@paperclipai/plugin-sdk 2026.1023.0 → 2026.1024.0-canary.1

package/README.md

@@ -1305,3 +1305,130 @@ An `appShellOverlay` slot uses `ui.action.register` and the standard
 `PluginWidgetProps` context. It survives navigation and unmounts on account or
 company changes, sign-out and onboarding. Plugins own panel accessibility and
 request cleanup. See [the distribution and lifecycle contract](../../../doc/plugins/DISTRIBUTION-PLUGINS.md).
+
+## Project storage and task workspaces
+
+A storage provider declares `workspaceProvider: { modes: ["isolated_workspace"],
+strategies: ["git_worktree"] }`, `workspaces.manage`, and
+`resourceLifecycle: ["project"]` (with `events.subscribe`). The same plugin must
+implement `onResourceLifecycle` and `onWorkspaceOperation`. Project lifecycle
+creates and retains the storage; workspace operations manage task checkouts in
+that storage. Execution remains a separate environment driver contract.
+
+Set `project.executionWorkspacePolicy.storageProviderPluginId` to an installed
+plugin's UUID for an explicit selection, or `null` for explicit Core/local storage.
+Omit the field to inherit the installed company-enabled default. A provider claims
+that default by declaring, for example:
+
+```ts
+workspaceProvider: {
+  modes: ["isolated_workspace", "operator_branch"],
+  strategies: ["git_worktree"],
+  defaultForProjects: { mode: "isolated_workspace", strategy: "git_worktree" },
+}
+```
+
+The declared defaults must be supported by the provider. Core applies missing mode
+and strategy settings to Git projects, including existing unconfigured projects,
+without writing their policy. Explicit settings remain intact; incompatible
+settings fail with a configuration error. Multiple enabled default claims require
+an explicit project choice or disabling a conflicting provider. Worker health does
+not change the selected default: unavailable providers fail without local fallback.
+No company settings row means enabled, matching the normal plugin contract.
+
+New and imported tasks leave an unspecified project mode inherited. Provider-owned
+workspaces retain explicit project and task strategies in shared and operator-branch
+modes. If neither supplies a strategy, those modes use `project_primary`; an agent's
+Git strategy remains a fallback only for isolated mode.
+
+Project responses keep the stored `executionWorkspacePolicy` and expose the
+separate `workspaceProvider` configuration, including its source, effective policy,
+provider choices and configuration error. The project configuration UI supports
+inheritance, explicit plugins and Core/local storage. Conflicts remain readable so
+operators can resolve them through this flow.
+
+Core reserves an execution-workspace row and binds the task before calling
+`onWorkspaceOperation`. Source-free task directories do not prepare project storage. The resolved provider
+choice, including Core/local, stays fixed through source resolution and preparation.
+Existing workspaces, including local workspaces, retain their original owner. Changing defaults never migrates, resets or recreates them;
+normal retirement and cleanup gates still apply on disable/uninstall.
+
+The hook receives a company, project, source revision, execution-workspace ID,
+lifecycle generation, deadline, and stable operation ID. Run and agent IDs are
+optional context. A storage hook must work without an environment lease, a live
+agent, or a filesystem mount on Core. It must reconcile ambiguous retries before
+repeating side effects. Use the workspace ID and generation to fence provider
+operations; the operation ID identifies a retry of the same request.
+Fresh inspections get a new operation ID so provider result caches cannot reuse
+an earlier checkout status. Prepare and removal retries retain their IDs.
+
+- `prepare` creates or restores the checkout. It returns an opaque, durable
+  `WorkspaceProviderBinding`, a branch, and the starting commit. `branchMode:
+  "existing"` must use an existing logical branch and must never reset its history.
+  A provider may materialize a local ref from a confirmed existing remote branch. Retried preparation must keep
+  local work. Providers may reject modes or strategies they do not support.
+- `inspect` reports tracked, untracked, and ignored/local-only changes, the
+  current commit, merge state, and whether remote storage can recover it. Use
+  `null` when a remote recovery or merge check is unknown.
+- `remove` checks the expected commit again and confirms removal. Busy, failed,
+  unsafe, and uncertain removal must throw. Core requires a clean checkout and
+  affirmative remote recovery or merge evidence before requesting removal.
+
+References contain the installed plugin ID, project/source/workspace IDs, source
+revision, and opaque provider coordinates. They must not contain secrets. Core
+stores no local `cwd` for managed rows. `/workspaces/<id>` is a logical path in
+Core's existing run metadata; Core must not use it for filesystem access.
+
+For the initial execution integration, select a task-capable environment driver
+from the same plugin. Core validates declared modes and strategies before it
+reserves a workspace. Core pins the binding on the environment lease and supplies
+it as `PluginEnvironmentTaskParams.workspace`. The execution hook resolves the
+provider reference to guest mounts and the actual working directory. Core rejects
+an execution driver from a different plugin. Native execution also requires the
+plugin Runner task bridge; Core refuses to fall back to a host Runner when that
+bridge is unavailable. This does not require merging the
+storage and execution interfaces.
+
+Core's existing archive, reopen, and terminal cleanup fences also cover provider
+workspaces. The plugin must prevent project storage retirement while its task
+workspaces still contain local data. Repository source and storage owner changes
+are blocked while live managed workspaces depend on them. An authorized storage
+owner or source edit retires closed workspaces whose provider removal is confirmed;
+retired records cannot reopen. Inspection reconciles a pending restoration with
+its recorded request, advances its generation, and keeps the Core row closed.
