@robota-sdk/agent-core 3.0.0-beta.84 → 3.0.0-beta.86

package/CHANGELOG.md

@@ -1,5 +1,63 @@
 # @robota-sdk/agent-core
 
+## 3.0.0-beta.86
+
+## 3.0.0-beta.85
+
+### Patch Changes
+
+- 41cca13: Fixed `run(input, { allowToolOnlyCompletion: true })` throwing an internal `[STRICT-POLICY]` error
+  when a round produced neither a tool call nor any text — for example a tool-calling decision agent
+  whose model answered with nothing at all. `allowToolOnlyCompletion` only widens what counts as a
+  finished turn (a tool call alone, with no final text); an ordinary text-only reply already completes
+  normally and is unaffected, and a turn that ends in tool results still resolves with `''`. A turn
+  that ends with neither text nor a tool result now rejects with a new, catchable `EmptyCompletionError`
+  (`code: 'EMPTY_COMPLETION'`) instead of the internal invariant message; `resume()` of such an
+  execution raises the same error.
+- ada3841: Dispatch tool-call plugin hooks around each decoded attempt, including unknown-tool refusals,
+  and emit the event emitter plugin's before-execution event. A pre-effect wait resumes the same
+  logical call without repeating its before hooks; recovered results do not replay call hooks.
+
+  Pair parallel tool analytics by the logical execution ID, including calls of the same tool.
+
+- 5093a30: A `Robota` run now calls `beforeConversation`, with `beforeExecution`, and `onStreamingChunk` for
+  each streamed piece of text, in order; the round waits for those chunk hooks before it goes on,
+  whether the provider call returned, failed or was interrupted. `EventEmitterPlugin` therefore emits
+  `CONVERSATION_START`.
+
+  The run result's `toolCalls` now carry each executed call's id and `result: null` for one that
+  failed, so `EventEmitterPlugin` emits `TOOL_ERROR` instead of `TOOL_SUCCESS` for a failed call, and
+  `WebhookPlugin`'s `tool.executed` payload reports it as failed with its call id.
+
+  `EXECUTION_START`, `EXECUTION_COMPLETE` and `EXECUTION_ERROR` are marked deprecated: no run emits
+  them; the `AGENT_EXECUTION_*` events are the ones a run emits. `beforeToolCall`,
+  `beforeToolExecution` and `afterToolCall` are still not called.
+
+- 94b2c87: A PreToolUse `command` hook can now steer a tool call, not only refuse it. The permission gate
+  applies the winning `hookSpecificOutput.permissionDecision`:
+
+  - `allow` skips the prompt a person would otherwise get. Deny rules, refusals from the mode, the
+    `auto` mode classifier and asks that must reach a person (an `ask` rule, a protected path, a
+    policy that asks about everything) still apply.
+  - `ask` sends the call to a person even when the mode or a remembered consent would run it. The
+    answer is not remembered, and with no one to ask the call is refused.
+  - `defer` leaves the call to the normal flow, as before.
+
+  Before this change these decisions were read and then ignored.
+
+  `updatedInput` is still not applied: the call runs the input it was made with, and an `allow` sent
+  with an `updatedInput` is not applied either, since it approved another input.
+
+  `runHooks` (agent-core) now reads a decision and an `updatedInput` only from `command` hooks: a
+  `prompt` or `agent` hook answers from a model that reads the tool input it judges, so it can only
+  refuse. With several hooks, `ask` now outranks `defer` (`deny` > `ask` > `defer` > `allow`), and the
+  reported `updatedInput` is the one sent with the winning decision.
+
+- 3ab2eca: - External presets accept every permission mode a session does, `auto` included; `auto` used to fail validation.
+  - `createDagFramework({ ports: { costMeta } })` wires cost-metadata management; without it cost operations still report that they are unsupported.
+  - `startCli()` runs the subagent worker when a subagent starts the embedder's entry script again, as the `robota` executable already did; an embedded CLI used to start a second CLI there.
+  - The provider `executor` option docs no longer import a `RemoteExecutor` that does not exist, and `IRemoteExecutorConfig` is marked deprecated: nothing implements a remote executor.
+
 ## 3.0.0-beta.84
 
 ### Minor Changes

package/dist/browser/bounded-output-Bgx2Cgkx.js

@@ -0,0 +1,2 @@
+var e=class extends Error{context;constructor(e,t){super(e),this.context=t,this.name=this.constructor.name,Object.setPrototypeOf(this,new.target.prototype)}},t=class extends e{code=`CONFIGURATION_ERROR`;category=`user`;recoverable=!1;constructor(e,t){super(`Configuration Error: ${e}`,t)}},n=class extends e{field;code=`VALIDATION_ERROR`;category=`user`;recoverable=!1;constructor(e,t,n){super(`Validation Error: ${e}`,n),this.field=t}},r=class extends e{issues;attempts;code=`STRUCTURED_OUTPUT_ERROR`;category=`provider`;recoverable=!0;constructor(e,t,n,r){super(`Structured Output Error: ${e}`,r),this.issues=t,this.attempts=n}},i=class extends e{provider;originalError;code=`PROVIDER_ERROR`;category=`provider`;recoverable=!0;status;type;constructor(e,t,n,r,i){super(`Provider Error (${t}): ${e}`,r),this.provider=t,this.originalError=n,i?.status!==void 0&&(this.status=i.status),i?.type!==void 0&&(this.type=i.type)}},a=class extends e{provider;code=`AUTHENTICATION_ERROR`;category=`user`;recoverable=!1;constructor(e,t,n){super(`Authentication Error: ${e}`,n),this.provider=t}},o=class extends e{retryAfter;provider;code=`RATE_LIMIT_ERROR`;category=`provider`;recoverable=!0;constructor(e,t,n,r){super(`Rate Limit Error: ${e}`,r),this.retryAfter=t,this.provider=n}},s=class extends e{originalError;provider;code=`NETWORK_ERROR`;category=`system`;recoverable=!0;constructor(e,t,n,r){super(`Network Error: ${e}`,n),this.originalError=t,this.provider=r}},c=class extends e{toolName;originalError;code=`TOOL_EXECUTION_ERROR`;category=`system`;recoverable=!1;constructor(e,t,n,r){super(`Tool Execution Error (${t}): ${e}`,r),this.toolName=t,this.originalError=n}},l=class extends e{toolName;callCount;maxSameToolInputs;code=`SAME_TOOL_INPUT_LOOP`;category=`system`;recoverable=!0;constructor(e,t,n,r){super(`Tool "${e}" was called with identical input ${t} times, past the maxSameToolInputs limit of ${n} — stopping the turn to break the loop`,r),this.toolName=e,this.callCount=t,this.maxSameToolInputs=n}},u=class extends e{round;code=`EMPTY_COMPLETION`;category=`provider`;recoverable=!0;constructor(e,t){super(`Round ${e} ended with no tool call and no text response, and allowToolOnlyCompletion prevented the follow-up call that would otherwise recover it`,t),this.round=e}},d=class extends e{model;provider;availableModels;code=`MODEL_NOT_AVAILABLE`;category=`user`;recoverable=!1;constructor(e,t,n,r){let i=e===void 0?`No model available for provider "${t}"`:`Model "${e}" is not available for provider "${t}"`,a=r?.originalMessage;super(typeof a==`string`&&a.length>0?`${i}: ${a}`:i,r),this.model=e,this.provider=t,this.availableModels=n}},f=class extends e{code=`CIRCUIT_BREAKER_OPEN`;category=`system`;recoverable=!0;constructor(e=`Circuit breaker is open`,t){super(e,t)}},p=class extends e{pluginName;code=`PLUGIN_ERROR`;category=`system`;recoverable=!1;constructor(e,t,n){super(`Plugin Error (${t}): ${e}`,n),this.pluginName=t}},m=class extends e{code=`STORAGE_ERROR`;category=`system`;recoverable=!0;constructor(e,t){super(`Storage Error: ${e}`,t)}},h=class extends e{code=`CACHE_INTEGRITY_ERROR`;category=`system`;recoverable=!1;constructor(e,t){super(`Cache Integrity Error: ${e}`,t)}},g=class extends e{executable;code=`UNSUPPORTED_SHELL`;category=`user`;recoverable=!1;constructor(e){super(`Unsupported shell executable: ${e}`,{executable:e}),this.executable=e}};function _(e){return e===`darwin`?'Host OS: macOS (POSIX, BSD userland). Use BSD-flavored utilities: `sed -i ""` needs an empty backup arg, `date`/`grep`/`stat` flags differ from GNU. Prefer portable POSIX flags; avoid Linux/GNU-only options.':e===`linux`?"Host OS: Linux (POSIX, usually GNU coreutils, but distro/user setup varies). Prefer portable POSIX flags; do not assume a specific distro, and probe with `command -v` before relying on a non-standard tool.":`Host OS: ${e}; active shell family: POSIX sh/bash. Write portable POSIX syntax and avoid host-specific flags.`}function v(e,t){let n=x(e)===`bash`?`bash`:`sh`;return{command:e,kind:n,platform:t,commandArgs:e=>[`-c`,e],interactiveArgs:[],label:`${n} on ${t}`,syntaxHint:_(t)}}function y(e,t){return{command:e,kind:`powershell`,platform:t,commandArgs:e=>[`-NoProfile`,`-Command`,e],interactiveArgs:[`-NoProfile`],label:`PowerShell on ${t}`,syntaxHint:`Host OS: ${t}; active shell family: PowerShell. Write PowerShell syntax (not bash): e.g. \`Get-ChildItem\` not \`ls -la\`, \`\$env:VAR\` not \`\$VAR\`.`}}function b(e,t){return{command:e,kind:`cmd`,platform:t,commandArgs:e=>[`/d`,`/s`,`/c`,e],interactiveArgs:[],label:`cmd.exe on ${t}`,syntaxHint:`Host OS: ${t}; active shell family: Windows cmd.exe. Write cmd.exe syntax.`}}function x(e){return(e.split(/[\\/]/).at(-1)?.toLowerCase()??``).replace(/\.exe$/i,``)}function S(e,t){switch(x(e)){case`sh`:case`bash`:return v(e,t);case`powershell`:case`pwsh`:return y(e,t);case`cmd`:return b(e,t);default:throw new g(e)}}function C(e){let t=e?.trim();return t===void 0||t.length===0?void 0:t}function w(e={}){let t=e.env??process.env,n=e.platform??process.platform,r=C(e.executable);return r===void 0?n===`win32`?y(`powershell.exe`,n):v(C(t.SHELL)??`/bin/sh`,n):S(r,n)}const T=/^(?!0{32}$)[0-9a-f]{32}$/,E=/^(?!0{16}$)[0-9a-f]{16}$/;function D(e){return e.replaceAll(`-`,``).slice(0,16)}const O=D;function k(e){return E.test(e)}function A(e,t){if(!(!T.test(e)||!E.test(t)))return`00-${e}-${t}-01`}function j(e,t){if(e.allowedOrigins.length===0)return;let n=A(e.traceId,D(t));if(n!==void 0)return{traceparent:n,allowedOrigins:[...e.allowedOrigins]}}function M(e,t){return j(e,t)}function N(e,t,n){if(t?.subprocessClasses?.includes(e)!==!0)return;let r=A(t.traceId,n);return r===void 0?void 0:{TRACEPARENT:r}}function P(e,t,n={}){if(t===void 0||n.TRACEPARENT!==void 0)return{...e,...n};let{TRACESTATE:r,...i}=e;return{...i,...t,...n}}function F(e,t){if(e===void 0||t===void 0)return{};let n;try{n=new URL(e).origin}catch{return{}}return n===`null`||!t.allowedOrigins.includes(n)?{}:{traceparent:t.traceparent}}const I=e=>`\n…[output truncated: ${e} byte(s) dropped]`;function L(e){let t=e.retain??`head`,n=e.truncationMarker??I,r=Math.max(0,Math.floor(e.maxBytes)),i=new TextEncoder,a=[],o=0,s=0,c=e=>{let t=r-o;if(t<=0)return;let n=e.byteLength<=t?e:e.subarray(0,t);a.push(n),o+=n.byteLength},l=e=>{let t=e.byteLength<=r?e:e.subarray(e.byteLength-r);for(a.push(t),o+=t.byteLength;o>r&&a.length>0;){let e=a[0],t=o-r;e.byteLength<=t?(a.shift(),o-=e.byteLength):(a[0]=e.subarray(t),o-=t)}};return{append(e){let n=typeof e==`string`?i.encode(e):e;s+=n.byteLength,t===`head`?c(n):l(n)},get retainedBytes(){return o},get totalBytes(){return s},get droppedBytes(){return s-o},get truncated(){return s>o},toString(){let e=new Uint8Array(o),r=0;for(let t of a)e.set(t,r),r+=t.byteLength;a=a.length>1?[e]:a;let i=new TextDecoder().decode(e);if(s<=o)return i;let c=n(s-o);return t===`head`?`${i}${c}`:`${c.replace(/^\n/,``)}\n${i}`}}}export{e as C,c as D,r as E,n as O,o as S,m as T,u as _,O as a,p as b,M as c,g as d,w as f,t as g,f as h,j as i,N as l,h as m,A as n,D as o,a as p,k as r,P as s,L as t,F as u,d as v,l as w,i as x,s as y};
+//# sourceMappingURL=bounded-output-Bgx2Cgkx.js.map

