@qduc/term2 0.29.0 → 0.30.0

package/dist/tools/system/run-code/run-code-agent-capability.js

@@ -0,0 +1,384 @@
+import { resolveAgentSpecForChild, } from '../../../services/agent-runtime/permission-boundary.js';
+import { applyApprovalGrant } from '../../../services/approval/approval-grant-executor.js';
+import { RUN_CODE_LIMITS } from './run-code-runtime.js';
+const ASYNC_LIFECYCLE_MEMBERS = ['start', 'status', 'result', 'cancel'];
+const isFunction = (value) => typeof value === 'function';
+/** True when at least one launch seam exists; gates capability existence. */
+export function isRunCodeAgentBridgeActive(bridge) {
+    if (!bridge)
+        return false;
+    const foreground = isFunction(bridge.runResolvedSubagent);
+    const asyncLifecycle = isFunction(bridge.runResolvedSubagentAsync) &&
+        isFunction(bridge.getSubagentResult) &&
+        isFunction(bridge.getSubagentStatus) &&
+        isFunction(bridge.cancelSubagentRun);
+    return foreground || asyncLifecycle;
+}
+/** The exact member list a bound bridge can serve; also rendered into the tool description. */
+export function getRunCodeAgentCapabilityMembers(bridge) {
+    const members = [];
+    if (isFunction(bridge.runResolvedSubagent))
+        members.push('run');
+    if (isFunction(bridge.runResolvedSubagentAsync) &&
+        isFunction(bridge.getSubagentResult) &&
+        isFunction(bridge.getSubagentStatus) &&
+        isFunction(bridge.cancelSubagentRun)) {
+        members.push(...ASYNC_LIFECYCLE_MEMBERS);
+    }
+    return members;
+}
+const isRecord = (value) => typeof value === 'object' && value !== null;
+const rejectCall = (error) => ({
+    kind: 'result',
+    result: { ok: false, error },
+});
+const isAbortError = (error) => error instanceof Error && error.name === 'AbortError';
+/**
+ * Extracts the pending tool call from a child run-loop interruption. Other
+ * interruption kinds — e.g. a child run-budget check-in — are not tool
+ * approvals: the caller leaves those pauses unapplied, so the child settles
+ * interrupted and the script keeps its existing catchable error.
+ */
+function extractChildToolApproval(interruption) {
+    if (!isRecord(interruption) || interruption.type !== 'tool_approval_item')
+        return undefined;
+    if (typeof interruption.name !== 'string' || interruption.name === '')
+        return undefined;
+    const argumentsText = typeof interruption.arguments === 'string' ? interruption.arguments : JSON.stringify(interruption.arguments ?? {});
+    let argumentsValue = {};
+    try {
+        argumentsValue = JSON.parse(argumentsText);
+    }
+    catch {
+        // Registry evaluation is fail-closed for arguments it cannot inspect.
+    }
+    return {
+        toolName: interruption.name,
+        argumentsText,
+        arguments: argumentsValue,
+        ...(typeof interruption.callId === 'string' ? { callId: interruption.callId } : {}),
+    };
+}
+/** `costRecords` and `nestedRunResult` are host-owned: possibly large, possibly not JSON-safe. */
+const projectNestedResult = (result) => {
+    const { costRecords: _costRecords, nestedRunResult: _nestedRunResult, ...projected } = result;
+    // The host re-serializes capability results through JSON, so any plain-data
+    // projection is transportable even without a JsonValue index signature.
+    return projected;
+};
+const AGENT_MEMBERS = ['run', 'start', 'status', 'result', 'cancel'];
+const LAUNCH_PARAM_FIELDS = new Set(['spec', 'worktree', 'name', 'continue_run_id']);
+/** Light, admission-time param checks. Deep AgentSpec validation is the boundary's job. */
+function launchParamError(member, params) {
+    const accepted = member === 'run' ? new Set(['spec', 'worktree']) : LAUNCH_PARAM_FIELDS;
+    for (const key of Object.keys(params)) {
+        if (!accepted.has(key))
+            return `unsupported param "${key}"; agent.${member} accepts ${[...accepted].join(', ')}.`;
+    }
+    if (!isRecord(params.spec) || Array.isArray(params.spec))
+        return 'spec must be a plain AgentSpec object.';
+    if (params.worktree !== undefined && typeof params.worktree !== 'string')
+        return 'worktree must be a string.';
+    if (params.name !== undefined && typeof params.name !== 'string')
+        return 'name must be a string.';
+    if (params.continue_run_id !== undefined && typeof params.continue_run_id !== 'string') {
+        return 'continue_run_id must be a string.';
+    }
+    if (member === 'start' && params.continue_run_id !== undefined) {
+        return 'continue_run_id is not supported by script agent.start until continuation authority can be verified.';
+    }
+    return undefined;
+}
+function lifecycleParamError(member, params) {
+    const accepted = member === 'status' ? new Set(['runId']) : new Set([member === 'result' ? 'runId' : 'target']);
+    for (const key of Object.keys(params)) {
+        if (!accepted.has(key))
+            return `unsupported param "${key}"; agent.${member} accepts ${[...accepted].join(', ')}.`;
+    }
+    const required = member === 'cancel' ? 'target' : 'runId';
+    if (member !== 'status' && (params[required] === undefined || typeof params[required] !== 'string')) {
+        return `${required} must be a string.`;
+    }
+    if (member === 'status' && params.runId !== undefined && typeof params.runId !== 'string') {
+        return 'runId must be a string.';
+    }
+    return undefined;
+}
+/**
+ * The script-only `agent` capability of one run_code invocation.
