@purista/harness 1.2.1 → 1.2.2

package/dist/sandbox/index.js

@@ -2,6 +2,10 @@ import { createRequire } from 'node:module';
 import path from 'node:path';
 import { OperationCancelledError, OperationTimeoutError, HarnessConfigError, SandboxError, SandboxNoExecutorError } from '../errors/index.js';
 const require = createRequire(import.meta.url);
+/** Returns true when a sandbox session can spawn long-lived processes. */
+export function isSpawnCapableSession(session) {
+    return typeof session.spawn === 'function';
+}
 function now() { return new Date().toISOString(); }
 function normalizePath(input) {
     if (!input.startsWith('/'))
@@ -63,7 +67,7 @@ class MemorySandboxSession {
             const relative = root === '/' ? k.slice(1) : k.slice(root.length + 1);
             if (!opts?.recursive && relative.includes('/'))
                 continue;
-            if (opts?.glob && !new RegExp(opts.glob.replaceAll('.', '\\.').replaceAll('*', '.*')).test(k))
+            if (opts?.glob && !globToRegExp(opts.glob).test(k))
                 continue;
             out.push({ name: k.split('/').at(-1) ?? '', path: k, kind: v.kind, ...(v.kind === 'file' ? { size: v.data.byteLength } : {}) });
         }
@@ -155,11 +159,44 @@ export function bashSandbox(opts) {
         }
     };
 }
+/**
+ * Translate a glob to a fully-anchored RegExp matched against the absolute
+ * path. `*`/`**` match any characters and `?` matches a single character; all
+ * other regex metacharacters are escaped to literals so a pattern can never
+ * throw a `SyntaxError` or trigger catastrophic backtracking. Anchoring both
+ * ends fixes the previous over-match (e.g. `*.ts` no longer matches `a.tsx`).
+ */
+function globToRegExp(glob) {
+    let out = '^';
+    for (let i = 0; i < glob.length; i += 1) {
+        const char = glob[i];
+        if (char === '*') {
+            out += '.*';
+            if (glob[i + 1] === '*')
+                i += 1;
+        }
+        else if (char === '?') {
+            out += '.';
+        }
+        else if (/[.+^${}()|[\]\\]/.test(char)) {
+            out += `\\${char}`;
+        }
+        else {
+            out += char;
+        }
+    }
+    return new RegExp(`${out}$`);
+}
 export function autoDetectSandbox() {
     try {
         return bashSandbox();
     }
-    catch {
-        return inMemorySandbox();
+    catch (error) {
+        // Only fall back to the no-executor sandbox when just-bash is absent.
+        // A real configuration/init error must surface, not silently downgrade.
+        if (error instanceof HarnessConfigError && error.meta?.reason === 'just_bash_not_installed') {
+            return inMemorySandbox();
+        }
+        throw error;
     }
 }

package/dist/sessions/index.d.ts

@@ -1,7 +1,8 @@
 import type { Logger } from '../logger/index.js';
-import type { Harness, HarnessDefaults, BuilderState, TelemetryOptions } from '../harness/defineHarness.js';
+import type { RunEvent, Harness, HarnessDefaults, BuilderState, TelemetryOptions } from '../harness/defineHarness.js';
 import type { MemoryAdapter } from '../ports/memory.js';
-import type { HarnessInspection } from '../ports/capabilities.js';
+import type { DurableRuntimeAdapter, HarnessInspection } from '../ports/capabilities.js';
+import type { DurableWorkspaceStore } from '../ports/workspace.js';
 import type { Sandbox } from '../sandbox/index.js';
 import type { StateStore } from '../ports/state.js';
 import { type TelemetryShim } from '../telemetry/index.js';
@@ -13,6 +14,8 @@ type HarnessDefinition<S extends BuilderState> = {
     state: StateStore;
     sandbox: Sandbox;
     memory: MemoryAdapter;
+    runtime?: DurableRuntimeAdapter;
+    workspaceStore?: DurableWorkspaceStore;
     defaults: HarnessDefaults;
     models: NonNullable<S['models']>;
     tools: NonNullable<S['tools']>;
@@ -21,5 +24,15 @@ type HarnessDefinition<S extends BuilderState> = {
     workflows: NonNullable<S['workflows']>;
     inspection: HarnessInspection;
 };
+/**
+ * Relay run events from an in-process run to a stream consumer.