package/dist/browser/bounded-output-Bgx2Cgkx.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bounded-output-Bgx2Cgkx.js","names":[],"sources":["../../src/utils/errors.ts","../../src/utils/platform-shell.ts","../../src/utils/trace-context.ts","../../src/utils/bounded-output.ts"],"sourcesContent":["/**\n * Reusable type definitions for error utilities\n */\n\n/**\n * Error context data type\n * Used for storing contextual information in error instances\n */\nexport type TErrorContextData = Record<\n  string,\n  string | number | boolean | Date | Error | string[] | undefined\n>;\n\n/**\n * Error external input type\n * Used for handling external errors from unknown sources\n */\nexport type TErrorExternalInput =\n  Error | string | Record<string, string | number | boolean> | null | undefined;\n\n/**\n * Base error class for all Robota errors\n */\nexport abstract class RobotaError extends Error {\n  abstract readonly code: string;\n  abstract readonly category: 'user' | 'system' | 'provider';\n  abstract readonly recoverable: boolean;\n\n  constructor(\n    message: string,\n    public readonly context?: TErrorContextData,\n  ) {\n    super(message);\n    this.name = this.constructor.name;\n\n    // Ensure proper prototype chain for instanceof checks\n    Object.setPrototypeOf(this, new.target.prototype);\n  }\n}\n\n/**\n * Configuration related errors\n */\nexport class ConfigurationError extends RobotaError {\n  readonly code = 'CONFIGURATION_ERROR';\n  readonly category = 'user' as const;\n  readonly recoverable = false;\n\n  constructor(message: string, context?: TErrorContextData) {\n    super(`Configuration Error: ${message}`, context);\n  }\n}\n\n/**\n * Input validation errors\n */\nexport class ValidationError extends RobotaError {\n  readonly code = 'VALIDATION_ERROR';\n  readonly category = 'user' as const;\n  readonly recoverable = false;\n\n  constructor(\n    message: string,\n    public readonly field?: string,\n    context?: TErrorContextData,\n  ) {\n    super(`Validation Error: ${message}`, context);\n  }\n}\n\n/**\n * Structured output validation exhausted its retry budget (CORE-015).\n *\n * Thrown by `run(input, { output })` when the model's final response still fails\n * schema validation after the configured number of retries. `issues` holds the\n * validation messages from the last attempt; `attempts` is the total number of\n * provider turns spent (initial + retries).\n */\nexport class StructuredOutputError extends RobotaError {\n  readonly code = 'STRUCTURED_OUTPUT_ERROR';\n  readonly category = 'provider' as const;\n  readonly recoverable = true;\n\n  constructor(\n    message: string,\n    public readonly issues: string[],\n    public readonly attempts: number,\n    context?: TErrorContextData,\n  ) {\n    super(`Structured Output Error: ${message}`, context);\n  }\n}\n\n/** What the vendor said about a failed call, as far as it said anything. */\nexport interface IProviderFailureDetails {\n  /** The HTTP status of the failed response; absent for a failure with no response (e.g. an SSE error event). */\n  status?: number;\n  /** The vendor's own error type, e.g. Anthropic's `overloaded_error`. */\n  type?: string;\n}\n\n/**\n * Provider related errors\n */\nexport class ProviderError extends RobotaError {\n  readonly code = 'PROVIDER_ERROR';\n  readonly category = 'provider' as const;\n  readonly recoverable = true;\n  readonly status?: number;\n  readonly type?: string;\n\n  constructor(\n    message: string,\n    public readonly provider: string,\n    public readonly originalError?: Error,\n    context?: TErrorContextData,\n    details?: IProviderFailureDetails,\n  ) {\n    super(`Provider Error (${provider}): ${message}`, context);\n    if (details?.status !== undefined) this.status = details.status;\n    if (details?.type !== undefined) this.type = details.type;\n  }\n}\n\n/**\n * Authentication errors\n */\nexport class AuthenticationError extends RobotaError {\n  readonly code = 'AUTHENTICATION_ERROR';\n  readonly category = 'user' as const;\n  readonly recoverable = false;\n\n  constructor(\n    message: string,\n    public readonly provider?: string,\n    context?: TErrorContextData,\n  ) {\n    super(`Authentication Error: ${message}`, context);\n  }\n}\n\n/**\n * Rate limit errors\n */\nexport class RateLimitError extends RobotaError {\n  readonly code = 'RATE_LIMIT_ERROR';\n  readonly category = 'provider' as const;\n  readonly recoverable = true;\n\n  constructor(\n    message: string,\n    public readonly retryAfter?: number,\n    public readonly provider?: string,\n    context?: TErrorContextData,\n  ) {\n    super(`Rate Limit Error: ${message}`, context);\n  }\n}\n\n/**\n * Network/connectivity errors\n */\nexport class NetworkError extends RobotaError {\n  readonly code = 'NETWORK_ERROR';\n  readonly category = 'system' as const;\n  readonly recoverable = true;\n\n  constructor(\n    message: string,\n    public readonly originalError?: Error,\n    context?: TErrorContextData,\n    /** `undefined` for a network failure with no provider context (e.g. a generic timeout). */\n    public readonly provider?: string,\n  ) {\n    super(`Network Error: ${message}`, context);\n  }\n}\n\n/**\n * Tool execution errors\n */\nexport class ToolExecutionError extends RobotaError {\n  readonly code = 'TOOL_EXECUTION_ERROR';\n  readonly category = 'system' as const;\n  readonly recoverable = false;\n\n  constructor(\n    message: string,\n    public readonly toolName: string,\n    public readonly originalError?: Error,\n    context?: TErrorContextData,\n  ) {\n    super(`Tool Execution Error (${toolName}): ${message}`, context);\n  }\n}\n\n/**\n * The same-tool-input loop guard tripped — CORE-035.\n *\n * A tool was invoked with byte-identical serialized inputs more times than `maxSameToolInputs`\n * allows, so the turn stopped rather than looping. This is the AGENT giving up, not the user\n * cancelling: the SPEC used to promise an `AbortError` here, which `isAbortFailure` resolves as\n * `success: true, interrupted: true` — reporting a run that produced no answer as a success.\n *\n * Named rather than a bare `Error` for the reason the SPEC was reaching for by naming a type at all:\n * a caller must be able to tell \"the agent looped\" from \"the network died\". `RobotaError` carries\n * `code`/`category`/`recoverable` out through CORE-027's failure path intact.\n *\n * `recoverable` is TRUE: the loop is a property of this turn's prompt and tool set, not of the\n * system, and a caller that varies either can reasonably try again.\n */\nexport class SameToolInputLoopError extends RobotaError {\n  readonly code = 'SAME_TOOL_INPUT_LOOP';\n  readonly category = 'system' as const;\n  readonly recoverable = true;\n\n  constructor(\n    public readonly toolName: string,\n    public readonly callCount: number,\n    public readonly maxSameToolInputs: number,\n    context?: TErrorContextData,\n  ) {\n    super(\n      `Tool \"${toolName}\" was called with identical input ${callCount} times, past the ` +\n        `maxSameToolInputs limit of ${maxSameToolInputs} — stopping the turn to break the loop`,\n      context,\n    );\n  }\n}\n\n/**\n * A turn ended with neither a tool result nor a final text response while `allowToolOnlyCompletion`\n * was set.\n *\n * `allowToolOnlyCompletion` only WIDENS what counts as a valid finish (a tool call alone, with no\n * final text after it); it never narrows the ordinary case. Without the flag, a round that produces\n * neither is recovered by one more provider call asking for a summary (`forceSummaryCall`). Setting\n * the flag is what turns that rescue off — a decision agent wants exactly one provider call, never a\n * follow-up — so a round that produces neither has nothing left to recover it. That is a genuinely\n * unanswered turn, not the internal `[STRICT-POLICY]` result-shape violation an actually malformed\n * execution result trips; a caller must be able to catch this by type instead of parsing that message.\n *\n * `recoverable` is TRUE: like `SameToolInputLoopError`, this is a property of this turn's prompt and\n * model response, not of the system, and a caller that varies either can reasonably try again.\n */\nexport class EmptyCompletionError extends RobotaError {\n  readonly code = 'EMPTY_COMPLETION';\n  readonly category = 'provider' as const;\n  readonly recoverable = true;\n\n  constructor(\n    public readonly round: number,\n    context?: TErrorContextData,\n  ) {\n    super(\n      `Round ${round} ended with no tool call and no text response, and allowToolOnlyCompletion ` +\n        'prevented the follow-up call that would otherwise recover it',\n      context,\n    );\n  }\n}\n\n/**\n * Model not available errors\n */\nexport class ModelNotAvailableError extends RobotaError {\n  readonly code = 'MODEL_NOT_AVAILABLE';\n  readonly category = 'user' as const;\n  readonly recoverable = false;\n\n  constructor(\n    /** `undefined` when the failure names no model — a provider adapter classifying a raw HTTP\n     *  response by status alone does not always know which model the vendor meant. */\n    public readonly model: string | undefined,\n    public readonly provider: string,\n    public readonly availableModels?: string[],\n    /**\n     * `context.originalMessage`, when given, is the vendor's own text (already scrubbed of any\n     * credential by the caller) — folded into `message` so a \"Details\" disclosure built from\n     * `message` alone still shows the real cause instead of just this class's fixed sentence.\n     */\n    context?: TErrorContextData,\n  ) {\n    const base =\n      model !== undefined\n        ? `Model \"${model}\" is not available for provider \"${provider}\"`\n        : `No model available for provider \"${provider}\"`;\n    const detail = context?.['originalMessage'];\n    super(typeof detail === 'string' && detail.length > 0 ? `${base}: ${detail}` : base, context);\n  }\n}\n\n/**\n * Circuit breaker open error\n */\nexport class CircuitBreakerOpenError extends RobotaError {\n  readonly code = 'CIRCUIT_BREAKER_OPEN';\n  readonly category = 'system' as const;\n  readonly recoverable = true;\n\n  constructor(message: string = 'Circuit breaker is open', context?: TErrorContextData) {\n    super(message, context);\n  }\n}\n\n/**\n * Plugin errors\n */\nexport class PluginError extends RobotaError {\n  readonly code = 'PLUGIN_ERROR';\n  readonly category = 'system' as const;\n  readonly recoverable = false;\n\n  constructor(\n    message: string,\n    public readonly pluginName: string,\n    context?: TErrorContextData,\n  ) {\n    super(`Plugin Error (${pluginName}): ${message}`, context);\n  }\n}\n\n/**\n * Storage related errors\n */\nexport class StorageError extends RobotaError {\n  readonly code = 'STORAGE_ERROR';\n  readonly category = 'system' as const;\n  readonly recoverable = true;\n\n  constructor(message: string, context?: TErrorContextData) {\n    super(`Storage Error: ${message}`, context);\n  }\n}\n\n/**\n * Cache integrity validation errors\n */\nexport class CacheIntegrityError extends RobotaError {\n  readonly code = 'CACHE_INTEGRITY_ERROR';\n  readonly category = 'system' as const;\n  readonly recoverable = false;\n\n  constructor(message: string, context?: TErrorContextData) {\n    super(`Cache Integrity Error: ${message}`, context);\n  }\n}\n","/**\n * TERM-008: cross-platform shell resolution (SSOT).\n *\n * Single source of truth for \"which shell do we spawn, and how\", shared by every shell-running site.\n * Resolution is a pure function of one request so every branch is testable without the host shell.\n */\n\nimport { RobotaError } from './errors.js';\n\n/** Shell family — drives non-interactive arg shape, quoting, and LLM syntax guidance. */\nexport type TShellKind = 'bash' | 'sh' | 'powershell' | 'cmd';\n\n/** The active shell resolved for a platform, plus the metadata callers need to drive and describe it. */\nexport interface IPlatformShell {\n  /** Executable to spawn (e.g. `/bin/sh`, `powershell.exe`, or `$SHELL`). */\n  readonly command: string;\n  /** Shell family. */\n  readonly kind: TShellKind;\n  /** Node platform this was resolved for (`process.platform`). */\n  readonly platform: NodeJS.Platform;\n  /** Args to run a single command string non-interactively. */\n  commandArgs(command: string): string[];\n  /** Args for an interactive shell session (drop-to-shell). */\n  readonly interactiveArgs: string[];\n  /** Human label for the active shell, for tool/UI descriptions (e.g. `PowerShell (Windows)`). */\n  readonly label: string;\n  /** One-line syntax guidance for an LLM authoring commands. */\n  readonly syntaxHint: string;\n}\n\n/** Pure inputs for resolving one executable together with its command argument family. */\nexport interface IPlatformShellResolutionRequest {\n  /** Request-local executable. A non-blank value has the highest precedence. */\n  readonly executable?: string;\n  /** Environment used for SHELL resolution. */\n  readonly env?: NodeJS.ProcessEnv;\n  /** Actual host platform retained in the resolved metadata. */\n  readonly platform?: NodeJS.Platform;\n}\n\n/** An explicit executable whose basename has no supported command argument family. */\nexport class UnsupportedShellError extends RobotaError {\n  readonly code = 'UNSUPPORTED_SHELL';\n  readonly category = 'user' as const;\n  readonly recoverable = false;\n\n  constructor(public readonly executable: string) {\n    super(`Unsupported shell executable: ${executable}`, { executable });\n  }\n}\n\n/**\n * OS-family syntax guidance for the LLM. macOS and Linux are both POSIX but ship different userlands\n * (macOS = BSD coreutils, most Linux = GNU coreutils), so flags like `sed -i`, `date`, and `grep`\n * differ — naming the OS lets the model avoid Linux-only invocations on macOS and vice versa.\n */\nfunction posixSyntaxHint(platform: NodeJS.Platform): string {\n  if (platform === 'darwin') {\n    return 'Host OS: macOS (POSIX, BSD userland). Use BSD-flavored utilities: `sed -i \"\"` needs an empty backup arg, `date`/`grep`/`stat` flags differ from GNU. Prefer portable POSIX flags; avoid Linux/GNU-only options.';\n  }\n  if (platform === 'linux') {\n    return 'Host OS: Linux (POSIX, usually GNU coreutils, but distro/user setup varies). Prefer portable POSIX flags; do not assume a specific distro, and probe with `command -v` before relying on a non-standard tool.';\n  }\n  return `Host OS: ${platform}; active shell family: POSIX sh/bash. Write portable POSIX syntax and avoid host-specific flags.`;\n}\n\nfunction posixShell(command: string, platform: NodeJS.Platform): IPlatformShell {\n  const isBash = shellBasename(command) === 'bash';\n  const kind: TShellKind = isBash ? 'bash' : 'sh';\n  return {\n    command,\n    kind,\n    platform,\n    commandArgs: (cmd: string): string[] => ['-c', cmd],\n    interactiveArgs: [],\n    label: `${kind} on ${platform}`,\n    syntaxHint: posixSyntaxHint(platform),\n  };\n}\n\nfunction powerShell(command: string, platform: NodeJS.Platform): IPlatformShell {\n  return {\n    command,\n    kind: 'powershell',\n    platform,\n    commandArgs: (cmd: string): string[] => ['-NoProfile', '-Command', cmd],\n    interactiveArgs: ['-NoProfile'],\n    label: `PowerShell on ${platform}`,\n    syntaxHint:\n      `Host OS: ${platform}; active shell family: PowerShell. Write PowerShell syntax (not bash): e.g. ` +\n      '`Get-ChildItem` not `ls -la`, `$env:VAR` not `$VAR`.',\n  };\n}\n\nfunction cmdShell(command: string, platform: NodeJS.Platform): IPlatformShell {\n  return {\n    command,\n    kind: 'cmd',\n    platform,\n    commandArgs: (cmd: string): string[] => ['/d', '/s', '/c', cmd],\n    interactiveArgs: [],\n    label: `cmd.exe on ${platform}`,\n    syntaxHint: `Host OS: ${platform}; active shell family: Windows cmd.exe. Write cmd.exe syntax.`,\n  };\n}\n\nfunction shellBasename(command: string): string {\n  const basename = command.split(/[\\\\/]/).at(-1)?.toLowerCase() ?? '';\n  return basename.replace(/\\.exe$/i, '');\n}\n\nfunction explicitShell(command: string, platform: NodeJS.Platform): IPlatformShell {\n  switch (shellBasename(command)) {\n    case 'sh':\n    case 'bash':\n      return posixShell(command, platform);\n    case 'powershell':\n    case 'pwsh':\n      return powerShell(command, platform);\n    case 'cmd':\n      return cmdShell(command, platform);\n    default:\n      throw new UnsupportedShellError(command);\n  }\n}\n\nfunction nonBlank(value: string | undefined): string | undefined {\n  const trimmed = value?.trim();\n  return trimmed === undefined || trimmed.length === 0 ? undefined : trimmed;\n}\n\n/**\n * Resolve the shell to spawn for the current (or a given) platform.\n *\n * - request `executable` wins when non-blank.\n * - **win32:** PowerShell.