+Cleanup must then inspect that generation afresh; it cannot reuse an earlier
+removal receipt. Direct removal refuses unresolved restoration intent.
+Core commits storage intent and recovery results with cleanup notifications so
+incremental terminal-workspace sweeps revisit changed records.
+Pending deletion is replayed before inspection, including after a lost removal
+result. File browsing and
+other Core-host filesystem operations are unavailable for managed storage.
+
+Use `createWorkspaceProviderHarness` from `@paperclipai/plugin-sdk/testing` to
+validate hook inputs and outputs without allocating an execution environment.
+
+
+### Private project instance credentials
+
+Project lifecycle plugins can opt into `projects.instance-secrets` alongside
+`events.subscribe` and `resourceLifecycle: ["project"]`. Automatic project
+callbacks receive `event.instanceSecrets`; return an `instanceSecrets` patch
+with an acknowledged result. Core stores the patch in the existing native
+instance-secret system and acknowledges the event in one transaction. A null
+value removes a key. Retry and deferred results do not store patches.
+
+Each company/project/installed-plugin owns its credentials. Up to 16 lowercase
+snake_case keys may change per result; nonempty string values are limited to
+128 KiB each. Core rejects replies if configuration, project sources, lifecycle
+state, or secret versions changed during the callback. A duplicate response to
+an acknowledged event cannot overwrite credentials. Deleted projects allow
+removal only; their secrets are also deleted by the native owner foreign key.
+
+Trusted worker code can use
+`ctx.projects.getInstanceSecrets(projectId, companyId)` during a company-scoped
+invocation to read its credentials without an external service call. Archived
+or missing projects cannot be read this way. Values never appear in ordinary
+lifecycle inbox listings or the company secret catalog. Do not expose values
+through plugin entities, state, data handlers, UI, or logs. Agent instance
+secrets retain their existing lifecycle contract. Back up the tenant's existing
+local secrets master key together with its database.

package/dist/.paperclip-build-complete

@@ -1 +1 @@
-{"sources":"c486201bab3162f41181f2c6914bb9f4fe7bf7378673536b811702714b6b5ce6","outputs":"d1c3561c18c9bc29450374d7bdd04e0579d8945852ae71a13e05cce1e61af0b3"}
+{"sources":"b07c91b046158531ba50d83aeaa639b4bf476e79cd7d35bb72396c49db11afb1","outputs":"8c8aca4fb1b4fcbd082ca032684cb951df526cd966a3fc924e000da1d009d5ff"}

package/dist/define-plugin.d.ts

@@ -1,3 +1,5 @@
+import type { PluginWorkspaceParams, PluginWorkspaceResult } from "./workspace-provider.js";
+import type { PluginEnvironmentTaskParams, PluginEnvironmentTaskResult } from "./environment-tasks.js";
 import type { AgentLifecycleRequest, AgentLifecycleResult } from "@paperclipai/shared";
 import type { AiConnectionRouterRequest, AiConnectionRouterResult } from "@paperclipai/shared";
 /**
@@ -50,8 +52,8 @@ import type { AiConnectionRouterRequest, AiConnectionRouterResult } from "@paper
  * });
  * ```
  */
-import type { PluginContext } from "./types.js";
-import type { PluginEnvironmentAcquireLeaseParams, PluginEnvironmentDestroyLeaseParams, PluginEnvironmentExecuteParams, PluginEnvironmentExecuteResult, PluginEnvironmentRunnerIngressEndpointParams, PluginEnvironmentRunnerIngressEndpoint, PluginEnvironmentSyncInParams, PluginEnvironmentSyncOutParams, PluginEnvironmentSyncResult, PluginEnvironmentStartInteractiveSetupParams, PluginEnvironmentInteractiveSetupSession, PluginEnvironmentGetInteractiveSetupParams, PluginEnvironmentCaptureTemplateParams, PluginEnvironmentCaptureTemplateResult, PluginEnvironmentCancelInteractiveSetupParams, PluginEnvironmentCancelInteractiveSetupResult, PluginEnvironmentDeleteTemplateParams, PluginEnvironmentDeleteTemplateResult, PluginEnvironmentLease, PluginEnvironmentProbeParams, PluginEnvironmentProbeResult, PluginEnvironmentRealizeWorkspaceParams, PluginEnvironmentRealizeWorkspaceResult