@noesis-brain/mcp-server 2.1.3 → 2.3.1

package/dist/agent/identity.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Which machine, and which process, a daemon is — sent with every claim.
+ *
+ * A user may run the agent on several computers. The server keeps one health record
+ * per machine (online? over its Claude limit? logged out?) so a healthy Mac can take
+ * the jobs a blocked Windows box should not, and so the right machine's status shows
+ * in Settings. Older daemons sent nothing that identifies the machine, so the server
+ * fell back to the API token — two machines sharing one token looked like one.
+ *
+ *  - daemonId: stable across restarts. Read from (or created in) `<run dir>/daemon-id`;
+ *    `NOESIS_AGENT_ID` overrides it (tests, or several daemons deliberately run apart).
+ *  - bootId: new for every process, so the server can tell a restart (which clears a
+ *    stale block) from two processes running on the same machine.
+ *  - label / platform: shown to the user to tell machines apart.
+ */
+export interface DaemonIdentity {
+    daemonId: string;
+    bootId: string;
+    label: string;
+    platform: string;
+}
+type Env = Record<string, string | undefined>;
+/** Where the daemon keeps its state — the same directory scripts/start-agent.sh runs it in. */
+export declare function agentRunDir(env?: Env): string;
+/**
+ * The stable machine id. If the file can be neither read nor written, a hash of
+ * machine facts keeps restarts agreeing with each other instead of minting a new
+ * "machine" every time.
+ */
+export declare function resolveDaemonId(env?: Env): string;
+export declare function resolveIdentity(env?: Env): DaemonIdentity;
+export {};
+//# sourceMappingURL=identity.d.ts.map

package/dist/agent/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../../src/agent/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAOH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAQ9C,+FAA+F;AAC/F,wBAAgB,WAAW,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAE1D;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,GAAE,GAAiB,GAAG,MAAM,CAoB9D;AAED,wBAAgB,eAAe,CAAC,GAAG,GAAE,GAAiB,GAAG,cAAc,CAGtE"}

package/dist/agent/identity.js

@@ -0,0 +1,61 @@
+/**
+ * Which machine, and which process, a daemon is — sent with every claim.
+ *
+ * A user may run the agent on several computers. The server keeps one health record
+ * per machine (online? over its Claude limit? logged out?) so a healthy Mac can take
+ * the jobs a blocked Windows box should not, and so the right machine's status shows
+ * in Settings. Older daemons sent nothing that identifies the machine, so the server
+ * fell back to the API token — two machines sharing one token looked like one.
+ *
+ *  - daemonId: stable across restarts. Read from (or created in) `<run dir>/daemon-id`;
+ *    `NOESIS_AGENT_ID` overrides it (tests, or several daemons deliberately run apart).
+ *  - bootId: new for every process, so the server can tell a restart (which clears a
+ *    stale block) from two processes running on the same machine.
+ *  - label / platform: shown to the user to tell machines apart.
+ */
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir, hostname, platform } from 'node:os';
+import { join } from 'node:path';
+const ID_PATTERN = /^[A-Za-z0-9._:-]{1,80}$/;
+function validId(v) {
+    return !!v && ID_PATTERN.test(v) && !/^legacy:/i.test(v);
+}
+/** Where the daemon keeps its state — the same directory scripts/start-agent.sh runs it in. */
+export function agentRunDir(env = process.env) {
+    return env.NOESIS_AGENT_RUN_DIR || join(homedir(), '.noesis-agent');
+}
+/**
+ * The stable machine id. If the file can be neither read nor written, a hash of
+ * machine facts keeps restarts agreeing with each other instead of minting a new
+ * "machine" every time.
