@kb-labs/mcp-app 2.116.14 → 2.117.0

package/dist/bin.cjs

@@ -2230,8 +2230,8 @@ var init_dist3 = __esm({
             totalTime: 0
           });
         }
-        const registered = this.resources.get(request.resource);
-        if (!registered) {
+        const registered2 = this.resources.get(request.resource);
+        if (!registered2) {
           return Promise.resolve({
             success: false,
             error: new Error(`Resource not registered: ${request.resource}`),
@@ -2241,7 +2241,7 @@ var init_dist3 = __esm({
             totalTime: 0
           });
         }
-        if (registered.limitOnly) {
+        if (registered2.limitOnly) {
           return Promise.resolve({
             success: false,
             error: new Error(
@@ -2257,8 +2257,8 @@ var init_dist3 = __esm({
           ...request,
           id: crypto4.randomUUID(),
           createdAt: Date.now(),
-          timeout: request.timeout ?? registered.config.timeout ?? 6e4,
-          maxRetries: request.maxRetries ?? registered.config.maxRetries ?? DEFAULT_RETRY_CONFIG.maxRetries
+          timeout: request.timeout ?? registered2.config.timeout ?? 6e4,
+          maxRetries: request.maxRetries ?? registered2.config.maxRetries ?? DEFAULT_RETRY_CONFIG.maxRetries
         };
         return new Promise((resolve9, reject) => {
           const item = {
@@ -2268,7 +2268,7 @@ var init_dist3 = __esm({
             enqueuedAt: Date.now()
           };
           this.queue.enqueue(item);
-          registered.stats.totalRequests++;
+          registered2.stats.totalRequests++;
           this.processQueue();
         });
       }
@@ -2293,15 +2293,15 @@ var init_dist3 = __esm({
             release: noopRelease
           };
         }
-        const registered = this.resources.get(resource);
-        if (!registered) {
+        const registered2 = this.resources.get(resource);
+        if (!registered2) {
           throw new Error(`Resource not registered: ${resource}`);
         }
         const tokens = opts?.tokens ?? 0;
         const result = await this.rateLimitBackend.acquire(
           resource,
           tokens,
-          registered.rateLimits
+          registered2.rateLimits
         );
         if (!result.allowed) {
           return { ...result, release: noopRelease };
@@ -2334,8 +2334,8 @@ var init_dist3 = __esm({
             if (!item) {
               break;
             }
-            const registered = this.resources.get(item.request.resource);
-            if (!registered) {
+            const registered2 = this.resources.get(item.request.resource);
+            if (!registered2) {
               this.queue.dequeue();
               item.reject(new Error(`Resource not registered: ${item.request.resource}`));
               continue;
@@ -2344,7 +2344,7 @@ var init_dist3 = __esm({
             const acquireResult = await this.rateLimitBackend.acquire(
               item.request.resource,
               tokens,
-              registered.rateLimits
+              registered2.rateLimits
             );
             if (!acquireResult.allowed) {
               await sleep(acquireResult.waitTimeMs ?? 100);
@@ -2353,7 +2353,7 @@ var init_dist3 = __esm({
             this.queue.dequeue();
             const currentActive = this.activeProcessing.get(item.request.resource) ?? 0;
             this.activeProcessing.set(item.request.resource, currentActive + 1);
-            this.executeItem(item, registered).catch(() => {
+            this.executeItem(item, registered2).catch(() => {
             });
           }
         } finally {
@@ -2366,15 +2366,15 @@ var init_dist3 = __esm({
       /**
        * Execute a single queue item with retry logic.
        */
-      async executeItem(item, registered) {
+      async executeItem(item, registered2) {
         const startTime = Date.now();
         const waitTime = startTime - item.enqueuedAt;
         let retries = 0;
         let lastError;
         const retryConfig = {
           maxRetries: item.request.maxRetries ?? DEFAULT_RETRY_CONFIG.maxRetries,
-          baseDelay: registered.config.baseDelay ?? DEFAULT_RETRY_CONFIG.baseDelay,
-          maxDelay: registered.config.maxDelay ?? DEFAULT_RETRY_CONFIG.maxDelay,
+          baseDelay: registered2.config.baseDelay ?? DEFAULT_RETRY_CONFIG.baseDelay,
+          maxDelay: registered2.config.maxDelay ?? DEFAULT_RETRY_CONFIG.maxDelay,
           jitter: DEFAULT_RETRY_CONFIG.jitter,
           retryableErrors: DEFAULT_RETRY_CONFIG.retryableErrors
         };
@@ -2385,16 +2385,16 @@ var init_dist3 = __esm({
               const timeoutPromise = new Promise((_, reject) => {
                 setTimeout(() => reject(new Error(`Request timeout after ${timeoutMs}ms`)), timeoutMs);
               });
-              const executionPromise = registered.config.executor(
+              const executionPromise = registered2.config.executor(
                 item.request.operation,
                 item.request.args
               );
               const result = await Promise.race([executionPromise, timeoutPromise]);
               const endTime2 = Date.now();
               const processingTime2 = endTime2 - startTime;
-              registered.stats.totalSuccess++;
-              registered.stats.totalWaitTime += waitTime;
-              registered.stats.totalProcessingTime += processingTime2;
+              registered2.stats.totalSuccess++;
+              registered2.stats.totalWaitTime += waitTime;
+              registered2.stats.totalProcessingTime += processingTime2;
               item.resolve({
                 success: true,
                 data: result,
@@ -2416,7 +2416,7 @@ var init_dist3 = __esm({
               const acquireResult = await this.rateLimitBackend.acquire(
                 item.request.resource,
                 tokens,
-                registered.rateLimits
+                registered2.rateLimits
               );
               if (!acquireResult.allowed && acquireResult.waitTimeMs) {
                 await sleep(acquireResult.waitTimeMs);
@@ -2425,9 +2425,9 @@ var init_dist3 = __esm({
           }
           const endTime = Date.now();
           const processingTime = endTime - startTime;
-          registered.stats.totalErrors++;
-          registered.stats.totalWaitTime += waitTime;
-          registered.stats.totalProcessingTime += processingTime;
+          registered2.stats.totalErrors++;
+          registered2.stats.totalWaitTime += waitTime;
+          registered2.stats.totalProcessingTime += processingTime;
           item.resolve({
             success: false,
             error: lastError,
@@ -2450,7 +2450,7 @@ var init_dist3 = __esm({
         let totalRequests = 0;
         let totalSuccess = 0;
         let totalErrors = 0;
-        for (const [resourceName, registered] of this.resources) {
+        for (const [resourceName, registered2] of this.resources) {
           const queueByPriority = this.queue.sizeByPriority();
           const queueSize = this.queue.sizeByResource(resourceName);
           const activeRequests = this.activeProcessing.get(resourceName) ?? 0;
@@ -2460,26 +2460,26 @@ var init_dist3 = __esm({
             requestsThisMinute: 0,
             requestsThisSecond: 0,
             activeRequests,
-            totalRequests: registered.stats.totalRequests,
+            totalRequests: registered2.stats.totalRequests,
             totalTokens: 0,
             waitCount: 0,
-            totalWaitTime: registered.stats.totalWaitTime
+            totalWaitTime: registered2.stats.totalWaitTime
           };
-          const avgWaitTime = registered.stats.totalRequests > 0 ? registered.stats.totalWaitTime / registered.stats.totalRequests : 0;
-          const avgProcessingTime = registered.stats.totalRequests > 0 ? registered.stats.totalProcessingTime / registered.stats.totalRequests : 0;
+          const avgWaitTime = registered2.stats.totalRequests > 0 ? registered2.stats.totalWaitTime / registered2.stats.totalRequests : 0;
+          const avgProcessingTime = registered2.stats.totalRequests > 0 ? registered2.stats.totalProcessingTime / registered2.stats.totalRequests : 0;
           resources[resourceName] = {
             rateLimits: rateLimitStats,
             queueSize,
             queueByPriority,
-            totalRequests: registered.stats.totalRequests,
-            totalSuccess: registered.stats.totalSuccess,
-            totalErrors: registered.stats.totalErrors,
+            totalRequests: registered2.stats.totalRequests,
+            totalSuccess: registered2.stats.totalSuccess,
+            totalErrors: registered2.stats.totalErrors,
             avgWaitTime,
             avgProcessingTime
           };
-          totalRequests += registered.stats.totalRequests;
-          totalSuccess += registered.stats.totalSuccess;
-          totalErrors += registered.stats.totalErrors;
+          totalRequests += registered2.stats.totalRequests;
+          totalSuccess += registered2.stats.totalSuccess;
+          totalErrors += registered2.stats.totalErrors;
         }
         return {
           resources,
@@ -3567,6 +3567,7 @@ __export(dist_exports, {
   KVStoreProxy: () => KVStoreProxy,
   LLMProxy: () => LLMProxy,
   OPERATION_TIMEOUTS: () => OPERATION_TIMEOUTS,
+  ProcessExecutorProxy: () => ProcessExecutorProxy,
   RemoteAdapter: () => RemoteAdapter,
   StorageProxy: () => StorageProxy,
   TimeoutError: () => TimeoutError,
@@ -3648,6 +3649,7 @@ function isPlainObject(value) {
 function createProxyPlatform(options) {
   const { transport } = options;
   const logger2 = options.logger ?? new LoggerProxy(transport);
+  const processExecutor = new ProcessExecutorProxy(transport);
   const cache = new CacheProxy(transport);
   const llm = new LLMProxy(transport);
   const embeddings = new EmbeddingsProxy(transport);
