@namzu/cli 15.1.2 → 16.1.0

package/dist/tui/agent.js

@@ -20,9 +20,10 @@
  * `emptySession()` whose `send()` yields a single error event so the UI
  * renders an actionable hint rather than crashing.
  */
-import { BOOT_EVENT_NAMES, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, buildSessionGoalTools, compactNow, createComputerUseTool, createMemoryPromoter, createToolPresenter, genericLabel, getBuiltinTools, isTrustedReadOnly, query, resumeRun, withProviderFallback, } from '@namzu/sdk';
+import { BOOT_EVENT_NAMES, DiskMemoryStore, DiskTaskStore, EVENT_NAME_ATTRIBUTE, ProviderRegistry, SESSION_GOAL_TOOL_NAMES, SearchToolsTool, ToolRegistry, asProjectId, asRunId, asSessionId, asTenantId, asTopicId, buildMemoryTools, buildSessionGoalTools, compactNow, createComputerUseTool, createMemoryPromoter, createToolPresenter, generateRunId, getBuiltinTools, isTrustedReadOnly, query, resumeRun, withProviderFallback, } from '@namzu/sdk';
 import { SubprocessComputerUseHost } from '@namzu/computer-use';
-import { join } from 'node:path';
+import { realpath, stat } from 'node:fs/promises';
+import { join, parse, resolve } from 'node:path';
 import { probeCapabilities } from '../context/capabilities.js';
 import { composeEnvironmentPrompt, readEnvironmentFacts } from '../context/environment.js';
 import { ProjectInstructionTracker } from '../context/project-tracker.js';
@@ -30,6 +31,7 @@ import { resolveSandbox, sandboxResolvedSeverity, } from '../context/sandbox.js'
 import { connectMcpServers, } from '../integrations/mcp/servers.js';
 import { createCliPluginRuntime } from '../integrations/plugins/runtime.js';
 import { CredentialRefreshRejectedError, CredentialWithdrawnError, PROVIDER_REGISTRY, chainCapabilityDisagreements, chainPositionName, describeAcceptedMismatch, describeCapabilityRefusal, discoverProviders, ensureFreshAnthropicToken, ensureFreshStoredCodexCredential, ensureRegistered, findDetected, isAnthropicOAuthToken, isRegistered, missingCredentialMessage, primaryProvider, readCodexCredentialFile, readPreferences, readSubscriptionCredential, resolveChainCapabilities, sameOAuthCredential, unresolvedMembers, unsupportedProviderMessage, } from '../integrations/providers/index.js';
+import { ensurePrivateStateDirectory } from '../integrations/state/private-directory.js';
 import { createSubagentRuntime } from '../integrations/subagents/runtime.js';
 import { cliLogger } from '../logging.js';
 import { composeMemoryPrompt, readMemory } from '../memory/store.js';
@@ -326,7 +328,9 @@ function buildToolRegistry(cwd) {
     // `save_memory` look like it touched only namzu's own state and was part of
     // why it sat on the no-prompt list; it writes into the user's project.
     // Separate from the user-curated MEMORY.md that is injected into the prompt.
-    const memoryStore = new DiskMemoryStore({ baseDir: join(cwd, '.namzu') });
+    const stateRoot = join(cwd, '.namzu');
+    ensurePrivateStateDirectory(stateRoot, 'memory');
+    const memoryStore = new DiskMemoryStore({ baseDir: stateRoot });
     // Search through the store's async boundary. Its concrete index is lazy:
     // handing `getIndex()` to the synchronous overload before the first store
     // read makes a new process report every persisted memory as absent.
