@kylecheng3146/agent-ops 0.5.3 → 0.7.0

package/dist/runtime/src/run/authorization.js

@@ -0,0 +1,60 @@
+import { canonicalJson } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { RunControlService } from "./controls.js";
+const plain = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+/** Provider decisions are observations, never an alternate permission executor. */
+export async function recordNativeRunAuthorization(repository, event) {
+    if (!plain(event.payload))
+        return;
+    const payload = event.payload;
+    const decisions = [];
+    if (event.host === "codex" && event.transportMethod === "item/autoApprovalReview/completed") {
+        if (!plain(payload.action) || !plain(payload.review) || typeof payload.reviewId !== "string")
+            throw new AgentOpsError("RUN_AUTHORIZATION_PROTOCOL_INVALID", "Native approval notification has an invalid scope or identity.");
+        const action = payload.action, review = payload.review;
+        if (payload.decisionSource !== "agent" || !["approved", "denied", "timedOut", "aborted"].includes(String(review.status)) ||
+            !["command", "execve", "writeStdin", "applyPatch", "networkAccess", "mcpToolCall", "requestPermissions"].includes(String(action.type)))
+            throw new AgentOpsError("RUN_AUTHORIZATION_PROTOCOL_INVALID", "Native approval must expose a supported completed agent decision.");
+        const status = review.status;
+        decisions.push({ id: payload.reviewId, operation: String(action.type), command: canonicalJson(action),
+            resource: canonicalJson({ cwd: action.cwd ?? null, host: action.host ?? null, target: action.target ?? null,
+                files: action.files ?? null, server: action.server ?? null, permissions: action.permissions ?? null }),
+            result: status === "approved" ? "auto-approved" : status === "denied" ? "denied" : "requires-host-approval",
+            reason: typeof review.rationale === "string" && review.rationale.trim().length > 0 ? review.rationale : "Native review did not expose a rationale." });
+    }
+    else if (event.host === "claude") {
+        const message = plain(payload.message) ? payload.message : null;
+        if (message !== null && Array.isArray(message.content))
+            for (const item of message.content) {
+                if (!plain(item) || item.type !== "tool_use" || typeof item.id !== "string" || typeof item.name !== "string" || !plain(item.input))
+                    continue;
+                decisions.push({ id: "tool:" + item.id, operation: item.name, command: canonicalJson(item.input), resource: canonicalJson({ tool: item.name }),
+                    result: "unknown", reason: "Claude exposed the requested tool scope but no per-command auto-mode decision or rationale." });
+            }
+        if (Array.isArray(payload.permission_denials))
+            for (const item of payload.permission_denials) {
+                if (!plain(item))
+                    continue;
+                decisions.push({ id: "denied:" + (typeof item.tool_use_id === "string" ? item.tool_use_id : sha256(canonicalJson(item))),
+                    operation: typeof item.tool_name === "string" ? item.tool_name : "native-permission",
+                    command: canonicalJson(item.tool_input ?? item), resource: canonicalJson({ tool: item.tool_name ?? null }),
+                    result: "denied", reason: "Claude reported an explicit permission denial; no alternate execution is authorized." });
+            }
+    }
+    if (decisions.length === 0)
+        return;
+    const state = await repository.read(event.runId);
+    const worker = state?.workers.find(w => w.workerId === event.workerId);
+    if (state?.policyBinding === undefined || worker?.generation !== event.generation || state.status !== "active" || state.disableRestart)
+        return;
+    if (event.host === "codex" && payload.threadId !== worker.nativeJobId)
+        throw new AgentOpsError("RUN_AUTHORIZATION_STALE", "Native approval belongs to another thread.");
+    const service = new RunControlService(repository);
+    for (const decision of decisions)
+        await service.recordAuthorization(event.runId, { ...decision,
+            authorizationId: decision.id, workerId: worker.workerId, generation: worker.generation, nativeSessionId: worker.nativeSessionId,
+            source: event.host === "codex" ? "codex-auto-review" : "claude-auto-mode", commandDigest: sha256(decision.command),