\n * - **posix:** `$SHELL` if set, else `/bin/sh`.\n */\nexport function resolvePlatformShell(\n  request: IPlatformShellResolutionRequest = {},\n): IPlatformShell {\n  const env = request.env ?? process.env;\n  const platform = request.platform ?? process.platform;\n  const requestedExecutable = nonBlank(request.executable);\n  if (requestedExecutable !== undefined) return explicitShell(requestedExecutable, platform);\n\n  if (platform === 'win32') return powerShell('powershell.exe', platform);\n\n  return posixShell(nonBlank(env['SHELL']) ?? '/bin/sh', platform);\n}\n","/**\n * Pure helpers for trusted W3C trace context. Strings and the WHATWG `URL` only, so they are the\n * same in the browser build and in every adapter that attaches the header.\n */\nimport type {\n  IOutboundTraceContext,\n  IRunTraceContext,\n  ISubprocessTraceEnv,\n  TSubprocessTraceClass,\n} from '../interfaces/trace-context';\n\nconst TRACE_ID = /^(?!0{32}$)[0-9a-f]{32}$/;\nconst SPAN_ID = /^(?!0{16}$)[0-9a-f]{16}$/;\n\n/**\n * The span ID an operation is exported under, derived from the ID core mints before it runs (a\n * provider call's call ID, a tool body's body ID). One derivation for both the exporter and the\n * outgoing header, so the span a recipient sees as its parent is the span the trace contains.\n */\nexport function spanIdFromMintedId(mintedId: string): string {\n  return mintedId.replaceAll('-', '').slice(0, 16);\n}\n\n/** The provider-call name for {@link spanIdFromMintedId}, kept so existing callers keep working. */\nexport const providerCallSpanId: (callId: string) => string = spanIdFromMintedId;\n\n/** Whether `spanId` is a well-formed minted span ID: 16 lowercase hex characters, not all zero. */\nexport function isMintedSpanId(spanId: string): boolean {\n  return SPAN_ID.test(spanId);\n}\n\n/** A sampled version-00 `traceparent`, or undefined when either identifier is invalid. */\nexport function buildTraceparent(traceId: string, spanId: string): string | undefined {\n  if (!TRACE_ID.test(traceId) || !SPAN_ID.test(spanId)) return undefined;\n  return `00-${traceId}-${spanId}-01`;\n}\n\n/** The outbound context for one invoked call, or undefined when there is nothing valid to send. */\nexport function outboundTraceContextFor(\n  traceContext: IRunTraceContext,\n  callId: string,\n): IOutboundTraceContext | undefined {\n  if (traceContext.allowedOrigins.length === 0) return undefined;\n  const traceparent = buildTraceparent(traceContext.traceId, spanIdFromMintedId(callId));\n  if (traceparent === undefined) return undefined;\n  return { traceparent, allowedOrigins: [...traceContext.allowedOrigins] };\n}\n\n/**\n * The outbound context for one tool body, keyed by the body ID core minted for it — never the\n * vendor's tool call ID, which is neither unique nor hex.\n */\nexport function toolTraceContextFor(\n  traceContext: IRunTraceContext,\n  toolBodyId: string,\n): IOutboundTraceContext | undefined {\n  return outboundTraceContextFor(traceContext, toolBodyId);\n}\n\n/**\n * The environment one child process of `subprocessClass` receives, naming `spanId` as its parent,\n * or undefined when the host did not enable that class. Independent of the origin allowlist.\n */\nexport function traceEnvFor(\n  subprocessClass: TSubprocessTraceClass,\n  traceContext: IRunTraceContext | undefined,\n  spanId: string,\n): ISubprocessTraceEnv | undefined {\n  if (traceContext?.subprocessClasses?.includes(subprocessClass) !== true) return undefined;\n  const traceparent = buildTraceparent(traceContext.traceId, spanId);\n  return traceparent === undefined ? undefined : { TRACEPARENT: traceparent };\n}\n\n/**\n * A fresh child environment: `base`, then Robota's trace, then `overrides`. When Robota's value\n * applies, the ambient `TRACESTATE` is dropped because it belongs to a different parent. When\n * `overrides` sets its own `TRACEPARENT`, Robota's value does not apply and `base` passes unchanged.\n * `base` itself is never modified.\n */\nexport function subprocessTraceEnvironment(\n  base: Readonly<Record<string, string | undefined>>,\n  traceEnv: ISubprocessTraceEnv | undefined,\n  overrides: Readonly<Record<string, string>> = {},\n): Record<string, string | undefined> {\n  if (traceEnv === undefined || overrides['TRACEPARENT'] !== undefined) return { ...base, ...overrides };\n  const { TRACESTATE: _ambientState, ...rest } = base;\n  return { ...rest, ...traceEnv, ...overrides };\n}\n\n/**\n * The headers to add to a request whose effective base URL is `baseUrl`: `traceparent` when its\n * origin exactly equals a listed origin, nothing otherwise. Scheme, host and port must all match;\n * a subdomain or a different port is a different origin.\n */\nexport function traceHeadersFor(\n  baseUrl: string | undefined,\n  traceContext: IOutboundTraceContext | undefined,\n): Readonly<Record<string, string>> {\n  if (baseUrl === undefined || traceContext === undefined) return {};\n  let origin: string;\n  try {\n    origin = new URL(baseUrl).origin;\n  } catch {\n    return {};\n  }\n  if (origin === 'null' || !traceContext.allowedOrigins.includes(origin)) return {};\n  return { traceparent: traceContext.traceparent };\n}\n","/**\n * ARCH-056 (#2161): the bounded output-retention contract for child-process execution.\n *\n * Every path that reads a child's stdout/stderr must bound memory WHILE the output is being read —\n * not cap a summary afterwards while retaining the whole log. Before this existed, `shell-tool`\n * could buffer for ten minutes, the hook `CommandExecutor` repeated the pattern, and a subagent\n * runner had rediscovered a 4 KiB tail on its own. This module names the policy once:\n *\n * - **Budget.** `maxBytes` is the most that is ever RETAINED; bytes beyond it are dropped as they\n *   arrive, so memory is bounded by the budget, not by the child's lifetime.\n * - **Retention.** `head` keeps the first `maxBytes` (a tool result: what the command said first);\n *   `tail` keeps the last `maxBytes` (a diagnostic: how it ended).\n * - **Truncation is visible.** `truncated`, `droppedBytes` and a marker in `toString()` say that\n *   output was dropped and how much — never a silently shorter string.\n * - **No spill.** This contract never writes to disk; a caller that needs the whole stream owns a\n *   log file (background tasks do), and this buffer is what stays in memory beside it.\n * - **Termination is not here.** Exceeding the budget drops bytes; whether the child is killed is\n *   the caller's policy (CORE-023 owns process-tree termination).\n *\n * Chunks are `Uint8Array` (a Node `Buffer` is one), and decoding happens once at `toString()`, so a\n * multi-byte character split across a chunk boundary is never decoded twice.\n */\n\nexport type TOutputRetention = 'head' | 'tail';\n\nexport interface IBoundedOutputOptions {\n  /** Most bytes ever retained. */\n  readonly maxBytes: number;\n  /** Which end to keep once over budget. Default `head`. */\n  readonly retain?: TOutputRetention;\n  /** Marker appended (head) or prepended (tail) to `toString()` when bytes were dropped. */\n  readonly truncationMarker?: (droppedBytes: number) => string;\n}\n\nexport interface IBoundedOutput {\n  append(chunk: Uint8Array | string): void;\n  /** Bytes currently retained (≤ `maxBytes`). */\n  readonly retainedBytes: number;\n  /** Bytes the child produced in total, retained or not. */\n  readonly totalBytes: number;\n  readonly droppedBytes: number;\n  readonly truncated: boolean;\n  /** The retained output, decoded as UTF-8, with the truncation marker when bytes were dropped. */\n  toString(): string;\n}\n\nconst DEFAULT_MARKER = (dropped: number): string =>\n  `\\n…[output truncated: ${dropped} byte(s) dropped]`;\n\nexport function createBoundedOutput(options: IBoundedOutputOptions): IBoundedOutput {\n  const retain = options.retain ?? 'head';\n  const marker = options.truncationMarker ?? DEFAULT_MARKER;\n  const maxBytes = Math.max(0, Math.floor(options.maxBytes));\n  const encoder = new TextEncoder();\n  let chunks: Uint8Array[] = [];\n  let retained = 0;\n  let total = 0;\n\n  const appendHead = (bytes: Uint8Array): void => {\n    const room = maxBytes - retained;\n    if (room <= 0) return;\n    const kept = bytes.byteLength <= room ? bytes : bytes.subarray(0, room);\n    chunks.push(kept);\n    retained += kept.byteLength;\n  };\n\n  const appendTail = (bytes: Uint8Array): void => {\n    const kept = bytes.byteLength <= maxBytes ? bytes : bytes.subarray(bytes.byteLength - maxBytes);\n    chunks.push(kept);\n    retained += kept.byteLength;\n    // Drop whole leading chunks first, then trim the oldest survivor — O(chunks), no re-copying.\n    while (retained > maxBytes && chunks.length > 0) {\n      const oldest = chunks[0] as Uint8Array;\n      const excess = retained - maxBytes;\n      if (oldest.byteLength <= excess) {\n        chunks.shift();\n        retained -= oldest.byteLength;\n      } else {\n        chunks[0] = oldest.subarray(excess);\n        retained -= excess;\n      }\n    }\n  };\n\n  return {\n    append(chunk) {\n      const bytes = typeof chunk === 'string' ? encoder.encode(chunk) : chunk;\n      total += bytes.byteLength;\n      if (retain === 'head') appendHead(bytes);\n      else appendTail(bytes);\n    },\n    get retainedBytes() {\n      return retained;\n    },\n    get totalBytes() {\n      return total;\n    },\n    get droppedBytes() {\n      return total - retained;\n    },\n    get truncated() {\n      return total > retained;\n    },\n    toString() {\n      const joined = new Uint8Array(retained);\n      let offset = 0;\n      for (const chunk of chunks) {\n        joined.set(chunk, offset);\n        offset += chunk.byteLength;\n      }\n      chunks = chunks.length > 1 ? [joined] : chunks;\n      const text = new TextDecoder().decode(joined);\n      if (total <= retained) return text;\n      const note = marker(total - retained);\n      return retain === 'head' ? `${text}${note}` : `${note.replace(/^\\n/, '')}\\n${text}`;\n    },\n  };\n}\n"],"mappings":"AAuBA,IAAsB,EAAtB,cAA0C,KAAM,CAO5B,QAFlB,YACE,EACA,EACA,CACA,MAAM,CAAO,EAFG,KAAA,QAAA,EAGhB,KAAK,KAAO,KAAK,YAAY,KAG7B,OAAO,eAAe,KAAM,IAAI,OAAO,SAAS,CAClD,CACF,EAKa,EAAb,cAAwC,CAAY,CAClD,KAAgB,sBAChB,SAAoB,OACpB,YAAuB,GAEvB,YAAY,EAAiB,EAA6B,CACxD,MAAM,wBAAwB,IAAW,CAAO,CAClD,CACF,EAKa,EAAb,cAAqC,CAAY,CAO7B,MANlB,KAAgB,mBAChB,SAAoB,OACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,CACA,MAAM,qBAAqB,IAAW,CAAO,EAH7B,KAAA,MAAA,CAIlB,CACF,EAUa,EAAb,cAA2C,CAAY,CAOnC,OACA,SAPlB,KAAgB,0BAChB,SAAoB,WACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,EACA,CACA,MAAM,4BAA4B,IAAW,CAAO,EAJpC,KAAA,OAAA,EACA,KAAA,SAAA,CAIlB,CACF,EAaa,EAAb,cAAmC,CAAY,CAS3B,SACA,cATlB,KAAgB,iBAChB,SAAoB,WACpB,YAAuB,GACvB,OACA,KAEA,YACE,EACA,EACA,EACA,EACA,EACA,CACA,MAAM,mBAAmB,EAAS,KAAK,IAAW,CAAO,EALzC,KAAA,SAAA,EACA,KAAA,cAAA,EAKZ,GAAS,SAAW,IAAA,KAAW,KAAK,OAAS,EAAQ,QACrD,GAAS,OAAS,IAAA,KAAW,KAAK,KAAO,EAAQ,KACvD,CACF,EAKa,EAAb,cAAyC,CAAY,CAOjC,SANlB,KAAgB,uBAChB,SAAoB,OACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,CACA,MAAM,yBAAyB,IAAW,CAAO,EAHjC,KAAA,SAAA,CAIlB,CACF,EAKa,EAAb,cAAoC,CAAY,CAO5B,WACA,SAPlB,KAAgB,mBAChB,SAAoB,WACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,EACA,CACA,MAAM,qBAAqB,IAAW,CAAO,EAJ7B,KAAA,WAAA,EACA,KAAA,SAAA,CAIlB,CACF,EAKa,EAAb,cAAkC,CAAY,CAO1B,cAGA,SATlB,KAAgB,gBAChB,SAAoB,SACpB,YAAuB,GAEvB,YACE,EACA,EACA,EAEA,EACA,CACA,MAAM,kBAAkB,IAAW,CAAO,EAL1B,KAAA,cAAA,EAGA,KAAA,SAAA,CAGlB,CACF,EAKa,EAAb,cAAwC,CAAY,CAOhC,SACA,cAPlB,KAAgB,uBAChB,SAAoB,SACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,EACA,CACA,MAAM,yBAAyB,EAAS,KAAK,IAAW,CAAO,EAJ/C,KAAA,SAAA,EACA,KAAA,cAAA,CAIlB,CACF,EAiBa,EAAb,cAA4C,CAAY,CAMpC,SACA,UACA,kBAPlB,KAAgB,uBAChB,SAAoB,SACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,EACA,CACA,MACE,SAAS,EAAS,oCAAoC,EAAU,8CAChC,EAAkB,wCAClD,CACF,EATgB,KAAA,SAAA,EACA,KAAA,UAAA,EACA,KAAA,kBAAA,CAQlB,CACF,EAiBa,EAAb,cAA0C,CAAY,CAMlC,MALlB,KAAgB,mBAChB,SAAoB,WACpB,YAAuB,GAEvB,YACE,EACA,EACA,CACA,MACE,SAAS,EAAM,yIAEf,CACF,EAPgB,KAAA,MAAA,CAQlB,CACF,EAKa,EAAb,cAA4C,CAAY,CAQpC,MACA,SACA,gBATlB,KAAgB,sBAChB,SAAoB,OACpB,YAAuB,GAEvB,YAGE,EACA,EACA,EAMA,EACA,CACA,IAAM,EACJ,IAAU,IAAA,GAEN,oCAAoC,EAAS,GAD7C,UAAU,EAAM,mCAAmC,EAAS,GAE5D,EAAS,GAAU,gBACzB,MAAM,OAAO,GAAW,UAAY,EAAO,OAAS,EAAI,GAAG,EAAK,IAAI,IAAW,EAAM,CAAO,EAf5E,KAAA,MAAA,EACA,KAAA,SAAA,EACA,KAAA,gBAAA,CAclB,CACF,EAKa,EAAb,cAA6C,CAAY,CACvD,KAAgB,uBAChB,SAAoB,SACpB,YAAuB,GAEvB,YAAY,EAAkB,0BAA2B,EAA6B,CACpF,MAAM,EAAS,CAAO,CACxB,CACF,EAKa,EAAb,cAAiC,CAAY,CAOzB,WANlB,KAAgB,eAChB,SAAoB,SACpB,YAAuB,GAEvB,YACE,EACA,EACA,EACA,CACA,MAAM,iBAAiB,EAAW,KAAK,IAAW,CAAO,EAHzC,KAAA,WAAA,CAIlB,CACF,EAKa,EAAb,cAAkC,CAAY,CAC5C,KAAgB,gBAChB,SAAoB,SACpB,YAAuB,GAEvB,YAAY,EAAiB,EAA6B,CACxD,MAAM,kBAAkB,IAAW,CAAO,CAC5C,CACF,EAKa,EAAb,cAAyC,CAAY,CACnD,KAAgB,wBAChB,SAAoB,SACpB,YAAuB,GAEvB,YAAY,EAAiB,EAA6B,CACxD,MAAM,0BAA0B,IAAW,CAAO,CACpD,CACF,ECjTa,EAAb,cAA2C,CAAY,CAKzB,WAJ5B,KAAgB,oBAChB,SAAoB,OACpB,YAAuB,GAEvB,YAAY,EAAoC,CAC9C,MAAM,iCAAiC,IAAc,CAAE,YAAW,CAAC,EADzC,KAAA,WAAA,CAE5B,CACF,EAOA,SAAS,EAAgB,EAAmC,CAO1D,OANI,IAAa,SACR,kNAEL,IAAa,QACR,gNAEF,YAAY,EAAS,iGAC9B,CAEA,SAAS,EAAW,EAAiB,EAA2C,CAE9E,IAAM,EADS,EAAc,CAAO,IAAM,OACR,OAAS,KAC3C,MAAO,CACL,UACA,OACA,WACA,YAAc,GAA0B,CAAC,KAAM,CAAG,EAClD,gBAAiB,CAAC,EAClB,MAAO,GAAG,EAAK,MAAM,IACrB,WAAY,EAAgB,CAAQ,CACtC,CACF,CAEA,SAAS,EAAW,EAAiB,EAA2C,CAC9E,MAAO,CACL,UACA,KAAM,aACN,WACA,YAAc,GAA0B,CAAC,aAAc,WAAY,CAAG,EACtE,gBAAiB,CAAC,YAAY,EAC9B,MAAO,iBAAiB,IACxB,WACE,YAAY,EAAS,2IAEzB,CACF,CAEA,SAAS,EAAS,EAAiB,EAA2C,CAC5E,MAAO,CACL,UACA,KAAM,MACN,WACA,YAAc,GAA0B,CAAC,KAAM,KAAM,KAAM,CAAG,EAC9D,gBAAiB,CAAC,EAClB,MAAO,cAAc,IACrB,WAAY,YAAY,EAAS,8DACnC,CACF,CAEA,SAAS,EAAc,EAAyB,CAE9C,OADiB,EAAQ,MAAM,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,YAAY,GAAK,GAAA,CACjD,QAAQ,UAAW,EAAE,CACvC,CAEA,SAAS,EAAc,EAAiB,EAA2C,CACjF,OAAQ,EAAc,CAAO,EAA7B,CACE,IAAK,KACL,IAAK,OACH,OAAO,EAAW,EAAS,CAAQ,EACrC,IAAK,aACL,IAAK,OACH,OAAO,EAAW,EAAS,CAAQ,EACrC,IAAK,MACH,OAAO,EAAS,EAAS,CAAQ,EACnC,QACE,MAAM,IAAI,EAAsB,CAAO,CAC3C,CACF,CAEA,SAAS,EAAS,EAA+C,CAC/D,IAAM,EAAU,GAAO,KAAK,EAC5B,OAAO,IAAY,IAAA,IAAa,EAAQ,SAAW,EAAI,IAAA,GAAY,CACrE,CASA,SAAgB,EACd,EAA2C,CAAC,EAC5B,CAChB,IAAM,EAAM,EAAQ,KAAO,QAAQ,IAC7B,EAAW,EAAQ,UAAY,QAAQ,SACvC,EAAsB,EAAS,EAAQ,UAAU,EAKvD,OAJI,IAAwB,IAAA,GAExB,IAAa,QAAgB,EAAW,iBAAkB,CAAQ,EAE/D,EAAW,EAAS,EAAI,KAAQ,GAAK,UAAW,CAAQ,EAJjB,EAAc,EAAqB,CAAQ,CAK3F,CC1IA,MAAM,EAAW,2BACX,EAAU,2BAOhB,SAAgB,EAAmB,EAA0B,CAC3D,OAAO,EAAS,WAAW,IAAK,EAAE,CAAC,CAAC,MAAM,EAAG,EAAE,CACjD,CAGA,MAAa,EAAiD,EAG9D,SAAgB,EAAe,EAAyB,CACtD,OAAO,EAAQ,KAAK,CAAM,CAC5B,CAGA,SAAgB,EAAiB,EAAiB,EAAoC,CAChF,MAAC,EAAS,KAAK,CAAO,GAAK,CAAC,EAAQ,KAAK,CAAM,GACnD,MAAO,MAAM,EAAQ,GAAG,EAAO,IACjC,CAGA,SAAgB,EACd,EACA,EACmC,CACnC,GAAI,EAAa,eAAe,SAAW,EAAG,OAC9C,IAAM,EAAc,EAAiB,EAAa,QAAS,EAAmB,CAAM,CAAC,EACjF,OAAgB,IAAA,GACpB,MAAO,CAAE,cAAa,eAAgB,CAAC,GAAG,EAAa,cAAc,CAAE,CACzE,CAMA,SAAgB,EACd,EACA,EACmC,CACnC,OAAO,EAAwB,EAAc,CAAU,CACzD,CAMA,SAAgB,EACd,EACA,EACA,EACiC,CACjC,GAAI,GAAc,mBAAmB,SAAS,CAAe,IAAM,GAAM,OACzE,IAAM,EAAc,EAAiB,EAAa,QAAS,CAAM,EACjE,OAAO,IAAgB,IAAA,GAAY,IAAA,GAAY,CAAE,YAAa,CAAY,CAC5E,CAQA,SAAgB,EACd,EACA,EACA,EAA8C,CAAC,EACX,CACpC,GAAI,IAAa,IAAA,IAAa,EAAU,cAAmB,IAAA,GAAW,MAAO,CAAE,GAAG,EAAM,GAAG,CAAU,EACrG,GAAM,CAAE,WAAY,EAAe,GAAG,GAAS,EAC/C,MAAO,CAAE,GAAG,EAAM,GAAG,EAAU,GAAG,CAAU,CAC9C,CAOA,SAAgB,EACd,EACA,EACkC,CAClC,GAAI,IAAY,IAAA,IAAa,IAAiB,IAAA,GAAW,MAAO,CAAC,EACjE,IAAI,EACJ,GAAI,CACF,EAAS,IAAI,IAAI,CAAO,CAAC,CAAC,MAC5B,MAAQ,CACN,MAAO,CAAC,CACV,CAEA,OADI,IAAW,QAAU,CAAC,EAAa,eAAe,SAAS,CAAM,EAAU,CAAC,EACzE,CAAE,YAAa,EAAa,WAAY,CACjD,CC7DA,MAAM,EAAkB,GACtB,yBAAyB,EAAQ,mBAEnC,SAAgB,EAAoB,EAAgD,CAClF,IAAM,EAAS,EAAQ,QAAU,OAC3B,EAAS,EAAQ,kBAAoB,EACrC,EAAW,KAAK,IAAI,EAAG,KAAK,MAAM,EAAQ,QAAQ,CAAC,EACnD,EAAU,IAAI,YAChB,EAAuB,CAAC,EACxB,EAAW,EACX,EAAQ,EAEN,EAAc,GAA4B,CAC9C,IAAM,EAAO,EAAW,EACxB,GAAI,GAAQ,EAAG,OACf,IAAM,EAAO,EAAM,YAAc,EAAO,EAAQ,EAAM,SAAS,EAAG,CAAI,EACtE,EAAO,KAAK,CAAI,EAChB,GAAY,EAAK,UACnB,EAEM,EAAc,GAA4B,CAC9C,IAAM,EAAO,EAAM,YAAc,EAAW,EAAQ,EAAM,SAAS,EAAM,WAAa,CAAQ,EAI9F,IAHA,EAAO,KAAK,CAAI,EAChB,GAAY,EAAK,WAEV,EAAW,GAAY,EAAO,OAAS,GAAG,CAC/C,IAAM,EAAS,EAAO,GAChB,EAAS,EAAW,EACtB,EAAO,YAAc,GACvB,EAAO,MAAM,EACb,GAAY,EAAO,aAEnB,EAAO,GAAK,EAAO,SAAS,CAAM,EAClC,GAAY,EAEhB,CACF,EAEA,MAAO,CACL,OAAO,EAAO,CACZ,IAAM,EAAQ,OAAO,GAAU,SAAW,EAAQ,OAAO,CAAK,EAAI,EAClE,GAAS,EAAM,WACX,IAAW,OAAQ,EAAW,CAAK,EAClC,EAAW,CAAK,CACvB,EACA,IAAI,eAAgB,CAClB,OAAO,CACT,EACA,IAAI,YAAa,CACf,OAAO,CACT,EACA,IAAI,cAAe,CACjB,OAAO,EAAQ,CACjB,EACA,IAAI,WAAY,CACd,OAAO,EAAQ,CACjB,EACA,UAAW,CACT,IAAM,EAAS,IAAI,WAAW,CAAQ,EAClC,EAAS,EACb,IAAK,IAAM,KAAS,EAClB,EAAO,IAAI,EAAO,CAAM,EACxB,GAAU,EAAM,WAElB,EAAS,EAAO,OAAS,EAAI,CAAC,CAAM,EAAI,EACxC,IAAM,EAAO,IAAI,YAAY,CAAC,CAAC,OAAO,CAAM,EAC5C,GAAI,GAAS,EAAU,OAAO,EAC9B,IAAM,EAAO,EAAO,EAAQ,CAAQ,EACpC,OAAO,IAAW,OAAS,GAAG,IAAO,IAAS,GAAG,EAAK,QAAQ,MAAO,EAAE,EAAE,IAAI,GAC/E,CACF,CACF"}