@@ -350,7 +354,35 @@ async function currentPluginSkills(registry) {
 }
 export async function createAgentSession(prefs, detected, options = {}) {
     const scope = options.scope ?? mintScope();
-    const cwd = options.cwd ?? process.cwd();
+    const requestedCwd = resolve(options.cwd ?? process.cwd());
+    let cwd;
+    try {
+        const entry = await stat(requestedCwd);
+        if (!entry.isDirectory()) {
+            return emptySession(`Working directory is not a directory: ${requestedCwd}`, 'invocation');
+        }
+        cwd = await realpath(requestedCwd);
+    }
+    catch (error) {
+        return emptySession(`Working directory is unavailable: ${requestedCwd} — ${describeError(error)}`, 'invocation');
+    }
+    const sandboxWorkspace = options.sandbox?.workspace ?? 'working-directory';
+    if (options.sandbox?.enabled !== false &&
+        sandboxWorkspace === 'working-directory' &&
+        cwd === parse(cwd).root) {
+        return emptySession(`Working-directory sandboxing refuses filesystem root ${cwd}; choose a project directory so confinement has a boundary, or explicitly select an ephemeral workspace.`, 'invocation');
+    }
+    try {
+        // Refuse an aliased or otherwise unsafe generated-state root before any
+        // provider, sandbox or plugin runtime is constructed. Project-authored
+        // `.namzu` content may coexist here, but generated memory must never be
+        // redirected outside the trusted working directory through an ancestor
+        // symlink.
+        ensurePrivateStateDirectory(join(cwd, '.namzu'), 'memory');
+    }
+    catch (error) {
+        return emptySession(`Project state is unavailable: ${describeError(error)}`, 'environment');
+    }
     // The head serves; the tail is fallen over to, in order, when it cannot.
     const primary = primaryProvider(prefs);
     const entry = PROVIDER_REGISTRY[primary.id];
@@ -662,6 +694,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // `buildToolRegistry` directly below, so they never receive these tools.
     // Per-send denial further keeps the schemas out of ordinary human turns.
     const goalAuthorities = new Map();
+    // A child is created after the parent query has started, from inside its
+    // Agent tool. Keying the review channel by the executing run keeps two
+    // concurrent sends from borrowing each other's prompt or approval latch.
+    const delegatedResumeHandlers = new Map();
     const goalToolNames = new Set(SESSION_GOAL_TOOL_NAMES);
     if (options.sessionGoals) {
         registry.register(buildSessionGoalTools(options.sessionGoals, (runId) => goalAuthorities.get(runId)));
@@ -714,11 +750,6 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // Best-effort — if the runtime can't stand up, the chat still works.
     let subagentGateway;
     let subagentRuntime;
-    // Buffer of the in-flight sub-agent's tool steps. The gateway streams the
-    // child's events here while the parent's `Agent` tool call blocks; runTurn
-    // drains it onto the `Agent` result as a `├─/└─` tree. Scoped per `Agent`
-    // call (cleared when one starts).
-    const childSteps = [];
     // Stays empty when the runtime below throws, which is the honest answer: the
     // catch is non-fatal and the session then genuinely has no delegate to
     // dispatch to. A roster reported from the request rather than the result
@@ -728,6 +759,8 @@ export async function createAgentSession(prefs, detected, options = {}) {
         const sub = await createSubagentRuntime({
             cwd,
             model,
+            sandboxWorkspace,
+            resolveResumeHandler: (runId) => delegatedResumeHandlers.get(runId),
             ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
             ...(options.sandbox?.teardownTimeoutMs !== undefined
                 ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
@@ -769,11 +802,6 @@ export async function createAgentSession(prefs, detected, options = {}) {
                 return buildToolRegistry(cwd).registry;
             },
             authorizationGate: gateFor(options.rules),
-            onEvent: (e) => {
-                if (e.type === 'tool_executing') {
-                    childSteps.push(`${e.toolName}(${genericLabel(e.input)})`);
-                }
-            },
         });
         subagentRuntime = sub;
         registry.register([sub.agentTool]);
@@ -803,8 +831,10 @@ export async function createAgentSession(prefs, detected, options = {}) {
     // It is also why `toolNames` below reads the registry rather than a list
     // captured on this line. The count at connect time is unchanged; what
     // changes is that asking again later gets a later answer.