+ *
+ * The unread events live in a bounded queue: consumed events are removed (no
+ * growing cursor over a shared array), and on overflow the oldest non-terminal
+ * unread event is dropped and counted, so a slow consumer never silently skips
+ * an unread event. Delivery is promise-notified rather than time-polled, so
+ * there is no fixed per-event latency or periodic timer.
+ */
+export declare function relayRunEvents(run: (onEvent: (event: RunEvent) => Promise<void>) => Promise<unknown>): AsyncIterable<RunEvent>;
 export declare function createSessionHarness<S extends BuilderState>(definition: HarnessDefinition<S>): Harness<S>;
 export {};

package/dist/sessions/index.js

@@ -3,6 +3,8 @@ import { ulid } from '../ulid/index.js';
 import { runDefaultAgent } from '../agents/index.js';
 import { runWorkflow } from '../workflows/index.js';
 import { createMemoryFacade, createSessionMemory } from '../ports/memory.js';
+import { beginDurableWorkflow, DURABLE_RUN_ID_PATTERN, isExecutableDurableRuntime } from '../runtime/sessionDurable.js';
+import { HarnessConfigError } from '../errors/catalog.js';
 import { loadSkillsSync } from '../skills/index.js';
 import { createModelRegistry } from '../models/registry.js';
 import { createMetrics, createTelemetryShim } from '../telemetry/index.js';
@@ -11,6 +13,82 @@ const NEVER_ABORT_SIGNAL = new AbortController().signal;
 function now() {
     return new Date().toISOString();
 }
+const STREAM_MAX_BUFFERED_EVENTS = 1024;
+const STREAM_TERMINAL_EVENT_TYPES = new Set(['run.finished', 'agent.finished']);
+/**
+ * Relay run events from an in-process run to a stream consumer.
+ *
+ * The unread events live in a bounded queue: consumed events are removed (no
+ * growing cursor over a shared array), and on overflow the oldest non-terminal
+ * unread event is dropped and counted, so a slow consumer never silently skips
+ * an unread event. Delivery is promise-notified rather than time-polled, so
+ * there is no fixed per-event latency or periodic timer.
+ */
+export async function* relayRunEvents(run) {
+    const queue = [];
+    let dropped = 0;
+    let liveRunId = 'unknown';
+    let done = false;
+    let failure;
+    let wake;
+    const notify = () => {
+        const resolve = wake;
+        wake = undefined;
+        resolve?.();
+    };
+    const result = run((event) => {
+        if ('runId' in event)
+            liveRunId = event.runId;
+        if (queue.length >= STREAM_MAX_BUFFERED_EVENTS) {
+            const dropIndex = queue.findIndex((candidate) => !STREAM_TERMINAL_EVENT_TYPES.has(candidate.type));
+            if (dropIndex >= 0) {
+                queue.splice(dropIndex, 1);
+                dropped += 1;
+            }
+        }
+        queue.push(event);
+        notify();
+        return Promise.resolve();
+    })
+        .catch((error) => {
+        failure = error;
+        return undefined;
+    })
+        .finally(() => {
+        done = true;
+        notify();
+    });
+    try {
+        while (true) {
+            if (dropped > 0) {
+                const droppedCount = dropped;
+                dropped = 0;
+                yield { type: 'stream.overflow', runId: liveRunId, at: now(), dropped: droppedCount };
+            }
+            while (queue.length > 0) {
+                yield queue.shift();
+                // Surface a fresh overflow notice promptly between events.
+                if (dropped > 0)
+                    break;
+            }
+            if (queue.length === 0 && dropped === 0) {
+                if (done) {
+                    break;
+                }
+                // No await between the empty check and installing `wake`, so a producer
+                // push cannot be lost between them.