+ */
+export function resolveDaemonId(env = process.env) {
+    const override = env.NOESIS_AGENT_ID?.trim();
+    if (validId(override))
+        return override;
+    const dir = agentRunDir(env);
+    const file = join(dir, 'daemon-id');
+    try {
+        const existing = readFileSync(file, 'utf8').trim();
+        if (validId(existing))
+            return existing;
+    }
+    catch {
+        /* not created yet */
+    }
+    const id = randomUUID();
+    try {
+        mkdirSync(dir, { recursive: true });
+        writeFileSync(file, `${id}\n`, { mode: 0o600 });
+        return id;
+    }
+    catch {
+        return `h-${createHash('sha256').update(`${hostname()}|${platform()}|${homedir()}`).digest('hex').slice(0, 32)}`;
+    }
+}
+export function resolveIdentity(env = process.env) {
+    const label = (env.NOESIS_AGENT_LABEL?.trim() || hostname() || 'agent').slice(0, 80);
+    return { daemonId: resolveDaemonId(env), bootId: randomUUID(), label, platform: platform() };
+}
+//# sourceMappingURL=identity.js.map

package/dist/agent/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","sourceRoot":"","sources":["../../src/agent/identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAWjC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,SAAS,OAAO,CAAC,CAAqB;IACpC,OAAO,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,WAAW,CAAC,MAAW,OAAO,CAAC,GAAG;IAChD,OAAO,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,eAAe,CAAC,CAAC;AACtE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAAW,OAAO,CAAC,GAAG;IACpD,MAAM,QAAQ,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;IAC7C,IAAI,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAEvC,MAAM,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,IAAI,CAAC;QACH,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpC,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,QAAQ,EAAE,IAAI,QAAQ,EAAE,IAAI,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACnH,CAAC;AACH,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAW,OAAO,CAAC,GAAG;IACpD,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,IAAI,EAAE,IAAI,QAAQ,EAAE,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,QAAQ,EAAE,eAAe,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC;AAC/F,CAAC"}

package/dist/agent/runner.d.ts

@@ -13,15 +13,47 @@
  * FOOTGUN GUARD: if ANTHROPIC_API_KEY is set, the Agent SDK bills the metered API
  * instead of the subscription — so we delete it (and warn) before any query().
  */
+import { type UrlVerdict } from './webGuard.js';
+import { type DaemonIdentity } from './identity.js';
+import { TokenGate } from './tokenState.js';
+/**
+ * NOESIS_AGENT_FAKE: '1' (or 'canned') answers every job with canned text; 'rate_limit'
+ * and 'auth' replay what the Claude Agent SDK emits on a subscription usage limit / a
+ * revoked login, through the SAME stream handling as a real run, until
+ * NOESIS_AGENT_FAKE_RESET_MIN minutes after start — then they answer like 'canned'.
+ * For testing the server's fallback and recovery without spending real quota.
+ */
+export type FakeMode = 'canned' | 'rate_limit' | 'auth';
 export interface AgentConfig {
     apiBaseUrl: string;
     apiToken: string;
     concurrency: number;
     fake: boolean;
+    fakeMode?: FakeMode;
+    fakeResetAt?: number;
+    fakeWordMs?: number;
 }
 export declare function resolveAgentConfig(): AgentConfig;
+interface ClaimedJob {
+    jobId: string;
+    kind: string;
+    payload: JobPayload;
+    lease: string;
+}
+interface JobPayload {
+    prompt?: string;
+    system?: string;
+    allowedTools?: string[];
+    maxTurns?: number;
+    images?: Array<{
+        mimeType: string;
+        data: string;
+    }>;
+}
 /** Drop anything the server asked for that is not on the read-only allowlist. */
 export declare function clampAllowedTools(raw: unknown): string[];
+/** The web built-ins this job asked for, in a fixed order. Nothing else can come out. */
+export declare function clampWebTools(raw: unknown): string[];
 /** Clamp the server-requested turn budget into a sane range. */
 export declare function clampMaxTurns(raw: unknown): number;
 /**
@@ -30,6 +62,19 @@ export declare function clampMaxTurns(raw: unknown): number;
  * package.json rather than hard-coded, so a release cannot forget to bump it.
  */
 export declare function agentVersion(): string;
+/**
+ * What every claim sends. The server keeps one health record per machine (daemonId), tells
+ * a restart from a second process by bootId, and shows label/platform in Settings. Older
+ * servers read only workerId + agentVersion and ignore the rest.
+ */
+export declare function claimBody(workerId: string, id: DaemonIdentity): Record<string, unknown>;
+/**
+ * Read a claim answer. A 401 means the server refused this daemon's API token (expired,
+ * revoked or unknown): the shared gate explains it once and the workers back off, instead
+ * of retrying silently every 2 s. Any accepted answer clears that state and feeds the
+ * token-expiry warning.
