@myagentroam/agent 0.9.135 → 0.9.136

package/dist/subagent/scheduler.d.ts

@@ -125,7 +125,7 @@ export declare class SubagentScheduler implements SubagentController {
         turnId?: string;
         deliveryStatus?: "accepted" | "applied" | "cancelled" | "failed";
     } | {
-        waitOutcome: "timeout" | "completion";
+        waitOutcome: "completion" | "timeout";
         agentId: string;
         description: string;
         status: "queued" | "running" | "completed" | "failed" | "cancelled" | "interrupted";
@@ -172,7 +172,7 @@ export declare class SubagentScheduler implements SubagentController {
         turnId?: string;
         deliveryStatus?: "accepted" | "applied" | "cancelled" | "failed";
     } | {
-        waitOutcome: "timeout" | "completion";
+        waitOutcome: "completion" | "timeout";
         agentId: string;
         description: string;
         status: "queued" | "running" | "completed" | "failed" | "cancelled" | "interrupted";
@@ -199,7 +199,7 @@ export declare class SubagentScheduler implements SubagentController {
     message(_agentId: string, _message: string): Promise<SubagentTaskSnapshot>;
     listSessionResources(): {
         agentId: string;
-        status: "completed" | "cancelled" | "running" | "failed" | "queued";
+        status: "completed" | "cancelled" | "running" | "queued" | "failed";
         description: string;
     }[];
     dispose(): Promise<void>;

package/dist/subagent/session-controller.d.ts

@@ -91,7 +91,7 @@ export declare class SubagentSessionController implements SubagentController {
     cancel(agentId: string): Promise<SubagentTaskSnapshot>;
     listSessionResources(): {
         agentId: string;
-        status: "completed" | "cancelled" | "running" | "failed" | "queued" | "interrupted";
+        status: "completed" | "cancelled" | "running" | "queued" | "failed" | "interrupted";
         description: string;
     }[];
     dispose(): Promise<void>;

package/dist/tools/agent-cancel.js

@@ -1,6 +1,7 @@
 import { MarAgentError } from '../error.js';
 export const agentCancelToolDefinition = {
     name: 'agent_cancel',
+    allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
     description: 'Idempotently cancel a child agent using the agentId returned by agent_start. For an exec processId, use exec with action:"cancel" instead. Waits for a running task to reach cancelled and returns its agentId and description.',
     inputSchema: {

package/dist/tools/agent-message.js

@@ -2,6 +2,7 @@ import { MarAgentError } from '../error.js';
 import { TOOL_EXECUTION_LIMITS } from './execution-limits.js';
 export const agentMessageToolDefinition = {
     name: 'agent_message',
+    allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
     description: 'Send a real user message to an existing child agent. Default delivery=append inserts guidance into a running child turn at the next safe boundary after the current model response or complete tool batch. Explicit delivery=replace immediately requests cancellation, waits for the old turn to close, then starts a new turn in the same Session. When idle, either mode starts a new turn using persisted history. Returns messageId, turnId, deliveryStatus, current status, and model metadata without repeating the child’s previous latestMessage, latestActivity, summary, or verification evidence. accepted means queued in memory; applied means persisted in model context, not that the guidance has been executed. Use agent_wait for subsequent progress or completion. Does not wait for the new task to complete or roll back existing side effects.',
     inputSchema: {

package/dist/tools/agent-start.js

@@ -3,6 +3,7 @@ import { marAgentReasoningEffortSchema } from '../model/configuration.js';
 import { TOOL_EXECUTION_LIMITS } from './execution-limits.js';
 export const agentStartToolDefinition = {
     name: 'agent_start',
+    allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
     description: 'Start one bounded, non-recursive child agent with self-contained context. Use when an independent investigation would consume substantial main-context space or when safe parallel work has real value; keep small or tightly coupled work in the main context. All agents share the filesystem, so avoid conflicting writes. The optional reasoningEffort overrides the parent effort and must be supported by the selected model; omit it to inherit. Returns agentId for agent_wait, agent_message, or agent_cancel, description, queued/running/completed/failed/cancelled status, bounded summary, changedFiles, verification, and read evidence; background returns immediately while foreground waits for a terminal result.',
     inputSchema: {