+    const stateRoot = join(cwd, '.namzu');
+    ensurePrivateStateDirectory(stateRoot, 'tenants');
     const taskStore = new DiskTaskStore({
-        baseDir: join(cwd, '.namzu'),
+        baseDir: stateRoot,
         defaultRunId: asRunId('run_namzu-cli'),
         tenantId: scope.tenantId,
     });
@@ -905,6 +935,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             ...(sandbox.environment ? { environment: sandbox.environment } : {}),
             enforced: sandbox.enforced,
             required: sandbox.required,
+            workspace: sandbox.workspace,
         },
         providerSummary: entry.label,
         modelSummary: model,
@@ -928,6 +959,7 @@ export async function createAgentSession(prefs, detected, options = {}) {
             .map((t) => t.name)
             .filter((name) => !goalToolNames.has(name)),
         agentIds: allowedAgentIds,
+        ...(subagentRuntime ? { subagents: subagentRuntime.activity } : {}),
         get instructionFiles() {
             return projectInstructions.instructionFiles;
         },
@@ -960,172 +992,198 @@ export async function createAgentSession(prefs, detected, options = {}) {
         },
         promptExemptTools: () => promptExemptToolNames(registry).filter((name) => !goalToolNames.has(name)),
         send: (messages, opts) => operations.stream(opts?.signal, (signal) => (async function* () {
-            // Renew a lapsed OAuth token before the turn runs (no-op for valid
-            // tokens and non-subscription credentials).
-            await prepareProviderCredential(signal);
-            // namzu identity first (so it establishes who the agent is even when
-            // the credential layer prepends whatever prefix its token requires),
-            // then memory and per-turn extra context. Project instructions are a
-            // separate retained user-context snapshot prepared by the controller;
-            // that is what lets nested scopes be replaced and persisted safely.
-            //
-            // The environment block is read fresh every turn because both facts in it
-            // can change WHILE the session
-            // runs — midnight passes, and the agent checks out a branch itself.
-            // Its text only changes when a fact changes, so it costs a prompt-cache
-            // miss exactly when a hit would have been a stale claim.
+            const runId = opts?.runId ?? generateRunId();
+            const turnOpts = { ...opts, runId, signal };
+            const resumeHandler = makeResumeHandler(approval, opts?.onPermission, opts?.permissionMode ?? options.permissionMode, (name, input) => isPromptExempt(registry, name, input));
+            if (delegatedResumeHandlers.has(runId)) {
+                throw new Error(`Run ${runId} already owns a delegated review channel.`);
+            }
+            delegatedResumeHandlers.set(runId, resumeHandler);
+            try {
+                // Renew a lapsed OAuth token before the turn runs (no-op for valid
+                // tokens and non-subscription credentials).
+                await prepareProviderCredential(signal);
+                // namzu identity first (so it establishes who the agent is even when
+                // the credential layer prepends whatever prefix its token requires),
+                // then memory and per-turn extra context. Project instructions are a
+                // separate retained user-context snapshot prepared by the controller;
+                // that is what lets nested scopes be replaced and persisted safely.
+                //
+                // The environment block is read fresh every turn because both facts in it
+                // can change WHILE the session
+                // runs — midnight passes, and the agent checks out a branch itself.
+                // Its text only changes when a fact changes, so it costs a prompt-cache
+                // miss exactly when a hit would have been a stale claim.