+            resourceDigest: sha256(decision.resource), policyConfigHash: state.policyBinding.configHash,
+            runtimeHash: state.policyBinding.runtimeHash, policyArtifactDigest: state.policyBinding.artifactDigest, expiresAt: state.policyBinding.expiresAt });
+}

package/dist/runtime/src/run/budget.js

@@ -0,0 +1,30 @@
+function highWater(value, incoming) {
+    if (incoming === null) {
+        return value;
+    }
+    return value === null ? incoming : Math.max(value, incoming);
+}
+/** Merge telemetry without allowing a resumed process to lower a prior high-water mark. */
+export function recordUsage(usage, incoming) {
+    const index = usage.findIndex((value) => value.source === incoming.source && value.epoch === incoming.epoch);
+    if (index < 0) {
+        return [...usage, incoming];
+    }
+    const previous = usage[index];
+    const sameEpoch = previous.epoch === incoming.epoch;
+    const merged = sameEpoch
+        ? {
+            ...incoming,
+            inputTokens: highWater(previous.inputTokens, incoming.inputTokens),
+            outputTokens: highWater(previous.outputTokens, incoming.outputTokens),
+            totalTokens: highWater(previous.totalTokens, incoming.totalTokens),
+            costUsd: highWater(previous.costUsd, incoming.costUsd),
+            completeness: previous.completeness === "complete" || incoming.completeness === "complete"
+                ? "complete"
+                : previous.completeness === "partial" || incoming.completeness === "partial"
+                    ? "partial"
+                    : "unknown"
+        }
+        : incoming;
+    return usage.map((value, currentIndex) => currentIndex === index ? merged : value);
+}

package/dist/runtime/src/run/controls.js

@@ -0,0 +1,139 @@
+import { sha256 } from "../fs/hash.js";
+import { AgentOpsError } from "../fs/paths.js";
+import { canonicalJson } from "../config/hash.js";
+import { join } from "node:path";
+import { readPrivateFile, writePrivateFile } from "../security/permissions.js";
+import { redactSecrets } from "../security/redact.js";
+const MAX_REASON_LENGTH = 4_096;
+function error(code, message) {
+    return new AgentOpsError(code, message);
+}
+function replace(state, controls) {
+    return { ...state, controls };
+}
+function nowIso(now) {
+    const value = now();
+    if (!Number.isFinite(Date.parse(value)))
+        throw error("RUN_CLOCK_INVALID", "Run clock returned an invalid timestamp.");
+    return value;
+}
+/**
+ * Run-scoped controls are an audit record and a coordination boundary. They
+ * never turn a repo trust grant into a global permission or bypass a native
+ * host's explicit denial.
+ */
+export class RunControlService {
+    #repository;
+    #now;
+    constructor(repository, now = () => new Date().toISOString()) {
+        this.#repository = repository;
+        this.#now = now;
+    }
+    async request(runId, request) {
+        const now = nowIso(this.#now);
+        const reason = request.reason?.trim() ?? null;
+        if (reason !== null && (reason.length === 0 || reason.length > MAX_REASON_LENGTH || reason.includes("\0"))) {
+            throw error("RUN_CONTROL_REASON_INVALID", "Control reason is empty or too large.");
+        }
+        return await this.#repository.mutate(runId, (current) => {
+            if (request.action === "resume" && ["complete", "blocked"].includes(current.status))
+                throw error("RUN_NOT_RESUMABLE", `Run ${runId} is ${current.status}.`);
+            const control = {
+                action: request.action,
+                actor: request.actor,
+                reason,
+                requestedAt: now,
+                expiresAt: request.expiresAt ?? null,
+                appliedAt: null
+            };
+            const status = request.action === "stop"
+                ? "stopping"
+                : request.action === "pause"
+                    ? "paused"
+                    : request.action === "resume" || request.action === "respond"
+                        ? "active"
+                        : current.status;
+            return {
+                ...replace(current, [...current.controls, control]),
+                status,
+                // A user-authorized resume re-enables reconciliation. The native
+                // process is still restarted only after the supervisor revalidates
+                // its generation and worktree lease.