, PluginEnvironmentReleaseLeaseParams, PluginEnvironmentTerminationReceipt, PluginEnvironmentResumeLeaseParams, PluginEnvironmentValidateConfigParams, PluginEnvironmentValidationResult, DetectExternalObjectsParams, DetectExternalObjectsResult, ResolveExternalObjectParams, PluginExternalObjectResolveResult, RefreshExternalObjectsParams, RefreshExternalObjectsResult, PluginLoginPtyOpenParams, PluginLoginPtyOpenResult, PluginLoginPtyInputParams, PluginLoginPtyStopParams, PluginLoginPtyCloseParams, PluginLoginPtyCloseResult, PluginDuplexChannelOpenParams, PluginDuplexChannelOpenResult, PluginDuplexChannelWriteParams, PluginDuplexChannelStopParams, PluginDuplexChannelCloseParams, PluginDuplexChannelCloseResult } from "./protocol.js";
+import type { PluginContext, ResourceLifecycleEvent, ResourceLifecycleResult } from "./types.js";
+import type { PluginEnvironmentAcquireLeaseParams, PluginEnvironmentDestroyLeaseParams, PluginEnvironmentInspectLeaseParams, PluginEnvironmentLeaseObservation, PluginEnvironmentExecuteParams, PluginEnvironmentExecuteResult, PluginEnvironmentRunnerIngressEndpointParams, PluginEnvironmentRunnerIngressEndpoint, PluginEnvironmentSyncInParams, PluginEnvironmentSyncOutParams, PluginEnvironmentSyncResult, PluginEnvironmentStartInteractiveSetupParams, PluginEnvironmentInteractiveSetupSession, PluginEnvironmentGetInteractiveSetupParams, PluginEnvironmentCaptureTemplateParams, PluginEnvironmentCaptureTemplateResult, PluginEnvironmentCancelInteractiveSetupParams, PluginEnvironmentCancelInteractiveSetupResult, PluginEnvironmentDeleteTemplateParams, PluginEnvironmentDeleteTemplateResult, PluginEnvironmentLease, PluginEnvironmentProbeParams, PluginEnvironmentProbeResult, PluginEnvironmentRealizeWorkspaceParams, PluginEnvironmentRealizeWorkspaceResult, PluginEnvironmentReleaseLeaseParams, PluginEnvironmentTerminationReceipt, PluginEnvironmentResumeLeaseParams, PluginEnvironmentValidateConfigParams, PluginEnvironmentValidationResult, DetectExternalObjectsParams, DetectExternalObjectsResult, ResolveExternalObjectParams, PluginExternalObjectResolveResult, RefreshExternalObjectsParams, RefreshExternalObjectsResult, PluginLoginPtyOpenParams, PluginLoginPtyOpenResult, PluginLoginPtyInputParams, PluginLoginPtyStopParams, PluginLoginPtyCloseParams, PluginLoginPtyCloseResult, PluginDuplexChannelOpenParams, PluginDuplexChannelOpenResult, PluginDuplexChannelWriteParams, PluginDuplexChannelStopParams, PluginDuplexChannelCloseParams, PluginDuplexChannelCloseResult } from "./protocol.js";
 /**
  * Optional plugin-reported diagnostics returned from the `health()` RPC method.
  *
@@ -113,6 +115,11 @@ export interface PluginApiRequestInput {
     headers: Record<string, string>;
 }
 export interface PluginApiResponse {
+    /** Server-only upstream for a declared WebSocket route. Never returned as JSON. */
+    websocket?: {
+        url: string;
+        headers?: Record<string, string>;
+    };
     status?: number;
     headers?: Record<string, string>;
     body?: unknown;
@@ -269,6 +276,13 @@ export interface PluginDefinition {
      * Calls can repeat. Fence older versions and make external effects idempotent.
      */
     onAgentLifecycle?(params: AgentLifecycleRequest): Promise<AgentLifecycleResult>;
+    /**
+     * Reconcile a committed resource event. Requires manifest resourceLifecycle and events.subscribe.
+     * The host acknowledges successful results and replays interrupted/unfinished work.
+     * Calls are at least once, in order per resource. Re-read current state and use
+     * idempotent external operations; deletion events remain available after the row is gone.
+     */
+    onResourceLifecycle?(event: ResourceLifecycleEvent): Promise<ResourceLifecycleResult>;
     /** Propose a member from host-authorized candidates. Requires ai.connections.route. */
     onRouteAiConnection?(params: AiConnectionRouterRequest): Promise<AiConnectionRouterResult>;
     /**
@@ -290,6 +304,10 @@ export interface PluginDefinition {
      * environment driver.