@@ -3691,10 +3693,11 @@ function createProxyPlatform(options) {
     invoke,
     documentDatabase,
     kvStore,
-    logs
+    logs,
+    processExecutor
   };
 }
-var BulkTransferHelper, DEFAULT_SOCKET_PATH, UnixSocketServer, IPCServer, ChildIPCServer, TransportError, TimeoutError, CircuitOpenError, OPERATION_TIMEOUTS, IPCTransport, UnixSocketTransport, RemoteAdapter, CacheProxy, LLMProxy, EmbeddingsProxy, VectorStoreProxy, StorageProxy, DocumentDatabaseProxy, stripSignal, KVStoreProxy, stripSignal2, ConfigProxy, EventBusProxy, LoggerProxy;
+var BulkTransferHelper, DEFAULT_SOCKET_PATH, UnixSocketServer, IPCServer, ChildIPCServer, TransportError, TimeoutError, CircuitOpenError, OPERATION_TIMEOUTS, IPCTransport, UnixSocketTransport, RemoteAdapter, CacheProxy, LLMProxy, EmbeddingsProxy, VectorStoreProxy, StorageProxy, DocumentDatabaseProxy, stripSignal, KVStoreProxy, stripSignal2, ConfigProxy, EventBusProxy, LoggerProxy, PROCESS_RPC_GRACE_MS, CONTROL_RPC_TIMEOUT_MS, MAX_TIMER_MS, ProcessExecutorProxy;
 var init_dist5 = __esm({
   "../../../core/ipc/dist/index.js"() {
     init_serializable();
@@ -4010,11 +4013,16 @@ var init_dist5 = __esm({
             return this.platform.analytics;
           case "eventBus":
             return this.platform.eventBus;
+          case "processExecutor":
+            if (!this.platform.processExecutor) {
+              throw new Error("Governed process executor is not configured on execution host");
+            }
+            return this.platform.processExecutor;
           case "invoke":
             return this.platform.invoke;
           default:
             throw new Error(
-              `Unknown adapter: '${name}'. Valid adapters: vectorStore, cache, config, llm, embeddings, storage, logger, analytics, eventBus, invoke`
+              `Unknown adapter: '${name}'. Valid adapters: vectorStore, cache, config, llm, embeddings, storage, logger, analytics, eventBus, invoke, processExecutor`
             );
         }
       }
@@ -4186,9 +4194,14 @@ var init_dist5 = __esm({
             return this.platform.eventBus;
           case "invoke":
             return this.platform.invoke;
+          case "processExecutor":
+            if (!this.platform.processExecutor) {
+              throw new Error("Governed process executor is not configured on execution host");
+            }
+            return this.platform.processExecutor;
           default:
             throw new Error(
-              `Unknown adapter: '${name}'. Valid adapters: vectorStore, cache, llm, embeddings, storage, logger, analytics, eventBus, invoke`
+              `Unknown adapter: '${name}'. Valid adapters: vectorStore, cache, llm, embeddings, storage, logger, analytics, eventBus, invoke, processExecutor`
             );
         }
       }
@@ -5528,6 +5541,52 @@ Caused by: ${cause.stack}`;
         return new _LoggerProxy(this.proxyTransport, { ...this.boundContext, ...bindings });
       }
     };
+    PROCESS_RPC_GRACE_MS = 5e3;
+    CONTROL_RPC_TIMEOUT_MS = 5e3;
+    MAX_TIMER_MS = 2147483647;
+    ProcessExecutorProxy = class extends RemoteAdapter {
+      constructor(transport) {
+        super("processExecutor", transport);
+      }
+      capabilities() {
+        return {
+          platform: "other",
+          processGroups: false,
+          hardMemoryLimit: false,
+          hardCpuLimit: false,
+          processTreeAccounting: false,
+          maxProcesses: false
+        };
+      }
+      async execute(request) {
+        const processId = request.processId ?? crypto4.randomUUID();
+        const { signal, ...serializableRequest } = request;
+        let cancelled = false;
+        const onAbort = () => {
+          cancelled = true;
+          void this.cancel(processId, "cancelled");
+        };
+        signal?.addEventListener("abort", onAbort, { once: true });
+        try {
+          const processTimeout = request.limits.timeoutMs + (request.limits.graceMs ?? 1e3);
+          const rpcTimeout = Math.min(MAX_TIMER_MS, processTimeout + PROCESS_RPC_GRACE_MS);
+          return await this.callRemote("execute", [{ ...serializableRequest, processId }], rpcTimeout);
+        } catch (error2) {
+          void this.cancel(processId, "cancelled").catch(() => void 0);
+          throw error2;
+        } finally {
+          if (!cancelled) {
+            signal?.removeEventListener("abort", onAbort);
+          }
+        }
+      }
+      async cancel(processId, reason = "cancelled") {
+        await this.callRemote("cancel", [processId, reason], CONTROL_RPC_TIMEOUT_MS);
+      }
+      async shutdown() {
+        await this.callRemote("shutdown", [], CONTROL_RPC_TIMEOUT_MS);
+      }
+    };
   }
 });
 function getLoggerMetadataFromHost(hostContext) {
@@ -6014,77 +6073,66 @@ function createShellAPI(options) {
   const { permissions, cwd } = options;
   const allowedCommands = permissions.shell?.allow ?? [];
   if (allowedCommands.length === 0) {
-    return {
-      async exec() {
-        throw new PermissionError("Shell execution not allowed");
-      }
-    };
+    return { async exec() {
+      throw new PermissionError("Shell execution not allowed");
+    } };
   }
+  const executor = options.processExecutor;
+  if (!executor) {
+    throw new Error("Governed process executor is unavailable in this execution host");
+  }
+  const identity = options.processIdentity ?? {
+    executionId: "unknown-execution",
+    requestId: "unknown-request",
+    pluginId: "unknown-plugin"
+  };
+  const quotas = permissions.quotas ?? {};
   return {
     async exec(command, args = [], execOptions) {
       const fullCommand = `${command} ${args.join(" ")}`;
       for (const blocked of BLOCKED_COMMANDS) {
         if (fullCommand.includes(blocked)) {
-          throw new PermissionError(`Dangerous command blocked`, {
-            command: fullCommand,
-            blocked
-          });
+          throw new PermissionError("Dangerous command blocked", { command: fullCommand, blocked });
         }
       }
       if (!allowedCommands.includes(command) && !allowedCommands.includes(path13.basename(command)) && !allowedCommands.includes("*")) {
-        throw new PermissionError(`Command not in whitelist`, {
-          command,
-          allowedCommands
-        });
-      }
-      const workingDir = execOptions?.cwd ?? cwd;
-      const timeout = execOptions?.timeout ?? 3e4;
-      const throwOnError = execOptions?.throwOnError ?? false;
-      return new Promise((resolve32, reject) => {
-        const child = child_process.spawn(command, args, {
-          cwd: workingDir,
-          env: {
-            ...process.env,
-            ...execOptions?.env
-          }
-        });
-        let stdout = "";
-        let stderr = "";
-        let timedOut = false;
-        const timeoutId = setTimeout(() => {
-          timedOut = true;
-          child.kill("SIGKILL");
-        }, timeout);
-        child.stdout?.on("data", (data) => {
-          stdout += data.toString();
-        });
-        child.stderr?.on("data", (data) => {
-          stderr += data.toString();
-        });
-        child.on("close", (code) => {
-          clearTimeout(timeoutId);
-          if (timedOut) {
-            reject(new Error(`Command timed out after ${timeout}ms`));
-            return;
-          }
-          const exitCode = code ?? 0;
-          const result = {
-            code: exitCode,
-            stdout,
-            stderr,
-            ok: exitCode === 0
-          };
-          if (throwOnError && exitCode !== 0) {
-            reject(new Error(`Command failed with code ${exitCode}: ${stderr}`));
-          } else {
-            resolve32(result);
-          }
-        });
-        child.on("error", (error2) => {
-          clearTimeout(timeoutId);
-          reject(error2);
-        });
+        throw new PermissionError("Command not in whitelist", { command, allowedCommands });
+      }
+      const requestedTimeout = execOptions?.timeout ?? quotas.timeoutMs ?? 3e4;
+      const timeoutMs = Math.min(requestedTimeout, quotas.timeoutMs ?? requestedTimeout);
+      const result = await executor.execute({
+        identity,
+        command,
+        args,
+        cwd: execOptions?.cwd ?? cwd,
+        env: execOptions?.env,
+        signal: execOptions?.signal ?? options.signal,
+        retry: execOptions?.retry,
+        limits: {
+          timeoutMs,
+          cpuMs: quotas.cpuMs,
+          memoryMb: quotas.memoryMb,
+          maxProcesses: quotas.maxProcesses,
+          maxConcurrent: permissions.shell?.maxConcurrent,
+          maxOutputBytes: execOptions?.maxOutputBytes ?? quotas.maxOutputBytes
+        }
       });
+      const output = {
+        code: result.code ?? -1,
+        stdout: result.stdout,
+        stderr: result.stderr,
+        ok: result.ok,
+        processId: result.processId,
+        terminationReason: result.terminationReason,
+        usage: result.usage,
+        attempts: result.attempts
+      };
+      if (execOptions?.throwOnError && !output.ok) {
+        const error2 = new Error(`Command failed with code ${output.code}: ${output.stderr}`);
+        Object.assign(error2, { code: "PROCESS_EXIT_NON_ZERO", result: output });
+        throw error2;
+      }
+      return output;
     }
   };
 }
@@ -6906,6 +6954,9 @@ function createPluginAPI(options) {
     cwd,
     outdir,
     permissions,
+    processExecutor,
+    processIdentity,
+    signal,
     cache,
     eventEmitter,
     pluginInvoker,
@@ -6923,7 +6974,7 @@ function createPluginAPI(options) {
     lifecycle: createLifecycleAPI(cleanupStack),
     state: createStateAPI({ pluginId, tenantId, cache }),
     artifacts: createArtifactsAPI({ outdir }),
-    shell: createShellAPI({ permissions, cwd }),
+    shell: createShellAPI({ permissions, cwd, processExecutor, processIdentity, signal }),
