@kodax-ai/kodax 0.7.96-beta.2 → 0.7.96-beta.3

package/CHANGELOG.md

@@ -6,6 +6,35 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+---
+
+## [0.7.96-beta.3] - 2026-09-08
+
+Third beta pre-release of the v0.7.96 line, retaining beta.2 context recovery
+and Provider fixes. npm publication remains a manual maintainer action.
+
+### Fixed
+
+- Repair Windows WFP probe allocation in KodaX doctor and ASRT 0.0.65: bind
+  bounded distinct candidates below the proxy permit range and keep successful
+  listeners alive through verification. SDK bundles, standalone binaries, and
+  npm tarballs ship the audited dependency patch, including installs with
+  `--ignore-scripts`. Build/pack rejects unexpected dependency source bytes.
+  Build/pack CLI entry detection resolves real paths so linked workspaces and
+  macOS temporary-directory aliases execute the patch and validation checks.
+  Windows allocation, installed-package, and packaged Electron gates cover
+  delivery and behavior; native protocol/setup and permission contracts stay unchanged.
+
+- Separate production and source-test TypeScript checks while retaining SDK
+  packaging and public entry points. Correct stale test contracts, await the
+  memory-review Session ID, complete A2A task-state projection, and return the
+  existing daemon-only error from embedded scoped credential methods.
+- Retire the old RPC connection and socket when the same authenticated client
+  identity takes over the credential/Host Tool reverse bridge. Clients now
+  observe a reconnectable disconnect instead of remaining RPC-connected with
+  an unusable credential channel. Reconnection can resume live scoped leases;
+  stale closes/replies cannot detach the successor or replay dispatched tools.
+
 ## [0.7.96-beta.2] - 2026-09-07
 
 Second beta pre-release of the v0.7.96 line: it retains the beta.1 sandbox-
@@ -5160,7 +5189,7 @@ repl            → coding, skills
 ### Tests
 - Added / expanded tests for `task-engine`, `reasoning`, `tool-display`, `live-streaming`, `StatusBar`, `invocation-runtime`, `types-legacy`, and `InkREPL.interrupted`
 
-<!-- last-sync: dfce6cd5 -->
+<!-- last-sync: 173418a417899899cb3757309f72d9066efd6f56 -->
 
 ### Added
 - **Repository intelligence substrate (FEATURE_018)**: Task-aware repository intelligence layer under `.agent/repo-intelligence/` with durable artifacts — `repo-overview.json`, `changed-scope.json`, `module-index.json`, `symbol-index.json`, `process-index.json`, `repo-intelligence-manifest.json` — supporting incremental refresh, freshness metadata, and language-tiered extraction (TS/JS via AST, Python, Go, Rust, Java, C++)

package/README.md

@@ -759,7 +759,9 @@ permission UI, and recovers stale prepared Session tails through an
 authoritative merge. Background persistence failures are surfaced as
 diagnostics rather than hidden.
 
-**v0.7.96-beta.2 release:** Windows shell admission now follows the
+Beta.3 repairs Windows WFP probe allocation in KodaX doctor and the bundled ASRT 0.0.65 dependency. SDK installs with `--ignore-scripts` receive the repair. Authenticated credential/Host Tool bridge takeover retires the old RPC connection so clients can reconnect and resume live scoped leases without replaying dispatched tools. Production and source-test TypeScript checks are separate; public SDK entry points remain unchanged.
+
+**v0.7.96-beta.3 release:** Windows shell admission now follows the
 Codex concurrency boundary: versioned setup performs legacy migration once,
 while ordinary admission accepts effective inherited normal-token access and
 only converges a missing exact-root restricted capability using `SET_ACCESS`
@@ -808,7 +810,7 @@ requests, preserves structured Child Agent Provider failures, honors exact
 run-scoped credential verification, and omits empty `tools` arrays for strict
 vLLM gateways (Issues 329-332). npm publication remains a
 manual maintainer action. See the
-[release checklist](docs/release.md#v0796-beta2-release-preparation).
+[release checklist](docs/release.md#v0796-beta3-release-preparation).
 
 **v0.7.96-alpha.3 release:** Provider credentials are lazy, scoped,
 revocable capabilities (ADR-068). The v2 credential broker keeps Provider

package/README_CN.md

@@ -296,7 +296,9 @@ SDK 系统代码契约更新，但没有放宽 shell/sandbox 的 fail-closed 边
 `handleRuntimePermissionRequest()` 管理 SDK 权限 UI，并在 prepared Session 尾部遇到
 `data_changed` 时通过权威 delta 合并恢复；后台持久化失败会显示为诊断，不再静默丢失。
 
-**v0.7.96-beta.2 发布**：Windows shell 准入现在遵循 Codex 的并发边界：
+beta.3 修复 KodaX doctor 和随包 ASRT 0.0.65 的 Windows WFP 探测端口分配；SDK 即使使用 `--ignore-scripts` 安装也包含修复。相同认证身份接管凭据/Host Tool 桥接时，旧 RPC 连接会断开，客户端可重连并恢复有效租约，已派发工具不会重放。生产代码与源码测试分别执行严格类型检查，SDK 公开入口保持不变。
+
+**v0.7.96-beta.3 发布**：Windows shell 准入现在遵循 Codex 的并发边界：
 版本化 setup 只执行一次 legacy 迁移；普通准入在 capability 已存在时只读，只有缺失
 精确 root restricted capability 时才用 `SET_ACCESS` 与 DACL 回读收敛，且不等待任何
 跨进程目标互斥锁。稳定 filesystem capability SID 保留在对象上，每条命令的 token
@@ -334,7 +336,7 @@ native 文本权威改在摘要固定的 `manylinux_2_28` 构建器中编译，
 scope 在 SDK、Agent 摘要、CLI 与 Runtime Worker 请求间共享，保留结构化的 Child Agent Provider
 失败信息，精确遵循 run-scoped 凭据校验，并为严格 vLLM 网关省略空 `tools` 数组（Issues 329-332）。
 npm 发布仍由
-维护者手动执行。详见 [v0.7.96-beta.2 发布清单](docs/release.md#v0796-beta2-release-preparation)。
+维护者手动执行。详见 [v0.7.96-beta.3 发布清单](docs/release.md#v0796-beta3-release-preparation)。
 
 **v0.7.96-alpha.3 发布**：Provider 凭据成为惰性、受限、可撤销的能力（ADR-068）。v2
 credential broker 将 Provider 密钥保留在 OS keychain，按每次 wire call、为单一封闭

package/dist/chunks/{agent-QGVCIM5U.js → agent-AGJEZOXZ.js}

@@ -1,2 +1,2 @@
 // @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
-import{Aa as e,Ba as f,Ra as g,Ta as h,a as c,gb as i,hb as j,pb as k,za as d}from"./chunk-HV4L23QZ.js";import"./chunk-HK4767SO.js";import"./chunk-TWXMMQ26.js";import"./chunk-IOR23YGO.js";import"./chunk-KGG5EDZN.js";import{Ob as a,Pb as b}from"./chunk-JM6QBNUM.js";import"./chunk-W764RSKQ.js";import"./chunk-SHXBOMIB.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};
+import{Aa as e,Ba as f,Ra as g,Ta as h,a as c,gb as i,hb as j,pb as k,za as d}from"./chunk-QLR3IZKV.js";import"./chunk-HK4767SO.js";import"./chunk-25LFDCMP.js";import"./chunk-IOR23YGO.js";import"./chunk-KGG5EDZN.js";import{Ob as a,Pb as b}from"./chunk-JM6QBNUM.js";import"./chunk-W764RSKQ.js";import"./chunk-SHXBOMIB.js";import"./chunk-ONUPGMER.js";export{e as bucketProviderPayloadSize,g as buildAutoRepoIntelligenceContext,f as checkPromiseSignal,b as cleanupIncompleteToolCalls,h as describeTransientProviderRetry,c as emitResilienceDebug,d as estimateProviderPayloadBytes,k as runKodaX,j as saveRequiredSessionSnapshot,i as saveSessionSnapshot,a as validateAndFixToolHistory};

package/dist/chunks/argument-completer-UH2SHQ5R.js

@@ -0,0 +1,2 @@
+// @kodax-ai/kodax — bundled distribution. See docs/ADR.md ADR-022 + ADR-024.
+import{Ma as a,Na as b}from"./chunk-MZSC5OWE.js";import"./chunk-ZFAX6QYE.js";import"./chunk-DWLYVWFJ.js";import"./chunk-JN4BW4KX.js";import"./chunk-ZGKIV7ZU.js";import"./chunk-QLR3IZKV.js";import"./chunk-HK4767SO.js";import"./chunk-6RP5I7VG.js";import"./chunk-25LFDCMP.js";import"./chunk-IOR23YGO.js";import"./chunk-KGG5EDZN.js";import"./chunk-JM6QBNUM.js";import"./chunk-W764RSKQ.js";import"./chunk-SHXBOMIB.js";import"./chunk-ONUPGMER.js";export{a as ArgumentCompleter,b as createArgumentCompleter};