      */
     onEnvironmentValidateConfig?(params: PluginEnvironmentValidateConfigParams): Promise<PluginEnvironmentValidationResult>;
+    /** Required with manifest.workspaceProvider, together with project resource lifecycle. */
+    onWorkspaceOperation?(params: PluginWorkspaceParams): Promise<PluginWorkspaceResult>;
+    /** Provide Runner execution: prepare resources, start Runner, connect via PRP, and manage task lifecycle. */
+    onEnvironmentTask?(params: PluginEnvironmentTaskParams): Promise<PluginEnvironmentTaskResult>;
     /** Called to test reachability or readiness of a plugin-hosted environment. */
     onEnvironmentProbe?(params: PluginEnvironmentProbeParams): Promise<PluginEnvironmentProbeResult>;
     /** Called before a run starts to acquire a provider lease. */
@@ -304,6 +322,8 @@ export interface PluginDefinition {
     onEnvironmentStopLease?(params: PluginEnvironmentReleaseLeaseParams): Promise<PluginEnvironmentTerminationReceipt>;
     /** Called when the host needs to force-destroy provider state. */
     onEnvironmentDestroyLease?(params: PluginEnvironmentDestroyLeaseParams): Promise<PluginEnvironmentTerminationReceipt | void>;
+    /** Read provider state only. This must not start or reconnect a sandbox. */
+    onEnvironmentInspectLease?(params: PluginEnvironmentInspectLeaseParams): Promise<PluginEnvironmentLeaseObservation>;
     /** Called to materialize the run workspace inside the provider lease. */
     onEnvironmentRealizeWorkspace?(params: PluginEnvironmentRealizeWorkspaceParams): Promise<PluginEnvironmentRealizeWorkspaceResult>;
     /** Called to execute a command inside the provider lease. */

package/dist/define-plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-plugin.d.ts","sourceRoot":"","sources":["../src/define-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChD,OAAO,KAAK,EACV,mCAAmC,EACnC,mCAAmC,EACnC,8BAA8B,EAC9B,8BAA8B,EAC9B,4CAA4C,EAC5C,sCAAsC,EACtC,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,4CAA4C,EAC5C,wCAAwC,EACxC,0CAA0C,EAC1C,sCAAsC,EACtC,sCAAsC,EACtC,6CAA6C,EAC7C,6CAA6C,EAC7C,qCAAqC,EACrC,qCAAqC,EACrC,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,uCAAuC,EACvC,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,kCAAkC,EAClC,qCAAqC,EACrC,iCAAiC,EACjC,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,eAAe,CAAC;AAMvB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;IACpC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAMD;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,mCAAmC;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,CACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;IAE3E;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAE1F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;OAIG;IACH,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAExE;;;;;;;OAOG;IACH,uBAAuB,CAAC,CACtB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEhF,uFAAuF;IACvF,mBAAmB,CAAC,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,uBAAuB,CAAC,CACtB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC;;;OAGG;IACH,2BAA2B,CAAC,CAC1B,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C,+EAA+E;IAC/E,kBAAkB,CAAC,CACjB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC,8DAA8D;IAC9D,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,mEAAmE;IACnE,wBAAwB,CAAC,CACvB,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,yEAAyE;IACzE,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IAEvD;;+EAE2E;IAC3E,sBAAsB,CAAC,CACrB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAEhD,kEAAkE;IAClE,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IAEvD,yEAAyE;IACzE,6BAA6B,CAAC,CAC5B,MAAM,EAAE,uCAAuC,GAC9C,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAEpD,6DAA6D;IAC7D,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAE3C,qEAAqE;IACrE,kCAAkC,CAAC,CACjC,MAAM,EAAE,4CAA4C,GACnD,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAClB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;OAKG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,4FAA4F;IAC5F,kCAAkC,CAAC,CACjC,MAAM,EAAE,4CAA4C,GACnD,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAErD,uFAAuF;IACvF,gCAAgC,CAAC,CAC/B,MAAM,EAAE,0CAA0C,GACjD,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAErD,gFAAgF;IAChF,4BAA4B,CAAC,CAC3B,MAAM,EAAE,sCAAsC,GAC7C,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD,kFAAkF;IAClF,mCAAmC,CAAC,CAClC,MAAM,EAAE,6CAA6C,GACpD,OAAO,CAAC,6CAA6C,CAAC,CAAC;IAE1D,+EAA+E;IAC/E,2BAA2B,CAAC,CAC1B,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErC,8GAA8G;IAC9G,eAAe,CAAC,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE,kGAAkG;IAClG,cAAc,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;OAIG;IACH,eAAe,CAAC,CACd,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;;OASG;IACH,mBAAmB,CAAC,CAClB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,mGAAmG;IACnG,oBAAoB,CAAC,CAAC,MAAM,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7E,2FAA2F;IAC3F,mBAAmB,CAAC,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;;OAIG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC5C;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,gBAAgB,GAAG,eAAe,CAE1E"}
