@namzu/cli 34.1.1 → 36.0.0

package/dist/chunks/chunk-UDDSFIMB.js

@@ -0,0 +1,1373 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  createCliPalMessagingContext
+} from "./chunk-2RBYHHLM.js";
+import {
+  palConversationBinding
+} from "./chunk-WY2WUTFR.js";
+import {
+  constructProvider,
+  createCurrentCredentialReader,
+  createLiveModeControl,
+  createTaskContextStep,
+  makeHoldingResumeHandler,
+  makeResumeHandler,
+  projectTurnConversation,
+  reviewExemptionFor,
+  toAgentEvent
+} from "./chunk-W5KGCUP3.js";
+import {
+  readStoredTurnGuards,
+  resolveTurnGuards
+} from "./chunk-W3UQMRYA.js";
+import {
+  ensureFreshStoredCodexCredential
+} from "./chunk-OWXJOD4H.js";
+import {
+  ensureRegistered,
+  findDetected,
+  primaryProvider,
+  readCodexCredentialFile
+} from "./chunk-SB6UD3ED.js";
+import {
+  PROVIDER_REGISTRY
+} from "./chunk-6LLJQ3KY.js";
+import {
+  BackgroundJobRegistry,
+  DiskSessionLog,
+  DiskTaskStore,
+  MCPClient,
+  PLAN_MODE_REFUSAL,
+  ToolManager,
+  abandonTurn,
+  asCheckpointId,
+  asTurnId,
+  bindOwner,
+  buildPalSystemPrompt,
+  buildTaskTools,
+  computerUseUnavailableReason,
+  createBrowserTools,
+  createComputerUseTool,
+  createPalReferenceImageTool,
+  createToolPresenter,
+  createViewImageTool,
+  getBuiltinTools,
+  mcpToolset,
+  palConversationGreeting,
+  query,
+  resumeSession,
+  toolset
+} from "./chunk-K5HARZ7G.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/pals/agent-session.ts
+import { randomUUID } from "node:crypto";
+
+// src/pals/guest-mcp.ts
+import { posix } from "node:path";
+
+// src/pals/guest-mcp-transport.ts
+import { StringDecoder } from "node:string_decoder";
+var MAX_MESSAGE_BYTES = 16 * 1024 * 1024;
+var MAX_WRITE_BYTES = 1024 * 1024;
+var PalGuestMcpTransport = class {
+  constructor(open) {
+    this.open = open;
+  }
+  open;
+  static {
+    __name(this, "PalGuestMcpTransport");
+  }
+  channel;
+  closing;
+  ended = false;
+  messageHandler;
+  closeHandler;
+  errorHandler;
+  pending = /* @__PURE__ */ new Map();
+  async connect() {
+    if (this.channel || this.ended) throw new Error("This guest MCP transport cannot reconnect.");
+    this.channel = await this.open();
+    void this.read(this.channel).catch((error) => {
+      this.fail(error instanceof Error ? error : new Error(String(error)));
+    });
+    void this.channel.closed.catch(
+      (error) => this.fail(error instanceof Error ? error : new Error(String(error)))
+    );
+  }
+  isConnected() {
+    return this.channel !== void 0 && !this.ended && !this.closing;
+  }
+  onMessage(handler) {
+    this.messageHandler = handler;
+  }
+  onClose(handler) {
+    this.closeHandler = handler;
+  }
+  onError(handler) {
+    this.errorHandler = handler;
+  }
+  async send(message, options) {
+    options?.signal?.throwIfAborted();
+    const channel = this.channel;
+    if (!channel || !this.isConnected()) throw new Error("This guest MCP channel is closed.");
+    const data = `${JSON.stringify(message)}
+`;
+    if (Buffer.byteLength(data) > MAX_WRITE_BYTES)
+      throw new Error("This guest MCP request exceeds the 1 MiB write limit; nothing was sent.");
+    const request = message.method !== void 0 && message.id !== void 0;
+    if (!request) {
+      await channel.write(data, options?.signal);
+      return;
+    }
+    const id = message.id;
+    if (this.pending.has(id)) throw new Error("This guest MCP request ID is already active.");
+    const operation = await channel.beginOperation(options?.signal);
+    if (options?.signal?.aborted || !this.isConnected()) {
+      operation.complete();
+      options?.signal?.throwIfAborted();
+      throw new Error("This guest MCP channel closed before dispatch.");
+    }
+    const onAbort = /* @__PURE__ */ __name(() => this.settle(id, false), "onAbort");
+    const entry = {
+      operation,
+      method: message.method,
+      removeAbort: /* @__PURE__ */ __name(() => options?.signal?.removeEventListener("abort", onAbort), "removeAbort")
+    };
+    this.pending.set(id, entry);
+    options?.signal?.addEventListener("abort", onAbort, { once: true });
+    try {
+      await channel.write(data, options?.signal);
+    } catch (error) {
+      this.settle(id, false);
+      throw error;
+    }
+  }
+  settle(id, confirmed) {
+    const entry = this.pending.get(id);
+    if (!entry) return;
+    this.pending.delete(id);
+    entry.removeAbort();
+    if (confirmed) entry.operation.complete();
+    else entry.operation.outcomeUnknown();
+  }
+  accept(line) {
+    if (Buffer.byteLength(line) > MAX_MESSAGE_BYTES)
+      throw new Error("This guest MCP reply exceeds the message limit.");
+    const message = JSON.parse(line);
+    if (!message || typeof message !== "object" || Array.isArray(message))
+      throw new Error("This guest MCP server returned an invalid JSON-RPC message.");
+    let rpc = message;
+    if (rpc.jsonrpc !== "2.0") throw new Error("This guest MCP server returned invalid JSON-RPC.");
+    if (rpc.method === void 0 && rpc.id !== void 0) {
+      if (Object.hasOwn(rpc, "result") === Object.hasOwn(rpc, "error"))
+        throw new Error("This guest MCP server returned an invalid reply.");
+      const entry = this.pending.get(rpc.id);
+      const result = rpc.result;
+      const metadata = result?._meta;
+      const outcome = metadata?.["namzu/outcome"];
+      const unknown = outcome === "unknown" || entry?.method === "tools/call" && (rpc.error !== void 0 || outcome !== "settled" && outcome !== "not_dispatched");
+      this.settle(rpc.id, !unknown);
+      if (unknown && entry?.method === "tools/call" && !rpc.error) {
+        rpc = {
+          ...rpc,
+          result: {
+            ...result,
+            isError: true,
+            _meta: { ...metadata, "namzu/outcome": "unknown" },
+            content: [
+              ...Array.isArray(result?.content) ? result.content : [],
+              {
+                type: "text",
+                text: "The guest application did not confirm operation completion. Do not repeat the action or take over; stop and restart this computer before further work."
