@qduc/term2 0.9.4 → 0.10.1

package/dist/services/agent-runtime/internal.d.ts

@@ -0,0 +1,15 @@
+export { resolveModelPolicy } from './model-resolver.js';
+export { resolvePermissions, resolveLimits, DEFAULT_RESOLVED_PERMISSIONS, DEFAULT_LIMITS, type PermissionResolutionError, } from './permission-resolver.js';
+export { resolveSkills } from './skill-resolver.js';
+export { resolveAgent } from './agent-resolver.js';
+export { resolveTools } from './tools-resolver.js';
+export type { ResolvedAgentDefinition } from './resolved-agent.js';
+export type { ResolvedAgentPermissions } from './types.js';
+export type { ExecutorInput, ExecutorFn } from './agent-handle.js';
+export { createExecutor, mapSubagentResultToRunResult } from './executor.js';
+export type { SubagentRunWithDefFn, MentorRunFn } from './executor.js';
+export { adaptLegacyRole, adaptLegacyDefinition } from './legacy-adapter.js';
+export type { AgentResolverDeps } from './agent-resolver.js';
+export { normalizeToolPath, resolveRealToolPath, isPathInScopeSafe, normalizeScopePattern, normalizeHostPattern, isPathInScope, isHostInScope, resolveFilesystemScopes, resolveNetworkScopes, isFilesystemScopeEmpty, isNetworkScopeEmpty, setWorkspaceRoot, type ResolvedFilesystemScope, type ResolvedNetworkScope, type ScopeResolutionError, } from './scope-resolver.js';
+export { ExecutionBudget, createRootBudget, AcquiredChildSlot, type ChildAcquireRejection, } from './execution-budget.js';
+//# sourceMappingURL=internal.d.ts.map

package/dist/services/agent-runtime/internal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/internal.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,4BAA4B,EAC5B,cAAc,EACd,KAAK,yBAAyB,GAC/B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,YAAY,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7E,YAAY,EAAE,oBAAoB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,uBAAuB,EAC5B,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,EACjB,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC"}

package/dist/services/agent-runtime/internal.js

@@ -0,0 +1,13 @@
+// Internal exports for testing, legacy adaptation, and subagent integration.
+// Do NOT import from this file in application code outside of tests,
+// legacy adapters, or the subagent composition layer.
+export { resolveModelPolicy } from './model-resolver.js';
+export { resolvePermissions, resolveLimits, DEFAULT_RESOLVED_PERMISSIONS, DEFAULT_LIMITS, } from './permission-resolver.js';
+export { resolveSkills } from './skill-resolver.js';
+export { resolveAgent } from './agent-resolver.js';
+export { resolveTools } from './tools-resolver.js';
+export { createExecutor, mapSubagentResultToRunResult } from './executor.js';
+export { adaptLegacyRole, adaptLegacyDefinition } from './legacy-adapter.js';
+export { normalizeToolPath, resolveRealToolPath, isPathInScopeSafe, normalizeScopePattern, normalizeHostPattern, isPathInScope, isHostInScope, resolveFilesystemScopes, resolveNetworkScopes, isFilesystemScopeEmpty, isNetworkScopeEmpty, setWorkspaceRoot, } from './scope-resolver.js';
+export { ExecutionBudget, createRootBudget, AcquiredChildSlot, } from './execution-budget.js';
+//# sourceMappingURL=internal.js.map

package/dist/services/agent-runtime/internal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"internal.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/internal.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,qEAAqE;AACrE,sDAAsD;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,4BAA4B,EAC5B,cAAc,GAEf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAInD,OAAO,EAAE,cAAc,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAE7E,OAAO,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE7E,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,uBAAuB,EACvB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,GAIjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,gBAAgB,EAChB,iBAAiB,GAElB,MAAM,uBAAuB,CAAC"}

package/dist/services/agent-runtime/legacy-adapter.d.ts

@@ -0,0 +1,19 @@
+import type { ISettingsService } from '../service-interfaces.js';
+import type { ResolvedAgentDefinition } from './resolved-agent.js';
+import type { SubagentDefinition, SupportedSubagentRole } from '../subagents/types.js';
+import type { ExecutionBudget } from './execution-budget.js';
+/**
+ * Adapt a legacy subagent role into a ResolvedAgentDefinition.
+ * This preserves existing role behavior by loading the trusted host preset
+ * and converting to the new internal shape.
+ */
+export declare function adaptLegacyRole(role: SupportedSubagentRole | string, settings: ISettingsService): ResolvedAgentDefinition;
+/**
+ * Convert a ResolvedAgentDefinition back to the legacy SubagentDefinition
+ * shape. Used when the new runtime creates an agent that must execute through
+ * the existing SubagentManager / ExecutionSubagentRunner infrastructure.
+ */
+export declare function adaptLegacyDefinition(resolved: ResolvedAgentDefinition, budget?: ExecutionBudget): SubagentDefinition;
+/** Re-export SubagentDefinition type for convenience. */
+export type { SubagentDefinition } from '../subagents/types.js';
+//# sourceMappingURL=legacy-adapter.d.ts.map