+{"version":3,"file":"define-plugin.d.ts","sourceRoot":"","sources":["../src/define-plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC5F,OAAO,KAAK,EAAE,2BAA2B,EAAE,2BAA2B,EAAE,MAAM,wBAAwB,CAAC;AACvG,OAAO,KAAK,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACvF,OAAO,KAAK,EAAE,yBAAyB,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/F;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACjG,OAAO,KAAK,EACV,mCAAmC,EACnC,mCAAmC,EACnC,mCAAmC,EACnC,iCAAiC,EACjC,8BAA8B,EAC9B,8BAA8B,EAC9B,4CAA4C,EAC5C,sCAAsC,EACtC,6BAA6B,EAC7B,8BAA8B,EAC9B,2BAA2B,EAC3B,4CAA4C,EAC5C,wCAAwC,EACxC,0CAA0C,EAC1C,sCAAsC,EACtC,sCAAsC,EACtC,6CAA6C,EAC7C,6CAA6C,EAC7C,qCAAqC,EACrC,qCAAqC,EACrC,sBAAsB,EACtB,4BAA4B,EAC5B,4BAA4B,EAC5B,uCAAuC,EACvC,uCAAuC,EACvC,mCAAmC,EACnC,mCAAmC,EACnC,kCAAkC,EAClC,qCAAqC,EACrC,iCAAiC,EACjC,2BAA2B,EAC3B,2BAA2B,EAC3B,2BAA2B,EAC3B,iCAAiC,EACjC,4BAA4B,EAC5B,4BAA4B,EAC5B,wBAAwB,EACxB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,6BAA6B,EAC7B,6BAA6B,EAC7B,8BAA8B,EAC9B,6BAA6B,EAC7B,8BAA8B,EAC9B,8BAA8B,EAC/B,MAAM,eAAe,CAAC;AAMvB;;;;GAIG;AACH,MAAM,WAAW,uBAAuB;IACtC,kEAAkE;IAClE,MAAM,EAAE,IAAI,GAAG,UAAU,GAAG,OAAO,CAAC;IACpC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAMD;;;;GAIG;AACH,MAAM,WAAW,4BAA4B;IAC3C,mCAAmC;IACnC,EAAE,EAAE,OAAO,CAAC;IACZ,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAMD;;;;GAIG;AACH,MAAM,WAAW,kBAAkB;IACjC,sDAAsD;IACtD,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IAC3C,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,wDAAwD;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC,CAAC;IACzC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,EAAE;QACL,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACvB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KACvB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,SAAS,CAAC,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,yBAAyB;IACxC;;;OAGG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAMD;;;;;;;;;;;;GAYG;AACH,MAAM,WAAW,gBAAgB;IAC/B;;;;;;;;;OASG;IACH,KAAK,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9C;;;;;;;;;;;;;OAaG;IACH,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAE7B;;;;;;;;;;;;OAYG;IACH,eAAe,CAAC,CACd,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAClC,OAAO,CAAC,EAAE,yBAAyB,GAClC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjB;;;;;;;;OAQG;IACH,UAAU,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B;;;;;;;;OAQG;IACH,WAAW,CAAC,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,GAAG,SAAS,CAAC,CAAC;IAE3E;;;;;;;;;;OAUG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAE1F;;;;;;;;;;;;OAYG;IACH,SAAS,CAAC,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;;;OAIG;IACH,YAAY,CAAC,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAExE;;;;;;;OAOG;IACH,uBAAuB,CAAC,CACtB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;OAKG;IACH,gBAAgB,CAAC,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEhF;;;;;OAKG;IACH,mBAAmB,CAAC,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAEtF,uFAAuF;IACvF,mBAAmB,CAAC,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAE3F;;;;;OAKG;IACH,uBAAuB,CAAC,CACtB,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C;;;;;OAKG;IACH,wBAAwB,CAAC,CACvB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC;;;OAGG;IACH,2BAA2B,CAAC,CAC1B,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C,0FAA0F;IAC1F,oBAAoB,CAAC,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAErF,6GAA6G;IAC7G,iBAAiB,CAAC,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAE9F,+EAA+E;IAC/E,kBAAkB,CAAC,CACjB,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAEzC,8DAA8D;IAC9D,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,mEAAmE;IACnE,wBAAwB,CAAC,CACvB,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAEnC,yEAAyE;IACzE,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IAEvD;;+EAE2E;IAC3E,sBAAsB,CAAC,CACrB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,CAAC,CAAC;IAEhD,kEAAkE;IAClE,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,mCAAmC,GAAG,IAAI,CAAC,CAAC;IAEvD,4EAA4E;IAC5E,yBAAyB,CAAC,CACxB,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAE9C,yEAAyE;IACzE,6BAA6B,CAAC,CAC5B,MAAM,EAAE,uCAAuC,GAC9C,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAEpD,6DAA6D;IAC7D,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAE3C,qEAAqE;IACrE,kCAAkC,CAAC,CACjC,MAAM,EAAE,4CAA4C,GACnD,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD;;;;;;OAMG;IACH,mBAAmB,CAAC,CAClB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC;;;;;OAKG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAExC,4FAA4F;IAC5F,kCAAkC,CAAC,CACjC,MAAM,EAAE,4CAA4C,GACnD,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAErD,uFAAuF;IACvF,gCAAgC,CAAC,CAC/B,MAAM,EAAE,0CAA0C,GACjD,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAErD,gFAAgF;IAChF,4BAA4B,CAAC,CAC3B,MAAM,EAAE,sCAAsC,GAC7C,OAAO,CAAC,sCAAsC,CAAC,CAAC;IAEnD,kFAAkF;IAClF,mCAAmC,CAAC,CAClC,MAAM,EAAE,6CAA6C,GACpD,OAAO,CAAC,6CAA6C,CAAC,CAAC;IAE1D,+EAA+E;IAC/E,2BAA2B,CAAC,CAC1B,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,qCAAqC,CAAC,CAAC;IAElD;;;;;;OAMG;IACH,cAAc,CAAC,CACb,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAErC,8GAA8G;IAC9G,eAAe,CAAC,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE,kGAAkG;IAClG,cAAc,CAAC,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;;;OAIG;IACH,eAAe,CAAC,CACd,MAAM,EAAE,yBAAyB,GAChC,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAEtC;;;;;;;;;OASG;IACH,mBAAmB,CAAC,CAClB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAE1C,mGAAmG;IACnG,oBAAoB,CAAC,CAAC,MAAM,EAAE,8BAA8B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7E,2FAA2F;IAC3F,mBAAmB,CAAC,CAAC,MAAM,EAAE,6BAA6B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE3E;;;;OAIG;IACH,oBAAoB,CAAC,CACnB,MAAM,EAAE,8BAA8B,GACrC,OAAO,CAAC,8BAA8B,CAAC,CAAC;CAC5C;AAMD;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe;IAC9B,iEAAiE;IACjE,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAC;CACvC;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,gBAAgB,GAAG,eAAe,CAE1E"}