+                const pluginSkills = pluginRuntime
+                    ? await currentPluginSkills(pluginRuntime.skills)
+                    : undefined;
+                const memoryPrompt = composeMemoryPrompt(readMemory());
+                const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
+                const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt, opts?.extraSystem]
+                    .filter((s) => Boolean(s))
+                    .join('\n\n') || undefined;
+                let capturedAuthority;
+                if (opts?.goalRound) {
+                    if (!opts.runId)
+                        throw new Error('A goal round requires a caller-reserved runId.');
+                    if (!options.sessionGoals)
+                        throw new Error('This session has no durable goal store.');
+                    if (opts.goalRound.sessionId !== scope.sessionId ||
+                        opts.goalRound.tenantId !== scope.tenantId) {
+                        throw new Error('Goal-round authority does not belong to this agent session scope.');
+                    }
+                    const current = await options.sessionGoals.getGoal(scope.sessionId, scope.tenantId);
+                    if (!current ||
+                        current.phase !== 'active' ||
+                        current.id !== opts.goalRound.id ||
+                        current.revision !== opts.goalRound.revision ||
+                        current.objective !== opts.goalRound.objective ||
+                        current.roundsAdmitted !== opts.goalRound.round ||
+                        current.maxGoalRounds !== opts.goalRound.maxGoalRounds) {
+                        throw new Error('Goal-round authority is stale or does not match the durable goal.');
+                    }
+                    if (goalAuthorities.has(opts.runId)) {
+                        throw new Error(`Run ${opts.runId} already owns goal-round authority.`);
+                    }
+                    capturedAuthority = Object.freeze({ ...opts.goalRound });
+                    goalAuthorities.set(opts.runId, capturedAuthority);
+                }
+                try {
+                    yield* runTurn({
+                        provider,
+                        // Constructed HERE, per turn, and that is not an optimisation to
+                        // undo. `refreshTokenIfNeeded` above replaces the head's client
+                        // object when an OAuth token rotates, so a member list built once at
+                        // session creation would hand the kernel a client holding a token
+                        // that expired hours ago — and a chain whose own members are stale
+                        // is a fallback that fails for the reason the fallback exists to
+                        // survive. Building a driver is a client object, not a request.
+                        fallbackProviders: fallbackPlan.build(currentToken),
+                        model,
+                        tools: registry,
+                        pluginManager: pluginRuntime?.manager,
+                        skillRegistry: pluginRuntime?.skills,
+                        skills: pluginSkills,
+                        scope,
+                        workingDirectory: cwd,
+                        sandboxWorkspace,
+                        rules: options.rules,
+                        reviewAnswer: options.reviewAnswer,
+                        maxAnswerReviews: options.maxAnswerReviews,
+                        promoteMemory,
+                        taskStore,
+                        systemPrompt,
+                        messages,
+                        projectInstructionContext: projectInstructions.createRunContext(),
+                        opts: turnOpts,
+                        resumeHandler,
+                        taskGateway: subagentGateway,
+                        onRunEvent: options.onRunEvent,
+                        ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
+                        ...(options.sandbox?.teardownTimeoutMs !== undefined
+                            ? {
+                                sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs,
+                            }
+                            : {}),
+                    });
+                }
+                finally {
+                    if (opts?.runId &&
+                        capturedAuthority &&
+                        goalAuthorities.get(opts.runId) === capturedAuthority) {
+                        goalAuthorities.delete(opts.runId);
+                    }
+                }
+            }
+            finally {
+                if (delegatedResumeHandlers.get(runId) === resumeHandler) {
+                    delegatedResumeHandlers.delete(runId);
+                }
+            }
+        })()),
+        resumeDurable: ({ entry, checkpointStore, claimFence, signal }) => operations.promise(signal, async (ownedSignal) => {
+            // The same prelude a turn runs, and for the same reasons: a lapsed
+            // OAuth token has to be renewed before the provider is used, and the
+            // fallback chain has to be built AFTER that so its members do not
+            // hold a client the refresh just replaced.
