@provos/ironcurtain 0.1.0

package/dist/sandbox/index.js

@@ -0,0 +1,178 @@
+/**
+ * Sandbox -- Sets up UTCP Code Mode with the MCP proxy server.
+ *
+ * Code Mode creates a sandboxed TypeScript execution environment where
+ * LLM-generated code runs with no direct access to the network, filesystem,
+ * or credentials. Instead of connecting to real MCP servers, it connects
+ * to our MCP proxy server which evaluates policy on every tool call.
+ */
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import '@utcp/mcp'; // Register MCP call template type with UTCP SDK
+import { CodeModeUtcpClient } from '@utcp/code-mode';
+// Detect compiled (.js in dist/) vs source (.ts in src/) mode.
+// In compiled mode, spawn with `node`; in source mode, spawn with `npx tsx`.
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
+const isCompiled = __filename.endsWith('.js');
+const proxyServerPath = resolve(__dirname, `../trusted-process/mcp-proxy-server.${isCompiled ? 'js' : 'ts'}`);
+const PROXY_COMMAND = isCompiled ? 'node' : 'npx';
+const PROXY_ARGS = isCompiled ? [proxyServerPath] : ['tsx', proxyServerPath];
+/**
+ * Transforms a UTCP tool name (dotted) into the actual callable function name
+ * in the sandbox. Mirrors UTCP Code Mode's sanitizeIdentifier() behavior:
+ * split on first dot (manual name), join remaining parts with underscores.
+ *
+ * Example: "filesystem.filesystem.list_directory" → "filesystem.filesystem_list_directory"
+ */
+export function toCallableName(toolName) {
+    const sanitize = (s) => s.replace(/[^a-zA-Z0-9_]/g, '_').replace(/^[0-9]/, '_$&');
+    if (!toolName.includes('.'))
+        return sanitize(toolName);
+    const [manual, ...parts] = toolName.split('.');
+    return `${sanitize(manual)}.${parts.map(sanitize).join('_')}`;
+}
+/**
+ * Extracts required parameter names from a tool's JSON Schema inputs
+ * to show inline in the catalog, e.g. "{ path }" or "{ path, content }".
+ */
+function extractRequiredParams(inputs) {
+    if (!inputs?.required?.length)
+        return '';
+    return `{ ${inputs.required.join(', ')} }`;
+}
+/**
+ * Builds a JavaScript snippet that patches __getToolInterface inside the
+ * sandbox isolate so that callable names (with underscores) resolve to
+ * the same interface as the raw UTCP tool names (with dots).
+ *
+ * UTCP Code Mode keys its interface map by raw tool name (e.g.,
+ * "tools.git.git_add") but the callable function name the agent sees
+ * uses underscores (e.g., "tools.git_git_add"). Without this patch,
+ * __getToolInterface(callableName) returns null.
+ */
+function buildInterfacePatchSnippet(callableToRawMap) {
+    const mapJson = JSON.stringify(callableToRawMap);
+    // The snippet runs inside the V8 isolate before user code.
+    // It wraps the existing __getToolInterface to also accept callable names.
+    return `
+    (function() {
+      var _callableToRaw = ${mapJson};
+      var _origGetToolInterface = global.__getToolInterface;
+      if (_origGetToolInterface) {
+        global.__getToolInterface = function(toolName) {
+          var result = _origGetToolInterface(toolName);
+          if (result) return result;
+          var rawName = _callableToRaw[toolName];
+          if (rawName) return _origGetToolInterface(rawName);
+          return null;
+        };
+      }
+    })();
+  `;
+}
+export class Sandbox {
+    client = null;
+    toolCatalog = '';
+    interfacePatchSnippet = '';
+    async initialize(config) {
+        this.client = await CodeModeUtcpClient.create();
+        // Register the MCP proxy server instead of real MCP servers.
+        // The proxy is the trusted process boundary -- it evaluates policy
+        // on every tool call before forwarding to the real MCP server.