+ *
+ * Every launch resolves an untrusted script AgentSpec through
+ * `resolveAgentSpecForChild` against the host-bound root authority snapshot
+ * before any bridge callback sees it; the boundary result — never the raw
+ * spec — is what reaches the host bridge. Start admission is a synchronous
+ * check-and-increment before resolution, so a script can never race itself
+ * past the launch cap, and an over-cap start is rejected before the manager
+ * launches anything while already-admitted siblings continue untouched.
+ */
+export function createRunCodeAgentCapability(deps, invocation) {
+    const members = getRunCodeAgentCapabilityMembers(deps);
+    if (members.length === 0) {
+        throw new Error('run_code agent capability requires a resolved-launch or async lifecycle bridge.');
+    }
+    // Synchronous admission counter: `prepare` never awaits between the cap
+    // check and the increment, so concurrent script starts cannot exceed it.
+    let startsAdmitted = 0;
+    /**
+     * Builds the per-call publisher that surfaces one foreground child approval
+     * pause through the session-owned decision owner. The capability attaches it
+     * only when the session owner and policy registry are bound; the decision is
+     * applied to the pause's exact retained continuation through `pause.apply`,
+     * never from script data, and the human wait is bracketed with the host
+     * work-clock hooks so paused children do not burn the script timeout.
+     */
+    const childApprovalPublisher = (callContext) => {
+        const owner = deps.nestedApprovalOwner;
+        const registry = deps.approvalPolicyRegistry;
+        if (!owner || !registry)
+            return undefined;
+        return async (pause) => {
+            const approvalInfo = extractChildToolApproval(pause.interruption);
+            // Not a tool approval (e.g. a child run-budget check-in): leave the pause
+            // unapplied so the child settles interrupted and the script keeps its
+            // existing catchable error.
+            if (!approvalInfo)
+                return;
+            // The host wraps these on the handler per run; the clock pauses only
+            // while every admitted call is waiting.
+            handler.onWaiting?.(callContext);
+            try {
+                const resolution = await owner.request({
+                    requestId: `${pause.runId}:child-approval:${pause.generation}`,
+                    sessionId: deps.sessionId ?? 'unknown',
+                    graphIdentity: deps.graphIdentity ?? {},
+                    outerRunId: invocation.bridgeRunId,
+                    nestedCallId: pause.runId,
+                    toolName: approvalInfo.toolName,
+                    preparedArguments: approvalInfo.arguments,
+                    authorityContext: invocation.context,
+                    approval: {
+                        agentName: `Script child agent (${pause.role})`,
+                        toolName: approvalInfo.toolName,
+                        argumentsText: approvalInfo.argumentsText,
+                        rawInterruption: null,
+                        ...(approvalInfo.callId !== undefined ? { callId: approvalInfo.callId } : {}),
+                    },
+                    signal: callContext.signal,
+                    revalidate: async () => (await registry.evaluate({
+                        toolName: approvalInfo.toolName,
+                        args: approvalInfo.arguments,
+                        context: invocation.context,
+                    })).kind,
+                    grant: (decision) => {
+                        if (callContext.signal.aborted)
+                            throw new Error('Tool execution was not approved.');
+                        // Nested edit tools have no session edit-grant store. Do not claim
+                        // a durable child edit authorization by mutating the root's state.
+                        if (decision.answer === 'allow-edit-file-session' || decision.answer === 'allow-edit-folder-session') {
+                            throw new Error('Session edit grants are unavailable for script child agents.');
+                        }
+                        // Session-owned grant memory (allow-session edits, docker, denied
+                        // reads) applies exactly as the direct child approval path does.
+                        const applied = applyApprovalGrant({
+                            sessionId: deps.sessionId ?? 'unknown',
+                            nestedCompatibility: deps.nestedCompatibility,
+                            logger: deps.logger,
+                        }, {
+                            answer: decision.answer,
+                            toolName: approvalInfo.toolName,
+                            rawArguments: approvalInfo.argumentsText,
+                            callId: approvalInfo.callId,
+                            interruption: pause.interruption,
+                        });
+                        if (!applied.isApproved)
+                            throw new Error('Tool execution was not approved.');
+                        // One decision on the exact retained continuation: `apply` consumes
+                        // only this pause's generation and returns false when stale.
+                        const resumed = pause.apply(({ handle, interruption }) => {
+                            handle.approve?.(interruption);
+                            return true;
+                        });
+                        if (!resumed)
+                            throw new Error('The child approval pause is no longer current.');
+                    },
+                    // The child's own loop dispatches after its continuation is approved;
+                    // the host owns no tool call to run here.
+                    dispatch: async () => true,
+                });
+                if (resolution.kind === 'denied') {
+                    pause.apply(({ handle, interruption }) => {
+                        handle.reject?.(interruption, { message: resolution.message });
+                        return true;
+                    });
+                }
+                // `approved`: the grant already resumed the exact child continuation.
+                // `failed`: the grant threw before or while applying; the lease queue
+                // settles the child so the script keeps a truthful outcome.