package/dist/chunks/{chunk-TWXMMQ26.js → chunk-25LFDCMP.js}

@@ -21,7 +21,7 @@ ${t.join(`
 `),sources:[{label:"provider capabilities",path:"packages/llm/src/providers/provider-capabilities.json"}],nextTopics:["custom-providers","config","troubleshooting"]},{id:"custom-providers",title:"Custom providers",aliases:["custom provider","baseurl","openai compatible","\u81EA\u5B9A\u4E49\u4F9B\u5E94\u5546","\u81EA\u5B9A\u4E49\u6A21\u578B"],summary:"Point KodaX at an OpenAI/Anthropic-compatible endpoint, incl. thinking config.",body:["Run `kodax setup --custom` for an explained interactive writer, or add a","`customProviders` entry in ~/.kodax/config.json for an OpenAI/Anthropic-compatible","endpoint: specify the protocol, baseUrl, API-key environment-variable name, and model.","The wizard explains the local alias, protocol family, provider-documentation Base URL,","environment-variable name, and model identifier; it never asks for a credential value.","KodaX infers a verifyStrategy from the protocol; you can override it explicitly.","Once added, the custom provider is selectable like any built-in one.","","Thinking / reasoning (set on the provider, or per-model in models[]):","- supportsThinking: true is enough for most non-Claude models. With a bare","  supportsThinking: true (no explicit reasoningPreset/reasoningProfile), openai-compat","  stays passive \u2014 KodaX sends no thinking toggle and just surfaces the reasoning the",'  model emits; anthropic-compat sends thinking:{type:"enabled"}, which is what the',"  Anthropic-compatible endpoints of zhipu / kimi / minimax / deepseek expect. (An","  explicit reasoningPreset/reasoningProfile can send a toggle on openai-compat too.)","- openai-compat multi-turn caveat: some reasoning models (notably DeepSeek V4) reject a","  later turn whose history drops the prior reasoning_content. If thinking shows on the","  first turn but a follow-up errors, also set replayReasoningContent: true (per-provider","  or per-model).","- OpenAI-compatible relays that reject the default `max_completion_tokens` field can","  set maxOutputTokensField: `max_tokens`. The only accepted values are `max_tokens`","  and `max_completion_tokens`; a per-model value overrides the provider-level default.","- DeepSeek V4 OpenAI-compatible configs use the model-specific","  `deepseek-v4-flash-openai` or `deepseek-v4-pro-openai` reasoning preset. Legacy","  `deepseek-v4-openai` configs migrate by model id and keep Pro-like behavior when","  the model cannot be identified.",'- reasoning: { efforts: ["low","high"], default: "high" } adds a tunable effort level.',"  On openai-compat it sends reasoning_effort; on anthropic-compat it sends",'  thinking:{type:"enabled"} + reasoning_effort (the non-Claude dialect). Include "off"',"  in efforts to allow disabling thinking.","- Pointing anthropic-compat at REAL Claude (4.6+)? Claude needs adaptive thinking, not",'  the enable toggle \u2014 set reasoningCapability: "native-adaptive" (or an explicit','  reasoningProfile with effortStrategy "anthropic-output-effort").',"- reasoningCapability is the low-level override: native-toggle / native-budget /","  native-effort / native-adaptive / none. It is ignored when supportsThinking is false.","If a relay rejects the chosen thinking shape, KodaX retries the turn once without it, so","it still completes (you just see no thinking) instead of erroring."].join(`
 `),sources:[{label:"config loader",path:"packages/repl/src/common/utils.ts"},{label:"custom provider reasoning",path:"packages/llm/src/providers/custom-provider.ts"}],nextTopics:["providers","config"]},{id:"config",title:"Configuration",aliases:["settings","config.json","env","\u914D\u7F6E","\u8BBE\u7F6E","\u73AF\u5883\u53D8\u91CF"],summary:"Core config, split integration files, migration, and KODAX_* env precedence.",body:["KodaX config is JSON + env vars \u2014 there is no YAML and no single loader entry.","Core file: ~/.kodax/config.json. Common keys: provider, model, effort,","planModeEffort, permissionMode, customProviders, repoIntelligenceMode, compaction,","fallbackProviders, autoMode, verifierLog, stallLog, runtimeMode, worker, and workflow.","`worker.configuredA2A` opts a Worker-hosted embedded Runtime into the configured A2A","plane (see the a2a topic); the CLI reads it from this file.","`autoReview.policy` configures only the Runtime-owned Auto[LLM] review policy body;","`autoMode.classifierModel` may select its reviewer model. Reviewer deadlines are fixed","at 90 seconds plus one 180-second retry, and legacy engine/timeout/speculative-window","inputs are inert. If no effective reviewer model exists, KodaX reports a recoverable","configuration error instead of falling back to rules or opening a permission prompt.","The active config.json remains strict JSON. Its complete commented reference is","~/.kodax/config.example.jsonc; the template first line points to all split files.","`kodax setup` creates missing active files and all four *.example.jsonc references,","preserves existing files, and migrates readable legacy MCP/Extensions declarations","before installing an otherwise-empty authoritative split file. It validates existing","active files first and stops without writing if any is invalid. `kodax config paths`","prints every active and example path.","Interactive/first-run setup also checks optional ASRT sandbox readiness once. Windows","requests activation UAC; a healthy setup-generation upgrade preserves the existing SID.","A bare interactive Windows CLI startup also repairs a missing or stale generation before","the REPL. Non-interactive Runtime/daemon/SDK startup and ordinary tool calls never invoke setup.","macOS/Linux print exact dependency guidance.","","User integration declarations are versioned separately:","- MCP:        ~/.kodax/integrations/mcp.json","- A2A:        ~/.kodax/integrations/a2a.json","- Extensions: ~/.kodax/integrations/extensions.json","Run `kodax integrations migrate` for a dry run, then","`kodax integrations migrate --apply` to create missing split files. Migration imports","MCP and Extensions from config.json#mcpServers and config.json#extensions; A2A has no","legacy source. It does not overwrite an existing destination. The first MCP/Extension mutation","also stages readable legacy entries before applying the change. Review literal-secret warnings,","then add `--cleanup-legacy` with `--apply` only after the destination validates; cleanup removes","a legacy field only when its split destination exists. Initialize A2A with `a2a add` or an empty",'version-2 `{ "version": 2, "agents": {} }` document.',"Long-lived owners hot-reload","valid changes and retain last-known-good state on failure; inbound A2A execution/store","authority changes are reported as restart-required.","If an optional integration file is invalid during cold start, only that domain uses its","safe empty document (no MCP servers, no A2A agents, or no configured Extension paths).","The daemon remains ready, reports structured degraded status, and hot-recovers after a","valid replacement. While a split MCP/Extensions file is absent, both that destination and","the legacy config.json source are watched and polled; status points at the file that is","actually invalid. KodaX does not delete or rewrite the invalid file.","A pre-health child-process failure is captured in","~/.kodax/runtime/daemon/<profile>/bootstrap.log; the active file and bootstrap.log.1 are","both bounded. Use this before deleting configuration or integration directories.","","Env mirrors / extras: KODAX_PROVIDER, KODAX_EFFORT, KODAX_FALLBACK_PROVIDERS, KODAX_FAST_*/KODAX_DEEP_*,","KODAX_REPO_INTELLIGENCE. Env generally overrides file. Project vs user config:","user config is ~/.kodax; project-scoped state lives under <repo>/.kodax/."].join(`
 `),sources:[{label:"config loader",path:"packages/repl/src/common/utils.ts"},{label:"integration config",path:"packages/repl/src/common/integration-config.ts"},{label:"canonical templates",path:"config-templates/"},{label:"setup guide",path:"packages/repl/src/common/setup-guide.ts"},{label:"setup initialization",path:"packages/repl/src/common/setup-config.ts"},{label:"permission config",path:"packages/repl/src/common/permission-config.ts"}],nextTopics:["providers","permissions","mcp","compaction"]},{id:"permissions",title:"Permission modes",aliases:["permission","approval","dangerous","auto llm","full access","exec policy","\u6743\u9650","\u5BA1\u6279","\u6743\u9650\u6A21\u5F0F"],summary:"File/command permission modes, Runtime-owned Auto Mode, and exact grants.",body:["- plan: read-only planning, no mutations until you switch.","- accept-edits: auto-apply trusted text edits; eligible shell calls try the sandbox first,","  then ask only at a proven host boundary.","- auto: sandbox-first execution; Auto[LLM] reviews only an exact host-boundary call.","- full-access: execute directly on the host with no sandbox or approval prompt;","  explicit forbidden rules and Codex dangerous-command policy still block.",'Set via ~/.kodax/config.json "permissionMode" or the relevant slash command.',"","Sandbox completion is final authority and creates no review or permission prompt. Only a","proven pre-start sandbox denial/unavailability reaches Exec Policy. Edits then uses the","user boundary; Auto[LLM] uses the independent reviewer. A started or uncertain target is","never replayed, and reviewer allow can produce at most one host attempt.","","Outside Full Access, an explicit Exec Policy `prompt` uses the Runtime permission broker.","Under Full Access it is rejected because approval policy is Never. Choose allow once,","a session-scoped exact grant, or (when","offered) a persistent exact grant. The Runtime creates the opaque suggestion; never","construct or widen a scope from the displayed input. Exact command grants include the","normalized command, cwd, shell, and background setting; path grants cover one tool and","one normalized absolute path. Dynamic shell commands deliberately do not get a","persistent suggestion. Persistent grants are daemon-owned and revisioned; use the SDK","permission service to inspect or revoke them.","Legacy grants without a Runtime-issued matcher remain visible and revocable but never","authorize a concrete call. A legacy `allow_always.scope` response is mapped only to a","current Runtime-issued concrete candidate; KodaX never persists its coarse scope.","","Loading static Skill instructions is allowed in Edit and Plan without a client approval","prompt. The Skill's later file, shell, network, or external actions keep their own policy","checks. Skill dynamic-context commands are blocked while Plan is active; outside Plan","they require an explicit host-controlled executor and never fall back to legacy `execSync`.","","Auto Mode runs sandboxed calls first and uses one Runtime-owned LLM reviewer only at the host boundary.","If no effective reviewer model is available, sandboxed operations remain usable and the","configuration error is deferred until host review is actually required. Trusted text tools","and sandbox completion never initialize the reviewer. Host review receives bounded genuine","user intent plus exact operation facts; command category alone is not a hazard.","Reviewer context is bounded and redacted before it reaches a provider. The first attempt has","a 90-second deadline. Only timeout, provider failure, or invalid output receives one","180-second retry; an explicit deny is never retried. Exhaustion blocks that host attempt with guidance","to use a safer, narrower, or reversible route.","Shift-Tab cycles Plan -> Edits -> Auto[LLM] -> Full Access; Shift+Enter inserts a newline.","Auto is shown as Auto[LLM], while Runtime","settings updates are serialized so rapid cycling cannot let an older mode win.","Concrete reviewer concerns block that exact attempt without opening an approval prompt.","The main model should try a safer route or stop for informed natural-language user","direction; a later operation is reviewed independently.","Threat model: KodaX is a single-user CLI; workspace integrity is the user\u2019s responsibility."].join(`
-`),sources:[{label:"permission config",path:"packages/repl/src/common/permission-config.ts"},{label:"Runtime permission service",path:"src/sdk-runtime.ts"},{label:"Runtime matcher",path:"src/runtime-permission-scope.ts"},{label:"Exec Policy",path:"packages/coding/src/permissions/exec-policy.ts"}],nextTopics:["tools","commands","config","sandbox"]},{id:"sandbox",title:"Sandbox containment",aliases:["asrt","seatbelt","bubblewrap","\u6C99\u7BB1","\u9694\u79BB","sandbox setup"],summary:"ASRT platform containment, sandbox-first execution, and host-boundary routing.",body:["Sandbox containment and permission decisions are separate layers.","Since v0.7.96, trusted text transactions and platform shell containment are","separate authorities on Windows, Linux, and macOS. write/edit/multi_edit/insert_after_anchor/undo run in the trusted","KodaX Runtime with final identity policy, a process-death-released per-file kernel lock,","revision CAS, and flushed atomic replacement. They never enter ASRT, workspace-session,","runner, setup, owner, reset, cleanup, or poison state, and KodaX does not describe those","text writes as OS-token sandbox enforcement.","On Windows, a trusted replacement self-heals an old sandbox-owned file into host ownership.","Windows retains the ordered effective ACE policy while the filesystem may canonicalize DACL protection/inheritance control at commit.","Windows text locks are host-SID private-namespace kernel objects. Unix uses a fixed per-UID","mode-0700 system coordination root shared across Runtime config homes, a separate protected","Agent Home addon cache, descriptor-verified addon loading, and an inode carrying kernel flock;","inode presence is not ownership. Process death releases both without a PID/ticket recovery","protocol. Unix replacement preserves owner/mode/xattrs/Linux flags/macOS extended ACL and","file flags or fails closed, and sandboxed shell policy cannot write either protected root.","Windows shell commands keep ASRT for network/account services and use a separate native","restricted-token runner with a nonce-bound per-policy private desktop, creation-time Job containment,","and framed stdio. Different","policy, Session, and Runtime commands do not share a command-lifetime filesystem-effect","lease. Arbitrary shell writes remain ordinary OS races; only controlled text tools use CAS.","Windows allow capabilities are installed only on exact canonical roots. Enabled traverse privilege reaches those roots without persistent ACEs or inheritance propagation on private ancestors.","Workspace-local .kodax/runtime state remains readable but is denied to shell writes even when the workspace root is writable.","Its recoverable Session sequence cursor uses a lock-held durable write and reconstructs from event ledgers after truncation.","The v0.7.96-beta.2 release uses Windows native shell protocol 10. It uses two authenticated, nonce-bound protocol streams,","keeps control available after target stdin EOF, and accepts timeout/cancellation only after validating a","nonce-bound terminal record that proves the command Job drained. Runtime capability `sandboxRuntime:11`","prevents an older daemon from silently serving this authority split.","Every protocol-10 request carries the protected setup-marker path and digest. The host holds that marker without delete sharing through durable target Started, so setup rotation and target start cannot cross.","Every canonical Windows root uses the same stable AllowRead/AllowWrite/DenyWrite capability ACE set, while the command token activates only its authorized capabilities. Setup owns broad profile-root grants; ordinary admission verifies those roots without changing their DACL and converges missing grants only for command-specific small roots, without a cross-process target mutex.","Ordinary Windows sandbox admission runs without a machine-global admission mutex, command-lifetime lock, or serial shell queue.","Setup generation 10 preserves the random filesystem-capability namespace and healthy fixed account SID/group from generation 8 without replaying the completed legacy ACL migration. Generation 8 remains only that one-time proof boundary.","Every Windows workspace shell receives an empty private Temp child and points TEMP, TMP, and TMPDIR to it. The shared system Temp/AppData roots are never ordinary-admission ACL targets, including when KODAX_HOME is nested below them; POSIX keeps its platform Temp roots and inherited Temp variables.","A Windows command owns only its unique private Temp leaf; ordinary cleanup never removes the shared hashed parent. After native lifecycle or Job-drain proof, a bounded leaf-cleanup failure is a warning and cannot replace the proven command result. Before proof, cleanup remains fail-closed and never authorizes replay.","Windows setup uses a protected two-phase marker: the elevated parent validates the digest-bound installing marker, synchronously converges NUL compatibility and profile read capabilities, then the caller atomically publishes the ready marker. No helper overlaps ordinary admission, shared system Temp is not prewarmed or rewritten, and doctor/ordinary admission never invoke UAC.","Windows per-command denyRead returns structured unsupported_policy before doctor, setup, DACL mutation, or target start because WRITE_RESTRICTED cannot enforce restricting SIDs for reads. Setup alone retires pre-cutover receipts and ACEs.","Native request and terminal state lives in a no-reparse, protected host/SYSTEM-only control directory.","SDK policy validation and the native host both reject overlapping allow roots and deny roots at/below that boundary before launch.","In a bundled build, a package-source ASRT executable may be a package-store hardlink, but KodaX authenticates it through a handle-bound bounded read against the embedded digest before copying it. A loaded embedded manifest first reuses the exact protected-cache content-hash generation, so a later npm-link rebuild cannot switch that process to another native evidence schema. Development manifests remain source-authoritative. The protected executable used by the broker remains single-link, ACL-protected, and hash-verified.","Non-interactive Runtime/daemon startup readiness remains verify-only. Interactive Windows CLI startup performs one setup-generation check before creating the REPL Runtime: current ready state is silent, while a missing or stale generation enters the existing setup boundary. Concurrent startup repairs converge through the setup-only lock, and a follower rechecks the winner instead of installing again. Explicit `kodax sandbox doctor` and the post-setup startup proof each run one no-side-effect identity command with host fallback disabled, so `ready: true` proves native target start and completion. The explicit doctor is a host control-plane command: run it directly in a host terminal, not through the Bash tool; inside the REPL use `/sandbox`. A doctor launched through sandboxed Bash is itself contained and cannot inspect host-owned ASRT state on Windows, so its local result is not the host readiness result. Doctor never runs setup or repairs ACL policy. Explicit setup may narrowly retire an expired dead-PID request or proven-drained terminal record before repairing host-owned state after proving the sandbox SID idle.","Live, unexpired, malformed, unknown, and windows-deny recovery records remain fail-closed.","macOS/Linux shells remain per-command ASRT Seatbelt/bubblewrap calls and keep no KodaX","workspace-session owner or filesystem-effect lease across a command lifetime.","Issue 307 retains the ASRT-created runner's pre-main shared-account window (also present","in current Codex); final targets are Job-contained at creation. Loader faults before runner","main are part of that residual; trusted text tools do not enter the upstream boundary.","Within one Runtime, exact network policy and setup generation reuse one healthy broker; readiness, target-start, or terminal-proof failure, plus trusted terminal proof of runner/controller loss, immediately detaches that generation from reuse without stopping existing holders.","A replacement broker may start while old holders finish. KodaX supplies ASRT a 64-port range for up to 32 exact authorities and relies on OS bind arbitration across Runtime processes instead of a process-local capacity or idle-eviction gate. Startup/control phases have independent 15-second bounds; caller-local abort or a shorter caller deadline does not retire a healthy shared broker.","Issue 308 records the earlier ASRT 0.0.65 ten-port/five-distinct-broker boundary. Current KodaX expands that range without serializing commands or sharing authority to hide capacity.","Issue 309 records the Codex-compatible Windows residual where a target owner can widen a","child DACL to an ambient compatibility trustee; it does not affect trusted text tools.","`kodax sandbox doctor` returns live-probed readiness, platform, ASRT version, diagnostics,","capability metadata, and setup guidance. `kodax sandbox setup` explicitly activates or","diagnoses the platform backend.","A v0.7.96 setup-generation-10 cutover upgrades healthy generation 8 or released generation 9 in place without replaying legacy cleanup, reuses the fixed account SID/group and filesystem nonce,","and records protocol 10 in protected state. Missing or","mismatched generation or pre-correction protocol blocks native shell admission, never trusted text tools.","Inside the REPL, `/sandbox` refreshes and displays the same readiness without activating","the backend or requesting elevation. Ordinary startup, command cards, and history print no","per-command sandbox status.","- Windows: a normal Terminal is sufficient. Activation requests UAC confirmation for","  the restricted account/network policy; a healthy setup-generation upgrade preserves its SID.","  Declining is non-fatal and trusted text tools remain available.","- macOS: ASRT uses Seatbelt/sandbox-exec and requires ripgrep (`brew install ripgrep`).","- Linux: ASRT uses bubblewrap and requires bubblewrap, socat, and ripgrep; install with","  your distro's apt/dnf/pacman command. KodaX never runs sudo/package managers silently.","`kodax setup`, first-run setup, and `/setup` check readiness once. Bare interactive Windows","CLI startup (including `kodax -r`) also repairs a missing or stale setup generation before","the REPL, then proves one real target start. Ready state remains silent. Print-mode, daemon,","and SDK startup never auto-activate; ordinary tool calls never enter setup or wait on its lock.","Model-issued commands inherit the host environment, including normal development credentials.","A fixed internal deny set preserves KodaX/Electron execution control; the obsolete","`sandbox.envPass` input is ignored and is not written by new clients.","When ASRT is unavailable or denies before target launch, Edits asks the user and","Auto[LLM] reviews the exact host-boundary call. An allow produces at most one host attempt.","Recognized nested shell forms are recursively checked. If a body cannot be lowered reliably, its complete outer argv remains opaque for exact Exec Policy and the normal Edits/Auto[LLM] boundary; parse uncertainty alone is not a critical-effect forbid.","Commands are never retried after target launch or uncertain settlement. Remote","A2A admitted Skill scripts retain their stronger isolation contract and do not run","unsandboxed.","Local interactive sandboxed shell calls retain normal network access and inherited identity;","writes stay bounded to workspace/system temp. Remote A2A","Skill runners keep credential scrubbing and deny/allowlist networking.","KodaX workspace containment allows broad host reads, including Agent Home, credential","locations, and global Git configuration; writes remain limited to workspace/system temp.","Since v0.7.86, Windows workspace Shell calls preserve case-insensitive PATH/Path and","PATHEXT values through the Runtime and sandbox brokers. Read grants follow the final shell","PATH and executable, including only bounded junction traversal for profile-managed toolchains;","cmd.exe arguments retain their verbatim-argument contract, so quoted paths are not re-parsed","by an intermediate broker. Missing lifecycle attestation never implicitly replays a command","that may already have started. Sandbox infrastructure failures before target start reach the","separate Exec Policy and profile-specific host boundary. Exact workspace, filesystem, toolchain,","and network policies retain independent request/token/pipe/Job lifecycles. v0.7.96 has no command-lifetime filesystem-effect coordinator for Bash, trusted text, or worktree lifecycle.","Old model-filesystem-effects state is ignored, and deprecated lease APIs are inert compatibility shims. Same-file text CAS and same-exact-path local worktree ordering remain narrow; Git owns cross-process repository locks.","A shared Windows network broker stays referenced while starting or leased and detaches from the Node event loop only while idle, so independent Runtime commands neither exit early nor keep an unused Runtime alive.","The v0.7.94 public sandbox capability metadata was version 4;","the v0.7.95 capability metadata was version 5, and v0.7.96 raises it to version 11;","auto-start replaces an idle older-version daemon, and a busy owner still fails closed.","When multiple npm-linked or `kodax -r` clients meet that idle incompatible daemon, token-authenticated temporary clients elect one inventory leader; followers detach and reconnect after the fenced replacement. If followers attach during the prepared-ticket/revision-CAS window, one resumes that exact durable ticket after detaching while the first client and other followers only observe the owner change. This bounded upgrade-only convergence adds no ordinary shell lock or queue.","Machine provisioning, legacy cleanup, and stale ACL recovery run only in explicit setup. Ordinary command admission verifies protected artifacts/control state and never launches synchronous PowerShell provisioning or scans legacy denyRead receipts.","Started-or-unknown cleanup requires a Job-drained terminal proof. After that proof, private Temp leaf housekeeping cannot revoke the result. Atomic control staging is retired only after exact dead-PID and age proof.","Historical v0.7.94-v0.7.95 text tools overlapped a compatible live Bash lease by","running snapshot and commit through the same ASRT workspace policy. v0.7.96","supersedes that helper path with the trusted host transaction described above.","Since v0.7.95, KodaX registers KodaX-created linked worktrees in that exact Session policy before","the model receives their path, persisted across later Runs, revalidated through the","Git common-directory backlink, and revoked on removal. An unregistered sibling remains","outside the concurrent text capability and keeps the ordinary host fence.","For an older Session without the registry field, only its retained successful worktree_create","result is migrated after full Git revalidation; a retained successful remove is a tombstone.","If create evidence is unavailable, stop the","background process and remove/recreate through KodaX.","Hard-linked workspace targets are rejected. Windows sandboxed git trusts","authorized repo roots only (`gitSafeDirectory: authorized-repo-roots`) and","never emits `safe.directory=*`. Linked-worktree and submodule relationship","files are read through strict byte bounds before that trust.","Sandboxed text-helper stdin failures stay on the operation Promise.","That v0.7.94 helper path is historical: FEATURE_295 removes it from the v0.7.96","production text-tool graph instead of forwarding its stdin payload.","A daemon snapshot whose `sandboxRuntime`","object lacks `gitSafeDirectory` predates that trust set. Auto-start replaces an idle older daemon; a busy owner returns the structured upgrade boundary without being killed.","A missing workspace directory omits the concurrent text sandbox at Run start","instead of aborting option construction.","Since v0.7.90, a timed-out workspace-session RPC fails its pending request","and retires the shared session through orderly close instead of force-killing it.","Protocol-10 command cleanup owns only its command Job and evidence; ordinary admission and replacement do not wait behind machine-global ACL/WFP work.","Daemon diagnostics retain Error messages,","AggregateError members, and cause chains rather than serializing detail as `{}`.","Since v0.7.91, complete Runtime exit settlement is SDK-owned: `settleKodaXRuntimeExit()` persists the exact owner before stop, resumes a crash-safe ticket, and repairs only verified Windows process/Job/ACL residue. Same-boot POSIX ambiguity, active work, foreign markers, PID reuse, and corrupt evidence remain fail-closed.","The same Runtime owner bounds AskUser, permission, and MCP elicitation lifecycles. SDK hosts receive an AbortSignal and can use `handleRuntimePermissionRequest()`; timeout, cancellation, or a competing response beats a late UI answer. Runtime validates `userInputTimeoutMs` and `permissionTimeoutMs` before startup.","SDK embedders can use `@kodax-ai/kodax/sandbox` independently of permissions:","`getKodaXSandboxCapability`, `doctorKodaXSandbox`, `activateKodaXSandbox`,","`getKodaXSandboxSetupGuidance`, and `runKodaXSandboxed`. The generic executor accepts","filesystem/network/environment/timeout/output controls and returns structured","`unavailable` without silently executing outside the sandbox."].join(`