package/dist/browser/{command-executor-BsBTcghZ.js → command-executor-C0XXfBnt.js}

@@ -1,2 +1,2 @@
-import{f as e,s as t,t as n}from"./bounded-output-D3cgiOrh.js";import{spawn as r}from"node:child_process";const i=1e6;function a(e,t){let r=n({maxBytes:i}),a=n({maxBytes:i,retain:`tail`});return e.stdout?.on(`data`,e=>r.append(e)),e.stderr?.on(`data`,e=>a.append(e)),e.stdin?.on(`error`,()=>{}),e.stdin?.write(t),e.stdin?.end(),{stdoutOutput:r,stderrOutput:a}}function o(e,t,n,r){if(e===0)return{outcome:`allow`,source:`command`,stdout:n};if(e===2)return{outcome:`deny`,source:`command`,reason:r.trim()||`Blocked by hook`};let i=r.trim()?`: ${r.trim()}`:``;return{outcome:`error`,source:`command`,kind:`nonzero-exit`,reason:e===null?`Hook terminated by signal ${t??`unknown`}${i}`:`Hook exited ${e}${i}`}}var s=class{shellExecutable;type=`command`;constructor(e){this.shellExecutable=e}execute(n,i,s){let c=n.timeout??600,l=c*1e3,u=JSON.stringify(i);return new Promise(d=>{let f=!1,p=e({executable:this.shellExecutable}),m=r(p.command,p.commandArgs(n.command),{cwd:i.cwd,env:t(process.env,s,i.env)}),{stdoutOutput:h,stderrOutput:g}=a(m,u),_=setTimeout(()=>{f||(f=!0,m.kill(`SIGTERM`),d({outcome:`error`,source:`command`,kind:`timeout`,reason:`Hook timed out after ${c}s`}))},l);m.on(`close`,(e,t)=>{f||(f=!0,clearTimeout(_),d(o(e,t,h.toString(),g.toString())))}),m.on(`error`,e=>{f||(f=!0,clearTimeout(_),d({outcome:`error`,source:`command`,kind:`spawn-failure`,reason:e.message}))})})}};export{s as CommandExecutor};
-//# sourceMappingURL=command-executor-BsBTcghZ.js.map
+import{f as e,s as t,t as n}from"./bounded-output-Bgx2Cgkx.js";import{spawn as r}from"node:child_process";const i=1e6;function a(e,t){let r=n({maxBytes:i}),a=n({maxBytes:i,retain:`tail`});return e.stdout?.on(`data`,e=>r.append(e)),e.stderr?.on(`data`,e=>a.append(e)),e.stdin?.on(`error`,()=>{}),e.stdin?.write(t),e.stdin?.end(),{stdoutOutput:r,stderrOutput:a}}function o(e,t,n,r){if(e===0)return{outcome:`allow`,source:`command`,stdout:n};if(e===2)return{outcome:`deny`,source:`command`,reason:r.trim()||`Blocked by hook`};let i=r.trim()?`: ${r.trim()}`:``;return{outcome:`error`,source:`command`,kind:`nonzero-exit`,reason:e===null?`Hook terminated by signal ${t??`unknown`}${i}`:`Hook exited ${e}${i}`}}var s=class{shellExecutable;type=`command`;constructor(e){this.shellExecutable=e}execute(n,i,s){let c=n.timeout??600,l=c*1e3,u=JSON.stringify(i);return new Promise(d=>{let f=!1,p=e({executable:this.shellExecutable}),m=r(p.command,p.commandArgs(n.command),{cwd:i.cwd,env:t(process.env,s,i.env)}),{stdoutOutput:h,stderrOutput:g}=a(m,u),_=setTimeout(()=>{f||(f=!0,m.kill(`SIGTERM`),d({outcome:`error`,source:`command`,kind:`timeout`,reason:`Hook timed out after ${c}s`}))},l);m.on(`close`,(e,t)=>{f||(f=!0,clearTimeout(_),d(o(e,t,h.toString(),g.toString())))}),m.on(`error`,e=>{f||(f=!0,clearTimeout(_),d({outcome:`error`,source:`command`,kind:`spawn-failure`,reason:e.message}))})})}};export{s as CommandExecutor};
+//# sourceMappingURL=command-executor-C0XXfBnt.js.map

package/dist/browser/{command-executor-BsBTcghZ.js.map → command-executor-C0XXfBnt.js.map}

