@oh-my-ai-sdk/omakase 0.1.2 → 0.1.4

package/dist/agent-catalog.js

@@ -0,0 +1,427 @@
+/**
+ * The host-owned agent catalog and the generic `agent` namespace it backs.
+ *
+ * `mountAgents` (agents.ts) turns trusted Flow backend references into named
+ * `agents.NAME` tools. This module adds the second, generic surface on the
+ * SAME execution machinery: `agent.run`, discriminated between a named
+ * registration (`{ agent, prompt, workspaceDir? }` — byte-identical result
+ * contract to `agents.NAME`) and an inline selection (`{ harness, provider,
+ * model, settings?, prompt, workspaceDir? }` → `{ sessionId, text }`), plus
+ * `agent.steer`, routed to the task-control port owned by agent-tasks.ts.
+ *
+ * Authority model: the host registers harnesses, the providers under each
+ * harness, the models authorized on each provider and named settings presets.
+ * Every credential pointer (`${file:…}`, `${VAR}`), sandbox env declaration,
+ * permission mode and option fragment lives in that host-owned registration
+ * and is composed into a trusted inline backend spec — the object
+ * presentation the flow provider already supports (inlineManifest). Guests
+ * pass only registered names, an authorized model id and a settings key;
+ * they can never supply executables, environment, paths or credentials, and
+ * no second backend loader exists.
+ *
+ * Identity protocol (agent-slice.ts): every agent tool registers a
+ * whole-catalog inspector (admission drift rejection — any change to the
+ * mounted authority, including unrelated additions, blocks recovery) and a
+ * selected-identity inspector resolving the per-invocation backend identity
+ * the durable host pins before native execution. The catalog fingerprint
+ * incorporates each named profile's resolved inspect identity, so content
+ * drift behind an unchanged ref string rejects recovery too. Inline specs
+ * never appear verbatim in identity, evidence or errors — only their stable
+ * content id does.
+ */
+import { createHash } from 'node:crypto';
+import { tool, jsonSchema } from 'ai';
+import { AgentHostError } from './agents.js';
+import { agentSteerTool, invokeAgentSteer } from './agent-tasks.js';
+import { registerAgentRecovery } from './agent-slice.js';
+import { assertJson } from './schema.js';
+const NAME_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]*$/;
+const PERMISSION_MODES = ['allow-reads', 'allow-edits', 'allow-all'];
+function isPlainObject(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null);
+}
+function plainObject(value, where) {
+    if (!isPlainObject(value))
+        throw new AgentHostError('INVALID_INPUT', `${where} must be a plain object`);
+    return value;
+}
+function rejectUnknownKeys(record, allowed, where) {
+    for (const key of Object.keys(record)) {
+        if (!allowed.includes(key))
+            throw new AgentHostError('INVALID_INPUT', `Unknown ${where} field: ${JSON.stringify(key)}; allowed: ${[...allowed].sort().join(', ')}`);
+    }
+}
+function optionalNonblankString(value, where) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' || !value.trim())
+        throw new AgentHostError('INVALID_INPUT', `${where} must be a nonblank string when present`);
+    return value;
+}
+/** Own-key lookup into a registration dictionary: names inherited from
+ * Object.prototype (`constructor`, `toString`, `__proto__`, …) never
+ * resolve — only explicitly registered own keys grant authority. */
+function ownEntry(record, key) {
+    return record !== undefined && Object.hasOwn(record, key) ? record[key] : undefined;
+}
+/** A trusted, host-owned option fragment. JSON-only, cloned into the
+ * snapshot, and never allowed to declare `model`: model authority belongs to
+ * the registered model key the caller selects. */
+function trustedOptions(value, where) {
+    if (value === undefined)
+        return undefined;
+    const record = plainObject(value, where);
+    try {
+        assertJson(record);
+    }
+    catch (error) {
+        throw new AgentHostError('INVALID_INPUT', `${where} must be JSON-compatible (${error instanceof Error ? error.message : String(error)})`);
+    }
+    if (Object.hasOwn(record, 'model')) {
+        throw new AgentHostError('INVALID_INPUT', `${where} must not declare "model" — model authority belongs to the registered model key selected by the caller`);
+    }
+    // assertJson above established JSON compatibility; the cast states it.
+    return structuredClone(record);
+}
+function stringRecord(value, where) {
+    if (value === undefined)
+        return undefined;
+    const record = plainObject(value, where);
+    // Null prototype: keys are freeform, so a trusted-JSON own "__proto__" key
+    // registers as the declared entry instead of rewiring this record's
+    // prototype.