+`),sources:[{label:"permission config",path:"packages/repl/src/common/permission-config.ts"},{label:"Runtime permission service",path:"src/sdk-runtime.ts"},{label:"Runtime matcher",path:"src/runtime-permission-scope.ts"},{label:"Exec Policy",path:"packages/coding/src/permissions/exec-policy.ts"}],nextTopics:["tools","commands","config","sandbox"]},{id:"sandbox",title:"Sandbox containment",aliases:["asrt","seatbelt","bubblewrap","\u6C99\u7BB1","\u9694\u79BB","sandbox setup"],summary:"ASRT platform containment, sandbox-first execution, and host-boundary routing.",body:["Sandbox containment and permission decisions are separate layers.","Since v0.7.96, trusted text transactions and platform shell containment are","separate authorities on Windows, Linux, and macOS. write/edit/multi_edit/insert_after_anchor/undo run in the trusted","KodaX Runtime with final identity policy, a process-death-released per-file kernel lock,","revision CAS, and flushed atomic replacement. They never enter ASRT, workspace-session,","runner, setup, owner, reset, cleanup, or poison state, and KodaX does not describe those","text writes as OS-token sandbox enforcement.","On Windows, a trusted replacement self-heals an old sandbox-owned file into host ownership.","Windows retains the ordered effective ACE policy while the filesystem may canonicalize DACL protection/inheritance control at commit.","Windows text locks are host-SID private-namespace kernel objects. Unix uses a fixed per-UID","mode-0700 system coordination root shared across Runtime config homes, a separate protected","Agent Home addon cache, descriptor-verified addon loading, and an inode carrying kernel flock;","inode presence is not ownership. Process death releases both without a PID/ticket recovery","protocol. Unix replacement preserves owner/mode/xattrs/Linux flags/macOS extended ACL and","file flags or fails closed, and sandboxed shell policy cannot write either protected root.","Windows shell commands keep ASRT for network/account services and use a separate native","restricted-token runner with a nonce-bound per-policy private desktop, creation-time Job containment,","and framed stdio. Different","policy, Session, and Runtime commands do not share a command-lifetime filesystem-effect","lease. Arbitrary shell writes remain ordinary OS races; only controlled text tools use CAS.","Windows allow capabilities are installed only on exact canonical roots. Enabled traverse privilege reaches those roots without persistent ACEs or inheritance propagation on private ancestors.","Workspace-local .kodax/runtime state remains readable but is denied to shell writes even when the workspace root is writable.","Its recoverable Session sequence cursor uses a lock-held durable write and reconstructs from event ledgers after truncation.","Beta.3 repairs Windows WFP probe allocation in doctor and bundled ASRT 0.0.65; SDK installs with --ignore-scripts include the fix.","The v0.7.96-beta.3 release uses Windows native shell protocol 10. It uses two authenticated, nonce-bound protocol streams,","keeps control available after target stdin EOF, and accepts timeout/cancellation only after validating a","nonce-bound terminal record that proves the command Job drained. Runtime capability `sandboxRuntime:11`","prevents an older daemon from silently serving this authority split.","Every protocol-10 request carries the protected setup-marker path and digest. The host holds that marker without delete sharing through durable target Started, so setup rotation and target start cannot cross.","Every canonical Windows root uses the same stable AllowRead/AllowWrite/DenyWrite capability ACE set, while the command token activates only its authorized capabilities. Setup owns broad profile-root grants; ordinary admission verifies those roots without changing their DACL and converges missing grants only for command-specific small roots, without a cross-process target mutex.","Ordinary Windows sandbox admission runs without a machine-global admission mutex, command-lifetime lock, or serial shell queue.","Setup generation 10 preserves the random filesystem-capability namespace and healthy fixed account SID/group from generation 8 without replaying the completed legacy ACL migration. Generation 8 remains only that one-time proof boundary.","Every Windows workspace shell receives an empty private Temp child and points TEMP, TMP, and TMPDIR to it. The shared system Temp/AppData roots are never ordinary-admission ACL targets, including when KODAX_HOME is nested below them; POSIX keeps its platform Temp roots and inherited Temp variables.","A Windows command owns only its unique private Temp leaf; ordinary cleanup never removes the shared hashed parent. After native lifecycle or Job-drain proof, a bounded leaf-cleanup failure is a warning and cannot replace the proven command result. Before proof, cleanup remains fail-closed and never authorizes replay.","Windows setup uses a protected two-phase marker: the elevated parent validates the digest-bound installing marker, synchronously converges NUL compatibility and profile read capabilities, then the caller atomically publishes the ready marker. No helper overlaps ordinary admission, shared system Temp is not prewarmed or rewritten, and doctor/ordinary admission never invoke UAC.","Windows per-command denyRead returns structured unsupported_policy before doctor, setup, DACL mutation, or target start because WRITE_RESTRICTED cannot enforce restricting SIDs for reads. Setup alone retires pre-cutover receipts and ACEs.","Native request and terminal state lives in a no-reparse, protected host/SYSTEM-only control directory.","SDK policy validation and the native host both reject overlapping allow roots and deny roots at/below that boundary before launch.","In a bundled build, a package-source ASRT executable may be a package-store hardlink, but KodaX authenticates it through a handle-bound bounded read against the embedded digest before copying it. A loaded embedded manifest first reuses the exact protected-cache content-hash generation, so a later npm-link rebuild cannot switch that process to another native evidence schema. Development manifests remain source-authoritative. The protected executable used by the broker remains single-link, ACL-protected, and hash-verified.","Non-interactive Runtime/daemon startup readiness remains verify-only. Interactive Windows CLI startup performs one setup-generation check before creating the REPL Runtime: current ready state is silent, while a missing or stale generation enters the existing setup boundary. Concurrent startup repairs converge through the setup-only lock, and a follower rechecks the winner instead of installing again. Explicit `kodax sandbox doctor` and the post-setup startup proof each run one no-side-effect identity command with host fallback disabled, so `ready: true` proves native target start and completion. The explicit doctor is a host control-plane command: run it directly in a host terminal, not through the Bash tool; inside the REPL use `/sandbox`. A doctor launched through sandboxed Bash is itself contained and cannot inspect host-owned ASRT state on Windows, so its local result is not the host readiness result. Doctor never runs setup or repairs ACL policy. Explicit setup may narrowly retire an expired dead-PID request or proven-drained terminal record before repairing host-owned state after proving the sandbox SID idle.","Live, unexpired, malformed, unknown, and windows-deny recovery records remain fail-closed.","macOS/Linux shells remain per-command ASRT Seatbelt/bubblewrap calls and keep no KodaX","workspace-session owner or filesystem-effect lease across a command lifetime.","Issue 307 retains the ASRT-created runner's pre-main shared-account window (also present","in current Codex); final targets are Job-contained at creation. Loader faults before runner","main are part of that residual; trusted text tools do not enter the upstream boundary.","Within one Runtime, exact network policy and setup generation reuse one healthy broker; readiness, target-start, or terminal-proof failure, plus trusted terminal proof of runner/controller loss, immediately detaches that generation from reuse without stopping existing holders.","A replacement broker may start while old holders finish. KodaX supplies ASRT a 64-port range for up to 32 exact authorities and relies on OS bind arbitration across Runtime processes instead of a process-local capacity or idle-eviction gate. Startup/control phases have independent 15-second bounds; caller-local abort or a shorter caller deadline does not retire a healthy shared broker.","Issue 308 records the earlier ASRT 0.0.65 ten-port/five-distinct-broker boundary. Current KodaX expands that range without serializing commands or sharing authority to hide capacity.","Issue 309 records the Codex-compatible Windows residual where a target owner can widen a","child DACL to an ambient compatibility trustee; it does not affect trusted text tools.","`kodax sandbox doctor` returns live-probed readiness, platform, ASRT version, diagnostics,","capability metadata, and setup guidance. `kodax sandbox setup` explicitly activates or","diagnoses the platform backend.","A v0.7.96 setup-generation-10 cutover upgrades healthy generation 8 or released generation 9 in place without replaying legacy cleanup, reuses the fixed account SID/group and filesystem nonce,","and records protocol 10 in protected state. Missing or","mismatched generation or pre-correction protocol blocks native shell admission, never trusted text tools.","Inside the REPL, `/sandbox` refreshes and displays the same readiness without activating","the backend or requesting elevation. Ordinary startup, command cards, and history print no","per-command sandbox status.","- Windows: a normal Terminal is sufficient. Activation requests UAC confirmation for","  the restricted account/network policy; a healthy setup-generation upgrade preserves its SID.","  Declining is non-fatal and trusted text tools remain available.","- macOS: ASRT uses Seatbelt/sandbox-exec and requires ripgrep (`brew install ripgrep`).","- Linux: ASRT uses bubblewrap and requires bubblewrap, socat, and ripgrep; install with","  your distro's apt/dnf/pacman command. KodaX never runs sudo/package managers silently.","`kodax setup`, first-run setup, and `/setup` check readiness once. Bare interactive Windows","CLI startup (including `kodax -r`) also repairs a missing or stale setup generation before","the REPL, then proves one real target start. Ready state remains silent. Print-mode, daemon,","and SDK startup never auto-activate; ordinary tool calls never enter setup or wait on its lock.","Model-issued commands inherit the host environment, including normal development credentials.","A fixed internal deny set preserves KodaX/Electron execution control; the obsolete","`sandbox.envPass` input is ignored and is not written by new clients.","When ASRT is unavailable or denies before target launch, Edits asks the user and","Auto[LLM] reviews the exact host-boundary call. An allow produces at most one host attempt.","Recognized nested shell forms are recursively checked. If a body cannot be lowered reliably, its complete outer argv remains opaque for exact Exec Policy and the normal Edits/Auto[LLM] boundary; parse uncertainty alone is not a critical-effect forbid.","Commands are never retried after target launch or uncertain settlement. Remote","A2A admitted Skill scripts retain their stronger isolation contract and do not run","unsandboxed.","Local interactive sandboxed shell calls retain normal network access and inherited identity;","writes stay bounded to workspace/system temp. Remote A2A","Skill runners keep credential scrubbing and deny/allowlist networking.","KodaX workspace containment allows broad host reads, including Agent Home, credential","locations, and global Git configuration; writes remain limited to workspace/system temp.","Since v0.7.86, Windows workspace Shell calls preserve case-insensitive PATH/Path and","PATHEXT values through the Runtime and sandbox brokers. Read grants follow the final shell","PATH and executable, including only bounded junction traversal for profile-managed toolchains;","cmd.exe arguments retain their verbatim-argument contract, so quoted paths are not re-parsed","by an intermediate broker. Missing lifecycle attestation never implicitly replays a command","that may already have started. Sandbox infrastructure failures before target start reach the","separate Exec Policy and profile-specific host boundary. Exact workspace, filesystem, toolchain,","and network policies retain independent request/token/pipe/Job lifecycles. v0.7.96 has no command-lifetime filesystem-effect coordinator for Bash, trusted text, or worktree lifecycle.","Old model-filesystem-effects state is ignored, and deprecated lease APIs are inert compatibility shims. Same-file text CAS and same-exact-path local worktree ordering remain narrow; Git owns cross-process repository locks.","A shared Windows network broker stays referenced while starting or leased and detaches from the Node event loop only while idle, so independent Runtime commands neither exit early nor keep an unused Runtime alive.","The v0.7.94 public sandbox capability metadata was version 4;","the v0.7.95 capability metadata was version 5, and v0.7.96 raises it to version 11;","auto-start replaces an idle older-version daemon, and a busy owner still fails closed.","When multiple npm-linked or `kodax -r` clients meet that idle incompatible daemon, token-authenticated temporary clients elect one inventory leader; followers detach and reconnect after the fenced replacement. If followers attach during the prepared-ticket/revision-CAS window, one resumes that exact durable ticket after detaching while the first client and other followers only observe the owner change. This bounded upgrade-only convergence adds no ordinary shell lock or queue.","Machine provisioning, legacy cleanup, and stale ACL recovery run only in explicit setup. Ordinary command admission verifies protected artifacts/control state and never launches synchronous PowerShell provisioning or scans legacy denyRead receipts.","Started-or-unknown cleanup requires a Job-drained terminal proof. After that proof, private Temp leaf housekeeping cannot revoke the result. Atomic control staging is retired only after exact dead-PID and age proof.","Historical v0.7.94-v0.7.95 text tools overlapped a compatible live Bash lease by","running snapshot and commit through the same ASRT workspace policy. v0.7.96","supersedes that helper path with the trusted host transaction described above.","Since v0.7.95, KodaX registers KodaX-created linked worktrees in that exact Session policy before","the model receives their path, persisted across later Runs, revalidated through the","Git common-directory backlink, and revoked on removal. An unregistered sibling remains","outside the concurrent text capability and keeps the ordinary host fence.","For an older Session without the registry field, only its retained successful worktree_create","result is migrated after full Git revalidation; a retained successful remove is a tombstone.","If create evidence is unavailable, stop the","background process and remove/recreate through KodaX.","Hard-linked workspace targets are rejected. Windows sandboxed git trusts","authorized repo roots only (`gitSafeDirectory: authorized-repo-roots`) and","never emits `safe.directory=*`. Linked-worktree and submodule relationship","files are read through strict byte bounds before that trust.","Sandboxed text-helper stdin failures stay on the operation Promise.","That v0.7.94 helper path is historical: FEATURE_295 removes it from the v0.7.96","production text-tool graph instead of forwarding its stdin payload.","A daemon snapshot whose `sandboxRuntime`","object lacks `gitSafeDirectory` predates that trust set. Auto-start replaces an idle older daemon; a busy owner returns the structured upgrade boundary without being killed.","A missing workspace directory omits the concurrent text sandbox at Run start","instead of aborting option construction.","Since v0.7.90, a timed-out workspace-session RPC fails its pending request","and retires the shared session through orderly close instead of force-killing it.","Protocol-10 command cleanup owns only its command Job and evidence; ordinary admission and replacement do not wait behind machine-global ACL/WFP work.","Daemon diagnostics retain Error messages,","AggregateError members, and cause chains rather than serializing detail as `{}`.","Since v0.7.91, complete Runtime exit settlement is SDK-owned: `settleKodaXRuntimeExit()` persists the exact owner before stop, resumes a crash-safe ticket, and repairs only verified Windows process/Job/ACL residue. Same-boot POSIX ambiguity, active work, foreign markers, PID reuse, and corrupt evidence remain fail-closed.","The same Runtime owner bounds AskUser, permission, and MCP elicitation lifecycles. SDK hosts receive an AbortSignal and can use `handleRuntimePermissionRequest()`; timeout, cancellation, or a competing response beats a late UI answer. Runtime validates `userInputTimeoutMs` and `permissionTimeoutMs` before startup.","SDK embedders can use `@kodax-ai/kodax/sandbox` independently of permissions:","`getKodaXSandboxCapability`, `doctorKodaXSandbox`, `activateKodaXSandbox`,","`getKodaXSandboxSetupGuidance`, and `runKodaXSandboxed`. The generic executor accepts","filesystem/network/environment/timeout/output controls and returns structured","`unavailable` without silently executing outside the sandbox."].join(`
 `),sources:[{label:"sandbox SDK",path:"src/sdk-sandbox.ts"},{label:"ASRT adapter",path:"src/sandbox-runtime.ts"},{label:"setup guide",path:"packages/repl/src/common/setup-guide.ts"},{label:"SDK embedder guide",path:"public_docs/sdk/embedder-guide.md"}],nextTopics:["permissions","config","commands","sdk"]},{id:"commands",title:"Commands (slash & CLI)",aliases:["command","slash","cli","flags","\u547D\u4EE4","\u659C\u6760\u547D\u4EE4","\u6307\u4EE4"],summary:"REPL slash commands, CLI flags, and the doctor command.",body:["All built-in REPL slash commands, grouped by purpose:","- basics: /help, /status, /cost, /clear, /new, /exit, /copy, /paste.","- model/runtime: /model, /provider, /thinking, /reasoning, /effort, /agent-mode,","  /mode, /auto, /auto-denials, /fallback, /setup, /sandbox.","`/thinking`, `/reasoning`, and `/effort` are the same native reasoning-effort control.","Use `none` to disable reasoning only where the active model supports it; `auto` clears","an explicit effort override. Legacy shortcuts remain accepted: `on/off` map to","`auto/none`, and `quick/balanced/deep` map to `low/medium/high` (`med` is `medium`).","- context/session: /compact, /recover, /save, /load, /history, /sessions, /tree,","  /fork, /rewind, /delete.","- capabilities: /mcp, /repo-intel, /repointel (legacy redirect), /skill, /extensions,","  /reload, /agents.","Enabled Skills are also invoked with `/<name>` or `/skill:<name>` at the query head or middle.","Text after the selected token is the Skill argument.","`disable-model-invocation` does not hide those explicit tokens.","See the skills topic for model discovery versus explicit invocation.","- governance/work: /memory, /learn, /goal, /review, /workflow, /verifier-log, /stall-log.","Setup: `/setup` initializes missing config files and chooses a provider;","`/setup --custom` opens the explained custom-provider writer, while","`/setup --help` displays the complete shared guide without changing files. Setup also","checks optional sandbox readiness once; use `kodax sandbox doctor|setup` explicitly.","Default mode shortcuts:","- Ctrl+T: cycle reasoning depth.","- Shift+Tab: cycle permission mode.","- Alt+M: switch AMA/SA agent mode.","Use /help <topic> for this manual and /help for command usage.","CLI: `kodax`, `kodax -c`, `kodax -r`, `kodax setup [--custom]`,","`kodax setup --help`, `kodax doctor [--ping]`, and","`kodax sessions dedupe` (dry-run first). Integration/runtime commands include `kodax","daemon`, `kodax integrations`, `kodax mcp`, `kodax extensions`, `kodax a2a`, and","`kodax sandbox`. BUILTIN_COMMANDS is authoritative; a drift","test requires every built-in slash command to remain named in this topic."].join(`
 `),sources:[{label:"commands",path:"packages/repl/src/interactive/commands.ts"}],nextTopics:["doctor","sessions","permissions","skills"]},{id:"tools",title:"Tools",aliases:["tool","read","write","edit","bash","\u5DE5\u5177"],summary:"What KodaX tools do, when they read/write/run shell, completion verification.",body:["KodaX agents use file tools (read, write, edit, multi_edit), search (grep, glob),","and bash \u2014 gated by your permission mode. Write tools only mutate the workspace;","read/search are side-effect free.","On Windows v0.7.96, controlled text tools commit in the trusted Runtime through final","canonical identity checks, per-file kernel locking, revision CAS, and atomic replace.","They do not depend on shell sandbox readiness. Shell writes do not join that lock and","remain normal operating-system races.","The built-in `web_search` is zero-service: its default bounded attempts are","DuckDuckGo HTML, then Bing RSS, then Bing HTML. A structurally valid empty result","is successful; transport, challenge, status, or parse failures fall back with","attempt diagnostics. Results normalize direct HTTP(S) URLs, deduplicate locators,","and report `freshness: unknown` when the source cannot prove freshness.","`KODAX_WEB_SEARCH_ENDPOINT` is an explicit single-endpoint override: it is isolated","from the public fallback chain and does not interpret provider-specific JSON formats.","Daemon-bound Host Tools are materialized only for their leased run, with the","cached `Host Capability Provider (run-bound)` catalog line and conservative","readonly/mutating plan-mode metadata. Revoked or colliding host tools fail closed","and never enter the global tool registry or leak into unrelated CLI runs.","At the provider boundary, v0.7.90 normalizes each run-scoped open input schema","to `{ type: 'object', properties, required? }` and keeps only string required names,","so daemon leases and embedded hosts send the same provider-valid tool contract.","Since v0.7.91, provider retries, fallback, and continuation use one effective","output-segment projection. `responseId` identifies the logical reply and","`providerRequestId` identifies the physical request; replacement removes only","the active failed segment, continuation appends, and stale deltas are ignored.","Raw Runtime journals retain every attempt; SDK hosts requiring","`liveOutputSegments:1` render `snapshot.live.outputSegmentsByRun` instead of","replaying provider checkpoints or deduplicating cumulative text.","From v0.7.92 through v0.7.95, mutation-tool coordinator timeouts used `KodaXFileLockTimeoutError`","(`KodaX file lock timed out`). v0.7.96 retains that type only for compatibility; current shell, text, and worktree paths do not acquire the retired coordinator.","On completion, an out-of-band Sidecar Verifier may re-check the result (a second","opinion). This is automatic; you do not invoke it."].join(`
 `),sources:[{label:"tools",path:"packages/coding/src/tools/"}],nextTopics:["agents","repo-intelligence","permissions"]},{id:"agents",title:"Agents & coordination",aliases:["agent","subagent","specialist","\u81EA\u5B9A\u4E49agent","\u667A\u80FD\u4F53","\u5B50\u4EE3\u7406"],summary:"Author specialist agents and coordinate Actor turns through mailbox-driven control.",body:["Write a specialist agent as a markdown file with frontmatter (name, description,","tools, model) + a body prompt. KodaX loads:","  - user agents:    ~/.kodax/agents/*.md","  - project agents: <repo>/.kodax/agents/*.md  (override user agents of the same name)",'The main Agent starts one through spawn_agent(agent_id="<name>").',"Difference from skills: an agent is a full sub-agent (own prompt/tools); a skill is","reference knowledge injected into the current agent.","","All native, constructed, Workflow-owned, recursive, and external children use one","Runtime-owned Actor/Turn tree. Use `spawn_agent`, `send_message`, and `followup_task`","to start or steer work; `list_agents` reads current tree state; `agent_output` reads","the bounded output of a known Actor/Turn.","","Native and constructed child Agents derive their Provider credentials from the","intersection of the live parent authorization and their concrete capabilities;","a wildcard never expands authority, and a follow-up delivered to an already-running","turn cannot replace or widen its binding. External Agent credentials stay on the","separate `credentialRef` broker.","","AMA uses parallel-first collaboration: when two or more substantive lanes are independent","and child start slots are available, fan them out through ordinary Actor operations.","Solo work is reserved for genuinely indivisible or strongly serial tasks. Optional","`quality_strategy` metadata records provenance without admitting or blocking a turn. Runtime derives","a bounded, fact-only `PatternTrace`; it distinguishes coverage, replication, and","opposition but never proves correctness. The existing Sidecar remains the sole","terminal-answer quality adjudicator, and pattern/trace presence never forces a verifier","call, child launch, fixed topology, or hidden Workflow. The pattern catalog remains available","to explicit Workflow composition and observability; it is not a Worker dispatch gate.","","One uninterrupted managed Runner invocation is mechanically capped at 500 tool-loop","iterations. Every idle-yield resume starts a fresh invocation and resets that fuse, so","the managed-task lifecycle remains unbounded. If the fuse trips, callers receive the","structured `RunnerIterationLimitError` (`code: 'RUNNER_ITERATION_LIMIT'`) with the","last legal recovery transcript; use `isRunnerIterationLimitError` and","`readRunnerRecoveryTranscript` to distinguish a runaway loop from an ordinary failure.","","`wait_agent` is a model-facing mailbox yield, not an Actor event reader. Its current","schema contains only `timeout_ms` (10,000..3,600,000 ms; default 120,000). It wakes","for scoped Agent messages/completions, root user input, interruption, or timeout and","returns only `mailbox`, `user_input_pending`, `interrupted`, or `wait_expired` as a","small acknowledgement. Actor progress and system reminders do not wake the model.","Progress remains available to UI and SDK consumers through event snapshots, replay,","and long-poll. Do not poll `agent_output` to imitate waiting.","","A Managed Workflow `runAgent` wait with an omitted workflow timeout is unbounded at","the Workflow layer. The Actor API's internal wait is only a polling window; an empty","poll cannot stop or fail the task. Only an explicit workflow deadline produces a","timeout, while terminal Actor output closes an event-delivery race.","","Authenticated Agent messages and structured completion metadata enter the next safe","model boundary as synthetic evidence; a queued root prompt remains a real user turn.","A completion is acknowledged only after the parent transcript commits. If the process","stops earlier, an explicit pending-delivery record restores that completion once;","same-process reconstruction deduplicates by child turn ID, and acknowledged or legacy","historical completions are not replayed."].join(`