+              }
+            ]
+          }
+        };
+      }
+    }
+    this.messageHandler?.(rpc);
+  }
+  async read(channel) {
+    const decoder = new StringDecoder("utf8");
+    let buffered = "";
+    for await (const event of channel.events) {
+      if (event.stream !== "stdout") continue;
+      buffered += decoder.write(Buffer.from(event.data));
+      for (; ; ) {
+        const end = buffered.indexOf("\n");
+        if (end < 0) break;
+        const line = buffered.slice(0, end).replace(/\r$/, "");
+        buffered = buffered.slice(end + 1);
+        if (line.trim()) this.accept(line);
+      }
+      if (Buffer.byteLength(buffered) > MAX_MESSAGE_BYTES)
+        throw new Error("This guest MCP reply exceeds the message limit.");
+    }
+    if (!this.closing) {
+      if (buffered.length || decoder.end())
+        throw new Error("This guest MCP server closed with an incomplete reply.");
+      this.end();
+    }
+  }
+  end() {
+    if (this.ended) return;
+    this.ended = true;
+    for (const id of this.pending.keys()) this.settle(id, false);
+    this.closeHandler?.();
+  }
+  fail(error) {
+    if (this.ended) return;
+    this.errorHandler?.(error);
+    this.end();
+    void this.close().catch(() => void 0);
+  }
+  close() {
+    if (this.closing) return this.closing;
+    this.end();
+    this.closing = this.channel?.close() ?? Promise.resolve();
+    return this.closing;
+  }
+};
+
+// src/pals/guest-mcp.ts
+var PAL_GUEST_MCP_MANIFEST = "/home/namzu/.config/namzu/mcp.json";
+var MAX_MANIFEST_BYTES = 64 * 1024;
+var DEFAULT_REQUEST_TIMEOUT_MS = 18e4;
+function absoluteGuestPath(value) {
+  return typeof value === "string" && value.length <= 4096 && !value.includes("\0") && !value.includes("\\") && posix.isAbsolute(value) && posix.normalize(value) === value;
+}
+__name(absoluteGuestPath, "absoluteGuestPath");
+function parsePalGuestMcpManifest(bytes) {
+  if (bytes.byteLength > MAX_MANIFEST_BYTES)
+    throw new Error("The guest MCP manifest exceeds 64 KiB.");
+  const value = JSON.parse(Buffer.from(bytes).toString("utf8"));
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error("The guest MCP manifest must be an object.");
+  const manifest = value;
+  if (manifest.version !== 1 || Object.keys(manifest).some((key) => key !== "version" && key !== "servers") || !Array.isArray(manifest.servers) || manifest.servers.length > 16)
+    throw new Error("The guest MCP manifest requires version 1 and at most 16 servers.");
+  const names = /* @__PURE__ */ new Set();
+  return manifest.servers.map((value2) => {
+    if (!value2 || typeof value2 !== "object" || Array.isArray(value2))
+      throw new Error("A guest MCP server must be an object.");
+    const server = value2;
+    if (Object.keys(server).some(
+      (key) => ![
+        "name",
+        "outcomeProtocol",
+        "command",
+        "args",
+        "cwd",
+        "env",
+        "allow",
+        "requestTimeoutMs"
+      ].includes(key)
+    ))
+      throw new Error("A guest MCP server contains an unsupported field.");
+    if (typeof server.name !== "string" || !/^[a-z][a-z0-9_-]{0,47}$/.test(server.name))
+      throw new Error("A guest MCP server requires a lowercase name.");
+    if (names.has(server.name)) throw new Error(`Duplicate guest MCP server "${server.name}".`);
+    names.add(server.name);
+    if (server.outcomeProtocol !== "namzu-v1")
+      throw new Error(
+        `Guest MCP server "${server.name}" requires the reviewed namzu-v1 outcome bridge.`
+      );
+    if (!absoluteGuestPath(server.command))
+      throw new Error(`Guest MCP server "${server.name}" requires an absolute guest command.`);
+    if (server.cwd !== void 0 && !absoluteGuestPath(server.cwd))
+      throw new Error(`Guest MCP server "${server.name}" requires an absolute guest cwd.`);
+    if (server.args !== void 0 && (!Array.isArray(server.args) || server.args.length > 64 || !server.args.every(
+      (arg) => typeof arg === "string" && arg.length <= 4096 && !arg.includes("\0")
+    )))
+      throw new Error(`Guest MCP server "${server.name}" has invalid arguments.`);
+    if (!Array.isArray(server.allow) || server.allow.length === 0 || server.allow.length > 128 || !server.allow.every(
+      (name) => typeof name === "string" && /^[a-zA-Z0-9_.-]{1,128}$/.test(name)
+    ))
+      throw new Error(`Guest MCP server "${server.name}" requires an explicit tool allowlist.`);
+    if (server.env !== void 0) {
+      if (!server.env || typeof server.env !== "object" || Array.isArray(server.env))
+        throw new Error(`Guest MCP server "${server.name}" has invalid environment values.`);
+      const entries = Object.entries(server.env);
+      if (entries.length > 64 || entries.some(
+        ([key, value3]) => !/^[A-Za-z_][A-Za-z0-9_]*$/.test(key) || key.startsWith("NAMZU_SANDBOX_") || typeof value3 !== "string" || value3.length > 8192 || value3.includes("\0")
+      ))
+        throw new Error(`Guest MCP server "${server.name}" has invalid environment values.`);
+    }
+    if (server.requestTimeoutMs !== void 0 && (typeof server.requestTimeoutMs !== "number" || !Number.isSafeInteger(server.requestTimeoutMs) || server.requestTimeoutMs < 1e3 || server.requestTimeoutMs > 3e5))
+      throw new Error(`Guest MCP server "${server.name}" requires a 1\u2013300 second request deadline.`);
+    return structuredClone(server);
+  });
+}
+__name(parsePalGuestMcpManifest, "parsePalGuestMcpManifest");
+async function connectPalGuestMcp(lease, assertExecutionAllowed, signal) {
+  const connected = [];
+  const failed = [];
+  const toolsets = [];
+  const openStdio = lease.sandbox.openStdio?.bind(lease.sandbox);
+  if (!openStdio) return { connected, failed, toolsets };
+  let servers;
+  try {
+    await assertExecutionAllowed();
+    signal?.throwIfAborted();
+    const exists = await lease.sandbox.exec(
+      "python3",
+      [
+        "-c",
+        "import os,sys; sys.exit(0 if os.path.isfile(sys.argv[1]) else 3)",
+        PAL_GUEST_MCP_MANIFEST
+      ],
+      { signal, timeout: 1e4 }
+    );
+    if (exists.exitCode === 3 && !exists.timedOut) return { connected, failed, toolsets };
+    if (exists.exitCode !== 0 || exists.timedOut)
+      throw new Error("The guest could not inspect its MCP installation manifest.");
+    await assertExecutionAllowed();
+    servers = parsePalGuestMcpManifest(
+      await lease.sandbox.readFile(PAL_GUEST_MCP_MANIFEST, {
+        length: MAX_MANIFEST_BYTES + 1,
+        signal
+      })
+    );
+  } catch (error) {
+    signal?.throwIfAborted();
+    await assertExecutionAllowed();
+    failed.push({
+      name: "guest-manifest",
+      reason: error instanceof Error ? error.message : String(error)
+    });
+    return { connected, failed, toolsets };
+  }
+  try {
+    for (const server of servers) {
+      const setup = new AbortController();
+      const onAbort = /* @__PURE__ */ __name(() => setup.abort(signal?.reason), "onAbort");
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) onAbort();
+      const deadline = setTimeout(
+        () => setup.abort(new Error("Guest MCP setup exceeded 20 seconds.")),
+        2e4
+      );