+            }
+            finally {
+                handler.onResumed?.(callContext);
+            }
+        };
+    };
+    const handler = {
+        binding: { name: 'agent', kind: 'namespace', members },
+        limits: {
+            maxCalls: RUN_CODE_LIMITS.maxAgentCalls,
+            maxConcurrency: RUN_CODE_LIMITS.maxAgentConcurrency,
+            limitExceededMessage: `Agent call limit reached (${RUN_CODE_LIMITS.maxAgentCalls} agent.* calls per script run).`,
+        },
+        overBudget: ({ usedCalls, maxCalls }) => rejectCall(`Agent call limit reached (${maxCalls} agent.* calls per script run; ${usedCalls} admitted, ${Math.max(0, maxCalls - usedCalls)} remaining). Return the partial results you collected.`),
+        onAdmitted: (prepared, context) => {
+            const callId = `${invocation.bridgeRunId}:agent:${context.callId}`;
+            deps.onCallAdmitted?.(prepared.member, prepared.started, callId);
+        },
+        onAborted: (prepared, context, reason) => {
+            const callId = `${invocation.bridgeRunId}:agent:${context.callId}`;
+            deps.onCallSettled?.(prepared.member, prepared.started, callId, 'unknown', reason);
+        },
+        lane: (prepared) => (prepared.member === 'run' || prepared.member === 'start' ? 'default' : 'serial'),
+        prepare: (payload) => {
+            const started = Date.now();
+            const requested = typeof payload.member === 'string' ? payload.member : '';
+            if (!AGENT_MEMBERS.includes(requested)) {
+                return rejectCall(`Unknown agent member "${requested}". Available: ${members.join(', ')}.`);
+            }
+            const member = requested;
+            const params = isRecord(payload.params) ? payload.params : {};
+            if (member === 'run' || member === 'start') {
+                const paramError = launchParamError(member, params);
+                if (paramError)
+                    return rejectCall(`agent.${member} params invalid: ${paramError}`);
+                // Admit the start before resolving so the cap holds regardless of what
+                // resolution does; a rejected spec consumes its admission like a
+                // launched one would, keeping the budget an honest upper bound.
+                if (startsAdmitted >= RUN_CODE_LIMITS.maxAgentStarts) {
+                    return rejectCall(`Agent start limit reached (${RUN_CODE_LIMITS.maxAgentStarts} agent launches per script run; ` +
+                        `${startsAdmitted} admitted, 0 remaining). Return the partial results you collected; ` +
+                        'admitted launches are unaffected.');
+                }
+                startsAdmitted += 1;
+                const boundary = resolveAgentSpecForChild(params.spec, {
+                    settings: deps.settings,
+                    logger: deps.logger,
+                    parent: deps.authority.parent,
+                    readOnly: deps.authority.readOnly,
+                    planMode: deps.authority.planMode,
+                    ...(typeof params.worktree === 'string' ? { worktree: params.worktree } : {}),
+                });
+                if (!boundary.ok) {
+                    return rejectCall(`Agent specification rejected: ${boundary.errors.map((error) => error.message).join('; ')}`);
+                }
+                return member === 'run'
+                    ? { member, boundary, started }
+                    : {
+                        member,
+                        boundary,
+                        ...(typeof params.name === 'string' ? { name: params.name } : {}),
+                        started,
+                    };
+            }
+            const lifecycleError = lifecycleParamError(member, params);
+            if (lifecycleError)
+                return rejectCall(`agent.${member} params invalid: ${lifecycleError}`);
+            if (member === 'status') {
+                return {
+                    member,
+                    ...(typeof params.runId === 'string' ? { runId: params.runId } : {}),
+                    started,
+                };
+            }
+            if (member === 'result') {
+                return { member, runId: params.runId, started };
+            }
+            return { member: 'cancel', target: params.target, started };
+        },
+        invoke: async (prepared, callContext) => {
+            const callId = `${invocation.bridgeRunId}:agent:${callContext.callId}`;
+            try {
+                const outcome = await (async () => {
+                    if (prepared.member === 'run') {
+                        try {
+                            const publisher = childApprovalPublisher(callContext);
+                            const nested = await deps.runResolvedSubagent.call(undefined, {
+                                resolvedDefinition: prepared.boundary,
+                                ...(publisher ? { foregroundChildApproval: publisher } : {}),
+                            }, invocation.context, 
+                            // The host controller signal aborts the child on script timeout or
+                            // cancellation; the tool call id keeps foreground leases movable.
+                            {
+                                toolCall: { callId: `${invocation.bridgeRunId}:agent:${callContext.callId}` },
+                                signal: callContext.signal,
+                            });
+                            if (nested.status === 'interrupted') {
+                                return rejectCall('Child run interrupted (possibly awaiting a tool approval). The script cannot resume ' +
+                                    'this foreground child; use the direct subagent tool for approval-interactive work.');
+                            }
+                            return { kind: 'result', result: { ok: true, result: projectNestedResult(nested) } };
+                        }
+                        catch (error) {
+                            if (callContext.signal.aborted || isAbortError(error))
+                                throw error;
+                            return rejectCall(error instanceof Error ? error.message : String(error));
+                        }
+                    }
+                    if (prepared.member === 'start') {
+                        try {
+                            const handle = await deps.runResolvedSubagentAsync.call(undefined, {
+                                resolvedDefinition: prepared.boundary,
+                                ...(prepared.name ? { name: prepared.name } : {}),
+                            });
+                            return {
+                                kind: 'result',
+                                result: {
+                                    ok: true,
+                                    result: {
+                                        runId: handle.runId,
+                                        ...(handle.name ? { name: handle.name } : {}),
+                                        role: handle.role,
+                                        status: handle.status,
+                                    },
+                                },
+                            };
+                        }
+                        catch (error) {
+                            // Launch failures are script-catchable; the background run is never
+                            // bound to this script's signal, so there is no abort case here.