+        const proxyEnv = {
+            AUDIT_LOG_PATH: config.auditLogPath,
+            MCP_SERVERS_CONFIG: JSON.stringify(config.mcpServers),
+            GENERATED_DIR: config.generatedDir,
+            PROTECTED_PATHS: JSON.stringify(config.protectedPaths),
+            ALLOWED_DIRECTORY: config.allowedDirectory,
+        };
+        // Pass the escalation directory to the proxy when configured.
+        // When set, the proxy uses file-based IPC for escalation instead of auto-deny.
+        if (config.escalationDir) {
+            proxyEnv.ESCALATION_DIR = config.escalationDir;
+        }
+        // Pass the session log path so the proxy can capture child process stderr.
+        if (config.sessionLogPath) {
+            proxyEnv.SESSION_LOG_PATH = config.sessionLogPath;
+        }
+        // Pass escalation timeout to the proxy process and use it for the sandbox timeout.
+        // The sandbox timeout must accommodate human escalation approval time.
+        proxyEnv.ESCALATION_TIMEOUT_SECONDS = String(config.escalationTimeoutSeconds);
+        const timeoutMs = config.escalationTimeoutSeconds * 1000;
+        // Pass sandbox availability policy to the proxy process
+        proxyEnv.SANDBOX_POLICY = config.sandboxPolicy ?? 'warn';
+        // Register one proxy per backend server so UTCP names them cleanly:
+        //   tools.<serverName>_<toolName>(...)
+        // Each proxy gets a SERVER_FILTER env var to connect only to its server.
+        const mcpServers = {};
+        for (const serverName of Object.keys(config.mcpServers)) {
+            mcpServers[serverName] = {
+                transport: 'stdio',
+                command: PROXY_COMMAND,
+                args: [...PROXY_ARGS],
+                env: { ...proxyEnv, SERVER_FILTER: serverName },
+                timeout: timeoutMs,
+            };
+        }
+        await this.client.registerManual({
+            name: 'tools',
+            call_template_type: 'mcp',
+            config: { mcpServers },
+        });
+        const { catalog, patchSnippet } = await this.buildToolCatalogAndPatch();
+        this.toolCatalog = catalog;
+        this.interfacePatchSnippet = patchSnippet;
+    }
+    /**
+     * Builds the tool catalog and the __getToolInterface patch in one pass.
+     *
+     * The catalog is a compact one-line-per-tool listing using callable names.
+     * The patch snippet maps callable names back to raw UTCP names so that
+     * __getToolInterface works with either naming convention.
+     */
+    async buildToolCatalogAndPatch() {
+        if (!this.client)
+            throw new Error('Sandbox not initialized');
+        const tools = await this.client.getTools();
+        if (tools.length === 0)
+            return { catalog: 'No tools available', patchSnippet: '' };
+        const callableToRaw = {};
+        const catalogLines = [];
+        for (const t of tools) {
+            const callableName = toCallableName(t.name);
+            const params = extractRequiredParams(t.inputs);
+            catalogLines.push(`- \`${callableName}(${params})\` — ${t.description}`);
+            // Only add mapping when the names actually differ
+            if (callableName !== t.name) {
+                callableToRaw[callableName] = t.name;
+            }
+        }
+        const patchSnippet = Object.keys(callableToRaw).length > 0
+            ? buildInterfacePatchSnippet(callableToRaw)
+            : '';
+        return { catalog: catalogLines.join('\n'), patchSnippet };
+    }
+    getToolInterfaces() {
+        return this.toolCatalog;
+    }
+    async executeCode(code, timeoutMs = 300000) {
+        if (!this.client)
+            throw new Error('Sandbox not initialized');
+        // Prepend the interface patch so __getToolInterface accepts callable names.
+        // Each callToolChain invocation creates a fresh V8 isolate, so the patch
+        // must be re-applied every time.