+ */
+export declare function handleClaimResponse(res: Response, gate: TokenGate): Promise<ClaimedJob | null>;
 /**
  * One Anthropic content block — a plain-text piece or a base64 image, the same
  * shape the SSE path's formatClaudeContent() already builds (main repo,
@@ -74,6 +119,155 @@ export declare function buildSdkPrompt(prompt: string, images: Array<{
     mimeType: string;
     data: string;
 }> | undefined): string | AsyncGenerator<unknown>;
+/** What the SDK expects back from a canUseTool decision. */
+type PermissionDecision = {
+    behavior: 'allow';
+    updatedInput: Record<string, unknown>;
+} | {
+    behavior: 'deny';
+    message: string;
+};
+/**
+ * SECOND, INDEPENDENT LAYER on the tool boundary.
+ *
+ * The `tools` option below (`[]`, or at most the two web tools) is the primary control, but
+ * it works by way of the CLI's `--tools` flag, whose handling lives in a minified `cli.js`
+ * we cannot audit. This callback is a
+ * gate we own outright: the SDK routes every permission request through it
+ * (`--permission-prompt-tool stdio`), and the request carries an `agentID`, so calls made
+ * by a spawned `Task` SUBAGENT are covered too — which matters, because a subagent, not
+ * the main loop, did the file reading in the 2026-08-14 incident.
+ *
+ * Deliberately fed from ALLOWED_TOOLS / ALLOWED_WEB_TOOLS (via the per-job clamps) so the
+ * daemon has ONE definition of what may run.
+ *
+ * DO NOT DELETE THIS AS DEAD CODE. It is the ONLY daemon-owned control over MCP tools.
+ * `tools: []` governs the SDK's BUILT-IN set and nothing else; the Noesis MCP server we
+ * spawn registers ~55 tools, and their definitions are not filtered by `allowedTools`, so
+ * the model can see and attempt every one of them — including `pull_notes`, which writes
+ * to an arbitrary local path, plus `add_root`, `sync_notes`, `trash_note`, `move_note`.
+ * For those, this callback is the whole boundary.
+ *
+ * MEASURED (30 runs, 2026-08-15), correcting an earlier comment that said the opposite:
+ * the gate DOES fire — it denied `mcp__noesis__list_roots` and `mcp__noesis__list_codebases`
+ * in real traffic, and the model received `is_error` results naming the refusal. An earlier
+ * 2-job sample saw zero firings and wrongly concluded the gate was inert; a permission tool
+ * is simply not consulted for calls that are already pre-approved, and that sample happened
+ * to exercise only pre-approved tools.
+ *
+ * KNOWN GAP, stated rather than glossed: the SDK's cache-warming sidechain
+ * (`isSidechain: true`) is a real model turn that emits genuine `Bash`/`Glob` calls against
+ * the daemon's cwd, with only the RESULT stubbed. `tools: []` does not reach it and this
+ * callback is never consulted there. Nothing executes — but that is Claude Code internal
+ * behaviour we neither own nor test, which is why the daemon is rooted at a neutral cwd
+ * (`scripts/start-agent.sh`), so the warmup probes an empty directory, not a source tree.
+ *
+ * WEB TOOLS: a permitted WebFetch is still refused unless its URL passes webGuard (public
+ * http(s) host only). The job's permitted set is checked FIRST, so a job never cleared
+ * for web cannot fetch even a public page. WebSearch needs no address check: the search
+ * runs on Anthropic's side, not from this machine. One exception the gate cannot see: the
+ * CLI itself pre-approves ~85 public documentation hosts for WebFetch and never asks. Those
+ * are public by definition, and executeJob logs every tool call from the stream anyway.
+ */
+export declare function buildCanUseTool(
+/**
+ * The tools permitted for THIS job — i.e. the output of `clampAllowedTools`, not the
+ * module-wide `ALLOWED_TOOLS`. Required, deliberately: an earlier version closed over
+ * `ALLOWED_TOOLS` and so turned a per-job clamp into a union. `clampAllowedTools`
+ * narrows to (what the server asked for ∩ ALLOWED_TOOLS); the gate then re-allowed all
+ * four regardless, so a job clamped to `get_note` could still execute `search_semantic`.
+ * The sets happen to coincide for chat today, which is exactly why it would have gone
+ * unnoticed until the first job kind with a narrower allowlist.