     events: eventEmitter ? createEventsAPI({ pluginId, emitter: eventEmitter }) : createNoopEventsAPI(),
     invoke: pluginInvoker ? createInvokeAPI({
       permissions,
@@ -7459,6 +7510,15 @@ function createPluginContextV3(options) {
     cwd,
     outdir: finalOutdir,
     permissions: descriptor.permissions,
+    processExecutor: extendedPlatform.processExecutor,
+    processIdentity: {
+      executionId: executionId ?? requestId,
+      requestId,
+      pluginId: descriptor.pluginId,
+      handlerId: descriptor.handlerId,
+      tenantId: descriptor.tenantId
+    },
+    signal,
     cache: enrichedPlatform.cache,
     // Use governed cache, not raw
     eventEmitter,
@@ -7714,6 +7774,29 @@ ${possiblePaths.join("\n")}`
     });
   });
 }
+function killTree(child, signal) {
+  if (!child.pid) {
+    return;
+  }
+  try {
+    if (process.platform === "darwin" || process.platform === "linux") {
+      process.kill(-child.pid, signal);
+    } else {
+      child.kill(signal);
+    }
+  } catch {
+    try {
+      child.kill(signal);
+    } catch {
+    }
+  }
+}
+function createDefaultProcessExecutor(logger2) {
+  if (process.platform === "darwin") {
+    return new DarwinProcessBackend(logger2);
+  }
+  return new LinuxProcessBackend(logger2);
+}
 async function resolveAdapterMiddlewares(rawDecls, logger2) {
   const result = [];
   for (const { pkgRoot, decl } of rawDecls) {
@@ -7793,7 +7876,7 @@ function wrapCliResult(runResult, descriptor) {
     meta: standardMeta
   };
 }
-var PluginError, PermissionError, TimeoutError2, AbortError, PLATFORM_CONTEXT_KEY, platformContext, RUNTIME_CONTEXT_KEY, runtimeContext, HARDCODED_DENIED_PATTERNS, ALWAYS_ALLOWED, BLOCKED_COMMANDS, ANALYTICS_EVENT, EVENT_BUS_TOPIC, NAMESPACE_SEPARATOR, KV_NAMESPACE_SEPARATOR, validateName, wrapLogger, wrapLlm, wrapEmbeddings, wrapVectorStore, wrapCache, wrapStorage, wrapNotifier, ADAPTER_REGISTRY, PIPELINE_SLOTS, SLOT_ORDER, NOOP_LIFECYCLE, ANSI_RE;
+var PluginError, PermissionError, TimeoutError2, AbortError, PLATFORM_CONTEXT_KEY, platformContext, RUNTIME_CONTEXT_KEY, runtimeContext, HARDCODED_DENIED_PATTERNS, ALWAYS_ALLOWED, BLOCKED_COMMANDS, ANALYTICS_EVENT, EVENT_BUS_TOPIC, NAMESPACE_SEPARATOR, KV_NAMESPACE_SEPARATOR, validateName, wrapLogger, wrapLlm, wrapEmbeddings, wrapVectorStore, wrapCache, wrapStorage, wrapNotifier, ADAPTER_REGISTRY, PIPELINE_SLOTS, SLOT_ORDER, NOOP_LIFECYCLE, ANSI_RE, GovernedProcessError, NodeProcessBackend, DarwinProcessBackend, LinuxProcessBackend, registered, BrokeredProcessExecutor;
 var init_dist6 = __esm({
   "../../../core/plugin-runtime/dist/index.js"() {
     init_dist();
@@ -7888,7 +7971,6 @@ var init_dist6 = __esm({
       "mkfs",
       "dd if=",
       ":(){:|:&};:",
-      // Fork bomb
       "chmod -R 777 /",
       "chown -R",
       "> /dev/sda",
@@ -8262,6 +8344,434 @@ var init_dist6 = __esm({
       }
     };
     ANSI_RE = /\x1b\[[0-9;]*[A-Za-z]/g;
+    GovernedProcessError = class extends Error {
+      code;
+      details;
+      constructor(code, message2, details = {}) {
+        super(message2);
+        this.name = "GovernedProcessError";
+        this.code = code;
+        this.details = details;
+      }
+    };
+    NodeProcessBackend = class {
+      constructor(logger2) {
+        this.logger = logger2;
+      }
+      logger;
+      active = /* @__PURE__ */ new Set();
+      cancellers = /* @__PURE__ */ new Map();
+      shuttingDown = false;
+      configureProcess(_pid, _request) {
+        return () => {
+        };
+      }
+      treePids(rootPid) {
+        if (process.platform !== "linux") {
+          return [rootPid];
+        }
+        const children = /* @__PURE__ */ new Map();
+        let entries;
+        try {
+          entries = fs5.readdirSync("/proc").filter((entry) => /^\d+$/.test(entry));
+        } catch {
+          return [rootPid];
+        }
+        for (const entry of entries) {
+          const pid = Number(entry);
+          try {
+            const stat3 = fs5.readFileSync(`/proc/${pid}/stat`, "utf8");
+            const close = stat3.lastIndexOf(")");
+            const ppid = Number(stat3.slice(close + 2).split(" ")[1]);
+            const list = children.get(ppid) ?? [];
+            list.push(pid);
+            children.set(ppid, list);
+          } catch {
+          }
+        }
+        const result = [rootPid];
+        for (let i = 0; i < result.length; i++) {
+          result.push(...children.get(result[i]) ?? []);
+        }
+        return result;
+      }
+      snapshot(pid) {
+        const pids = this.treePids(pid);
+        let memoryMb = 0;
+        let cpuMs = 0;
+        for (const current of pids) {
+          if (process.platform !== "linux") {
+            continue;
+          }
+          try {
+            const status = fs5.readFileSync(`/proc/${current}/status`, "utf8");
+            const rss = /^VmRSS:\s+(\d+)\s+kB$/m.exec(status);
+            memoryMb += rss ? Number(rss[1]) / 1024 : 0;
+            const stat3 = fs5.readFileSync(`/proc/${current}/stat`, "utf8");
+            const close = stat3.lastIndexOf(")");
+            const fields = stat3.slice(close + 2).split(" ");
+            const ticks = Number(fields[11]) + Number(fields[12]);
+            cpuMs += ticks / 100 * 1e3;
+          } catch {
+          }
+        }
+        return { cpuMs, memoryMb, processCount: pids.length };
+      }
+      async execute(request) {
+        if (this.shuttingDown) {
+          throw new GovernedProcessError("PROCESS_CANCELLED", "Process backend is shutting down");
+        }
+        const attempts = request.retry?.maxAttempts ?? 1;
+        if (attempts > 1 && !request.retry?.idempotent) {
+          throw new GovernedProcessError("PROCESS_SPAWN_FAILED", "Retrying shell commands requires idempotent=true");
+        }
+        let lastError;
+        for (let attempt = 1; attempt <= attempts; attempt++) {
+          try {
+            return await this.runOnce(request, attempt);
+          } catch (error2) {
+            lastError = error2;
+            if (attempt === attempts) {
+              break;
+            }
+            if (!(error2 instanceof GovernedProcessError) || error2.code !== "PROCESS_SPAWN_FAILED") {
+              break;
+            }
+            const base2 = request.retry?.initialDelayMs ?? 250;
+            const max = request.retry?.maxDelayMs ?? 5e3;
+            const jitter = request.retry?.jitter ?? 0.1;
+            const delay = Math.min(max, base2 * 2 ** (attempt - 1));
+            await new Promise((resolve32) => {
+              setTimeout(resolve32, Math.floor(delay * (1 + Math.random() * jitter)));
+            });
+          }
+        }
+        throw lastError instanceof Error ? lastError : new Error(String(lastError));
+      }
+      runOnce(request, attempt) {
+        const started = Date.now();
+        const processId = request.processId ?? crypto4.randomUUID();
+        this.logger?.info("process.execution.started", {
+          component: "process-executor",
+          operation: "execute",
+          processId,
+          executionId: request.identity.executionId,
+          requestId: request.identity.requestId,
+          pluginId: request.identity.pluginId,
+          handlerId: request.identity.handlerId,
+          command: request.command,
+          argCount: request.args.length,
+          cwd: request.cwd,
+          attempt,
+          limits: request.limits
+        });
+        const maxOutput = request.limits.maxOutputBytes ?? 8 * 1024 * 1024;
+        const graceMs = request.limits.graceMs ?? 1e3;
+        return new Promise((resolve32, reject) => {
+          let child;
+          try {
+            child = child_process.spawn(request.command, request.args, {
+              cwd: request.cwd,
+              env: { ...process.env, ...request.env },
+              detached: process.platform === "darwin" || process.platform === "linux",
+              shell: false,
+              stdio: ["ignore", "pipe", "pipe"]
+            });
+          } catch (error2) {
+            reject(new GovernedProcessError("PROCESS_SPAWN_FAILED", `Failed to spawn ${request.command}`, { cause: String(error2) }));
+            return;
+          }
+          child.once("error", (error2) => {
+            if (!child.pid) {
+              this.logger?.error("process.execution.failed", error2, {
+                component: "process-executor",
+                operation: "execute",
+                executionId: request.identity.executionId,
+                requestId: request.identity.requestId,
+                pluginId: request.identity.pluginId,
+                command: request.command
+              });
+              reject(new GovernedProcessError("PROCESS_SPAWN_FAILED", error2.message));
+            }
+          });
+          if (!child.pid) {
+            reject(new GovernedProcessError("PROCESS_SPAWN_FAILED", "Process did not receive a PID"));
+            return;
+          }
+          const pid = child.pid;
+          this.active.add(pid);
+          let cleanupProcessConfig = () => {
+          };
+          try {
+            cleanupProcessConfig = this.configureProcess(pid, request);
+          } catch (error2) {
+            killTree(child, "SIGKILL");
+            this.active.delete(pid);
+            reject(new GovernedProcessError("PROCESS_SPAWN_FAILED", "Unable to apply process limits", { cause: String(error2) }));
+            return;
+          }
+          let stdout = "";
+          let stderr = "";
+          let stdoutBytes = 0;
+          let stderrBytes = 0;
+          let reason = "completed";
+          let peakMemoryMb = 0;
+          let peakCpuMs = 0;
+          let peakProcessCount = 1;
+          let settled = false;
+          const finish = (code, signal) => {
+            if (settled) {
+              return;