+                await new Promise((resolve) => {
+                    wake = resolve;
+                });
+            }
+        }
+    }
+    finally {
+        await result.catch(() => undefined);
+    }
+    if (failure)
+        throw failure;
+}
 function validateInvokeOptions(opts) {
     if (opts?.historyWindow !== undefined && opts.historyWindow < 0) {
         throw new ValidationError('Invoke options are invalid.', { where: 'invoke_options', issues: { historyWindow: opts.historyWindow } });
@@ -30,6 +108,12 @@ function normalizeMessage(message, sessionId) {
 export function createSessionHarness(definition) {
     const resolvedSkills = loadSkillsSync(definition.skills);
     const sessionStates = new Map();
+    // In-flight session-state creations, memoized so concurrent first-time callers
+    // share one sandbox open (no orphaned sessions) and one SessionState object
+    // (so the synchronous busy check/set below serializes runs correctly).
+    const sessionStateOpenings = new Map();
+    // Stable per-harness-instance worker id used as the default durable lease owner.
+    const durableWorkerId = `worker_${ulid()}`;
     const contentCaptureMode = resolveContentCaptureMode(definition.telemetry);
     const telemetry = withTelemetryFlavor(definition.telemetryShim ?? createTelemetryShim(), definition.telemetry);
     const adapterMetrics = createMetrics(telemetry, { 'harness.name': definition.name });
@@ -45,6 +129,7 @@ export function createSessionHarness(definition) {
             toolTimeoutMs: definition.defaults.toolTimeoutMs ?? 120_000,
             skillTimeoutMs: definition.defaults.skillTimeoutMs ?? 60_000,
             modelTimeoutMs: definition.defaults.modelTimeoutMs ?? 300_000,
+            maxParallelToolCalls: definition.defaults.maxParallelToolCalls ?? 8,
             ...(definition.defaults.historyWindow !== undefined ? { historyWindow: definition.defaults.historyWindow } : {})
         }
     };
@@ -56,24 +141,36 @@ export function createSessionHarness(definition) {
         if (existing) {
             return existing;
         }
+        const createdAt = now();
         const created = {
             id: sessionId,
-            createdAt: now(),
-            updatedAt: now(),
+            createdAt,
+            updatedAt: createdAt,
             runCount: 0
         };
         await definition.state.upsertSession(created);
         return created;
     }
-    async function getSessionState(sessionId) {
+    function getSessionState(sessionId) {
         const existing = sessionStates.get(sessionId);
         if (existing) {
-            return existing;
+            return Promise.resolve(existing);
         }
-        const sandboxSession = await definition.sandbox.open({ sessionId, runId: `init_${ulid()}` });
-        const created = { busy: false, sandboxSession, mountedSkills: new Set() };
-        sessionStates.set(sessionId, created);
-        return created;
+        const pending = sessionStateOpenings.get(sessionId);
+        if (pending) {
+            return pending;
+        }
+        const opening = (async () => {
+            const sandboxSession = await definition.sandbox.open({ sessionId, runId: `init_${ulid()}` });
+            const created = { busy: false, sandboxSession, mountedSkills: new Set() };
+            sessionStates.set(sessionId, created);
+            sessionStateOpenings.delete(sessionId);
+            return created;
+        })();
+        // Let a failed open be retried instead of caching the rejection forever.
+        opening.catch(() => sessionStateOpenings.delete(sessionId));
+        sessionStateOpenings.set(sessionId, opening);
+        return opening;
     }
     async function appendEvents(runId, events) {
         try {
@@ -141,6 +238,21 @@ export function createSessionHarness(definition) {
     function memoryFacade(opts) {
         return createMemoryFacade(memoryOptions(opts.sessionId, opts.sandboxSession, opts.signal, opts));
     }
+    /**
+     * Validates `opts.durable` and returns the executable durable runtime, or
+     * `undefined` for an ephemeral run. Throws before any run record is created.
+     */
+    function resolveDurableRuntime(opts) {
+        if (!opts?.durable)
+            return undefined;
+        if (!DURABLE_RUN_ID_PATTERN.test(opts.durable.runId)) {
+            throw new ValidationError('Durable run id is invalid.', { where: 'invoke_options', issues: { 'durable.runId': opts.durable.runId } });
+        }
+        if (!isExecutableDurableRuntime(definition.runtime)) {
+            throw new HarnessConfigError('Durable execution requires an executable .runtime(...) adapter.', { reason: 'durable_runtime_required', path: 'runtime' });
+        }
+        return definition.runtime;
+    }
     return {
         inspect() {
             return definition.inspection;
@@ -202,14 +314,21 @@ export function createSessionHarness(definition) {
                             throw new ValidationError('Session history replacement failed validation.', { where: 'session_history', issues: { message } }, error);
                         }
                     });
-                    await definition.state.clearMessages(sessionId);
-                    if (parsed.length > 0) {
-                        await definition.state.appendMessages(sessionId, parsed);
+                    if (definition.state.replaceMessages) {
+                        await definition.state.replaceMessages(sessionId, parsed);
+                    }
+                    else {
+                        // Non-atomic fallback for adapters without atomic replace.