+ */
+permitted: Iterable<string>, onDecision?: (toolName: string, allowed: boolean, agentID?: string, detail?: string) => void, checkUrl?: (url: unknown) => Promise<UrlVerdict>): (toolName: string, input?: unknown, ctx?: {
+    agentID?: string;
+}) => Promise<PermissionDecision>;
+/**
+ * The `options` object handed to sdk.query() — extracted, like buildSdkPrompt above, so
+ * the tool boundary is asserted by a test instead of resting on a comment. `tools` is the
+ * security-relevant field: see the note at its assignment. Takes the MCP-server
+ * factory as an argument so a test can supply a stub instead of a real spawn config.
+ */
+export declare function buildQueryOptions(payload: JobPayload, mcpServersFor: () => Record<string, unknown>): Record<string, unknown>;
+/** The prompt text for a job, with the fallback used when a payload carries none. */
+export declare function resolveJobPrompt(payload: JobPayload, kindLabel: string): string;
+/** The minimum of the Agent SDK this daemon uses — enough for a test to substitute a fake. */
+export interface SdkLike {
+    query(args: {
+        prompt: unknown;
+        options: Record<string, unknown>;
+    }): AsyncIterable<unknown>;
+}
+/**
+ * The ONE place the SDK is invoked. Exported so a test can pass a fake `sdk` and assert
+ * what actually reaches `query()`.
+ *
+ * This exists because of a real gap: the suite pinned `buildQueryOptions` with a
+ * power-set mutation battery, but NOTHING pinned the call. Restoring the pre-fix inline
+ * options literal here — deleting `tools: []` and `canUseTool` outright — reverted the
+ * entire tool boundary with all 79 tests still green. The builder being correct is
+ * worthless if the caller stops using it, so both the seam below and the source-fitness
+ * test in `agentToolClamp.test.ts` guard this.
+ */
+export declare function runSdkQuery(sdk: SdkLike, payload: JobPayload, kindLabel: string, mcpServersFor: () => Record<string, unknown>): AsyncIterable<unknown>;
+/**
+ * Appended when the SDK stops a run at maxTurns. Without it the saved reply would be only
+ * the narration that came before the tool calls ("let me check the official page…"), with
+ * nothing saying the answer was cut off.
+ */
+export declare const TURN_LIMIT_NOTE = "\n\n_(Stopped at the step limit before finishing. Ask me to continue.)_";
+/**
+ * Turn one SDK message stream into the reply text, pushing it to `out` as it arrives.
+ * Extracted from executeJob so these rules are testable against a fake stream:
+ *  - With includePartialMessages the stream carries BOTH incremental `stream_event` deltas
+ *    AND a terminal `assistant` message holding the whole reply. Taking both would emit the
+ *    answer twice, so deltas win and the terminal message is only a fallback for a stream
+ *    that produced none (older SDK, or partials unsupported).
+ *  - A multi-turn run (every web fetch or note lookup) gets a paragraph break between turns,
+ *    so narration does not run into the answer. Only when the next turn actually has text,
+ *    so a tool-only turn adds nothing.
+ *  - Every tool call is logged, including WebFetch calls to the hosts the CLI pre-approves
+ *    itself, which never reach canUseTool.
+ *  - Hitting maxTurns appends TURN_LIMIT_NOTE.
+ */
+export declare function consumeAgentStream(stream: AsyncIterable<unknown>, out: {
+    push(text: string): void;
+    isClosed(): boolean;
+}, logToolCall?: (name: string, detail?: string) => void): Promise<string>;
+/** A Claude API failure the daemon reports with its own text and SDK error code. */
+export declare class AgentRunError extends Error {
+    readonly code: string;
+    readonly resetsAt?: number | undefined;
+    constructor(message: string, code: string, resetsAt?: number | undefined);
+}
+/** The /complete body for a failed job: the message, plus the SDK's code when known. */
+export declare function completionErrorBody(lease: string, err: unknown): Record<string, unknown>;
+export interface FakeSdkOptions {
+    kind: string;
+    promptText: string;
+    /** Epoch ms after which rate_limit/auth answer like 'canned'. */
+    resetAt: number;
+    wordMs: number;
+    /** End a failing run by throwing, as the real SDK does when the CLI exits 1 (default true). */
+    throwAtEnd?: boolean;
+    now?: () => number;
+    timeZone?: string;
+}
+/**
+ * A stand-in for the Agent SDK that emits the message sequences a real run does, so the
+ * fake modes exercise consumeAgentStream exactly like real traffic.