package/dist/define-plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"define-plugin.js","sourceRoot":"","sources":["../src/define-plugin.ts"],"names":[],"mappings":"AA+iBA,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,YAAY,CAAC,UAA4B;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACvC,CAAC"}
+{"version":3,"file":"define-plugin.js","sourceRoot":"","sources":["../src/define-plugin.ts"],"names":[],"mappings":"AAwkBA,8EAA8E;AAC9E,mCAAmC;AACnC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,YAAY,CAAC,UAA4B;IACvD,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;AACvC,CAAC"}

package/dist/environment-tasks.d.ts

@@ -0,0 +1,359 @@
+import { z } from "zod";
+import type { PluginEnvironmentDriverBaseParams, PluginEnvironmentLease } from "./protocol.js";
+export declare const MAX_ENVIRONMENT_TASK_FILE_BYTES: number;
+/** Only provider authentication is transferred. Paths and executable settings remain provider-owned. */
+export declare const environmentTaskCredentialSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"codex-auth-json">;
+    authJson: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"claude-env">;
+    environment: z.ZodObject<{
+        CLAUDE_CODE_OAUTH_TOKEN: z.ZodOptional<z.ZodString>;
+        ANTHROPIC_API_KEY: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "type">;
+export type PluginEnvironmentTaskCredential = z.infer<typeof environmentTaskCredentialSchema>;
+/** Runner owns this versioned data contract. The plugin resolves its execution-host locations. */
+export declare const environmentRunnerLaunchRequirementsSchema: z.ZodObject<{
+    schema: z.ZodLiteral<"paperclip.runner.launch-requirements.v1">;
+    identity: z.ZodObject<{
+        runnerInstanceId: z.ZodString;
+        environmentLeaseId: z.ZodString;
+        runId: z.ZodString;
+        normalizedSessionId: z.ZodString;
+        turnId: z.ZodString;
+        itemId: z.ZodString;
+    }, z.core.$strict>;
+    provider: z.ZodEnum<{
+        acpx: "acpx";
+        aws_agentcore: "aws_agentcore";
+        claude_managed: "claude_managed";
+        codex: "codex";
+        opencode: "opencode";
+    }>;
+    model: z.ZodNullable<z.ZodString>;
+    instructions: z.ZodString;
+    runtimeContext: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    settings: z.ZodObject<{
+        acpxAgent: z.ZodOptional<z.ZodString>;
+        acpxMode: z.ZodOptional<z.ZodString>;
+        acpxPermissionMode: z.ZodOptional<z.ZodEnum<{
+            "approve-all": "approve-all";
+            "approve-paperclip": "approve-paperclip";
+            "approve-reads": "approve-reads";
+            "deny-all": "deny-all";
+        }>>;
+        acpxPermissionModePinned: z.ZodOptional<z.ZodBoolean>;
+        piThinkingLevel: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            max: "max";
+            off: "off";
+        }>>;
+        claudeEffort: z.ZodOptional<z.ZodEnum<{
+            high: "high";
+            low: "low";
+            max: "max";
+            medium: "medium";
+            xhigh: "xhigh";
+        }>>;
+        opencodePermissionMode: z.ZodOptional<z.ZodEnum<{
+            allow: "allow";
+            ask: "ask";
+            deny: "deny";
+        }>>;
+        managedProfile: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        agentCoreProfile: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+    }, z.core.$strict>;
+    approvalPolicy: z.ZodEnum<{
+        never: "never";
+        "on-request": "on-request";
+        untrusted: "untrusted";
+    }>;
+    readOnly: z.ZodBoolean;
+    preparedConversation: z.ZodBoolean;
+    includeCollaborationModeInstructions: z.ZodBoolean;
+}, z.core.$strict>;
+declare const preparedLaunch: z.ZodObject<{
+    configurationId: z.ZodString;
+    requirementsDigest: z.ZodString;
+    provider: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>;
+/** One plugin-provided Runner execution attempt with a PRP connection. Secrets are transient RPC input. */
+export declare const environmentTaskOperationSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"describe">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"copilot_metadata">;
+    token: z.ZodString;
+    model: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"prepare">;
+    requirements: z.ZodObject<{
+        schema: z.ZodLiteral<"paperclip.runner.launch-requirements.v1">;
+        identity: z.ZodObject<{
+            runnerInstanceId: z.ZodString;
+            environmentLeaseId: z.ZodString;
+            runId: z.ZodString;
+            normalizedSessionId: z.ZodString;
+            turnId: z.ZodString;
+            itemId: z.ZodString;
+        }, z.core.$strict>;
+        provider: z.ZodEnum<{
+            acpx: "acpx";
+            aws_agentcore: "aws_agentcore";
+            claude_managed: "claude_managed";
+            codex: "codex";
+            opencode: "opencode";
+        }>;
+        model: z.ZodNullable<z.ZodString>;
+        instructions: z.ZodString;
+        runtimeContext: z.ZodNullable<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        settings: z.ZodObject<{
+            acpxAgent: z.ZodOptional<z.ZodString>;