+                        await definition.state.clearMessages(sessionId);
+                        if (parsed.length > 0) {
+                            await definition.state.appendMessages(sessionId, parsed);
+                        }
                     }
                 },
                 async close() {
                     await definition.state.closeSession(sessionId);
                     sessionStates.delete(sessionId);
+                    sessionStateOpenings.delete(sessionId);
                     await state.sandboxSession.close();
                 }
             };
@@ -248,51 +367,13 @@ export function createSessionHarness(definition) {
         $infer: {}
     };
     async function* streamAgentCall(sessionId, agentId, agent, input, opts) {
-        const buffer = [];
-        const maxBufferedEvents = 1024;
-        let dropped = 0;
-        let done = false;
-        let failure;
-        let liveRunId = 'unknown';
-        const result = runAgentCall(sessionId, agentId, agent, input, opts, (event) => {
-            if ('runId' in event)
-                liveRunId = event.runId;
-            if (buffer.length >= maxBufferedEvents) {
-                const dropIndex = buffer.findIndex((candidate) => candidate.type !== 'run.finished');
-                if (dropIndex >= 0) {
-                    buffer.splice(dropIndex, 1);
-                    dropped += 1;
-                }
-            }
-            buffer.push(event);
-            return Promise.resolve();
-        }).catch((error) => {
-            failure = error;
-            return undefined;
-        }).finally(() => {
-            done = true;
-        });
-        let cursor = 0;
-        while (true) {
-            if (dropped > 0) {
-                yield { type: 'stream.overflow', runId: liveRunId, at: now(), dropped };
-                dropped = 0;
-            }
-            while (cursor < buffer.length) {
-                yield buffer[cursor];
-                cursor += 1;
-            }
-            if (done) {
-                await result.catch(() => undefined);
-                if (failure)
-                    throw failure;
-                return;
-            }
-            await new Promise((resolve) => setTimeout(resolve, 5));
-        }
+        yield* relayRunEvents((onEvent) => runAgentCall(sessionId, agentId, agent, input, opts, onEvent));
     }
     async function runAgentCall(sessionId, agentId, agent, input, opts, onEvent) {
         validateInvokeOptions(opts);
+        if (opts?.durable) {
+            throw new ValidationError('Durable execution is only supported for workflow runs.', { where: 'invoke_options', issues: { durable: 'agent_run' } });
+        }
         if (opts?.signal?.aborted) {
             throw new OperationCancelledError('Run was cancelled before start.', { scope: 'run' });
         }
@@ -363,6 +444,7 @@ export function createSessionHarness(definition) {
                     maxSteps: definition.defaults.agentMaxIterations ?? 16,
                     signal: runSignal.signal,
                     toolTimeoutMs: definition.defaults.toolTimeoutMs ?? 120_000,
+                    maxParallelToolCalls: definition.defaults.maxParallelToolCalls ?? 8,
                     logger: definition.logger,
                     telemetry,
                     emitEvent: emit,
@@ -418,51 +500,11 @@ export function createSessionHarness(definition) {
         }
     }
     async function* streamWorkflowCall(sessionId, workflowId, workflow, input, opts) {
-        const buffer = [];
-        const maxBufferedEvents = 1024;
-        let dropped = 0;
-        let done = false;
-        let failure;
-        let liveRunId = 'unknown';
-        const result = runWorkflowCall(sessionId, workflowId, workflow, input, opts, (event) => {
-            if ('runId' in event)
-                liveRunId = event.runId;
-            if (buffer.length >= maxBufferedEvents) {
-                const dropIndex = buffer.findIndex((candidate) => candidate.type !== 'run.finished');
-                if (dropIndex >= 0) {
-                    buffer.splice(dropIndex, 1);
-                    dropped += 1;
-                }
-            }
-            buffer.push(event);
-            return Promise.resolve();
-        }).catch((error) => {
-            failure = error;
-            return undefined;
-        }).finally(() => {
-            done = true;
-        });
-        let cursor = 0;
-        while (true) {
-            if (dropped > 0) {
-                yield { type: 'stream.overflow', runId: liveRunId, at: now(), dropped };
-                dropped = 0;
-            }
-            while (cursor < buffer.length) {
-                yield buffer[cursor];
-                cursor += 1;
-            }
-            if (done) {
-                await result.catch(() => undefined);