+        const patchedCode = this.interfacePatchSnippet
+            ? `${this.interfacePatchSnippet}\n${code}`
+            : code;
+        const { result, logs } = await this.client.callToolChain(patchedCode, timeoutMs);
+        return { result, logs: logs ?? [] };
+    }
+    async shutdown() {
+        if (this.client) {
+            await this.client.close();
+            this.client = null;
+        }
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/sandbox/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/sandbox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,WAAW,CAAC,CAAC,gDAAgD;AACpE,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAGrD,+DAA+D;AAC/D,6EAA6E;AAC7E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AACtC,MAAM,UAAU,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9C,MAAM,eAAe,GAAG,OAAO,CAAC,SAAS,EAAE,uCAAuC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AAC9G,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;AAClD,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;AAE7E;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAE,EAAE,CAC7B,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC5D,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/C,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,MAAsE;IACnG,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;AAC7C,CAAC;AAOD;;;;;;;;;GASG;AACH,SAAS,0BAA0B,CAAC,gBAAwC;IAC1E,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACjD,2DAA2D;IAC3D,0EAA0E;IAC1E,OAAO;;6BAEoB,OAAO;;;;;;;;;;;;GAYjC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,OAAO;IACV,MAAM,GAA8B,IAAI,CAAC;IACzC,WAAW,GAAW,EAAE,CAAC;IACzB,qBAAqB,GAAW,EAAE,CAAC;IAE3C,KAAK,CAAC,UAAU,CAAC,MAAyB;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,CAAC;QAEhD,6DAA6D;QAC7D,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,QAAQ,GAA2B;YACvC,cAAc,EAAE,MAAM,CAAC,YAAY;YACnC,kBAAkB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC;YACrD,aAAa,EAAE,MAAM,CAAC,YAAY;YAClC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,cAAc,CAAC;YACtD,iBAAiB,EAAE,MAAM,CAAC,gBAAgB;SAC3C,CAAC;QAEF,8DAA8D;QAC9D,+EAA+E;QAC/E,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC;QACjD,CAAC;QAED,2EAA2E;QAC3E,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,QAAQ,CAAC,gBAAgB,GAAG,MAAM,CAAC,cAAc,CAAC;QACpD,CAAC;QAED,mFAAmF;QACnF,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,GAAG,MAAM,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAC9E,MAAM,SAAS,GAAG,MAAM,CAAC,wBAAwB,GAAG,IAAI,CAAC;QAEzD,wDAAwD;QACxD,QAAQ,CAAC,cAAc,GAAG,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC;QAEzD,oEAAoE;QACpE,uCAAuC;QACvC,yEAAyE;QACzE,MAAM,UAAU,GAMX,EAAE,CAAC;QACR,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,UAAU,CAAC,UAAU,CAAC,GAAG;gBACvB,SAAS,EAAE,OAAO;gBAClB,OAAO,EAAE,aAAa;gBACtB,IAAI,EAAE,CAAC,GAAG,UAAU,CAAC;gBACrB,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,UAAU,EAAE;gBAC/C,OAAO,EAAE,SAAS;aACnB,CAAC;QACJ,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC;YAC/B,IAAI,EAAE,OAAO;YACb,kBAAkB,EAAE,KAAK;YACzB,MAAM,EAAE,EAAE,UAAU,EAAE;SACvB,CAAC,CAAC;QAEH,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAC;QACxE,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC;QAC3B,IAAI,CAAC,qBAAqB,GAAG,YAAY,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB;QACpC,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAE7D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;QAEnF,MAAM,aAAa,GAA2B,EAAE,CAAC;QACjD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,YAAY,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC5C,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/C,YAAY,CAAC,IAAI,CAAC,OAAO,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAEzE,kDAAkD;YAClD,IAAI,YAAY,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5B,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC;YACxD,CAAC,CAAC,0BAA0B,CAAC,aAAa,CAAC;YAC3C,CAAC,CAAC,EAAE,CAAC;QAEP,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5D,CAAC;IAED,iBAAiB;QACf,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY,EAAE,SAAS,GAAG,MAAM;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QAE7D,4EAA4E;QAC5E,yEAAyE;QACzE,iCAAiC;QACjC,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB;YAC5C,CAAC,CAAC,GAAG,IAAI,CAAC,qBAAqB,KAAK,IAAI,EAAE;YAC1C,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;QACjF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,QAAQ;QACZ,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;CACF"}

package/dist/session/agent-session.d.ts

@@ -0,0 +1,83 @@
+/**
+ * AgentSession -- concrete Session implementation.