package/dist/tools/agent-wait.js

@@ -2,6 +2,7 @@ import { MarAgentError } from '../error.js';
 import { TOOL_EXECUTION_LIMITS } from './execution-limits.js';
 export const agentWaitToolDefinition = {
     name: 'agent_wait',
+    allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
     description: 'Read or wait a bounded time for a child agent result. waitFor defaults to "completion"; use "message" only when a fresh public commentary/final message would change the next decision. Omit agentId to wait for whichever live child returns first, matching Codex-style untargeted waiting and avoiding UUID transcription; provide the exact agentId returned by agent_start only when observing a specific child. If no child is live, untargeted waiting reads the most recently created child. For an exec processId, use exec with action:"poll" instead. Omitting waitMs waits up to 30 seconds by default; waitMs=0 returns the current snapshot immediately. Positive waits range up to 5 minutes, and positive values below 10 seconds are raised to 10 seconds. When blocked on a live child result, prefer one 300000 ms completion wait rather than repeated short waits. Every result includes waitOutcome as snapshot, message, completion, or timeout plus the real agentId and description. A message, timeout with unread progress, or first terminal completion result includes the newly observed latest public commentary/final message; snapshots and repeated observations omit previously observed message text. latestActivity can still identify a public message or bounded tool started/completed/failed status. A queued or running result is not completion. A message wait consumes only the latest unread public message in the current Session runtime; tool activity does not wake it, and parent cancellation preserves unread progress for a later Execution. Do not use message waits as heartbeat checks or request progress merely to confirm that a child is still running. First terminal results include bounded summary, changedFiles, verification, and read evidence with path/line ranges; use that evidence to avoid repeating the full exploration, while independently checking consequential edits and claims.',
     inputSchema: {

package/dist/tools/apply-patch.js

@@ -6,8 +6,9 @@ import { MarAgentError } from '../error.js';
 import { TOOL_EXECUTION_LIMITS } from './execution-limits.js';
 export const applyPatchToolDefinition = {
     name: 'apply_patch',
+    allowedCallers: ['direct', 'programmatic'],
     parallelSafety: 'serial',
-    description: `Preferred for precise, reviewable local edits. Do not batch all task files merely to reduce tool calls. Group only a few tightly coupled edits whose combined patch is quick to generate and review; split broad or independent work into successive bounded patches before composing them. Submit a raw *** Begin Patch / *** End Patch patch. Supports Add File, Update File, Delete File, and Move to. Add File may replace an existing regular file, and Move to may replace an existing regular destination; duplicate operations on the same resolved path remain invalid. Update hunks accept @@ or @@ <change context>; context-only hunks may also be used as ordered anchors before a later changing hunk. Context is searched forward with Codex-style exact, whitespace-tolerant, then common Unicode punctuation-tolerant matching. Syntax and resolved paths are validated before writing, then file units are committed in order. Each file unit is atomic, and a Move keeps its source and destination atomic. On MAR_AGENT_PATCH_PARTIAL, earlier files remain applied; the error lists applied, failed, and pending paths, so retry only failed and pending paths. Existing file permissions, line endings, and final-newline state are preserved. Returns changed file paths and operations with per-file and total line counts when all units succeed. Oversized patches are rejected without advertising defensive limits as recommended patch sizes. A first-unit MAR_AGENT_PATCH_CONFLICT applies nothing; hunk match conflicts identify the affected path and hunk so you can reread only that file before retrying.`,
+    description: `Preferred for precise, reviewable local edits. Do not batch all task files merely to reduce tool calls. Group only a few tightly coupled edits whose combined patch is quick to generate and review; split broad or independent work into successive bounded patches before composing them. Submit a raw *** Begin Patch / *** End Patch patch. Supports Add File, Update File, Delete File, and Move to. Add File may replace an existing regular file, and Move to may replace an existing regular destination; duplicate operations on the same resolved path remain invalid. Update hunks accept @@ or @@ <change context>; context-only hunks may also be used as ordered anchors before a later changing hunk. Context is searched forward with Codex-style exact, whitespace-tolerant, then common Unicode punctuation-tolerant matching. Syntax and resolved paths are validated before writing, then file units are committed in order. Each file unit is atomic, and a Move keeps its source and destination atomic. On MAR_AGENT_PATCH_PARTIAL, earlier files remain applied; the error lists applied, failed, and pending paths, so retry only failed and pending paths. Existing file permissions, line endings, and final-newline state are preserved. Returns changed file paths and operations with per-file and total line counts when all units succeed. In Code Mode, the Promise resolves on success and rejects with code/message on failure; the returned envelope has data.files and data.totals, not an ok or success flag. Oversized patches are rejected without advertising defensive limits as recommended patch sizes. A first-unit MAR_AGENT_PATCH_CONFLICT applies nothing; hunk match conflicts identify the affected path and hunk so you can reread only that file before retrying.`,
     inputMode: 'freeform',
     outputSchema: {
         type: 'object',

