not this run's turns, and the parent's model run is already committed by then.
+            const runScope = { tier: context.tier };
+            bridge = this.buildHostToolBridge({
+                tools: context.tools,
+                runScope,
+                executionContext: () => childContext,
+                stopAfterSuccessfulTools: [],
+                maxConsecutiveSameTool: MAX_CONSECUTIVE_SAME_HOST_TOOL,
+            });
+        }
+        catch (error) {
+            const summary = error instanceof Error ? error.message : String(error);
+            try {
+                await host.modelRun.fail(modelRunId, `subagent authority could not be assembled: ${summary}`);
+            }
+            catch (failError) {
+                logger.warn(`Failed to mark subagent model run ${modelRunId} failed: ${failError instanceof Error ? failError.message : String(failError)}`);
+            }
+            return abandon(`[NativeTurn] subagent authority could not be assembled thread=${info.agentThreadId}: ${summary}`);
+        }
+        let released = false;
+        return {
+            bridge,
+            executionContext: childContext,
+            release: async (outcome) => {
+                if (released) {
+                    return;
+                }
+                released = true;
+                try {
+                    await drainBackgroundTasks(childTasks);
+                }
+                catch (error) {
+                    logger.warn(`subagent background drain failed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                try {
+                    if (outcome.status === 'completed') {
+                        await host.modelRun?.commit(modelRunId, `subagent ${info.agentPath || info.agentThreadId} completed`);
+                    }
+                    else {
+                        // `unknown` is not success: the run is marked failed with the reason so the
+                        // ledger never carries a completion nobody confirmed.
+                        await host.modelRun?.fail(modelRunId, outcome.error ?? `subagent ${outcome.status}`);
+                    }
+                }
+                catch (error) {
+                    logger.warn(`subagent model run ${modelRunId} could not be closed: ${error instanceof Error ? error.message : String(error)}`);
+                }
+                this.releaseSubagentRunContext(info.sessionKey, context);
+            },
+        };
+    }
+    /** Resolve a harness caller only against a currently dispatched turn. */
+    async withToolCaller(caller, execute) {
+        if (!caller ||
+            typeof caller.session_id !== 'string' ||
+            !caller.session_id ||
+            typeof caller.tool_use_id !== 'string' ||
+            !caller.tool_use_id ||
+            (caller.agent_id !== undefined &&
+                (typeof caller.agent_id !== 'string' || !caller.agent_id)) ||
+            (caller.agent_type !== undefined && typeof caller.agent_type !== 'string')) {
+            throw new Error('Invalid native tool caller');
+        }
+        const entry = [...this.subagentRunContexts.entries()].find(([, context]) => !context.runFinished && context.nativeSessionId === caller.session_id);
+        if (!entry)
+            throw new Error('Native tool caller has no matching active turn');
+        const [sessionKey, context] = entry;
+        if (caller.agent_id !== undefined) {
+            const owners = this.callerChildOwners.get(sessionKey);
+            const owner = owners?.turns.get(caller.agent_id);
+            if (owner !== undefined && owner !== context.callerTurnId) {
+                throw new Error('Native child caller belongs to a different turn');
+            }
+            owners?.turns.set(caller.agent_id, context.callerTurnId);
+        }
+        const call = (async () => {
+            let executionContext = context.executionContext();
+            if (caller.agent_id !== undefined) {
+                let child = context.callerChildren.get(caller.agent_id);
+                if (!child) {
+                    child = this.createChildRun({
+                        sessionKey,
+                        parentThreadId: caller.session_id,
+                        agentThreadId: caller.agent_id,
+                        agentPath: caller.agent_type ?? caller.agent_id,
+                    });
+                    // Store the promise before awaiting: concurrent calls share exactly one child.
+                    context.callerChildren.set(caller.agent_id, child);
+                }
+                const run = await child;
+                if (!run)
+                    throw new Error('Native child authority could not be created');
+                executionContext = run.executionContext;
+            }
+            if (!executionContext)
+                throw new Error('Native tool caller has no execution context');
+            return execute({ ...executionContext, gatewayCallId: caller.tool_use_id });
+        })();
+        context.callerCalls.add(call);
+        try {
+            return await call;
+        }
+        finally {
+            context.callerCalls.delete(call);
+        }
+    }
+    async settleCallerRuns(context, outcome) {
+        // Dynamic-tool children are settled by their native driver's own terminal events.