+            }
+            settled = true;
+            this.active.delete(pid);
+            this.cancellers.delete(processId);
+            cleanupProcessConfig();
+            clearTimeout(timeout);
+            clearInterval(monitor);
+            const usage = {
+              wallTimeMs: Date.now() - started,
+              cpuMs: peakCpuMs,
+              peakMemoryMb,
+              processCount: peakProcessCount,
+              stdoutBytes,
+              stderrBytes
+            };
+            const result = {
+              processId,
+              code,
+              signal: signal ?? void 0,
+              stdout,
+              stderr,
+              ok: reason === "completed" && code === 0,
+              terminationReason: reason,
+              usage,
+              attempts: attempt
+            };
+            this.logger?.info("process.execution.finished", {
+              component: "process-executor",
+              operation: "execute",
+              processId,
+              executionId: request.identity.executionId,
+              requestId: request.identity.requestId,
+              pluginId: request.identity.pluginId,
+              command: request.command,
+              ok: result.ok,
+              code: result.code,
+              terminationReason: result.terminationReason,
+              usage: result.usage,
+              attempts: result.attempts
+            });
+            if (reason === "completed") {
+              resolve32(result);
+              return;
+            }
+            const codes = {
+              timeout: "PROCESS_TIMEOUT",
+              cancelled: "PROCESS_CANCELLED",
+              memory_limit: "PROCESS_MEMORY_LIMIT",
+              cpu_limit: "PROCESS_CPU_LIMIT",
+              process_limit: "PROCESS_LIMIT",
+              output_limit: "PROCESS_OUTPUT_LIMIT",
+              shutdown: "PROCESS_CANCELLED"
+            };
+            const governedError = new GovernedProcessError(codes[reason], `Process terminated: ${reason}`, { result });
+            this.logger?.warn("process.execution.terminated", {
+              component: "process-executor",
+              operation: "execute",
+              processId,
+              executionId: request.identity.executionId,
+              requestId: request.identity.requestId,
+              pluginId: request.identity.pluginId,
+              terminationReason: reason,
+              usage
+            });
+            reject(governedError);
+          };
+          const terminate = (next) => {
+            if (settled) {
+              return;
+            }
+            reason = next;
+            killTree(child, "SIGTERM");
+            setTimeout(() => killTree(child, "SIGKILL"), graceMs);
+          };
+          this.cancellers.set(processId, terminate);
+          const timeout = setTimeout(() => terminate("timeout"), request.limits.timeoutMs);
+          const monitor = setInterval(() => {
+            const sample = this.snapshot(pid);
+            peakMemoryMb = Math.max(peakMemoryMb, sample.memoryMb);
+            peakCpuMs = Math.max(peakCpuMs, sample.cpuMs);
+            peakProcessCount = Math.max(peakProcessCount, sample.processCount);
+            if (request.limits.memoryMb && sample.memoryMb > request.limits.memoryMb) {
+              terminate("memory_limit");
+            } else if (request.limits.cpuMs && sample.cpuMs > request.limits.cpuMs) {
+              terminate("cpu_limit");
+            } else if (request.limits.maxProcesses && sample.processCount > request.limits.maxProcesses) {
+              terminate("process_limit");
+            }
+          }, 50);
+          const abort = () => terminate("cancelled");
+          request.signal?.addEventListener("abort", abort, { once: true });
+          const append = (stream2, chunk) => {
+            if (stream2 === "stdout") {
+              stdoutBytes += chunk.byteLength;
+              stdout += chunk.toString();
+            } else {
+              stderrBytes += chunk.byteLength;
+              stderr += chunk.toString();
+            }
+            if (stdoutBytes + stderrBytes > maxOutput) {
+              terminate("output_limit");
+            }
+          };
+          child.stdout?.on("data", (chunk) => append("stdout", chunk));
+          child.stderr?.on("data", (chunk) => append("stderr", chunk));
+          child.once("error", (error2) => {
+            if (!settled) {
+              this.logger?.error("process.execution.failed", error2, {
+                component: "process-executor",
+                operation: "execute",
+                processId,
+                executionId: request.identity.executionId,
+                requestId: request.identity.requestId,
+                pluginId: request.identity.pluginId,
+                command: request.command
+              });
+              reject(new GovernedProcessError("PROCESS_SPAWN_FAILED", error2.message));
+            }
+          });
+          child.once("close", (code, signal) => {
+            request.signal?.removeEventListener("abort", abort);
+            finish(code, signal);
+          });
+        });
+      }
+      async cancel(processId, reason = "cancelled") {
+        const cancel = this.cancellers.get(processId);
+        if (cancel) {
+          cancel(reason);
+        }
+        if (reason === "shutdown") {
+          this.cancellers.delete(processId);
+        }
+      }
+      async shutdown() {
+        this.shuttingDown = true;
+        for (const cancel of this.cancellers.values()) {
+          cancel("shutdown");
+        }
+        for (const pid of this.active) {
+          try {
+            process.kill(-pid, "SIGTERM");
+          } catch {
+          }
+        }
+        this.active.clear();
+        this.cancellers.clear();
+      }
+    };
+    DarwinProcessBackend = class extends NodeProcessBackend {
+      capabilities() {
+        return { platform: "darwin", processGroups: true, hardMemoryLimit: false, hardCpuLimit: false, processTreeAccounting: false, maxProcesses: false };
+      }
+    };
+    LinuxProcessBackend = class extends NodeProcessBackend {
+      cgroupRoot = "/sys/fs/cgroup";
+      cgroupAvailable() {
+        try {
+          return fs5.existsSync(path13.join(this.cgroupRoot, "cgroup.controllers")) && fs5.existsSync(path13.join(this.cgroupRoot, "cgroup.procs")) && fs5.accessSync(this.cgroupRoot, fs5.constants.W_OK) === void 0;
+        } catch {
+          return false;
+        }
+      }
+      capabilities() {
+        const cgroup = this.cgroupAvailable();
+        return { platform: "linux", processGroups: true, hardMemoryLimit: cgroup, hardCpuLimit: false, processTreeAccounting: true, maxProcesses: cgroup };
+      }
+      configureProcess(pid, request) {
+        if (!this.cgroupAvailable()) {
+          return () => {
+          };
+        }
+        const group = path13.join(this.cgroupRoot, `kb-plugin-${pid}`);
+        fs5.mkdirSync(group);
+        if (request.limits.memoryMb) {
+          fs5.writeFileSync(path13.join(group, "memory.max"), String(Math.floor(request.limits.memoryMb * 1024 * 1024)));
+        }
+        if (request.limits.maxProcesses) {
+          fs5.writeFileSync(path13.join(group, "pids.max"), String(Math.floor(request.limits.maxProcesses)));
+        }
+        fs5.writeFileSync(path13.join(group, "cgroup.procs"), String(pid));
+        return () => {
+          try {
+            fs5.readFileSync(path13.join(group, "cgroup.procs"), "utf8");
+            fs5.rmSync(group, { recursive: true, force: true });
+          } catch {
+          }
+        };
+      }
+    };
+    registered = /* @__PURE__ */ new WeakMap();
+    BrokeredProcessExecutor = class {
+      constructor(broker, delegate, logger2) {
+        this.broker = broker;
+        this.delegate = delegate;
+        this.logger = logger2;
+      }
+      broker;
+      delegate;
+      logger;
+      capabilities() {
+        return this.delegate.capabilities();
+      }
+      async execute(request) {
+        const resource = `process:shell:${request.identity.pluginId}`;
+        const resources = registered.get(this.broker) ?? /* @__PURE__ */ new Set();
+        if (!resources.has(resource)) {
+          this.broker.registerLimit(resource, { maxConcurrentRequests: request.limits.maxConcurrent ?? 1 });
+          resources.add(resource);
+          registered.set(this.broker, resources);
+        }
+        const deadline = Date.now() + request.limits.timeoutMs;
+        let lastWait = 25;
+        while (Date.now() < deadline) {
+          if (request.signal?.aborted) {
+            throw new GovernedProcessError("PROCESS_CANCELLED", "Shell admission was cancelled");
+          }
+          const acquired = await this.broker.tryAcquire(resource);
+          if (acquired.allowed) {
+            this.logger?.debug("process.execution.admitted", {
+              component: "process-executor",
+              operation: "admission",
+              resource,
+              executionId: request.identity.executionId,
+              requestId: request.identity.requestId,
+              pluginId: request.identity.pluginId
+            });
+            try {
+              return await this.delegate.execute(request);
+            } finally {
+              await acquired.release();
+            }
+          }
+          await new Promise((resolve32) => {
+            setTimeout(resolve32, Math.min(lastWait, acquired.waitTimeMs ?? lastWait));
+          });
+          lastWait = Math.min(lastWait * 2, 500);
+        }
+        throw new GovernedProcessError("PROCESS_ADMISSION_TIMEOUT", "Shell capacity was not available before execution deadline", {
+          resource,
+          timeoutMs: request.limits.timeoutMs
+        });
+      }
+      async shutdown() {