package/dist/tools/callers.d.ts

@@ -0,0 +1,4 @@
+import type { ClientToolDefinition, ToolCaller } from '../model/contracts.js';
+/** Normalize trusted Host policy independently of discovery, Agent scope and parallel safety. */
+export declare function toolCallers(tool: ClientToolDefinition): readonly ToolCaller[];
+export declare function allowsToolCaller(tool: ClientToolDefinition, caller: ToolCaller): boolean;

package/dist/tools/callers.js

@@ -0,0 +1,18 @@
+import { MarAgentError } from '../error.js';
+/** Normalize trusted Host policy independently of discovery, Agent scope and parallel safety. */
+export function toolCallers(tool) {
+    const value = tool.allowedCallers;
+    if (value === undefined)
+        return tool.name.startsWith('mcp__') ? ['direct', 'programmatic'] : ['direct'];
+    if (!Array.isArray(value) ||
+        value.length === 0 ||
+        value.some((caller) => caller !== 'direct' && caller !== 'programmatic'))
+        throw new MarAgentError('MAR_AGENT_TOOL_INPUT_INVALID', 'Tool caller policy is invalid.');
+    return ['direct', 'programmatic'].filter((caller) => value.includes(caller));
+}
+export function allowsToolCaller(tool, caller) {
+    // Control tools cannot be widened by a Host override or historical definition.
+    if (caller === 'programmatic' && ['code_mode', 'tool_search', 'question'].includes(tool.name))
+        return false;
+    return toolCallers(tool).includes(caller);
+}

package/dist/tools/code-mode/engine.d.ts

@@ -0,0 +1,43 @@
+import type { ToolCall, ToolExecutionResult } from '../../sdk/types.js';
+import type { CodeModeStateEntry, CodeModeStateMutation } from './state.js';
+export interface CodeModeCatalogEntry {
+    readonly name: string;
+    readonly description: string;
+    readonly inputSchema: unknown;
+    readonly inputMode: 'json' | 'freeform';
+}
+/** A trusted, replaceable worker-side engine; no engine handles cross this interface. */
+export interface CodeModeEngine {
+    execute(input: {
+        code: string;
+        tools: readonly string[];
+        catalog: readonly CodeModeCatalogEntry[];
+        state: readonly CodeModeStateEntry[];
+        signal: AbortSignal;
+        limits: {
+            memoryBytes: number;
+            stackBytes: number;
+            timeoutMs: number;
+            outputBytes: number;
+            stateEntries: number;
+            stateMutations: number;
+            stateKeyBytes: number;
+            stateValueBytes: number;
+            stateTotalBytes: number;
+            sleepMs: number;
+        };
+        onToolCall(call: ToolCall): Promise<ToolExecutionResult>;
+        onText(value: string): void;
+        onImage(value: unknown): void;
+    }): Promise<{
+        readonly stateMutations: readonly CodeModeStateMutation[];
+    }>;
+    dispose(): Promise<void>;
+}
+/** Only the Local Host may supply this descriptor; it is never part of model tool input. */
+export interface CodeModeEngineFactory {
+    readonly moduleUrl: string;
+    readonly runtimeDirectories: readonly string[];
+    readonly options?: Readonly<Record<string, unknown>>;
+}
+export type CreateCodeModeEngine = (options: Readonly<Record<string, unknown>>) => Promise<CodeModeEngine>;