@@ -34,7 +34,7 @@ ${t.join(`
 `),sources:[{label:"session storage",path:"packages/repl/src/interactive/storage.ts"}],nextTopics:["compaction","memory","commands","troubleshooting"]},{id:"compaction",title:"Context compaction",aliases:["compact","automatic compaction","context compression","\u4E0A\u4E0B\u6587\u538B\u7F29","\u81EA\u52A8\u538B\u7F29"],summary:"Always-on large compaction thresholds, protected tail, query retention, and events.",body:["Automatic large context compaction is always enabled. The legacy `enabled:false`","setting is accepted for compatibility but cannot turn it off.","`compaction.triggerPercent` defaults to 75 and is clamped to 15..90.","`compaction.triggerTokens` is an optional absolute token threshold; omitted or 0","disables only that absolute threshold. The smaller percentage, positive absolute,","and physical provider-capacity threshold wins.","","The protected recent tail is 20% of the effective trigger, not 20% of the model","context window. One major-compaction wave summarizes the complete eligible prefix","once and preserves the recent tail atomically; it does not repeatedly compact only","the oldest chunk in one turn. A mechanical user-query ledger retains every genuine","user request and correction across later compactions.","","Large compaction is checked at request boundaries, never by a background timer.","Manual `/compact` and Runtime `sessions.compact()` bypass only the trigger comparison","and use the same effective policy and protected budget. SDK hosts can set per-run","`options.compaction` or Session `compactionTriggerPercent` /","`compactionTriggerTokens`; setting the Session absolute value to 0 removes it.","","A successful transition emits one post-commit `context.compaction.finished` fact.","Failed, stale, unchanged, or physically invalid fallback candidates do not emit a","successful compact result and do not partially replace canonical history.","","Before compacted raw bodies are evicted from memory, the root Session host durably","persists their exact lineage. The island sidecar is flushed before the slim main","Session replaces it; stable entry IDs deduplicate their overlap on load. A failed","sidecar or main write keeps an exact live or persisted copy and exposes a diagnostic.","The commit callback is awaited before the next model request or canonical finished","event. Runtime becomes the persistence owner across embedded and daemon boundaries.","Sessions already reduced to `[compacted]` by an older build cannot reconstruct bytes","that were never persisted, but all later compactions use the durable ordering.","","When a later request depends on an omitted detail, a root Agent can use","`session_history_search` and then bounded `session_history_read` instead of guessing","from the summary. Search covers exact persisted user, assistant, tool-result, and","child-task evidence, excludes hidden reasoning/system/checkpoint content, and binds","reads to a revision. SDK hosts use `sessions.transcriptSearch()` and then","`transcriptEntryChunk()` with the returned transcript revision and entry index."].join(`
 `),sources:[{label:"v0.7.74 design",path:"docs/features/v0.7.74.md"},{label:"compaction config",path:"packages/coding/src/compaction-config.ts"},{label:"shared policy",path:"packages/agent/src/session-lineage/compaction/policy.ts"},{label:"history recovery",path:"packages/agent/src/session-lineage/history-retrieval.ts"},{label:"durable storage",path:"packages/repl/src/interactive/storage.ts"},{label:"SDK guide",path:"public_docs/sdk/embedder-guide.md"}],nextTopics:["config","sessions","sdk"]},{id:"memory",title:"Governed memory",aliases:["memory","remember","recall","memory agent","memory_recall","memory_intent","\u8BB0\u5FC6","\u8BB0\u4F4F","\u4E0B\u6B21\u8BB0\u5F97","\u56DE\u5FC6"],summary:"F228 memory governance, automatic recall, deliberate query, and the experimental SDK.",body:["Top-level coding runs use the existing F228 Memory Control Plane. At session start KodaX","builds an exact-scoped memory pack; passive recall stays on the zero-wait hot path. When","the current context cannot answer a specific question about prior execution experience or","a user preference, the Action LLM may call the read-only memory_recall tool. Current","repository facts must still come from current tools, not memory.","","Memory management is conversation-first. When the user asks what KodaX remembers, or","explicitly asks it to remember, correct, or forget something, the root Action LLM calls","memory_intent. Mutations carry an exact quote from the current user turn. Safe explicit","requests apply immediately through the governed preview/fingerprint/apply controller and","do not create a duplicate episode review. Ordinary narration, quoted examples, temporary","task instructions, ambiguous targets, and sensitive content are not silently stored.","Ambiguous, conflicting, broad, or sensitive requests return clarification or an explained","decision. Autonomous episode review remains separate: verified low-risk changes may","auto-apply, while exceptional inferred changes remain reviewable and restart-recoverable.","","Recalled text is low-authority evidence, never an instruction override. Scope, secret","filtering, source evidence, lifecycle, and mutation protection are deterministic code gates.","Use /memory list|remember|forget|decisions|show|approve|reject|doctor|open as an advanced","escape hatch. MEMORY.md is a derived projection; open launches an external application and","the hidden rebuild command only repairs that projection. Durable changes still pass the","proposal/preview/fingerprint/apply controller;","KodaX does not expose filesystem memory actions or auto-edit prompts, policy, code, or weights.","","For `tool_failure`, `verification_failure`, or a durably committed `context_compacted`","event, `MemorySession.intervene()` rebuilds a closed prompt-safe candidate set and may","inject at most three low-authority evidence items before the next Action-LLM request.","Deterministic exact matches run without a model call. An in-process host may opt into the","bounded `memoryRecallRunner`; malformed, unknown, stale, timed-out, cancelled, or failed","selector output fails silent. The default runtime makes no selector call, and daemon DTOs","reject this function binding.","","SDK hosts can opt into @kodax-ai/kodax/experimental-memory. MemorySession.recall() is","synchronous; query() is deliberate and read-only; observe(), complete(), rewind(), and close()","provide bounded episode lifecycle. Decision receipts are trace-only and do not store hidden","reasoning. This subpath is experimental; the F228 control plane remains the only durable store."].join(`
 `),sources:[{label:"coding memory runtime",path:"packages/coding/src/agent-runtime/run-substrate.ts"},{label:"memory recall tool",path:"packages/coding/src/tools/memory-recall.ts"},{label:"memory intent tool",path:"packages/coding/src/tools/memory-intent.ts"},{label:"memory command",path:"packages/repl/src/commands/memory-command.ts"},{label:"experimental memory SDK",path:"packages/agent/src/experimental-memory/"}],nextTopics:["sessions","tools","sdk"]},{id:"doctor",title:"kodax doctor",aliases:["doctor","diagnose","health check","ping","\u8BCA\u65AD","\u4F53\u68C0"],summary:"Diagnose config/provider/credential issues; --ping live reachability.",body:["Run `kodax doctor` to print a health report: configured provider(s), credential/config","state, and storage directories. Add `kodax doctor --ping` to live-probe whether each","configured provider is reachable with the current key. This is the first stop for",'connection / 401 / 429 / "provider not working" problems.'].join(`
-`),sources:[{label:"doctor CLI",path:"src/kodax_doctor.ts"}],nextTopics:["troubleshooting","providers","config"]},{id:"sdk",title:"SDK",aliases:["embed","library","api","sdk\u5165\u95E8","\u5D4C\u5165"],summary:"Published subpaths, shared Runtime hosting, packaged Electron, A2A, and memory.",body:["The source monorepo has 4 workspace packages: @kodax-ai/llm, @kodax-ai/agent,","@kodax-ai/coding, and @kodax-ai/repl. The published @kodax-ai/kodax bundle exposes","12 SDK subpaths: /agent, /llm, /coding, /media, /repl, /skills, /mcp, /session,","/runtime, /sandbox, /a2a, and /experimental-memory.","Use @kodax-ai/kodax/coding for coding tasks; @kodax-ai/kodax/runtime for embedded,","Worker-hosted, or local-daemon sessions/runs/events/permissions;","@kodax-ai/kodax/sandbox for explicit host-owned ASRT containment;","@kodax-ai/kodax/a2a for the A2A 1.0 JSON-RPC/SSE client/server edge; and","@kodax-ai/kodax/experimental-memory for the opt-in MemoryAgent/MemorySession contract.","For an A2A server, listen() waits for durable recovery; a host wiring handle() directly","can await server.whenReady() before accepting traffic.","External Agent owner planes bound close to a 30-second default across admitted work","and executor disposal; hosts may set a positive finite `closeTimeoutMs` override.","","The shared local daemon is authoritative for one Coder profile. Join a session atomically","with sessions.observe(); replace local projection after runtime change/resync_required.","Use sessions.status() for the authoritative Session lifecycle projection and","captureRuntimeSessionDiagnostics() / sessions.diagnostics() for one bounded, read-only","support record. Diagnostics never take ownership, resume, repair, or migrate the Session.","Use sessions.conversation(), sessions.conversationPage(), and","sessions.conversationEntryChunk() for the same immutable ordinary-conversation projection","across embedded and daemon modes; require conversationHistory:2 when topology-transparent","managed context and direct clone provenance are needed.","Control mutations use durable operation identities and settings/permission revisions.","AskUser and permissions are transport-safe. Provider credentials are requested just in","time and scoped to a run/provider; run-bound Host Tools never leak into unrelated CLI","runs. Daemon/inline ownership is fenced, and inline rollback remains sticky. Partner","products keep their separate private embedded Runtime.","The v0.7.90 stabilization keeps these ownership boundaries while making workspace","timeout retirement orderly, preserving direct clone provenance, and normalizing","run-scoped tool schemas before provider dispatch.","The v0.7.91 SDK adds `runtimeExitSettlement:1` and the public","`settleKodaXRuntimeExit({ configHome, profile, runtime? })` transaction.","Pass the connected Runtime for an orderly host exit; after relaunch, call it","with `configHome` and `profile` to resume an exact prepared ticket. `clean`","means verified orderly shutdown, `recovered` means identity-scoped repair","was proven safe, and `blocked` supplies a bounded next action. The API never","accepts short caller timeouts and never exposes bare-PID kill or raw ACL deletion.","The v0.7.94 SDK keeps `sandboxRuntime:4` and `crashOutcomeModel:2`.","The v0.7.95 SDK advertises Windows `sandboxRuntime:5` and local","`runtimeExitSettlement:2`; `crashOutcomeModel:2` is unchanged and publication remains manual.","The v0.7.96-beta.2 release advertises Windows `sandboxRuntime:11`; `runtimeExitSettlement:2`","and `crashOutcomeModel:2` are unchanged. Linux native text authorities build in digest-pinned","`manylinux_2_28` images and require no `GLIBC_*` symbol newer than 2.28 (Issue 328).","Beta.2 recovers long coding sessions at context capacity boundaries: a confirmed upstream","overflow permits one generation retry after persisted history reduction without replaying tools,","and protected tool-output previews persist as durable artifacts when committed history cannot fit.","Bundled Provider credential scopes stay shared across SDK, Agent summaries, CLI, and Runtime Worker","requests; custom Provider credential verification honors exact and lazy run-scoped authority and","fails closed for denied scopes. Tool-free side queries omit empty `tools` arrays for strict vLLM gateways.","npm publication remains a separate manual maintainer action.","The v0.7.96-alpha.3 SDK adds the v2 scoped Provider credential broker (ADR-068):","Provider secrets stay in the OS keychain and resolve lazily, per wire call, for","one closed purpose (primary, fallback, classifier, sidecar, compaction, agent,","workflow, or utility) inside revocable leases. Manual compaction runs keychain-only","through a stable session.compact operation target. Shared-daemon native,","constructed, and workflow Agent turns require an explicit scoped credential","binding and fail closed without one; External Agents keep their independent","credentialRef plane. A v2 client fails closed against an older daemon, so restart","the daemon before using v2 bindings. Daemons advertising `daemonClientInventory:1`","also return bounded, display-only connected-client diagnostics","(`preflight.clients`); connection principals are attribution only, never","authorization or work ownership.","Windows sandbox cleanup preserves exact Job-drain proof without a machine-global admission mutex.","Windows per-command denyRead fails closed as unsupported_policy before target start and creates no execution receipt; explicit setup owns pre-cutover receipt recovery.","Dynamic worktrees register their cleanup policy at creation. Learning locks with stale","zero-byte, malformed, or truncated owner data are reclaimed through unchanged bytes/stat","verification. The coding runtime finalizes its authoritative `KodaXResult` before emitting the","public completion signal, so A2A responses cannot observe an empty successful answer.","Historical v0.7.94-v0.7.95 Runtime text tools overlapped a compatible live Bash lease","through one ASRT workspace policy. v0.7.96 removes that helper/session dependency;","hard-linked trusted-text targets remain rejected.","Since v0.7.95, KodaX-created linked worktree roots persist in the owning Session; they are","revalidated against the same Git common directory on later Runs, and are","revoked on removal; unrelated siblings are never inferred from their names.","A Session rooted in a real submodule proves its common directory through a byte-bounded","`.git/modules/...` core.worktree backlink; candidate roots still require linked-worktree backlinks.","A pre-correction Session migrates only an exact retained successful worktree_create result","after full Git revalidation; a retained successful remove prevents stale re-adoption.","Without create evidence, stop and remove/recreate the worktree;","ProgramData coordination files are not a migration mechanism.","Windows sandboxed git trusts authorized repo roots only","(`gitSafeDirectory: authorized-repo-roots`). Scheduled daemon shutdown","reports failed cleanup. A missing workspace directory omits the concurrent","text sandbox at Run start instead of aborting option construction.","Require `conversationHistory:2` when topology-transparent managed context","and direct clone provenance must be present.","Explicit Skill invocation remains available for every enabled Skill;","`disable-model-invocation` only blocks the model tool path.","Invalid `allowed-tools` entries and malformed hook JSON are diagnosed;","`PostToolUse` still runs if an embedder result observer throws.","Sandboxed text-helper stdin failures stay on the operation Promise.","Linked-worktree and submodule relationship files are read through strict byte bounds before git trust.","Since v0.7.94, Runtime observes every Run finalization rejection. A durable","terminal remains authoritative if only event publication fails. If no terminal record","can be persisted, the Run resolves `unknown` with `run_settlement_not_persisted` and","the Session execution fence remains closed. Terminal failures may include the bounded,","credential-safe `failureKind` classification without exposing provider error text.","Local context exhaustion is `failureKind: context_capacity`, `stage: runtime_control`,","and `providerErrorCode: context_capacity_exceeded`; optional `contextTokens.required`","and `contextTokens.available` give the bounded request/window estimate.","Since v0.7.96, an over-budget tool-result batch records bounded `capacityDebt` and","commits through the recovery ladder instead of aborting the Run; only irreducible overflow","reaches that `context_capacity` terminal.","Since v0.7.95, Runtime rereads a terminal status committed before status-lock cleanup failure and emits one","terminal event only when it exactly matches the local proposal; different authority wins.","Daemon clients receive `RuntimeDaemonDisconnectCode`, `connectionId`, and `reconnectable`","facts. After `runs.start()` returns a `runId`, retain it: following a reconnect, call","`runs.get(runId)` and `runs.await(runId)` on the replacement Runtime. Never call","`runs.start()` again for that admitted Run or replay its provider/tool effects.","The v0.7.93 SDK keeps `sandboxRuntime:4` and `crashOutcomeModel:2`.","A durable Windows failed shutdown outcome ends the 170-second orderly","exit wait and enters exact recovery immediately.","After a verified boot change, previous-boot shared ACL markers may be","recovered under the machine lock before they are cleared.","Anthropic and OpenAI abort wrappers are classified by isolated SDK class","identity when the request signal is already aborted.","The v0.7.92 SDK advertises `sandboxRuntime:4` and `crashOutcomeModel:2`.","Historical filesystem-effect tickets shared an operation token with a coordinator lock;","v0.7.96 ignores that state and keeps the deprecated lease APIs as inert compatibility shims.","Managed `onComplete` is not terminal authority; the executor Promise is.","`KodaXFileLockTimeoutError` is a historical compatibility type from the retired","filesystem-effect coordinator, not a current shell/text/worktree failure signal.","Do not delete old ProgramData lock files by hand.","Resume reconstruction uses canonical Session messages as the ordinary","conversation; uiHistory may overlay display metadata but cannot hide that","transcript. Presentation-only agent-completed and task-completed events","stay host-owned when a non-empty CLI uiHistory exists.","The same release requires `liveOutputSegments:1` for new daemon consumers and","bundles lazy Anthropic/OpenAI SDK dependency graphs in standalone binaries.","AskUser and permission prompts have independent bounded deadlines and owner AbortSignals. On expiry, Runtime accepts only a validated default; otherwise it dismisses the request. MCP reverse elicitation cancels through the same signal. `reclaimStaleKodaXFileLock` is the public Agent helper for an explicitly identified stale learning lock; it is not a general lock deletion primitive.","Configure `userInputTimeoutMs` independently from `permissionTimeoutMs`; both are validated before embedded, Worker, or daemon startup. Permission timeout 0 retains its timer-disable meaning.","","Require `learningCenter:1` and `skillLearningLoop:1` when a host depends on the complete","F263 project-canary contract. `runtime.learning` exposes list/get/snapshot/events/subscribe","plus explicit acknowledge, snooze, reject, disable, rollback, review, trust, and user-scope","promotion controls. Inventory and lifecycle state remain Runtime-owned; clients render","the Learning Center and never infer activation from files alone.","","Packaged/asar Electron hosts may use daemon auto-start when the default-enabled","RunAsNode fuse is available. `homeDir` is the CLI-style base directory that owns","`.kodax`; `KODAX_HOME` is the lower-level `.kodax` path. ELECTRON_RUN_AS_NODE exists","only at the detached child exec boundary and is removed before daemon or user child","code loads. If the fuse is disabled, start the daemon with ordinary Node/CLI and use","attach-only mode; KodaX does not reopen the GUI or silently fall back to inline mode.","","Windows child cleanup identity-checks observed processes and exposes indeterminate outcomes","instead of using bare-PID success. Snapshot ancestry is not Job Object containment: an","intermediate parent can exit before a later snapshot and hide a running descendant. Until","Issue 256 is resolved with spawn-time Job Object assignment and a host-issued Worker owner","lease, do not treat Runtime/Worker close as proof that every descendant terminated.","","Runtime Auto Mode is a durable Session setting, not a UI-side classifier. Query","sessions.getAutoModeStats() for reviewer health. Session settings may select","`autoModeClassifierModel`; policy comes from `config.json#autoReview.policy` or the","Runtime host's `autoReview.administratorPolicy` / `autoReview.modelGuidance` options.","A missing LLM classifier model blocks only a real host-boundary","review; it does not block sandbox-first startup or become a permission prompt. Permission requests can include opaque","`grantSuggestions`; return a suggestion id for allow_session/allow_always rather than","building a scope. `RuntimePermissionMatcher` describes the Runtime-generated exact","command/path/call matcher, while persistent grants are revisioned through","permissions.listGrants() and revokeGrant(). Daemon capability","`runtimeAutoModeGuardrail` v5 advertises sandbox completion authority, host-boundary","review, no automatic prompt on denial, and one bounded host retry. Shared Session","settings v2 advertises the four canonical profiles and input-only auto-in-project alias.","ACP embedders import `ACP_PERMISSION_MODE_IDS`, `AcpPermissionMode`,","`AcpPermissionModeInput`, and `AcpRuntimePermissionMode` from the root SDK instead","of duplicating the canonical mode list.","Daemon auto-start requires v5/v2 and safely replaces only an idle older owner; reviewer","failure blocks with safer-route guidance and never restores a rules engine.","","Hosts that depend on bounded source-level streaming batches can require","`runtimeEventCoalescing:1`. Auto-start safely upgrades an idle legacy daemon; busy or","otherwise unsafe owners fail closed instead of being stopped. Text and reasoning deltas","remain reconstructable and each accumulated merge stays within 8 KiB before sequence","allocation, durable event persistence, and subscriber delivery.","","Persisted Actor Sessions have one exclusive Runtime owner. Current owners publish a","loopback identity challenge in addition to their PID, so an unrelated process that reuses","the PID cannot pin crashed ownership. Ambiguous probes and legacy owners remain fail-closed.","","Model `wait_agent` and SDK `runtime.agents.wait()` are intentionally different.","The model tool waits for mailbox/user/interruption/timeout activity and receives only","an acknowledgement. SDK hosts use `runtime.agents.events()` for Actor event snapshots","and `runtime.agents.wait(sessionId, afterSequence, timeoutMs)` for sequence-based","telemetry long-poll; progress remains observable without resampling the action model.","For user input during an active Run, require `interruptInput:1` and call","`runtime.runs.submitInput()`; the Runtime delivers the ordered batch at a safe Runner","boundary rather than creating a continuation Run. A terminal candidate closes the input","window atomically, drains every already-accepted item, and reserves one same-Run model","turn even at the iteration limit. Failure, cancellation, and terminal cleanup keep the","window closed so undelivered input cannot leak into another Run.","","For a Runtime-owned Session, every delivered interrupt is first persisted as its own","canonical user entry. `runtime.runs.get().interruptInputs` and `run.input.delivered` expose","the delivered item's `entryId`, an exact canonical session-entry reference; compaction,","event replay, and Runtime restart preserve it. Treat the field as absent only for legacy","records and never invent an entry id: missing/ambiguous provenance or required persistence","failure fails the current delivery closed.","Since v0.7.82, submitInput resolves the admitted authoritative Run before reading mutable","Session history. Active interrupt and after-turn admission therefore avoid transient","`data_changed`; after-turn still waits for predecessor settlement and an exact operation","id produces one admission and one queue item.","An observed daemon Stop is cooperative: it fences later provider retries, continuations,","guardrails, tools, and Run-admitted Actor work while preserving turns already admitted.","Trusted Stop/Abort causality is classified before credential redaction; completion races","and independent failures remain factual terminal outcomes.","Since v0.7.83, a Windows daemon starts suspended and is assigned to a kill-on-close","Job Object before user code runs. An out-of-Job supervisor waits for daemon exit and","Job emptiness. `waitForRuntimeDaemonShutdown()` requires the exact durable cleanup","outcome plus daemon and supervisor exit; the `daemonShutdownVerification:1` capability","advertises this contract. A legacy daemon without containment is not reported as verified","and cannot be migrated safely in place for this requirement: stop and relaunch it.","This daemon-owned slice narrows Issue 256 but does not close its Worker owner-lease gap,","which remains open after v0.7.87; this release assigns no replacement target.","Since v0.7.84, Agent progress persistence is bounded to one in-flight","durable projection plus one latest replacement, so terminal settlement does not","wait behind an unbounded progress backlog. If Actor durability becomes unknown,","a same-owner Stop can reconcile and validate the late snapshot, quiesce remaining","turns, and retry the repair. Promise terminal facts outrank fallback callbacks","after repair; foreign owners and unresolved stores remain fail-closed. A no-op","quiesce does not rewrite the Session.","","Since v0.7.85, Runtime event order belongs to one Session journal. Every event","carries a { sessionId, journalEpoch, seq } cursor, and events.subscribe()/replay()","require sessionId or runId; numeric Runtime-global sequences are not resumable.","A2A binds one Runtime Session to each Task, daemon clients require","sessionEventJournal:1, and corrupt journal indexes or ambiguous retention evidence","fail closed. A terminal Run with authoritative status and no queued interrupt input","is restored at startup without replaying its complete event journal.","The semantic repo-intelligence Worker retires after its idle warm-cache window;","a later cache miss starts a fresh Worker.","","F289/F290 keep Memory review draining and lesson/verdict admission bounded and","observable. F292 makes explicit Memory management conversation-first: safe explicit","remember, correction, forget, and recall requests are host-governed, while","ambiguous or inferred changes remain reviewable. The experimental SDK exposes","MemoryManagementAgent only when the supplied controller supports that capability.","","Since v0.7.86, inline daemon-enable recovery removes only a provably abandoned","owner fence; live, malformed, legacy, and ambiguous owners remain fail-closed.","Runtime owner and learning-file lock records include an OS process-start identity,","so PID reuse cannot preserve stale ownership. The former v0.7.86 Windows command-lifetime ACL owner serialization is historical: protocol 10 keeps machine migration and stale ACL recovery in explicit setup only.","Sandbox stop waits for per-command process-tree and Job-drain proof; missing attestation prevents replay of that command but does not fence independent trusted text or shell operations. Spawn, lease-release, and authoritative lifecycle cleanup","failures remain combined in a lifecycle safety diagnostic. Post-proof private Temp leaf housekeeping is diagnostic only. POSIX workspace sessions","initialize fresh KODAX_HOME policy roots before identity capture, settle only workspace-local","warm-up within the Shell abort/deadline, retire","invalid cached sessions after lease-cleanup failure, and block replacement after unconfirmed","process-tree or cleanup failure. Issue 256 remains open","after v0.7.87; this release assigns no replacement target.","","Coding hosts may pass `memoryRecallRunner` to opt into F275 semantic candidate selection;","without it, sparse governed intervention remains deterministic and adds zero selector calls.","Because the runner is a function binding, Worker/daemon DTO options reject it; configure it","inside the Runtime owner or use inline mode.","","The SDK is ESM-only. Capability queries such as per-model context/limits, credential","verification, and agent discovery can support embedder UIs without starting a coding run."].join(`