-                if (failure)
-                    throw failure;
-                return;
-            }
-            await new Promise((resolve) => setTimeout(resolve, 5));
-        }
+        yield* relayRunEvents((onEvent) => runWorkflowCall(sessionId, workflowId, workflow, input, opts, onEvent));
     }
     async function runWorkflowCall(sessionId, workflowId, workflow, input, opts, onEvent) {
         validateInvokeOptions(opts);
+        const durableRuntime = resolveDurableRuntime(opts);
         if (opts?.signal?.aborted) {
             throw new OperationCancelledError('Run was cancelled before start.', { scope: 'run' });
         }
@@ -473,7 +515,7 @@ export function createSessionHarness(definition) {
         }
         state.busy = true;
         const startedAt = now();
-        const runId = ulid();
+        const runId = opts?.durable ? opts.durable.runId : ulid();
         const memory = memoryFacade({
             sessionId,
             runId,
@@ -503,7 +545,22 @@ export function createSessionHarness(definition) {
             state.busy = false;
             throw error;
         }
+        let durableBinding;
         try {
+            if (durableRuntime && opts?.durable) {
+                durableBinding = await beginDurableWorkflow({
+                    runtime: durableRuntime,
+                    ...(definition.workspaceStore ? { workspaceStore: definition.workspaceStore } : {}),
+                    durable: opts.durable,
+                    defaultWorkerId: durableWorkerId,
+                    sessionId,
+                    workflowId,
+                    input: input,
+                    signal: runSignal.signal,
+                    logger: definition.logger,
+                    harnessName: definition.name
+                });
+            }
             const result = await withIncomingTraceContext(telemetry, opts, definition.logger, async () => telemetry.span('harness.session.prompt', {
                 'harness.name': definition.name,
                 'harness.session.id': sessionId,
@@ -532,6 +589,7 @@ export function createSessionHarness(definition) {
                         metadata: opts?.metadata ?? {},
                         metrics: workflowMetrics,
                         memory,
+                        step: durableBinding ? durableBinding.step : passthroughStep,
                         agents: Object.fromEntries(Object.entries(definition.agents).map(([agentId, agent]) => [
                             agentId,
                             async (agentInput, agentOpts) => {
@@ -568,6 +626,7 @@ export function createSessionHarness(definition) {
                                         maxSteps: definition.defaults.agentMaxIterations ?? 16,
                                         signal: agentSignal.signal,
                                         toolTimeoutMs: definition.defaults.toolTimeoutMs ?? 120_000,
+                                        maxParallelToolCalls: definition.defaults.maxParallelToolCalls ?? 8,
                                         logger: definition.logger,
                                         telemetry,
                                         emitEvent: emit,
@@ -597,6 +656,9 @@ export function createSessionHarness(definition) {
                 }));
             }));
             const finishedAt = now();
+            if (durableBinding) {
+                await guardDurableStep({ sessionId, runId, workflowId, operation: 'finish_success' }, () => durableBinding.finishSuccess(result));
+            }
             const runFinished = { type: 'run.finished', runId, at: finishedAt, output: result };
             await emit(runFinished);
             await definition.state.finishRun(runId, { status: 'succeeded', finishedAt, output: result });
@@ -608,6 +670,9 @@ export function createSessionHarness(definition) {
             const finalError = normalizeRunError(error, runSignal.signal);
             const finishedAt = now();
             const serialized = serializeError(finalError);
+            if (durableBinding && finalError instanceof OperationCancelledError) {
+                await guardDurableStep({ sessionId, runId, workflowId, operation: 'finish_cancelled' }, () => durableBinding.finishCancelled(finalError));
+            }
             const log = finalError instanceof OperationCancelledError ? definition.logger.warn.bind(definition.logger) : definition.logger.error.bind(definition.logger);
             log('Harness workflow run failed.', {
                 harness: definition.name,
@@ -637,10 +702,41 @@ export function createSessionHarness(definition) {
             throw finalError;
         }
         finally {
+            // Releases the lease for a non-cancel failure so a retry with the same run
+            // id can resume; a no-op once the run was settled (success/cancel).