package/dist/tools/code-mode/engine.js

@@ -0,0 +1 @@
+export {};

package/dist/tools/code-mode/quickjs-engine.d.ts

@@ -0,0 +1,2 @@
+/** @returns {Promise<import('./engine.js').CodeModeEngine>} */
+export function createCodeModeEngine(options: any): Promise<import("./engine.js").CodeModeEngine>;

package/dist/tools/code-mode/quickjs-engine.js

@@ -0,0 +1,454 @@
+// This trusted module runs only in the Host-managed worker, never in the model's JS context.
+/** @returns {Promise<import('./engine.js').CodeModeEngine>} */
+export async function createCodeModeEngine(options) {
+    const { newQuickJSWASMModuleFromVariant } = await import(options.coreModuleUrl);
+    const variant = (await import(options.variantModuleUrl)).default;
+    const quickjs = await newQuickJSWASMModuleFromVariant(variant);
+    let runtime;
+    let context;
+    let disposed = false;
+    return {
+        async execute(input) {
+            if (disposed || runtime)
+                throw diagnostic('MAR_AGENT_CODE_FAILED', 'Engine is not reusable.');
+            runtime = quickjs.newRuntime();
+            runtime.setMemoryLimit(input.limits.memoryBytes);
+            runtime.setMaxStackSize(input.limits.stackBytes);
+            const deadline = Date.now() + input.limits.timeoutMs;
+            runtime.setInterruptHandler(() => input.signal.aborted || Date.now() >= deadline);
+            context = runtime.newContext();
+            const vm = context;
+            let wake;
+            let bridgeFailure;
+            const pending = new Set();
+            const deferreds = new Set();
+            const unconsumedToolCalls = new Set();
+            const sleepTimers = new Set();
+            const state = new Map(input.state.map((entry) => [entry.key, entry.value]));
+            const stateMutations = [];
+            let outputBytes = 0;
+            const notify = () => {
+                wake?.();
+                wake = undefined;
+            };
+            const fail = (handle) => {
+                const error = vm.dump(handle);
+                handle.dispose();
+                if (input.signal.aborted)
+                    throw input.signal.reason;
+                if (Date.now() >= deadline)
+                    throw diagnostic('MAR_AGENT_CODE_TIMEOUT', 'JavaScript execution exceeded its deadline.');
+                const message = String(error?.message ?? error).slice(0, 4096);
+                const code = message.includes('out of memory')
+                    ? 'MAR_AGENT_CODE_MEMORY_LIMIT'
+                    : typeof error?.code === 'string'
+                        ? error.code
+                        : 'MAR_AGENT_CODE_FAILED';
+                throw diagnostic(code, message);
+            };
+            const guestError = (code, message) => {
+                const handle = vm.newError({ name: 'Error', message });
+                const value = vm.newString(code);
+                vm.setProp(handle, 'code', value);
+                value.dispose();
+                return handle;
+            };
+            runtime.setModuleLoader(() => ({
+                error: guestError('MAR_AGENT_CODE_IMPORT_DENIED', 'Module imports are unavailable.')
+            }));
+            const setup = vm.evalCode(`
+        for (const name of ['console', 'process', 'require', 'module', 'Buffer', 'fetch',
+          'WebSocket', 'WebAssembly', 'SharedArrayBuffer', 'Atomics', 'text', 'image'])
+          delete globalThis[name];
+        globalThis.__parseJson = JSON.parse;
+        globalThis.__serialize = value => {
+          return JSON.stringify(value, (_key, item) => {
+            if (['bigint', 'function', 'symbol', 'undefined'].includes(typeof item))
+              throw Object.assign(new TypeError('Only JSON values may cross the tool bridge.'),
+                { code: 'MAR_AGENT_TOOL_INPUT_INVALID' });
+            return item;
+          });
+        };
+        globalThis.__text = value => {
+          if (value === null || ['string', 'number', 'boolean', 'bigint', 'undefined'].includes(typeof value))
+            return String(value);
+          return JSON.stringify(value, (_key, item) => {
+            if (['bigint', 'function', 'symbol', 'undefined'].includes(typeof item))
+              throw Object.assign(new TypeError('Only JSON values may be emitted.'),
+                { code: 'MAR_AGENT_TOOL_INPUT_INVALID' });
+            return item;
+          });
+        };
+        globalThis.__deepFreeze = function deepFreeze(value) {