package/dist/services/agent-runtime/legacy-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-adapter.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/legacy-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEvF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,qBAAqB,GAAG,MAAM,EACpC,QAAQ,EAAE,gBAAgB,GACzB,uBAAuB,CA0BzB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,CAAC,EAAE,eAAe,GAAG,kBAAkB,CAmBrH;AAED,yDAAyD;AACzD,YAAY,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/services/agent-runtime/legacy-adapter.js

@@ -0,0 +1,58 @@
+import { loadRoleDefinition } from '../subagents/role-loader.js';
+/**
+ * Adapt a legacy subagent role into a ResolvedAgentDefinition.
+ * This preserves existing role behavior by loading the trusted host preset
+ * and converting to the new internal shape.
+ */
+export function adaptLegacyRole(role, settings) {
+    const def = loadRoleDefinition(role, settings);
+    return {
+        name: def.name,
+        legacyRole: def.role,
+        instructions: def.instructions,
+        model: { provider: def.provider, model: def.model },
+        permissions: {
+            canRead: def.canRead,
+            canWrite: def.canWrite,
+            canRunShell: def.canRunShell,
+            canSearchWeb: def.canSearchWeb,
+            canUseNestedAgents: false,
+        },
+        limits: {
+            maxTurns: def.maxTurns,
+        },
+        tools: [],
+        skillInstructions: '',
+        // Legacy roles have undefined scopes (no fine-grained restriction —
+        // they continue to use their existing coarse behavior).
+        filesystemScope: undefined,
+        networkScope: undefined,
+        resolutionErrors: [],
+    };
+}
+/**
+ * Convert a ResolvedAgentDefinition back to the legacy SubagentDefinition
+ * shape. Used when the new runtime creates an agent that must execute through
+ * the existing SubagentManager / ExecutionSubagentRunner infrastructure.
+ */
+export function adaptLegacyDefinition(resolved, budget) {
+    return {
+        role: resolved.legacyRole ?? resolved.name,
+        name: resolved.name,
+        instructions: resolved.instructions,
+        canRead: resolved.permissions.canRead ?? false,
+        canWrite: resolved.permissions.canWrite ?? false,
+        canSearchWeb: resolved.permissions.canSearchWeb ?? false,
+        canRunShell: resolved.permissions.canRunShell ?? false,
+        maxTurns: resolved.limits.maxTurns ?? 20,
+        model: resolved.model.model,
+        provider: resolved.model.provider,
+        reasoningEffort: 'default',
+        ...(resolved.limits.maxTokens !== undefined ? { maxTokens: resolved.limits.maxTokens } : {}),
+        ...(resolved.tools.length > 0 ? { tools: [...resolved.tools] } : {}),
+        ...(resolved.filesystemScope ? { filesystemScope: resolved.filesystemScope } : {}),
+        ...(resolved.networkScope ? { networkScope: resolved.networkScope } : {}),
+        ...(budget ? { executionBudget: budget } : {}),
+    };
+}
+//# sourceMappingURL=legacy-adapter.js.map

package/dist/services/agent-runtime/legacy-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-adapter.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/legacy-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AAGjE;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAoC,EACpC,QAA0B;IAE1B,MAAM,GAAG,GAAuB,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAEnE,OAAO;QACL,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,UAAU,EAAE,GAAG,CAAC,IAAI;QACpB,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,KAAK,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE;QACnD,WAAW,EAAE;YACX,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,YAAY,EAAE,GAAG,CAAC,YAAY;YAC9B,kBAAkB,EAAE,KAAK;SAC1B;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,GAAG,CAAC,QAAQ;SACvB;QACD,KAAK,EAAE,EAAE;QACT,iBAAiB,EAAE,EAAE;QACrB,oEAAoE;QACpE,wDAAwD;QACxD,eAAe,EAAE,SAAS;QAC1B,YAAY,EAAE,SAAS;QACvB,gBAAgB,EAAE,EAAE;KACrB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAiC,EAAE,MAAwB;IAC/F,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,IAAI;QAC1C,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,OAAO,EAAE,QAAQ,CAAC,WAAW,CAAC,OAAO,IAAI,KAAK;QAC9C,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,QAAQ,IAAI,KAAK;QAChD,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,YAAY,IAAI,KAAK;QACxD,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,WAAW,IAAI,KAAK;QACtD,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE;QACxC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK;QAC3B,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ;QACjC,eAAe,EAAE,SAAS;QAC1B,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5F,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/C,CAAC;AACJ,CAAC"}