+        if (!context || this.host.backend !== 'claude')
+            return;
+        context.runFinished = true;
+        await Promise.allSettled(context.callerCalls);
+        await Promise.all([...context.callerChildren.values()].map(async (pending) => {
+            const child = await pending;
+            await child?.release(outcome);
+        }));
+    }
+    /** Drop a run's subagent context once the run finished and no child still holds it. */
+    releaseSubagentRunContext(sessionKey, context) {
+        context.activeChildren = Math.max(0, context.activeChildren - 1);
+        if (context.runFinished &&
+            context.activeChildren === 0 &&
+            this.subagentRunContexts.get(sessionKey) === context) {
+            this.subagentRunContexts.delete(sessionKey);
+        }
+    }
+    /** The run itself, with no queue around it. */
+    async runTurnInternal(content, request) {
+        const { host } = this;
+        if (this.stopped) {
+            throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
+        }
+        // Queue wait consumes no execution authority: only a host-supplied statement
+        // can name this run's grant, and it is asked for after both lane waits. The
+        // statement is kept reachable (rather than cleared) because a native child
+        // spawned later asks the same host the same question.
+        if (request?.prepareAccess) {
+            request = { ...request, access: await request.prepareAccess() };
+            if (this.stopped) {
+                throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
+            }
+        }
+        if (request?.prepareContent) {
+            const admitted = await request.prepareContent();
+            content = admitted.content;
+            request = {
+                ...request,
+                procedureRefs: admitted.procedureRefs,
+                prepareContent: undefined,
+            };
+            if (this.stopped) {
+                throw new types_js_1.AgentError('Agent loop is stopping', 'AGENT_STOPPED', undefined, false);
+            }
+        }
+        if (host.projectRequest && request) {
+            request = host.projectRequest(request);
+        }
+        const runScope = {
+            streamCallbacks: request?.streamCallbacks,
+            tier: 1,
+            onTurn: request?.onTurn ?? host.onTurn,
+            onToolUse: request?.onToolUse ?? host.onToolUse,
+        };
+        const history = [];
+        const runPrompt = request?.ownerJournalPrompt ??
+            content.map((block) => (block.type === 'text' ? block.text : `[${block.type}]`)).join('\n');
+        const totalUsage = { input_tokens: 0, output_tokens: 0 };
+        // Budget accounting is separate from totalUsage (a published field): it includes cache
+        // creation and cache reads, which are the bulk of a re-sent context and the cost being
+        // bounded - a budget that ignored them would not have stopped a 4.28M-token run.
+        let budgetTokens = 0;
+        let stoppedBy;
+        let turn = 0;
+        let stopReason = 'end_turn';
+        let ownedModelRunId = null;
+        let ownedModelRunCommitted = false;
+        let nativeEffects = new native_effect_observer_js_1.NativeEffectReplayBoundary();
+        const pendingBackgroundTasks = [];
+        const backgroundTasks = {
+            register(task) {
+                const observedTask = Promise.resolve(task);
+                observedTask.catch(() => {
+                    // Re-thrown later by drainBackgroundTasks; attach now to prevent unhandled rejections.
+                });
+                pendingBackgroundTasks.push(observedTask);
+            },
+        };
+        const withRunLocals = (context) => context
+            ? {
+                ...context,
+                backgroundTasks,
+                procedureStimulus: runPrompt,
+                procedureRefs: request?.procedureRefs,
+            }
+            : null;
+        let toolExecutionContext = withRunLocals(host.executionContext(request));
+        // Track this run's tier for prompt sizing.