+          if (value && typeof value === 'object' && !Object.isFrozen(value)) {
+            for (const item of Object.values(value)) deepFreeze(item);
+            Object.freeze(value);
+          }
+          return value;
+        };
+      `);
+            if (setup.error)
+                fail(setup.error);
+            setup.value.dispose();
+            const parseJson = vm.getProp(vm.global, '__parseJson');
+            const serialize = vm.getProp(vm.global, '__serialize');
+            const formatText = vm.getProp(vm.global, '__text');
+            const deepFreeze = vm.getProp(vm.global, '__deepFreeze');
+            const parse = (value) => {
+                const handle = vm.newString(JSON.stringify(value));
+                const parsed = vm.callFunction(parseJson, vm.undefined, handle);
+                handle.dispose();
+                if (parsed.error)
+                    fail(parsed.error);
+                return parsed.value;
+            };
+            const jsonValue = (handle) => {
+                const result = vm.callFunction(serialize, vm.undefined, handle);
+                if (result.error)
+                    return { error: result.error };
+                try {
+                    return { value: JSON.parse(vm.getString(result.value)) };
+                }
+                finally {
+                    result.value.dispose();
+                }
+            };
+            const method = (object, name, callback) => {
+                const handle = vm.newFunction(name, callback);
+                vm.setProp(object, name, handle);
+                handle.dispose();
+            };
+            const key = (handle) => {
+                if (!handle || vm.typeof(handle) !== 'string')
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_INPUT_INVALID', 'State key must be a string.')
+                    };
+                const value = vm.getString(handle);
+                if (!value || Buffer.byteLength(value) > input.limits.stateKeyBytes)
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_INPUT_INVALID', 'State key is invalid or too large.')
+                    };
+                return { value };
+            };
+            const validateState = () => {
+                if (state.size > input.limits.stateEntries)
+                    return guestError('MAR_AGENT_TOOL_OUTPUT_LIMIT', 'Code Mode state has too many entries.');
+                const entries = [...state].map(([entryKey, value]) => ({ key: entryKey, value }));
+                if (Buffer.byteLength(JSON.stringify(entries)) > input.limits.stateTotalBytes)
+                    return guestError('MAR_AGENT_TOOL_OUTPUT_LIMIT', 'Code Mode state is too large.');
+            };
+            const tools = vm.newObject();
+            let toolCallSequence = 0;
+            for (const name of input.tools) {
+                method(tools, name, (args = vm.undefined) => {
+                    const parsed = jsonValue(args);
+                    if (parsed.error)
+                        return parsed;
+                    const operationId = ++toolCallSequence;
+                    unconsumedToolCalls.add(operationId);
+                    const deferred = vm.newPromise();
+                    deferreds.add(deferred);
+                    const job = Promise.resolve()
+                        .then(() => input.onToolCall({ name, arguments: parsed.value }))
+                        .then((output) => {
+                        if (disposed || input.signal.aborted)
+                            return;
+                        const handle = parse(output);
+                        try {
+                            deferred.resolve(handle);
+                        }
+                        finally {
+                            handle.dispose();
+                        }
+                    }, (error) => {
+                        if (disposed || input.signal.aborted)
+                            return;
+                        const handle = vm.newError({
+                            name: 'Error',
+                            message: String(error?.message ?? error).slice(0, 4096)
+                        });
+                        const code = vm.newString(String(error?.code ?? 'MAR_AGENT_HOST_OPERATION_FAILED'));
+                        vm.setProp(handle, 'code', code);
+                        code.dispose();
+                        try {
+                            deferred.reject(handle);
+                        }
+                        finally {
+                            handle.dispose();