+        await this.delegate.shutdown();
+      }
+      async cancel(processId, reason) {
+        await this.delegate.cancel(processId, reason);
+      }
+    };
   }
 });
 
@@ -19974,11 +20484,11 @@ var require_codegen = __commonJS({
         const rhs = this.rhs === void 0 ? "" : ` = ${this.rhs}`;
         return `${varKind} ${this.name}${rhs};` + _n;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants5) {
         if (!names[this.name.str])
           return;
         if (this.rhs)
-          this.rhs = optimizeExpr(this.rhs, names, constants4);
+          this.rhs = optimizeExpr(this.rhs, names, constants5);
         return this;
       }
       get names() {
@@ -19995,10 +20505,10 @@ var require_codegen = __commonJS({
       render({ _n }) {
         return `${this.lhs} = ${this.rhs};` + _n;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants5) {
         if (this.lhs instanceof code_1.Name && !names[this.lhs.str] && !this.sideEffects)
           return;
-        this.rhs = optimizeExpr(this.rhs, names, constants4);
+        this.rhs = optimizeExpr(this.rhs, names, constants5);
         return this;
       }
       get names() {
@@ -20059,8 +20569,8 @@ var require_codegen = __commonJS({
       optimizeNodes() {
         return `${this.code}` ? this : void 0;
       }
-      optimizeNames(names, constants4) {
-        this.code = optimizeExpr(this.code, names, constants4);
+      optimizeNames(names, constants5) {
+        this.code = optimizeExpr(this.code, names, constants5);
         return this;
       }
       get names() {
@@ -20089,12 +20599,12 @@ var require_codegen = __commonJS({
         }
         return nodes.length > 0 ? this : void 0;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants5) {
         const { nodes } = this;
         let i = nodes.length;
         while (i--) {
           const n = nodes[i];
-          if (n.optimizeNames(names, constants4))
+          if (n.optimizeNames(names, constants5))
             continue;
           subtractNames(names, n.names);
           nodes.splice(i, 1);
@@ -20147,12 +20657,12 @@ var require_codegen = __commonJS({
           return void 0;
         return this;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants5) {
         var _a3;
-        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
-        if (!(super.optimizeNames(names, constants4) || this.else))
+        this.else = (_a3 = this.else) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants5);
+        if (!(super.optimizeNames(names, constants5) || this.else))
           return;
-        this.condition = optimizeExpr(this.condition, names, constants4);
+        this.condition = optimizeExpr(this.condition, names, constants5);
         return this;
       }
       get names() {
@@ -20175,10 +20685,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.iteration})` + super.render(opts);
       }
-      optimizeNames(names, constants4) {
-        if (!super.optimizeNames(names, constants4))
+      optimizeNames(names, constants5) {
+        if (!super.optimizeNames(names, constants5))
           return;
-        this.iteration = optimizeExpr(this.iteration, names, constants4);
+        this.iteration = optimizeExpr(this.iteration, names, constants5);
         return this;
       }
       get names() {
@@ -20214,10 +20724,10 @@ var require_codegen = __commonJS({
       render(opts) {
         return `for(${this.varKind} ${this.name} ${this.loop} ${this.iterable})` + super.render(opts);
       }
-      optimizeNames(names, constants4) {
-        if (!super.optimizeNames(names, constants4))
+      optimizeNames(names, constants5) {
+        if (!super.optimizeNames(names, constants5))
           return;
-        this.iterable = optimizeExpr(this.iterable, names, constants4);
+        this.iterable = optimizeExpr(this.iterable, names, constants5);
         return this;
       }
       get names() {
@@ -20259,11 +20769,11 @@ var require_codegen = __commonJS({
         (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNodes();
         return this;
       }
-      optimizeNames(names, constants4) {
+      optimizeNames(names, constants5) {
         var _a3, _b;
-        super.optimizeNames(names, constants4);
-        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants4);
-        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants4);
+        super.optimizeNames(names, constants5);
+        (_a3 = this.catch) === null || _a3 === void 0 ? void 0 : _a3.optimizeNames(names, constants5);
+        (_b = this.finally) === null || _b === void 0 ? void 0 : _b.optimizeNames(names, constants5);
         return this;
       }
       get names() {
@@ -20564,7 +21074,7 @@ var require_codegen = __commonJS({
     function addExprNames(names, from) {
       return from instanceof code_1._CodeOrName ? addNames(names, from.names) : names;
     }
-    function optimizeExpr(expr, names, constants4) {
+    function optimizeExpr(expr, names, constants5) {
       if (expr instanceof code_1.Name)
         return replaceName(expr);
       if (!canOptimize(expr))
@@ -20579,14 +21089,14 @@ var require_codegen = __commonJS({
         return items;
       }, []));
       function replaceName(n) {
-        const c = constants4[n.str];
+        const c = constants5[n.str];
         if (c === void 0 || names[n.str] !== 1)
           return n;
         delete names[n.str];
         return c;
       }
       function canOptimize(e) {
-        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants4[c.str] !== void 0);
+        return e instanceof code_1._Code && e._items.some((c) => c instanceof code_1.Name && names[c.str] === 1 && constants5[c.str] !== void 0);
       }
     }
     function subtractNames(names, from) {
@@ -22648,15 +23158,14 @@ var require_data = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/lib/utils.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/lib/utils.js"(exports$1, module) {
+  "../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/utils.js"(exports$1, module) {
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
-    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -22799,7 +23308,7 @@ var require_utils = __commonJS({
               continue;
             }
           } else if (input[0] === "/") {
-            if (input[1] === ".") {
+            if (input[1] === "." || input[1] === "/") {
               output.push("/");
               break;
             }
@@ -22881,30 +23390,10 @@ var require_utils = __commonJS({
       }
       return output;
     }
-    var BYTE_HEX = new Array(256);
-    {
-      const HEX_DIGITS = "0123456789ABCDEF";
-      for (let i = 0; i < 256; i++) {
-        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
-      }
-    }
-    function isEscapeSafe(cp2) {
-      return cp2 >= 48 && cp2 <= 57 || cp2 >= 65 && cp2 <= 90 || cp2 >= 97 && cp2 <= 122 || cp2 === 42 || cp2 === 43 || cp2 === 45 || cp2 === 46 || cp2 === 47 || cp2 === 64 || cp2 === 95;
-    }
-    function percentEncodeNonAscii(cp2) {
-      if (cp2 < 2048) {
-        return BYTE_HEX[192 | cp2 >> 6] + BYTE_HEX[128 | cp2 & 63];
-      }
-      if (cp2 < 65536) {
-        return BYTE_HEX[224 | cp2 >> 12] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
-      }
-      return BYTE_HEX[240 | cp2 >> 18] + BYTE_HEX[128 | cp2 >> 12 & 63] + BYTE_HEX[128 | cp2 >> 6 & 63] + BYTE_HEX[128 | cp2 & 63];
-    }
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
+        if (input[i] === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             const normalizedHex = hex3.toUpperCase();
@@ -22918,66 +23407,10 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(ch)) {
-          output += ch;
+        if (isPathCharacter(input[i])) {
+          output += input[i];
         } else {
-          const code = input.charCodeAt(i);
-          if (code < 128) {
-            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
-          } else if (code < 55296 || code > 57343) {
-            output += percentEncodeNonAscii(code);
-          } else if (code <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
-        }
-      }
-      return output;
-    }
-    function normalizeQueryFragmentEncoding(input) {
-      let output = "";
-      for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
-          const hex3 = input.slice(i + 1, i + 3);
-          if (isHexPair(hex3)) {
-            const normalizedHex = hex3.toUpperCase();
-            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
-            if (isUnreserved(decoded)) {
-              output += decoded;
-            } else {
-              output += "%" + normalizedHex;
-            }
-            i += 2;
-            continue;
-          }
-        }
-        if (isQueryFragmentCharacter(ch)) {
-          output += ch;
-        } else {
-          const code = input.charCodeAt(i);
-          if (code < 128) {
-            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
-          } else if (code < 55296 || code > 57343) {
-            output += percentEncodeNonAscii(code);
-          } else if (code <= 56319 && i + 1 < input.length) {
-            const low = input.charCodeAt(i + 1);
-            if (low >= 56320 && low <= 57343) {
-              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
-              i++;
-            } else {
-              output += percentEncodeNonAscii(65533);
-            }
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
+          output += escape(input[i]);
         }
       }
       return output;
@@ -22985,8 +23418,7 @@ var require_utils = __commonJS({
     function escapePreservingEscapes(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        const ch = input[i];
-        if (ch === "%" && i + 2 < input.length) {
+        if (input[i] === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             output += "%" + hex3.toUpperCase();