package/dist/services/agent-runtime/model-resolver.d.ts

@@ -0,0 +1,13 @@
+import type { ISettingsService } from '../service-interfaces.js';
+import type { ModelPolicy, ExactModelPolicy } from './types.js';
+export type AncillaryModelTier = 'smart' | 'balanced' | 'cheap' | 'chore';
+/**
+ * Resolve a model policy to a concrete {provider, model} pair.
+ *
+ * - `ExactModelPolicy` → passes through unchanged.
+ * - `ModelTier` (efficient|balanced|capable) → reads from settings.
+ * - `RelativeModelPolicy` → adjusts relative to `parent`; requires a parent.
+ */
+export declare function resolveModelPolicy(policy: ModelPolicy, settings: ISettingsService, parent?: ModelPolicy): ExactModelPolicy;
+export declare function resolveAncillaryModelTier(tier: AncillaryModelTier, settings: ISettingsService): ExactModelPolicy;
+//# sourceMappingURL=model-resolver.d.ts.map

package/dist/services/agent-runtime/model-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolver.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/model-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,CAAC;AAE1E;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,WAAW,EACnB,QAAQ,EAAE,gBAAgB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,gBAAgB,CAgBlB;AAMD,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,kBAAkB,EAAE,QAAQ,EAAE,gBAAgB,GAAG,gBAAgB,CAIhH"}

package/dist/services/agent-runtime/model-resolver.js

@@ -0,0 +1,85 @@
+/**
+ * Resolve a model policy to a concrete {provider, model} pair.
+ *
+ * - `ExactModelPolicy` → passes through unchanged.
+ * - `ModelTier` (efficient|balanced|capable) → reads from settings.
+ * - `RelativeModelPolicy` → adjusts relative to `parent`; requires a parent.
+ */
+export function resolveModelPolicy(policy, settings, parent) {
+    // 1. Exact policy: pass-through.
+    if (typeof policy === 'object' && 'provider' in policy && 'model' in policy) {
+        return { provider: policy.provider, model: policy.model };
+    }
+    // 2. Relative policy: requires parent.
+    if (typeof policy === 'object' && 'tier' in policy) {
+        if (!parent) {
+            throw new Error('Relative model policy requires a parent agent policy.');
+        }
+        return resolveRelativePolicy(policy, settings, parent);
+    }
+    // 3. Named tier.
+    return resolveTierPolicy(policy, settings);
+}
+function resolveTierPolicy(tier, settings) {
+    return resolveAncillaryModelTier(policyTierToAncillaryTier(tier), settings);
+}
+export function resolveAncillaryModelTier(tier, settings) {
+    const model = settings.get(`agent.${tier}Model`) ?? resolveLegacyTierModel(tier, settings);
+    const provider = settings.get(`agent.${tier}Provider`) ?? settings.get('agent.provider') ?? 'openai';
+    return { provider, model: model ?? settings.get('agent.model') ?? 'gpt-4o' };
+}
+function resolveRelativePolicy(policy, settings, parent) {
+    // Resolve parent to exact first.
+    const parentExact = resolveModelPolicy(parent, settings);
+    if (policy.tier === 'same') {
+        return parentExact;
+    }
+    if (policy.reasoning) {
+        // MVP: all reasoning effort levels resolve to the same configured
+        // reasoning model. Granular per-effort settings can be added later.
+        const reasoningModel = settings.get(`agent.reasoning.${policy.reasoning}`) ?? settings.get('agent.reasoningModel');
+        if (reasoningModel) {
+            return { provider: parentExact.provider, model: reasoningModel };
+        }
+    }
+    const tier = policy.tier === 'lower' ? 'cheap' : 'smart';
+    const model = settings.get(`agent.${tier}Model`) ??
+        resolveLegacyTierModel(tier, settings) ??
+        settings.get('agent.model') ??
+        parentExact.model;
+    const provider = settings.get(`agent.${tier}Provider`) ?? parentExact.provider;
+    return { provider, model };
+}
+function resolveLegacyTierModel(tier, settings) {
+    for (const settingKey of legacyTierModelSettingKeys(tier)) {
+        const model = settings.get(settingKey);
+        if (model !== undefined && model !== null)
+            return model;
+    }
+    return undefined;
+}
+function policyTierToAncillaryTier(tier) {
+    switch (tier) {
+        case 'capable':
+            return 'smart';
+        case 'efficient':
+            return 'cheap';
+        case 'balanced':
+        default:
+            return 'balanced';
+    }
+}
+function legacyTierModelSettingKeys(tier) {
+    switch (tier) {
+        case 'cheap':
+            return ['agent.efficientModel', 'agent.subagentExplorerModel'];
+        case 'smart':
+            return ['agent.capableModel', 'agent.mentorModel'];
+        case 'chore':
+            return [];
+        case 'balanced':
+        default:
+            return ['agent.model'];
+    }
+}
+//# sourceMappingURL=model-resolver.js.map