+                disableRestart: request.action === "stop" ? true : request.action === "resume" ? false : current.disableRestart,
+                awaitingResume: request.action === "resume" ? false : current.awaitingResume
+            };
+        });
+    }
+    async markApplied(runId, action, requestedAt) {
+        return await this.#repository.mutate(runId, (current) => {
+            const found = current.controls.findIndex((control) => control.action === action && control.requestedAt === requestedAt && control.appliedAt === null);
+            if (found < 0)
+                throw error("RUN_CONTROL_NOT_FOUND", `No pending ${action} control was found.`);
+            const controls = [...current.controls];
+            controls[found] = { ...controls[found], appliedAt: nowIso(this.#now) };
+            return replace(current, controls);
+        });
+    }
+    async pending(runId) {
+        const state = await this.#repository.read(runId);
+        if (state === null)
+            throw error("RUN_NOT_FOUND", `Run not found: ${runId}`);
+        return state.controls.filter((control) => control.appliedAt === null);
+    }
+    /** Keep the complete redacted scope; the digests identify the original input. */
+    async recordAuthorization(runId, authorization) {
+        if (sha256(authorization.command) !== authorization.commandDigest || sha256(authorization.resource) !== authorization.resourceDigest ||
+            !["auto-approved", "requires-host-approval", "denied", "unknown"].includes(authorization.result) ||
+            !["claude-auto-mode", "codex-auto-review", "coordinator-policy-review", "user", "repo-trust"].includes(authorization.source) ||
+            !Number.isSafeInteger(authorization.generation) || authorization.generation < 1 ||
+            authorization.workerId.length === 0 || authorization.workerId.length > 256 ||
+            authorization.operation.length === 0 || authorization.operation.length > 256) {
+            throw error("RUN_AUTHORIZATION_INVALID", "Run authorization must use command and resource digests.");
+        }
+        if (authorization.reason.length === 0 || authorization.reason.length > MAX_REASON_LENGTH)
+            throw error("RUN_AUTHORIZATION_INVALID", "Run authorization reason is invalid.");
+        const at = nowIso(this.#now);
+        if (!Number.isFinite(Date.parse(authorization.expiresAt)) ||
+            (authorization.result === "auto-approved" && Date.parse(authorization.expiresAt) <= Date.parse(at)) ||
+            !/^[a-f0-9]{64}$/u.test(authorization.policyConfigHash) || !/^[a-f0-9]{64}$/u.test(authorization.runtimeHash) ||
+            !/^[a-f0-9]{64}$/u.test(authorization.policyArtifactDigest) ||
+            authorization.authorizationId.length === 0 || authorization.authorizationId.length > 256 ||
+            authorization.command.length > 32 * 1024 || authorization.resource.length > 32 * 1024)
+            throw error("RUN_AUTHORIZATION_INVALID", "Authorization identity, expiry or scope is invalid.");
+        const id = "auth-" + sha256(canonicalJson({ runId, workerId: authorization.workerId, generation: authorization.generation,
+            nativeSessionId: authorization.nativeSessionId, source: authorization.source, id: authorization.authorizationId }));
+        const state = await this.#repository.read(runId);
+        if (state === null)
+            throw error("RUN_NOT_FOUND", "Run does not exist.");
+        const path = join(state.commonDir, "agent-ops/runs", runId, "authorizations", id + ".json");
+        const content = canonicalJson({ runId, ...authorization, command: redactSecrets(authorization.command),
+            resource: redactSecrets(authorization.resource), reason: redactSecrets(authorization.reason) });
+        const previous = await readPrivateFile(path, state.commonDir);
+        if (previous !== null && previous !== content)
+            throw error("RUN_AUTHORIZATION_CONFLICT", "An authorization identity cannot be reused for a different decision.");
+        const saved = await this.#repository.mutate(runId, async (current) => {
+            const worker = current.workers.find(w => w.workerId === authorization.workerId);
+            if (worker?.generation !== authorization.generation || worker.nativeSessionId !== authorization.nativeSessionId ||
+                current.status !== "active" || current.disableRestart || current.policyBinding?.configHash !== authorization.policyConfigHash ||
+                current.policyBinding.runtimeHash !== authorization.runtimeHash || current.policyBinding.expiresAt !== authorization.expiresAt ||
+                current.policyBinding.artifactDigest !== authorization.policyArtifactDigest)
+                throw error("RUN_AUTHORIZATION_STALE", "Authorization must bind the current worker, run policy and runtime.");
+            await writePrivateFile(path, content, current.commonDir);
+            if (current.events.some(event => event.id === id))
+                return current;
+            return { ...current, events: [...current.events, {
+                        id,
+                        at,
+                        type: "control",
+                        code: authorization.result === "auto-approved" ? "RUN_COMMAND_AUTO_APPROVED" : authorization.result === "denied" ? "RUN_COMMAND_DENIED" : "RUN_COMMAND_AUTHORIZATION_OBSERVED",
+                        workerId: authorization.workerId,
+                        taskId: worker.taskId,