+            await prepareProviderCredential(ownedSignal);
             const pluginSkills = pluginRuntime
                 ? await currentPluginSkills(pluginRuntime.skills)
                 : undefined;
             const memoryPrompt = composeMemoryPrompt(readMemory());
             const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt, opts?.extraSystem]
+            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt]
                 .filter((s) => Boolean(s))
                 .join('\n\n') || undefined;
-            let capturedAuthority;
-            if (opts?.goalRound) {
-                if (!opts.runId)
-                    throw new Error('A goal round requires a caller-reserved runId.');
-                if (!options.sessionGoals)
-                    throw new Error('This session has no durable goal store.');
-                if (opts.goalRound.sessionId !== scope.sessionId ||
-                    opts.goalRound.tenantId !== scope.tenantId) {
-                    throw new Error('Goal-round authority does not belong to this agent session scope.');
-                }
-                const current = await options.sessionGoals.getGoal(scope.sessionId, scope.tenantId);
-                if (!current ||
-                    current.phase !== 'active' ||
-                    current.id !== opts.goalRound.id ||
-                    current.revision !== opts.goalRound.revision ||
-                    current.objective !== opts.goalRound.objective ||
-                    current.roundsAdmitted !== opts.goalRound.round ||
-                    current.maxGoalRounds !== opts.goalRound.maxGoalRounds) {
-                    throw new Error('Goal-round authority is stale or does not match the durable goal.');
-                }
-                if (goalAuthorities.has(opts.runId)) {
-                    throw new Error(`Run ${opts.runId} already owns goal-round authority.`);
-                }
-                capturedAuthority = Object.freeze({ ...opts.goalRound });
-                goalAuthorities.set(opts.runId, capturedAuthority);
+            const resumeHandler = makeResumeHandler(approval, undefined, options.permissionMode, (name, input) => isPromptExempt(registry, name, input));
+            if (delegatedResumeHandlers.has(entry.runId)) {
+                throw new Error(`Run ${entry.runId} already owns a delegated review channel.`);
             }
+            delegatedResumeHandlers.set(entry.runId, resumeHandler);
             try {
-                yield* runTurn({
+                return await resumeRun({
                     provider,
-                    // Constructed HERE, per turn, and that is not an optimisation to
-                    // undo. `refreshTokenIfNeeded` above replaces the head's client
-                    // object when an OAuth token rotates, so a member list built once at
-                    // session creation would hand the kernel a client holding a token
-                    // that expired hours ago — and a chain whose own members are stale
-                    // is a fallback that fails for the reason the fallback exists to
-                    // survive. Building a driver is a client object, not a request.
                     fallbackProviders: fallbackPlan.build(currentToken),
-                    model,
                     tools: registry,
                     pluginManager: pluginRuntime?.manager,
                     skillRegistry: pluginRuntime?.skills,
                     skills: pluginSkills,
-                    scope,
-                    workingDirectory: cwd,
-                    rules: options.rules,
-                    permissionMode: opts?.permissionMode ?? options.permissionMode,
-                    reviewAnswer: options.reviewAnswer,
-                    maxAnswerReviews: options.maxAnswerReviews,
-                    promoteMemory,
-                    approval,
                     taskStore,
-                    systemPrompt,
-                    messages,
+                    ...(subagentGateway ? { taskGateway: subagentGateway } : {}),
+                    authorizationGate: gateFor(options.rules),
+                    compactionConfig: COMPACTION_CONFIG,
                     projectInstructionContext: projectInstructions.createRunContext(),
-                    opts: { ...opts, signal },
-                    taskGateway: subagentGateway,
-                    onRunEvent: options.onRunEvent,
-                    childSteps,
                     ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
                     ...(options.sandbox?.teardownTimeoutMs !== undefined
-                        ? {
-                            sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs,
-                        }
+                        ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
                         : {}),
+                    // NOT `emergencySave`, unlike a turn. The manager is a singleton
+                    // whose `attach` detaches whoever held it before, so a caller
+                    // resuming several runs in one process would leave only the last
+                    // one covered — and would look covered. A turn owns its process
+                    // end to end; a drainer does not.
+                    runConfig: {
+                        model,
+                        ...(sandbox.provider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
+                        timeoutMs: 600_000,
+                        tokenBudget: 1_000_000,
+                        maxIterations: 50,
+                        maxResponseTokens: 8192,
+                        permissionMode: 'auto',
+                    },
+                    agentId: 'namzu',
+                    agentName: 'namzu',
+                    ...(systemPrompt ? { systemPrompt } : {}),
+                    workingDirectory: cwd,
+                    // No `onPermission`: there is nobody at a drainer's terminal, so a
+                    // prompt would block the pass forever on a run nobody is watching.
+                    // The gate's deny rules still apply.
+                    // One presenter for the whole stream, built from the registry this
+                    // scope already holds. It was the absence of the registry HERE that
+                    // forced presentation to be name matching: `toAgentEvent` was pure
+                    // over a `RunEvent` and could not ask a tool anything.