package/dist/services/agent-runtime/model-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-resolver.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/model-resolver.ts"],"names":[],"mappings":"AAKA;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAmB,EACnB,QAA0B,EAC1B,MAAoB;IAEpB,iCAAiC;IACjC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,IAAI,MAAM,IAAI,OAAO,IAAI,MAAM,EAAE,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5D,CAAC;IAED,uCAAuC;IACvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,IAAI,MAAM,EAAE,CAAC;QACnD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,OAAO,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;IACzD,CAAC;IAED,iBAAiB;IACjB,OAAO,iBAAiB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,QAA0B;IACjE,OAAO,yBAAyB,CAAC,yBAAyB,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,IAAwB,EAAE,QAA0B;IAC5F,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAS,SAAS,IAAI,OAAO,CAAC,IAAI,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnG,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAS,SAAS,IAAI,UAAU,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAS,gBAAgB,CAAC,IAAI,QAAQ,CAAC;IACrH,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,IAAI,QAAQ,CAAC,GAAG,CAAS,aAAa,CAAC,IAAI,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAoF,EACpF,QAA0B,EAC1B,MAAmB;IAEnB,iCAAiC;IACjC,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,kEAAkE;QAClE,oEAAoE;QACpE,MAAM,cAAc,GAClB,QAAQ,CAAC,GAAG,CAAS,mBAAmB,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAS,sBAAsB,CAAC,CAAC;QAC9G,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,EAAE,QAAQ,EAAE,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,MAAM,KAAK,GACT,QAAQ,CAAC,GAAG,CAAS,SAAS,IAAI,OAAO,CAAC;QAC1C,sBAAsB,CAAC,IAAI,EAAE,QAAQ,CAAC;QACtC,QAAQ,CAAC,GAAG,CAAS,aAAa,CAAC;QACnC,WAAW,CAAC,KAAK,CAAC;IACpB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAS,SAAS,IAAI,UAAU,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAwB,EAAE,QAA0B;IAClF,KAAK,MAAM,UAAU,IAAI,0BAA0B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAS,UAAU,CAAC,CAAC;QAC/C,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;IAC1D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,yBAAyB,CAAC,IAAY;IAC7C,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,SAAS;YACZ,OAAO,OAAO,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,OAAO,CAAC;QACjB,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,UAAU,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAwB;IAC1D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,CAAC,sBAAsB,EAAE,6BAA6B,CAAC,CAAC;QACjE,KAAK,OAAO;YACV,OAAO,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;QACrD,KAAK,OAAO;YACV,OAAO,EAAE,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB;YACE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3B,CAAC;AACH,CAAC"}

package/dist/services/agent-runtime/permission-resolver.d.ts

@@ -0,0 +1,30 @@
+import type { AgentPermissions, AgentLimits, ResolvedAgentPermissions } from './types.js';
+import type { ResolvedFilesystemScope, ResolvedNetworkScope } from './scope-resolver.js';
+export interface PermissionResolutionError {
+    code: 'unsupported_permission_scope' | 'invalid_scope_pattern';
+    field: string;
+    message: string;
+}
+/** Default effective permissions: no authority. */
+export declare const DEFAULT_RESOLVED_PERMISSIONS: ResolvedAgentPermissions;
+/** Default effective limits: conservative. */
+export declare const DEFAULT_LIMITS: AgentLimits;
+/**
+ * Convert public AgentPermissions into the internal coarse
+ * ResolvedAgentPermissions. Also resolves fine-grained filesystem
+ * and network scopes via intersection with parent.
+ */
+export declare function resolvePermissions(child?: AgentPermissions, parent?: AgentPermissions): {
+    permissions: ResolvedAgentPermissions;
+    filesystemScope?: ResolvedFilesystemScope;
+    networkScope?: ResolvedNetworkScope;
+    /** Resolved agents.maxDepth from child intersected with parent. */
+    agentsMaxDepth?: number;
+    errors: PermissionResolutionError[];
+};
+/**
+ * Compute effective limits by clamping child values to parent maxima.
+ * The child may be more restrictive than the parent but never less.
+ */
+export declare function resolveLimits(child?: AgentLimits, parent?: AgentLimits): AgentLimits;
+//# sourceMappingURL=permission-resolver.d.ts.map