+                        }
+                    })
+                        .catch((error) => {
+                        bridgeFailure = diagnostic('MAR_AGENT_CODE_ENGINE_FAILED', String(error?.message ?? error).slice(0, 4096));
+                    })
+                        .finally(() => {
+                        pending.delete(job);
+                        deferreds.delete(deferred);
+                        if (deferred.alive)
+                            deferred.dispose();
+                        notify();
+                    });
+                    pending.add(job);
+                    const operation = vm.newObject();
+                    const id = vm.newNumber(operationId);
+                    vm.setProp(operation, 'id', id);
+                    vm.setProp(operation, 'promise', deferred.handle);
+                    id.dispose();
+                    return operation;
+                });
+            }
+            vm.setProp(vm.global, 'tools', tools);
+            tools.dispose();
+            const consumeToolCall = vm.newFunction('__consumeToolCall', (idHandle) => {
+                if (idHandle && vm.typeof(idHandle) === 'number')
+                    unconsumedToolCalls.delete(vm.getNumber(idHandle));
+                return vm.undefined;
+            });
+            vm.setProp(vm.global, '__consumeToolCall', consumeToolCall);
+            consumeToolCall.dispose();
+            const out = vm.newObject();
+            method(out, 'text', (handle) => {
+                const result = vm.callFunction(formatText, vm.undefined, handle ?? vm.undefined);
+                if (result.error)
+                    return { error: result.error };
+                try {
+                    const value = vm.getString(result.value);
+                    outputBytes += Buffer.byteLength(value) + 1;
+                    if (outputBytes > input.limits.outputBytes)
+                        return {
+                            error: guestError('MAR_AGENT_TOOL_OUTPUT_LIMIT', 'Text output limit exceeded.')
+                        };
+                    input.onText(value);
+                }
+                finally {
+                    result.value.dispose();
+                }
+                return vm.undefined;
+            });
+            method(out, 'image', (handle) => {
+                const parsed = jsonValue(handle ?? vm.undefined);
+                if (parsed.error)
+                    return parsed;
+                input.onImage(parsed.value);
+                return vm.undefined;
+            });
+            vm.setProp(vm.global, 'out', out);
+            out.dispose();
+            const stateObject = vm.newObject();
+            method(stateObject, 'get', (keyHandle) => {
+                const parsed = key(keyHandle);
+                if (parsed.error)
+                    return parsed;
+                return state.has(parsed.value) ? parse(state.get(parsed.value)) : vm.undefined;
+            });
+            method(stateObject, 'has', (keyHandle) => {
+                const parsed = key(keyHandle);
+                if (parsed.error)
+                    return parsed;
+                return state.has(parsed.value) ? vm.true : vm.false;
+            });
+            method(stateObject, 'set', (keyHandle, valueHandle = vm.undefined) => {
+                const parsedKey = key(keyHandle);
+                if (parsedKey.error)
+                    return parsedKey;
+                const parsedValue = jsonValue(valueHandle);
+                if (parsedValue.error)
+                    return parsedValue;
+                if (Buffer.byteLength(JSON.stringify(parsedValue.value)) > input.limits.stateValueBytes)
+                    return { error: guestError('MAR_AGENT_TOOL_INPUT_INVALID', 'State value is too large.') };
+                const previous = state.has(parsedKey.value)
+                    ? { exists: true, value: state.get(parsedKey.value) }
+                    : { exists: false };
+                state.set(parsedKey.value, parsedValue.value);
+                const invalid = validateState();
+                if (invalid) {
+                    if (previous.exists)
+                        state.set(parsedKey.value, previous.value);
+                    else
+                        state.delete(parsedKey.value);
+                    return { error: invalid };
+                }
+                if (stateMutations.length >= input.limits.stateMutations) {
+                    if (previous.exists)