+            if (durableBinding)
+                await durableBinding.dispose();
             runSignal.cleanup();
             state.busy = false;
         }
     }
+    /** Pass-through step used when a workflow runs without durable execution. */
+    function passthroughStep(_stepId, fn) {
+        return fn();
+    }
+    /**
+     * Runs a durable finalization side effect (runtime finish / workspace lifecycle)
+     * without ever masking the primary run outcome (spec 21 §16.1 step 7).
+     */
+    async function guardDurableStep(args, step) {
+        try {
+            await step();
+        }
+        catch (error) {
+            telemetry.recordCounter('harness.runs.durable_errors', 1, {
+                harness: definition.name,
+                'harness.run.durable.operation': args.operation
+            });
+            definition.logger.error('Durable finalization step failed; preserving run outcome.', {
+                harness: definition.name,
+                session_id: args.sessionId,
+                run_id: args.runId,
+                workflow_id: args.workflowId,
+                operation: args.operation,
+                error: serializeError(error)
+            });
+        }
+    }
     async function terminalizeFailedRun(args) {
         await runFailureTerminalizationStep(args, 'emit_run_finished', args.emitRunFinished);
         await runFailureTerminalizationStep(args, 'finish_run', args.finishRun);
@@ -869,6 +965,12 @@ function sanitizeEventForPersistence(event) {
             };
         case 'stream.overflow':
             return { dropped: event.dropped };
+        default: {
+            // Exhaustiveness guard: adding a RunEvent variant without updating this
+            // sanitizer becomes a compile error instead of silently persisting undefined.
+            event;
+            return {};
+        }
     }
 }
 function isJsonRecord(value) {
@@ -891,9 +993,11 @@ function normalizeSerializedRunError(error) {
 }
 function createRunSignal(parent, timeoutMs) {
     const controller = new AbortController();
-    const relay = () => controller.abort(parent?.reason);
+    const relay = () => controller.abort(runAbortReason(parent?.reason));
     if (parent)
         parent.addEventListener('abort', relay, { once: true });
+    if (parent?.aborted)
+        relay();
     const timeout = timeoutMs && timeoutMs > 0
         ? setTimeout(() => controller.abort(new OperationTimeoutError('Run timed out.', { scope: 'run', timeout_ms: timeoutMs })), timeoutMs)
         : undefined;
@@ -911,10 +1015,14 @@ function combineSignals(primary, secondary) {
     if (!secondary)
         return { signal: primary, cleanup: () => undefined };
     const controller = new AbortController();
-    const relayPrimary = () => controller.abort(primary.reason);
-    const relaySecondary = () => controller.abort(secondary.reason);
+    const relayPrimary = () => controller.abort(runAbortReason(primary.reason));
+    const relaySecondary = () => controller.abort(runAbortReason(secondary.reason));
     primary.addEventListener('abort', relayPrimary, { once: true });
     secondary.addEventListener('abort', relaySecondary, { once: true });
+    if (primary.aborted)
+        relayPrimary();
+    else if (secondary.aborted)
+        relaySecondary();
     return {
         signal: controller.signal,
         cleanup: () => {
@@ -923,3 +1031,8 @@ function combineSignals(primary, secondary) {
         }
     };
 }
+function runAbortReason(reason) {
+    if (reason instanceof OperationCancelledError || reason instanceof OperationTimeoutError)
+        return reason;
+    return new OperationCancelledError('Run was cancelled.', { scope: 'run' }, reason);
+}

package/dist/skills/index.js

@@ -178,16 +178,29 @@ export function loadSkillsSync(skills) {
 export async function loadSkills(skills) {
     return loadSkillsSync(skills);
 }
-async function readDirRecursive(root) {
+const SKILL_MOUNT_MAX_FILES = 5_000;
+const SKILL_MOUNT_MAX_BYTES = 100_000_000;
+async function readDirRecursive(root, skillId) {