package/dist/services/agent-runtime/permission-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-resolver.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/permission-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAKzF,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,8BAA8B,GAAG,uBAAuB,CAAC;IAC/D,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAID,mDAAmD;AACnD,eAAO,MAAM,4BAA4B,EAAE,wBAMzC,CAAC;AAEH,8CAA8C;AAC9C,eAAO,MAAM,cAAc,EAAE,WAQ3B,CAAC;AA4DH;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,CAAC,EAAE,gBAAgB,EACxB,MAAM,CAAC,EAAE,gBAAgB,GACxB;IACD,WAAW,EAAE,wBAAwB,CAAC;IACtC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IAC1C,YAAY,CAAC,EAAE,oBAAoB,CAAC;IACpC,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,yBAAyB,EAAE,CAAC;CACrC,CA6EA;AAcD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAyBpF"}

package/dist/services/agent-runtime/permission-resolver.js

@@ -0,0 +1,204 @@
+import { resolveFilesystemScopes, resolveNetworkScopes } from './scope-resolver.js';
+// ─── Defaults ─────────────────────────────────────────────────────
+/** Default effective permissions: no authority. */
+export const DEFAULT_RESOLVED_PERMISSIONS = Object.freeze({
+    canRead: false,
+    canWrite: false,
+    canRunShell: false,
+    canSearchWeb: false,
+    canUseNestedAgents: false,
+});
+/** Default effective limits: conservative. */
+export const DEFAULT_LIMITS = Object.freeze({
+    maxTurns: 20,
+    maxTokens: undefined,
+    maxCost: undefined,
+    timeoutMs: undefined,
+    maxChildren: undefined,
+    maxDepth: undefined,
+    maxConcurrency: undefined,
+});
+// ─── Permission narrowing helpers ─────────────────────────────────
+/**
+ * Derive coarse `canRead` from the public permission shape.
+ * - `tools` listing any read-only tool grants read.
+ * - `filesystem.read` present but empty also grants read.
+ */
+function deriveCanRead(perms) {
+    const readTools = new Set([
+        'read_file',
+        'grep',
+        'glob',
+        'read_code_outline',
+        'code_context_search',
+        'web_search',
+        'web_fetch',
+        'ask_user',
+        'activate_skill',
+    ]);
+    if (perms.tools?.some((t) => readTools.has(t)))
+        return true;
+    if (perms.filesystem?.read !== undefined)
+        return true;
+    return false;
+}
+/** Derive coarse `canWrite` from the public permission shape. */
+function deriveCanWrite(perms) {
+    const writeTools = new Set(['apply_patch', 'search_replace', 'create_file']);
+    if (perms.tools?.some((t) => writeTools.has(t)))
+        return true;
+    if (perms.filesystem?.write !== undefined)
+        return true;
+    return false;
+}
+/** Derive coarse `canRunShell` from the public permission shape. */
+function deriveCanRunShell(perms) {
+    if (perms.tools?.includes('shell'))
+        return true;
+    return false;
+}
+/** Derive coarse `canSearchWeb` from the public permission shape. */
+function deriveCanSearchWeb(perms) {
+    const webTools = new Set(['web_search', 'web_fetch']);
+    if (perms.tools?.some((t) => webTools.has(t)))
+        return true;
+    if (perms.network?.hosts !== undefined)
+        return true;
+    return false;
+}
+/** Derive coarse `canUseNestedAgents` from the public permission shape. */
+function deriveCanUseNestedAgents(perms) {
+    // Explicit denial via agents.create: false overrides everything.
+    if (perms.agents?.create === false)
+        return false;
+    const nestedTools = new Set(['run_subagent', 'ask_mentor']);
+    if (perms.tools?.some((t) => nestedTools.has(t)))
+        return true;
+    if (perms.agents?.create === true)
+        return true;
+    return false;
+}
+// ─── Public → internal resolution ─────────────────────────────────
+/**
+ * Convert public AgentPermissions into the internal coarse
+ * ResolvedAgentPermissions. Also resolves fine-grained filesystem
+ * and network scopes via intersection with parent.
+ */
+export function resolvePermissions(child, parent) {
+    const errors = [];
+    // Validate remaining unsupported scopes
+    if (child?.agents?.allowedModels && child.agents.allowedModels.length > 0) {
+        errors.push({
+            code: 'unsupported_permission_scope',
+            field: 'agents.allowedModels',
+            message: 'Fine-grained agent model whitelisting is not yet supported. Omit allowedModels for no restriction.',
+        });
+    }
+    // ── Resolve agents.maxDepth (intersect child with parent) ──
+    let agentsMaxDepth;
+    if (child?.agents?.maxDepth !== undefined || parent?.agents?.maxDepth !== undefined) {