@@ -1 +1 @@
-{"version":3,"file":"command-executor-BsBTcghZ.js","names":[],"sources":["../../src/hooks/executors/command-executor.ts"],"sourcesContent":["/**\n * Command hook executor — executes shell commands with JSON input on stdin.\n *\n * Exit-code mapping (SEC-015):\n * - `0` → `allow`, stdout carried for the runner's response-protocol decode\n * - `2` → `deny`, stderr carried as the reason\n * - any other code → `error` / `nonzero-exit`\n * - killed by a signal (exit code `null`) → `error` / `nonzero-exit`, signal named in the reason\n * - deadline elapsed → `error` / `timeout`\n * - the process never started → `error` / `spawn-failure`\n *\n * The last four used to be one number. A missing binary exits `127` and a timeout resolved `1`, and\n * the runner discarded both alike, so a gate that never ran was indistinguishable from one that\n * approved.\n */\n\nimport { spawn } from 'node:child_process';\n\nimport { createBoundedOutput, type IBoundedOutput } from '../../utils/bounded-output.js';\nimport { resolvePlatformShell } from '../../utils/platform-shell.js';\nimport { subprocessTraceEnvironment } from '../../utils/trace-context.js';\n\nimport type { ISubprocessTraceEnv } from '../../interfaces/trace-context.js';\nimport type {\n  ICommandHookDefinition,\n  IHookInput,\n  THookOutcome,\n  IHookTypeExecutor,\n} from '../types.js';\n\n/** Default timeout in seconds — matches Claude Code's 600s default */\nconst DEFAULT_TIMEOUT_SECONDS = 600;\n/** ARCH-056: most bytes retained per hook stream (stdout head, stderr tail). */\nconst MAX_HOOK_OUTPUT_BYTES = 1_000_000;\n\n/**\n * How a finished process maps onto an outcome — a pure function of what the process reported.\n *\n * Extracted from `execute` because it is the part that carries the contract: `execute` owns spawning\n * and settling exactly once, this owns what the result MEANS, and the two change for different\n * reasons.\n */\n/**\n * Attach the output collectors and feed the hook input to stdin.\n *\n * Separated from `execute` so the promise body reads as the three things that can settle it —\n * timeout, close, spawn error — rather than as stream plumbing interleaved with them. The\n * `settled` guard those three share is the invariant worth keeping visible in one place.\n */\nfunction wireChildIo(\n  child: ReturnType<typeof spawn>,\n  inputJson: string,\n): { stdoutOutput: IBoundedOutput; stderrOutput: IBoundedOutput } {\n  // ARCH-056: bounded while reading; a hook that floods stdout cannot grow the parent's memory.\n  const stdoutOutput = createBoundedOutput({ maxBytes: MAX_HOOK_OUTPUT_BYTES });\n  const stderrOutput = createBoundedOutput({ maxBytes: MAX_HOOK_OUTPUT_BYTES, retain: 'tail' });\n  child.stdout?.on('data', (chunk: Buffer) => stdoutOutput.append(chunk));\n  child.stderr?.on('data', (chunk: Buffer) => stderrOutput.append(chunk));\n  child.stdin?.on('error', () => {\n    // EPIPE: child closed stdin before we finished writing — safe to ignore\n  });\n  child.stdin?.write(inputJson);\n  child.stdin?.end();\n  return { stdoutOutput, stderrOutput };\n}\n\nfunction outcomeOfExit(\n  code: number | null,\n  signal: NodeJS.Signals | null,\n  stdout: string,\n  stderr: string,\n): THookOutcome {\n  if (code === 0) return { outcome: 'allow', source: 'command', stdout };\n  if (code === 2) {\n    return { outcome: 'deny', source: 'command', reason: stderr.trim() || 'Blocked by hook' };\n  }\n  const detail = stderr.trim() ? `: ${stderr.trim()}` : '';\n  return {\n    outcome: 'error',\n    source: 'command',\n    kind: 'nonzero-exit',\n    // `code === null` means a signal ended it. That is not an exit code and must not be read as\n    // one — the old `code ?? 1` made a SIGKILLed hook indistinguishable from one that exited 1.\n    reason:\n      code === null\n        ? `Hook terminated by signal ${signal ?? 'unknown'}${detail}`\n        : `Hook exited ${code}${detail}`,\n  };\n}\n\nexport class CommandExecutor implements IHookTypeExecutor {\n  readonly type = 'command' as const;\n\n  constructor(private readonly shellExecutable?: string) {}\n\n  /**\n   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the\n   * stdin JSON. The child sees `process.env`, then Robota's value, then the hook's own `env`; a hook\n   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.\n   */\n  execute(\n    definition: ICommandHookDefinition,\n    input: IHookInput,\n    traceEnv?: ISubprocessTraceEnv,\n  ): Promise<THookOutcome> {\n    const timeoutSeconds = definition.timeout ?? DEFAULT_TIMEOUT_SECONDS;\n    const timeoutMs = timeoutSeconds * 1000;\n    const inputJson = JSON.stringify(input);\n\n    return new Promise<THookOutcome>((resolve) => {\n      let settled = false;\n      const shell = resolvePlatformShell({ executable: this.shellExecutable });\n      const child = spawn(shell.command, shell.commandArgs(definition.command), {\n        cwd: input.cwd,\n        env: subprocessTraceEnvironment(process.env, traceEnv, input.env),\n      });\n      const { stdoutOutput, stderrOutput } = wireChildIo(child, inputJson);\n\n      const timer = setTimeout(() => {\n        if (!settled) {\n          settled = true;\n          child.kill('SIGTERM');\n          resolve({\n            outcome: 'error',\n            source: 'command',\n            kind: 'timeout',\n            reason: `Hook timed out after ${timeoutSeconds}s`,\n          });\n        }\n      }, timeoutMs);\n\n      child.on('close', (code: number | null, signal: NodeJS.Signals | null) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        resolve(outcomeOfExit(code, signal, stdoutOutput.toString(), stderrOutput.toString()));\n      });\n\n      child.on('error', (err: Error) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        resolve({\n          outcome: 'error',\n          source: 'command',\n          kind: 'spawn-failure',\n          reason: err.message,\n        });\n      });\n    });\n  }\n}\n"],"mappings":"0GA+BA,MAEM,EAAwB,IAgB9B,SAAS,EACP,EACA,EACgE,CAEhE,IAAM,EAAe,EAAoB,CAAE,SAAU,CAAsB,CAAC,EACtE,EAAe,EAAoB,CAAE,SAAU,EAAuB,OAAQ,MAAO,CAAC,EAQ5F,OAPA,EAAM,QAAQ,GAAG,OAAS,GAAkB,EAAa,OAAO,CAAK,CAAC,EACtE,EAAM,QAAQ,GAAG,OAAS,GAAkB,EAAa,OAAO,CAAK,CAAC,EACtE,EAAM,OAAO,GAAG,YAAe,CAE/B,CAAC,EACD,EAAM,OAAO,MAAM,CAAS,EAC5B,EAAM,OAAO,IAAI,EACV,CAAE,eAAc,cAAa,CACtC,CAEA,SAAS,EACP,EACA,EACA,EACA,EACc,CACd,GAAI,IAAS,EAAG,MAAO,CAAE,QAAS,QAAS,OAAQ,UAAW,QAAO,EACrE,GAAI,IAAS,EACX,MAAO,CAAE,QAAS,OAAQ,OAAQ,UAAW,OAAQ,EAAO,KAAK,GAAK,iBAAkB,EAE1F,IAAM,EAAS,EAAO,KAAK,EAAI,KAAK,EAAO,KAAK,IAAM,GACtD,MAAO,CACL,QAAS,QACT,OAAQ,UACR,KAAM,eAGN,OACE,IAAS,KACL,6BAA6B,GAAU,YAAY,IACnD,eAAe,IAAO,GAC9B,CACF,CAEA,IAAa,EAAb,KAA0D,CAG3B,gBAF7B,KAAgB,UAEhB,YAAY,EAA2C,CAA1B,KAAA,gBAAA,CAA2B,CAOxD,QACE,EACA,EACA,EACuB,CACvB,IAAM,EAAiB,EAAW,SAAW,IACvC,EAAY,EAAiB,IAC7B,EAAY,KAAK,UAAU,CAAK,EAEtC,OAAO,IAAI,QAAuB,GAAY,CAC5C,IAAI,EAAU,GACR,EAAQ,EAAqB,CAAE,WAAY,KAAK,eAAgB,CAAC,EACjE,EAAQ,EAAM,EAAM,QAAS,EAAM,YAAY,EAAW,OAAO,EAAG,CACxE,IAAK,EAAM,IACX,IAAK,EAA2B,QAAQ,IAAK,EAAU,EAAM,GAAG,CAClE,CAAC,EACK,CAAE,eAAc,gBAAiB,EAAY,EAAO,CAAS,EAE7D,EAAQ,eAAiB,CACxB,IACH,EAAU,GACV,EAAM,KAAK,SAAS,EACpB,EAAQ,CACN,QAAS,QACT,OAAQ,UACR,KAAM,UACN,OAAQ,wBAAwB,EAAe,EACjD,CAAC,EAEL,EAAG,CAAS,EAEZ,EAAM,GAAG,SAAU,EAAqB,IAAkC,CACpE,IACJ,EAAU,GACV,aAAa,CAAK,EAClB,EAAQ,EAAc,EAAM,EAAQ,EAAa,SAAS,EAAG,EAAa,SAAS,CAAC,CAAC,EACvF,CAAC,EAED,EAAM,GAAG,QAAU,GAAe,CAC5B,IACJ,EAAU,GACV,aAAa,CAAK,EAClB,EAAQ,CACN,QAAS,QACT,OAAQ,UACR,KAAM,gBACN,OAAQ,EAAI,OACd,CAAC,EACH,CAAC,CACH,CAAC,CACH,CACF"}
+{"version":3,"file":"command-executor-C0XXfBnt.js","names":[],"sources":["../../src/hooks/executors/command-executor.ts"],"sourcesContent":["/**\n * Command hook executor — executes shell commands with JSON input on stdin.\n *\n * Exit-code mapping (SEC-015):\n * - `0` → `allow`, stdout carried for the runner's response-protocol decode\n * - `2` → `deny`, stderr carried as the reason\n * - any other code → `error` / `nonzero-exit`\n * - killed by a signal (exit code `null`) → `error` / `nonzero-exit`, signal named in the reason\n * - deadline elapsed → `error` / `timeout`\n * - the process never started → `error` / `spawn-failure`\n *\n * The last four used to be one number. A missing binary exits `127` and a timeout resolved `1`, and\n * the runner discarded both alike, so a gate that never ran was indistinguishable from one that\n * approved.\n */\n\nimport { spawn } from 'node:child_process';\n\nimport { createBoundedOutput, type IBoundedOutput } from '../../utils/bounded-output.js';\nimport { resolvePlatformShell } from '../../utils/platform-shell.js';\nimport { subprocessTraceEnvironment } from '../../utils/trace-context.js';\n\nimport type { ISubprocessTraceEnv } from '../../interfaces/trace-context.js';\nimport type {\n  ICommandHookDefinition,\n  IHookInput,\n  THookOutcome,\n  IHookTypeExecutor,\n} from '../types.js';\n\n/** Default timeout in seconds — matches Claude Code's 600s default */\nconst DEFAULT_TIMEOUT_SECONDS = 600;\n/** ARCH-056: most bytes retained per hook stream (stdout head, stderr tail). */\nconst MAX_HOOK_OUTPUT_BYTES = 1_000_000;\n\n/**\n * How a finished process maps onto an outcome — a pure function of what the process reported.\n *\n * Extracted from `execute` because it is the part that carries the contract: `execute` owns spawning\n * and settling exactly once, this owns what the result MEANS, and the two change for different\n * reasons.\n */\n/**\n * Attach the output collectors and feed the hook input to stdin.\n *\n * Separated from `execute` so the promise body reads as the three things that can settle it —\n * timeout, close, spawn error — rather than as stream plumbing interleaved with them. The\n * `settled` guard those three share is the invariant worth keeping visible in one place.\n */\nfunction wireChildIo(\n  child: ReturnType<typeof spawn>,\n  inputJson: string,\n): { stdoutOutput: IBoundedOutput; stderrOutput: IBoundedOutput } {\n  // ARCH-056: bounded while reading; a hook that floods stdout cannot grow the parent's memory.\n  const stdoutOutput = createBoundedOutput({ maxBytes: MAX_HOOK_OUTPUT_BYTES });\n  const stderrOutput = createBoundedOutput({ maxBytes: MAX_HOOK_OUTPUT_BYTES, retain: 'tail' });\n  child.stdout?.on('data', (chunk: Buffer) => stdoutOutput.append(chunk));\n  child.stderr?.on('data', (chunk: Buffer) => stderrOutput.append(chunk));\n  child.stdin?.on('error', () => {\n    // EPIPE: child closed stdin before we finished writing — safe to ignore\n  });\n  child.stdin?.write(inputJson);\n  child.stdin?.end();\n  return { stdoutOutput, stderrOutput };\n}\n\nfunction outcomeOfExit(\n  code: number | null,\n  signal: NodeJS.Signals | null,\n  stdout: string,\n  stderr: string,\n): THookOutcome {\n  if (code === 0) return { outcome: 'allow', source: 'command', stdout };\n  if (code === 2) {\n    return { outcome: 'deny', source: 'command', reason: stderr.trim() || 'Blocked by hook' };\n  }\n  const detail = stderr.trim() ? `: ${stderr.trim()}` : '';\n  return {\n    outcome: 'error',\n    source: 'command',\n    kind: 'nonzero-exit',\n    // `code === null` means a signal ended it. That is not an exit code and must not be read as\n    // one — the old `code ?? 1` made a SIGKILLed hook indistinguishable from one that exited 1.\n    reason:\n      code === null\n        ? `Hook terminated by signal ${signal ?? 'unknown'}${detail}`\n        : `Hook exited ${code}${detail}`,\n  };\n}\n\nexport class CommandExecutor implements IHookTypeExecutor {\n  readonly type = 'command' as const;\n\n  constructor(private readonly shellExecutable?: string) {}\n\n  /**\n   * `traceEnv` is the prompt's trace for this child, handed separately so it never reaches the\n   * stdin JSON. The child sees `process.env`, then Robota's value, then the hook's own `env`; a hook\n   * that sets its own `TRACEPARENT` wins and gets the ambient environment unchanged.\n   */\n  execute(\n    definition: ICommandHookDefinition,\n    input: IHookInput,\n    traceEnv?: ISubprocessTraceEnv,\n  ): Promise<THookOutcome> {\n    const timeoutSeconds = definition.timeout ?? DEFAULT_TIMEOUT_SECONDS;\n    const timeoutMs = timeoutSeconds * 1000;\n    const inputJson = JSON.stringify(input);\n\n    return new Promise<THookOutcome>((resolve) => {\n      let settled = false;\n      const shell = resolvePlatformShell({ executable: this.shellExecutable });\n      const child = spawn(shell.command, shell.commandArgs(definition.command), {\n        cwd: input.cwd,\n        env: subprocessTraceEnvironment(process.env, traceEnv, input.env),\n      });\n      const { stdoutOutput, stderrOutput } = wireChildIo(child, inputJson);\n\n      const timer = setTimeout(() => {\n        if (!settled) {\n          settled = true;\n          child.kill('SIGTERM');\n          resolve({\n            outcome: 'error',\n            source: 'command',\n            kind: 'timeout',\n            reason: `Hook timed out after ${timeoutSeconds}s`,\n          });\n        }\n      }, timeoutMs);\n\n      child.on('close', (code: number | null, signal: NodeJS.Signals | null) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        resolve(outcomeOfExit(code, signal, stdoutOutput.toString(), stderrOutput.toString()));\n      });\n\n      child.on('error', (err: Error) => {\n        if (settled) return;\n        settled = true;\n        clearTimeout(timer);\n        resolve({\n          outcome: 'error',\n          source: 'command',\n          kind: 'spawn-failure',\n          reason: err.message,\n        });\n      });\n    });\n  }\n}\n"],"mappings":"0GA+BA,MAEM,EAAwB,IAgB9B,SAAS,EACP,EACA,EACgE,CAEhE,IAAM,EAAe,EAAoB,CAAE,SAAU,CAAsB,CAAC,EACtE,EAAe,EAAoB,CAAE,SAAU,EAAuB,OAAQ,MAAO,CAAC,EAQ5F,OAPA,EAAM,QAAQ,GAAG,OAAS,GAAkB,EAAa,OAAO,CAAK,CAAC,EACtE,EAAM,QAAQ,GAAG,OAAS,GAAkB,EAAa,OAAO,CAAK,CAAC,EACtE,EAAM,OAAO,GAAG,YAAe,CAE/B,CAAC,EACD,EAAM,OAAO,MAAM,CAAS,EAC5B,EAAM,OAAO,IAAI,EACV,CAAE,eAAc,cAAa,CACtC,CAEA,SAAS,EACP,EACA,EACA,EACA,EACc,CACd,GAAI,IAAS,EAAG,MAAO,CAAE,QAAS,QAAS,OAAQ,UAAW,QAAO,EACrE,GAAI,IAAS,EACX,MAAO,CAAE,QAAS,OAAQ,OAAQ,UAAW,OAAQ,EAAO,KAAK,GAAK,iBAAkB,EAE1F,IAAM,EAAS,EAAO,KAAK,EAAI,KAAK,EAAO,KAAK,IAAM,GACtD,MAAO,CACL,QAAS,QACT,OAAQ,UACR,KAAM,eAGN,OACE,IAAS,KACL,6BAA6B,GAAU,YAAY,IACnD,eAAe,IAAO,GAC9B,CACF,CAEA,IAAa,EAAb,KAA0D,CAG3B,gBAF7B,KAAgB,UAEhB,YAAY,EAA2C,CAA1B,KAAA,gBAAA,CAA2B,CAOxD,QACE,EACA,EACA,EACuB,CACvB,IAAM,EAAiB,EAAW,SAAW,IACvC,EAAY,EAAiB,IAC7B,EAAY,KAAK,UAAU,CAAK,EAEtC,OAAO,IAAI,QAAuB,GAAY,CAC5C,IAAI,EAAU,GACR,EAAQ,EAAqB,CAAE,WAAY,KAAK,eAAgB,CAAC,EACjE,EAAQ,EAAM,EAAM,QAAS,EAAM,YAAY,EAAW,OAAO,EAAG,CACxE,IAAK,EAAM,IACX,IAAK,EAA2B,QAAQ,IAAK,EAAU,EAAM,GAAG,CAClE,CAAC,EACK,CAAE,eAAc,gBAAiB,EAAY,EAAO,CAAS,EAE7D,EAAQ,eAAiB,CACxB,IACH,EAAU,GACV,EAAM,KAAK,SAAS,EACpB,EAAQ,CACN,QAAS,QACT,OAAQ,UACR,KAAM,UACN,OAAQ,wBAAwB,EAAe,EACjD,CAAC,EAEL,EAAG,CAAS,EAEZ,EAAM,GAAG,SAAU,EAAqB,IAAkC,CACpE,IACJ,EAAU,GACV,aAAa,CAAK,EAClB,EAAQ,EAAc,EAAM,EAAQ,EAAa,SAAS,EAAG,EAAa,SAAS,CAAC,CAAC,EACvF,CAAC,EAED,EAAM,GAAG,QAAU,GAAe,CAC5B,IACJ,EAAU,GACV,aAAa,CAAK,EAClB,EAAQ,CACN,QAAS,QACT,OAAQ,UACR,KAAM,gBACN,OAAQ,EAAI,OACd,CAAC,EACH,CAAC,CACH,CAAC,CACH,CACF"}

package/dist/browser/{http-executor-CHy6UeBU.js → http-executor-B4YgCJg7.js}

@@ -1,2 +1,2 @@
-import{t as e}from"./verdict-decoder-Dk_w2NG9.js";function t(e){return e.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(e,t)=>{let n=process.env[t];return n===void 0?e:n})}var n=class{type=`http`;async execute(n,i){let a=(n.timeout??10)*1e3,o={"Content-Type":`application/json`};if(n.headers)for(let[e,r]of Object.entries(n.headers))o[e]=t(r);try{let t=await fetch(n.url,{method:`POST`,headers:o,body:JSON.stringify(i),signal:AbortSignal.timeout(a)});return t.ok?e(await t.text(),`http`,i.hook_event_name):{outcome:`error`,source:`http`,kind:`http-status`,reason:`HTTP ${t.status} ${t.statusText}`}}catch(e){return r(e)}}};function r(e){return{outcome:`error`,source:`http`,kind:e instanceof Error&&e.name===`TimeoutError`?`timeout`:`transport-failure`,reason:e instanceof Error?e.message:String(e)}}export{n as HttpExecutor};
-//# sourceMappingURL=http-executor-CHy6UeBU.js.map
+import{t as e}from"./verdict-decoder-Dz_rjoIZ.js";function t(e){return e.replace(/\$([A-Za-z_][A-Za-z0-9_]*)/g,(e,t)=>{let n=process.env[t];return n===void 0?e:n})}var n=class{type=`http`;async execute(n,i){let a=(n.timeout??10)*1e3,o={"Content-Type":`application/json`};if(n.headers)for(let[e,r]of Object.entries(n.headers))o[e]=t(r);try{let t=await fetch(n.url,{method:`POST`,headers:o,body:JSON.stringify(i),signal:AbortSignal.timeout(a)});return t.ok?e(await t.text(),`http`,i.hook_event_name):{outcome:`error`,source:`http`,kind:`http-status`,reason:`HTTP ${t.status} ${t.statusText}`}}catch(e){return r(e)}}};function r(e){return{outcome:`error`,source:`http`,kind:e instanceof Error&&e.name===`TimeoutError`?`timeout`:`transport-failure`,reason:e instanceof Error?e.message:String(e)}}export{n as HttpExecutor};
+//# sourceMappingURL=http-executor-B4YgCJg7.js.map

package/dist/browser/{http-executor-CHy6UeBU.js.map → http-executor-B4YgCJg7.js.map}