+ *
+ * Not exported from the public API. Callers use the Session interface
+ * via createSession() in index.ts.
+ */
+import type { IronCurtainConfig } from '../config/types.js';
+import type { Session, SessionId, SessionInfo, SessionOptions, ConversationTurn, DiagnosticEvent, EscalationRequest, BudgetStatus } from './types.js';
+export declare class AgentSession implements Session {
+    private readonly sessionId;
+    private status;
+    private readonly config;
+    private sandbox;
+    private readonly createdAt;
+    private readonly sandboxFactory;
+    private readonly escalationDir;
+    /** Raw AI SDK message history. */
+    private messages;
+    /** Structured turn log exposed through getHistory(). */
+    private turns;
+    /** Accumulated diagnostic events exposed through getDiagnosticLog(). */
+    private diagnosticLog;
+    /** System prompt, built once after sandbox initialization. */
+    private systemPrompt;
+    /** The tool set, built once after sandbox initialization. */
+    private tools;
+    /** Language model, optionally wrapped with logging middleware. */
+    private model;
+    /** Currently pending escalation, if any. */
+    private pendingEscalation;
+    /** Interval handle for polling the escalation directory. */
+    private escalationPollInterval;
+    /** Escalation IDs already detected, to prevent re-detection after resolution. */
+    private seenEscalationIds;
+    /** Step-level loop detector for the agent. */
+    private loopDetector;
+    /** Resource budget tracker for token, step, time, and cost limits. */
+    private readonly budgetTracker;
+    /** Message compactor for auto-summarizing older messages. */
+    private readonly compactor;
+    /** Last step's input token count, used by the compactor to detect threshold. */
+    private lastStepInputTokens;
+    /** Callbacks from SessionOptions. */
+    private readonly onEscalation?;
+    private readonly onDiagnostic?;
+    constructor(config: IronCurtainConfig, sessionId: SessionId, escalationDir: string, options?: SessionOptions);
+    /**
+     * Initialize the session's sandbox and build the tool set.
+     * Called by the factory function, not by external callers.
+     */
+    initialize(): Promise<void>;
+    getInfo(): SessionInfo;
+    sendMessage(userMessage: string): Promise<string>;
+    getHistory(): readonly ConversationTurn[];
+    getDiagnosticLog(): readonly DiagnosticEvent[];
+    getPendingEscalation(): EscalationRequest | undefined;
+    getBudgetStatus(): BudgetStatus;
+    resolveEscalation(escalationId: string, decision: 'approved' | 'denied'): Promise<void>;
+    close(): Promise<void>;
+    private buildTools;
+    private buildModel;
+    /** Logs a diagnostic event and forwards it to the transport callback. */
+    private emitDiagnostic;
+    private emitToolCallDiagnostics;
+    /** Analyze a step for loop detection and attach a warning if needed. */
+    private applyLoopVerdict;
+    private emitTruncationDiagnostic;
+    private emitLoopDetectionDiagnostic;
+    private emitBudgetWarnings;
+    private emitBudgetExhaustedDiagnostic;
+    private emitTextDiagnostic;
+    private recordTurn;
+    /**
+     * Starts polling the escalation directory for new request files.
+     * When a request is detected, sets pendingEscalation and fires
+     * the onEscalation callback.
+     */
+    private startEscalationWatcher;
+    private pollEscalationDirectory;
+    /** Extracts the escalation ID from a request filename like "request-abc123.json". */
+    private extractEscalationId;
+    private stopEscalationWatcher;
+}

package/dist/session/agent-session.js

@@ -0,0 +1,382 @@
+/**
+ * AgentSession -- concrete Session implementation.