@@ -22994,22 +23426,7 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        const code = input.charCodeAt(i);
-        if (code < 128) {
-          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
-        } else if (code < 55296 || code > 57343) {
-          output += percentEncodeNonAscii(code);
-        } else if (code <= 56319 && i + 1 < input.length) {
-          const low = input.charCodeAt(i + 1);
-          if (low >= 56320 && low <= 57343) {
-            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
-            i++;
-          } else {
-            output += percentEncodeNonAscii(65533);
-          }
-        } else {
-          output += percentEncodeNonAscii(65533);
-        }
+        output += escape(input[i]);
       }
       return output;
     }
@@ -23043,7 +23460,6 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
-      normalizeQueryFragmentEncoding,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -23054,9 +23470,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/lib/schemes.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/lib/schemes.js"(exports$1, module) {
+  "../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/lib/schemes.js"(exports$1, module) {
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
     var supportedSchemeNames = (
@@ -23263,10 +23679,10 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/index.js
+// ../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../../node_modules/.pnpm/fast-uri@4.1.1/node_modules/fast-uri/index.js"(exports$1, module) {
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+  "../../../node_modules/.pnpm/fast-uri@3.1.5/node_modules/fast-uri/index.js"(exports$1, module) {
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize4(uri, options) {
       if (typeof uri === "string") {
@@ -23280,7 +23696,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve9(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse5(baseURI, schemelessOptions), parse5(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize2(resolved, schemelessOptions);
     }
@@ -23406,6 +23827,7 @@ var require_fast_uri = __commonJS({
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
     var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -23440,9 +23862,23 @@ var require_fast_uri = __commonJS({
         parsed.error = "URI authority must not contain a literal backslash.";
         malformedAuthorityOrPort = true;
       }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
+        parsed.scheme = matches[1];
         parsed.userinfo = matches[3];
         parsed.host = matches[4];
         parsed.port = parseInt(matches[5], 10);
@@ -23501,11 +23937,12 @@ var require_fast_uri = __commonJS({
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
-          if (parsed.query) {
-            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
-          }
           if (parsed.fragment) {
-            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
+            try {
+              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
+            } catch {
+              parsed.error = parsed.error || "URI malformed";
+            }
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -27159,6 +27596,7 @@ __export(dist_exports2, {
   createExecutionId: () => createExecutionId,
   createIsolatedExecutionBackend: () => createIsolatedExecutionBackend,
   createTimeoutPromise: () => createTimeoutPromise,
+  ensureHostProcessExecutor: () => ensureHostProcessExecutor,
   isExecutionLayerError: () => isExecutionLayerError,
   isKnownErrorCode: () => isKnownErrorCode,
   localWorkspaceManager: () => localWorkspaceManager,
@@ -27339,7 +27777,19 @@ function createDefaultIPCServerFactory() {
     }
   };
 }
+function ensureHostProcessExecutor(platform2) {
+  const host = platform2;
+  if (host.processExecutor || !host.setAdapter || host.hasResourceBroker !== true || !host.resourceBroker) {
+    return;
+  }
+  host.setAdapter("processExecutor", new BrokeredProcessExecutor(
+    host.resourceBroker,
+    createDefaultProcessExecutor(host.logger),
+    host.logger
+  ));
+}
 function createExecutionBackend(options) {
+  ensureHostProcessExecutor(options.platform);
   const mode = options.mode === "auto" || !options.mode ? detectMode() : options.mode;
   switch (mode) {
     case "in-process":
@@ -27777,7 +28227,9 @@ var init_dist9 = __esm({
             }
           } : void 0;
           const loggerOverride = requestToExecute.context?.loggerOverride;
-          const effectivePlatform = loggerOverride ? { ...this.platform, logger: loggerOverride } : this.platform;
+          const effectivePlatform = loggerOverride ? Object.create(this.platform, {
+            logger: { value: loggerOverride, enumerable: true, configurable: true }
+          }) : this.platform;
           const adapterMiddlewares = await this.getMiddlewares();
           const runResult = await runInProcess({
             descriptor: requestToExecute.descriptor,
@@ -37159,7 +37611,7 @@ var require_thread_stream = __commonJS({
     var { version: version3 } = require_package();
     var { EventEmitter: EventEmitter3 } = __require("events");
     var { Worker: Worker2 } = __require("worker_threads");
-    var { join: join11 } = __require("path");
+    var { join: join12 } = __require("path");
     var { pathToFileURL: pathToFileURL4 } = __require("url");
     var { wait } = require_wait();
     var {
@@ -37195,7 +37647,7 @@ var require_thread_stream = __commonJS({
     function createWorker(stream2, opts) {
       const { filename, workerData } = opts;
       const bundlerOverrides = "__bundlerPathsOverrides" in globalThis ? globalThis.__bundlerPathsOverrides : {};
-      const toExecute = bundlerOverrides["thread-stream-worker"] || join11(__dirname, "lib", "worker.js");
+      const toExecute = bundlerOverrides["thread-stream-worker"] || join12(__dirname, "lib", "worker.js");
       const worker = new Worker2(toExecute, {
         ...opts.workerOpts,
         trackUnmanagedFds: false,
@@ -37583,9 +38035,9 @@ var require_thread_stream = __commonJS({
 var require_transport = __commonJS({
   "../../../node_modules/.pnpm/pino@10.3.1/node_modules/pino/lib/transport.js"(exports$1, module) {
     var { createRequire: createRequire4 } = __require("module");
-    var { existsSync: existsSync10 } = __require("fs");
+    var { existsSync: existsSync11 } = __require("fs");
     var getCallers = require_caller();
-    var { join: join11, isAbsolute, sep: sep3 } = __require("path");
+    var { join: join12, isAbsolute, sep: sep3 } = __require("path");
     var { fileURLToPath: fileURLToPath6 } = __require("url");
     var sleep3 = require_atomic_sleep();
     var onExit = require_on_exit_leak_free();
@@ -37657,7 +38109,7 @@ var require_transport = __commonJS({
           return false;
         }
       }
-      return isAbsolute(path15) && !existsSync10(path15);
+      return isAbsolute(path15) && !existsSync11(path15);
     }
     function stripQuotes(value) {
       const first = value[0];
@@ -37738,7 +38190,7 @@ var require_transport = __commonJS({
         throw new Error("only one of target or targets can be specified");
       }
       if (targets) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join12(__dirname, "worker.js");
         options.targets = targets.filter((dest) => dest.target).map((dest) => {
           return {
             ...dest,
@@ -37756,7 +38208,7 @@ var require_transport = __commonJS({
           });
         });
       } else if (pipeline) {
-        target = bundlerOverrides["pino-worker"] || join11(__dirname, "worker.js");
+        target = bundlerOverrides["pino-worker"] || join12(__dirname, "worker.js");
         options.pipelines = [pipeline.map((dest) => {
           return {
             ...dest,
@@ -37779,7 +38231,7 @@ var require_transport = __commonJS({
           return origin;
         }
         if (origin === "pino/file") {
-          return join11(__dirname, "..", "file.js");
+          return join12(__dirname, "..", "file.js");
         }
         let fixTarget2;
         for (const filePath of callers) {
@@ -38754,7 +39206,7 @@ var require_safe_stable_stringify = __commonJS({
               return circularValue;
             }
             let res = "";
-            let join11 = ",";
+            let join12 = ",";
             const originalIndentation = indentation;
             if (Array.isArray(value)) {
               if (value.length === 0) {
@@ -38768,7 +39220,7 @@ var require_safe_stable_stringify = __commonJS({
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join12 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -38776,13 +39228,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join12;
               }
               const tmp = stringifyFnReplacer(String(i), value, stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -38803,7 +39255,7 @@ ${originalIndentation}`;
             let separator = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join12 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -38817,13 +39269,13 @@ ${indentation}`;
               const tmp = stringifyFnReplacer(key2, value, stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join12;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...":${whitespace}"${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join12;
             }
             if (spacer !== "" && separator.length > 1) {
               res = `
@@ -38864,7 +39316,7 @@ ${originalIndentation}`;
             }
             const originalIndentation = indentation;
             let res = "";
-            let join11 = ",";
+            let join12 = ",";
             if (Array.isArray(value)) {
               if (value.length === 0) {
                 return "[]";
@@ -38877,7 +39329,7 @@ ${originalIndentation}`;