+    const out = Object.create(null);
+    for (const [key, entry] of Object.entries(record)) {
+        if (!key)
+            throw new AgentHostError('INVALID_INPUT', `${where} keys must be nonempty`);
+        if (typeof entry !== 'string' || !entry)
+            throw new AgentHostError('INVALID_INPUT', `${where}.${key} must be a nonempty string (credential pointers like \${file:…} are resolved against the host environment only)`);
+        out[key] = entry;
+    }
+    return out;
+}
+function settingsLike(value, where) {
+    if (value === undefined)
+        return undefined;
+    const record = plainObject(value, where);
+    const out = {};
+    for (const [key, entry] of Object.entries(record)) {
+        if (!NAME_PATTERN.test(key))
+            throw new AgentHostError('INVALID_INPUT', `${where} key ${JSON.stringify(key)} must match ${NAME_PATTERN.source}`);
+        const fields = plainObject(entry, `${where}.${key}`);
+        rejectUnknownKeys(fields, ['options'], `${where}.${key}`);
+        const options = trustedOptions(fields.options, `${where}.${key}.options`);
+        out[key] = options === undefined ? {} : { options };
+    }
+    return out;
+}
+/** Validates and snapshots a catalog before any host effect (namespace
+ * registration, filesystem, workers). Throws typed INVALID_INPUT naming the
+ * offending field; forbidden overrides (a `model` key in any option
+ * fragment) are rejected here, before effects, per the authority contract. */
+export function validateAgentCatalog(catalog) {
+    const root = plainObject(catalog, 'catalog');
+    rejectUnknownKeys(root, ['harnesses'], 'catalog');
+    const harnessesRaw = plainObject(root.harnesses, 'catalog.harnesses');
+    if (Object.keys(harnessesRaw).length === 0)
+        throw new AgentHostError('INVALID_INPUT', 'catalog.harnesses must register at least one harness');
+    const harnesses = {};
+    for (const [harnessKey, harnessRaw] of Object.entries(harnessesRaw)) {
+        if (!NAME_PATTERN.test(harnessKey))
+            throw new AgentHostError('INVALID_INPUT', `catalog.harnesses key ${JSON.stringify(harnessKey)} must match ${NAME_PATTERN.source}`);
+        const where = `catalog.harnesses.${harnessKey}`;
+        const h = plainObject(harnessRaw, where);
+        rejectUnknownKeys(h, ['harness', 'description', 'instructions', 'permissionMode', 'toolApproval', 'activeTools', 'sandbox', 'options', 'providers'], where);
+        if (typeof h.harness !== 'string' || !h.harness.trim())
+            throw new AgentHostError('INVALID_INPUT', `${where}.harness must be a nonblank adapter id (e.g. 'claude-code')`);
+        if (h.permissionMode !== undefined && !PERMISSION_MODES.includes(h.permissionMode)) {
+            throw new AgentHostError('INVALID_INPUT', `${where}.permissionMode must be one of ${PERMISSION_MODES.join(', ')}`);
+        }
+        let activeTools;
+        if (h.activeTools !== undefined) {
+            if (!Array.isArray(h.activeTools))
+                throw new AgentHostError('INVALID_INPUT', `${where}.activeTools must be an array of tool names`);
+            activeTools = h.activeTools.map(name => {
+                if (typeof name !== 'string' || !name)
+                    throw new AgentHostError('INVALID_INPUT', `${where}.activeTools entries must be nonempty strings`);
+                return name;
+            });
+        }
+        let sandbox = {};
+        if (h.sandbox !== undefined) {
+            const raw = plainObject(h.sandbox, `${where}.sandbox`);
+            rejectUnknownKeys(raw, ['type', 'inheritEnv', 'warm'], `${where}.sandbox`);
+            if (raw.type !== undefined && raw.type !== 'local' && raw.type !== 'local-persistent')
+                throw new AgentHostError('INVALID_INPUT', `${where}.sandbox.type must be 'local' or 'local-persistent'`);
+            if (raw.inheritEnv !== undefined && typeof raw.inheritEnv !== 'boolean')
+                throw new AgentHostError('INVALID_INPUT', `${where}.sandbox.inheritEnv must be a boolean`);
+            if (raw.warm !== undefined && typeof raw.warm !== 'boolean')
+                throw new AgentHostError('INVALID_INPUT', `${where}.sandbox.warm must be a boolean`);
+            sandbox = {
+                ...(raw.type !== undefined ? { type: raw.type } : {}),
+                ...(raw.inheritEnv !== undefined ? { inheritEnv: raw.inheritEnv } : {}),
+                ...(raw.warm !== undefined ? { warm: raw.warm } : {}),
+            };
+        }
+        const providersRaw = plainObject(h.providers, `${where}.providers`);