+        if (child?.agents?.maxDepth !== undefined && parent?.agents?.maxDepth !== undefined) {
+            agentsMaxDepth = Math.min(child.agents.maxDepth, parent.agents.maxDepth);
+        }
+        else {
+            agentsMaxDepth = child?.agents?.maxDepth ?? parent?.agents?.maxDepth;
+        }
+    }
+    // Resolve fine-grained filesystem scopes
+    const fsResult = resolveFilesystemScopes(child?.filesystem ? { read: child.filesystem.read, write: child.filesystem.write } : undefined, parent?.filesystem ? { read: parent.filesystem.read, write: parent.filesystem.write } : undefined);
+    for (const err of fsResult.errors) {
+        errors.push({ code: err.code, field: err.field, message: err.message });
+    }
+    // Resolve fine-grained network scopes
+    const netResult = resolveNetworkScopes(child?.network ? { hosts: child.network.hosts } : undefined, parent?.network ? { hosts: parent.network.hosts } : undefined);
+    for (const err of netResult.errors) {
+        errors.push({ code: err.code, field: err.field, message: err.message });
+    }
+    // Derive coarse flags from the public shape
+    const childCoarse = child ? publicToCoarse(child) : undefined;
+    const parentCoarse = parent ? publicToCoarse(parent) : undefined;
+    let resolved;
+    if (!childCoarse && !parentCoarse) {
+        resolved = { ...DEFAULT_RESOLVED_PERMISSIONS };
+    }
+    else if (!childCoarse && parentCoarse) {
+        resolved = { ...parentCoarse };
+    }
+    else if (childCoarse && !parentCoarse) {
+        resolved = {
+            canRead: childCoarse.canRead,
+            canWrite: childCoarse.canWrite,
+            canRunShell: childCoarse.canRunShell,
+            canSearchWeb: childCoarse.canSearchWeb,
+            canUseNestedAgents: childCoarse.canUseNestedAgents,
+        };
+    }
+    else {
+        // Both present: intersect
+        const p = parentCoarse;
+        resolved = {
+            canRead: childCoarse.canRead && p.canRead,
+            canWrite: childCoarse.canWrite && p.canWrite,
+            canRunShell: childCoarse.canRunShell && p.canRunShell,
+            canSearchWeb: childCoarse.canSearchWeb && p.canSearchWeb,
+            canUseNestedAgents: childCoarse.canUseNestedAgents && p.canUseNestedAgents,
+        };
+    }
+    return {
+        permissions: resolved,
+        filesystemScope: fsResult.resolved,
+        networkScope: netResult.resolved,
+        agentsMaxDepth,
+        errors,
+    };
+}
+function publicToCoarse(perms) {
+    return {
+        canRead: deriveCanRead(perms),
+        canWrite: deriveCanWrite(perms),
+        canRunShell: deriveCanRunShell(perms),
+        canSearchWeb: deriveCanSearchWeb(perms),
+        canUseNestedAgents: deriveCanUseNestedAgents(perms),
+    };
+}
+// ─── Limits resolution ────────────────────────────────────────────
+/**
+ * Compute effective limits by clamping child values to parent maxima.
+ * The child may be more restrictive than the parent but never less.
+ */
+export function resolveLimits(child, parent) {
+    if (!child && !parent)
+        return { ...DEFAULT_LIMITS };
+    if (!child && parent)
+        return { ...parent };
+    if (child && !parent) {
+        return {
+            maxTurns: child.maxTurns ?? DEFAULT_LIMITS.maxTurns,
+            maxTokens: child.maxTokens ?? DEFAULT_LIMITS.maxTokens,
+            maxCost: child.maxCost ?? DEFAULT_LIMITS.maxCost,
+            timeoutMs: child.timeoutMs ?? DEFAULT_LIMITS.timeoutMs,
+            maxChildren: child.maxChildren ?? DEFAULT_LIMITS.maxChildren,
+            maxDepth: child.maxDepth ?? DEFAULT_LIMITS.maxDepth,
+            maxConcurrency: child.maxConcurrency ?? DEFAULT_LIMITS.maxConcurrency,
+        };
+    }
+    const p = parent;
+    return {
+        maxTurns: clampOpt(child.maxTurns, p.maxTurns, DEFAULT_LIMITS.maxTurns),
+        maxTokens: clampOpt(child.maxTokens, p.maxTokens),
+        maxCost: clampOpt(child.maxCost, p.maxCost),
+        timeoutMs: clampOpt(child.timeoutMs, p.timeoutMs),
+        maxChildren: clampOpt(child.maxChildren, p.maxChildren),
+        maxDepth: clampOpt(child.maxDepth, p.maxDepth),
+        maxConcurrency: clampOpt(child.maxConcurrency, p.maxConcurrency),
+    };
+}
+function clampOpt(childVal, parentVal, defaultVal) {
+    const effectiveParent = parentVal ?? defaultVal;
+    if (childVal === undefined)
+        return effectiveParent;
+    if (effectiveParent === undefined)
+        return childVal;
+    return Math.min(childVal, effectiveParent);
+}
+//# sourceMappingURL=permission-resolver.js.map