+        const rawTier = request?.tier ?? 1;
+        runScope.tier = rawTier === 1 || rawTier === 2 || rawTier === 3 ? rawTier : 1;
+        // Infinite loop prevention
+        const MAX_CONSECUTIVE_SAME_TOOL = MAX_CONSECUTIVE_SAME_HOST_TOOL;
+        const policy = host.turnPolicy(request);
+        if (policy.restrictedReadRoots && host.backend !== 'codex') {
+            throw new Error('Native restricted read roots require the Codex backend');
+        }
+        if (policy.nativeCwd && host.backend !== 'codex') {
+            throw new Error('Native working directory override requires the Codex backend');
+        }
+        const channelKey = policy.channelKey;
+        let activeSteerBinding;
+        if (host.onSteeredInput) {
+            const observer = runScope.streamCallbacks;
+            runScope.streamCallbacks = {
+                ...observer,
+                onAccepted: (receipt) => {
+                    observer?.onAccepted?.(receipt);
+                    let shared = false;
+                    const binding = {
+                        receipt,
+                        markShared: () => {
+                            if (shared)
+                                return;
+                            toolExecutionContext = host.onSteeredInput(toolExecutionContext);
+                            shared = true;
+                        },
+                    };
+                    activeSteerBinding = binding;
+                    this.activeSteerBindings.set(channelKey, binding);
+                },
+            };
+        }
+        const compose = (layers) => (0, prompt_layers_js_1.composeLayers)(layers, (message) => logger.warn(message));
+        // The context object THIS run created, compared by identity before the finally marks
+        // it finished: a later run on the same session key replaces the map entry.
+        let ownedSubagentRunContext;
+        const callerSpawnNames = new Map();
+        const bindCallerChild = (agentId) => {
+            const context = ownedSubagentRunContext;
+            const owners = this.callerChildOwners.get(channelKey);
+            if (!context || !owners || owners.nativeSessionId !== context.nativeSessionId)
+                return;
+            // A delayed launch event from an older turn cannot undo an explicit later resume.
+            if ((owners.turns.get(agentId) ?? 0) <= context.callerTurnId) {
+                owners.turns.set(agentId, context.callerTurnId);
+            }
+        };
+        const callerObserver = runScope.streamCallbacks;
+        runScope.streamCallbacks = {
+            ...callerObserver,
+            onInputDispatch: (input) => {
+                if (ownedSubagentRunContext)
+                    ownedSubagentRunContext.nativeSessionId = input.sessionId;
+                if (host.backend === 'claude' &&
+                    this.callerChildOwners.get(channelKey)?.nativeSessionId !== input.sessionId) {
+                    this.callerChildOwners.set(channelKey, {
+                        nativeSessionId: input.sessionId,
+                        turns: new Map(),
+                        aliases: new Map(),
+                    });
+                }
+                callerObserver?.onInputDispatch?.(input);
+            },
+            onSubagentStart: (info) => {
+                bindCallerChild(info.agentThreadId);
+                const name = callerSpawnNames.get(info.itemId);
+                const owners = this.callerChildOwners.get(channelKey);
+                if (name && owners && owners.nativeSessionId === ownedSubagentRunContext?.nativeSessionId) {
+                    owners.aliases.set(name, info.agentThreadId);
+                }
+                callerObserver?.onSubagentStart?.(info);
+            },
+            onToolUse: (name, input) => {
+                if (host.backend === 'claude') {
+                    if (name === 'Agent' &&
+                        typeof input.name === 'string' &&
+                        typeof input.nativeToolUseId === 'string') {
+                        callerSpawnNames.set(input.nativeToolUseId, input.name);
+                    }
+                    // Claude 2.1.x resumes through SendMessage, addressed by native ID or
+                    // a name resolved from the observed Agent launch, before child calls run.
+                    if (name === 'SendMessage' && typeof input.to === 'string') {
+                        const owners = this.callerChildOwners.get(channelKey);
+                        bindCallerChild(owners?.aliases.get(input.to) ?? input.to);
+                    }
+                }
+                callerObserver?.onToolUse?.(name, input);
+            },
+        };
+        // Use session pool for conversation continuity
+        // IMPORTANT: if the caller passes a session id, use it directly to avoid double-locking
+        let sessionIsNew = request?.resumeSession === undefined ? true : !request.resumeSession;
+        let ownedSession = false;
+        // Claude PersistentCLI: process alive -> CONTINUE (stdin message), process dead -> NEW.
+        // Codex: durable runtime session alive -> CONTINUE, missing -> NEW.
+        const isCodex = host.backend === 'codex';
+        const isDurableRuntime = isCodex;
+        const tracksSessionPolicy = isDurableRuntime || host.backend === 'claude';
+        // --tools is part of the spawned surface: a different grant on the same session
+        // must respawn the process instead of inheriting a stale tool list.