+        if (Object.keys(providersRaw).length === 0)
+            throw new AgentHostError('INVALID_INPUT', `${where}.providers must register at least one provider`);
+        const providers = {};
+        for (const [providerKey, providerRaw] of Object.entries(providersRaw)) {
+            if (!NAME_PATTERN.test(providerKey))
+                throw new AgentHostError('INVALID_INPUT', `${where}.providers key ${JSON.stringify(providerKey)} must match ${NAME_PATTERN.source}`);
+            const pWhere = `${where}.providers.${providerKey}`;
+            const p = plainObject(providerRaw, pWhere);
+            rejectUnknownKeys(p, ['description', 'models', 'options', 'sandboxEnv', 'processEnv', 'settings'], pWhere);
+            const description = optionalNonblankString(p.description, `${pWhere}.description`);
+            const providerOptions = trustedOptions(p.options, `${pWhere}.options`);
+            const sandboxEnv = stringRecord(p.sandboxEnv, `${pWhere}.sandboxEnv`);
+            const processEnv = stringRecord(p.processEnv, `${pWhere}.processEnv`);
+            const settings = settingsLike(p.settings, `${pWhere}.settings`);
+            const modelsRaw = plainObject(p.models, `${pWhere}.models`);
+            if (Object.keys(modelsRaw).length === 0)
+                throw new AgentHostError('INVALID_INPUT', `${pWhere}.models must authorize at least one model`);
+            // Null prototype: model ids are freeform, so a trusted-JSON own
+            // "__proto__" key registers as the declared entry instead of rewiring
+            // this record's prototype.
+            const models = Object.create(null);
+            for (const [modelKey, modelRaw] of Object.entries(modelsRaw)) {
+                if (!modelKey.trim())
+                    throw new AgentHostError('INVALID_INPUT', `${pWhere}.models keys must be nonempty model ids`);
+                const mWhere = `${pWhere}.models.${JSON.stringify(modelKey)}`;
+                const m = plainObject(modelRaw, mWhere);
+                rejectUnknownKeys(m, ['options'], mWhere);
+                const modelOptions = trustedOptions(m.options, `${mWhere}.options`);
+                models[modelKey] = modelOptions === undefined ? {} : { options: modelOptions };
+            }
+            providers[providerKey] = {
+                key: providerKey,
+                ...(description !== undefined ? { description } : {}),
+                models,
+                ...(providerOptions !== undefined ? { options: providerOptions } : {}),
+                ...(sandboxEnv !== undefined ? { sandboxEnv } : {}),
+                ...(processEnv !== undefined ? { processEnv } : {}),
+                ...(settings !== undefined ? { settings } : {}),
+            };
+        }
+        const harnessDescription = optionalNonblankString(h.description, `${where}.description`);
+        const instructions = optionalNonblankString(h.instructions, `${where}.instructions`);
+        const toolApproval = trustedOptions(h.toolApproval, `${where}.toolApproval`);
+        const harnessOptions = trustedOptions(h.options, `${where}.options`);
+        harnesses[harnessKey] = {
+            key: harnessKey,
+            harness: h.harness,
+            ...(harnessDescription !== undefined ? { description: harnessDescription } : {}),
+            ...(instructions !== undefined ? { instructions } : {}),
+            ...(h.permissionMode !== undefined ? { permissionMode: h.permissionMode } : {}),
+            ...(toolApproval !== undefined ? { toolApproval } : {}),
+            ...(activeTools !== undefined ? { activeTools } : {}),
+            sandbox,
+            ...(harnessOptions !== undefined ? { options: harnessOptions } : {}),
+            providers,
+        };
+    }
+    return { harnesses };
+}
+/** Deterministic JSON with recursively sorted object keys: equal
+ * configurations hash equal regardless of authoring key order. */
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (value !== null && typeof value === 'object') {
+        const keys = Object.keys(value).sort();
+        return `{${keys.map(key => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+/** Stable, secret-free fingerprint of the whole mounted agent authority.
+ * Inputs are the validated catalog snapshot, the trusted slice budget and —
+ * critically — each named profile's RESOLVED inspect identity, so content
+ * drift behind an unchanged ref string (an agent.yaml edit on the host)
+ * rejects admission recovery even for tools a pending cell never invoked.