+                        state.set(parsedKey.value, previous.value);
+                    else
+                        state.delete(parsedKey.value);
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_OUTPUT_LIMIT', 'Too many state mutations.')
+                    };
+                }
+                stateMutations.push({ operation: 'set', key: parsedKey.value, value: parsedValue.value });
+                return vm.undefined;
+            });
+            method(stateObject, 'delete', (keyHandle) => {
+                const parsed = key(keyHandle);
+                if (parsed.error)
+                    return parsed;
+                if (!state.has(parsed.value))
+                    return vm.false;
+                if (stateMutations.length >= input.limits.stateMutations)
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_OUTPUT_LIMIT', 'Too many state mutations.')
+                    };
+                state.delete(parsed.value);
+                stateMutations.push({ operation: 'delete', key: parsed.value });
+                return vm.true;
+            });
+            vm.setProp(vm.global, 'state', stateObject);
+            stateObject.dispose();
+            const catalog = vm.newObject();
+            method(catalog, 'tools', () => {
+                const value = parse(input.catalog);
+                const frozen = vm.callFunction(deepFreeze, vm.undefined, value);
+                value.dispose();
+                if (frozen.error)
+                    return { error: frozen.error };
+                return frozen.value;
+            });
+            vm.setProp(vm.global, 'catalog', catalog);
+            catalog.dispose();
+            const cell = vm.newObject();
+            method(cell, 'sleep', (durationHandle) => {
+                if (!durationHandle || vm.typeof(durationHandle) !== 'number')
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_INPUT_INVALID', 'Sleep duration must be an integer.')
+                    };
+                const duration = vm.getNumber(durationHandle);
+                if (!Number.isSafeInteger(duration) || duration < 0 || duration > input.limits.sleepMs)
+                    return {
+                        error: guestError('MAR_AGENT_TOOL_INPUT_INVALID', 'Sleep duration is out of range.')
+                    };
+                const deferred = vm.newPromise();
+                deferreds.add(deferred);
+                let timer;
+                const job = new Promise((resolve) => {
+                    timer = setTimeout(resolve, duration);
+                    sleepTimers.add(timer);
+                })
+                    .then(() => {
+                    sleepTimers.delete(timer);
+                    if (!disposed && !input.signal.aborted)
+                        deferred.resolve(vm.undefined);
+                })
+                    .catch((error) => {
+                    bridgeFailure = diagnostic('MAR_AGENT_CODE_ENGINE_FAILED', String(error?.message ?? error).slice(0, 4096));
+                })
+                    .finally(() => {
+                    pending.delete(job);
+                    deferreds.delete(deferred);
+                    if (deferred.alive)
+                        deferred.dispose();
+                    notify();
+                });
+                pending.add(job);
+                return deferred.handle;
+            });
+            vm.setProp(vm.global, 'cell', cell);
+            cell.dispose();
+            const lock = vm.evalCode(`
+        const rawTools = globalThis.tools;
+        const consumeToolCall = globalThis.__consumeToolCall;
+        const wrappedTools = Object.fromEntries(Object.keys(rawTools).map(name => [name, (...args) => {
+          const operation = rawTools[name](...args);
+          const consume = () => consumeToolCall(operation.id);
+          return Object.freeze({
+            then(onFulfilled, onRejected) {
+              consume();
+              return operation.promise.then(onFulfilled, onRejected);
+            },
+            catch(onRejected) {
+              consume();
+              return operation.promise.catch(onRejected);
+            },
+            finally(onFinally) {
+              consume();
+              return operation.promise.finally(onFinally);
+            }
+          });
+        }]));
+        globalThis.tools = new Proxy(wrappedTools, { get(target, name) {
+          if (name === 'then') return undefined;
+          if (!Object.prototype.hasOwnProperty.call(target, name))