+ *
+ * Not exported from the public API. Callers use the Session interface
+ * via createSession() in index.ts.
+ */
+import { generateText, stepCountIs, tool, wrapLanguageModel, } from 'ai';
+import { createLanguageModel } from '../config/model-provider.js';
+import { z } from 'zod';
+import { readFileSync, writeFileSync, readdirSync } from 'node:fs';
+import { createLlmLoggingMiddleware } from '../pipeline/llm-logger.js';
+import { resolve } from 'node:path';
+import { buildSystemPrompt } from './prompts.js';
+import { SessionNotReadyError, SessionClosedError, BudgetExhaustedError } from './errors.js';
+import { StepLoopDetector } from './step-loop-detector.js';
+import { ResourceBudgetTracker } from './resource-budget-tracker.js';
+import { MessageCompactor } from './message-compactor.js';
+import { truncateResult, getResultSizeLimit, formatKB } from './truncate-result.js';
+import * as logger from '../logger.js';
+const MAX_AGENT_STEPS = 100;
+const ESCALATION_POLL_INTERVAL_MS = 300;
+/** Default sandbox factory: creates a real UTCP Code Mode sandbox. */
+async function defaultSandboxFactory(config) {
+    const { Sandbox: SandboxClass } = await import('../sandbox/index.js');
+    const instance = new SandboxClass();
+    await instance.initialize(config);
+    return instance;
+}
+export class AgentSession {
+    sessionId;
+    status = 'initializing';
+    config;
+    sandbox = null;
+    createdAt;
+    sandboxFactory;
+    escalationDir;
+    /** Raw AI SDK message history. */
+    messages = [];
+    /** Structured turn log exposed through getHistory(). */
+    turns = [];
+    /** Accumulated diagnostic events exposed through getDiagnosticLog(). */
+    diagnosticLog = [];
+    /** System prompt, built once after sandbox initialization. */
+    systemPrompt = '';
+    /** The tool set, built once after sandbox initialization. */
+    tools = {};
+    /** Language model, optionally wrapped with logging middleware. */
+    model = null;
+    /** Currently pending escalation, if any. */
+    pendingEscalation;
+    /** Interval handle for polling the escalation directory. */
+    escalationPollInterval = null;
+    /** Escalation IDs already detected, to prevent re-detection after resolution. */
+    seenEscalationIds = new Set();
+    /** Step-level loop detector for the agent. */
+    loopDetector = new StepLoopDetector();
+    /** Resource budget tracker for token, step, time, and cost limits. */
+    budgetTracker;
+    /** Message compactor for auto-summarizing older messages. */
+    compactor;
+    /** Last step's input token count, used by the compactor to detect threshold. */
+    lastStepInputTokens = 0;
+    /** Callbacks from SessionOptions. */
+    onEscalation;
+    onDiagnostic;
+    constructor(config, sessionId, escalationDir, options = {}) {
+        this.sessionId = sessionId;
+        this.config = config;
+        this.escalationDir = escalationDir;
+        this.sandboxFactory = options.sandboxFactory ?? defaultSandboxFactory;
+        this.onEscalation = options.onEscalation;
+        this.onDiagnostic = options.onDiagnostic;
+        this.createdAt = new Date().toISOString();
+        this.budgetTracker = new ResourceBudgetTracker(config.userConfig.resourceBudget, config.agentModelId);
+        this.compactor = new MessageCompactor(config.userConfig.autoCompact);
+    }
+    /**
+     * Initialize the session's sandbox and build the tool set.
+     * Called by the factory function, not by external callers.