     const files = new Map();
+    let totalBytes = 0;
     const walk = async (dir) => {
         const entries = await fsp.readdir(dir, { withFileTypes: true });
         for (const entry of entries) {
             const abs = path.join(dir, entry.name);
-            if (entry.isDirectory())
+            if (entry.isDirectory()) {
                 await walk(abs);
-            else if (entry.isFile())
-                files.set(path.posix.normalize(path.relative(root, abs).split(path.sep).join('/')), await fsp.readFile(abs));
+            }
+            else if (entry.isFile()) {
+                if (files.size >= SKILL_MOUNT_MAX_FILES) {
+                    throw new SkillManifestError('Skill exceeds the mount file-count limit.', { reason: 'scan_limit_reached', skill_id: skillId, directory: root });
+                }
+                const data = await fsp.readFile(abs);
+                totalBytes += data.byteLength;
+                if (totalBytes > SKILL_MOUNT_MAX_BYTES) {
+                    throw new SkillManifestError('Skill exceeds the mount byte limit.', { reason: 'scan_limit_reached', skill_id: skillId, directory: root });
+                }
+                files.set(path.posix.normalize(path.relative(root, abs).split(path.sep).join('/')), data);
+            }
         }
     };
     await walk(root);
@@ -195,7 +208,7 @@ async function readDirRecursive(root) {
 }
 export async function mountSkillsOnce(session, mounted, skills, skillIds) {
     if (skillIds.length > 0 && typeof session.mount !== 'function') {
-        throw new SkillManifestError('Sandbox does not support skill mounting.', { reason: 'invalid_frontmatter', directory: '' });
+        throw new SkillManifestError('Sandbox does not support skill mounting.', { reason: 'skill_sandbox_unsupported' });
     }
     for (const skillId of skillIds) {
         if (mounted.has(skillId))
@@ -203,7 +216,7 @@ export async function mountSkillsOnce(session, mounted, skills, skillIds) {
         const skill = skills[skillId];
         if (!skill)
             throw new SkillNotFoundError('Skill not found.', { skill_id: skillId });
-        const files = await readDirRecursive(skill.directory);
+        const files = await readDirRecursive(skill.directory, skillId);
         await session.mount(files, skill.mountPath);
         mounted.add(skillId);
     }

package/dist/state/in-memory.d.ts

@@ -18,6 +18,7 @@ export declare class InMemoryStateStore implements StateStore {
         before?: string;
     }): Promise<Message[]>;
     clearMessages(sessionId: string): Promise<void>;
+    replaceMessages(sessionId: string, messages: Message[]): Promise<void>;
     createRun(record: RunRecord): Promise<void>;
     finishRun(runId: string, patch: FinishRunPatch): Promise<void>;
     getRun(runId: string): Promise<RunRecord | undefined>;

package/dist/state/in-memory.js

@@ -32,6 +32,7 @@ export class InMemoryStateStore {
     async closeSession(id) {
         this.sessions.delete(id);
         this.messages.delete(id);
+        this.messageLocks.delete(id);
         for (const [runId, run] of this.runs) {
             if (run.sessionId === id) {
                 this.runs.delete(runId);
@@ -71,6 +72,20 @@ export class InMemoryStateStore {
             this.messages.delete(sessionId);
         });
     }
+    async replaceMessages(sessionId, messages) {
+        return this.withMessageLock(sessionId, async () => {
+            const ids = new Set();
+            for (const message of messages) {
+                if (ids.has(message.id)) {
+                    throw new StateError('Duplicate message id.', { op: 'appendMessages', reason: 'duplicate_message_id' });
+                }
+                ids.add(message.id);
+            }
+            // Atomic clear+append under one lock: validate first, then commit so a
+            // failure never leaves history partially replaced.
+            this.messages.set(sessionId, [...messages]);
+        });
+    }
     async createRun(record) {
         this.runs.set(record.id, record);
     }