+ * Inline config drift is covered the same way: the selected identity embeds
+ * the resolved manifest fingerprint of the composed spec. The result is a
+ * hex hash — no configuration object, pointer or secret is serialized. */
+export function agentCatalogFingerprint(input) {
+    const material = {
+        v: 1,
+        kind: 'omakase-agent-catalog',
+        named: input.named.map(({ name, identity }) => ({ name, identity })),
+        catalog: input.catalog ?? null,
+        sliceSeconds: input.sliceSeconds,
+    };
+    return `omakase-agent-catalog-v1:${createHash('sha256').update(canonicalJson(material)).digest('hex')}`;
+}
+/** In-memory memo key for one backend ref: the ref itself when named, a hash
+ * of the canonical spec otherwise. Never persisted, logged or sent. */
+export function agentBackendRefKey(ref) {
+    return typeof ref === 'string' ? ref : `inline:${createHash('sha256').update(canonicalJson(ref)).digest('hex')}`;
+}
+/** Deep merge of trusted option fragments: plain objects merge recursively,
+ * everything else (arrays, scalars) replaces. Later fragments win; the
+ * caller-selected model id is placed last under `options.model`. Own keys
+ * only: inherited names never merge, and a JSON-declared own `__proto__` key
+ * lands as a data property instead of rewiring the prototype. */
+function mergeOptions(fragments) {
+    const out = {};
+    for (const fragment of fragments) {
+        if (fragment === undefined)
+            continue;
+        for (const [key, value] of Object.entries(fragment)) {
+            const prior = ownEntry(out, key);
+            const merged = isPlainObject(prior) && isPlainObject(value)
+                ? mergeOptions([prior, value])
+                : value;
+            // Trusted JSON can declare an own "__proto__" data property; plain
+            // assignment would rewire out's prototype instead of merging it.
+            if (key === '__proto__')
+                Object.defineProperty(out, key, { value: merged, writable: true, enumerable: true, configurable: true });
+            else
+                out[key] = merged;
+        }
+    }
+    return out;
+}
+/** Validates one agent.run input against the mounted authority and resolves
+ * the backend selection. Pure: no worker, no filesystem, no effects — every
+ * unregistered or mixed selection fails here, typed, before anything runs.
+ * Registration lookups are own-key: names inherited from Object.prototype
+ * (`constructor`, `toString`, `__proto__`, …) never grant authority. */
+export function resolveAgentRunSelection(input, named, catalog) {
+    if (!isPlainObject(input))
+        throw new AgentHostError('INVALID_INPUT', 'agent.run input must be an object');
+    if (input.agent !== undefined && typeof input.agent !== 'string')
+        throw new AgentHostError('INVALID_INPUT', 'agent.run agent must be a string when present');
+    if (input.harness !== undefined && typeof input.harness !== 'string')
+        throw new AgentHostError('INVALID_INPUT', 'agent.run harness must be a string when present');
+    if (input.provider !== undefined && typeof input.provider !== 'string')
+        throw new AgentHostError('INVALID_INPUT', 'agent.run provider must be a string when present');
+    if (input.model !== undefined && typeof input.model !== 'string')
+        throw new AgentHostError('INVALID_INPUT', 'agent.run model must be a string when present');
+    if (input.settings !== undefined && typeof input.settings !== 'string')
+        throw new AgentHostError('INVALID_INPUT', 'agent.run settings must be a string when present');
+    const { agent, harness, provider, model, settings, prompt, workspaceDir } = input;
+    if (prompt === undefined || !prompt.trim())
+        throw new AgentHostError('INVALID_INPUT', 'agent.run requires a nonblank prompt');
+    if (workspaceDir !== undefined && !workspaceDir)
+        throw new AgentHostError('INVALID_INPUT', 'agent.run workspaceDir must be a nonempty string when present');
+    const namedChosen = agent !== undefined;
+    const inlineChosen = harness !== undefined || provider !== undefined || model !== undefined || settings !== undefined;
+    if (namedChosen && inlineChosen)
+        throw new AgentHostError('INVALID_INPUT', 'agent.run takes either { agent } or { harness, provider, model, settings? }, never both');
+    if (!namedChosen && !inlineChosen)
+        throw new AgentHostError('INVALID_INPUT', 'agent.run requires either a registered agent name or a harness/provider/model selection');