+     */
+    async initialize() {
+        this.sandbox = await this.sandboxFactory(this.config);
+        this.systemPrompt = buildSystemPrompt(this.sandbox.getToolInterfaces(), this.config.allowedDirectory);
+        this.tools = this.buildTools();
+        this.model = await this.buildModel();
+        this.startEscalationWatcher();
+        this.status = 'ready';
+    }
+    getInfo() {
+        return {
+            id: this.sessionId,
+            status: this.status,
+            turnCount: this.turns.length,
+            createdAt: this.createdAt,
+        };
+    }
+    async sendMessage(userMessage) {
+        if (this.status === 'closed')
+            throw new SessionClosedError();
+        if (this.status !== 'ready')
+            throw new SessionNotReadyError(this.status);
+        this.budgetTracker.startTurn();
+        this.status = 'processing';
+        const turnStart = new Date().toISOString();
+        const messageCountBefore = this.messages.length;
+        // Wall-clock abort signal (null when wall-clock budget is disabled)
+        const remainingMs = this.budgetTracker.getRemainingWallClockMs();
+        const abortController = remainingMs !== null ? new AbortController() : null;
+        const abortTimeout = abortController
+            ? setTimeout(() => abortController.abort(), remainingMs)
+            : null;
+        try {
+            this.messages.push({ role: 'user', content: userMessage });
+            // Auto-compact older messages if the previous turn exceeded the threshold
+            if (this.compactor.shouldCompact()) {
+                const compactionResult = await this.compactor.compact(this.messages, this.config.userConfig);
+                if (compactionResult) {
+                    this.emitDiagnostic({
+                        kind: 'message_compaction',
+                        originalMessageCount: compactionResult.originalMessageCount,
+                        newMessageCount: compactionResult.newMessageCount,
+                        summaryPreview: compactionResult.summaryPreview,
+                    });
+                }
+            }
+            const result = await generateText({
+                model: this.model,
+                system: this.systemPrompt,
+                messages: this.messages,
+                tools: this.tools,
+                stopWhen: [
+                    stepCountIs(MAX_AGENT_STEPS),
+                    this.budgetTracker.createStopCondition(),
+                ],
+                ...(abortController ? { abortSignal: abortController.signal } : {}),
+                onStepFinish: (stepResult) => {
+                    this.lastStepInputTokens = stepResult.usage?.inputTokens ?? 0;
+                    this.emitToolCallDiagnostics(stepResult.toolCalls);
+                    this.emitTextDiagnostic(stepResult.text);
+                    this.emitBudgetWarnings();
+                },
+            });
+            // Check if budget triggered the stop
+            const postCheck = this.budgetTracker.isExhausted();
+            if (postCheck) {
+                this.emitBudgetExhaustedDiagnostic(postCheck.dimension, postCheck.message);
+            }
+            this.messages.push(...result.response.messages);
+            // Record input tokens for the compactor's next-turn threshold check
+            this.compactor.recordInputTokens(this.lastStepInputTokens);
+            const turn = this.recordTurn(userMessage, result.text, result.totalUsage, turnStart);
+            this.turns.push(turn);
+            this.status = 'ready';
+            return result.text;
+        }
+        catch (error) {
+            // Truncate back to the state before this turn, removing the user
+            // message and any partial response messages that may have been pushed.