+ */
+export declare function fakeSdk(mode: FakeMode, opts: FakeSdkOptions): SdkLike;
+/**
+ * A reset time the way the Claude CLI prints it in its limit message: "3pm (Zone)",
+ * "3:07pm (Zone)", or "Oct 12, 3pm (Zone)" when more than a day away — minutes, no seconds.
+ */
+export declare function formatResetLikeCli(atMs: number, timeZone?: string, nowMs?: number): string;
+/**
+ * The daemon's startup banner line — pulled out of runAgentDaemon() so the printed
+ * version string is directly unit-testable without starting the real (infinite) loop.
+ */
+export declare function startupBanner(cfg: AgentConfig): string;
 /** Run the daemon loop until aborted. */
 export declare function runAgentDaemon(cfg: AgentConfig, signal?: AbortSignal): Promise<void>;
 export {};

package/dist/agent/runner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/agent/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAUhD;AAqCD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAMxD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAIlD;AA0BD;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAOrC;AAiED;;;;;GAKG;AACH,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,wBAAuB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,YAAY,EAAE,CAQnH;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GAC5D,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAGlC;AAqHD,yCAAyC;AACzC,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAU1F"}
+{"version":3,"file":"runner.d.ts","sourceRoot":"","sources":["../../src/agent/runner.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAIH,OAAO,EAAyC,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACvF,OAAO,EAAmB,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,SAAS,EAAkD,MAAM,iBAAiB,CAAC;AAO5F;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,MAAM,CAAC;AAExD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAcD,wBAAgB,kBAAkB,IAAI,WAAW,CAmBhD;AAED,UAAU,UAAU;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,UAAU,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,UAAU,UAAU;IAElB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACpD;AAgCD,iFAAiF;AACjF,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAMxD;AAED,yFAAyF;AACzF,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,EAAE,CAGpD;AAED,gEAAgE;AAChE,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAIlD;AA0BD;;;;GAIG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAOrC;AAUD;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEvF;AAKD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAUpG;AA6ED;;;;;GAKG;AACH,KAAK,YAAY,GACb;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC9B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEpF;;;;;;;;;GASG;AACH,wBAAuB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAOzF;AAED,0EAA0E;AAC1E,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,YAAY,EAAE,CAQnH;AAED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,SAAS,GAC5D,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAGlC;AAED,4DAA4D;AAC5D,KAAK,kBAAkB,GACnB;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAC5D;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AACH,wBAAgB,eAAe;AAC7B;;;;;;;;GAQG;AACH,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAC3B,UAAU,GAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAsB,EAC7G,QAAQ,GAAE,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,UAAU,CAAoB,GACjE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAqBhG;AAeD;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,EACnB,aAAa,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3C,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgCzB;AAED,qFAAqF;AACrF,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAE/E;AAED,8FAA8F;AAC9F,MAAM,WAAW,OAAO;IACtB,KAAK,CAAC,IAAI,EAAE;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;CAC5F;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3C,aAAa,CAAC,OAAO,CAAC,CAKxB;AAiCD;;;;GAIG;AACH,eAAO,MAAM,eAAe,4EAA4E,CAAC;AAEzG;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,EAC9B,GAAG,EAAE;IAAE,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,IAAI,OAAO,CAAA;CAAE,EACtD,WAAW,GAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAwB,GACvE,OAAO,CAAC,MAAM,CAAC,CAoEjB;AAED,oFAAoF;AACpF,qBAAa,aAAc,SAAQ,KAAK;IACT,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM;gBAAlE,OAAO,EAAE,MAAM,EAAW,IAAI,EAAE,MAAM,EAAW,QAAQ,CAAC,EAAE,MAAM,YAAA;CAI/E;AAmFD,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAOxF;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,+FAA+F;IAC/F,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAErE;AAyBD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,MAAM,CAUtG;AAiBD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,WAAW,GAAG,MAAM,CAGtD;AAED,yCAAyC;AACzC,wBAAsB,cAAc,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAc1F"}