+    if (namedChosen) {
+        if (!NAME_PATTERN.test(agent))
+            throw new AgentHostError('INVALID_INPUT', `agent.run agent name is invalid: ${JSON.stringify(agent)}`);
+        const registration = named.get(agent);
+        if (registration === undefined) {
+            throw new AgentHostError('INVALID_INPUT', `agent.run has no registered agent named ${JSON.stringify(agent)}; registered: ${[...named.keys()].sort().join(', ') || '(none)'}`);
+        }
+        return { kind: 'named', name: agent, ref: registration.ref, ...(registration.outputSchema !== undefined ? { outputSchema: registration.outputSchema } : {}) };
+    }
+    if (catalog === undefined)
+        throw new AgentHostError('INVALID_INPUT', 'agent.run inline selection requires a mounted harness catalog; this host registered none');
+    if (harness === undefined || provider === undefined || model === undefined) {
+        throw new AgentHostError('INVALID_INPUT', 'agent.run inline selection requires harness, provider and model');
+    }
+    const harnessRegistration = ownEntry(catalog.harnesses, harness);
+    if (harnessRegistration === undefined) {
+        throw new AgentHostError('INVALID_INPUT', `agent.run has no registered harness named ${JSON.stringify(harness)}; registered: ${Object.keys(catalog.harnesses).sort().join(', ')}`);
+    }
+    const providerRegistration = ownEntry(harnessRegistration.providers, provider);
+    if (providerRegistration === undefined) {
+        throw new AgentHostError('INVALID_INPUT', `agent.run harness ${JSON.stringify(harness)} has no provider named ${JSON.stringify(provider)}; registered: ${Object.keys(harnessRegistration.providers).sort().join(', ')}`);
+    }
+    const modelRegistration = ownEntry(providerRegistration.models, model);
+    if (modelRegistration === undefined) {
+        throw new AgentHostError('INVALID_INPUT', `agent.run model ${JSON.stringify(model)} is not authorized on ${harness}/${provider}; authorized: ${Object.keys(providerRegistration.models).sort().join(', ')}`);
+    }
+    let settingsOptions;
+    if (settings !== undefined) {
+        const preset = ownEntry(providerRegistration.settings, settings);
+        if (preset === undefined) {
+            throw new AgentHostError('INVALID_INPUT', `agent.run settings ${JSON.stringify(settings)} is not registered on ${harness}/${provider}; registered: ${Object.keys(providerRegistration.settings ?? {}).sort().join(', ') || '(none)'}`);
+        }
+        settingsOptions = preset.options;
+    }
+    const sandbox = {
+        ...(harnessRegistration.sandbox.type !== undefined ? { type: harnessRegistration.sandbox.type } : {}),
+        ...(providerRegistration.sandboxEnv !== undefined ? { env: providerRegistration.sandboxEnv } : {}),
+        ...(harnessRegistration.sandbox.inheritEnv !== undefined ? { inheritEnv: harnessRegistration.sandbox.inheritEnv } : {}),
+        ...(harnessRegistration.sandbox.warm !== undefined ? { warm: harnessRegistration.sandbox.warm } : {}),
+    };
+    const spec = {
+        harness: harnessRegistration.harness,
+        ...(harnessRegistration.instructions !== undefined ? { instructions: harnessRegistration.instructions } : {}),
+        options: mergeOptions([harnessRegistration.options, providerRegistration.options, modelRegistration.options, settingsOptions, { model }]),
+        ...(Object.keys(sandbox).length > 0 ? { sandbox } : {}),
+        ...(providerRegistration.processEnv !== undefined ? { processEnv: providerRegistration.processEnv } : {}),
+        ...(harnessRegistration.permissionMode !== undefined ? { permissionMode: harnessRegistration.permissionMode } : {}),
+        ...(harnessRegistration.toolApproval !== undefined ? { toolApproval: harnessRegistration.toolApproval } : {}),
+        ...(harnessRegistration.activeTools !== undefined ? { activeTools: harnessRegistration.activeTools } : {}),
+    };
+    return { kind: 'inline', spec, label: `inline ${harness}/${provider}/${model}${settings !== undefined ? ` settings=${settings}` : ''}` };
+}
+/** Nonsecret, host-derived selection summary for the tool description. */
+function describeCatalog(mount) {
+    const namedNames = [...mount.named.keys()].sort();
+    const harnessLines = Object.values(mount.catalog?.harnesses ?? {}).sort((a, b) => a.key.localeCompare(b.key)).map(harness => {