+        const effectiveSessionPolicyFingerprint = host.backend === 'claude' && policy.sessionPolicyFingerprint !== undefined
+            ? `${policy.sessionPolicyFingerprint}::tools=${policy.nativeTools ?? 'default'}`
+            : policy.sessionPolicyFingerprint;
+        let resolvedCliSessionId = request?.cliSessionId ?? null;
+        if (request?.cliSessionId) {
+            // Session routing travels per prompt() call via resolvedCliSessionId - no
+            // shared-adapter mutation (setSessionId re-pointed channelKey/currentProcess
+            // across awaits, cross-wiring concurrent lanes).
+        }
+        else if (request?.freshSession) {
+            // Stateless lanes: session context is a cache, not persistence - every run
+            // self-gathers and recalls; carrying prior runs' gather dumps only grows the
+            // context (measured 146s -> 521s over 3 days; owner decision 2026-07-16).
+            const cliSessionId = host.sessionPool.resetSession(channelKey);
+            sessionIsNew = true;
+            ownedSession = true;
+            resolvedCliSessionId = cliSessionId;
+        }
+        else {
+            // The native lane serializes this session before the pool is acquired.
+            // A busy entry means another caller holds it outside this lane: reusing
+            // and then releasing that entry would steal its session identity.
+            const { sessionId: cliSessionId, isNew, busy } = host.sessionPool.getSession(channelKey);
+            if (busy) {
+                throw new types_js_1.AgentError('Native session is busy outside its lane', 'CLI_ERROR', undefined, true);
+            }
+            sessionIsNew = isNew;
+            ownedSession = true;
+            resolvedCliSessionId = cliSessionId;
+        }
+        // A run record is opened for EVERY turn this entry runs, with two exceptions that
+        // are both stated rather than inferred: the caller already owns a run, or the
+        // driver says it cannot stand behind one. Tool routing is not one of them.
+        const callerOwnsModelRun = Boolean(request?.modelRunId);
+        const runnerReportsRuns = host.agent.reportsModelRuns !== false;
+        try {
+            if (!callerOwnsModelRun && runnerReportsRuns && host.modelRun) {
+                ownedModelRunId = await host.modelRun.begin(request, resolvedCliSessionId);
+                request?.onModelRunStarted?.(ownedModelRunId);
+                if (ownedModelRunId) {
+                    toolExecutionContext = withRunLocals(host.executionContext({
+                        ...(request ?? {}),
+                        modelRunId: ownedModelRunId,
+                    }));
+                }
+            }
+            if (callerOwnsModelRun)
+                request?.onModelRunStarted?.(request.modelRunId);
+            let nativeObserver;
+            try {
+                nativeObserver = host.createNativeEffectObserver?.(toolExecutionContext);
+            }
+            catch {
+                logger.warn('[NativeTurn] native observation setup failed');
+            }
+            nativeEffects = new native_effect_observer_js_1.NativeEffectReplayBoundary(nativeObserver);
+            // This run's bridge is ITS OWN: the loop guards, the emergency budget, the history
+            // writes and the turn observers all belong to this run. A native child gets a
+            // separate bridge - sharing this closure let a child trip the parent's loop guard
+            // and append its traces to the parent's committed model run.
+            const hostToolDefinitions = host.hostToolDefinitions(request);
+            const hostToolBridge = isDurableRuntime && host.isGatewayMode
+                ? this.buildHostToolBridge({
+                    tools: hostToolDefinitions,
+                    runScope,
+                    executionContext: () => toolExecutionContext,
+                    stopAfterSuccessfulTools: request?.stopAfterSuccessfulTools ?? [],
+                    maxConsecutiveSameTool: MAX_CONSECUTIVE_SAME_TOOL,
+                    // A durable runtime does not return completed host exchanges, so record
+                    // them here: it reports the paired custom-tool exchange from its event
+                    // stream and this entry appends it exactly once.