+                            return rejectCall(error instanceof Error ? error.message : String(error));
+                        }
+                    }
+                    if (prepared.member === 'status') {
+                        const status = deps.getSubagentStatus.call(undefined, prepared.runId !== undefined ? { runId: prepared.runId } : {}, invocation.context);
+                        return { kind: 'result', result: { ok: true, result: status } };
+                    }
+                    if (prepared.member === 'result') {
+                        try {
+                            const settled = await deps.getSubagentResult.call(undefined, { runId: prepared.runId }, invocation.context, {
+                                signal: callContext.signal,
+                            });
+                            return { kind: 'result', result: { ok: true, result: projectNestedResult(settled) } };
+                        }
+                        catch (error) {
+                            if (callContext.signal.aborted || isAbortError(error))
+                                throw error;
+                            return rejectCall(error instanceof Error ? error.message : String(error));
+                        }
+                    }
+                    const acknowledgement = deps.cancelSubagentRun.call(undefined, { target: prepared.target });
+                    return { kind: 'result', result: { ok: true, result: acknowledgement } };
+                })();
+                const result = outcome.kind === 'result' && isRecord(outcome.result) ? outcome.result : undefined;
+                const failed = outcome.kind === 'fail' || result?.ok === false;
+                const reason = failed && typeof result?.error === 'string' ? result.error : undefined;
+                deps.onCallSettled?.(prepared.member, prepared.started, callId, failed ? 'error' : 'ok', reason);
+                return outcome;
+            }
+            catch (error) {
+                deps.onCallSettled?.(prepared.member, prepared.started, callId, 'error', error instanceof Error ? error.message : String(error));
+                throw error;
+            }
+        },
+    };
+    return handler;
+}
+//# sourceMappingURL=run-code-agent-capability.js.map

package/dist/tools/system/run-code/run-code-agent-capability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-code-agent-capability.js","sourceRoot":"","sources":["../../../../source/tools/system/run-code/run-code-agent-capability.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,wBAAwB,GAGzB,MAAM,wDAAwD,CAAC;AAWhE,OAAO,EAAE,kBAAkB,EAAE,MAAM,uDAAuD,CAAC;AAG3F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA4DxD,MAAM,uBAAuB,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAEjF,MAAM,UAAU,GAAG,CAAC,KAAc,EAA0C,EAAE,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC;AAE3G,6EAA6E;AAC7E,MAAM,UAAU,0BAA0B,CACxC,MAA0C;IAE1C,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IAC1D,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAC3C,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACvC,OAAO,UAAU,IAAI,cAAc,CAAC;AACtC,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,gCAAgC,CAAC,MAA8B;IAC7E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,UAAU,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,IACE,UAAU,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAC3C,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC;QACpC,UAAU,CAAC,MAAM,CAAC,iBAAiB,CAAC,EACpC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAoBD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AAEnH,MAAM,UAAU,GAAG,CAAC,KAAa,EAAqB,EAAE,CAAC,CAAC;IACxD,IAAI,EAAE,QAAQ;IACd,MAAM,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAe;CAC1C,CAAC,CAAC;AAEH,MAAM,YAAY,GAAG,CAAC,KAAc,EAAW,EAAE,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,CAAC;AAUxG;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,YAAqB;IACrD,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,SAAS,CAAC;IAC5F,IAAI,OAAO,YAAY,CAAC,IAAI,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxF,MAAM,aAAa,GACjB,OAAO,YAAY,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IACrH,IAAI,cAAc,GAAY,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,cAAc,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;IACxE,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,YAAY,CAAC,IAAI;QAC3B,aAAa;QACb,SAAS,EAAE,cAAc;QACzB,GAAG,CAAC,OAAO,YAAY,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;AACJ,CAAC;AAED,kGAAkG;AAClG,MAAM,mBAAmB,GAAG,CAAC,MAA6C,EAAa,EAAE;IACvF,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,SAAS,EAAE,GAAG,MAAM,CAAC;IAC9F,4EAA4E;IAC5E,wEAAwE;IACxE,OAAO,SAAiC,CAAC;AAC3C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG9E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAErF,2FAA2F;AAC3F,SAAS,gBAAgB,CAAC,MAAuB,EAAE,MAA+B;IAChF,MAAM,QAAQ,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC;IACxF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,sBAAsB,GAAG,YAAY,MAAM,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,wCAAwC,CAAC;IAC1G,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,4BAA4B,CAAC;IAC9G,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,wBAAwB,CAAC;IAClG,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;QACvF,OAAO,mCAAmC,CAAC;IAC7C,CAAC;IACD,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;QAC/D,OAAO,sGAAsG,CAAC;IAChH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,mBAAmB,CAC1B,MAAsC,EACtC,MAA+B;IAE/B,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAChH,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,sBAAsB,GAAG,YAAY,MAAM,YAAY,CAAC,GAAG,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACpH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;QACpG,OAAO,GAAG,QAAQ,oBAAoB,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC1F,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAgC,EAChC,UAA4C;IAE5C,MAAM,OAAO,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,wEAAwE;IACxE,yEAAyE;IACzE,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB;;;;;;;OAOG;IACH,MAAM,sBAAsB,GAAG,CAAC,WAAkC,EAAE,EAAE;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,mBAAmB,CAAC;QACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,sBAAsB,CAAC;QAC7C,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;YAAE,OAAO,SAAS,CAAC;QAC1C,OAAO,KAAK,EAAE,KAAsC,EAAiB,EAAE;YACrE,MAAM,YAAY,GAAG,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YAClE,0EAA0E;YAC1E,sEAAsE;YACtE,4BAA4B;YAC5B,IAAI,CAAC,YAAY;gBAAE,OAAO;YAC1B,qEAAqE;YACrE,wCAAwC;YACxC,OAAO,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC;oBACrC,SAAS,EAAE,GAAG,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,UAAU,EAAE;oBAC9D,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;oBACtC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,EAAE;oBACvC,UAAU,EAAE,UAAU,CAAC,WAAW;oBAClC,YAAY,EAAE,KAAK,CAAC,KAAK;oBACzB,QAAQ,EAAE,YAAY,CAAC,QAAQ;oBAC/B,iBAAiB,EAAE,YAAY,CAAC,SAAS;oBACzC,gBAAgB,EAAE,UAAU,CAAC,OAAO;oBACpC,QAAQ,EAAE;wBACR,SAAS,EAAE,uBAAuB,KAAK,CAAC,IAAI,GAAG;wBAC/C,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,aAAa,EAAE,YAAY,CAAC,aAAa;wBACzC,eAAe,EAAE,IAAI;wBACrB,GAAG,CAAC,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC9E;oBACD,MAAM,EAAE,WAAW,CAAC,MAAM;oBAC1B,UAAU,EAAE,KAAK,IAAI,EAAE,CACrB,CACE,MAAM,QAAQ,CAAC,QAAQ,CAAC;wBACtB,QAAQ,EAAE,YAAY,CAAC,QAAQ;wBAC/B,IAAI,EAAE,YAAY,CAAC,SAAS;wBAC5B,OAAO,EAAE,UAAU,CAAC,OAAO;qBAC5B,CAAC,CACH,CAAC,IAAI;oBACR,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE;wBAClB,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;wBACpF,mEAAmE;wBACnE,mEAAmE;wBACnE,IAAI,QAAQ,CAAC,MAAM,KAAK,yBAAyB,IAAI,QAAQ,CAAC,MAAM,KAAK,2BAA2B,EAAE,CAAC;4BACrG,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;wBAClF,CAAC;wBACD,kEAAkE;wBAClE,iEAAiE;wBACjE,MAAM,OAAO,GAAG,kBAAkB,CAChC;4BACE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;4BACtC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;4BAC7C,MAAM,EAAE,IAAI,CAAC,MAAM;yBACpB,EACD;4BACE,MAAM,EAAE,QAAQ,CAAC,MAAM;4BACvB,QAAQ,EAAE,YAAY,CAAC,QAAQ;4BAC/B,YAAY,EAAE,YAAY,CAAC,aAAa;4BACxC,MAAM,EAAE,YAAY,CAAC,MAAM;4BAC3B,YAAY,EAAE,KAAK,CAAC,YAAY;yBACjC,CACF,CAAC;wBACF,IAAI,CAAC,OAAO,CAAC,UAAU;4BAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;wBAC7E,oEAAoE;wBACpE,6DAA6D;wBAC7D,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;4BACvD,MAAM,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAC;4BAC/B,OAAO,IAAI,CAAC;wBACd,CAAC,CAAC,CAAC;wBACH,IAAI,CAAC,OAAO;4BAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;oBAClF,CAAC;oBACD,sEAAsE;oBACtE,0CAA0C;oBAC1C,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;iBAC3B,CAAC,CAAC;gBACH,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACjC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;wBACvC,MAAM,CAAC,MAAM,EAAE,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC;wBAC/D,OAAO,IAAI,CAAC;oBACd,CAAC,CAAC,CAAC;gBACL,CAAC;gBACD,sEAAsE;gBACtE,sEAAsE;gBACtE,4DAA4D;YAC9D,CAAC;oBAAS,CAAC;gBACT,OAAO,CAAC,SAAS,EAAE,CAAC,WAAW,CAAC,CAAC;YACnC,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;IAEF,MAAM,OAAO,GAAyC;QACpD,OAAO,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE;QACtD,MAAM,EAAE;YACN,QAAQ,EAAE,eAAe,CAAC,aAAa;YACvC,cAAc,EAAE,eAAe,CAAC,mBAAmB;YACnD,oBAAoB,EAAE,6BAA6B,eAAe,CAAC,aAAa,iCAAiC;SAClH;QACD,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CACtC,UAAU,CACR,6BAA6B,QAAQ,kCAAkC,SAAS,cAAc,IAAI,CAAC,GAAG,CACpG,CAAC,EACD,QAAQ,GAAG,SAAS,CACrB,wDAAwD,CAC1D;QACH,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE;YAChC,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,IAAI,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACnE,CAAC;QACD,SAAS,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE;YACvC,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,UAAU,OAAO,CAAC,MAAM,EAAE,CAAC;YACnE,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrG,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE;YACnB,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC3B,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3E,IAAI,CAAE,aAAmC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC9D,OAAO,UAAU,CAAC,yBAAyB,SAAS,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,MAAM,GAAG,SAAwB,CAAC;YACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAE9D,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACpD,IAAI,UAAU;oBAAE,OAAO,UAAU,CAAC,SAAS,MAAM,oBAAoB,UAAU,EAAE,CAAC,CAAC;gBACnF,uEAAuE;gBACvE,iEAAiE;gBACjE,gEAAgE;gBAChE,IAAI,cAAc,IAAI,eAAe,CAAC,cAAc,EAAE,CAAC;oBACrD,OAAO,UAAU,CACf,8BAA8B,eAAe,CAAC,cAAc,kCAAkC;wBAC5F,GAAG,cAAc,qEAAqE;wBACtF,mCAAmC,CACtC,CAAC;gBACJ,CAAC;gBACD,cAAc,IAAI,CAAC,CAAC;gBACpB,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE;oBACrD,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM;oBAC7B,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;oBACjC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ;oBACjC,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC9E,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,UAAU,CACf,iCAAiC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;gBACJ,CAAC;gBACD,OAAO,MAAM,KAAK,KAAK;oBACrB,CAAC,CAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAA+B;oBAC7D,CAAC,CAAE;wBACC,MAAM;wBACN,QAAQ;wBACR,GAAG,CAAC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjE,OAAO;qBACqB,CAAC;YACrC,CAAC;YAED,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,cAAc;gBAAE,OAAO,UAAU,CAAC,SAAS,MAAM,oBAAoB,cAAc,EAAE,CAAC,CAAC;YAC3F,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO;oBACL,MAAM;oBACN,GAAG,CAAC,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACpE,OAAO;iBACoB,CAAC;YAChC,CAAC;YACD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACxB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAe,EAAE,OAAO,EAA8B,CAAC;YACxF,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAgB,EAAE,OAAO,EAA8B,CAAC;QACpG,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,EAA8B,EAAE;YAClE,MAAM,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,UAAU,WAAW,CAAC,MAAM,EAAE,CAAC;YACvE,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAgC,EAAE;oBAC5D,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;wBAC9B,IAAI,CAAC;4BACH,MAAM,SAAS,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;4BACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,mBAAoB,CAAC,IAAI,CACjD,SAAS,EACT;gCACE,kBAAkB,EAAE,QAAQ,CAAC,QAAQ;gCACrC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,uBAAuB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAC7D,EACD,UAAU,CAAC,OAAO;4BAClB,mEAAmE;4BACnE,kEAAkE;4BAClE;gCACE,QAAQ,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,UAAU,WAAW,CAAC,MAAM,EAAE,EAAE;gCAC7E,MAAM,EAAE,WAAW,CAAC,MAAM;6BAC3B,CACF,CAAC;4BACF,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gCACpC,OAAO,UAAU,CACf,sFAAsF;oCACpF,oFAAoF,CACvF,CAAC;4BACJ,CAAC;4BACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,EAAe,EAAE,CAAC;wBACpG,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;4BACnE,OAAO,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,CAAC;oBACH,CAAC;oBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBAChC,IAAI,CAAC;4BACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,wBAAyB,CAAC,IAAI,CAAC,SAAS,EAAE;gCAClE,kBAAkB,EAAE,QAAQ,CAAC,QAAQ;gCACrC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAClD,CAAC,CAAC;4BACH,OAAO;gCACL,IAAI,EAAE,QAAQ;gCACd,MAAM,EAAE;oCACN,EAAE,EAAE,IAAI;oCACR,MAAM,EAAE;wCACN,KAAK,EAAE,MAAM,CAAC,KAAK;wCACnB,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wCAC7C,IAAI,EAAE,MAAM,CAAC,IAAI;wCACjB,MAAM,EAAE,MAAM,CAAC,MAAM;qCACT;iCACF;6BACf,CAAC;wBACJ,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,oEAAoE;4BACpE,iEAAiE;4BACjE,OAAO,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,CAAC;oBACH,CAAC;oBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAkB,CAAC,IAAI,CACzC,SAAS,EACT,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAC7D,UAAU,CAAC,OAAO,CACnB,CAAC;wBACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAA8B,EAAE,EAAE,CAAC;oBAC1F,CAAC;oBACD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;wBACjC,IAAI,CAAC;4BACH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,iBAAkB,CAAC,IAAI,CAChD,SAAS,EACT,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EACzB,UAAU,CAAC,OAAO,EAClB;gCACE,MAAM,EAAE,WAAW,CAAC,MAAM;6BAC3B,CACF,CAAC;4BACF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,CAAC,OAAO,CAAC,EAAe,EAAE,CAAC;wBACrG,CAAC;wBAAC,OAAO,KAAK,EAAE,CAAC;4BACf,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,IAAI,YAAY,CAAC,KAAK,CAAC;gCAAE,MAAM,KAAK,CAAC;4BACnE,OAAO,UAAU,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;wBAC5E,CAAC;oBACH,CAAC;oBACD,MAAM,eAAe,GAAG,IAAI,CAAC,iBAAkB,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;oBAC7F,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,eAAuC,EAAE,EAAE,CAAC;gBACnG,CAAC,CAAC,EAAE,CAAC;gBACL,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAClG,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,KAAK,MAAM,IAAI,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC;gBAC/D,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,MAAM,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtF,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACjG,OAAO,OAAO,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,aAAa,EAAE,CAClB,QAAQ,CAAC,MAAM,EACf,QAAQ,CAAC,OAAO,EAChB,MAAM,EACN,OAAO,EACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/tools/system/run-code/run-code-runtime.d.ts

@@ -4,6 +4,8 @@ import type { ILoggingService } from '../../../services/service-interfaces.js';
 import type { ToolApprovalPolicyRegistry } from '../../../services/approval/tool-approval-policy-registry.js';
 import type { NestedApprovalOwner } from '../../../services/approval/nested-approval-owner.js';
 import { type AnyToolDefinition, type ToolRegistry } from '../../types.js';
+import type { AgentSpecAuthoritySnapshot } from '../../../services/agent-runtime/permission-boundary.js';
+import { type RunCodeAgentSpecBridge } from './run-code-agent-capability.js';
 import type { RunCodeActionOutcome } from './run-code-runtime-contract.js';
 export type { RunCodeActionOutcome, RunCodeActionReceipt, RunCodeCallRecord } from './run-code-runtime-contract.js';
 export declare const TOOL_NAME_RUN_CODE = "run_code";
@@ -12,6 +14,9 @@ export declare const TOOL_NAME_DESCRIBE = "describe";
 export declare const RUN_CODE_LIMITS: {
     readonly maxCalls: 200;
     readonly maxConcurrency: 8;
+    readonly maxAgentStarts: 16;
+    readonly maxAgentConcurrency: 4;
+    readonly maxAgentCalls: 200;
     readonly maxResultChars: 100000;
     readonly maxMediaBytes: number;
     readonly maxMediaTotalBytes: number;
@@ -67,6 +72,10 @@ export interface RunCodeRuntimeOptions {
     nestedApprovalOwner?: NestedApprovalOwner;