+            return () => { throw Object.assign(new Error('The requested nested tool is unavailable.'),
+              { code: 'MAR_AGENT_TOOL_NOT_AVAILABLE' }); };
+          return target[name];
+        }});
+        for (const name of ['tools', 'out', 'state', 'catalog', 'cell']) {
+          const value = globalThis[name];
+          Object.freeze(value);
+          Object.defineProperty(globalThis, name, {
+            value, writable: false, configurable: false, enumerable: true
+          });
+        }
+        delete globalThis.__parseJson;
+        delete globalThis.__serialize;
+        delete globalThis.__text;
+        delete globalThis.__deepFreeze;
+        delete globalThis.__consumeToolCall;
+      `);
+            if (lock.error)
+                fail(lock.error);
+            lock.value.dispose();
+            input.signal.addEventListener('abort', notify, { once: true });
+            let main;
+            try {
+                const evaluated = vm.evalCode(`(async () => {\n${input.code}\n})()`, 'code-mode.js');
+                if (evaluated.error)
+                    fail(evaluated.error);
+                main = evaluated.value;
+                for (;;) {
+                    input.signal.throwIfAborted();
+                    if (bridgeFailure)
+                        throw bridgeFailure;
+                    const jobs = runtime.executePendingJobs(100);
+                    if (jobs.error)
+                        fail(jobs.error);
+                    jobs.dispose();
+                    const promiseState = vm.getPromiseState(main);
+                    if (promiseState.type === 'rejected')
+                        fail(promiseState.error);
+                    if (promiseState.type === 'fulfilled') {
+                        promiseState.value.dispose();
+                        if (pending.size)
+                            throw diagnostic('MAR_AGENT_CODE_INCOMPLETE', 'Unawaited asynchronous operations remain; completed tool operations are not rolled back.');
+                        if (unconsumedToolCalls.size)
+                            throw diagnostic('MAR_AGENT_CODE_INCOMPLETE', 'Tool calls must be awaited; completed tool operations are not rolled back.');
+                        return { stateMutations };
+                    }
+                    if (runtime.hasPendingJob())
+                        continue;
+                    if (Date.now() >= deadline)
+                        throw diagnostic('MAR_AGENT_CODE_TIMEOUT', 'JavaScript execution exceeded its deadline.');
+                    if (!pending.size)
+                        throw diagnostic('MAR_AGENT_CODE_INCOMPLETE', 'JavaScript returned an unresolved promise without active operations.');
+                    await new Promise((resolve) => {
+                        wake = resolve;
+                    });
+                }
+            }
+            finally {
+                input.signal.removeEventListener('abort', notify);
+                disposed = true;
+                for (const timer of sleepTimers)
+                    clearTimeout(timer);
+                main?.dispose();
+                for (const deferred of deferreds)
+                    if (deferred.alive)
+                        deferred.dispose();
+                parseJson.dispose();
+                serialize.dispose();
+                formatText.dispose();
+                deepFreeze.dispose();
+            }
+        },
+        async dispose() {
+            disposed = true;
+            if (context?.alive)
+                context.dispose();
+            if (runtime?.alive)
+                runtime.dispose();
+        }
+    };
+}
+function diagnostic(code, message) {
+    return Object.assign(new Error(message), { code });
+}

package/dist/tools/code-mode/state.d.ts

@@ -0,0 +1,20 @@
+export interface CodeModeStateEntry {
+    readonly key: string;
+    readonly value: unknown;
+}
+export type CodeModeStateMutation = {
+    readonly operation: 'set';
+    readonly key: string;
+    readonly value: unknown;
+} | {
+    readonly operation: 'delete';
+    readonly key: string;
+};
+type StateRecord = {
+    readonly type: string;
+    readonly payload: unknown;
+};
+export declare function parseCodeModeStateMutations(value: unknown): CodeModeStateMutation[];
+export declare function restoreCodeModeState(records: readonly StateRecord[]): CodeModeStateEntry[];
+export declare function applyCodeModeStateMutations(entries: readonly CodeModeStateEntry[], mutations: readonly CodeModeStateMutation[]): CodeModeStateEntry[];
+export {};