+      deadline.unref();
+      const clearSetup = /* @__PURE__ */ __name(() => clearTimeout(deadline), "clearSetup");
+      const releaseSignal = /* @__PURE__ */ __name(() => {
+        clearSetup();
+        signal?.removeEventListener("abort", onAbort);
+      }, "releaseSignal");
+      const requestTimeoutMs = server.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+      const client = new MCPClient({
+        serverName: server.name,
+        transport: {
+          type: "stdio",
+          command: server.command,
+          args: [...server.args ?? []]
+        },
+        transportFactory: /* @__PURE__ */ __name(() => new PalGuestMcpTransport(async () => {
+          await assertExecutionAllowed();
+          setup.signal.throwIfAborted();
+          return openStdio(server.command, server.args, {
+            cwd: server.cwd ?? lease.sandbox.rootDir,
+            env: server.env,
+            signal: setup.signal,
+            assertExecutionAllowed
+          });
+        }), "transportFactory"),
+        requestTimeoutMs
+      });
+      try {
+        await client.connect();
+        const sources = await mcpToolset(client, {
+          id: `pal:${lease.palId}/computer:${lease.environmentId}:${lease.generation}/mcp:${server.name}`,
+          allow: server.allow,
+          maxRetries: 0,
+          readOnlyHintTrusted: false,
+          reconnect: { enabled: false }
+        });
+        clearSetup();
+        let closing;
+        const close = /* @__PURE__ */ __name(() => {
+          closing ??= (async () => {
+            releaseSignal();
+            for (const source of sources) await source.close?.();
+            await client.disconnect();
+          })();
+          return closing;
+        }, "close");
+        for (const source of sources)
+          toolsets.push({
+            ...source,
+            tools: /* @__PURE__ */ __name(() => source.tools().map((tool) => ({
+              ...tool,
+              timeoutMs: requestTimeoutMs + 1e3,
+              isConcurrencySafe: /* @__PURE__ */ __name(() => false, "isConcurrencySafe")
+            })), "tools"),
+            close
+          });
+        const names = /* @__PURE__ */ __name(() => sources.flatMap((source) => source.tools().map((tool) => tool.name)), "names");
+        connected.push({
+          name: server.name,
+          get toolCount() {
+            return names().length;
+          },
+          get tools() {
+            return names();
+          }
+        });
+      } catch (error) {
+        releaseSignal();
+        await client.disconnect();
+        signal?.throwIfAborted();
+        await assertExecutionAllowed();
+        failed.push({
+          name: server.name,
+          reason: setup.signal.aborted && setup.signal.reason instanceof Error ? setup.signal.reason.message : error instanceof Error ? error.message : String(error)
+        });
+      }
+    }
+  } catch (error) {
+    const failures = [error];
+    for (const source of toolsets) {
+      try {
+        await source.close?.();
+      } catch (cleanup) {
+        failures.push(cleanup);
+      }
+    }
+    throw failures.length === 1 ? error : new AggregateError(failures, "Guest MCP setup and cleanup were not confirmed.");
+  }
+  return { connected, failed, toolsets };
+}
+__name(connectPalGuestMcp, "connectPalGuestMcp");
+
+// src/pals/review.ts
+async function readPalWaitingReview(log, turnId, checkpointId, now = Date.now()) {
+  asTurnId(turnId);
+  if (checkpointId !== void 0) asCheckpointId(checkpointId);
+  const active = await log.activeTurn();
+  if (active?.turnId !== turnId) throw new Error("This Pal turn is no longer waiting or active.");
+  const documents = /* @__PURE__ */ new Map();
+  const parks = /* @__PURE__ */ new Map();
+  for await (const { record, pointer } of log.read({ mode: "strict" })) {
+    if (record.sessionId !== log.sessionId) throw new Error("Foreign Pal review journal.");
+    if (record.turnId !== turnId) continue;
+    if (record.type === "checkpoint_written") documents.set(record.checkpointId, record.docSha256);
+    else if (record.type === "decision_requested") {
+      const request = record.request;
+      if (request.sessionId !== log.sessionId || request.turnId !== turnId || request.checkpointId !== record.checkpointId || typeof record.decisionId !== "string" || !record.decisionId)
+        throw new Error("Invalid Pal decision attribution.");
+      asCheckpointId(record.checkpointId);
+      const hash = documents.get(record.checkpointId);
+      if (!hash) throw new Error("Pal decision has no committed checkpoint.");
+      validateRequest(request);
+      const deadline = record.deadlineAt === void 0 ? void 0 : Date.parse(record.deadlineAt);
+      if (deadline !== void 0 && !Number.isFinite(deadline))
+        throw new Error("Invalid Pal decision deadline.");
+      parks.set(record.decisionId, {
+        turnId: asTurnId(turnId),
+        checkpointId: record.checkpointId,
+        decisionId: record.decisionId,
+        request: structuredClone(request),
+        requestRecord: { ...pointer },
+        checkpointDocSha256: hash,
+        ...deadline !== void 0 ? { deadlineAt: deadline } : {}
+      });
+    } else if (record.type === "decision_resolved" || record.type === "decision_expired")
+      parks.delete(record.decisionId);
+  }
+  const latest = [...parks.values()].at(-1);
+  if (!latest) return null;
+  if (checkpointId !== void 0 && latest.checkpointId !== checkpointId)
+    throw new Error("This Pal decision was replaced by a newer review.");
+  if (latest.deadlineAt !== void 0 && now >= latest.deadlineAt)
+    throw new Error("This Pal decision expired.");
+  return latest;
+}
+__name(readPalWaitingReview, "readPalWaitingReview");
+function validateRequest(request) {
+  if (request.type === "tool_review") {
+    if (!Array.isArray(request.toolCalls) || request.toolCalls.length === 0 || request.toolCalls.some(
+      (call) => !call || typeof call.id !== "string" || !call.id || typeof call.name !== "string" || !call.name || typeof call.isDestructive !== "boolean" || !Object.hasOwn(call, "input")
+    ) || new Set(request.toolCalls.map((call) => call.id)).size !== request.toolCalls.length)
+      throw new Error("Invalid Pal tool review.");
+  } else if (request.type === "user_question") {
+    const question = request.question;
+    if (!question || typeof question.questionId !== "string" || !question.questionId || !Array.isArray(question.options) || typeof question.multiSelect !== "boolean" || typeof question.allowFreeText !== "boolean" || question.options.some((option) => !option || typeof option.id !== "string" || !option.id) || new Set(question.options.map((option) => option.id)).size !== question.options.length)
+      throw new Error("Invalid Pal question review.");
+  } else if (request.type !== "iteration_checkpoint")
+    throw new Error("This Pal review kind cannot be resumed durably.");
+}
+__name(validateRequest, "validateRequest");
+function assertPalReviewDecision(request, decision) {
+  if (decision.action === "abort" || decision.action === "pause") {