     sessionAccess?: import('../../../services/session/session-access-state.js').SessionAccessState;
     nestedCompatibility?: import('../../../services/session/nested-tool-compatibility-state.js').NestedToolCompatibilityState;
+    /** Host-owned root authority snapshot; required by the agent capability. */
+    agentSpecAuthority?: AgentSpecAuthoritySnapshot;
+    /** Host-owned resolved-launch bridge; the agent capability exists only when active. */
+    agentBridge?: RunCodeAgentSpecBridge;
 }
 export interface RunCodeRuntimeInput {
     code: string;

package/dist/tools/system/run-code/run-code-runtime.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run-code-runtime.d.ts","sourceRoot":"","sources":["../../../../source/tools/system/run-code/run-code-runtime.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,KAAK,EAGV,SAAS,EACV,MAAM,qDAAqD,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAI/F,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAcrG,OAAO,KAAK,EAAE,oBAAoB,EAA2C,MAAM,gCAAgC,CAAC;AAEpH,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEpH,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,8CAA8C;AAC9C,eAAO,MAAM,eAAe;aAC1B,QAAQ,EAAE,GAAG;aACb,cAAc,EAAE,CAAC;aACjB,cAAc,EAAE,MAAO;aACvB,aAAa;aACb,kBAAkB;aAClB,mBAAmB,EAAE,EAAE;aACvB,YAAY,EAAE,KAAM;aACpB,cAAc,EAAE,MAAO;aACvB,eAAe,EAAE,MAAO;CAChB,CAAC;AAEX,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CASxD,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiCjH,CAAC;AAEF,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,OAA+C,CAAC;AAY5F,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,MAC0D,CAAC;AAEvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,OAAO,CAEjF;AA+BD,wBAAgB,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAuB/D;AAiCD,wBAAgB,yBAAyB;qBAIf,OAAO,KAAG,OAAO;qBAwBjB,OAAO,KAAG,OAAO;EAO1C;AAqBD,eAAO,MAAM,eAAe,WAClB,OAAO,SACR,MAAM,YACH,MAAM,kBACA,MAAM,KACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyBxE,CAAC;AAsCF,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGrH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,OAAO,CAAC,cAAc,CAAC,CAazB;AAmDD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAInH;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,WAAW,GAAG,SAAS,EAAE,UAAU,EAAE,WAAW,GAAG,WAAW,CAe7G;AAYD,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAQjC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,YAAY,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,eAAe,CAAC;IAChC,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,MAAM,EAAE,MAAM,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,mDAAmD,EAAE,kBAAkB,CAAC;IAC/F,mBAAmB,CAAC,EAAE,OAAO,8DAA8D,EAAE,4BAA4B,CAAC;CAC3H;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iEAAiE;IACjE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAYD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB;qBAM3C,YAAY;qBAEJ,mBAAmB,KAAG,OAAO,CAAC,oBAAoB,CAAC;EA2blF"}
+{"version":3,"file":"run-code-runtime.d.ts","sourceRoot":"","sources":["../../../../source/tools/system/run-code/run-code-runtime.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wCAAwC,CAAC;AAE/E,OAAO,KAAK,EAGV,SAAS,EACV,MAAM,qDAAqD,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yCAAyC,CAAC;AAE/E,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,6DAA6D,CAAC;AAC9G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,qDAAqD,CAAC;AAI/F,OAAO,EAA4B,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,gBAAgB,CAAC;AASrG,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,wDAAwD,CAAC;AACzG,OAAO,EAGL,KAAK,sBAAsB,EAC5B,MAAM,gCAAgC,CAAC;AAMxC,OAAO,KAAK,EAAE,oBAAoB,EAA2C,MAAM,gCAAgC,CAAC;AAEpH,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AAEpH,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAC7C,eAAO,MAAM,kBAAkB,aAAa,CAAC;AAE7C,8CAA8C;AAC9C,eAAO,MAAM,eAAe;aAC1B,QAAQ,EAAE,GAAG;aACb,cAAc,EAAE,CAAC;aAGjB,cAAc,EAAE,EAAE;aAClB,mBAAmB,EAAE,CAAC;aACtB,aAAa,EAAE,GAAG;aAClB,cAAc,EAAE,MAAO;aACvB,aAAa;aACb,kBAAkB;aAClB,mBAAmB,EAAE,EAAE;aACvB,YAAY,EAAE,KAAM;aACpB,cAAc,EAAE,MAAO;aACvB,eAAe,EAAE,MAAO;CAChB,CAAC;AAEX,6DAA6D;AAC7D,eAAO,MAAM,yBAAyB,EAAE,WAAW,CAAC,MAAM,CASxD,CAAC;AAEH,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK;IAAE,OAAO,EAAE,oBAAoB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAiCjH,CAAC;AAEF,eAAO,MAAM,YAAY,SAAU,MAAM,KAAG,OAA+C,CAAC;AAY5F,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,MAC0D,CAAC;AAEvG,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,CAAC,GAAG,OAAO,CAEjF;AA+BD,wBAAgB,YAAY,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,CAuB/D;AAiCD,wBAAgB,yBAAyB;qBAIf,OAAO,KAAG,OAAO;qBAwBjB,OAAO,KAAG,OAAO;EAO1C;AAqBD,eAAO,MAAM,eAAe,WAClB,OAAO,SACR,MAAM,YACH,MAAM,kBACA,MAAM,KACrB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAyBxE,CAAC;AAsCF,KAAK,cAAc,GAAG;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAGrH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,OAAO,EACf,GAAG,EAAE,MAAM,EACX,gBAAgB,CAAC,EAAE,gBAAgB,GAClC,OAAO,CAAC,cAAc,CAAC,CAazB;AAmDD,wBAAgB,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,OAAO,CAInH;AAED,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,WAAW,GAAG,SAAS,EAAE,UAAU,EAAE,WAAW,GAAG,WAAW,CAe7G;AAYD,OAAO,EAIL,KAAK,gBAAgB,EACtB,MAAM,yBAAyB,CAAC;AAQjC,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,YAAY,CAAC;IACvB,4EAA4E;IAC5E,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,cAAc,EAAE,eAAe,CAAC;IAChC,sBAAsB,EAAE,0BAA0B,CAAC;IACnD,MAAM,EAAE,MAAM,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mBAAmB,CAAC,EAAE,mBAAmB,CAAC;IAC1C,aAAa,CAAC,EAAE,OAAO,mDAAmD,EAAE,kBAAkB,CAAC;IAC/F,mBAAmB,CAAC,EAAE,OAAO,8DAA8D,EAAE,4BAA4B,CAAC;IAC1H,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,0BAA0B,CAAC;IAChD,uFAAuF;IACvF,WAAW,CAAC,EAAE,sBAAsB,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,iEAAiE;IACjE,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3B;AAYD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB;qBAM3C,YAAY;qBAEJ,mBAAmB,KAAG,OAAO,CAAC,oBAAoB,CAAC;EAiflF"}