+                        detail: canonicalJson({ artifact: path, digest: sha256(content), result: authorization.result, source: authorization.source })
+                    }].slice(-2_000)
+            };
+        });
+        if (authorization.result === "denied")
+            throw error("RUN_COMMAND_DENIED", "The native host or organization denied this command; its audit is saved and the denial cannot be bypassed.");
+        return saved;
+    }
+}

package/dist/runtime/src/run/convergence.js

@@ -0,0 +1,177 @@
+import { canonicalJson } from "../config/hash.js";
+import { sha256 } from "../fs/hash.js";
+const MAX_ID = 4_096;
+function bounded(value, label) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_ID || value.includes("\0") || /[\r\n]/u.test(value)) {
+        throw new TypeError(`${label} must be a bounded single-line string.`);
+    }
+    return value;
+}
+function status(value) {
+    return value === "PASS" || value === "FAIL" ? value : "UNKNOWN";
+}
+function failureClass(value, current) {
+    if (typeof value !== "string" || value.length === 0 || value.length > MAX_ID || value.includes("\0") || /[\r\n]/u.test(value)) {
+        return current === "PASS" ? "none" : "unknown";
+    }
+    return value;
+}
+function stablePins(values) {
+    return [...new Set((values ?? []).map((value) => bounded(value, "pinId")))].sort();
+}
+function stableIds(values, label) {
+    return [...new Set((values ?? []).map((value) => bounded(value, label)))].sort();
+}
+function itemKey(check) {
+    return {
+        criterionId: check.criterionId,
+        runnerId: check.runnerId,
+        checkId: check.checkId,
+        phase: check.phase,
+        pinId: check.pinId
+    };
+}
+function identity(check) {
+    return {
+        ...itemKey(check),
+        status: check.status,
+        failureClass: check.failureClass
+    };
+}
+function sortedChecks(checks) {
+    return [...checks].sort((left, right) => canonicalJson(identity(left)).localeCompare(canonicalJson(identity(right))));
+}
+function commandObservation(result) {
+    const current = status(result.status);
+    return {
+        criterionId: null,
+        runnerId: null,
+        checkId: bounded(result.commandId, "commandId"),
+        phase: "verification",
+        status: current,
+        failureClass: failureClass(result.failureClass, current),
+        pinId: null
+    };
+}
+function acceptanceObservations(result) {
+    const current = status(result.status);
+    const criterionId = bounded(result.criterionId, "criterionId");
+    const runnerId = bounded(result.runnerId, "runnerId");
+    const phase = result.phase === "baseline" || result.phase === "candidate" ? result.phase : "candidate";
+    const actual = new Map((result.checks ?? []).map((check) => [bounded(check.checkId, "checkId"), {
+            status: status(check.status),
+            failureClass: failureClass(check.failureClass, status(check.status))
+        }]));
+    const required = stableIds(result.requiredCheckIds, "checkId");
+    const red = stableIds(result.redCheckIds, "redCheckId");
+    const checkIds = [...new Set([...required, ...red, ...actual.keys()])].sort();
+    if (checkIds.length === 0) {
+        return [{
+                criterionId,
+                runnerId,
+                checkId: criterionId,
+                phase,
+                status: current,
+                failureClass: failureClass(result.failureClass, current),
+                pinId: null
+            }];
+    }
+    return checkIds.map((checkId) => {
+        const observed = actual.get(checkId);
+        // A PASS criterion is a successful contract result. Baseline assertion
+        // failures are the intended red proof and must not become repair work.
+        if (current === "PASS") {
+            return { criterionId, runnerId, checkId, phase, status: "PASS", failureClass: "none", pinId: null };
+        }
+        if (phase === "baseline" && red.length > 0) {
+            if (red.includes(checkId) && observed?.status === "FAIL" && observed.failureClass === "assertion") {
+                return { criterionId, runnerId, checkId, phase, status: "PASS", failureClass: "none", pinId: null };
+            }
+            if (red.includes(checkId)) {
+                return {
+                    criterionId,
+                    runnerId,
+                    checkId,
+                    phase,
+                    status: "FAIL",
+                    failureClass: observed === undefined ? "missing-red-check" : observed.status === "PASS" ? "non-discriminating" : observed.failureClass,
+                    pinId: null
+                };
+            }
+        }
+        return {
+            criterionId,
+            runnerId,
+            checkId,
+            phase,
+            status: observed?.status ?? current,
+            failureClass: observed?.failureClass ?? (observed === undefined ? "missing-check" : failureClass(result.failureClass, current)),
+            pinId: null
+        };
+    });
+}
+function pinObservation(pinId) {
+    return {
+        criterionId: null,
+        runnerId: null,
+        checkId: pinId,
+        phase: "review",
+        status: "FAIL",
+        failureClass: "pinned-finding",
+        pinId
+    };
+}
+/**
+ * Turn a verifier report and the saved finding ratchet into a stable semantic
+ * observation. Raw diagnostics, source commits, timestamps, and task failure
+ * fingerprints are deliberately not read by this function.