+`),sources:[{label:"doctor CLI",path:"src/kodax_doctor.ts"}],nextTopics:["troubleshooting","providers","config"]},{id:"sdk",title:"SDK",aliases:["embed","library","api","sdk\u5165\u95E8","\u5D4C\u5165"],summary:"Published subpaths, shared Runtime hosting, packaged Electron, A2A, and memory.",body:["The source monorepo has 4 workspace packages: @kodax-ai/llm, @kodax-ai/agent,","@kodax-ai/coding, and @kodax-ai/repl. The published @kodax-ai/kodax bundle exposes","12 SDK subpaths: /agent, /llm, /coding, /media, /repl, /skills, /mcp, /session,","/runtime, /sandbox, /a2a, and /experimental-memory.","Use @kodax-ai/kodax/coding for coding tasks; @kodax-ai/kodax/runtime for embedded,","Worker-hosted, or local-daemon sessions/runs/events/permissions;","@kodax-ai/kodax/sandbox for explicit host-owned ASRT containment;","@kodax-ai/kodax/a2a for the A2A 1.0 JSON-RPC/SSE client/server edge; and","@kodax-ai/kodax/experimental-memory for the opt-in MemoryAgent/MemorySession contract.","For an A2A server, listen() waits for durable recovery; a host wiring handle() directly","can await server.whenReady() before accepting traffic.","External Agent owner planes bound close to a 30-second default across admitted work","and executor disposal; hosts may set a positive finite `closeTimeoutMs` override.","","The shared local daemon is authoritative for one Coder profile. Join a session atomically","with sessions.observe(); replace local projection after runtime change/resync_required.","Use sessions.status() for the authoritative Session lifecycle projection and","captureRuntimeSessionDiagnostics() / sessions.diagnostics() for one bounded, read-only","support record. Diagnostics never take ownership, resume, repair, or migrate the Session.","Use sessions.conversation(), sessions.conversationPage(), and","sessions.conversationEntryChunk() for the same immutable ordinary-conversation projection","across embedded and daemon modes; require conversationHistory:2 when topology-transparent","managed context and direct clone provenance are needed.","Control mutations use durable operation identities and settings/permission revisions.","AskUser and permissions are transport-safe. Provider credentials are requested just in","time and scoped to a run/provider; run-bound Host Tools never leak into unrelated CLI","runs. Daemon/inline ownership is fenced, and inline rollback remains sticky. Partner","products keep their separate private embedded Runtime.","The v0.7.90 stabilization keeps these ownership boundaries while making workspace","timeout retirement orderly, preserving direct clone provenance, and normalizing","run-scoped tool schemas before provider dispatch.","The v0.7.91 SDK adds `runtimeExitSettlement:1` and the public","`settleKodaXRuntimeExit({ configHome, profile, runtime? })` transaction.","Pass the connected Runtime for an orderly host exit; after relaunch, call it","with `configHome` and `profile` to resume an exact prepared ticket. `clean`","means verified orderly shutdown, `recovered` means identity-scoped repair","was proven safe, and `blocked` supplies a bounded next action. The API never","accepts short caller timeouts and never exposes bare-PID kill or raw ACL deletion.","The v0.7.94 SDK keeps `sandboxRuntime:4` and `crashOutcomeModel:2`.","The v0.7.95 SDK advertises Windows `sandboxRuntime:5` and local","`runtimeExitSettlement:2`; `crashOutcomeModel:2` is unchanged and publication remains manual.","The v0.7.96-beta.3 release advertises Windows `sandboxRuntime:11`; `runtimeExitSettlement:2`","and `crashOutcomeModel:2` are unchanged. Linux native text authorities build in digest-pinned","`manylinux_2_28` images and require no `GLIBC_*` symbol newer than 2.28 (Issue 328).","Beta.3 retires superseded credential/Host Tool RPC connections so clients can reconnect and resume live scoped leases without replaying dispatched tools.","SDK packages carry the audited ASRT 0.0.65 WFP probe repair, including installs with --ignore-scripts; no consumer patch step is required.","Beta.2 recovers long coding sessions at context capacity boundaries: a confirmed upstream","overflow permits one generation retry after persisted history reduction without replaying tools,","and protected tool-output previews persist as durable artifacts when committed history cannot fit.","Bundled Provider credential scopes stay shared across SDK, Agent summaries, CLI, and Runtime Worker","requests; custom Provider credential verification honors exact and lazy run-scoped authority and","fails closed for denied scopes. Tool-free side queries omit empty `tools` arrays for strict vLLM gateways.","npm publication remains a separate manual maintainer action.","The v0.7.96-alpha.3 SDK adds the v2 scoped Provider credential broker (ADR-068):","Provider secrets stay in the OS keychain and resolve lazily, per wire call, for","one closed purpose (primary, fallback, classifier, sidecar, compaction, agent,","workflow, or utility) inside revocable leases. Manual compaction runs keychain-only","through a stable session.compact operation target. Shared-daemon native,","constructed, and workflow Agent turns require an explicit scoped credential","binding and fail closed without one; External Agents keep their independent","credentialRef plane. A v2 client fails closed against an older daemon, so restart","the daemon before using v2 bindings. Daemons advertising `daemonClientInventory:1`","also return bounded, display-only connected-client diagnostics","(`preflight.clients`); connection principals are attribution only, never","authorization or work ownership.","Windows sandbox cleanup preserves exact Job-drain proof without a machine-global admission mutex.","Windows per-command denyRead fails closed as unsupported_policy before target start and creates no execution receipt; explicit setup owns pre-cutover receipt recovery.","Dynamic worktrees register their cleanup policy at creation. Learning locks with stale","zero-byte, malformed, or truncated owner data are reclaimed through unchanged bytes/stat","verification. The coding runtime finalizes its authoritative `KodaXResult` before emitting the","public completion signal, so A2A responses cannot observe an empty successful answer.","Historical v0.7.94-v0.7.95 Runtime text tools overlapped a compatible live Bash lease","through one ASRT workspace policy. v0.7.96 removes that helper/session dependency;","hard-linked trusted-text targets remain rejected.","Since v0.7.95, KodaX-created linked worktree roots persist in the owning Session; they are","revalidated against the same Git common directory on later Runs, and are","revoked on removal; unrelated siblings are never inferred from their names.","A Session rooted in a real submodule proves its common directory through a byte-bounded","`.git/modules/...` core.worktree backlink; candidate roots still require linked-worktree backlinks.","A pre-correction Session migrates only an exact retained successful worktree_create result","after full Git revalidation; a retained successful remove prevents stale re-adoption.","Without create evidence, stop and remove/recreate the worktree;","ProgramData coordination files are not a migration mechanism.","Windows sandboxed git trusts authorized repo roots only","(`gitSafeDirectory: authorized-repo-roots`). Scheduled daemon shutdown","reports failed cleanup. A missing workspace directory omits the concurrent","text sandbox at Run start instead of aborting option construction.","Require `conversationHistory:2` when topology-transparent managed context","and direct clone provenance must be present.","Explicit Skill invocation remains available for every enabled Skill;","`disable-model-invocation` only blocks the model tool path.","Invalid `allowed-tools` entries and malformed hook JSON are diagnosed;","`PostToolUse` still runs if an embedder result observer throws.","Sandboxed text-helper stdin failures stay on the operation Promise.","Linked-worktree and submodule relationship files are read through strict byte bounds before git trust.","Since v0.7.94, Runtime observes every Run finalization rejection. A durable","terminal remains authoritative if only event publication fails. If no terminal record","can be persisted, the Run resolves `unknown` with `run_settlement_not_persisted` and","the Session execution fence remains closed. Terminal failures may include the bounded,","credential-safe `failureKind` classification without exposing provider error text.","Local context exhaustion is `failureKind: context_capacity`, `stage: runtime_control`,","and `providerErrorCode: context_capacity_exceeded`; optional `contextTokens.required`","and `contextTokens.available` give the bounded request/window estimate.","Since v0.7.96, an over-budget tool-result batch records bounded `capacityDebt` and","commits through the recovery ladder instead of aborting the Run; only irreducible overflow","reaches that `context_capacity` terminal.","Since v0.7.95, Runtime rereads a terminal status committed before status-lock cleanup failure and emits one","terminal event only when it exactly matches the local proposal; different authority wins.","Daemon clients receive `RuntimeDaemonDisconnectCode`, `connectionId`, and `reconnectable`","facts. After `runs.start()` returns a `runId`, retain it: following a reconnect, call","`runs.get(runId)` and `runs.await(runId)` on the replacement Runtime. Never call","`runs.start()` again for that admitted Run or replay its provider/tool effects.","The v0.7.93 SDK keeps `sandboxRuntime:4` and `crashOutcomeModel:2`.","A durable Windows failed shutdown outcome ends the 170-second orderly","exit wait and enters exact recovery immediately.","After a verified boot change, previous-boot shared ACL markers may be","recovered under the machine lock before they are cleared.","Anthropic and OpenAI abort wrappers are classified by isolated SDK class","identity when the request signal is already aborted.","The v0.7.92 SDK advertises `sandboxRuntime:4` and `crashOutcomeModel:2`.","Historical filesystem-effect tickets shared an operation token with a coordinator lock;","v0.7.96 ignores that state and keeps the deprecated lease APIs as inert compatibility shims.","Managed `onComplete` is not terminal authority; the executor Promise is.","`KodaXFileLockTimeoutError` is a historical compatibility type from the retired","filesystem-effect coordinator, not a current shell/text/worktree failure signal.","Do not delete old ProgramData lock files by hand.","Resume reconstruction uses canonical Session messages as the ordinary","conversation; uiHistory may overlay display metadata but cannot hide that","transcript. Presentation-only agent-completed and task-completed events","stay host-owned when a non-empty CLI uiHistory exists.","The same release requires `liveOutputSegments:1` for new daemon consumers and","bundles lazy Anthropic/OpenAI SDK dependency graphs in standalone binaries.","AskUser and permission prompts have independent bounded deadlines and owner AbortSignals. On expiry, Runtime accepts only a validated default; otherwise it dismisses the request. MCP reverse elicitation cancels through the same signal. `reclaimStaleKodaXFileLock` is the public Agent helper for an explicitly identified stale learning lock; it is not a general lock deletion primitive.","Configure `userInputTimeoutMs` independently from `permissionTimeoutMs`; both are validated before embedded, Worker, or daemon startup. Permission timeout 0 retains its timer-disable meaning.","","Require `learningCenter:1` and `skillLearningLoop:1` when a host depends on the complete","F263 project-canary contract. `runtime.learning` exposes list/get/snapshot/events/subscribe","plus explicit acknowledge, snooze, reject, disable, rollback, review, trust, and user-scope","promotion controls. Inventory and lifecycle state remain Runtime-owned; clients render","the Learning Center and never infer activation from files alone.","","Packaged/asar Electron hosts may use daemon auto-start when the default-enabled","RunAsNode fuse is available. `homeDir` is the CLI-style base directory that owns","`.kodax`; `KODAX_HOME` is the lower-level `.kodax` path. ELECTRON_RUN_AS_NODE exists","only at the detached child exec boundary and is removed before daemon or user child","code loads. If the fuse is disabled, start the daemon with ordinary Node/CLI and use","attach-only mode; KodaX does not reopen the GUI or silently fall back to inline mode.","","Windows child cleanup identity-checks observed processes and exposes indeterminate outcomes","instead of using bare-PID success. Snapshot ancestry is not Job Object containment: an","intermediate parent can exit before a later snapshot and hide a running descendant. Until","Issue 256 is resolved with spawn-time Job Object assignment and a host-issued Worker owner","lease, do not treat Runtime/Worker close as proof that every descendant terminated.","","Runtime Auto Mode is a durable Session setting, not a UI-side classifier. Query","sessions.getAutoModeStats() for reviewer health. Session settings may select","`autoModeClassifierModel`; policy comes from `config.json#autoReview.policy` or the","Runtime host's `autoReview.administratorPolicy` / `autoReview.modelGuidance` options.","A missing LLM classifier model blocks only a real host-boundary","review; it does not block sandbox-first startup or become a permission prompt. Permission requests can include opaque","`grantSuggestions`; return a suggestion id for allow_session/allow_always rather than","building a scope. `RuntimePermissionMatcher` describes the Runtime-generated exact","command/path/call matcher, while persistent grants are revisioned through","permissions.listGrants() and revokeGrant(). Daemon capability","`runtimeAutoModeGuardrail` v5 advertises sandbox completion authority, host-boundary","review, no automatic prompt on denial, and one bounded host retry. Shared Session","settings v2 advertises the four canonical profiles and input-only auto-in-project alias.","ACP embedders import `ACP_PERMISSION_MODE_IDS`, `AcpPermissionMode`,","`AcpPermissionModeInput`, and `AcpRuntimePermissionMode` from the root SDK instead","of duplicating the canonical mode list.","Daemon auto-start requires v5/v2 and safely replaces only an idle older owner; reviewer","failure blocks with safer-route guidance and never restores a rules engine.","","Hosts that depend on bounded source-level streaming batches can require","`runtimeEventCoalescing:1`. Auto-start safely upgrades an idle legacy daemon; busy or","otherwise unsafe owners fail closed instead of being stopped. Text and reasoning deltas","remain reconstructable and each accumulated merge stays within 8 KiB before sequence","allocation, durable event persistence, and subscriber delivery.","","Persisted Actor Sessions have one exclusive Runtime owner. Current owners publish a","loopback identity challenge in addition to their PID, so an unrelated process that reuses","the PID cannot pin crashed ownership. Ambiguous probes and legacy owners remain fail-closed.","","Model `wait_agent` and SDK `runtime.agents.wait()` are intentionally different.","The model tool waits for mailbox/user/interruption/timeout activity and receives only","an acknowledgement. SDK hosts use `runtime.agents.events()` for Actor event snapshots","and `runtime.agents.wait(sessionId, afterSequence, timeoutMs)` for sequence-based","telemetry long-poll; progress remains observable without resampling the action model.","For user input during an active Run, require `interruptInput:1` and call","`runtime.runs.submitInput()`; the Runtime delivers the ordered batch at a safe Runner","boundary rather than creating a continuation Run. A terminal candidate closes the input","window atomically, drains every already-accepted item, and reserves one same-Run model","turn even at the iteration limit. Failure, cancellation, and terminal cleanup keep the","window closed so undelivered input cannot leak into another Run.","","For a Runtime-owned Session, every delivered interrupt is first persisted as its own","canonical user entry. `runtime.runs.get().interruptInputs` and `run.input.delivered` expose","the delivered item's `entryId`, an exact canonical session-entry reference; compaction,","event replay, and Runtime restart preserve it. Treat the field as absent only for legacy","records and never invent an entry id: missing/ambiguous provenance or required persistence","failure fails the current delivery closed.","Since v0.7.82, submitInput resolves the admitted authoritative Run before reading mutable","Session history. Active interrupt and after-turn admission therefore avoid transient","`data_changed`; after-turn still waits for predecessor settlement and an exact operation","id produces one admission and one queue item.","An observed daemon Stop is cooperative: it fences later provider retries, continuations,","guardrails, tools, and Run-admitted Actor work while preserving turns already admitted.","Trusted Stop/Abort causality is classified before credential redaction; completion races","and independent failures remain factual terminal outcomes.","Since v0.7.83, a Windows daemon starts suspended and is assigned to a kill-on-close","Job Object before user code runs. An out-of-Job supervisor waits for daemon exit and","Job emptiness. `waitForRuntimeDaemonShutdown()` requires the exact durable cleanup","outcome plus daemon and supervisor exit; the `daemonShutdownVerification:1` capability","advertises this contract. A legacy daemon without containment is not reported as verified","and cannot be migrated safely in place for this requirement: stop and relaunch it.","This daemon-owned slice narrows Issue 256 but does not close its Worker owner-lease gap,","which remains open after v0.7.87; this release assigns no replacement target.","Since v0.7.84, Agent progress persistence is bounded to one in-flight","durable projection plus one latest replacement, so terminal settlement does not","wait behind an unbounded progress backlog. If Actor durability becomes unknown,","a same-owner Stop can reconcile and validate the late snapshot, quiesce remaining","turns, and retry the repair. Promise terminal facts outrank fallback callbacks","after repair; foreign owners and unresolved stores remain fail-closed. A no-op","quiesce does not rewrite the Session.","","Since v0.7.85, Runtime event order belongs to one Session journal. Every event","carries a { sessionId, journalEpoch, seq } cursor, and events.subscribe()/replay()","require sessionId or runId; numeric Runtime-global sequences are not resumable.","A2A binds one Runtime Session to each Task, daemon clients require","sessionEventJournal:1, and corrupt journal indexes or ambiguous retention evidence","fail closed. A terminal Run with authoritative status and no queued interrupt input","is restored at startup without replaying its complete event journal.","The semantic repo-intelligence Worker retires after its idle warm-cache window;","a later cache miss starts a fresh Worker.","","F289/F290 keep Memory review draining and lesson/verdict admission bounded and","observable. F292 makes explicit Memory management conversation-first: safe explicit","remember, correction, forget, and recall requests are host-governed, while","ambiguous or inferred changes remain reviewable. The experimental SDK exposes","MemoryManagementAgent only when the supplied controller supports that capability.","","Since v0.7.86, inline daemon-enable recovery removes only a provably abandoned","owner fence; live, malformed, legacy, and ambiguous owners remain fail-closed.","Runtime owner and learning-file lock records include an OS process-start identity,","so PID reuse cannot preserve stale ownership. The former v0.7.86 Windows command-lifetime ACL owner serialization is historical: protocol 10 keeps machine migration and stale ACL recovery in explicit setup only.","Sandbox stop waits for per-command process-tree and Job-drain proof; missing attestation prevents replay of that command but does not fence independent trusted text or shell operations. Spawn, lease-release, and authoritative lifecycle cleanup","failures remain combined in a lifecycle safety diagnostic. Post-proof private Temp leaf housekeeping is diagnostic only. POSIX workspace sessions","initialize fresh KODAX_HOME policy roots before identity capture, settle only workspace-local","warm-up within the Shell abort/deadline, retire","invalid cached sessions after lease-cleanup failure, and block replacement after unconfirmed","process-tree or cleanup failure. Issue 256 remains open","after v0.7.87; this release assigns no replacement target.","","Coding hosts may pass `memoryRecallRunner` to opt into F275 semantic candidate selection;","without it, sparse governed intervention remains deterministic and adds zero selector calls.","Because the runner is a function binding, Worker/daemon DTO options reject it; configure it","inside the Runtime owner or use inline mode.","","The SDK is ESM-only. Capability queries such as per-model context/limits, credential","verification, and agent discovery can support embedder UIs without starting a coding run."].join(`
 `),sources:[{label:"published exports",path:"package.json"},{label:"Runtime facade",path:"src/sdk-runtime.ts"},{label:"A2A facade",path:"src/sdk-a2a.ts"},{label:"SDK embedder guide",path:"public_docs/sdk/embedder-guide.md"},{label:"known issues",path:"docs/KNOWN_ISSUES.md"}],nextTopics:["providers","agents","tools"]},{id:"troubleshooting",title:"Troubleshooting",aliases:["error","problem","401","429","fix","\u6392\u969C","\u62A5\u9519","\u95EE\u9898"],summary:"First run kodax doctor; provider 401/429, network, Windows paths, Node/npm.",body:["First: run `kodax doctor --ping` to localize the problem.","- 401 / unauthorized: key missing/invalid \u2014 check provider env var or config.json.","- 429 / rate limit: back off, or set KODAX_FALLBACK_PROVIDERS for cross-provider fallback.","- Network: corporate proxy / region blocks can fail provider endpoints.","- Windows: paths use forward slashes internally; case-insensitive workspace match is handled.","- Node/npm: ensure Node >= 20; reinstall the global package if the CLI is stale.","- Daemon exits before healthy: inspect ~/.kodax/runtime/daemon/<profile>/bootstrap.log.","- Typed daemon disconnect: record the disconnect code, connectionId, and reconnectable","  flag. `invalid_frame` identifies a protocol/frame boundary; do not relabel every","  transport close as `daemon_crashed` without durable Run or launcher evidence.","- If a Run already has a runId, reconnect and query/await that same Run. Never start it","  again. `run_settlement_not_persisted` means terminal durability was not proven and the","  Session remains fenced; inspect disk, antivirus, lock, and I/O diagnostics.","- Integration degraded: validate only the named integrations/*.json domain. The core","  daemon remains usable and hot-recovers; do not delete config.json or the whole directory."].join(`
 `),sources:[{label:"doctor CLI",path:"src/kodax_doctor.ts"}],nextTopics:["doctor","providers","config"]}],cf=Object.freeze(Object.fromEntries(Qv.map(e=>[e.id,e])));var Zv="KodaX";function ex(e){return{id:String(e.id??""),title:String(e.title??""),aliases:e.aliases??[],summary:String(e.summary??""),body:String(e.body??""),sources:e.sources??[],nextTopics:e.nextTopics??[]}}i(ex,"normalizeInjected");function tx(e,t){let n=new Map,r=[],o=t??af;for(let s of o){if(n.has(s))continue;let a=cf[s];a&&(n.set(s,a),r.push(s))}for(let s of e??[])n.has(s.id)||r.push(s.id),n.set(s.id,ex(s));return{ids:r,byId:n}}i(tx,"buildEntries");function nx(e,t){return`(${t} ${e} manual \u2014 about ${t} itself, not Claude Code or Codex CLI.`+(t==="KodaX"?" KodaX config lives in ~/.kodax/config.json + KODAX_* env vars.)":")")}i(nx,"scopeAnchor");function uf(e){return e.toLowerCase().split(/[^a-z0-9一-鿿]+/u).filter(t=>t.length>0)}i(uf,"tokenize");function rx(e,t,n){return e.includes(n)?t.get(n):void 0}i(rx,"findByExactId");function ox(e,t,n){let r=n.trim().toLowerCase();if(r.length!==0)for(let o of e){let s=t.get(o);if(s.aliases.some(a=>a.toLowerCase()===r))return s}}i(ox,"findByAlias");function ix(e,t,n){if(t.length===0)return 0;let r=new Set(uf([e.id,e.title,e.summary,...e.aliases].join(" "))),o=0;for(let s of t)r.has(s)&&(o+=1);for(let s of e.aliases){let a=s.trim().toLowerCase();/[一-鿿]/u.test(a)&&n.includes(a)&&(o+=2)}return o}i(ix,"scoreTopic");function lf(e,t,n){let r=uf(n),o=n.toLowerCase();return e.map(s=>t.get(s)).map(s=>({topic:s,score:ix(s,r,o)})).filter(s=>s.score>0).sort((s,a)=>a.score-s.score).map(s=>s.topic)}i(lf,"rankByQuery");function df(e,t){return{matchedTopic:e.id,title:e.title,content:`${nx(e.id,t)}
 