                 indentation += spacer;
                 res += `
 ${indentation}`;
-                join11 = `,
+                join12 = `,
 ${indentation}`;
               }
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
@@ -38885,13 +39337,13 @@ ${indentation}`;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
                 res += tmp2 !== void 0 ? tmp2 : "null";
-                res += join11;
+                res += join12;
               }
               const tmp = stringifyArrayReplacer(String(i), value[i], stack, replacer, spacer, indentation);
               res += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res += `${join11}"... ${getItemCount(removedKeys)} not stringified"`;
+                res += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               if (spacer !== "") {
                 res += `
@@ -38904,7 +39356,7 @@ ${originalIndentation}`;
             let whitespace = "";
             if (spacer !== "") {
               indentation += spacer;
-              join11 = `,
+              join12 = `,
 ${indentation}`;
               whitespace = " ";
             }
@@ -38913,7 +39365,7 @@ ${indentation}`;
               const tmp = stringifyArrayReplacer(key2, value[key2], stack, replacer, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}:${whitespace}${tmp}`;
-                separator = join11;
+                separator = join12;
               }
             }
             if (spacer !== "" && separator.length > 1) {
@@ -38971,20 +39423,20 @@ ${originalIndentation}`;
               indentation += spacer;
               let res2 = `
 ${indentation}`;
-              const join12 = `,
+              const join13 = `,
 ${indentation}`;
               const maximumValuesToStringify = Math.min(value.length, maximumBreadth);
               let i = 0;
               for (; i < maximumValuesToStringify - 1; i++) {
                 const tmp2 = stringifyIndent(String(i), value[i], stack, spacer, indentation);
                 res2 += tmp2 !== void 0 ? tmp2 : "null";
-                res2 += join12;
+                res2 += join13;
               }
               const tmp = stringifyIndent(String(i), value[i], stack, spacer, indentation);
               res2 += tmp !== void 0 ? tmp : "null";
               if (value.length - 1 > maximumBreadth) {
                 const removedKeys = value.length - maximumBreadth - 1;
-                res2 += `${join12}"... ${getItemCount(removedKeys)} not stringified"`;
+                res2 += `${join13}"... ${getItemCount(removedKeys)} not stringified"`;
               }
               res2 += `
 ${originalIndentation}`;
@@ -39000,16 +39452,16 @@ ${originalIndentation}`;
               return '"[Object]"';
             }
             indentation += spacer;
-            const join11 = `,
+            const join12 = `,
 ${indentation}`;
             let res = "";
             let separator = "";
             let maximumPropertiesToStringify = Math.min(keyLength, maximumBreadth);
             if (isTypedArrayWithEntries(value)) {
-              res += stringifyTypedArray(value, join11, maximumBreadth);
+              res += stringifyTypedArray(value, join12, maximumBreadth);
               keys = keys.slice(value.length);
               maximumPropertiesToStringify -= value.length;
-              separator = join11;
+              separator = join12;
             }
             if (deterministic) {
               keys = sort(keys, comparator);
@@ -39020,13 +39472,13 @@ ${indentation}`;
               const tmp = stringifyIndent(key2, value[key2], stack, spacer, indentation);
               if (tmp !== void 0) {
                 res += `${separator}${strEscape(key2)}: ${tmp}`;
-                separator = join11;
+                separator = join12;
               }
             }
             if (keyLength > maximumBreadth) {
               const removedKeys = keyLength - maximumBreadth;
               res += `${separator}"...": "${getItemCount(removedKeys)} not stringified"`;
-              separator = join11;
+              separator = join12;
             }
             if (separator !== "") {
               res = `
@@ -50873,7 +51325,7 @@ var require_subset = __commonJS({
 var require_semver2 = __commonJS({
   "../../../node_modules/.pnpm/semver@7.7.4/node_modules/semver/index.js"(exports$1, module) {
     var internalRe = require_re();
-    var constants4 = require_constants2();
+    var constants5 = require_constants2();
     var SemVer = require_semver();
     var identifiers = require_identifiers();
     var parse5 = require_parse2();
@@ -50955,8 +51407,8 @@ var require_semver2 = __commonJS({
       re: internalRe.re,
       src: internalRe.src,
       tokens: internalRe.t,
-      SEMVER_SPEC_VERSION: constants4.SEMVER_SPEC_VERSION,
-      RELEASE_TYPES: constants4.RELEASE_TYPES,
+      SEMVER_SPEC_VERSION: constants5.SEMVER_SPEC_VERSION,
+      RELEASE_TYPES: constants5.RELEASE_TYPES,
       compareIdentifiers: identifiers.compareIdentifiers,
       rcompareIdentifiers: identifiers.rcompareIdentifiers
     };
@@ -56593,7 +57045,7 @@ var require_parse_url = __commonJS({
 // ../../../node_modules/.pnpm/light-my-request@6.6.0/node_modules/light-my-request/lib/form-data.js
 var require_form_data = __commonJS({
   "../../../node_modules/.pnpm/light-my-request@6.6.0/node_modules/light-my-request/lib/form-data.js"(exports$1, module) {
-    var { randomUUID: randomUUID11 } = __require("crypto");
+    var { randomUUID: randomUUID12 } = __require("crypto");
     var { Readable: Readable2 } = __require("stream");
     var textEncoder;
     function isFormDataLike(payload) {
@@ -56601,23 +57053,23 @@ var require_form_data = __commonJS({
     }
     function formDataToStream(formdata) {
       textEncoder = textEncoder ?? new TextEncoder();
-      const boundary = `----formdata-${randomUUID11()}`;
+      const boundary = `----formdata-${randomUUID12()}`;
       const prefix = `--${boundary}\r
 Content-Disposition: form-data`;
-      const escape2 = (str) => str.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
+      const escape3 = (str) => str.replace(/\n/g, "%0A").replace(/\r/g, "%0D").replace(/"/g, "%22");
       const normalizeLinefeeds = (value) => value.replace(/\r?\n|\r/g, "\r\n");
       const linebreak = new Uint8Array([13, 10]);
       async function* asyncIterator() {
         for (const [name, value] of formdata) {
           if (typeof value === "string") {
-            yield textEncoder.encode(`${prefix}; name="${escape2(normalizeLinefeeds(name))}"\r
+            yield textEncoder.encode(`${prefix}; name="${escape3(normalizeLinefeeds(name))}"\r
 \r
 `);
             yield textEncoder.encode(`${normalizeLinefeeds(value)}\r
 `);
           } else {
-            let header = `${prefix}; name="${escape2(normalizeLinefeeds(name))}"`;
-            value.name && (header += `; filename="${escape2(value.name)}"`);
+            let header = `${prefix}; name="${escape3(normalizeLinefeeds(name))}"`;
+            value.name && (header += `; filename="${escape3(value.name)}"`);
             header += `\r
 Content-Type: ${value.type || "application/octet-stream"}\r
 \r
@@ -70669,26 +71121,26 @@ var require_escape_html = __commonJS({
       if (!match2) {
         return str;
       }
-      var escape2;
+      var escape3;
       var html = "";
       var index = 0;
       var lastIndex = 0;
       for (index = match2.index; index < str.length; index++) {
         switch (str.charCodeAt(index)) {
           case 34:
-            escape2 = "&quot;";
+            escape3 = "&quot;";
             break;
           case 38:
-            escape2 = "&amp;";
+            escape3 = "&amp;";
             break;
           case 39:
-            escape2 = "&#39;";
+            escape3 = "&#39;";
             break;
           case 60:
-            escape2 = "&lt;";
+            escape3 = "&lt;";
             break;
           case 62:
-            escape2 = "&gt;";
+            escape3 = "&gt;";
             break;
           default:
             continue;
@@ -70697,7 +71149,7 @@ var require_escape_html = __commonJS({
           html += str.substring(lastIndex, index);
         }
         lastIndex = index + 1;
-        html += escape2;
+        html += escape3;
       }
       return lastIndex !== index ? html + str.substring(lastIndex, index) : html;
     }
@@ -71656,7 +72108,7 @@ var require_send = __commonJS({
     var { parseTokenList } = require_parseTokenList();
     var { createHttpError } = require_createHttpError();
     var extname3 = path15.extname;
-    var join11 = path15.join;
+    var join12 = path15.join;
     var normalize4 = path15.normalize;
     var resolve9 = path15.resolve;
     var sep3 = path15.sep;
@@ -71743,7 +72195,7 @@ var require_send = __commonJS({
           return { statusCode: 403 };
         }
         parts = path16.split(sep3);
-        path16 = normalize4(join11(root, path16));
+        path16 = normalize4(join12(root, path16));
       } else {
         if (UP_PATH_REGEXP.test(path16)) {
           debug('malicious path "%s"', path16);
@@ -72026,7 +72478,7 @@ var require_send = __commonJS({
       let err;
       for (let i = 0; i < options.index.length; i++) {
         const index = options.index[i];
-        const p = join11(path16, index);
+        const p = join12(path16, index);
         const { error: error2, stat: stat2 } = await tryStat(p);
         if (error2) {
           err = error2;
@@ -79613,6 +80065,10 @@ var init_container = __esm3({
       get hasResourceBroker() {
         return this._resourceBroker !== void 0;
       }
+      /** Platform-owned process executor. Never exposed through governed plugin adapters. */
+      get processExecutor() {
+        return this.getAdapter("processExecutor");
+      }
       /**
        * Initialize core features.