+                    resumeHandler,
+                    signal: ownedSignal,
+                    // Attribution comes from the ENTRY, not from this session: the run
+                    // belongs to whoever started it, and stamping the drainer's ids onto
+                    // it would file another tenant's work under this one.
+                    tenantId: entry.tenantId,
+                    projectId: entry.projectId,
+                    sessionId: entry.sessionId,
+                    // …except the topic, which no checkpoint records — see
+                    // `RunStateScope`. This one is the drainer's, and honestly so:
+                    // supplied here rather than pretended to have been recovered.
+                    topicId: scope.topicId,
+                    scope: { ...entry, topicId: scope.topicId },
+                    checkpointStore,
+                    ...(claimFence !== undefined ? { claimFence } : {}),
                 });
             }
             finally {
-                if (opts?.runId &&
-                    capturedAuthority &&
-                    goalAuthorities.get(opts.runId) === capturedAuthority) {
-                    goalAuthorities.delete(opts.runId);
+                if (delegatedResumeHandlers.get(entry.runId) === resumeHandler) {
+                    delegatedResumeHandlers.delete(entry.runId);
                 }
             }
-        })()),
-        resumeDurable: ({ entry, checkpointStore, claimFence, signal }) => operations.promise(signal, async (ownedSignal) => {
-            // The same prelude a turn runs, and for the same reasons: a lapsed
-            // OAuth token has to be renewed before the provider is used, and the
-            // fallback chain has to be built AFTER that so its members do not
-            // hold a client the refresh just replaced.
-            await prepareProviderCredential(ownedSignal);
-            const pluginSkills = pluginRuntime
-                ? await currentPluginSkills(pluginRuntime.skills)
-                : undefined;
-            const memoryPrompt = composeMemoryPrompt(readMemory());
-            const environmentPrompt = composeEnvironmentPrompt(await readEnvironmentFacts(cwd));
-            const systemPrompt = [NAMZU_IDENTITY, environmentPrompt, memoryPrompt]
-                .filter((s) => Boolean(s))
-                .join('\n\n') || undefined;
-            return resumeRun({
-                provider,
-                fallbackProviders: fallbackPlan.build(currentToken),
-                tools: registry,
-                pluginManager: pluginRuntime?.manager,
-                skillRegistry: pluginRuntime?.skills,
-                skills: pluginSkills,
-                taskStore,
-                ...(subagentGateway ? { taskGateway: subagentGateway } : {}),
-                authorizationGate: gateFor(options.rules),
-                compactionConfig: COMPACTION_CONFIG,
-                projectInstructionContext: projectInstructions.createRunContext(),
-                ...(sandbox.provider ? { sandboxProvider: sandbox.provider } : {}),
-                ...(options.sandbox?.teardownTimeoutMs !== undefined
-                    ? { sandboxTeardownTimeoutMs: options.sandbox.teardownTimeoutMs }
-                    : {}),
-                // NOT `emergencySave`, unlike a turn. The manager is a singleton
-                // whose `attach` detaches whoever held it before, so a caller
-                // resuming several runs in one process would leave only the last
-                // one covered — and would look covered. A turn owns its process
-                // end to end; a drainer does not.
-                runConfig: {
-                    model,
-                    timeoutMs: 600_000,
-                    tokenBudget: 1_000_000,
-                    maxIterations: 50,
-                    maxResponseTokens: 8192,
-                    permissionMode: 'auto',
-                },
-                agentId: 'namzu',
-                agentName: 'namzu',
-                ...(systemPrompt ? { systemPrompt } : {}),
-                workingDirectory: cwd,
-                // No `onPermission`: there is nobody at a drainer's terminal, so a
-                // prompt would block the pass forever on a run nobody is watching.
-                // The gate's deny rules still apply.
-                // One presenter for the whole stream, built from the registry this
-                // scope already holds. It was the absence of the registry HERE that
-                // forced presentation to be name matching: `toAgentEvent` was pure
-                // over a `RunEvent` and could not ask a tool anything.