package/dist/tools/system/run-code/run-code-runtime.js

@@ -11,6 +11,7 @@ import { renderCompactSignature } from './tools-header.js';
 import { MCP_TOOL_BINDING, describeMcpTool, isMcpToolDefinition, validateMcpArguments } from './mcp-script-surface.js';
 import { getScriptedReturnContract, scriptedReturnContractJsonSchema, validateScriptedReturn, } from '../../scripted-return-contract.js';
 import { WORKFLOW_PROHIBITED_TOOLS } from '../../../services/agent-runtime/workflow/workflow-evaluator.js';
+import { createRunCodeAgentCapability, isRunCodeAgentBridgeActive, } from './run-code-agent-capability.js';
 import { resolveWorkspacePath, resolveWorkspacePathPhysically } from '../../utils.js';
 import { parseUpstreamApplyPatch } from '../../file/upstream-apply-patch.js';
 import { TOOL_NAME_APPLY_PATCH } from '../../tool-names.js';
@@ -22,6 +23,11 @@ export const TOOL_NAME_DESCRIBE = 'describe';
 export const RUN_CODE_LIMITS = {
     maxCalls: 200,
     maxConcurrency: 8,
+    // Agent capability budgets are separate from the tools ledger by design:
+    // launching child agents is scarcer and more expensive than a tool call.
+    maxAgentStarts: 16,
+    maxAgentConcurrency: 4,
+    maxAgentCalls: 200,
     maxResultChars: 100_000,
     maxMediaBytes: 8 * 1024 * 1024,
     maxMediaTotalBytes: 32 * 1024 * 1024,
@@ -421,6 +427,8 @@ export function createRunCodeRuntime(options) {
         const receipts = [];
         const pendingReceiptByCallId = new Map();
         const abortedCallIds = new Set();
+        const agentCallIndexes = new Map();
+        const abortedAgentCallIds = new Set();
         let rejectedSeq = 0;
         const output = [];
         const consoleValues = [];
@@ -460,6 +468,29 @@ export function createRunCodeRuntime(options) {
             else
                 receipts.push(value);
         };
+        const recordAgentCall = (member, started, callId, outcome, reason) => {
+            if (abortedAgentCallIds.has(callId) && outcome !== 'unknown')
+                return;
+            let index = agentCallIndexes.get(callId);
+            if (index === undefined) {
+                index = calls.length;
+                agentCallIndexes.set(callId, index);
+                calls.push({ tool: `agent.${member}`, outcome: 'unknown', durationMs: 0, callId });
+                if (member === 'start')
+                    recordReceipt(callId, 'agent.start', 'unknown');
+            }
+            calls[index] = {
+                tool: `agent.${member}`,
+                outcome,
+                durationMs: Date.now() - started,
+                callId,
+                ...(reason ? { reason: clipReason(reason) } : {}),
+            };
+            if (member === 'start') {
+                const actionOutcome = outcome === 'ok' ? 'applied' : outcome === 'error' ? 'failed' : 'unknown';
+                recordReceipt(callId, 'agent.start', actionOutcome, reason);
+            }
+        };
         const tools = {
             binding: {
                 name: 'tools',
@@ -691,6 +722,28 @@ export function createRunCodeRuntime(options) {
                 }
             },
         };
+        const capabilities = { tools };
+        if (options.agentBridge && options.agentSpecAuthority && isRunCodeAgentBridgeActive(options.agentBridge)) {
+            capabilities.agent = createRunCodeAgentCapability({
+                ...options.agentBridge,
+                authority: options.agentSpecAuthority,
+                logger: loggingService,
+                // Session-owned child approval surfaces: without an owner the child
+                // interruption settles as the catchable interrupted error.
+                ...(options.nestedApprovalOwner
+                    ? { nestedApprovalOwner: options.nestedApprovalOwner, approvalPolicyRegistry: approvalRegistry }
+                    : {}),
+                ...(sessionId !== undefined ? { sessionId } : {}),
+                ...(options.graphIdentity ? { graphIdentity: options.graphIdentity } : {}),
+                ...(options.nestedCompatibility ? { nestedCompatibility: options.nestedCompatibility } : {}),
+                onCallAdmitted: (member, started, callId) => recordAgentCall(member, started, callId, 'unknown'),
+                onCallSettled: (member, started, callId, outcome, reason) => {
+                    if (outcome === 'unknown' && reason)
+                        abortedAgentCallIds.add(callId);
+                    recordAgentCall(member, started, callId, outcome, reason);
+                },
+            }, { bridgeRunId, context: input.context });
+        }
         const settleResolved = async (prepared, raw, callId) => {
             try {
                 if (isActionTool(prepared.tool.name)) {
@@ -732,7 +785,7 @@ export function createRunCodeRuntime(options) {
         const result = await new SandboxedCodeHostImpl().run({
             code: input.code,
             inputData: input.inputs,
-            capabilities: { tools },
+            capabilities,
             limits: {
                 timeoutMs: input.timeout,
                 maxCodeBytes: RUN_CODE_LIMITS.maxCodeBytes,