+    if (typeof decision.reason !== "string") throw new Error("A Pal decision needs its reason.");
+    return;
+  }
+  if (request.type === "tool_review") {
+    if (!["approve_tools", "reject_tools", "modify_tools"].includes(decision.action))
+      throw new Error("This answer does not apply to the waiting Pal tool review.");
+    if (decision.action === "reject_tools" && typeof decision.feedback !== "string")
+      throw new Error("A rejected Pal review needs its feedback.");
+  } else if (request.type === "user_question") {
+    if (decision.action !== "answer_question" || decision.questionId !== request.question.questionId)
+      throw new Error("This answer does not apply to the waiting Pal question.");
+    const question = request.question;
+    if (!Array.isArray(decision.selectedOptionIds) || decision.selectedOptionIds.some(
+      (id) => !question.options.some((option) => option.id === id)
+    ) || new Set(decision.selectedOptionIds).size !== decision.selectedOptionIds.length || !question.multiSelect && decision.selectedOptionIds.length > 1 || decision.freeText !== void 0 && (!question.allowFreeText || typeof decision.freeText !== "string"))
+      throw new Error("Invalid answer to the waiting Pal question.");
+  } else if (request.type !== "iteration_checkpoint" || decision.action !== "continue")
+    throw new Error("This answer does not apply to the waiting Pal review.");
+}
+__name(assertPalReviewDecision, "assertPalReviewDecision");
+
+// src/pals/agent-session.ts
+function palSessionEnvironment(runtime, definition, conversationId) {
+  const { id, revision } = definition;
+  const request = /* @__PURE__ */ __name((signal) => ({
+    palId: id,
+    revision,
+    conversationId,
+    ...signal ? { signal } : {}
+  }), "request");
+  return {
+    definition: structuredClone(definition),
+    readyComputer: /* @__PURE__ */ __name(() => {
+      const lease = runtime.computer(id);
+      const control = runtime.computerControl(id);
+      return lease && (!control.supported || control.mode === "pal") ? lease : void 0;
+    }, "readyComputer"),
+    observeComputer: /* @__PURE__ */ __name(() => {
+      const lease = runtime.computer(id);
+      if (!lease) return void 0;
+      const control = runtime.computerControl(id);
+      if (runtime.computer(id) !== lease) return void 0;
+      return { status: "connected", control: control.mode };
+    }, "observeComputer"),
+    admit: /* @__PURE__ */ __name((signal) => runtime.admit(request(signal)), "admit"),
+    admitConversation: /* @__PURE__ */ __name((signal) => runtime.admitConversation(request(signal)), "admitConversation")
+  };
+}
+__name(palSessionEnvironment, "palSessionEnvironment");
+function guardHost(host, assertActive, ignoreDestroy = false, current, beforeAsync) {
+  return new Proxy(host, {
+    get(target, key) {
+      const source = current?.() ?? target;
+      const value = Reflect.get(source, key, source);
+      if (ignoreDestroy && key === "destroy") return async () => {
+      };
+      if (typeof value !== "function") return value;
+      if (beforeAsync && key === "execStream")
+        return async function* (...args) {
+          await beforeAsync();
+          assertActive();
+          const actual = current?.() ?? target;
+          const method = Reflect.get(actual, key, actual);
+          if (typeof method !== "function")
+            throw new Error("This Pal computer lost its stream operation.");
+          yield* method.apply(actual, args);
+        };
+      if (beforeAsync && ["readFile", "writeFile", "listFiles", "exec", "execute", "getDisplayGeometry"].includes(
+        String(key)
+      ))
+        return async (...args) => {
+          await beforeAsync();
+          assertActive();
+          const actual = current?.() ?? target;
+          const method = Reflect.get(actual, key, actual);
+          if (typeof method !== "function") throw new Error("This Pal computer lost its operation.");
+          return method.apply(actual, args);
+        };
+      return (...args) => {
+        assertActive();
+        const actual = current?.() ?? target;
+        const method = Reflect.get(actual, key, actual);
+        if (typeof method !== "function")
+          throw new Error("This Pal computer does not support that operation.");
+        return method.apply(actual, args);
+      };
+    }
+  });
+}
+__name(guardHost, "guardHost");
+function guardProvider(provider, assertActive, assertExecutionAllowed) {
+  const guarded = guardHost(provider, assertActive);
+  return new Proxy(guarded, {
+    get(target, key) {
+      if (key === "chatStream")
+        return async function* (params) {
+          assertActive();
+          await assertExecutionAllowed();
+          assertActive();
+          yield* target.chatStream(params);
+        };
+      return Reflect.get(target, key, target);
+    }
+  });
+}
+__name(guardProvider, "guardProvider");
+async function createPalAgentSession(prefs, detected, options) {
+  const suppliedBinding = options.palEnvironment;
+  const binding = suppliedBinding ? {
+    ...suppliedBinding,
+    definition: structuredClone(suppliedBinding.definition),
+    admit: suppliedBinding.admit.bind(suppliedBinding),
+    admitConversation: suppliedBinding.admitConversation?.bind(suppliedBinding),
+    readyComputer: suppliedBinding.readyComputer?.bind(suppliedBinding)
+  } : void 0;
+  const scope = options.scope ? { ...options.scope } : void 0;
+  const conversations = options.conversationSessions;
+  if (!binding || !scope || !conversations)
+    throw new Error("Pal execution requires its owned computer and claimed conversation scope.");
+  if (options.cwd !== binding.definition.workspace || binding.lease && binding.lease.palId !== binding.definition.id || !binding.admitConversation && !binding.lease)
+    throw new Error("This Pal does not own the conversation or computer.");
+  const primary = { ...primaryProvider(prefs) };
+  const entry = PROVIDER_REGISTRY[primary.id];
+  if (!entry) throw new Error("Unknown Pal model provider.");
+  await ensureRegistered(primary.id);
+  const model = primary.model ?? entry.defaultModel;
+  let current = findDetected(detected, primary.id);
+  const refresh = createCurrentCredentialReader();
+  let provider = constructProvider(primary.id, current, model, {
+    sessionId: scope.sessionId
+  });
+  let admission;
+  let conversationAdmission;
+  let identity = {
+    name: binding.definition.name,
+    appearance: binding.definition.appearance
+  };
+  let writer;
+  let borrowedWriter;
+  let closed = false;
+  let cleaned = false;
+  let closing;
+  let activeAbort;
+  let settleSend;
+  let sendSettled = Promise.resolve();
+  const assertActive = /* @__PURE__ */ __name(() => {
+    if (closed || !conversationAdmission && !admission)
+      throw new Error("This Pal does not own an active conversation admission.");
+    if (conversationAdmission) conversationAdmission.assertActive();
+    else admission?.assertActive();
+    if (conversationAdmission && admission) admission.assertActive();
+  }, "assertActive");
+  const assertComputerActive = /* @__PURE__ */ __name(() => {
+    assertActive();