-                resumeHandler: makeResumeHandler(approval, undefined, options.permissionMode, (n, i) => isPromptExempt(registry, n, i)),
-                signal: ownedSignal,
-                // Attribution comes from the ENTRY, not from this session: the run
-                // belongs to whoever started it, and stamping the drainer's ids onto
-                // it would file another tenant's work under this one.
-                tenantId: entry.tenantId,
-                projectId: entry.projectId,
-                sessionId: entry.sessionId,
-                // …except the topic, which no checkpoint records — see
-                // `RunStateScope`. This one is the drainer's, and honestly so:
-                // supplied here rather than pretended to have been recovered.
-                topicId: scope.topicId,
-                scope: { ...entry, topicId: scope.topicId },
-                checkpointStore,
-                ...(claimFence !== undefined ? { claimFence } : {}),
-            });
         }),
     };
 }
@@ -1485,7 +1543,7 @@ const COMPACTION_CONFIG = {
     maxCharsPerRequirement: 300,
     maxCharsPerTask: 400,
 };
-async function* runTurn({ provider, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, workingDirectory, rules, permissionMode, reviewAnswer, maxAnswerReviews, promoteMemory, approval, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, childSteps, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
+async function* runTurn({ provider, fallbackProviders, model, tools, pluginManager, skillRegistry, skills, scope, workingDirectory, sandboxWorkspace, rules, reviewAnswer, maxAnswerReviews, promoteMemory, resumeHandler, taskStore, systemPrompt, messages, projectInstructionContext, opts, taskGateway, sandboxProvider, sandboxTeardownTimeoutMs, onRunEvent, }) {
     const signal = opts?.signal;
     // One presenter for the whole stream, built from the registry this scope
     // already holds. Its absence HERE is what forced presentation to be name
@@ -1523,6 +1581,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, pluginManag
             emergencySave: true,
             runConfig: {
                 model,
+                ...(sandboxProvider ? { sandbox: { workspace: sandboxWorkspace } } : {}),
                 ...(opts?.effort !== undefined ? { effort: opts.effort } : {}),
                 timeoutMs: 600_000,
                 tokenBudget: 1_000_000,
@@ -1550,7 +1609,7 @@ async function* runTurn({ provider, fallbackProviders, model, tools, pluginManag
             // The exemption reads `tools` at decision time, so it sees the task
             // tools `query()` registers deferred below and any tool server that
             // connected after this session was built.
-            resumeHandler: makeResumeHandler(approval, opts?.onPermission, permissionMode, (name, input) => isPromptExempt(tools, name, input)),
+            resumeHandler,
             signal,
             ...scope,
         });
@@ -1581,22 +1640,6 @@ async function* runTurn({ provider, fallbackProviders, model, tools, pluginManag
                 const mapped = toAgentEvent(event, presenter);
                 if (!mapped)
                     continue;
-                // On an `Agent` delegation finishing, attach the sub-agent's tool
-                // steps (collected via the gateway while the call blocked) as a
-                // `├─/└─` tree under its result, then reset for the next delegation.
-                // (Don't clear on tool_executing: the parent's events can be buffered
-                // and pulled only after the child already ran, which would wipe it.)
-                if (event.type === 'tool_completed' &&
-                    event.toolName === 'Agent' &&
-                    childSteps.length > 0 &&
-                    mapped.kind === 'tool-end') {
-                    yield {
-                        ...mapped,
-                        detail: [...(mapped.detail ?? []), ...asTree(childSteps)],
-                    };
-                    childSteps.length = 0;
-                    continue;
-                }
                 yield mapped;
             }
         }
@@ -2014,10 +2057,6 @@ function describeFallback(event) {
         `${status} ${why} (${event.code}). ` +
         `${name(event.toIndex, event.toProviderId, event.toModel)} — is serving the rest of this turn.`);
 }
-/** Render a sub-agent's tool steps as a `├─/└─` tree for the Agent result. */
-function asTree(steps) {
-    return steps.map((s, i) => `${i === steps.length - 1 ? '└─' : '├─'} ${s}`);
-}
 /**
  * The one presentation function this host keeps.
  *