package/dist/services/agent-runtime/permission-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permission-resolver.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/permission-resolver.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAUpF,qEAAqE;AAErE,mDAAmD;AACnD,MAAM,CAAC,MAAM,4BAA4B,GAA6B,MAAM,CAAC,MAAM,CAAC;IAClF,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,KAAK;IACnB,kBAAkB,EAAE,KAAK;CAC1B,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,CAAC,MAAM,cAAc,GAAgB,MAAM,CAAC,MAAM,CAAC;IACvD,QAAQ,EAAE,EAAE;IACZ,SAAS,EAAE,SAAS;IACpB,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,SAAS;IACpB,WAAW,EAAE,SAAS;IACtB,QAAQ,EAAE,SAAS;IACnB,cAAc,EAAE,SAAS;CAC1B,CAAC,CAAC;AAEH,qEAAqE;AAErE;;;;GAIG;AACH,SAAS,aAAa,CAAC,KAAuB;IAC5C,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC;QACxB,WAAW;QACX,MAAM;QACN,MAAM;QACN,mBAAmB;QACnB,qBAAqB;QACrB,YAAY;QACZ,WAAW;QACX,UAAU;QACV,gBAAgB;KACjB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5D,IAAI,KAAK,CAAC,UAAU,EAAE,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,KAAuB;IAC7C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,IAAI,KAAK,CAAC,UAAU,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,SAAS,iBAAiB,CAAC,KAAuB;IAChD,IAAI,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AACrE,SAAS,kBAAkB,CAAC,KAAuB;IACjD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC;IACtD,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,2EAA2E;AAC3E,SAAS,wBAAwB,CAAC,KAAuB;IACvD,iEAAiE;IACjE,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,KAAK,KAAK;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC,CAAC;IAC5D,IAAI,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qEAAqE;AAErE;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAwB,EACxB,MAAyB;IASzB,MAAM,MAAM,GAAgC,EAAE,CAAC;IAE/C,wCAAwC;IACxC,IAAI,KAAK,EAAE,MAAM,EAAE,aAAa,IAAI,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,8BAA8B;YACpC,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,oGAAoG;SAC9G,CAAC,CAAC;IACL,CAAC;IAED,8DAA8D;IAC9D,IAAI,cAAkC,CAAC;IACvC,IAAI,KAAK,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpF,IAAI,KAAK,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACpF,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC3E,CAAC;aAAM,CAAC;YACN,cAAc,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC;QACvE,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,MAAM,QAAQ,GAAG,uBAAuB,CACtC,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAC9F,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAClG,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,sCAAsC;IACtC,MAAM,SAAS,GAAG,oBAAoB,CACpC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,EAC3D,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAC9D,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACnC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,4CAA4C;IAC5C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAEjE,IAAI,QAAkC,CAAC;IAEvC,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QAClC,QAAQ,GAAG,EAAE,GAAG,4BAA4B,EAAE,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,WAAW,IAAI,YAAY,EAAE,CAAC;QACxC,QAAQ,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC;IACjC,CAAC;SAAM,IAAI,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,QAAQ,GAAG;YACT,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;YACpC,YAAY,EAAE,WAAW,CAAC,YAAY;YACtC,kBAAkB,EAAE,WAAW,CAAC,kBAAkB;SACnD,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,0BAA0B;QAC1B,MAAM,CAAC,GAAG,YAAa,CAAC;QACxB,QAAQ,GAAG;YACT,OAAO,EAAE,WAAY,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO;YAC1C,QAAQ,EAAE,WAAY,CAAC,QAAQ,IAAI,CAAC,CAAC,QAAQ;YAC7C,WAAW,EAAE,WAAY,CAAC,WAAW,IAAI,CAAC,CAAC,WAAW;YACtD,YAAY,EAAE,WAAY,CAAC,YAAY,IAAI,CAAC,CAAC,YAAY;YACzD,kBAAkB,EAAE,WAAY,CAAC,kBAAkB,IAAI,CAAC,CAAC,kBAAkB;SAC5E,CAAC;IACJ,CAAC;IAED,OAAO;QACL,WAAW,EAAE,QAAQ;QACrB,eAAe,EAAE,QAAQ,CAAC,QAAQ;QAClC,YAAY,EAAE,SAAS,CAAC,QAAQ;QAChC,cAAc;QACd,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAuB;IAC7C,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,KAAK,CAAC;QAC7B,QAAQ,EAAE,cAAc,CAAC,KAAK,CAAC;QAC/B,WAAW,EAAE,iBAAiB,CAAC,KAAK,CAAC;QACrC,YAAY,EAAE,kBAAkB,CAAC,KAAK,CAAC;QACvC,kBAAkB,EAAE,wBAAwB,CAAC,KAAK,CAAC;KACpD,CAAC;AACJ,CAAC;AAED,qEAAqE;AAErE;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAmB,EAAE,MAAoB;IACrE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,GAAG,cAAc,EAAE,CAAC;IACpD,IAAI,CAAC,KAAK,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3C,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ;YACnD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS;YACtD,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,cAAc,CAAC,OAAO;YAChD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS;YACtD,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,cAAc,CAAC,WAAW;YAC5D,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,cAAc,CAAC,QAAQ;YACnD,cAAc,EAAE,KAAK,CAAC,cAAc,IAAI,cAAc,CAAC,cAAc;SACtE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,GAAG,MAAO,CAAC;IAClB,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,KAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,CAAC,QAAQ,CAAC;QACxE,SAAS,EAAE,QAAQ,CAAC,KAAM,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAClD,OAAO,EAAE,QAAQ,CAAC,KAAM,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;QAC5C,SAAS,EAAE,QAAQ,CAAC,KAAM,CAAC,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC;QAClD,WAAW,EAAE,QAAQ,CAAC,KAAM,CAAC,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC;QACxD,QAAQ,EAAE,QAAQ,CAAC,KAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,CAAC;QAC/C,cAAc,EAAE,QAAQ,CAAC,KAAM,CAAC,cAAc,EAAE,CAAC,CAAC,cAAc,CAAC;KAClE,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ,CACf,QAA4B,EAC5B,SAA6B,EAC7B,UAAmB;IAEnB,MAAM,eAAe,GAAG,SAAS,IAAI,UAAU,CAAC;IAChD,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACnD,IAAI,eAAe,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;AAC7C,CAAC"}