+            this.messages.length = messageCountBefore;
+            this.status = 'ready';
+            // Detect AbortError from wall-clock timeout
+            if (error instanceof Error && error.name === 'AbortError') {
+                const exhausted = this.budgetTracker.isExhausted();
+                const dimension = exhausted?.dimension ?? 'wall_clock';
+                const message = exhausted?.message ?? 'Session aborted: wall-clock time budget exceeded';
+                this.emitBudgetExhaustedDiagnostic(dimension, message);
+                throw new BudgetExhaustedError(dimension, message);
+            }
+            throw error;
+        }
+        finally {
+            if (abortTimeout !== null)
+                clearTimeout(abortTimeout);
+            this.budgetTracker.endTurn();
+        }
+    }
+    getHistory() {
+        return this.turns;
+    }
+    getDiagnosticLog() {
+        return this.diagnosticLog;
+    }
+    getPendingEscalation() {
+        return this.pendingEscalation;
+    }
+    getBudgetStatus() {
+        return {
+            ...this.budgetTracker.getSnapshot(),
+            limits: this.config.userConfig.resourceBudget,
+        };
+    }
+    async resolveEscalation(escalationId, decision) {
+        if (!this.pendingEscalation || this.pendingEscalation.escalationId !== escalationId) {
+            throw new Error(`No pending escalation with ID: ${escalationId}`);
+        }
+        const responsePath = resolve(this.escalationDir, `response-${escalationId}.json`);
+        writeFileSync(responsePath, JSON.stringify({ decision }));
+        this.pendingEscalation = undefined;
+    }
+    async close() {
+        if (this.status === 'closed')
+            return;
+        this.status = 'closed';
+        this.stopEscalationWatcher();
+        if (this.sandbox) {
+            await this.sandbox.shutdown();
+            this.sandbox = null;
+        }
+    }
+    // --- Private helpers ---
+    buildTools() {
+        return {
+            execute_code: tool({
+                description: 'Execute TypeScript code in a secure sandbox with access to filesystem tools. ' +
+                    'Write code that calls tool functions like filesystem.filesystem_read_file({ path }), ' +
+                    'filesystem.filesystem_list_directory({ path }), etc. ' +
+                    'Tools are synchronous — no await needed. Use return to provide results. ' +
+                    'Call __getToolInterface(\'tool.name\') to discover the full type signature of any tool.',
+                inputSchema: z.object({
+                    code: z
+                        .string()
+                        .describe('TypeScript code to execute in the sandbox'),
+                }),
+                execute: async ({ code }) => {
+                    if (!this.sandbox)
+                        throw new Error('Sandbox not initialized');
+                    const budgetBlock = this.budgetTracker.isExhausted();
+                    if (budgetBlock) {
+                        return { error: budgetBlock.message };
+                    }
+                    const blockCheck = this.loopDetector.isBlocked();
+                    if (blockCheck) {
+                        return { error: blockCheck.message };
+                    }
+                    try {
+                        const { result, logs } = await this.sandbox.executeCode(code);
+                        const output = {};
+                        if (logs.length > 0)
+                            output.console = logs;
+                        const truncation = truncateResult(result, getResultSizeLimit());
+                        output.result = truncation.value;
+                        if (truncation.truncated) {
+                            output.warning = `Tool result truncated from ${formatKB(truncation.originalSize)} to ${formatKB(truncation.finalSize)}. Use targeted reads (head/tail parameters) for specific portions.`;
+                            logger.warn(`[truncation] Result truncated: ${formatKB(truncation.originalSize)} -> ${formatKB(truncation.finalSize)}`);
+                            this.emitTruncationDiagnostic(truncation.originalSize, truncation.finalSize);
+                        }
+                        return this.applyLoopVerdict(code, output);
+                    }
+                    catch (err) {
+                        const output = {
+                            error: err instanceof Error ? err.message : String(err),
+                        };
+                        return this.applyLoopVerdict(code, output);
+                    }
+                },
+            }),
+        };
+    }
+    async buildModel() {
+        const baseModel = await createLanguageModel(this.config.agentModelId, this.config.userConfig);