+            acpxMode: z.ZodOptional<z.ZodString>;
+            acpxPermissionMode: z.ZodOptional<z.ZodEnum<{
+                "approve-all": "approve-all";
+                "approve-paperclip": "approve-paperclip";
+                "approve-reads": "approve-reads";
+                "deny-all": "deny-all";
+            }>>;
+            acpxPermissionModePinned: z.ZodOptional<z.ZodBoolean>;
+            piThinkingLevel: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                low: "low";
+                max: "max";
+                off: "off";
+            }>>;
+            claudeEffort: z.ZodOptional<z.ZodEnum<{
+                high: "high";
+                low: "low";
+                max: "max";
+                medium: "medium";
+                xhigh: "xhigh";
+            }>>;
+            opencodePermissionMode: z.ZodOptional<z.ZodEnum<{
+                allow: "allow";
+                ask: "ask";
+                deny: "deny";
+            }>>;
+            managedProfile: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+            agentCoreProfile: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
+        }, z.core.$strict>;
+        approvalPolicy: z.ZodEnum<{
+            never: "never";
+            "on-request": "on-request";
+            untrusted: "untrusted";
+        }>;
+        readOnly: z.ZodBoolean;
+        preparedConversation: z.ZodBoolean;
+        includeCollaborationModeInstructions: z.ZodBoolean;
+    }, z.core.$strict>;
+    recovery: z.ZodOptional<z.ZodObject<{
+        configurationId: z.ZodString;
+        requirementsDigest: z.ZodString;
+        provider: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>>;
+    resumeFrom: z.ZodOptional<z.ZodString>;
+    projectIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"submit">;
+    projectIds: z.ZodArray<z.ZodString>;
+    runner: z.ZodObject<{
+        protocolMin: z.ZodNumber;
+        protocolMax: z.ZodNumber;
+        harness: z.ZodString;
+        runnerId: z.ZodString;
+        leaseId: z.ZodString;
+        runId: z.ZodString;
+        sessionId: z.ZodString;
+        turnId: z.ZodString;
+        itemId: z.ZodString;
+    }, z.core.$strict>;
+    bootstrapTicket: z.ZodString;
+    resumeFrom: z.ZodOptional<z.ZodString>;
+    preparedLaunchId: z.ZodOptional<z.ZodString>;
+    credentialIdentity: z.ZodOptional<z.ZodString>;
+    accountIdentity: z.ZodOptional<z.ZodString>;
+    credential: z.ZodOptional<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"codex-auth-json">;
+        authJson: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"claude-env">;
+        environment: z.ZodObject<{
+            CLAUDE_CODE_OAUTH_TOKEN: z.ZodOptional<z.ZodString>;
+            ANTHROPIC_API_KEY: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "type">>;
+    launch: z.ZodOptional<z.ZodObject<{
+        runnerVersion: z.ZodString;
+        runnerDigest: z.ZodString;
+        maxOutboxBytes: z.ZodNumber;
+        p0ReserveBytes: z.ZodNumber;
+        maxRuntimeMs: z.ZodOptional<z.ZodNumber>;
+        maxLifetimeMs: z.ZodOptional<z.ZodNumber>;
+        reconnectGraceMs: z.ZodOptional<z.ZodNumber>;
+        lifecyclePolicy: z.ZodObject<{
+            mode: z.ZodLiteral<"per_turn">;
+            idleTimeoutMs: z.ZodNull;
+        }, z.core.$strict>;
+    }, z.core.$strict>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"check_project_auth">;
+    configurationId: z.ZodString;
+    provider: z.ZodString;
+    projectIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"read_file">;
+    identity: z.ZodObject<{
+        runnerInstanceId: z.ZodString;
+        environmentLeaseId: z.ZodString;
+        runId: z.ZodString;
+        normalizedSessionId: z.ZodString;
+        turnId: z.ZodString;
+        itemId: z.ZodString;
+    }, z.core.$strict>;
+    path: z.ZodString;
+    maxBytes: z.ZodNumber;
+    projectIds: z.ZodArray<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"read_state">;
+    identity: z.ZodObject<{
+        runnerInstanceId: z.ZodString;
+        environmentLeaseId: z.ZodString;
+        runId: z.ZodString;
+        normalizedSessionId: z.ZodString;
+        turnId: z.ZodString;
+        itemId: z.ZodString;
+    }, z.core.$strict>;
+    resumeFrom: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"archive_state">;
+    priorIdentity: z.ZodObject<{
+        runnerInstanceId: z.ZodString;
+        environmentLeaseId: z.ZodString;
+        runId: z.ZodString;
+        normalizedSessionId: z.ZodString;
+        turnId: z.ZodString;
+        itemId: z.ZodString;
+    }, z.core.$strict>;
+    archiveKey: z.ZodString;
+    resumeFrom: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"credentials">;
+    accountIdentity: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"status">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"complete">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"stop">;
+}, z.core.$strict>], "kind">;
+export declare const environmentTaskResultSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    kind: z.ZodLiteral<"accepted">;
+    taskId: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"copilot_metadata">;
+    taskId: z.ZodString;
+    metadata: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    executionStopped: z.ZodLiteral<true>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"project_auth">;
+    taskId: z.ZodString;