@@ -1 +1 @@
-{"version":3,"file":"http-executor-CHy6UeBU.js","names":[],"sources":["../../src/hooks/executors/http-executor.ts"],"sourcesContent":["/**\n * HTTP hook executor — POSTs hook input as JSON to a URL.\n *\n * Response format: `{ ok: boolean, reason?: string }`, decoded by `decodeHookVerdict` (SEC-015):\n * - `ok: true`  → `allow`\n * - `ok: false` → `deny`, carrying `reason`\n * - anything else, including a non-boolean `ok` → `error` / `malformed-response`\n *\n * Transport conditions are outcomes in their own right rather than a shared failure code:\n * non-2xx → `http-status`, deadline elapsed → `timeout`, unreachable → `transport-failure`,\n * unparseable body → `malformed-response`.\n *\n * Supports env var interpolation in headers: $VAR_NAME\n */\n\nimport { decodeHookVerdict } from '../verdict-decoder.js';\n\nimport type { IHttpHookDefinition, IHookInput, THookOutcome, IHookTypeExecutor } from '../types.js';\n\n/** Default timeout in seconds */\nconst DEFAULT_TIMEOUT_SECONDS = 10;\n\n/** Interpolate $VAR_NAME references in a string with process.env values. */\nfunction interpolateEnvVars(value: string): string {\n  return value.replace(/\\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, varName: string) => {\n    const envValue = process.env[varName];\n    return envValue !== undefined ? envValue : _match;\n  });\n}\n\nexport class HttpExecutor implements IHookTypeExecutor {\n  readonly type = 'http' as const;\n\n  async execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome> {\n    const timeoutSeconds = definition.timeout ?? DEFAULT_TIMEOUT_SECONDS;\n    const timeoutMs = timeoutSeconds * 1000;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n    };\n\n    if (definition.headers) {\n      for (const [key, value] of Object.entries(definition.headers)) {\n        headers[key] = interpolateEnvVars(value);\n      }\n    }\n\n    try {\n      const response = await fetch(definition.url, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(input),\n        signal: AbortSignal.timeout(timeoutMs),\n      });\n\n      if (!response.ok) {\n        return {\n          outcome: 'error',\n          source: 'http',\n          kind: 'http-status',\n          reason: `HTTP ${response.status} ${response.statusText}`,\n        };\n      }\n\n      // Read the body as TEXT first. `response.json()` would collapse \"the endpoint sent HTML\" and\n      // \"the endpoint sent a verdict\" into one throw, and the raw text is what the decoder quotes\n      // back — so a misconfigured endpoint is identifiable from the reason alone.\n      return decodeHookVerdict(await response.text(), 'http', input.hook_event_name);\n    } catch (err: unknown) {\n      return toTransportOutcome(err);\n    }\n  }\n}\n\n/**\n * Classify a `fetch` rejection.\n *\n * `AbortSignal.timeout` rejects with a `DOMException` named `TimeoutError`, which is a different\n * fact from a connection refused or dropped: one says the hook was too slow, the other says it was\n * never reached. Both are `error`, and an operator reading the reason needs to know which.\n */\nfunction toTransportOutcome(err: unknown): THookOutcome {\n  return {\n    outcome: 'error',\n    source: 'http',\n    kind: err instanceof Error && err.name === 'TimeoutError' ? 'timeout' : 'transport-failure',\n    reason: err instanceof Error ? err.message : String(err),\n  };\n}\n"],"mappings":"kDAuBA,SAAS,EAAmB,EAAuB,CACjD,OAAO,EAAM,QAAQ,+BAAgC,EAAQ,IAAoB,CAC/E,IAAM,EAAW,QAAQ,IAAI,GAC7B,OAAO,IAAa,IAAA,GAAuB,EAAX,CAClC,CAAC,CACH,CAEA,IAAa,EAAb,KAAuD,CACrD,KAAgB,OAEhB,MAAM,QAAQ,EAAiC,EAA0C,CAEvF,IAAM,GADiB,EAAW,SAAW,IACV,IAE7B,EAAkC,CACtC,eAAgB,kBAClB,EAEA,GAAI,EAAW,QACb,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAW,OAAO,EAC1D,EAAQ,GAAO,EAAmB,CAAK,EAI3C,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAW,IAAK,CAC3C,OAAQ,OACR,UACA,KAAM,KAAK,UAAU,CAAK,EAC1B,OAAQ,YAAY,QAAQ,CAAS,CACvC,CAAC,EAcD,OAZK,EAAS,GAYP,EAAkB,MAAM,EAAS,KAAK,EAAG,OAAQ,EAAM,eAAe,EAXpE,CACL,QAAS,QACT,OAAQ,OACR,KAAM,cACN,OAAQ,QAAQ,EAAS,OAAO,GAAG,EAAS,YAC9C,CAOJ,OAAS,EAAc,CACrB,OAAO,EAAmB,CAAG,CAC/B,CACF,CACF,EASA,SAAS,EAAmB,EAA4B,CACtD,MAAO,CACL,QAAS,QACT,OAAQ,OACR,KAAM,aAAe,OAAS,EAAI,OAAS,eAAiB,UAAY,oBACxE,OAAQ,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACzD,CACF"}
+{"version":3,"file":"http-executor-B4YgCJg7.js","names":[],"sources":["../../src/hooks/executors/http-executor.ts"],"sourcesContent":["/**\n * HTTP hook executor — POSTs hook input as JSON to a URL.\n *\n * Response format: `{ ok: boolean, reason?: string }`, decoded by `decodeHookVerdict` (SEC-015):\n * - `ok: true`  → `allow`\n * - `ok: false` → `deny`, carrying `reason`\n * - anything else, including a non-boolean `ok` → `error` / `malformed-response`\n *\n * Transport conditions are outcomes in their own right rather than a shared failure code:\n * non-2xx → `http-status`, deadline elapsed → `timeout`, unreachable → `transport-failure`,\n * unparseable body → `malformed-response`.\n *\n * Supports env var interpolation in headers: $VAR_NAME\n */\n\nimport { decodeHookVerdict } from '../verdict-decoder.js';\n\nimport type { IHttpHookDefinition, IHookInput, THookOutcome, IHookTypeExecutor } from '../types.js';\n\n/** Default timeout in seconds */\nconst DEFAULT_TIMEOUT_SECONDS = 10;\n\n/** Interpolate $VAR_NAME references in a string with process.env values. */\nfunction interpolateEnvVars(value: string): string {\n  return value.replace(/\\$([A-Za-z_][A-Za-z0-9_]*)/g, (_match, varName: string) => {\n    const envValue = process.env[varName];\n    return envValue !== undefined ? envValue : _match;\n  });\n}\n\nexport class HttpExecutor implements IHookTypeExecutor {\n  readonly type = 'http' as const;\n\n  async execute(definition: IHttpHookDefinition, input: IHookInput): Promise<THookOutcome> {\n    const timeoutSeconds = definition.timeout ?? DEFAULT_TIMEOUT_SECONDS;\n    const timeoutMs = timeoutSeconds * 1000;\n\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n    };\n\n    if (definition.headers) {\n      for (const [key, value] of Object.entries(definition.headers)) {\n        headers[key] = interpolateEnvVars(value);\n      }\n    }\n\n    try {\n      const response = await fetch(definition.url, {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(input),\n        signal: AbortSignal.timeout(timeoutMs),\n      });\n\n      if (!response.ok) {\n        return {\n          outcome: 'error',\n          source: 'http',\n          kind: 'http-status',\n          reason: `HTTP ${response.status} ${response.statusText}`,\n        };\n      }\n\n      // Read the body as TEXT first. `response.json()` would collapse \"the endpoint sent HTML\" and\n      // \"the endpoint sent a verdict\" into one throw, and the raw text is what the decoder quotes\n      // back — so a misconfigured endpoint is identifiable from the reason alone.\n      return decodeHookVerdict(await response.text(), 'http', input.hook_event_name);\n    } catch (err: unknown) {\n      return toTransportOutcome(err);\n    }\n  }\n}\n\n/**\n * Classify a `fetch` rejection.\n *\n * `AbortSignal.timeout` rejects with a `DOMException` named `TimeoutError`, which is a different\n * fact from a connection refused or dropped: one says the hook was too slow, the other says it was\n * never reached. Both are `error`, and an operator reading the reason needs to know which.\n */\nfunction toTransportOutcome(err: unknown): THookOutcome {\n  return {\n    outcome: 'error',\n    source: 'http',\n    kind: err instanceof Error && err.name === 'TimeoutError' ? 'timeout' : 'transport-failure',\n    reason: err instanceof Error ? err.message : String(err),\n  };\n}\n"],"mappings":"kDAuBA,SAAS,EAAmB,EAAuB,CACjD,OAAO,EAAM,QAAQ,+BAAgC,EAAQ,IAAoB,CAC/E,IAAM,EAAW,QAAQ,IAAI,GAC7B,OAAO,IAAa,IAAA,GAAuB,EAAX,CAClC,CAAC,CACH,CAEA,IAAa,EAAb,KAAuD,CACrD,KAAgB,OAEhB,MAAM,QAAQ,EAAiC,EAA0C,CAEvF,IAAM,GADiB,EAAW,SAAW,IACV,IAE7B,EAAkC,CACtC,eAAgB,kBAClB,EAEA,GAAI,EAAW,QACb,IAAK,GAAM,CAAC,EAAK,KAAU,OAAO,QAAQ,EAAW,OAAO,EAC1D,EAAQ,GAAO,EAAmB,CAAK,EAI3C,GAAI,CACF,IAAM,EAAW,MAAM,MAAM,EAAW,IAAK,CAC3C,OAAQ,OACR,UACA,KAAM,KAAK,UAAU,CAAK,EAC1B,OAAQ,YAAY,QAAQ,CAAS,CACvC,CAAC,EAcD,OAZK,EAAS,GAYP,EAAkB,MAAM,EAAS,KAAK,EAAG,OAAQ,EAAM,eAAe,EAXpE,CACL,QAAS,QACT,OAAQ,OACR,KAAM,cACN,OAAQ,QAAQ,EAAS,OAAO,GAAG,EAAS,YAC9C,CAOJ,OAAS,EAAc,CACrB,OAAO,EAAmB,CAAG,CAC/B,CACF,CACF,EASA,SAAS,EAAmB,EAA4B,CACtD,MAAO,CACL,QAAS,QACT,OAAQ,OACR,KAAM,aAAe,OAAS,EAAI,OAAS,eAAiB,UAAY,oBACxE,OAAQ,aAAe,MAAQ,EAAI,QAAU,OAAO,CAAG,CACzD,CACF"}