+ */
+export function deriveFailureObservation(report, options = {}) {
+    const checks = [
+        ...report.results.filter((result) => result.required).map(commandObservation),
+        ...(report.acceptance ?? []).flatMap(acceptanceObservations),
+        ...stablePins(options.pendingPinIds).map(pinObservation)
+    ];
+    if (checks.length === 0 && report.status !== undefined && report.status !== "PASS") {
+        checks.push({
+            criterionId: null,
+            runnerId: null,
+            checkId: "verification",
+            phase: "verification",
+            status: status(report.status),
+            failureClass: "verification-failed",
+            pinId: null
+        });
+    }
+    const ordered = sortedChecks(checks);
+    const pendingPinIds = stablePins(options.pendingPinIds);
+    const failing = ordered.filter((check) => check.status !== "PASS").map(identity);
+    return {
+        taskId: bounded(report.taskId, "taskId"),
+        checks: ordered,
+        pendingPinIds,
+        failureKey: failing.length === 0 ? null : sha256(canonicalJson({ taskId: report.taskId, failing })),
+        progressDigest: sha256(canonicalJson({
+            taskId: report.taskId,
+            checks: ordered.map((check) => identity(check)),
+            pendingPinIds
+        }))
+    };
+}
+/** Compare only stable check identities; diagnostic text never participates. */
+export function compareFailureObservations(previous, current) {
+    const currentByItem = new Map(current.checks.map((check) => [canonicalJson(itemKey(check)), check]));
+    const passed = previous.checks.some((check) => {
+        if (check.status === "PASS")
+            return false;
+        return currentByItem.get(canonicalJson(itemKey(check)))?.status === "PASS";
+    });
+    const currentPins = new Set(current.pendingPinIds);
+    const dischargedPin = previous.pendingPinIds.some((pinId) => !currentPins.has(pinId));
+    return {
+        sameFailure: previous.failureKey !== null && previous.failureKey === current.failureKey,
+        usefulProgress: passed || dischargedPin,
+        failureKey: current.failureKey,
+        progressDigest: current.progressDigest
+    };
+}

package/dist/runtime/src/run/hosts/claude.js

@@ -0,0 +1,180 @@
+import { randomUUID } from "node:crypto";
+import { AgentOpsError } from "../../fs/paths.js";
+import { JsonLineStream } from "./protocol.js";
+import { actionResult, assertContext, assertProcessRunning, event, spawnNative, stopNativeProcess } from "./util.js";
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringField(value, key) {
+    return isRecord(value) && typeof value[key] === "string" ? value[key] : null;
+}
+function goalStatus(value) {
+    if (isRecord(value)) {
+        const subtype = stringField(value, "subtype");
+        if (subtype === "success")
+            return "complete";
+        if (subtype === "error_max_budget_usd" || subtype === "error_max_turns")
+            return "budgetLimited";
+        const status = stringField(value, "status");
+        if (status === "active" || status === "paused" || status === "blocked" ||
+            status === "usageLimited" || status === "budgetLimited" || status === "complete") {
+            return status;
+        }
+    }
+    return "unknown";
+}
+function writeMessage(handle, text) {
+    handle.process.stdin.write(`${JSON.stringify({
+        type: "user",
+        message: {
+            role: "user",
+            content: [{ type: "text", text }]
+        }
+    })}\n`);
+}
+export class ClaudeGoalHost {
+    options;
+    kind = "claude";
+    streams = new WeakMap();
+    now;
+    constructor(options = {}) {
+        this.options = options;
+        this.now = options.now ?? (() => new Date());
+    }
+    async start(input) {
+        return this.open(input, false, null);
+    }
+    async resume(input, sessionId, objective) {
+        if (sessionId.length === 0) {
+            throw new AgentOpsError("NATIVE_SESSION_INVALID", "Claude session id is required to resume.");
+        }
+        const handle = await this.open(input, true, sessionId);
+        if (objective !== undefined) {
+            await this.activate(handle, objective, input, input.tokenBudget);
+        }
+        return handle;
+    }
+    async activate(handle, objective, context, tokenBudget = null) {
+        assertContext(handle, context);
+        assertProcessRunning(handle.process);
+        if (objective.length === 0 || objective.length > 4000) {
+            throw new AgentOpsError("NATIVE_GOAL_INVALID", "Claude goal objective must be 1–4000 characters.");
+        }
+        const condition = tokenBudget === null
+            ? `/goal ${objective}`
+            : `/goal ${objective} or stop after ${tokenBudget} tokens`;
+        writeMessage(handle, condition);