+                    ...(isCodex
+                        ? {
+                            recordExchange: {
+                                assistant: (toolUse) => {
+                                    history.push({ role: 'assistant', content: [toolUse] });
+                                    runScope.onTurn?.({
+                                        turn,
+                                        role: 'assistant',
+                                        content: [toolUse],
+                                        stopReason: 'tool_use',
+                                    });
+                                },
+                                result: (toolResult) => {
+                                    const persistedToolResult = historyToolResult(toolResult);
+                                    history.push({ role: 'user', content: [persistedToolResult] });
+                                    runScope.onTurn?.({
+                                        turn,
+                                        role: 'user',
+                                        content: [persistedToolResult],
+                                    });
+                                },
+                            },
+                        }
+                        : {}),
+                })
+                : undefined;
+            if ((hostToolBridge && isCodex) || host.backend === 'claude') {
+                // A child can be announced during this run and outlive it, so what its authority
+                // needs is recorded now, per session key, and dropped when nothing needs it.
+                // A previous run's context object stays referenced by ITS still-live children, so
+                // this run starts its own count rather than inheriting one it can never settle.
+                ownedSubagentRunContext = {
+                    request: request ? { ...request } : undefined,
+                    parentModelRunId: ownedModelRunId ?? request?.modelRunId ?? null,
+                    cliSessionId: resolvedCliSessionId,
+                    tools: hostToolDefinitions,
+                    tier: runScope.tier,
+                    activeChildren: 0,
+                    runFinished: false,
+                    callerTurnId: ++this.nextCallerTurnId,
+                    executionContext: () => toolExecutionContext,
+                    callerChildren: new Map(),
+                    callerCalls: new Set(),
+                };
+                this.subagentRunContexts.set(channelKey, ownedSubagentRunContext);
+            }
+            // Reset StopContinuation state for this channel to prevent leaking
+            // retry counts from previous invocations
+            // The input remains a user message; native compaction/continuation owns subsequent work.
+            history.push({ role: 'user', content });
+            const carry = {
+                turn,
+                stopReason,
+                stoppedBy,
+                budgetTokens,
+                resolvedCliSessionId,
+                sessionIsNew,
+            };
+            await (0, native_prompt_js_1.runNativePrompt)(carry, {
+                channelKey,
+                claudeNativeTools: policy.nativeTools,
+                effectiveSessionPolicyFingerprint,
+                restrictedReadRoots: policy.restrictedReadRoots,
+                nativeCwd: policy.nativeCwd,
+                history,
+                prepareSessionContent: request?.prepareSessionContent,
+                hostToolBridge,
+                isCodex,
+                isDurableRuntime,
+                nativeEffects,
+                ownedModelRunId,
+                standingPolicy: policy.standingPolicy === true,
+                systemPrompt: compose(policy.systemLayers),
+                reanchor: policy.reanchorLayers
+                    ? async () => compose(await policy.reanchorLayers())
+                    : undefined,
+                resumeInstructions: policy.resumeLayers
+                    ? async () => compose(await policy.resumeLayers())
+                    : undefined,
+                runScope,
+                toolExecutionContext,
+                totalUsage,
+                tracksSessionPolicy,
+            }, request ?? {}, {
+                agent: host.agent,
+                backend: host.backend,
+                model: host.model,
+                runTokenBudget: host.runTokenBudget,
+                sessionPool: host.sessionPool,
+                onBudgetStop: host.onBudgetStop,
+                onTokenUsage: host.onTokenUsage,
+                onMetric: host.onMetric,
+                formatLastMessageOnly: (messages) => formatLastUserMessage(messages, { mediaDir: host.inboundMediaDir }),
+            });
+            ({ turn, stopReason, stoppedBy, budgetTokens, resolvedCliSessionId, sessionIsNew } = carry);
+            const finalResponse = (0, turn_text_js_1.extractTextResponse)(history);
+            const result = {
+                ...(stoppedBy ? { stoppedBy } : {}),
+                response: finalResponse,
+                turns: turn,
+                history,
+                totalUsage,
+                stopReason,
+                modelRunId: ownedModelRunId ?? request?.modelRunId ?? null,
+                modelRunProvenance: (ownedModelRunId ?? request?.modelRunId) ? 'available' : 'backend_no_run',
+            };
+            await this.settleCallerRuns(ownedSubagentRunContext, stoppedBy
+                ? { status: 'interrupted', error: `parent stopped: ${stoppedBy}` }
+                : { status: 'completed' });
+            // Draining background work and committing the run are separate failures and get
+            // separate catches. Sharing one meant a rejected background task skipped the commit
+            // and was then reported as `commit_failed` - naming a failure that was never even
+            // attempted, which is the exact habit this provenance state exists to break.