+    if (!admission) throw new Error("This Pal turn has no computer authority.");
+    admission.assertActive();
+  }, "assertComputerActive");
+  const releaseAdmission = /* @__PURE__ */ __name(async (workFailure) => {
+    try {
+      if (conversationAdmission) await conversationAdmission.release();
+      else await admission?.release();
+      admission = void 0;
+      conversationAdmission = void 0;
+    } catch (error) {
+      if (workFailure !== void 0)
+        throw new AggregateError([workFailure, error], "Pal work and admission cleanup failed.");
+      throw error;
+    }
+  }, "releaseAdmission");
+  let sandboxProvider;
+  let tools = [];
+  let sets = [];
+  let guestMcp = {
+    toolsets: [],
+    connected: [],
+    failed: []
+  };
+  let manager = new ToolManager({ toolsets: sets, messages: /* @__PURE__ */ __name(() => [], "messages") });
+  let selectedTaskStore;
+  let taskPresentationTurn;
+  let taskPresentationTools = [];
+  const taskToolOverrides = {
+    task_create: options.toolLoading === "deferred" ? "deferred" : "active",
+    task_update: options.toolLoading === "deferred" ? "deferred" : "active",
+    task_list: options.toolLoading === "deferred" ? "deferred" : "active"
+  };
+  const presenter = createToolPresenter({
+    get: /* @__PURE__ */ __name((name) => {
+      manager.refresh();
+      return manager.get(name) ?? taskPresentationTools.find((tool) => tool.name === name);
+    }, "get")
+  });
+  const observeSessionEvent = /* @__PURE__ */ __name((event) => {
+    if (selectedTaskStore && event.sessionId === scope.sessionId && event.turnId !== void 0 && event.turnId !== taskPresentationTurn) {
+      taskPresentationTools = buildTaskTools(selectedTaskStore, {
+        sessionId: event.sessionId,
+        turnId: event.turnId
+      });
+      taskPresentationTurn = event.turnId;
+    }
+    options.onSessionEvent?.(event);
+  }, "observeSessionEvent");
+  const messaging = createCliPalMessagingContext(binding.definition, scope, assertActive);
+  let assertExecutionAllowed;
+  let activePermissionMode;
+  let referenceAttachments = [];
+  const closeGuestMcp = /* @__PURE__ */ __name(async () => {
+    const failures = [];
+    for (const source of guestMcp.toolsets) {
+      try {
+        await source.close?.();
+      } catch (error) {
+        failures.push(error);
+      }
+    }
+    if (failures.length)
+      throw new AggregateError(failures, "Pal application server cleanup was not confirmed.");
+  }, "closeGuestMcp");
+  const configureComputer = /* @__PURE__ */ __name(async (lease) => {
+    await manager.dispose();
+    await closeGuestMcp();
+    tools = [];
+    sets = [];
+    guestMcp = { toolsets: [], connected: [], failed: [] };
+    sandboxProvider = void 0;
+    if (lease) {
+      const guest = guardHost(
+        lease.sandbox,
+        assertComputerActive,
+        true,
+        () => admission?.lease.sandbox ?? lease.sandbox,
+        async () => {
+          await renewWriter();
+          await assertExecutionAllowed?.();
+        }
+      );
+      const computer = guardHost(
+        lease.computerUseHost,
+        assertComputerActive,
+        false,
+        () => admission?.lease.computerUseHost ?? lease.computerUseHost,
+        async () => {
+          await renewWriter();
+          await assertExecutionAllowed?.();
+        }
+      );
+      sandboxProvider = {
+        id: `pal:${binding.definition.id}`,
+        name: "Pal virtual computer",
+        environment: guest.environment,
+        workspaceModes: ["working-directory"],
+        create: /* @__PURE__ */ __name(async () => {
+          assertComputerActive();
+          return guest;
+        }, "create")
+      };
+      const allTools = getBuiltinTools();
+      const computerTool = createComputerUseTool(computer, {
+        unavailableReason: computerUseUnavailableReason(provider)
+      });
+      tools = [
+        ...allTools,
+        createViewImageTool({
+          unavailableReason: computerUseUnavailableReason(provider)
+        }),
+        ...messaging.tools,
+        createPalReferenceImageTool({
+          attachments: /* @__PURE__ */ __name(() => referenceAttachments, "attachments"),
+          assertCurrentAdmission: /* @__PURE__ */ __name(async () => {
+            assertComputerActive();
+            await renewWriter();
+            await assertExecutionAllowed?.();
+            assertComputerActive();
+            if (activePermissionMode?.() === "plan") throw new Error(PLAN_MODE_REFUSAL);
+          }, "assertCurrentAdmission")
+        }),
+        computerTool,
+        ...lease.browserHost ? createBrowserTools(
+          guardHost(lease.browserHost, assertComputerActive, false, () => {
+            const browser = admission?.lease.browserHost ?? lease.browserHost;
+            if (!browser)
+              throw new Error("This Pal computer does not support browser operations.");
+            return browser;
+          })
+        ) : []
+      ];
+      const guardTool = /* @__PURE__ */ __name((tool) => ({
+        ...tool,
+        async execute(input, context) {
+          assertComputerActive();
+          manager.refresh();
+          await renewWriter();
+          await assertExecutionAllowed?.();
+          assertComputerActive();
+          if (activePermissionMode?.() === "plan" && !reviewExemptionFor("plan", manager, () => false)(tool.name, input))
+            throw new Error(PLAN_MODE_REFUSAL);
+          return tool.execute(input, context);
+        }
+      }), "guardTool");
+      sets = [toolset("pal-computer", tools.map(guardTool))];
+      if (admission) {
+        const pinned = {
+          environmentId: lease.environmentId,
+          generation: lease.generation
+        };
+        guestMcp = await connectPalGuestMcp(
+          lease,
+          async () => {
+            assertComputerActive();
+            await renewWriter();
+            await assertExecutionAllowed?.();
+            assertComputerActive();
+            if (admission?.lease.environmentId !== pinned.environmentId || admission?.lease.generation !== pinned.generation)
+              throw new Error("This guest MCP server belongs to another Pal computer lifetime.");
+          },
+          activeAbort?.signal
+        );
+        sets.push(
+          ...guestMcp.toolsets.map((source) => ({
+            ...source,
+            tools: /* @__PURE__ */ __name(() => source.tools().map(guardTool), "tools")
+          }))
+        );
+      }
+    }
+    manager = new ToolManager({ toolsets: sets, messages: /* @__PURE__ */ __name(() => [], "messages") });
+  }, "configureComputer");
+  await configureComputer(binding.readyComputer?.() ?? binding.lease);
+  const jobs = new BackgroundJobRegistry();
+  const ownedJobs = bindOwner(jobs, scope.sessionId);
+  const approval = { all: false };
+  const permissionReader = /* @__PURE__ */ __name((opts) => {
+    const read = opts?.currentPermissionMode;
+    const fallback = opts?.permissionMode ?? options.permissionMode ?? // Supplying a review UI does not opt an owned guest into prompting.
+    // Explicit modes and a durable review hold still narrow this default.