package/dist/browser/index.d.ts

@@ -487,6 +487,28 @@ declare class SameToolInputLoopError extends RobotaError {
   readonly recoverable = true;
   constructor(toolName: string, callCount: number, maxSameToolInputs: number, context?: TErrorContextData);
 }
+/**
+ * A turn ended with neither a tool result nor a final text response while `allowToolOnlyCompletion`
+ * was set.
+ *
+ * `allowToolOnlyCompletion` only WIDENS what counts as a valid finish (a tool call alone, with no
+ * final text after it); it never narrows the ordinary case. Without the flag, a round that produces
+ * neither is recovered by one more provider call asking for a summary (`forceSummaryCall`). Setting
+ * the flag is what turns that rescue off — a decision agent wants exactly one provider call, never a
+ * follow-up — so a round that produces neither has nothing left to recover it. That is a genuinely
+ * unanswered turn, not the internal `[STRICT-POLICY]` result-shape violation an actually malformed
+ * execution result trips; a caller must be able to catch this by type instead of parsing that message.
+ *
+ * `recoverable` is TRUE: like `SameToolInputLoopError`, this is a property of this turn's prompt and
+ * model response, not of the system, and a caller that varies either can reasonably try again.
+ */
+declare class EmptyCompletionError extends RobotaError {
+  readonly round: number;
+  readonly code = "EMPTY_COMPLETION";
+  readonly category: "provider";
+  readonly recoverable = true;
+  constructor(round: number, context?: TErrorContextData);
+}
 /**
  * Model not available errors
  */
@@ -2204,7 +2226,8 @@ interface IRunOptions {
    * The summary call is the one made when the round cap ends the loop on a tool round; before the cap
    * the model is called again after tool results as usual, so a decision agent sets
    * `maxExecutionRounds` too (e.g. `1`). The run resolves with the turn's text, or `''` when it
-   * produced none; consumers read the outcome from the tool results.
+   * ended in tool results (consumers read the outcome from those results), and rejects with
+   * `EmptyCompletionError` when it produced neither text nor a tool result.
    */
   allowToolOnlyCompletion?: boolean;
   /**
@@ -2252,8 +2275,11 @@ type TAgentEventName = (typeof AGENT_EVENT_NAMES)[keyof typeof AGENT_EVENT_NAMES
  * - Import and use EVENT_EMITTER_EVENTS instead.
  */
 declare const EVENT_EMITTER_EVENTS: {
+  /** @deprecated Not emitted by a run; a run emits `AGENT_EXECUTION_START`. */
   readonly EXECUTION_START: "execution.start";
+  /** @deprecated Not emitted by a run; a run emits `AGENT_EXECUTION_COMPLETE`. */
   readonly EXECUTION_COMPLETE: "execution.complete";
+  /** @deprecated Not emitted by a run; a run emits `AGENT_EXECUTION_ERROR`. */
   readonly EXECUTION_ERROR: "execution.error";
   readonly TOOL_BEFORE_EXECUTE: "tool.beforeExecute";
   readonly TOOL_AFTER_EXECUTE: "tool.afterExecute";
@@ -2484,6 +2510,8 @@ interface IPluginExecutionResult {
  * above, which lives at this abstracts layer.
  */
 interface IPluginContext {
+  toolData?: IToolExecutionContext;
+  toolResult?: IToolExecutionResult;
   input?: string;
   response?: string;
   messages?: TUniversalMessage[];
@@ -2493,7 +2521,10 @@ interface IPluginContext {
   executionContext?: TContextData;
   /** PLG-020 (issue #2460): the run's result, for `afterExecution` / `afterConversation` / `afterToolExecution`. */
   executionResult?: IPluginExecutionResult;
-  /** PLG-020 (issue #2460): the message just appended to the conversation, for `onMessageAdded`. */
+  /**
+   * The message just appended to the conversation, for `onMessageAdded`, or the streamed text
+   * chunk, for `onStreamingChunk`.
+   */
   message?: TUniversalMessage;
 }
 /** Error context for plugin error handling */
@@ -2573,7 +2604,7 @@ interface IPluginHooks {
   afterExecution?(context: IPluginExecutionContext, result: IPluginExecutionResult): Promise<void> | void;
   beforeConversation?(context: IPluginExecutionContext): Promise<void> | void;
   afterConversation?(context: IPluginExecutionContext, result: IPluginExecutionResult): Promise<void> | void;
-  beforeToolCall?(toolName: string, parameters: TToolParameters): Promise<void> | void;
+  beforeToolCall?(toolName: string, parameters: TToolParameters, context?: IToolExecutionContext): Promise<void> | void;
   beforeToolExecution?(context: IPluginExecutionContext, toolData: IToolExecutionContext): Promise<void> | void;
   afterToolCall?(toolName: string, parameters: TToolParameters, result: IToolExecutionResult): Promise<void> | void;
   afterToolExecution?(context: IPluginExecutionContext, toolResults: IPluginExecutionResult): Promise<void> | void;
@@ -3088,7 +3119,7 @@ interface IProviderDefinition {
    * LLM nodes' single `COST_PER_TOKEN_USD` scalar. The correct long-term home is the per-model
    * {@link IProviderModelCatalogEntry.costPerInputToken}/`costPerOutputToken`; this flat scalar is a
    * fidelity-preserving interim used only while model catalogs are `status:'unavailable'` (no per-model
-   * entries to attach cost to). Consumed by the collapsed `llm-text` node's `maxCostUsd` estimation. Absent
+   * entries to attach cost to). Consumed by the collapsed `llm-text` node's cost estimate. Absent
    * means cost is unknown for this provider and estimators must degrade explicitly.
    */
   costPerTokenUsd?: number;
@@ -3758,14 +3789,9 @@ type TExecutorStreamEvent = IExecutorStreamMessageEvent | IExecutorStreamTermina
 /**
  * Interface for executing AI provider operations
  *
- * Executors abstract the execution mechanism, allowing providers to work
- * with either local API calls or remote server calls transparently.
- *
- * Implementation patterns:
- * - LocalExecutor: Direct API calls using provider SDKs
- * - RemoteExecutor: HTTP/WebSocket calls to remote server
- * - CacheExecutor: Cached responses with explicit error propagation
- * - HybridExecutor: Conditional local/remote execution
+ * Executors abstract the execution mechanism, so a provider can call its API directly or hand the
+ * call to something else (a server of your own, a cache). `LocalExecutor` is the in-process one;
+ * any other is yours to implement.
  */
 interface IExecutor {
   /**
@@ -3843,7 +3869,10 @@ interface ILocalExecutorConfig {
   enableLogging?: boolean;
 }
 /**
- * Configuration options for remote executor
+ * Configuration options for a remote executor.
+ *
+ * @deprecated Robota ships no remote executor, so nothing reads this type. It stays exported only
+ * so existing imports keep compiling; describe your own executor's options instead.
  */
 interface IRemoteExecutorConfig {
   /** Remote server URL */
@@ -4391,7 +4420,7 @@ declare abstract class AbstractPlugin<TOptions extends IPluginOptions = IPluginO
   afterExecution?(context: IPluginExecutionContext, result: IPluginExecutionResult): Promise<void>;
   beforeConversation?(context: IPluginExecutionContext): Promise<void>;
   afterConversation?(context: IPluginExecutionContext, result: IPluginExecutionResult): Promise<void>;
-  beforeToolCall?(toolName: string, parameters: TToolParameters): Promise<void>;
+  beforeToolCall?(toolName: string, parameters: TToolParameters, context?: IToolExecutionContext): Promise<void>;
   beforeToolExecution?(context: IPluginExecutionContext, toolData: IToolExecutionContext): Promise<void>;
   afterToolCall?(toolName: string, parameters: TToolParameters, result: IToolExecutionResult): Promise<void>;
   afterToolExecution?(context: IPluginExecutionContext, toolResults: IPluginExecutionResult): Promise<void>;
@@ -6539,9 +6568,9 @@ interface IOrchestrationStepResult {
   output: string;
   /**
    * Optional token usage of the step's subagent run (the {@link ITokenUsage} SSOT triple;
-   * TYPE-003). Present only when the underlying runner/manager surfaces usage through its
-   * result — the default `SubagentManager.wait` does not yet thread it, so this is
-   * `undefined` there until that port is extended.
+   * TYPE-003). Present when the underlying runner reported it — `SubagentManager.wait` already
+   * threads a completed job's `usage` straight through its result; this is `undefined` only when
+   * the runner itself never reported any.
    */
   usage?: ITokenUsage;
 }
@@ -7356,7 +7385,7 @@ interface IAgentHookDefinition {
  * Guardrail hook (SELFHOST-005) — runs the registered guardrail SET in parallel and fails the turn
  * fast. The guardrail functions live in the `GuardrailExecutor` (registered by the consumer); this
  * data-only definition just selects which to run. Any failure maps onto the existing exit-code-2 /
- * `blocked` contract, so enforcement reuses the single `runHooks` → `runPreToolHook` path.
+ * `blocked` contract, so enforcement reuses the single `runHooks` → `runPreToolGate` path.
  */
 interface IGuardrailHookDefinition {
   type: 'guardrail';
@@ -7599,5 +7628,5 @@ declare function decodeHookVerdict(raw: string, source: THookDefinition['type'],
 /** Does a hook that reached no verdict block at this event? */
 declare function isEnforcing(event: THookEvent): boolean;
 //#endregion
-export { AGENT_EVENTS, AGENT_EVENT_PREFIX, AbstractAIProvider, AbstractAgent, AbstractEventService, AbstractExecutor, AbstractManager, AbstractPlugin, AbstractTool, AgentFactory, AgentTemplates, AuthenticationError, CONFIRM_NO, CONFIRM_YES, CONTEXT_ESTIMATE_CHARS_PER_TOKEN, CacheIntegrityError, CircuitBreakerOpenError, ConfigurationError, ConsoleLogger, ConversationHistory, ConversationStore, DEFAULT_ABSTRACT_EVENT_SERVICE, DEFAULT_BACKGROUND_PERMISSION_POLICY, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT, DEFAULT_TOOL_RESULT_HARD_CHARS, DEFAULT_TOOL_RESULT_WARNING_CHARS, DEFERRED_WITHOUT_LOADER_MESSAGE, DefaultEventService, ENV_REFERENCE_PREFIX, EVENT_EMITTER_EVENTS, EXECUTION_EVENTS, EXECUTION_EVENT_PREFIX, ErrorUtils, EventEmitterPlugin, EventHistoryModule, ExecutionJournalError, ExecutionProxy, ExecutionRecoveryError, ExecutionSuspendedError, FunctionTool, GuardrailExecutor, type IAIProvider, type IAIProviderInstance, type IAIProviderManager, type IAbstractTool, type IAbstractToolOptions, type IActionDefault, type IActionOption, type IActionRequest, type IAgent, type IAgentConfig, type IAgentCreationStats, type IAgentEventData, type IAgentFactoryOptions, type IAgentHookDefinition, type IAgentLifecycleEvents, type IAgentTemplate, type IAssistantMessage, type IAssistantUsageMetadata, type IBaseEventData, type IBaseMessage, type IBoundedOutput, type IBoundedOutputOptions, type ICacheEntry, type ICacheKey, type ICacheOptions, type ICacheStats, type ICacheStorage, type IChatExecutionRequest, type IChatOptions, type ICommandHookDefinition, type IContextOptions, type IContextTokenEstimate, type IContextTokenEstimateOptions, type IContextTokenUsage, type IContextWindowState, type IConversationContext, type IConversationResponse, type IConversationService, type IConversationServiceOptions, type ICredentialKey, type ICredentialStore, type ICriticalPathContext, type IDeferredToolCatalog, type IDestroyResult, type IDirent, type IEventContext, type IEventEmitterEventData, type IEventEmitterHierarchicalEventData, type IEventEmitterMetrics, type IEventEmitterMetricsSnapshot, type IEventEmitterPlugin, type IEventEmitterPluginOptions, type IEventHistoryModule, type IEventHistoryRecord, type IEventHistorySnapshot, type IEventObjectValue, type IEventService, type IEventServiceOwnerBinding, type IExecutionContinuationState, type IExecutionEventData, type IExecutionJournal, type IExecutionProxyConfig, type IExecutionRoundCheckpoint, type IExecutor, IExecutorAwareProviderConfig, type IExecutorChatResult, type IExecutorStreamMessageEvent, type IExecutorStreamTerminalEvent, type IFileSystem, type IFileSystemAsync, type IFunctionTool, type IGroupChatOrchestrationSpec, type IGuardrailHookDefinition, type IGuardrailResult, type IHandoffOrchestrationSpec, type IHierarchicalOrchestrationSpec, type IHistoryEntry, type IHookGroup, type IHookInput, type IHookTypeExecutor, type IHttpHookDefinition, type IImageComposeRequest, type IImageEditRequest, type IImageGenerationProvider, type IImageGenerationRequest, type IImageGenerationResult, type IInlineImageInputSource, type IInlineImageMessagePart, type IJsonSchemaOutput, type ILocalExecutorConfig, ILogger, ILoggerOptions, IManagerLifecycleOptions, type IMediaOutputRef, type IMediaProviderConfig, type IMediaProviderCredentialRequirement, type IMediaProviderDefinition, type IMediaProviderOverrides, type IMessageTokenUsage, type IModelCapabilityDeviation, type IModelDefinition, type IModelEffortCapability, type IModelEffortOutcome, type IModelEffortResolution, type IModelFallbackNotice, type IModelJournalContext, type IModelPrice, type IModelRef, type IObjectParameterSchema, type IOpenAPIToolConfig, type IOrchestrationDelegation, type IOrchestrationEventData, type IOrchestrationRunResult, type IOrchestrationStep, type IOrchestrationStepResult, type IOutboundTraceContext, type IOwnerPathSegment, type IParallelOrchestrationSpec, type IParameterRule, type IParameterSchema, type IParameterValidationResult, type IPermissionEvaluationContext, type IPermissionLists, type IPermissionPatternProblem, type IPermissionPolicyContext, type IPermissionPolicyProjection, IPlatformShell, IPlatformShellResolutionRequest, type IPlugin, type IPluginConfig, type IPluginContext, type IPluginContract, type IPluginData, type IPluginErrorContext, type IPluginExecutionContext, type IPluginExecutionResult, type IPluginHooks, type IPluginOptions, type IPluginStats, type IProgressReportingTool, type IPromptHookDefinition, type IProviderCapabilities, type IProviderCapabilityTable, type IProviderCredentialRequirement, type IProviderDefinition, type IProviderDefinitionConfig, type IProviderEndpoint, type IProviderFailureClassification, IProviderFailureDetails, type IProviderFunctionCallingCapability, type IProviderMediaError, type IProviderModelCatalog, type IProviderModelCatalogEntry, type IProviderModelEffortTable, type IProviderNativeRawPayloadEvent, type IProviderNativeWebToolCapabilities, type IProviderNativeWebToolCapability, type IProviderNativeWebToolRequest, type IProviderOptions, type IProviderProbeResult, type IProviderProfileConfig, type IProviderProfileDefaults, type IProviderRequest, IProviderRuntimeConfig, type IProviderSetupHelpLink, type IProviderSetupStepDefinition, type IProviderSpecificOptions, type IProviderStructuredOutputCapability, type IRawProviderResponse, type IReadOnlyCommandContext, type IRecoverableExecutionJournal, type IRegistryOwnedLifecycle, type IRegistryTransactionError, type IRegistryTransactionStep, type IRemoteExecutorConfig, type IResponseFormatConfig, type IResumeExecutionOptions, type IResumeToolCallsOptions, type IResumeToolCallsResult, type IRunOptions, type IRunTraceContext, type ISchemaClosureChange, type ISchemaClosureOptions, type ISchemaConversionOptions, type ISequentialOrchestrationSpec, type ISession, type ISessionUsageTotals, ISimpleValidationResult, type ISpanCompletionEventData, type ISpinner, type IStats, type IStreamExecutionRequest, type IStreamingChunk, type IStructuredOutputResolutionInput, type IStructuredOutputSpec, type ISubprocessTraceEnv, type ISystemMessage, type ITemplateApplicationResult, type ITerminalOutput, type ITextMessagePart, type ITokenUsage, type ITokenUsageWithCacheRead, type ITool, type IToolActionIdentity, type IToolCall, type IToolContinuation, type IToolContinuationPrompt, type IToolContract, type IToolEventData, type IToolExecutionContext, type IToolExecutionRequest, type IToolExecutionResult, type IToolExecutionStep, type IToolFactory, type IToolManager, type IToolMessage, type IToolPermissionArgument, type IToolPermissionProfile, type IToolRegistry, type IToolResult, type IToolResultAdmissionOptions, type IToolResultSpillStore, type IToolSchema, type IToolSchemaProjection, type IToolSchemaProjectionChange, type IToolSchemaProjectionProfile, type IToolWaitRequest, type IToolWaitResponse, type IToolWaitState, type IToolWithEventService, type IUniversalObjectValue, type IUriImageInputSource, type IUriImageMessagePart, type IUserInteraction, type IUserMessage, IUtilLogEntry, type IVerifiedProviderCallUsage, type IVideoGenerationProvider, type IVideoGenerationRequest, type IVideoJobAccepted, type IVideoJobSnapshot, type IZodParseResult, type IZodSchema, type IZodSchemaDef, InMemoryEventEmitterMetrics, LocalExecutor, MAX_TOOL_RESULT_CHARS, MODEL_EFFORT_VALUES, MODEL_PRICES, MessageConverter, ModelNotAvailableError, NetworkError, ORCHESTRATION_EVENTS, ORCHESTRATION_EVENT_PREFIX, ObservableEventService, PARAMETER_SCHEMA_KEYWORDS, PERMISSIVE_TOOL_SCHEMA_PROFILE, PROTECTED_DIRECTORY_NAMES, PROTECTED_FILE_NAMES, PROVIDER_CALL_EVENTS, PROVIDER_FALLBACK_EVENTS, PluginCategory, PluginError, PluginPriority, ProviderError, RISK_CLASS_POLICY, RateLimitError, Robota, RobotaError, SPAN_EVENTS, SPAN_EVENT_PREFIX, STRICT_TOOL_SCHEMA_PROFILE, SameToolInputLoopError, SilentLogger, StorageError, StructuredEventService, StructuredOutputError, TASK_EVENTS, TASK_EVENT_PREFIX, type TActionResponse, type TArgumentKind, type TBackgroundPermissionPolicy, TComplexConfigValue, TConfigData, TConfigValue, TContextData, type TConversationContextMetadata, type TEnvResolver, TErrorContextData, TErrorExternalInput, type TEventEmitterListener, type TEventExtensionValue, type TEventListener, type TEventLoggerData, type TEventName, type TEventUniversalValue, type TExecutionEventCallback, type TExecutionEventData, type TExecutionEventName, type TExecutionJournalRecord, type TExecutionRecoveryErrorCode, type TExecutorStreamEvent, type TGuardrail, type THookDefinition, type THookEvent, type THookOutcome, type THooksConfig, type TImageInputSource, type TJSONSchemaEnum, type TJSONSchemaKind, type TJournalModelOptions, TLoggerData, type TManagerToolParameters, type