+        return actionResult(true, "active", { objective, tokenBudget });
+    }
+    async update(handle, update) {
+        assertContext(handle, update);
+        assertProcessRunning(handle.process);
+        return this.activate(handle, update.objective, update, update.tokenBudget ?? null);
+    }
+    async *observe(handle, options = {}) {
+        const stream = this.stream(handle);
+        while (true) {
+            const message = await stream.next(options.signal);
+            if (message === null) {
+                return;
+            }
+            const mapped = this.mapEvent(handle, message);
+            yield mapped;
+            if (mapped.type === "completed" || mapped.type === "error" || mapped.type === "closed") {
+                return;
+            }
+        }
+    }
+    async interrupt(handle, context) {
+        assertContext(handle, context);
+        if (handle.process.exitCode === null && handle.process.signalCode === null) {
+            handle.process.kill("SIGINT");
+        }
+        return actionResult(true, "paused", { signal: "SIGINT" });
+    }
+    async stop(handle, context, signal = "SIGTERM") {
+        assertContext(handle, context);
+        await stopNativeProcess(handle.process, signal);
+        return actionResult(true, "paused", { signal });
+    }
+    async open(input, resume, sessionId) {
+        const requestedSessionId = sessionId ?? input.sessionId ?? randomUUID();
+        const defaultArgs = resume
+            ? [
+                "-p",
+                "--resume", requestedSessionId,
+                "--input-format", "stream-json",
+                "--output-format", "stream-json",
+                "--verbose", "--include-partial-messages",
+                "--permission-mode", "auto",
+                "--permission-prompts", "none"
+            ]
+            : [
+                "-p",
+                "--session-id", requestedSessionId,
+                "--input-format", "stream-json",
+                "--output-format", "stream-json",
+                "--verbose", "--include-partial-messages",
+                "--permission-mode", "auto",
+                "--permission-prompts", "none"
+            ];
+        const command = this.options.command ?? "claude";
+        const args = this.options.args ?? defaultArgs;
+        const process = spawnNative(command, args, input.cwd, input.env, this.options);
+        const stream = new JsonLineStream(process);
+        try {
+            if (process.pid !== undefined)
+                await input.registerProcess?.(process.pid);
+        }
+        catch (cause) {
+            stream.close(cause);
+            if (process.pid !== undefined)
+                await stopNativeProcess(process, "SIGKILL");
+            throw cause;
+        }
+        const handle = {
+            runId: input.runId,
+            workerId: input.workerId,
+            generation: input.generation,
+            contractHash: input.contractHash,
+            kind: this.kind,
+            // --session-id and --resume make this identity durable before the first
+            // user message. Claude can emit startup hook events before system/init,
+            // so start intentionally does not wait for that event.
+            sessionId: requestedSessionId,
+            threadId: null,
+            nativeVersion: input.nativeVersion ?? this.options.nativeVersion ?? null,
+            cwd: input.cwd,
+            processId: process.pid ?? null,
+            startedAt: this.now().toISOString(),
+            process,
+            goalStatus: "unknown"
+        };
+        this.streams.set(handle, stream);
+        return handle;
+    }
+    stream(handle) {
+        const stream = this.streams.get(handle);
+        if (stream === undefined) {
+            throw new AgentOpsError("NATIVE_SESSION_INVALID", "Unknown Claude native handle.");
+        }
+        return stream;
+    }
+    mapEvent(handle, payload) {
+        const type = stringField(payload, "type");
+        if (type === "result") {
+            const subtype = stringField(payload, "subtype");
+            return event(handle, subtype === "success" ? "completed" : "error", goalStatus(payload), payload, this.now);
+        }
+        if (type === "error" || (type === "system" && stringField(payload, "subtype") === "error")) {
+            return event(handle, "error", goalStatus(payload), payload, this.now);
+        }
+        if (isRecord(payload.usage) || typeof payload.total_cost_usd === "number") {
+            return event(handle, "usage", goalStatus(payload), payload, this.now);
+        }
+        if (type === "system" && stringField(payload, "subtype") === "goal") {
+            return event(handle, "goal-updated", goalStatus(payload), payload, this.now);
+        }
+        return event(handle, "message", goalStatus(payload), payload, this.now);
+    }
+}