@@ -372,7 +372,7 @@ LSP errors detected in this file, please fix:
 ${u}`:""}async getDefinition(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=await o.client.definition(Se.resolve(t),n).catch(()=>[]);return Xi(s,"No definition found at that position.")}async getHover(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=await o.client.hover(Se.resolve(t),n).catch(()=>null);return hw(s)}async getReferences(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=await o.client.references(Se.resolve(t),n).catch(()=>[]);return Xi(s,"No references found at that position.")}async getDocumentSymbols(t,n={}){let r=await this.navClient(t,n);if(r.kind!=="client")return r.message;let o=await r.client.documentSymbols(Se.resolve(t)).catch(()=>[]);return gw(o,"No symbols found in this file.")}async getWorkspaceSymbols(t,n={}){let r=await this.workspaceClients(n);if(r.length===0)return"No language server is available for workspace symbol search.";let o=await Promise.all(r.map(s=>s.workspaceSymbols(t).catch(()=>[])));return yw(o.flat(),"No workspace symbols found for that query.")}async getImplementation(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=await o.client.implementation(Se.resolve(t),n).catch(()=>[]);return Xi(s,"No implementation found at that position.")}async getPrepareCallHierarchy(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=await o.client.prepareCallHierarchy(Se.resolve(t),n).catch(()=>[]);return bw(s,"No call hierarchy item found at that position.")}async getIncomingCalls(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=Se.resolve(t),a=await o.client.prepareCallHierarchy(s,n).catch(()=>[]);if(a.length===0)return"No call hierarchy item found at that position.";let c=await Promise.all(a.map(l=>o.client.incomingCalls(l).catch(()=>[])));return vw(c.flat(),"No incoming calls found for that symbol.")}async getOutgoingCalls(t,n,r={}){let o=await this.navClient(t,r);if(o.kind!=="client")return o.message;let s=Se.resolve(t),a=await o.client.prepareCallHierarchy(s,n).catch(()=>[]);if(a.length===0)return"No call hierarchy item found at that position.";let c=await Promise.all(a.map(l=>o.client.outgoingCalls(l).catch(()=>[])));return xw(c.flat(),"No outgoing calls found for that symbol.")}async navClient(t,n){let r=_s(t);if(!r)return{kind:"message",message:`No language server is configured for ${Se.basename(t)}.`};let o=this.servers.filter(c=>c.languageIds.includes(r));if(o.length===0)return{kind:"message",message:`No language server is configured for ${Se.basename(t)}.`};let s=Se.resolve(t),a=n.gitRoot??Se.dirname(s);for(let c of o){let l=xd(s,c.rootMarkers,a),d=await this.getClient(c,l,n);if(d)return await d.notifyOpenOrChange(s).catch(()=>{}),{kind:"client",client:d}}return{kind:"message",message:o.map(c=>c.installGuidance).join(`
 `)}}async workspaceClients(t){let n=Se.resolve(t.gitRoot??process.cwd()),r=[];for(let o of this.servers){let s=await this.getClient(o,n,t);s&&r.push(s)}return r}async shutdownAll(){this.shuttingDown=!0;try{await Promise.all([...this.spawning.values()].map(n=>n.catch(()=>{})));let t=[...this.clients.values()];this.clients.clear(),this.broken.clear(),await Promise.all(t.map(n=>n.shutdown().catch(()=>{})))}finally{this.shuttingDown=!1}}killAllSync(){for(let t of this.clients.values())t.killSync();this.clients.clear()}resetBroken(t){t?this.broken.delete(t):this.broken.clear()}async getClient(t,n,r){let o=`${On(n)}|${t.id}`,s=this.clients.get(o);if(s)return s;if(this.broken.has(o))return;let a=this.spawning.get(o);if(a)return a;let c=this.spawnClient(t,n,o,r);this.spawning.set(o,c);try{return await c}finally{this.spawning.delete(o)}}async spawnClient(t,n,r,o){try{let s=t.discover({root:n,moduleUrl:this.config.moduleUrl});if(s||(s=await this.acquireIfEnabled(t,n,o)),!s){this.broken.add(r),this.config.debug?.(`${t.id} not installed at ${n} \u2014 ${t.installGuidance}`);return}o.onProgress?.(`Starting ${t.id} language server\u2026`);let c=await(this.config.createClient??(await import("./client-WH5AZEVW.js")).createLspClient)({serverId:t.id,root:n,launch:s,debug:this.config.debug});if(this.shuttingDown){await c.shutdown().catch(()=>{});return}return this.clients.set(r,c),c}catch(s){this.broken.add(r),this.config.debug?.(`${t.id} failed to start at ${n}: ${s.message}`);return}}async acquireIfEnabled(t,n,r){if(!(!t.acquire||!kd()))try{return await t.acquire({root:n,signal:r.signal,onProgress:r.onProgress,debug:this.config.debug})}catch(o){this.config.debug?.(`${t.id} auto-install failed: ${o.message}`);return}}},ro,kw=!1;function _w(){let e=po()?.lsp;if(!(e===!1||e===void 0&&process.env.KODAX_LSP==="0"))return ro||(ro=new Td({moduleUrl:import.meta.url,debug:process.env.KODAX_DEBUG_LSP?t=>S({source:"coding:lsp",level:"debug",message:t}):void 0}),!kw&&!hr()&&(kw=!0,process.once("exit",()=>ro?.killAllSync()))),ro}i(_w,"getDefaultLspService");async function Rz(){await ro?.shutdownAll()}i(Rz,"shutdownDefaultLspService");import{createHash as K$}from"node:crypto";import{execFileSync as l$}from"child_process";import{randomUUID as d$}from"node:crypto";import u$ from"fs/promises";import $w from"os";function Ew(e,t,n){let r=e?.provider?.trim()||process.env[t]?.trim()||void 0,o=e?.model?.trim()||process.env[n]?.trim()||void 0;if(!(!r&&!o))return{provider:r,model:o}}i(Ew,"resolveTier");function Ad(e,t){let n=po()?.modelTiers;if(e==="fast")return t?Ew(n?.fast,"KODAX_FAST_PROVIDER","KODAX_FAST_MODEL"):void 0;if(e==="deep")return Ew(n?.deep,"KODAX_DEEP_PROVIDER","KODAX_DEEP_MODEL")}i(Ad,"resolveModelHintTier");function t$(){let e=process.env.KODAX_FALLBACK_PROVIDERS?.trim();return e?e.split(",").map(t=>t.trim()).filter(Boolean):[]}i(t$,"resolveFallbackChain");function Sw(e){return e instanceof ps||e instanceof ms||e instanceof fs}i(Sw,"isFallbackEligibleError");function n$(e){return e instanceof ps?"rate-limit exhausted":e instanceof ms?"network error":e instanceof fs?"provider error":e instanceof Error?e.message:String(e)}i(n$,"errorReason");async function Rd(e,t,n,r){let o=e.provider??"anthropic";try{return await n(e,t)}catch(s){if(e.abortSignal?.aborted||!Sw(s))throw s;let a=t$().filter(l=>l!==o&&(r?.isProviderAllowed?.(l)??!0)),c=s;for(let l of a){r?.onFallback?.({fromProvider:o,toProvider:l,reason:n$(c)});try{return await n({...e,provider:l,model:void 0},t)}catch(d){if(e.abortSignal?.aborted||!Sw(d))throw d;c=d}}throw c}}i(Rd,"invokeChildWithFallback");function ut(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}i(ut,"isRecord");function r$(e){return e instanceof Error?e.message:String(e)}i(r$,"errorMessage");function Ji(e){try{return JSON.stringify(e,null,2)}catch{return String(e)}}i(Ji,"safeStringify");function Tw(e,t){switch(t){case"string":return typeof e=="string";case"number":return typeof e=="number";case"integer":return typeof e=="number"&&Number.isInteger(e);case"boolean":return typeof e=="boolean";case"object":return ut(e);case"array":return Array.isArray(e);case"null":return e===null;default:return!0}}i(Tw,"matchesType");function o$(e,t){return e.some(n=>n===t?!0:typeof n!="object"||typeof t!="object"?!1:Ji(n)===Ji(t))}i(o$,"enumMatches");function Gi(e,t){return e?`${e}.${t}`:t}i(Gi,"joinPath");function Vi(e,t,n=""){if(!ut(t))return[];let r=[],o=n||"(root)",s=t.type;if(typeof s=="string"&&!Tw(e,s))return[`${o}: expected type ${s}`];if(Array.isArray(s)&&!s.some(a=>typeof a=="string"&&Tw(e,a)))return[`${o}: expected one of types ${s.join("|")}`];if(Array.isArray(t.enum)&&!o$(t.enum,e)&&r.push(`${o}: value is not one of the allowed enum values`),Array.isArray(t.oneOf)){let a=t.oneOf.filter(c=>Vi(e,c,n).length===0).length;a!==1&&r.push(`${o}: value must match exactly one of the ${t.oneOf.length} oneOf variants (matched ${a})`)}if(ut(e)){let a=ut(t.properties)?t.properties:void 0;if(Array.isArray(t.required))for(let c of t.required)typeof c=="string"&&!(c in e)&&r.push(`${Gi(n,c)}: required field is missing`);if(a){for(let[c,l]of Object.entries(e))c in a&&r.push(...Vi(l,a[c],Gi(n,c)));if(t.additionalProperties===!1)for(let c of Object.keys(e))c in a||r.push(`${Gi(n,c)}: unexpected property (additionalProperties is false)`)}}return Array.isArray(e)&&ut(t.items)&&e.forEach((a,c)=>{r.push(...Vi(a,t.items,`${o}[${c}]`))}),r}i(Vi,"validateAgainstSchema");var i$=["$ref","$defs","definitions","allOf","anyOf","not","if","then","else","const","patternProperties","propertyNames","dependencies","dependentSchemas","dependentRequired","contains","unevaluatedProperties","unevaluatedItems","minimum","maximum","exclusiveMinimum","exclusiveMaximum","multipleOf","minLength","maxLength","pattern","minItems","maxItems","uniqueItems","minProperties","maxProperties"];function Yi(e,t,n){if(ut(e)){for(let r of i$)r in e&&!n.has(r)&&n.set(r,t||"(root)");if(ut(e.properties))for(let[r,o]of Object.entries(e.properties))Yi(o,Gi(t,r),n);if(ut(e.items)&&Yi(e.items,`${t||"(root)"}[]`,n),Array.isArray(e.oneOf))for(let r of e.oneOf)Yi(r,`${t||"(root)"}(oneOf)`,n);ut(e.additionalProperties)&&!n.has("additionalProperties (schema form)")&&n.set("additionalProperties (schema form)",t||"(root)")}}i(Yi,"collectUnsupportedKeywords");function Dz(e){if(!ut(e))return;let t=new Map;if(Yi(e,"",t),t.size===0)return;let n=[...t.entries()].map(([r,o])=>`\`${r}\` (at ${o})`).join(", ");throw new Error(`outputSchema uses unsupported JSON-Schema keyword(s): ${n}. The workflow validator supports only type, enum, required, properties, items, oneOf, and additionalProperties: false (nested object arrays included). Inline the referenced shapes, drop value-constraint keywords, and use that subset.`)}i(Dz,"assertSupportedOutputSchema");function s$(e){let t=e.indexOf("{"),n=e.indexOf("[");return t<0?n:n<0?t:Math.min(t,n)}i(s$,"firstStructureStart");function Aw(e){let t=s$(e);if(t<0)return;let n=e[t],r=n==="{"?"}":"]",o=0,s=!1,a=!1;for(let c=t;c<e.length;c+=1){let l=e[c];if(s){a?a=!1:l==="\\"?a=!0:l==='"'&&(s=!1);continue}if(l==='"'){s=!0;continue}if(l===n)o+=1;else if(l===r&&(o-=1,o===0))return e.slice(t,c+1)}}i(Aw,"balancedStructure");function a$(e){if(typeof e!="string"||e.trim().length===0)return;let t=/```(?:json)?\s*([\s\S]*?)```/gi,n,r;for(;(n=t.exec(e))!==null;){let o=n[1]?.trim();o&&(r=o)}return r?Aw(r)??r:Aw(e)}i(a$,"extractJsonCandidate");function Cd(e,t){let n=a$(e);if(n===void 0)return{ok:!1,errors:["no JSON value was found in the output"]};let r;try{r=JSON.parse(n)}catch(s){return{ok:!1,errors:[`output was not valid JSON: ${r$(s)}`]}}let o=Vi(r,t);return{ok:o.length===0,value:r,errors:o}}i(Cd,"evaluateStructuredOutput");function Rw(e){return["## Required Output Format","After your analysis, end your response with a single fenced ```json code block containing ONLY a JSON value that matches the JSON Schema below. Put nothing after the closing fence.","Schema:","```json",Ji(e),"```"].join(`
 `)}i(Rw,"buildStructuredOutputInstruction");function Cw(e,t){return["Your previous response did not produce a valid result object for the workflow.","Problems:",...e.map(n=>`- ${n}`),"Re-emit ONLY a single fenced ```json code block containing a JSON value that matches this schema. No prose, nothing after the closing fence.","Schema:","```json",Ji(t),"```"].join(`
-`)}i(Cw,"buildStructuredOutputRepairPrompt");var Iw={type:"object",additionalProperties:!1,required:["schemaVersion","outcomes","assertedCoverage"],properties:{schemaVersion:{type:"number",enum:[1]},outcomes:{type:"array",items:{type:"object",additionalProperties:!1,required:["target","disposition","evidenceRefs"],properties:{target:{oneOf:[{type:"object",additionalProperties:!1,required:["actorPath","turnId"],properties:{actorPath:{type:"string"},turnId:{type:"string"}}},{type:"object",additionalProperties:!1,required:["evidenceRef"],properties:{evidenceRef:{type:"string"}}}]},disposition:{type:"string",enum:["confirmed","refuted","unresolved"]},evidenceRefs:{type:"array",items:{type:"string"}}}}},assertedCoverage:{type:"array",items:{type:"string"}}}};function es(e){if(!Zi(e)||!Id(e,["schemaVersion","outcomes","assertedCoverage"])||e.schemaVersion!==1||!Array.isArray(e.outcomes)||e.outcomes.length>50||!Array.isArray(e.assertedCoverage)||e.assertedCoverage.length>50)return;let t=Ow(e.assertedCoverage);if(t===void 0)return;let n=[];for(let r of e.outcomes){let o=c$(r);if(o===void 0)return;n.push(o)}return{schemaVersion:1,outcomes:n,assertedCoverage:[...new Set(t)]}}i(es,"parsePatternDispositionEnvelope");function An(e){if(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number"&&Number.isFinite(e))return e;if(Array.isArray(e)){let n=[];for(let r of e){let o=An(r);if(o===void 0)return;n.push(o)}return n}if(!Zi(e))return;let t={};for(let[n,r]of Object.entries(e)){let o=An(r);if(o===void 0)return;t[n]=o}return t}i(An,"toAgentMetadataValue");function c$(e){if(!Zi(e)||!Id(e,["target","disposition","evidenceRefs"])||!Zi(e.target)||!Id(e.target,["actorPath","turnId","evidenceRef"])||e.disposition!=="confirmed"&&e.disposition!=="refuted"&&e.disposition!=="unresolved"||!Array.isArray(e.evidenceRefs)||e.evidenceRefs.length>20)return;let t=Ow(e.evidenceRefs);if(t===void 0)return;let n=Qi(e.target.actorPath),r=Qi(e.target.turnId),o=Qi(e.target.evidenceRef),s=n!==void 0&&r!==void 0;if(s!==(o!==void 0)&&!(!s&&(e.target.actorPath!==void 0||e.target.turnId!==void 0)))return{target:s?{actorPath:n,turnId:r}:{evidenceRef:o},disposition:e.disposition,evidenceRefs:[...new Set(t)]}}i(c$,"parseOutcome");function Ow(e){let t=[];for(let n of e){let r=Qi(n);if(r===void 0)return;t.push(r)}return t}i(Ow,"stringArray");function Qi(e){if(typeof e!="string")return;let t=e.trim();return t.length>0&&t.length<=512?t:void 0}i(Qi,"boundedString");function Zi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}i(Zi,"isRecord");function Id(e,t){let n=new Set(t);return Object.keys(e).every(r=>n.has(r))}i(Id,"hasOnlyKeys");var Od,ts;async function Dw(){if(Od)return Od;if(!ts){let e="./agent.js";ts=import("./agent-QGVCIM5U.js").then(t=>{let n=t.runKodaX;if(typeof n!="function")throw new Error("[child-executor] Agent module loaded but `runKodaX` export is missing or not a function. This indicates an API break in packages/coding/src/agent.ts. Check that `export { runKodaX }` is still present.");return Od=n,n}).catch(t=>{if(ts=void 0,t instanceof Error&&t.message.startsWith("[child-executor]"))throw t;let n=t instanceof Error?t.message:String(t);throw new Error(`[child-executor] Failed to lazy-load agent module (\`${e}\`) for a nested Agent turn. This usually means the @kodax-ai/coding build is broken or out of date. Underlying cause: ${n}`)})}return ts}i(Dw,"getRunKodaX");var f$=["You are summarizing your own just-completed child-agent report for a parent workflow.","Do not use tools. Do not continue investigation. Produce only the digest."].join(`
+`)}i(Cw,"buildStructuredOutputRepairPrompt");var Iw={type:"object",additionalProperties:!1,required:["schemaVersion","outcomes","assertedCoverage"],properties:{schemaVersion:{type:"number",enum:[1]},outcomes:{type:"array",items:{type:"object",additionalProperties:!1,required:["target","disposition","evidenceRefs"],properties:{target:{oneOf:[{type:"object",additionalProperties:!1,required:["actorPath","turnId"],properties:{actorPath:{type:"string"},turnId:{type:"string"}}},{type:"object",additionalProperties:!1,required:["evidenceRef"],properties:{evidenceRef:{type:"string"}}}]},disposition:{type:"string",enum:["confirmed","refuted","unresolved"]},evidenceRefs:{type:"array",items:{type:"string"}}}}},assertedCoverage:{type:"array",items:{type:"string"}}}};function es(e){if(!Zi(e)||!Id(e,["schemaVersion","outcomes","assertedCoverage"])||e.schemaVersion!==1||!Array.isArray(e.outcomes)||e.outcomes.length>50||!Array.isArray(e.assertedCoverage)||e.assertedCoverage.length>50)return;let t=Ow(e.assertedCoverage);if(t===void 0)return;let n=[];for(let r of e.outcomes){let o=c$(r);if(o===void 0)return;n.push(o)}return{schemaVersion:1,outcomes:n,assertedCoverage:[...new Set(t)]}}i(es,"parsePatternDispositionEnvelope");function An(e){if(e===null||typeof e=="string"||typeof e=="boolean"||typeof e=="number"&&Number.isFinite(e))return e;if(Array.isArray(e)){let n=[];for(let r of e){let o=An(r);if(o===void 0)return;n.push(o)}return n}if(!Zi(e))return;let t={};for(let[n,r]of Object.entries(e)){let o=An(r);if(o===void 0)return;t[n]=o}return t}i(An,"toAgentMetadataValue");function c$(e){if(!Zi(e)||!Id(e,["target","disposition","evidenceRefs"])||!Zi(e.target)||!Id(e.target,["actorPath","turnId","evidenceRef"])||e.disposition!=="confirmed"&&e.disposition!=="refuted"&&e.disposition!=="unresolved"||!Array.isArray(e.evidenceRefs)||e.evidenceRefs.length>20)return;let t=Ow(e.evidenceRefs);if(t===void 0)return;let n=Qi(e.target.actorPath),r=Qi(e.target.turnId),o=Qi(e.target.evidenceRef),s=n!==void 0&&r!==void 0;if(s!==(o!==void 0)&&!(!s&&(e.target.actorPath!==void 0||e.target.turnId!==void 0)))return{target:s?{actorPath:n,turnId:r}:{evidenceRef:o},disposition:e.disposition,evidenceRefs:[...new Set(t)]}}i(c$,"parseOutcome");function Ow(e){let t=[];for(let n of e){let r=Qi(n);if(r===void 0)return;t.push(r)}return t}i(Ow,"stringArray");function Qi(e){if(typeof e!="string")return;let t=e.trim();return t.length>0&&t.length<=512?t:void 0}i(Qi,"boundedString");function Zi(e){return typeof e=="object"&&e!==null&&!Array.isArray(e)}i(Zi,"isRecord");function Id(e,t){let n=new Set(t);return Object.keys(e).every(r=>n.has(r))}i(Id,"hasOnlyKeys");var Od,ts;async function Dw(){if(Od)return Od;if(!ts){let e="./agent.js";ts=import("./agent-AGJEZOXZ.js").then(t=>{let n=t.runKodaX;if(typeof n!="function")throw new Error("[child-executor] Agent module loaded but `runKodaX` export is missing or not a function. This indicates an API break in packages/coding/src/agent.ts. Check that `export { runKodaX }` is still present.");return Od=n,n}).catch(t=>{if(ts=void 0,t instanceof Error&&t.message.startsWith("[child-executor]"))throw t;let n=t instanceof Error?t.message:String(t);throw new Error(`[child-executor] Failed to lazy-load agent module (\`${e}\`) for a nested Agent turn. This usually means the @kodax-ai/coding build is broken or out of date. Underlying cause: ${n}`)})}return ts}i(Dw,"getRunKodaX");var f$=["You are summarizing your own just-completed child-agent report for a parent workflow.","Do not use tools. Do not continue investigation. Produce only the digest."].join(`