        * Called internally by initPlatform().
@@ -84277,6 +84733,16 @@ async function initPlatform(config2 = {}, cwd = process.cwd(), uiProvider, platf
           error: error2 instanceof Error ? error2.message : String(error2)
         });
       }
+      if (_assemblyBroker && !platform.processExecutor) {
+        try {
+          const { ensureHostProcessExecutor: ensureHostProcessExecutor2 } = await Promise.resolve().then(() => (init_dist9(), dist_exports2));
+          ensureHostProcessExecutor2(platform);
+        } catch (error2) {
+          platform.logger.warn("Failed to initialize governed process executor", {
+            error: error2 instanceof Error ? error2.message : String(error2)
+          });
+        }
+      }
       if (assemblyHook && _assemblyBroker) {
         const llmOptions = adapterOptions.llm ?? {};
         const executionDefaults = llmOptions.executionDefaults;
@@ -85097,6 +85563,7 @@ init_llm_proxy();
 init_embeddings_proxy();
 init_vector_store_proxy();
 init_storage_proxy();
+init_remote_adapter();
 init_container();
 init_adapter_status();
 
@@ -97337,10 +97804,10 @@ var Server = class extends Protocol {
   }
 };
 
-// ../../../node_modules/.pnpm/@hono+node-server@2.0.11_hono@4.12.32/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
+// ../../../node_modules/.pnpm/@hono+node-server@2.0.11_hono@4.13.0/node_modules/@hono/node-server/dist/constants-BLSFu_RU.mjs
 var X_ALREADY_SENT = "x-hono-already-sent";
 
-// ../../../node_modules/.pnpm/@hono+node-server@2.0.11_hono@4.12.32/node_modules/@hono/node-server/dist/index.mjs
+// ../../../node_modules/.pnpm/@hono+node-server@2.0.11_hono@4.13.0/node_modules/@hono/node-server/dist/index.mjs
 var RequestError = class extends Error {
   constructor(message2, options) {
     super(message2, options);
@@ -101470,7 +101937,7 @@ var range = (a, b, str) => {
   return result;
 };
 
-// ../../../node_modules/.pnpm/brace-expansion@5.0.8/node_modules/brace-expansion/dist/esm/index.js
+// ../../../node_modules/.pnpm/brace-expansion@5.0.9/node_modules/brace-expansion/dist/esm/index.js
 var escSlash = "\0SLASH" + Math.random() + "\0";
 var escOpen = "\0OPEN" + Math.random() + "\0";
 var escClose = "\0CLOSE" + Math.random() + "\0";
@@ -101557,7 +102024,7 @@ function combine(acc, pre, values, max, maxLength, dropEmpties) {
   }
   return out;
 }
-function expandSequence(body, isAlphaSequence, max) {
+function expandSequence(body, isAlphaSequence, max, maxLength) {
   const n = body.split(/\.\./);
   const N = [];
   if (n[0] === void 0 || n[1] === void 0) {
@@ -101574,6 +102041,7 @@ function expandSequence(body, isAlphaSequence, max) {
     test = gte;
   }
   const pad = n.some(isPadded);
+  let length = 0;
   for (let i = x; test(i, y) && N.length < max; i += incr) {
     let c;
     if (isAlphaSequence) {
@@ -101595,7 +102063,10 @@ function expandSequence(body, isAlphaSequence, max) {
         }
       }
     }
+    if (length + c.length > maxLength)
+      break;
     N.push(c);
+    length += c.length;
   }
   return N;
 }
@@ -101635,7 +102106,7 @@ function expand_(str, max, maxLength, isTop) {
     }
     let values;
     if (isSequence) {
-      values = expandSequence(m.body, isAlphaSequence, max);
+      values = expandSequence(m.body, isAlphaSequence, max, maxLength);
     } else {
       let n = parseCommaParts(m.body);
       if (n.length === 1 && n[0] !== void 0) {
@@ -101648,9 +102119,26 @@ function expand_(str, max, maxLength, isTop) {
           continue;
         }
       }
+      let dropsEmpties = dropEmpties && !m.post.length && !pre;
+      for (let d = 0; dropsEmpties && d < acc.length; d++) {
+        if (acc[d]) {
+          dropsEmpties = false;
+        }
+      }
       values = [];
-      for (let j2 = 0; j2 < n.length; j2++) {
-        values.push.apply(values, expand_(n[j2], max, maxLength, false));
+      let valuesLength = 0;
+      outer: for (let j2 = 0; j2 < n.length; j2++) {
+        const expanded = expand_(n[j2], max, maxLength, false);
+        for (let k = 0; k < expanded.length; k++) {
+          const v = expanded[k];
+          if (dropsEmpties && !v)
+            continue;
+          if (values.length >= max || valuesLength + v.length > maxLength) {
+            break outer;
+          }
+          values.push(v);
+          valuesLength += v.length;
+        }
       }
     }
     acc = combine(acc, pre, values, max, maxLength, dropEmpties && !m.post.length);
@@ -102434,7 +102922,7 @@ var AST = class {
 _a2 = AST;
 
 // ../../../node_modules/.pnpm/minimatch@10.2.5/node_modules/minimatch/dist/esm/escape.js
-var escape = (s, { windowsPathsNoEscape = false, magicalBraces = false } = {}) => {
+var escape2 = (s, { windowsPathsNoEscape = false, magicalBraces = false } = {}) => {
   if (magicalBraces) {
     return windowsPathsNoEscape ? s.replace(/[?*()[\]{}]/g, "[$&]") : s.replace(/[?*()[\]\\{}]/g, "\\$&");
   }
@@ -103247,7 +103735,7 @@ var Minimatch = class {
 };
 minimatch.AST = AST;
 minimatch.Minimatch = Minimatch;
-minimatch.escape = escape;
+minimatch.escape = escape2;
 minimatch.unescape = unescape2;
 var S = diagnostics_channel.channel("lru-cache:metrics");
 var W = diagnostics_channel.tracingChannel("lru-cache");
@@ -107486,7 +107974,7 @@ var glob = Object.assign(glob_, {
   iterateSync,
   Glob,
   hasMagic,
-  escape,
+  escape: escape2,
   unescape: unescape2
 });
 glob.glob = glob;
@@ -109329,7 +109817,7 @@ var init_discover = __esm5({
     init_path();
     init_schema();
     DISCOVERY_VERSION = 2;
-    DEBUG_MODE = process.env.DEBUG_SANDBOX === "1" || process.env.NODE_ENV === "development";
+    DEBUG_MODE = process.env.DEBUG_SANDBOX === "1" || process.env.KB_DISCOVERY_DEBUG === "1";
     log = (level, message2, fields) => {
       if (!DEBUG_MODE) {
         return;
@@ -109539,16 +110027,16 @@ var TrieRouter = class {
       const tok = tokens[i];
       const child = node.children.get(tok);
       if (!child) {
+        if (node.command && i > 0) {
+          return { type: "command", command: node.command, rest: tokens.slice(i) };
+        }
+        if (node.systemCommand && i > 0) {
+          return { type: "system-cmd", cmd: node.systemCommand, rest: tokens.slice(i) };
+        }
         return this._notFound(node, tokens, i);
       }
       node = child;
       i++;
-      if (node.command && i < tokens.length) {
-        return { type: "command", command: node.command, rest: tokens.slice(i) };
-      }
-      if (node.systemCommand && i < tokens.length) {
-        return { type: "system-cmd", cmd: node.systemCommand, rest: tokens.slice(i) };
-      }
     }
     if (node.command) {
       return { type: "command", command: node.command, rest: [] };