+    (opts?.reviewHold ? "prompt" : "auto");
+    return () => read?.() ?? fallback;
+  }, "permissionReader");
+  const beginWork = /* @__PURE__ */ __name((signal, guard, mode) => {
+    if (closed) throw new Error("This Pal conversation is closed.");
+    if (activeAbort) throw new Error("This Pal conversation already has active work.");
+    if (admission || conversationAdmission || writer)
+      throw new Error("This Pal admission needs cleanup before further work.");
+    if (options.scope?.sessionId !== scope.sessionId)
+      throw new Error("Reopen this Pal conversation after switching its session.");
+    const controller = new AbortController();
+    const onAbort = /* @__PURE__ */ __name(() => controller.abort(signal?.reason), "onAbort");
+    signal?.addEventListener("abort", onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+    activeAbort = controller;
+    selectedTaskStore = void 0;
+    taskPresentationTurn = void 0;
+    taskPresentationTools = [];
+    referenceAttachments = [];
+    assertExecutionAllowed = guard;
+    activePermissionMode = mode;
+    sendSettled = new Promise((done) => {
+      settleSend = done;
+    });
+    return { controller, signal, onAbort };
+  }, "beginWork");
+  const releaseWriter = /* @__PURE__ */ __name(async () => {
+    if (!writer) return;
+    writer.closing = true;
+    if (writer.heartbeat) {
+      clearInterval(writer.heartbeat);
+      writer.heartbeat = void 0;
+    }
+    await writer.renewing?.catch(() => void 0);
+    await writer.log.release(writer.lease);
+    writer = void 0;
+  }, "releaseWriter");
+  const renewWriter = /* @__PURE__ */ __name(async () => {
+    if (borrowedWriter) {
+      const current2 = await borrowedWriter.log.lease();
+      if (!current2 || current2.fence !== borrowedWriter.lease.fence || current2.holder !== borrowedWriter.lease.holder || current2.expiresAt <= Date.now())
+        throw new Error("This Pal resume lost its borrowed session writer lease.");
+      return;
+    }
+    const owned = writer;
+    if (!owned) return;
+    if (owned.closing) throw new Error("This Pal resume writer is closing.");
+    if (owned.renewing) return owned.renewing;
+    const renewal = (async () => {
+      const renewed = await owned.log.claim({
+        holder: owned.lease.holder,
+        ttlMs: 9e4,
+        repairTornTail: false
+      });
+      if (!renewed || renewed.fence !== owned.lease.fence)
+        throw new Error("This Pal resume lost its session writer lease.");
+      owned.lease = renewed;
+    })();
+    owned.renewing = renewal;
+    try {
+      await renewal;
+    } finally {
+      if (owned.renewing === renewal) owned.renewing = void 0;
+    }
+  }, "renewWriter");
+  const finishWork = /* @__PURE__ */ __name(async (work, failure) => {
+    try {
+      const failures = [];
+      try {
+        await releaseWriter();
+      } catch (error) {
+        failures.push(error);
+      }
+      try {
+        await releaseAdmission();
+      } catch (error) {
+        failures.push(error);
+      }
+      if (failures.length)
+        throw failures.length === 1 && failure === void 0 ? failures[0] : new AggregateError(
+          [...failure === void 0 ? [] : [failure], ...failures],
+          "Pal work cleanup was not confirmed."
+        );
+    } finally {
+      work.signal?.removeEventListener("abort", work.onAbort);
+      activeAbort = void 0;
+      assertExecutionAllowed = void 0;
+      activePermissionMode = void 0;
+      referenceAttachments = [];
+      borrowedWriter = void 0;
+      settleSend?.();
+      settleSend = void 0;
+    }
+  }, "finishWork");
+  const assertOwnedConversation = /* @__PURE__ */ __name(async () => {
+    const owner = await palConversationBinding(binding.definition.workspace, scope.sessionId);
+    if (!owner || owner.definition.id !== binding.definition.id || owner.definition.revision !== binding.definition.revision || owner.definition.workspace !== binding.definition.workspace)
+      throw new Error("This Pal does not own the pinned conversation revision.");
+    identity = { name: owner.pal.name, appearance: owner.pal.appearance };
+  }, "assertOwnedConversation");
+  const prepareProvider = /* @__PURE__ */ __name(async (controller) => {
+    if (current?.entry.id === "codex" && current.codex?.origin === "stored") {
+      const credential = await ensureFreshStoredCodexCredential(controller.signal);
+      current = {
+        ...current,
+        apiKey: credential.accessToken,
+        codex: {
+          ...current.codex,
+          accountId: credential.accountId,
+          expiresAt: credential.expiresAt
+        }
+      };
+    } else if (current?.entry.id === "codex" && current.source.kind === "codex-file") {
+      const credential = readCodexCredentialFile(current.source.path);
+      if (!credential || credential.expiresAt !== void 0 && credential.expiresAt <= Date.now())
+        throw new Error(
+          "The Codex credential is unavailable or expired; refresh it with its owner."
+        );
+      current = {
+        ...current,
+        apiKey: credential.accessToken,
+        codex: {
+          ...current.codex,
+          accountId: credential.accountId,
+          expiresAt: credential.expiresAt,
+          origin: "codex-file"
+        }
+      };
+    } else current = await refresh(current, controller.signal);
+    provider = guardProvider(
+      constructProvider(primary.id, current, model, {
+        sessionId: scope.sessionId
+      }),
+      assertActive,
+      async () => {
+        await renewWriter();
+        await assertExecutionAllowed?.();
+      }
+    );
+  }, "prepareProvider");
+  const enterConversation = /* @__PURE__ */ __name(async (controller, requireComputer = false) => {
+    controller.signal.throwIfAborted();
+    await assertExecutionAllowed?.();
+    controller.signal.throwIfAborted();
+    await assertOwnedConversation();
+    if (binding.admitConversation) {
+      conversationAdmission = await binding.admitConversation(controller.signal);
+      assertActive();
+      const ready = binding.readyComputer?.();
+      if (requireComputer || ready) {
+        admission = await conversationAdmission.acquireComputer();
+        if (ready && (admission.lease.environmentId !== ready.environmentId || admission.lease.generation !== ready.generation))
+          throw new Error("This Pal computer changed before its turn was admitted.");
+      }
+    } else admission = await binding.admit(controller.signal);
+    assertActive();
+    await configureComputer(admission?.lease);
+    await prepareProvider(controller);
+  }, "enterConversation");
+  const queryOptions = /* @__PURE__ */ __name((opts) => {
+    const taskStore = admission ? new DiskTaskStore({
+      paths: conversations.paths,
+      session: { sessionId: scope.sessionId },
+      tenantId: scope.tenantId
+    }) : void 0;
+    selectedTaskStore = taskStore;
+    const read = activePermissionMode ?? permissionReader(opts);
+    const modeControl = createLiveModeControl({
+      initial: read(),
+      read,
+      handlerFor: /* @__PURE__ */ __name((mode) => {
+        const exempt = reviewExemptionFor(mode, manager, () => false);
+        return opts?.reviewHold ? makeHoldingResumeHandler(mode, exempt, {}, opts.reviewHold.reason) : makeResumeHandler(approval, opts?.onPermission, mode, exempt);
+      }, "handlerFor")
+    });
+    return {
+      provider,
+      paths: conversations.paths,
+      ...scope,
+      agentId: `pal:${binding.definition.id}`,
+      agentName: identity.name,
+      ...admission ? { workingDirectory: admission.lease.sandbox.rootDir, sandboxProvider } : {},
+      sandboxEscape: "refuse",
+      outsideRootAccess: "refuse",
+      toolsets: sets,
+      ...taskStore ? {
+        taskStore,