 `),p$=["Create a short user-facing digest of your previous report for the parent workflow.","Return only 2-4 bullet lines.","Each bullet must be concrete: a finding, decision, risk, evidence pointer, unresolved question, or next action.","Use the same natural language as the user request or your report.","Do not include a title, table, generic preamble, or workflow handoff markers."].join(`
 `),jw=4,Fw=1e4,m$=45e3,h$=40;function Uw(e,t){return e.historyStorage?{id:`worker-${d$()}`,scope:"managed-task-worker",storage:e.historyStorage,...t&&t.length>0?{initialMessages:[...t]}:{}}:t&&t.length>0?{initialMessages:[...t]}:void 0}i(Uw,"buildChildRunSession");function rs(e){let t={};return e.parentOptions.repoIntelligenceMode!==void 0&&(t.repoIntelligenceMode=e.parentOptions.repoIntelligenceMode),e.parentOptions.repoIntelligenceTrace!==void 0&&(t.repoIntelligenceTrace=e.parentOptions.repoIntelligenceTrace),t}i(rs,"inheritRepoIntelligenceContext");async function qw(e,t,n){if(e.length===0)return Nw;let r=e.filter(f=>f.readOnly),o=e.filter(f=>!f.readOnly),s=H$(o,n.parentRole,n.parentHarness),a=[...r,...s];if(a.length===0)return Nw;let c=[],l=[],d=n.onProgress??(()=>{});d(`Starting ${a.length} child tasks in parallel`);let u=await Qd({bundles:a,runOne:i(f=>f.readOnly?P$(f,t,n):L$(f,t,n),"runOne"),maxParallel:n.maxParallel,abortSignal:n.abortSignal,onProgress:i((f,p)=>{f.kind==="start"?d(`[${p.completedCount}/${p.totalCount}] Running: ${f.bundle.id}`):f.kind==="item-done"&&d(`[${p.completedCount}/${p.totalCount}] Done: ${f.bundle.id} \u2192 ${f.result.status}`)},"onProgress")});for(let f of u.results)f.status==="fulfilled"?c.push(f.value):c.push(Rn(f.bundle,`[Crash] ${f.reason.message}`,"failed"));for(let f of u.cancelled)l.push(f.id);return B$(a,c,l)}i(qw,"executeChildAgents");function Ww(e,t){let n=[...t?.bindingConstraints??[],...e.constraints];return{...t,delegatedObjective:e.objective,bindingConstraints:n,...e.scopeSummary!==void 0?{scopeHint:e.scopeSummary}:{},readOnly:t?.readOnly===!0||e.readOnly}}i(Ww,"buildChildPermissionIntent");var g$=["list_dispatchable_agents","spawn_agent","run_workflow","send_message","followup_task","wait_agent","interrupt_agent","list_agents","agent_output","emit_managed_protocol"];function y$(e,t){if(!t)return e;let n=new Set(t.tools),r=n.has("*"),o=new Set(e);for(let s of Vt()){let a=!r&&!n.has(s.name),c=!t.network&&(s.sideEffect==="reads-network"||s.sideEffect==="mutates-network"),l=!t.canAskUser&&s.name==="ask_user_question";(a||c||l)&&o.add(s.name)}return[...o]}i(y$,"restrictToolsForActor");function Bw(e,t,n){let r=y$(e,t);return n!==void 0?r:[...new Set([...r,...g$])]}i(Bw,"restrictToolsForChildRuntime");function os(e,t){return t.contextAgentId??e.id}i(os,"childContextAgentId");function is(e,t){return t.contextParentAgentId??(t.actorControl!==void 0?t.actorParentAgentId:e.currentAgentId)}i(is,"childContextParentAgentId");function ns(e,t,n){if(t.includes(e))return!1;let r=Vt().find(o=>o.name===e);return r?n.toolVisibilityPolicy?.({name:r.name,sideEffect:r.sideEffect,planModeAllowed:r.planModeAllowed===!0})??!0:!1}i(ns,"isChildToolVisible");function $d(e,t){return t===void 0||t.providers.includes("*")||t.providers.includes(e)}i($d,"isProviderAllowed");function Hw(e,t){if(!$d(e,t))throw new Error(`Child Actor is not authorized to use provider ${e}.`)}i(Hw,"assertChildProviderAllowed");function w$(e){let t=JSON.parse(e);if(typeof t!="object"||t===null||!("path"in t))throw new Error("worktree_create returned an invalid payload");let n=t.path;if(typeof n!="string"||n.length===0)throw new Error("worktree_create returned an invalid path");return n}i(w$,"readWorktreePath");async function Kw(e,t){if(e.isolation!=="worktree")return{ctx:t};let n=await Bh({description:`workflow-${e.id}`},t),r=w$(n);return{ctx:{...t,gitRoot:r,executionCwd:r},worktreePath:r}}i(Kw,"prepareChildIsolationScope");function zw(e,t){return t.worktreePath?[`[Workflow worktree: ${t.worktreePath}]`,e].join(`
 `):e}i(zw,"annotateWorktreeSummary");async function Pw(e,t){if(e.worktreePath)try{await Kh(e.worktreePath,t);return}catch(n){return`[Workflow worktree cleanup failed: ${n instanceof Error?n.message:String(n)}]`}}i(Pw,"cleanupChildIsolationScope");function b$(e,t){return t?{...e,summary:`${e.summary}
@@ -408,4 +408,4 @@ ${Oe(o)}
 ${Oe(e.content)}
 </agent-completed>`}return`<agent-message id="${Oe(e.messageId)}" from="${Oe(e.senderPath)}" classification="${e.classification}">
 ${Oe(e.content)}
-</agent-message>`}i(Dd,"renderMailboxMessage");function aP(e,t){if(!(!t||e.actor.capabilities.providers.includes("*"))&&!e.actor.capabilities.providers.includes(t))throw new Error(`Actor ${e.actor.path} is not authorized to use provider ${t}.`)}i(aP,"assertProviderAuthority");function Oe(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}i(Oe,"escapeXml");function cP(e){return{async admit(t){return e.spentBudget+t.units>e.totalBudget?{admitted:!1,fact:{code:"agent_budget_exhausted",retryable:!1,reason:`shared root work budget exhausted (${e.spentBudget}/${e.totalBudget})`}}:(e.spentBudget+=t.units,{admitted:!0})},async refund(){e.spentBudget=Math.max(0,e.spentBudget-1)},snapshot:i(()=>({...e}),"snapshot")}}i(cP,"managedWorkBudgetPort");function lP(e,t){let n=Xe(e.specialistName);if(n)return n;let r=Xe(e.agentId);if(!(!r||t.actor.kind==="native"))throw new Error(`Agent selector ${r} was not resolved before execution.`)}i(lP,"specialistName");function dP(e){return e==="fast"||e==="balanced"||e==="deep"?e:void 0}i(dP,"modelHint");function uP(e){let t=Xe(e);if(!t)return;let n=Cn(t);return n==="auto"?void 0:n}i(uP,"effort");function Xe(e){return typeof e=="string"&&e.length>0?e:void 0}i(Xe,"metadataString");function pb(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}i(pb,"metadataStringArray");import gb from"node:path";var fP=80;function pP(e){let t=e.trim().replace(/[^A-Za-z0-9._-]+/g,"_").replace(/^_+|_+$/g,"").slice(0,fP);return!t||t==="."||t===".."?"session":t}i(pP,"sanitizeScratchSessionId");function yb(e){let t=e.session?.id?.trim();if(!t)return;let n=e.context?.gitRoot?.trim(),r=n?gb.resolve(n):he(e.context);return gb.resolve(r,".agent","tmp","sessions",pP(t))}i(yb,"getSessionScratchDir");var mP="emit_managed_protocol",RX="kodax-task-contract",hP="kodax-task-verdict",CX="kodax-task-scout",IX="kodax-task-handoff";function gP(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}i(gP,"asRecord");function wb(e){return e.trim().toLowerCase()===mP}i(wb,"isManagedProtocolToolName");function bb(e,t){if(!(!e&&!t))return{verdict:t?.verdict?{...e?.verdict??{},...t.verdict}:e?.verdict}}i(bb,"mergeManagedProtocolPayload");function yP(e){let t=e.trim().toLowerCase();if(!t)return;let r=t.replace(/[`"'()[\]{}<>]+/g,"").replace(/[.:;!?]+$/g,"").replace(/[_\s-]+/g," ").trim().split(/\s+/,1)[0]??"";if(r){if(/^accept(?:ed|s|ing)?$/.test(r)||r==="approve"||r==="approved")return"accept";if(/^revis(?:e|ed|es|ing)?$/.test(r))return"revise";if(/^block(?:ed|ing)?$/.test(r))return"blocked"}}i(yP,"normalizeManagedVerdictStatus");function wP(e){let t=e.trim();if(!t)return;let n=t.replace(/[`"'()[\]{}<>]+/g,"").replace(/[.:;!?]+$/g,"").replace(/[\s-]+/g,"_").trim().toUpperCase();if(n==="H1_EXECUTE_EVAL"||n==="H1")return"H1_EXECUTE_EVAL";if(n==="H2_PLAN_EXECUTE_EVAL"||n==="H2")return"H2_PLAN_EXECUTE_EVAL"}i(wP,"normalizeManagedNextHarness");function bP(e){return Array.isArray(e)?e.map(t=>String(t).trim()).filter(Boolean):typeof e=="string"?e.split(/\r?\n/).map(t=>t.replace(/^-+\s*/,"").trim()).filter(Boolean):[]}i(bP,"normalizeStringListValue");function OX(e,t,n=""){let r=gP(t);if(!r||e!=="evaluator")return;let o=typeof r.status=="string"?yP(r.status):void 0;if(o)return{verdict:{source:"evaluator",status:o,reason:typeof r.reason=="string"&&r.reason.trim()||void 0,followups:bP(r.followup??r.followups),userFacingText:n,userAnswer:typeof r.user_answer=="string"?r.user_answer.trim()||void 0:typeof r.userAnswer=="string"&&r.userAnswer.trim()||void 0,nextHarness:typeof(r.next_harness??r.nextHarness)=="string"?wP(String(r.next_harness??r.nextHarness)):void 0,budgetRequest:typeof(r.budget_request??r.budgetRequest)=="string"&&String(r.budget_request??r.budgetRequest).trim()||void 0}}}i(OX,"coerceManagedProtocolToolPayload");function $X(e){if(e==="evaluator")return hP}i($X,"getManagedBlockNameForRole");function PX(e,t){return e&&t==="evaluator"?!!e.verdict:!1}i(PX,"hasManagedProtocolForRole");function MX(e,t){return new RegExp(String.raw`\`\`\`${t}\s*[\s\S]*?\`\`\``,"i").test(e)}i(MX,"textContainsManagedBlock");function vb(e,t){if(!t||t.length===0)return e;let n=new Set(t);return e.filter(r=>!n.has(r))}i(vb,"filterExcludedTools");function xb(e,t,n){return t?e.filter(r=>{let o=Be(r)??n?.get(r);return o?t({name:o.name,sideEffect:o.sideEffect,planModeAllowed:o.planModeAllowed===!0}):!1}):e}i(xb,"applyToolVisibilityPolicy");function vP(e,t,n=!1,r,o=!1){let s=nc(t)==="off"?nd(e):e;return n||(s=rd(s)),s=Hl(s,r),s=Ql(s,r),o||(s=s.filter(a=>a!=="list_dispatchable_agents")),s}i(vP,"getRuntimeActiveToolNames");function BX(e,t,n=!1,r=!1,o,s,a,c=!1,l){let d=td(),u=new Set(d.map(m=>m.name)),f=[...d,...(l??[]).filter(m=>!u.has(m.name)).map(Fi)];if(e.length===0)return[];let p=new Set(vP(e,t,r,o,c));return f.filter(m=>p.has(m.name)&&(n||!wb(m.name))).map(m=>{let h=Lo(m,a);if(!Ui(h.name)||s&&s.has(h.name))return h;let y=_n[h.name];return y?{...h,description:y}:h})}i(BX,"getActiveToolDefinitions");import{randomUUID as xP}from"node:crypto";import{join as kP}from"node:path";function _P(e,t){if(t&&/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(t)&&!t.includes(".."))return kP(e,t)}i(_P,"resolveResumeFromRunDir");function rG(e){let{options:t,runtime:n,managedProtocolPayloadRef:r,sessionId:o}=e,s=t.events??{},a=he(t.context),c=yb(t),l=xb(vb([...Ht],t.context?.excludeTools),t.context?.toolVisibilityPolicy),d=Ht.every(f=>l.includes(f))?Cc({sessionId:o,currentAgentId:t.context?.currentAgentId,sessionScope:t.session?.scope,storage:t.session?.storage}):void 0,u={backups:new Map,actorControl:t.context?.actorControl,actorQueueAgentId:t.context?.actorQueueAgentId,contextIdentitySessionId:t.context?.contextIdentitySessionId??o,actorHost:t.context?.actorHost,managedWorkBudget:t.context?.managedWorkBudget,permissionIntent:t.context?.permissionIntent,gitRoot:t.context?.gitRoot??void 0,sessionId:o,...d!==void 0?{loadSessionHistory:d}:{},taskSurface:t.context?.taskSurface,agentProfile:t.context?.agentProfile,agentScope:t.context?.agentScope,agentExecutorPlane:t.context?.agentExecutorPlane,selfManual:t.selfManual,skillDynamicContext:t.skillDynamicContext,skillRegistry:t.context?.skillRegistry,admitLearnedSkillInvocation:t.context?.admitLearnedSkillInvocation,skillScriptRunner:t.context?.skillScriptRunner,assertReadablePath:t.context?.assertReadablePath,toolVisibilityPolicy:t.context?.toolVisibilityPolicy,excludeTools:t.context?.excludeTools,lspService:t.context?.lspService??_w(),executionCwd:a,shellExecution:t.context?.shellExecution,sandbox:t.sandbox,shellSandbox:t.context?.shellSandbox,resolveShellPermissionMode:t.context?.resolveShellPermissionMode,authorizeShellHostExecution:t.context?.authorizeShellHostExecution,trustedTextMutationHost:t.context?.trustedTextMutationHost,workspaceSandboxRoots:t.context?.workspaceSandboxRoots,sessionScratchDir:c,extensionRuntime:n,askUser:s.askUser,askUserMulti:s.askUserMulti,askUserInput:s.askUserInput,exitPlanMode:s.exitPlanMode,abortSignal:t.abortSignal,managedProtocolRole:t.context?.managedProtocolEmission?.enabled?t.context.managedProtocolEmission.role:void 0,emitManagedProtocol:t.context?.managedProtocolEmission?.enabled?f=>{r.current=bb(r.current,f)}:void 0,mutationTracker:t.context?.mutationTracker,planModeBlockCheck:t.context?.planModeBlockCheck,guardrails:t.guardrails,parentAgentConfig:{provider:t.provider,model:t.modelOverride??t.model,reasoningMode:t.reasoningMode,effort:t.effort,repoIntelligenceMode:t.context?.repoIntelligenceMode,repoIntelligenceTrace:t.context?.repoIntelligenceTrace,...t.compaction!==void 0?{compaction:{...t.compaction}}:{},...t.context?.contextDiagnostics!==void 0?{contextDiagnostics:t.context.contextDiagnostics}:{},...t.disablePromptCache!==void 0?{disablePromptCache:t.disablePromptCache}:{},...t.context?.shellExecution!==void 0?{shellExecution:t.context.shellExecution}:{},...t.sandbox!==void 0?{sandbox:t.sandbox}:{},...t.context?.permissionIntent!==void 0?{permissionIntent:t.context.permissionIntent}:{}},parentEvents:s,onChildProgress:void 0,currentAgentId:t.context?.currentAgentId,parentAgentId:t.context?.parentAgentId,sendMessageTurnCounter:{count:0},goalContext:t.context?.goalRuntime?.goalContext};if(!u.actorControl&&(t.agentMode==="ama"||t.context?.actorSession)){let f=t.context?.actorSession??new oo({maxConcurrentThreadsPerSession:t.maxConcurrentThreadsPerSession,sessionId:o});u.actorHost=f,u.actorControl=f.attach(u,t)}return u.workflowHost=SP(t,o,u.actorControl,u.actorHost),u}i(rG,"buildToolExecutionContext");function EP(e,t){return{...t?{sessionId:t}:{},...e.context?.agentProfile?.surface?{surface:e.context.agentProfile.surface}:{},...e.context?.taskSurface?{taskSurface:e.context.taskSurface}:{},...e.context?.gitRoot?{projectRoot:e.context.gitRoot}:{}}}i(EP,"buildWorkflowHostMetadata");function SP(e,t,n,r){let o=e.workflowRunsBaseDir;if(process.env.KODAX_DEBUG_WORKFLOW_GATE){let a=o===void 0?"no-host: workflowRunsBaseDir undefined":e.agentMode!=="ama"?`no-host: agentMode=${String(e.agentMode)} (need ama)`:e.context?.workflowIntent!=="explicit"?"no-host: explicit Workflow intent absent":"host wired";S({source:"coding:workflow-gate",level:"debug",message:"Workflow host gate evaluated.",detail:{agentMode:e.agentMode,runsBaseDir:o,decision:a}})}if(o===void 0||e.agentMode!=="ama"||e.context?.workflowIntent!=="explicit")return;let s=i(async({manifest:a,source:c,args:l,resumeFromRunId:d,signal:u})=>{let[{startManagedWorkflow:f},{getDefaultWorkflowRunManager:p}]=await Promise.all([import("./host-OYXSGVJK.js"),import("./run-manager-B46VII2V.js")]),m=[e.abortSignal,u].filter(j=>j!==void 0),h=m.length===0?void 0:m.length===1?m[0]:AbortSignal.any(m),y=n&&r?{...e,context:{...e.context,actorControl:n,actorHost:r}}:e,w=fo(),g=w===void 0?void 0:`run-${Date.now().toString(36)}-${xP().replace(/-/g,"").slice(0,8)}`,b=w===void 0||g===void 0?void 0:uo(w,{kind:"workflow",workflowRunId:g}),x=i(()=>{b?.close("Workflow cancelled")},"closeCredentialScopeOnAbort");b!==void 0&&h!==void 0&&(h.aborted?x():h.addEventListener("abort",x,{once:!0}));let v=i(()=>{h?.removeEventListener("abort",x)},"releaseCredentialAbort"),E=i(()=>f({source:{kind:"inline",manifest:a,source:c},args:l,options:y,runsBaseDir:o,...g===void 0?{}:{runId:g},manager:p(),...(()=>{let j=_P(o,d);return j?{resumeFromRunDir:j}:{}})(),...h?{signal:h}:{},processMetadata:{hostMetadata:EP(e,t)}}),"startWorkflow"),_;try{_=b===void 0?await E():await lo(b,E)}catch(j){throw v(),b?.close("Workflow start failed"),j}if(_.kind==="declined")return v(),b?.close("Workflow declined"),{kind:"declined",reason:_.reason};let I=_.qualityWarnings?.map(j=>`${j.code}: ${j.message}`),V=(b===void 0?_.managed.done:_.managed.done.finally(()=>{v(),b.close("Workflow settled")})).then(j=>{let M=_.managed.getSnapshot?.(),W=j.kind==="completed"?j.state.events.reduce((Q,te)=>{if(te.type==="agent_unverified"){let z=te.data?.name??te.data?.taskId;Q.push(typeof z=="string"&&z.length>0?z:"agent")}return Q},[]):[];return{kind:"started",runId:_.runId,...M?.status!==void 0?{status:M.status}:{},...M?.resultText!==void 0?{resultText:M.resultText}:{},...M?.error!==void 0?{error:M.error}:{},...W.length>0?{verificationWarnings:W}:{},...I&&I.length>0?{workflowQualityWarnings:I}:{}}});return{kind:"started",runId:_.runId,done:V,...I&&I.length>0?