+        if (!this.config.llmLogPath)
+            return baseModel;
+        const logContext = { stepName: 'agent' };
+        return wrapLanguageModel({
+            model: baseModel,
+            middleware: createLlmLoggingMiddleware(this.config.llmLogPath, logContext),
+        });
+    }
+    /** Logs a diagnostic event and forwards it to the transport callback. */
+    emitDiagnostic(event) {
+        this.diagnosticLog.push(event);
+        this.onDiagnostic?.(event);
+    }
+    emitToolCallDiagnostics(toolCalls) {
+        for (const tc of toolCalls) {
+            if (tc.toolName === 'execute_code' && tc.input != null) {
+                const input = tc.input;
+                const preview = input.code.substring(0, 120).replace(/\n/g, '\\n');
+                this.emitDiagnostic({
+                    kind: 'tool_call',
+                    toolName: tc.toolName,
+                    preview: `${preview}${input.code.length > 120 ? '...' : ''}`,
+                });
+            }
+        }
+    }
+    /** Analyze a step for loop detection and attach a warning if needed. */
+    applyLoopVerdict(code, output) {
+        const verdict = this.loopDetector.analyzeStep(code, output);
+        if (verdict.action === 'warn' || verdict.action === 'block') {
+            output.warning = output.warning
+                ? `${output.warning} | ${verdict.message}`
+                : verdict.message;
+            this.emitLoopDetectionDiagnostic(verdict.action, verdict.category, verdict.message);
+        }
+        return output;
+    }
+    emitTruncationDiagnostic(originalSize, finalSize) {
+        this.emitDiagnostic({
+            kind: 'result_truncation',
+            originalKB: +(originalSize / 1024).toFixed(1),
+            finalKB: +(finalSize / 1024).toFixed(1),
+        });
+    }
+    emitLoopDetectionDiagnostic(action, category, message) {
+        this.emitDiagnostic({ kind: 'loop_detection', action, category, message });
+    }
+    emitBudgetWarnings() {
+        for (const warning of this.budgetTracker.getActiveWarnings()) {
+            this.emitDiagnostic({
+                kind: 'budget_warning',
+                dimension: warning.dimension,
+                percentUsed: warning.percentUsed,
+                message: warning.message,
+            });
+        }
+    }
+    emitBudgetExhaustedDiagnostic(dimension, message) {
+        this.emitDiagnostic({ kind: 'budget_exhausted', dimension, message });
+    }
+    emitTextDiagnostic(text) {
+        if (!text)
+            return;
+        this.emitDiagnostic({
+            kind: 'agent_text',
+            preview: `${text.substring(0, 200)}${text.length > 200 ? '...' : ''}`,
+        });
+    }
+    recordTurn(userMessage, assistantResponse, usage, timestamp) {
+        return {
+            turnNumber: this.turns.length + 1,
+            userMessage,
+            assistantResponse,
+            usage: {
+                promptTokens: usage.inputTokens ?? 0,
+                completionTokens: usage.outputTokens ?? 0,
+                totalTokens: usage.totalTokens ?? 0,
+            },
+            timestamp,
+        };
+    }
+    /**
+     * Starts polling the escalation directory for new request files.
+     * When a request is detected, sets pendingEscalation and fires
+     * the onEscalation callback.
+     */
+    startEscalationWatcher() {
+        this.escalationPollInterval = setInterval(() => {
+            this.pollEscalationDirectory();
+        }, ESCALATION_POLL_INTERVAL_MS);
+    }
+    pollEscalationDirectory() {
+        if (this.pendingEscalation)
+            return;
+        try {
+            const files = readdirSync(this.escalationDir);
+            const requestFile = files.find(f => f.startsWith('request-') && f.endsWith('.json') &&
+                !this.seenEscalationIds.has(this.extractEscalationId(f)));
+            if (!requestFile)
+                return;
+            const requestPath = resolve(this.escalationDir, requestFile);
+            const request = JSON.parse(readFileSync(requestPath, 'utf-8'));
+            this.seenEscalationIds.add(request.escalationId);
+            this.pendingEscalation = request;
+            this.onEscalation?.(request);
+        }
+        catch {
+            // Directory may not exist yet or be empty -- ignore
+        }
+    }
+    /** Extracts the escalation ID from a request filename like "request-abc123.json". */
+    extractEscalationId(filename) {
+        return filename.replace(/^request-/, '').replace(/\.json$/, '');
+    }
+    stopEscalationWatcher() {
+        if (this.escalationPollInterval) {
+            clearInterval(this.escalationPollInterval);
+            this.escalationPollInterval = null;
+        }
+    }
+}
+//# sourceMappingURL=agent-session.js.map