+    configurationId: z.ZodString;
+    provider: z.ZodString;
+    allowed: z.ZodBoolean;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"file">;
+    taskId: z.ZodString;
+    base64: z.ZodString;
+    byteSize: z.ZodNumber;
+    sha256: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"state">;
+    taskId: z.ZodString;
+    state: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"prepared">;
+    taskId: z.ZodString;
+    launch: z.ZodObject<{
+        configurationId: z.ZodString;
+        requirementsDigest: z.ZodString;
+        provider: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    }, z.core.$strict>;
+    projectAuthCheckAtSubmit: z.ZodOptional<z.ZodLiteral<true>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"credentials">;
+    taskId: z.ZodString;
+    credential: z.ZodNullable<z.ZodDiscriminatedUnion<[z.ZodObject<{
+        type: z.ZodLiteral<"codex-auth-json">;
+        authJson: z.ZodString;
+    }, z.core.$strict>, z.ZodObject<{
+        type: z.ZodLiteral<"claude-env">;
+        environment: z.ZodObject<{
+            CLAUDE_CODE_OAUTH_TOKEN: z.ZodOptional<z.ZodString>;
+            ANTHROPIC_API_KEY: z.ZodOptional<z.ZodString>;
+        }, z.core.$strict>;
+    }, z.core.$strict>], "type">>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"description">;
+    taskId: z.ZodString;
+    runner: z.ZodObject<{
+        version: z.ZodString;
+        digest: z.ZodString;
+    }, z.core.$strict>;
+    launchPreparationVersion: z.ZodOptional<z.ZodLiteral<1>>;
+    freshWorkspaceVersion: z.ZodOptional<z.ZodLiteral<1>>;
+    projectAuthCheckVersion: z.ZodOptional<z.ZodLiteral<1>>;
+    workspaceFileReadVersion: z.ZodOptional<z.ZodLiteral<1>>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"status">;
+    taskId: z.ZodString;
+    phase: z.ZodEnum<{
+        cancelled: "cancelled";
+        completed: "completed";
+        failed: "failed";
+        interrupted: "interrupted";
+        preparing: "preparing";
+        running: "running";
+    }>;
+    exitCode: z.ZodOptional<z.ZodNumber>;
+    executionStopped: z.ZodOptional<z.ZodBoolean>;
+    sessionStateAvailable: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"connection">;
+    taskId: z.ZodString;
+    endpoint: z.ZodObject<{
+        kind: z.ZodLiteral<"authenticated_websocket">;
+        websocketUrl: z.ZodString;
+        generation: z.ZodString;
+        secretHeaders: z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            value: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strict>;
+}, z.core.$strict>], "kind">;
+export type PluginEnvironmentRunnerLaunchRequirements = z.infer<typeof environmentRunnerLaunchRequirementsSchema>;
+export type PluginEnvironmentPreparedLaunch = z.infer<typeof preparedLaunch>;
+export type PluginEnvironmentTaskOperation = z.infer<typeof environmentTaskOperationSchema>;
+export type PluginEnvironmentTaskResult = z.infer<typeof environmentTaskResultSchema>;
+export interface PluginEnvironmentTaskParams extends Omit<PluginEnvironmentDriverBaseParams, "environmentId"> {
+    /** Null during cleanup after the environment is deleted. */
+    environmentId: string | null;
+    lease: PluginEnvironmentLease;
+    /** Provider-issued task identifier persisted in the lease, stable across ambiguous submission retries. */
+    taskId: string;
+    /** Null during cleanup after the associated run is deleted. */
+    runId: string | null;
+    agentId: string | null;
+    /** Company-validated projects to prepare on submit; empty during cleanup. */
+    projectIds: string[];
+    workspace?: import("@paperclipai/shared").WorkspaceProviderBinding;
+    fresh?: import("./workspace-provider.js").PluginFreshWorkspace;
+    operation: PluginEnvironmentTaskOperation;
+}
+/** An accepted stop is not proof of process termination. */
+export declare function parseEnvironmentTaskResult(operation: PluginEnvironmentTaskOperation, taskId: string, value: unknown): PluginEnvironmentTaskResult;
+export {};
+//# sourceMappingURL=environment-tasks.d.ts.map

package/dist/environment-tasks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-tasks.d.ts","sourceRoot":"","sources":["../src/environment-tasks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,iCAAiC,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAE/F,eAAO,MAAM,+BAA+B,QAAmB,CAAC;AAiBhE,wGAAwG;AACxG,eAAO,MAAM,+BAA+B;;;;;;;;;4BAK1C,CAAC;AACH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAE9F,kGAAkG;AAClG,eAAO,MAAM,yCAAyC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAe3C,CAAC;AACZ,QAAA,MAAM,cAAc;;;;kBAGT,CAAC;AAEZ,2GAA2G;AAC3G,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAmDzC,CAAC;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BA0CtC,CAAC;AAEH,MAAM,MAAM,yCAAyC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yCAAyC,CAAC,CAAC;AAClH,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE7E,MAAM,MAAM,8BAA8B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAC5F,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEtF,MAAM,WAAW,2BAA4B,SAAQ,IAAI,CAAC,iCAAiC,EAAE,eAAe,CAAC;IAC3G,4DAA4D;IAC5D,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,sBAAsB,CAAC;IAC9B,0GAA0G;IAC1G,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,qBAAqB,EAAE,wBAAwB,CAAC;IACnE,KAAK,CAAC,EAAE,OAAO,yBAAyB,EAAE,oBAAoB,CAAC;IAC/D,SAAS,EAAE,8BAA8B,CAAC;CAC3C;AAED,4DAA4D;AAC5D,wBAAgB,0BAA0B,CAAC,SAAS,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,2BAA2B,CAKjJ"}