{workflowQualityWarnings:I}:{}}},"startInline");return{startInline:s,runInline:i(async a=>{let c=await s(a);return c.kind==="declined"?{kind:"declined",reason:c.reason}:await c.done},"runInline")}}i(SP,"buildWorkflowToolHost");export{he as a,H as b,Ge as c,Ss as d,xe as e,As as f,Ab as g,MP as h,Rb as i,$n as j,vu as k,LP as l,KP as m,zP as n,ie as o,So as p,YP as q,Ps as r,Ms as s,ZP as t,eM as u,Ds as v,Mu as w,hM as x,Xu as y,Gu as z,TM as A,AM as B,RM as C,CM as D,Bs as E,Hs as F,Bt as G,RS as H,xc as I,A0 as J,O0 as K,$0 as L,Qu as M,tn as N,Mn as O,Ks as P,Co as Q,ot as R,vr as S,xr as T,Pv as U,Io as V,nn as W,Vs as X,jr as Y,IF as Z,OF as _,Fr as $,NF as aa,DF as ba,jF as ca,WF as da,CT as ea,BF as fa,af as ga,z0 as ha,cf as ia,ff as ja,Qs as ka,Lo as la,ah as ma,JF as na,ch as oa,QF as pa,ZF as qa,eU as ra,tU as sa,bi as ta,oU as ua,lh as va,oL as wa,ea as xa,na as ya,$x as za,Px as Aa,ra as Ba,da as Ca,ua as Da,jf as Ea,Rr as Fa,Tr as Ga,Ho as Ha,Kx as Ia,Sr as Ja,oa as Ka,Mf as La,Xo as Ma,ya as Na,Cr as Oa,ba as Pa,va as Qa,gt as Ra,Hn as Sa,RD as Ta,Ap as Ua,Oa as Va,$a as Wa,Rp as Xa,Pa as Ya,Ma as Za,La as _a,Na as $a,ja as ab,Fa as bb,Ua as cb,qa as db,$r as eb,ge as fb,yE as gb,nc as hb,Ej as ib,Sj as jb,Tj as kb,Mr as lb,li as mb,di as nb,Lr as ob,$E as pb,PE as qb,Aj as rb,rc as sb,oc as tb,ic as ub,sc as vb,dn as wb,cc as xb,fi as yb,lc as zb,Sm as Ab,oe as Bb,uc as Cb,fc as Db,pc as Eb,mc as Fb,gF as Gb,yF as Hb,wF as Ib,vS as Jb,hi as Kb,bF as Lb,Hr as Mb,Qe as Nb,ki as Ob,ew as Pb,DC as Qb,jC as Rb,Wr as Sb,Gh as Tb,Qc as Ub,Zc as Vb,O1 as Wb,dg as Xb,ug as Yb,N1 as Zb,fg as _b,q1 as $b,W1 as ac,B1 as bc,H1 as cc,K1 as dc,z1 as ec,pg as fc,yg as gc,cl as hc,xR as ic,hI as jc,PH as kc,od as lc,Fi as mc,MH as nc,_n as oc,Ui as pc,DH as qc,Cy as rc,Iy as sc,bI as tc,Ny as uc,Dy as vc,Zr as wc,qI as xc,ud as yc,fd as zc,rK as Ac,HI as Bc,KI as Cc,oK as Dc,Br as Ec,Ri as Fc,zt as Gc,_t as Hc,fl as Ic,vl as Jc,zr as Kc,Xr as Lc,Lg as Mc,Ng as Nc,_l as Oc,Et as Pc,zR as Qc,Tl as Rc,nr as Sc,rr as Tc,YR as Uc,Gr as Vc,eC as Wc,sC as Xc,aC as Yc,yn as Zc,Vr as _c,Yr as $c,mC as ad,Ml as bd,wn as cd,bn as dd,gC as ed,yC as fd,wC as gd,EC as hd,TC as id,OC as jd,Ni as kd,Yg as ld,MC as md,LC as nd,pd as od,md as pd,bK as qd,vK as rd,xK as sd,kK as td,_K as ud,eo as vd,Wi as wd,zy as xd,Vy as yd,iI as zd,or as Ad,sI as Bd,sr as Cd,Be as Dd,vn as Ed,aI as Fd,ed as Gd,cI as Hd,lI as Id,Vt as Jd,dI as Kd,uI as Ld,fI as Md,pI as Nd,mI as Od,At as Pd,td as Qd,vO as Rd,pl as Sd,gy as Td,yy as Ud,YC as Vd,JC as Wd,eI as Xd,tI as Yd,nI as Zd,$O as _d,nw as $d,rw as ae,yb as be,mP as ce,RX as de,hP as ee,CX as fe,IX as ge,wb as he,bb as ie,OX as je,$X as ke,PX as le,MX as me,ow as ne,pw as oe,Td as pe,_w as qe,Rz as re,Vi as se,Dz as te,es as ue,qw as ve,lX as we,oo as xe,bX as ye,vX as ze,vb as Ae,xb as Be,vP as Ce,BX as De,rG as Ee};
+</agent-message>`}i(Dd,"renderMailboxMessage");function aP(e,t){if(!(!t||e.actor.capabilities.providers.includes("*"))&&!e.actor.capabilities.providers.includes(t))throw new Error(`Actor ${e.actor.path} is not authorized to use provider ${t}.`)}i(aP,"assertProviderAuthority");function Oe(e){return e.replaceAll("&","&amp;").replaceAll("<","&lt;").replaceAll(">","&gt;").replaceAll('"',"&quot;")}i(Oe,"escapeXml");function cP(e){return{async admit(t){return e.spentBudget+t.units>e.totalBudget?{admitted:!1,fact:{code:"agent_budget_exhausted",retryable:!1,reason:`shared root work budget exhausted (${e.spentBudget}/${e.totalBudget})`}}:(e.spentBudget+=t.units,{admitted:!0})},async refund(){e.spentBudget=Math.max(0,e.spentBudget-1)},snapshot:i(()=>({...e}),"snapshot")}}i(cP,"managedWorkBudgetPort");function lP(e,t){let n=Xe(e.specialistName);if(n)return n;let r=Xe(e.agentId);if(!(!r||t.actor.kind==="native"))throw new Error(`Agent selector ${r} was not resolved before execution.`)}i(lP,"specialistName");function dP(e){return e==="fast"||e==="balanced"||e==="deep"?e:void 0}i(dP,"modelHint");function uP(e){let t=Xe(e);if(!t)return;let n=Cn(t);return n==="auto"?void 0:n}i(uP,"effort");function Xe(e){return typeof e=="string"&&e.length>0?e:void 0}i(Xe,"metadataString");function pb(e){return Array.isArray(e)?e.filter(t=>typeof t=="string"):[]}i(pb,"metadataStringArray");import gb from"node:path";var fP=80;function pP(e){let t=e.trim().replace(/[^A-Za-z0-9._-]+/g,"_").replace(/^_+|_+$/g,"").slice(0,fP);return!t||t==="."||t===".."?"session":t}i(pP,"sanitizeScratchSessionId");function yb(e){let t=e.session?.id?.trim();if(!t)return;let n=e.context?.gitRoot?.trim(),r=n?gb.resolve(n):he(e.context);return gb.resolve(r,".agent","tmp","sessions",pP(t))}i(yb,"getSessionScratchDir");var mP="emit_managed_protocol",RX="kodax-task-contract",hP="kodax-task-verdict",CX="kodax-task-scout",IX="kodax-task-handoff";function gP(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:void 0}i(gP,"asRecord");function wb(e){return e.trim().toLowerCase()===mP}i(wb,"isManagedProtocolToolName");function bb(e,t){if(!(!e&&!t))return{verdict:t?.verdict?{...e?.verdict??{},...t.verdict}:e?.verdict}}i(bb,"mergeManagedProtocolPayload");function yP(e){let t=e.trim().toLowerCase();if(!t)return;let r=t.replace(/[`"'()[\]{}<>]+/g,"").replace(/[.:;!?]+$/g,"").replace(/[_\s-]+/g," ").trim().split(/\s+/,1)[0]??"";if(r){if(/^accept(?:ed|s|ing)?$/.test(r)||r==="approve"||r==="approved")return"accept";if(/^revis(?:e|ed|es|ing)?$/.test(r))return"revise";if(/^block(?:ed|ing)?$/.test(r))return"blocked"}}i(yP,"normalizeManagedVerdictStatus");function wP(e){let t=e.trim();if(!t)return;let n=t.replace(/[`"'()[\]{}<>]+/g,"").replace(/[.:;!?]+$/g,"").replace(/[\s-]+/g,"_").trim().toUpperCase();if(n==="H1_EXECUTE_EVAL"||n==="H1")return"H1_EXECUTE_EVAL";if(n==="H2_PLAN_EXECUTE_EVAL"||n==="H2")return"H2_PLAN_EXECUTE_EVAL"}i(wP,"normalizeManagedNextHarness");function bP(e){return Array.isArray(e)?e.map(t=>String(t).trim()).filter(Boolean):typeof e=="string"?e.split(/\r?\n/).map(t=>t.replace(/^-+\s*/,"").trim()).filter(Boolean):[]}i(bP,"normalizeStringListValue");function OX(e,t,n=""){let r=gP(t);if(!r||e!=="evaluator")return;let o=typeof r.status=="string"?yP(r.status):void 0;if(o)return{verdict:{source:"evaluator",status:o,reason:typeof r.reason=="string"&&r.reason.trim()||void 0,followups:bP(r.followup??r.followups),userFacingText:n,userAnswer:typeof r.user_answer=="string"?r.user_answer.trim()||void 0:typeof r.userAnswer=="string"&&r.userAnswer.trim()||void 0,nextHarness:typeof(r.next_harness??r.nextHarness)=="string"?wP(String(r.next_harness??r.nextHarness)):void 0,budgetRequest:typeof(r.budget_request??r.budgetRequest)=="string"&&String(r.budget_request??r.budgetRequest).trim()||void 0}}}i(OX,"coerceManagedProtocolToolPayload");function $X(e){if(e==="evaluator")return hP}i($X,"getManagedBlockNameForRole");function PX(e,t){return e&&t==="evaluator"?!!e.verdict:!1}i(PX,"hasManagedProtocolForRole");function MX(e,t){return new RegExp(String.raw`\`\`\`${t}\s*[\s\S]*?\`\`\``,"i").test(e)}i(MX,"textContainsManagedBlock");function vb(e,t){if(!t||t.length===0)return e;let n=new Set(t);return e.filter(r=>!n.has(r))}i(vb,"filterExcludedTools");function xb(e,t,n){return t?e.filter(r=>{let o=Be(r)??n?.get(r);return o?t({name:o.name,sideEffect:o.sideEffect,planModeAllowed:o.planModeAllowed===!0}):!1}):e}i(xb,"applyToolVisibilityPolicy");function vP(e,t,n=!1,r,o=!1){let s=nc(t)==="off"?nd(e):e;return n||(s=rd(s)),s=Hl(s,r),s=Ql(s,r),o||(s=s.filter(a=>a!=="list_dispatchable_agents")),s}i(vP,"getRuntimeActiveToolNames");function BX(e,t,n=!1,r=!1,o,s,a,c=!1,l){let d=td(),u=new Set(d.map(m=>m.name)),f=[...d,...(l??[]).filter(m=>!u.has(m.name)).map(Fi)];if(e.length===0)return[];let p=new Set(vP(e,t,r,o,c));return f.filter(m=>p.has(m.name)&&(n||!wb(m.name))).map(m=>{let h=Lo(m,a);if(!Ui(h.name)||s&&s.has(h.name))return h;let y=_n[h.name];return y?{...h,description:y}:h})}i(BX,"getActiveToolDefinitions");import{randomUUID as xP}from"node:crypto";import{join as kP}from"node:path";function _P(e,t){if(t&&/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(t)&&!t.includes(".."))return kP(e,t)}i(_P,"resolveResumeFromRunDir");function rG(e){let{options:t,runtime:n,managedProtocolPayloadRef:r,sessionId:o}=e,s=t.events??{},a=he(t.context),c=yb(t),l=xb(vb([...Ht],t.context?.excludeTools),t.context?.toolVisibilityPolicy),d=Ht.every(f=>l.includes(f))?Cc({sessionId:o,currentAgentId:t.context?.currentAgentId,sessionScope:t.session?.scope,storage:t.session?.storage}):void 0,u={backups:new Map,actorControl:t.context?.actorControl,actorQueueAgentId:t.context?.actorQueueAgentId,contextIdentitySessionId:t.context?.contextIdentitySessionId??o,actorHost:t.context?.actorHost,managedWorkBudget:t.context?.managedWorkBudget,permissionIntent:t.context?.permissionIntent,gitRoot:t.context?.gitRoot??void 0,sessionId:o,...d!==void 0?{loadSessionHistory:d}:{},taskSurface:t.context?.taskSurface,agentProfile:t.context?.agentProfile,agentScope:t.context?.agentScope,agentExecutorPlane:t.context?.agentExecutorPlane,selfManual:t.selfManual,skillDynamicContext:t.skillDynamicContext,skillRegistry:t.context?.skillRegistry,admitLearnedSkillInvocation:t.context?.admitLearnedSkillInvocation,skillScriptRunner:t.context?.skillScriptRunner,assertReadablePath:t.context?.assertReadablePath,toolVisibilityPolicy:t.context?.toolVisibilityPolicy,excludeTools:t.context?.excludeTools,lspService:t.context?.lspService??_w(),executionCwd:a,shellExecution:t.context?.shellExecution,sandbox:t.sandbox,shellSandbox:t.context?.shellSandbox,resolveShellPermissionMode:t.context?.resolveShellPermissionMode,authorizeShellHostExecution:t.context?.authorizeShellHostExecution,trustedTextMutationHost:t.context?.trustedTextMutationHost,workspaceSandboxRoots:t.context?.workspaceSandboxRoots,sessionScratchDir:c,extensionRuntime:n,askUser:s.askUser,askUserMulti:s.askUserMulti,askUserInput:s.askUserInput,exitPlanMode:s.exitPlanMode,abortSignal:t.abortSignal,managedProtocolRole:t.context?.managedProtocolEmission?.enabled?t.context.managedProtocolEmission.role:void 0,emitManagedProtocol:t.context?.managedProtocolEmission?.enabled?f=>{r.current=bb(r.current,f)}:void 0,mutationTracker:t.context?.mutationTracker,planModeBlockCheck:t.context?.planModeBlockCheck,guardrails:t.guardrails,parentAgentConfig:{provider:t.provider,model:t.modelOverride??t.model,reasoningMode:t.reasoningMode,effort:t.effort,repoIntelligenceMode:t.context?.repoIntelligenceMode,repoIntelligenceTrace:t.context?.repoIntelligenceTrace,...t.compaction!==void 0?{compaction:{...t.compaction}}:{},...t.context?.contextDiagnostics!==void 0?{contextDiagnostics:t.context.contextDiagnostics}:{},...t.disablePromptCache!==void 0?{disablePromptCache:t.disablePromptCache}:{},...t.context?.shellExecution!==void 0?{shellExecution:t.context.shellExecution}:{},...t.sandbox!==void 0?{sandbox:t.sandbox}:{},...t.context?.permissionIntent!==void 0?{permissionIntent:t.context.permissionIntent}:{}},parentEvents:s,onChildProgress:void 0,currentAgentId:t.context?.currentAgentId,parentAgentId:t.context?.parentAgentId,sendMessageTurnCounter:{count:0},goalContext:t.context?.goalRuntime?.goalContext};if(!u.actorControl&&(t.agentMode==="ama"||t.context?.actorSession)){let f=t.context?.actorSession??new oo({maxConcurrentThreadsPerSession:t.maxConcurrentThreadsPerSession,sessionId:o});u.actorHost=f,u.actorControl=f.attach(u,t)}return u.workflowHost=SP(t,o,u.actorControl,u.actorHost),u}i(rG,"buildToolExecutionContext");function EP(e,t){return{...t?{sessionId:t}:{},...e.context?.agentProfile?.surface?{surface:e.context.agentProfile.surface}:{},...e.context?.taskSurface?{taskSurface:e.context.taskSurface}:{},...e.context?.gitRoot?{projectRoot:e.context.gitRoot}:{}}}i(EP,"buildWorkflowHostMetadata");function SP(e,t,n,r){let o=e.workflowRunsBaseDir;if(process.env.KODAX_DEBUG_WORKFLOW_GATE){let a=o===void 0?"no-host: workflowRunsBaseDir undefined":e.agentMode!=="ama"?`no-host: agentMode=${String(e.agentMode)} (need ama)`:e.context?.workflowIntent!=="explicit"?"no-host: explicit Workflow intent absent":"host wired";S({source:"coding:workflow-gate",level:"debug",message:"Workflow host gate evaluated.",detail:{agentMode:e.agentMode,runsBaseDir:o,decision:a}})}if(o===void 0||e.agentMode!=="ama"||e.context?.workflowIntent!=="explicit")return;let s=i(async({manifest:a,source:c,args:l,resumeFromRunId:d,signal:u})=>{let[{startManagedWorkflow:f},{getDefaultWorkflowRunManager:p}]=await Promise.all([import("./host-QNWCUM5M.js"),import("./run-manager-UWRNFFGA.js")]),m=[e.abortSignal,u].filter(j=>j!==void 0),h=m.length===0?void 0:m.length===1?m[0]:AbortSignal.any(m),y=n&&r?{...e,context:{...e.context,actorControl:n,actorHost:r}}:e,w=fo(),g=w===void 0?void 0:`run-${Date.now().toString(36)}-${xP().replace(/-/g,"").slice(0,8)}`,b=w===void 0||g===void 0?void 0:uo(w,{kind:"workflow",workflowRunId:g}),x=i(()=>{b?.close("Workflow cancelled")},"closeCredentialScopeOnAbort");b!==void 0&&h!==void 0&&(h.aborted?x():h.addEventListener("abort",x,{once:!0}));let v=i(()=>{h?.removeEventListener("abort",x)},"releaseCredentialAbort"),E=i(()=>f({source:{kind:"inline",manifest:a,source:c},args:l,options:y,runsBaseDir:o,...g===void 0?{}:{runId:g},manager:p(),...(()=>{let j=_P(o,d);return j?{resumeFromRunDir:j}:{}})(),...h?{signal:h}:{},processMetadata:{hostMetadata:EP(e,t)}}),"startWorkflow"),_;try{_=b===void 0?await E():await lo(b,E)}catch(j){throw v(),b?.close("Workflow start failed"),j}if(_.kind==="declined")return v(),b?.close("Workflow declined"),{kind:"declined",reason:_.reason};let I=_.qualityWarnings?.map(j=>`${j.code}: ${j.message}`),V=(b===void 0?_.managed.done:_.managed.done.finally(()=>{v(),b.close("Workflow settled")})).then(j=>{let M=_.managed.getSnapshot?.(),W=j.kind==="completed"?j.state.events.reduce((Q,te)=>{if(te.type==="agent_unverified"){let z=te.data?.name??te.data?.taskId;Q.push(typeof z=="string"&&z.length>0?z:"agent")}return Q},[]):[];return{kind:"started",runId:_.runId,...M?.status!==void 0?{status:M.status}:{},...M?.resultText!==void 0?{resultText:M.resultText}:{},...M?.error!==void 0?{error:M.error}:{},...W.length>0?{verificationWarnings:W}:{},...I&&I.length>0?{workflowQualityWarnings:I}:{}}});return{kind:"started",runId:_.runId,done:V,...I&&I.length>0?{workflowQualityWarnings:I}:{}}},"startInline");return{startInline:s,runInline:i(async a=>{let c=await s(a);return c.kind==="declined"?{kind:"declined",reason:c.reason}:await c.done},"runInline")}}i(SP,"buildWorkflowToolHost");export{he as a,H as b,Ge as c,Ss as d,xe as e,As as f,Ab as g,MP as h,Rb as i,$n as j,vu as k,LP as l,KP as m,zP as n,ie as o,So as p,YP as q,Ps as r,Ms as s,ZP as t,eM as u,Ds as v,Mu as w,hM as x,Xu as y,Gu as z,TM as A,AM as B,RM as C,CM as D,Bs as E,Hs as F,Bt as G,RS as H,xc as I,A0 as J,O0 as K,$0 as L,Qu as M,tn as N,Mn as O,Ks as P,Co as Q,ot as R,vr as S,xr as T,Pv as U,Io as V,nn as W,Vs as X,jr as Y,IF as Z,OF as _,Fr as $,NF as aa,DF as ba,jF as ca,WF as da,CT as ea,BF as fa,af as ga,z0 as ha,cf as ia,ff as ja,Qs as ka,Lo as la,ah as ma,JF as na,ch as oa,QF as pa,ZF as qa,eU as ra,tU as sa,bi as ta,oU as ua,lh as va,oL as wa,ea as xa,na as ya,$x as za,Px as Aa,ra as Ba,da as Ca,ua as Da,jf as Ea,Rr as Fa,Tr as Ga,Ho as Ha,Kx as Ia,Sr as Ja,oa as Ka,Mf as La,Xo as Ma,ya as Na,Cr as Oa,ba as Pa,va as Qa,gt as Ra,Hn as Sa,RD as Ta,Ap as Ua,Oa as Va,$a as Wa,Rp as Xa,Pa as Ya,Ma as Za,La as _a,Na as $a,ja as ab,Fa as bb,Ua as cb,qa as db,$r as eb,ge as fb,yE as gb,nc as hb,Ej as ib,Sj as jb,Tj as kb,Mr as lb,li as mb,di as nb,Lr as ob,$E as pb,PE as qb,Aj as rb,rc as sb,oc as tb,ic as ub,sc as vb,dn as wb,cc as xb,fi as yb,lc as zb,Sm as Ab,oe as Bb,uc as Cb,fc as Db,pc as Eb,mc as Fb,gF as Gb,yF as Hb,wF as Ib,vS as Jb,hi as Kb,bF as Lb,Hr as Mb,Qe as Nb,ki as Ob,ew as Pb,DC as Qb,jC as Rb,Wr as Sb,Gh as Tb,Qc as Ub,Zc as Vb,O1 as Wb,dg as Xb,ug as Yb,N1 as Zb,fg as _b,q1 as $b,W1 as ac,B1 as bc,H1 as cc,K1 as dc,z1 as ec,pg as fc,yg as gc,cl as hc,xR as ic,hI as jc,PH as kc,od as lc,Fi as mc,MH as nc,_n as oc,Ui as pc,DH as qc,Cy as rc,Iy as sc,bI as tc,Ny as uc,Dy as vc,Zr as wc,qI as xc,ud as yc,fd as zc,rK as Ac,HI as Bc,KI as Cc,oK as Dc,Br as Ec,Ri as Fc,zt as Gc,_t as Hc,fl as Ic,vl as Jc,zr as Kc,Xr as Lc,Lg as Mc,Ng as Nc,_l as Oc,Et as Pc,zR as Qc,Tl as Rc,nr as Sc,rr as Tc,YR as Uc,Gr as Vc,eC as Wc,sC as Xc,aC as Yc,yn as Zc,Vr as _c,Yr as $c,mC as ad,Ml as bd,wn as cd,bn as dd,gC as ed,yC as fd,wC as gd,EC as hd,TC as id,OC as jd,Ni as kd,Yg as ld,MC as md,LC as nd,pd as od,md as pd,bK as qd,vK as rd,xK as sd,kK as td,_K as ud,eo as vd,Wi as wd,zy as xd,Vy as yd,iI as zd,or as Ad,sI as Bd,sr as Cd,Be as Dd,vn as Ed,aI as Fd,ed as Gd,cI as Hd,lI as Id,Vt as Jd,dI as Kd,uI as Ld,fI as Md,pI as Nd,mI as Od,At as Pd,td as Qd,vO as Rd,pl as Sd,gy as Td,yy as Ud,YC as Vd,JC as Wd,eI as Xd,tI as Yd,nI as Zd,$O as _d,nw as $d,rw as ae,yb as be,mP as ce,RX as de,hP as ee,CX as fe,IX as ge,wb as he,bb as ie,OX as je,$X as ke,PX as le,MX as me,ow as ne,pw as oe,Td as pe,_w as qe,Rz as re,Vi as se,Dz as te,es as ue,qw as ve,lX as we,oo as xe,bX as ye,vX as ze,vb as Ae,xb as Be,vP as Ce,BX as De,rG as Ee};