+            try {
+                await drainBackgroundTasks(pendingBackgroundTasks);
+            }
+            catch (backgroundError) {
+                logger.warn(`background task drain failed: ${backgroundError instanceof Error ? backgroundError.message : String(backgroundError)}`);
+            }
+            try {
+                if (ownedModelRunId && host.modelRun) {
+                    await host.modelRun.commit(ownedModelRunId, completionSummary(finalResponse), totalUsage.input_tokens + totalUsage.output_tokens);
+                    ownedModelRunCommitted = true;
+                }
+            }
+            catch (commitError) {
+                logger.warn(`model run commit failed: ${commitError instanceof Error ? commitError.message : String(commitError)}`);
+            }
+            if (ownedModelRunId && !ownedModelRunCommitted) {
+                // The response still stands - the turn happened and the owner should get it.
+                // What does NOT stand is the handle: the run record may be left uncommitted, so
+                // returning its id would hand out provenance that cannot be resolved. Report the
+                // answer, withhold the claim, and say which kind of absence this is - an
+                // uncommitted record is a durability failure to repair, not the ordinary case of
+                // a backend that reports no run at all.
+                //
+                // Deliberately NOT marked failed. The run did not fail; writing its completion
+                // did. Relabelling a successful run as failed would tidy the state by recording
+                // something untrue, and an existing test pins that decision. The orphan stays
+                // visible, and the reason below is what a repair pass keys on.
+                result.modelRunId = null;
+                result.modelRunProvenance = 'commit_failed';
+                logger.error(`Model run ${ownedModelRunId} may remain uncommitted; provenance reported as commit_failed`);
+            }
+            try {
+                await host.onRunFinished?.({
+                    request,
+                    result,
+                    channelKey,
+                    modelRunId: ownedModelRunId,
+                    prompt: runPrompt,
+                    response: finalResponse,
+                });
+            }
+            catch (observerError) {
+                logger.error(`Run-finished observer failed: ${observerError instanceof Error ? observerError.message : String(observerError)}`);
+            }
+            if (stoppedBy) {
+                // Budget interruption is returned structurally; keep admission uncertain.
+                nativeEffects.failure(new Error('Native run stopped by token budget'));
+            }
+            else {
+                nativeEffects.finished();
+            }
+            return result;
+        }
+        catch (error) {
+            await this.settleCallerRuns(ownedSubagentRunContext, {
+                status: 'failed',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            if (ownedModelRunId && !ownedModelRunCommitted && host.modelRun) {
+                try {
+                    const summary = error instanceof Error ? error.message : String(error);
+                    await host.modelRun.fail(ownedModelRunId, summary, totalUsage.input_tokens + totalUsage.output_tokens);
+                }
+                catch (failError) {
+                    logger.warn(`Failed to mark model run ${ownedModelRunId} failed: ${failError instanceof Error ? failError.message : String(failError)}`);
+                }
+            }
+            throw nativeEffects.failure(error);
+        }
+        finally {
+            if (activeSteerBinding && this.activeSteerBindings.get(channelKey) === activeSteerBinding) {
+                this.activeSteerBindings.delete(channelKey);
+            }
+            // A child that outlives this run still needs its authority recipe, so the context is
+            // dropped only once the run finished AND no child of it is still registered.
+            if (ownedSubagentRunContext) {
+                ownedSubagentRunContext.runFinished = true;
+                if (ownedSubagentRunContext.activeChildren === 0 &&
+                    this.subagentRunContexts.get(channelKey) === ownedSubagentRunContext) {
+                    this.subagentRunContexts.delete(channelKey);
+                }
+            }
+            // Always release the session lock, even on error, but only if we own it.
+            if (ownedSession) {
+                host.sessionPool.releaseSession(channelKey);
+            }
+        }
+    }
+}
+exports.NativeSessionRunner = NativeSessionRunner;
+function createNativeSessionRunner(host) {
+    return new NativeSessionRunner(host);
+}
+//# sourceMappingURL=native-turn.js.map