+        runtimeToolOverrides: taskToolOverrides,
+        prepareStep: [createTaskContextStep(taskStore, scope.tenantId)]
+      } : {},
+      systemPrompt: [
+        buildPalSystemPrompt(
+          { ...binding.definition, ...identity },
+          {
+            greeting: palConversationGreeting(binding.definition, scope.sessionId),
+            computer: admission ? {
+              status: "ready",
+              workingDirectory: admission.lease.sandbox.rootDir
+            } : binding.observeComputer?.() ?? { status: "unavailable" },
+            ...opts?.systemNote ? { systemNote: opts.systemNote } : {}
+          }
+        ),
+        taskStore ? "For genuinely multi-step work, use task_create to track meaningful steps and task_update as their progress changes; use task_list to inspect the plan. These are agent-maintained planning records, not evidence that work succeeded and not delegated agents. Do not create a task list for ordinary chat or a simple single-step request. Mark work complete only when the requested result has been verified." : void 0
+      ].filter(Boolean).join("\n\n"),
+      beforeStep: /* @__PURE__ */ __name(async () => {
+        assertActive();
+        await renewWriter();
+        await assertExecutionAllowed?.();
+        assertActive();
+        return void 0;
+      }, "beforeStep"),
+      authorizationGate: {
+        enabled: true,
+        allowReadOnlyTools: true,
+        denyDangerousPatterns: true,
+        logDecisions: false,
+        rules: [...opts?.rules ?? options.rules ?? []]
+      },
+      resumeHandler: modeControl.handler,
+      approvalPolicyName: modeControl.initialName,
+      onApprovalPolicy: /* @__PURE__ */ __name((box) => modeControl.attach(box), "onApprovalPolicy"),
+      reviewAllowedCalls: modeControl.reviewAllowedCalls,
+      backgroundJobs: jobs,
+      backgroundJobOwner: scope.sessionId
+    };
+  }, "queryOptions");
+  const kernelResume = /* @__PURE__ */ __name(async (input) => {
+    const params = {
+      ...input,
+      entry: { ...input.entry },
+      ...input.pendingDecision ? { pendingDecision: structuredClone(input.pendingDecision) } : {},
+      ...input.model ? { model: { ...input.model } } : {}
+    };
+    const work = beginWork(params.signal, params.assertExecutionAllowed, permissionReader(params));
+    let failure;
+    try {
+      const expected = DiskSessionLog.at(conversations.paths, {
+        sessionId: scope.sessionId
+      });
+      if (params.entry.sessionId !== scope.sessionId || params.entry.tenantId !== scope.tenantId || params.entry.projectId !== scope.projectId || !(params.sessionLog instanceof DiskSessionLog) || params.sessionLog.file !== expected.file || params.sessionLog.sessionDir !== expected.sessionDir)
+        throw new Error("A Pal can resume only its own original conversation journal.");
+      const turnId = asTurnId(params.entry.turnId);
+      const checkpointId = params.checkpointId === void 0 ? void 0 : asCheckpointId(params.checkpointId);
+      if (params.model && (params.model.provider !== primary.id || (params.model.model ?? model) !== model))
+        throw new Error("A Pal resume must retain its pinned model provider and model.");
+      await assertExecutionAllowed?.();
+      work.controller.signal.throwIfAborted();
+      await assertOwnedConversation();
+      const waiting = await readPalWaitingReview(params.sessionLog, turnId, checkpointId);
+      if (params.pendingDecision) {
+        if (!waiting) throw new Error("This Pal decision is no longer waiting.");
+        assertPalReviewDecision(waiting.request, params.pendingDecision);
+      }
+      const limits = await readStoredTurnGuards(params.sessionLog, turnId);
+      if (!limits) throw new Error("This Pal turn has no original recorded limits.");
+      for await (const { record } of params.sessionLog.read({
+        mode: "strict"
+      })) {
+        if (record.type === "turn_started" && record.turnId === turnId && record.config.model !== model)
+          throw new Error("This Pal turn used another model.");
+        if (record.type === "message" && record.turnId === turnId && record.content.role === "user" && !record.content.source)
+          referenceAttachments = structuredClone(record.content.attachments ?? []);
+      }
+      const effort = params.model?.effort;
+      if (effort !== void 0 && !["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra"].includes(effort))
+        throw new Error("Invalid Pal resume reasoning effort.");
+      if (params.lease) {
+        borrowedWriter = { log: params.sessionLog, lease: { ...params.lease } };
+        await renewWriter();
+      } else {
+        const lease = await params.sessionLog.claim({
+          holder: `pal-resume:${randomUUID()}`,
+          ttlMs: 9e4,
+          repairTornTail: false
+        });
+        if (!lease) throw new Error("This Pal turn is leased by another writer.");
+        writer = { log: params.sessionLog, lease };
+        writer.heartbeat = setInterval(() => {
+          void renewWriter().catch((error) => work.controller.abort(error));
+        }, 3e4);
+        writer.heartbeat.unref();
+      }
+      const lockedWaiting = await readPalWaitingReview(params.sessionLog, turnId, checkpointId);
+      if (params.pendingDecision) {
+        if (!lockedWaiting || lockedWaiting.decisionId !== waiting?.decisionId || lockedWaiting.requestRecord.sha256 !== waiting.requestRecord.sha256)
+          throw new Error("This Pal decision changed before its writer was admitted.");
+        assertPalReviewDecision(lockedWaiting.request, params.pendingDecision);
+      }
+      await enterConversation(work.controller, true);
+      return await resumeSession({
+        ...queryOptions(params),
+        scope: { ...scope, turnId },
+        sessionLog: params.sessionLog,
+        ...params.checkpointStore ? { checkpointStore: params.checkpointStore } : {},
+        lease: params.lease ?? writer?.lease,
+        ...checkpointId ? { checkpointId } : {},
+        ...params.pendingDecision ? { pendingDecision: params.pendingDecision } : {},
+        turnConfig: {
+          model,
+          ...limits,
+          sandbox: { workspace: "working-directory" },
+          permissionMode: "auto",
+          ...effort ? { effort } : {}
+        },
+        listener: /* @__PURE__ */ __name((event) => {
+          observeSessionEvent(event);
+          params.listener?.(event);
+        }, "listener"),
+        signal: work.controller.signal
+      });
+    } catch (error) {
+      failure = error;
+      throw error;
+    } finally {
+      await finishWork(work, failure);
+    }
+  }, "kernelResume");
+  const resumePaused = /* @__PURE__ */ __name(async function* (params) {
+    const turnId = asTurnId(params.turnId);
+    const controller = new AbortController();
+    const onAbort = /* @__PURE__ */ __name(() => controller.abort(params.signal?.reason), "onAbort");
+    params.signal?.addEventListener("abort", onAbort, { once: true });
+    if (params.signal?.aborted) onAbort();
+    const queue = [];
+    let wake;
+    let settled = false;
+    let failure;
+    const completion = kernelResume({
+      ...params,
+      signal: controller.signal,
+      entry: {
+        tenantId: scope.tenantId,
+        projectId: scope.projectId,
+        sessionId: scope.sessionId,
+        turnId
+      },
+      sessionLog: DiskSessionLog.at(conversations.paths, {
+        sessionId: scope.sessionId
+      }),
+      listener: /* @__PURE__ */ __name((event) => {
+        queue.push(event);
+        wake?.();
+      }, "listener")
+    }).then((result) => {
+      if (!result.resumed)
+        throw new Error(
+          result.reason === "awaiting-decision" ? "This Pal turn is parked on a decision only a person can answer." : "This Pal turn has no recorded checkpoint."