package/dist/services/agent-runtime/resolved-agent.d.ts

@@ -0,0 +1,42 @@
+import type { ResolvedAgentPermissions, AgentLimits, ExactModelPolicy } from './types.js';
+import type { ResolvedFilesystemScope, ResolvedNetworkScope } from './scope-resolver.js';
+/**
+ * Immutable internal definition of a fully-resolved agent.
+ * Core executors consume only this type — they never load roles,
+ * skills, or widen authority.
+ *
+ * Carries both coarse permission flags and fine-grained resolved scopes.
+ * When scopes are undefined, no fine-grained restriction applies (legacy
+ * coarse flag behavior). When scopes are defined, they MUST be enforced
+ * at invocation time by tool wrappers.
+ */
+export interface ResolvedAgentDefinition {
+    readonly name: string;
+    /** Stable trusted-preset identity; distinct from the user-facing display name. */
+    readonly legacyRole?: string;
+    readonly instructions: string;
+    readonly model: ExactModelPolicy;
+    /** Internal coarse permission flags resolved from the public shape. */
+    readonly permissions: ResolvedAgentPermissions;
+    /** Resolved limits clamped to parent maxima. */
+    readonly limits: AgentLimits;
+    /** Resolved tool names available to the agent. */
+    readonly tools: ReadonlyArray<string>;
+    /** Resolved skill instruction bodies. */
+    readonly skillInstructions: string;
+    /** Resolved filesystem scopes (undefined = no fine-grained restriction). */
+    readonly filesystemScope?: ResolvedFilesystemScope;
+    /** Resolved network host scopes (undefined = no fine-grained restriction). */
+    readonly networkScope?: ResolvedNetworkScope;
+    /** Structured output schema request (undefined if not requested). */
+    readonly outputSchema?: {
+        schema: Record<string, unknown>;
+        name?: string;
+    };
+    /** Errors accumulated during resolution. If non-empty the handle MUST refuse execution. */
+    readonly resolutionErrors: ReadonlyArray<{
+        code: string;
+        message: string;
+    }>;
+}
+//# sourceMappingURL=resolved-agent.d.ts.map

package/dist/services/agent-runtime/resolved-agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-agent.d.ts","sourceRoot":"","sources":["../../../source/services/agent-runtime/resolved-agent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC1F,OAAO,KAAK,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEzF;;;;;;;;;GASG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,wBAAwB,CAAC;IAC/C,gDAAgD;IAChD,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,yCAAyC;IACzC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,uBAAuB,CAAC;IACnD,8EAA8E;IAC9E,QAAQ,CAAC,YAAY,CAAC,EAAE,oBAAoB,CAAC;IAC7C,qEAAqE;IACrE,QAAQ,CAAC,YAAY,CAAC,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC;IACF,2FAA2F;IAC3F,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC;QACvC,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC,CAAC;CACJ"}

package/dist/services/agent-runtime/resolved-agent.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=resolved-agent.js.map

package/dist/services/agent-runtime/resolved-agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolved-agent.js","sourceRoot":"","sources":["../../../source/services/agent-runtime/resolved-agent.ts"],"names":[],"mappings":""}