+        const providers = Object.values(harness.providers).sort((a, b) => a.key.localeCompare(b.key)).map(provider => `${provider.key} (models: ${Object.keys(provider.models).sort().join(', ')}${provider.settings !== undefined ? `; settings: ${Object.keys(provider.settings).sort().join(', ')}` : ''})`);
+        return `${harness.key} [${harness.harness}]: ${providers.join(' | ')}`;
+    });
+    return [
+        `Named agents: ${namedNames.join(', ') || '(none registered)'}.`,
+        harnessLines.length > 0 ? `Inline harnesses: ${harnessLines.join(' ')}` : 'No inline harness catalog is registered on this host.',
+    ].join(' ');
+}
+/** Registers the `agent` namespace — `run` (named or inline selection) and
+ * `steer` (routed to the task-control port) — and the recovery inspectors
+ * of `agent.run`. Called once from mountAgents after the named tools. */
+export async function mountAgentCatalog(mount) {
+    const { host } = mount;
+    const runTool = tool({
+        description: `Run a registered agent. Named: { agent, prompt, workspaceDir? } returns the agent's declared structured result (identical to its agents.NAME tool). Inline: { harness, provider, model, settings?, prompt, workspaceDir? } composes the registered harness/provider configuration around the authorized model and returns { sessionId, text }. ${describeCatalog(mount)}`,
+        inputSchema: jsonSchema({
+            type: 'object',
+            properties: {
+                agent: { type: 'string', pattern: '^[a-zA-Z0-9][a-zA-Z0-9_-]*$', description: 'Named mode: a registered agent name. Exclusive with harness/provider/model/settings.' },
+                harness: { type: 'string', pattern: '^[a-zA-Z0-9][a-zA-Z0-9_-]*$', description: 'Inline mode: a registered harness key.' },
+                provider: { type: 'string', pattern: '^[a-zA-Z0-9][a-zA-Z0-9_-]*$', description: 'Inline mode: a provider key registered under the harness.' },
+                model: { type: 'string', minLength: 1, description: 'Inline mode: a model id authorized on the provider.' },
+                settings: { type: 'string', pattern: '^[a-zA-Z0-9][a-zA-Z0-9_-]*$', description: 'Inline mode: optional settings key registered on the provider.' },
+                prompt: { type: 'string', pattern: '\\S', description: 'The task for the agent.' },
+                workspaceDir: { type: 'string', minLength: 1, description: 'Omit to use the registered agent workspace. Optional subdirectory must stay inside that root; the calling harness current directory may be elsewhere.' },
+            },
+            required: ['prompt'],
+            additionalProperties: false,
+        }),
+        // Safe only because same-intent invocations are deduplicated in the
+        // shared run machinery, selection included.
+        metadata: { omakase: { replay: 'safe' } },
+        execute: async (input, execution) => {
+            if (typeof execution.toolCallId !== 'string' || !execution.toolCallId)
+                throw new AgentHostError('INVALID_INPUT', 'Agent tools require a tool call id');
+            const selection = resolveAgentRunSelection(input, mount.named, mount.catalog);
+            return await mount.runSelected(selection, input, { toolCallId: execution.toolCallId, abortSignal: execution.abortSignal });
+        },
+    });
+    await host.register('agent', { run: runTool, steer: agentSteerTool }, {
+        resolveBinding: invocation => invocation.toolName === 'agent.steer'
+            ? { id: 'agent.steer', target: agentSteerTool }
+            : { id: 'agent.run', target: runTool },
+        executor: {
+            replays: false,
+            invoke: async (invocation, binding, options) => {
+                if (invocation.toolName === 'agent.steer')
+                    return await invokeAgentSteer(host, invocation);
+                return await binding.target.execute(invocation.input, {
+                    ...options,
+                    toolCallId: JSON.stringify([invocation.harnessId ?? null, invocation.sessionId ?? null, invocation.toolCallId]),
+                });
+            },
+        },
+    });
+    registerAgentRecovery(host, 'agent.run', mount.catalogFingerprint, input => mount.identityForSelection(resolveAgentRunSelection(input, mount.named, mount.catalog)));
+}

package/dist/agent-runtime/manifest.json

@@ -1,5 +1,5 @@
 {
-  "generatedAt": "2026-10-11T16:56:28.358Z",
+  "generatedAt": "2026-10-12T07:09:16.138Z",
   "entry": "worker.mjs",
   "runtime": "bun >=1.3.14 (launched per run by the host; stdin/stdout JSON wire)",
   "adapters": {