+        );
+    }).catch((error) => {
+      failure = error;
+    }).finally(() => {
+      settled = true;
+      wake?.();
+    });
+    try {
+      for (; ; ) {
+        while (queue.length) {
+          const event = queue.shift();
+          if (!event) break;
+          const mapped = toAgentEvent(event, presenter);
+          if (mapped) yield mapped;
+        }
+        if (settled) break;
+        await new Promise((resolve) => {
+          wake = resolve;
+        });
+        wake = void 0;
+      }
+      await completion;
+      if (failure) throw failure;
+    } finally {
+      controller.abort(new Error("Pal resume event stream closed."));
+      params.signal?.removeEventListener("abort", onAbort);
+      await completion;
+    }
+  }, "resumePaused");
+  return {
+    hasProvider: true,
+    errorHint: null,
+    errorKind: null,
+    providerSummary: entry.label,
+    modelSummary: model,
+    imageAttachmentsSupported: provider.capabilities?.supportsVision,
+    documentAttachmentsSupported: provider.capabilities?.supportsDocuments,
+    reasoningEffortLevels: provider.reasoningEffortLevelsFor?.(model),
+    reasoningEffortDefault: provider.reasoningEffortDefaultFor?.(model),
+    get sandbox() {
+      return sandboxProvider ? {
+        unconfined: false,
+        environment: sandboxProvider.environment,
+        enforced: ["filesystem", "process"],
+        required: ["filesystem", "process"],
+        workspace: "working-directory"
+      } : { unconfined: false, enforced: [], required: [] };
+    },
+    toolNames: /* @__PURE__ */ __name(() => {
+      manager.refresh();
+      return [...manager.listNames(), ...selectedTaskStore ? Object.keys(taskToolOverrides) : []];
+    }, "toolNames"),
+    currentTaskStore: /* @__PURE__ */ __name(() => closed ? void 0 : selectedTaskStore, "currentTaskStore"),
+    resetTaskStore: /* @__PURE__ */ __name(() => {
+      selectedTaskStore = void 0;
+      taskPresentationTurn = void 0;
+      taskPresentationTools = [];
+    }, "resetTaskStore"),
+    presenter,
+    agentIds: [],
+    instructionFiles: [],
+    skippedInstructionFiles: [],
+    get mcpConnected() {
+      return guestMcp.connected;
+    },
+    get mcpFailed() {
+      return guestMcp.failed;
+    },
+    configNotices: [
+      "Pal tools run in its local virtual computer. Host plugins, MCP servers, browser accounts and filesystem are not inherited."
+    ],
+    approvalLatched: /* @__PURE__ */ __name(() => approval.all, "approvalLatched"),
+    resetApprovalLatch: /* @__PURE__ */ __name(() => {
+      approval.all = false;
+    }, "resetApprovalLatch"),
+    promptExemptTools: /* @__PURE__ */ __name(() => [], "promptExemptTools"),
+    jobs: /* @__PURE__ */ __name(() => jobs.list(scope.sessionId), "jobs"),
+    readJob: /* @__PURE__ */ __name((id, fromOffset) => ownedJobs.read(id, { fromOffset }), "readJob"),
+    stopJob: /* @__PURE__ */ __name((id) => ownedJobs.kill(id), "stopJob"),
+    onJobExit: /* @__PURE__ */ __name((listener) => jobs.onExit((job) => {
+      if (job.owner === scope.sessionId) listener(job);
+    }), "onJobExit"),
+    compact: /* @__PURE__ */ __name(async () => {
+      throw new Error("Manual compaction is not available in a Pal conversation yet.");
+    }, "compact"),
+    resumeDurable: kernelResume,
+    resumePaused,
+    // A Pal's paused turn is closed the way any conversation's is: one append to the
+    // conversation's own log, which needs no computer and runs nothing. Without it the host
+    // could not offer "Continue without this reply" in a Pal.
+    abandonTurn: /* @__PURE__ */ __name(async (turnId, reason, abandonOptions) => {
+      if (closed) throw new Error("This Pal conversation is closed.");
+      await assertOwnedConversation();
+      await abandonTurn(scope.sessionId, turnId, reason, {
+        log: DiskSessionLog.at(conversations.paths, { sessionId: scope.sessionId }),
+        index: conversations.index,
+        ...abandonOptions?.withdrawMessages ? { withdrawMessages: true } : {}
+      });
+    }, "abandonTurn"),
+    send: /* @__PURE__ */ __name(async function* (messages, opts) {
+      const work = beginWork(opts?.signal, opts?.assertExecutionAllowed, permissionReader(opts));
+      const { controller } = work;
+      let sendFailure;
+      try {
+        for (let index = messages.length - 1; index >= 0; index--) {
+          const message = messages[index];
+          if (!message || message.role === "assistant" || message.role === "tool") break;
+          if (message.role === "user" && !message.source && !message.id) {
+            referenceAttachments = structuredClone(message.attachments ?? []);
+            break;
+          }
+        }
+        await enterConversation(controller);
+        const events = query({
+          ...queryOptions(opts),
+          sessionLog: DiskSessionLog.at(conversations.paths, {
+            sessionId: scope.sessionId
+          }),
+          messages: [...messages],
+          ...opts?.turnId ? { turnId: opts.turnId } : {},
+          ...opts?.origin ? { origin: opts.origin } : {},
+          turnConfig: {
+            model,
+            ...resolveTurnGuards(options.limits, opts?.limits),
+            ...admission ? { sandbox: { workspace: "working-directory" } } : {},
+            permissionMode: "auto",
+            ...opts?.effort ? { effort: opts.effort } : {}
+          },
+          backgroundJobs: jobs,
+          backgroundJobOwner: scope.sessionId,
+          durableInbound: opts?.durableInbound ?? messaging.durableInbound,
+          ...opts?.inboundMessages ? { inboundMessages: opts.inboundMessages } : {},
+          ...opts?.waitForInbound ? { waitForInbound: opts.waitForInbound } : {},
+          ...opts?.abandonInterrupted ? { abandonInterrupted: true } : {},
+          signal: controller.signal
+        });
+        try {
+          while (true) {
+            const next = await events.next();
+            if (next.done) {
+              opts?.onConversationMessages?.(projectTurnConversation(next.value.messages));
+              break;
+            }
+            observeSessionEvent(next.value);
+            const mapped = toAgentEvent(next.value, presenter);
+            if (mapped) yield mapped;
+          }
+        } finally {
+          await events.return(void 0);
+        }
+      } catch (error) {
+        sendFailure = error;
+        throw error;
+      } finally {
+        await finishWork(work, sendFailure);
+      }
+    }, "send"),
+    close: /* @__PURE__ */ __name(async () => {
+      if (cleaned) return;
+      if (closing) return closing;
+      closed = true;
+      activeAbort?.abort(new Error("Pal conversation closed."));
+      const cleanup = (async () => {
+        await sendSettled;
+        await releaseWriter();
+        await releaseAdmission();
+        await jobs.killOwner(scope.sessionId);
+        await manager.dispose();
+        await closeGuestMcp();
+        cleaned = true;
+      })();
+      closing = cleanup;
+      try {
+        await cleanup;
+      } finally {
+        if (closing === cleanup) closing = void 0;
+      }
+    }, "close")
+  };
+}
+__name(createPalAgentSession, "createPalAgentSession");
+
+export {
+  palSessionEnvironment,
+  createPalAgentSession
+};
+//# sourceMappingURL=chunk-UDDSFIMB.js.map