TMatchDirection, TMessageConverterRegistry, TMessageFormatConverter, type TMessageState, TMetadata, TMetadataValue, type TModelEffort, type TModelEffortDisposition, type TModelEffortNativeControl, type TModelEffortOutcomeCallback, type TModelEffortProviderDispatch, type TModelEffortSelection, type TModelFallbackCallback, TOOL_BODY_EVENTS, TOOL_EVENTS, TOOL_EVENT_PREFIX, TOOL_PERMISSION_EVENTS, TOOL_SCHEMA_PROJECTION_MAX_DEPTH, TOOL_SCHEMA_PROJECTION_MAX_NODES, TOOL_SEARCH_TOOL_NAME, type TOrchestrationEvent, type TOrchestrationPrimitive, type TOutputRetention, type TParameterDefaultValue, type TPermissionDecision, type TPermissionMode, type TPrimitiveValue, type TProviderConfigValue, type TProviderCredentialField, type TProviderFailureReason, TProviderLoggingData, type TProviderMediaResult, TProviderMessage, type TProviderModelCapability, type TProviderModelCatalogStatus, type TProviderModelLifecycle, type TProviderNativeRawPayload, type TProviderNativeRawPayloadCallback, type TProviderNativeRawPayloadKind, type TProviderOptionValueBase, type TProviderSetupField, type TProviderSetupHelpLinkKind, type TProviderUsageProvenance, TRUST_TO_MODE, type TResolveInWorkspace, type TResponseMetadata, type TRoleModelMap, type TSessionEndReason, TShellKind, type TSpanEvent, type TStructuredOutputMechanism, type TStructuredOutputProvenance, type TStructuredOutputSchema, type TStructuredOutputValidation, type TSubprocessTraceClass, type TTextDeltaCallback, type TTimerId, type TToolArgs, type TToolChoice, type TToolEffectAdmission, type TToolExecutionFunction, type TToolExecutionParameters, type TToolExecutor, type TToolMetadata, TToolParameters, type TToolProgressCallback, type TToolResultAdmissionErrorCode, type TToolRiskClass, type TToolSchemaProjectionOutcome, type TToolSchemaProjectionProfileBase, type TToolSearchMode, type TToolSearchSetting, type TTrustLevel, type TUniversalArrayValue, type TUniversalMessage, type TUniversalMessageMetadata, type TUniversalMessagePart, type TUniversalMessageRole, type TUniversalValue, type TUserEvent, TUtilLogLevel, ToolExecutionError, ToolRegistry, ToolResultAdmissionError, TypeUtils, UNCLASSIFIED_TOOL_FALLBACK, USER_EVENTS, USER_EVENT_PREFIX, UnsupportedShellError, ValidationError, Validator, admitToolResult, allowRulesForAutoMode, applyPresetToolLists, assertProviderNativeWebToolsAvailable, assertResidentToolRemains, bindEventServiceOwner, bindWithOwnerPath, buildTraceparent, calculateModelCost, callJournaledProvider, chatEntryToMessage, classifyProviderFailure, clearRegisteredToolProfiles, closeObjectSchemas, collectAssistantUsageMetadata, composeEventName, confirmAction, createAssistantMessage, createBoundedOutput, createDefaultProviderCapabilities, createExecutionProxy, createImageProviderFromDefinition, createLogger, createModelEffortOutcome, createProviderFromConfig, createRecordEnvResolver, createSystemMessage, createToolMessage, createUserMessage, createVideoProviderFromDefinition, decodeHookVerdict, estimateBlendedCostPer1000, estimateContextTokensFromMessages, estimateSerializedContextTokens, estimateToolSchemaTokens, evaluatePermission, extractEnumValues, findInvalidPermissionPatterns, findMediaProviderDefinition, findModelDefinition, findPermissionPatternWarnings, findProviderDefinition, formatEnvReference, formatSupportedProviderTypes, formatTokenCount, generateSpanId, getGlobalLogLevel, getGlobalLoggerSink, getMessagesForAPI, getModelContextWindow, getModelMaxOutput, getModelName, getProviderCapabilities, getProviderCredentialRequirement, getSchemaTypeName, getToolEstimatedDuration, getToolExecutionSteps, getToolPermissionProfile, hasUsableSecretReference, hasValidationConstraints, hashToolSchema, isAbortFailure, isAssistantMessage, isBroadExecutionAllowRule, isChatEntry, isConfirmed, isDefaultEventService, isEnforcing, isEnvReference, isExecutionControlError, isImageGenerationProvider, isMediaProviderDefinition, isMintedSpanId, isModelEffort, isProgressReportingTool, isProtectedPath, isReadOnlyCommandLine, isRegistryTransactionError, isSystemMessage, isToolDeniedOutright, isToolMessage, isUserMessage, isVideoGenerationProvider, lifecycleOf, logger, lookupModelPrice, matchesAnyPattern, messageToHistoryEntry, modelDeclaresCapability, multiSelectAction, normalizeProviderConfig, normalizeStructuredOutput, outboundTraceContextFor, parseParameterRule, parseStructuredResponseText, peerDriverOf, printablePeerDriver, processEnvResolver, projectPermissionPolicy, projectToolSchema, providerCallSpanId, readModelFallbackNotice, readProviderFailureDetails, readTokenUsageFromMessage, readTokenUsageFromMetadata, registerModelMetadata, registerToolPermissionProfile, removesCriticalPath, requiresFreshApproval, resolveEnvReference, resolveMediaProviderConfig, resolveModelCapabilities, resolveModelCapability, resolveModelEffort, resolvePlatformShell, resolveStructuredOutputCapability, runHooks, runRegistryTransaction, scrubSecrets, selectAction, setGlobalLogLevel, setGlobalLoggerSink, setToolProgressCallback, shellArgumentForDisplay, spanIdFromMintedId, splitCommandSegments, startPeriodicTask, stopPeriodicTask, subprocessTraceEnvironment, sumHistoryUsage, sumMessagesUsage, textAction, toProviderError, toolNameMatches, toolNamesToPatterns, toolTraceContextFor, traceEnvFor, traceHeadersFor, validateAgainstJsonSchema, validateAgentConfig, validateApiKey, validateModelName, validatePermissionPattern, validateProviderName, validateUserInput, verifiedProviderCallUsage, wasToolResultAdmitted, withEventEmission, zodToJsonSchema };
+export { AGENT_EVENTS, AGENT_EVENT_PREFIX, AbstractAIProvider, AbstractAgent, AbstractEventService, AbstractExecutor, AbstractManager, AbstractPlugin, AbstractTool, AgentFactory, AgentTemplates, AuthenticationError, CONFIRM_NO, CONFIRM_YES, CONTEXT_ESTIMATE_CHARS_PER_TOKEN, CacheIntegrityError, CircuitBreakerOpenError, ConfigurationError, ConsoleLogger, ConversationHistory, ConversationStore, DEFAULT_ABSTRACT_EVENT_SERVICE, DEFAULT_BACKGROUND_PERMISSION_POLICY, DEFAULT_CONTEXT_WINDOW, DEFAULT_MAX_OUTPUT, DEFAULT_TOOL_RESULT_HARD_CHARS, DEFAULT_TOOL_RESULT_WARNING_CHARS, DEFERRED_WITHOUT_LOADER_MESSAGE, DefaultEventService, ENV_REFERENCE_PREFIX, EVENT_EMITTER_EVENTS, EXECUTION_EVENTS, EXECUTION_EVENT_PREFIX, EmptyCompletionError, ErrorUtils, EventEmitterPlugin, EventHistoryModule, ExecutionJournalError, ExecutionProxy, ExecutionRecoveryError, ExecutionSuspendedError, FunctionTool, GuardrailExecutor, type IAIProvider, type IAIProviderInstance, type IAIProviderManager, type IAbstractTool, type IAbstractToolOptions, type IActionDefault, type IActionOption, type IActionRequest, type IAgent, type IAgentConfig, type IAgentCreationStats, type IAgentEventData, type IAgentFactoryOptions, type IAgentHookDefinition, type IAgentLifecycleEvents, type IAgentTemplate, type IAssistantMessage, type IAssistantUsageMetadata, type IBaseEventData, type IBaseMessage, type IBoundedOutput, type IBoundedOutputOptions, type ICacheEntry, type ICacheKey, type ICacheOptions, type ICacheStats, type ICacheStorage, type IChatExecutionRequest, type IChatOptions, type ICommandHookDefinition, type IContextOptions, type IContextTokenEstimate, type IContextTokenEstimateOptions, type IContextTokenUsage, type IContextWindowState, type IConversationContext, type IConversationResponse, type IConversationService, type IConversationServiceOptions, type ICredentialKey, type ICredentialStore, type ICriticalPathContext, type IDeferredToolCatalog, type IDestroyResult, type IDirent, type IEventContext, type IEventEmitterEventData, type IEventEmitterHierarchicalEventData, type IEventEmitterMetrics, type IEventEmitterMetricsSnapshot, type IEventEmitterPlugin, type IEventEmitterPluginOptions, type IEventHistoryModule, type IEventHistoryRecord, type IEventHistorySnapshot, type IEventObjectValue, type IEventService, type IEventServiceOwnerBinding, type IExecutionContinuationState, type IExecutionEventData, type IExecutionJournal, type IExecutionProxyConfig, type IExecutionRoundCheckpoint, type IExecutor, IExecutorAwareProviderConfig, type IExecutorChatResult, type IExecutorStreamMessageEvent, type IExecutorStreamTerminalEvent, type IFileSystem, type IFileSystemAsync, type IFunctionTool, type IGroupChatOrchestrationSpec, type IGuardrailHookDefinition, type IGuardrailResult, type IHandoffOrchestrationSpec, type IHierarchicalOrchestrationSpec, type IHistoryEntry, type IHookGroup, type IHookInput, type IHookTypeExecutor, type IHttpHookDefinition, type IImageComposeRequest, type IImageEditRequest, type IImageGenerationProvider, type IImageGenerationRequest, type IImageGenerationResult, type IInlineImageInputSource, type IInlineImageMessagePart, type IJsonSchemaOutput, type ILocalExecutorConfig, ILogger, ILoggerOptions, IManagerLifecycleOptions, type IMediaOutputRef, type IMediaProviderConfig, type IMediaProviderCredentialRequirement, type IMediaProviderDefinition, type IMediaProviderOverrides, type IMessageTokenUsage, type IModelCapabilityDeviation, type IModelDefinition, type IModelEffortCapability, type IModelEffortOutcome, type IModelEffortResolution, type IModelFallbackNotice, type IModelJournalContext, type IModelPrice, type IModelRef, type IObjectParameterSchema, type IOpenAPIToolConfig, type IOrchestrationDelegation, type IOrchestrationEventData, type IOrchestrationRunResult, type IOrchestrationStep, type IOrchestrationStepResult, type IOutboundTraceContext, type IOwnerPathSegment, type IParallelOrchestrationSpec, type IParameterRule, type IParameterSchema, type IParameterValidationResult, type IPermissionEvaluationContext, type IPermissionLists, type IPermissionPatternProblem, type IPermissionPolicyContext, type IPermissionPolicyProjection, IPlatformShell, IPlatformShellResolutionRequest, type IPlugin, type IPluginConfig, type IPluginContext, type IPluginContract, type IPluginData, type IPluginErrorContext, type IPluginExecutionContext, type IPluginExecutionResult, type IPluginHooks, type IPluginOptions, type IPluginStats, type IProgressReportingTool, type IPromptHookDefinition, type IProviderCapabilities, type IProviderCapabilityTable, type IProviderCredentialRequirement, type IProviderDefinition, type IProviderDefinitionConfig, type IProviderEndpoint, type IProviderFailureClassification, IProviderFailureDetails, type IProviderFunctionCallingCapability, type IProviderMediaError, type IProviderModelCatalog, type IProviderModelCatalogEntry, type IProviderModelEffortTable, type IProviderNativeRawPayloadEvent, type IProviderNativeWebToolCapabilities, type IProviderNativeWebToolCapability, type IProviderNativeWebToolRequest, type IProviderOptions, type IProviderProbeResult, type IProviderProfileConfig, type IProviderProfileDefaults, type IProviderRequest, IProviderRuntimeConfig, type IProviderSetupHelpLink, type IProviderSetupStepDefinition, type IProviderSpecificOptions, type IProviderStructuredOutputCapability, type IRawProviderResponse, type IReadOnlyCommandContext, type IRecoverableExecutionJournal, type IRegistryOwnedLifecycle, type IRegistryTransactionError, type IRegistryTransactionStep, type IRemoteExecutorConfig, type IResponseFormatConfig, type IResumeExecutionOptions, type IResumeToolCallsOptions, type IResumeToolCallsResult, type IRunOptions, type IRunTraceContext, type ISchemaClosureChange, type ISchemaClosureOptions, type ISchemaConversionOptions, type ISequentialOrchestrationSpec, type ISession, type ISessionUsageTotals, ISimpleValidationResult, type ISpanCompletionEventData, type ISpinner, type IStats, type IStreamExecutionRequest, type IStreamingChunk, type IStructuredOutputResolutionInput, type IStructuredOutputSpec, type ISubprocessTraceEnv, type ISystemMessage, type ITemplateApplicationResult, type ITerminalOutput, type ITextMessagePart, type ITokenUsage, type ITokenUsageWithCacheRead, type ITool, type IToolActionIdentity, type IToolCall, type IToolContinuation, type IToolContinuationPrompt, type IToolContract, type IToolEventData, type IToolExecutionContext, type IToolExecutionRequest, type IToolExecutionResult, type IToolExecutionStep, type IToolFactory, type IToolManager, type IToolMessage, type IToolPermissionArgument, type IToolPermissionProfile, type IToolRegistry, type IToolResult, type IToolResultAdmissionOptions, type IToolResultSpillStore, type IToolSchema, type IToolSchemaProjection, type IToolSchemaProjectionChange, type IToolSchemaProjectionProfile, type IToolWaitRequest, type IToolWaitResponse, type IToolWaitState, type IToolWithEventService, type IUniversalObjectValue, type IUriImageInputSource, type IUriImageMessagePart, type IUserInteraction, type IUserMessage, IUtilLogEntry, type IVerifiedProviderCallUsage, type IVideoGenerationProvider, type IVideoGenerationRequest, type IVideoJobAccepted, type IVideoJobSnapshot, type IZodParseResult, type IZodSchema, type IZodSchemaDef, InMemoryEventEmitterMetrics, LocalExecutor, MAX_TOOL_RESULT_CHARS, MODEL_EFFORT_VALUES, MODEL_PRICES, MessageConverter, ModelNotAvailableError, NetworkError, ORCHESTRATION_EVENTS, ORCHESTRATION_EVENT_PREFIX, ObservableEventService, PARAMETER_SCHEMA_KEYWORDS, PERMISSIVE_TOOL_SCHEMA_PROFILE, PROTECTED_DIRECTORY_NAMES, PROTECTED_FILE_NAMES, PROVIDER_CALL_EVENTS, PROVIDER_FALLBACK_EVENTS, PluginCategory, PluginError, PluginPriority, ProviderError, RISK_CLASS_POLICY, RateLimitError, Robota, RobotaError, SPAN_EVENTS, SPAN_EVENT_PREFIX, STRICT_TOOL_SCHEMA_PROFILE, SameToolInputLoopError, SilentLogger, StorageError, StructuredEventService, StructuredOutputError, TASK_EVENTS, TASK_EVENT_PREFIX, type TActionResponse, type TArgumentKind, type TBackgroundPermissionPolicy, TComplexConfigValue, TConfigData, TConfigValue, TContextData, type TConversationContextMetadata, type TEnvResolver, TErrorContextData, TErrorExternalInput, type TEventEmitterListener, type TEventExtensionValue, type TEventListener, type TEventLoggerData, type TEventName, type TEventUniversalValue, type TExecutionEventCallback, type TExecutionEventData, type TExecutionEventName, type TExecutionJournalRecord, type TExecutionRecoveryErrorCode, type TExecutorStreamEvent, type TGuardrail, type THookDefinition, type THookEvent, type THookOutcome, type THooksConfig, type TImageInputSource, type TJSONSchemaEnum, type TJSONSchemaKind, type TJournalModelOptions, TLoggerData, type TManagerToolParameters, type TMatchDirection, TMessageConverterRegistry, TMessageFormatConverter, type TMessageState, TMetadata, TMetadataValue, type TModelEffort, type TModelEffortDisposition, type TModelEffortNativeControl, type TModelEffortOutcomeCallback, type TModelEffortProviderDispatch, type TModelEffortSelection, type TModelFallbackCallback, TOOL_BODY_EVENTS, TOOL_EVENTS, TOOL_EVENT_PREFIX, TOOL_PERMISSION_EVENTS, TOOL_SCHEMA_PROJECTION_MAX_DEPTH, TOOL_SCHEMA_PROJECTION_MAX_NODES, TOOL_SEARCH_TOOL_NAME, type TOrchestrationEvent, type TOrchestrationPrimitive, type TOutputRetention, type TParameterDefaultValue, type TPermissionDecision, type TPermissionMode, type TPrimitiveValue, type TProviderConfigValue, type TProviderCredentialField, type TProviderFailureReason, TProviderLoggingData, type TProviderMediaResult, TProviderMessage, type TProviderModelCapability, type TProviderModelCatalogStatus, type TProviderModelLifecycle, type TProviderNativeRawPayload, type TProviderNativeRawPayloadCallback, type TProviderNativeRawPayloadKind, type TProviderOptionValueBase, type TProviderSetupField, type TProviderSetupHelpLinkKind, type TProviderUsageProvenance, TRUST_TO_MODE, type TResolveInWorkspace, type TResponseMetadata, type TRoleModelMap, type TSessionEndReason, TShellKind, type TSpanEvent, type TStructuredOutputMechanism, type TStructuredOutputProvenance, type TStructuredOutputSchema, type TStructuredOutputValidation, type TSubprocessTraceClass, type TTextDeltaCallback, type TTimerId, type TToolArgs, type TToolChoice, type TToolEffectAdmission, type TToolExecutionFunction, type TToolExecutionParameters, type TToolExecutor, type TToolMetadata, TToolParameters, type TToolProgressCallback, type TToolResultAdmissionErrorCode, type TToolRiskClass, type TToolSchemaProjectionOutcome, type TToolSchemaProjectionProfileBase, type TToolSearchMode, type TToolSearchSetting, type TTrustLevel, type TUniversalArrayValue, type TUniversalMessage, type TUniversalMessageMetadata, type TUniversalMessagePart, type TUniversalMessageRole, type TUniversalValue, type TUserEvent, TUtilLogLevel, ToolExecutionError, ToolRegistry, ToolResultAdmissionError, TypeUtils, UNCLASSIFIED_TOOL_FALLBACK, USER_EVENTS, USER_EVENT_PREFIX, UnsupportedShellError, ValidationError, Validator, admitToolResult, allowRulesForAutoMode, applyPresetToolLists, assertProviderNativeWebToolsAvailable, assertResidentToolRemains, bindEventServiceOwner, bindWithOwnerPath, buildTraceparent, calculateModelCost, callJournaledProvider, chatEntryToMessage, classifyProviderFailure, clearRegisteredToolProfiles, closeObjectSchemas, collectAssistantUsageMetadata, composeEventName, confirmAction, createAssistantMessage, createBoundedOutput, createDefaultProviderCapabilities, createExecutionProxy, createImageProviderFromDefinition, createLogger, createModelEffortOutcome, createProviderFromConfig, createRecordEnvResolver, createSystemMessage, createToolMessage, createUserMessage, createVideoProviderFromDefinition, decodeHookVerdict, estimateBlendedCostPer1000, estimateContextTokensFromMessages, estimateSerializedContextTokens, estimateToolSchemaTokens, evaluatePermission, extractEnumValues, findInvalidPermissionPatterns, findMediaProviderDefinition, findModelDefinition, findPermissionPatternWarnings, findProviderDefinition, formatEnvReference, formatSupportedProviderTypes, formatTokenCount, generateSpanId, getGlobalLogLevel, getGlobalLoggerSink, getMessagesForAPI, getModelContextWindow, getModelMaxOutput, getModelName, getProviderCapabilities, getProviderCredentialRequirement, getSchemaTypeName, getToolEstimatedDuration, getToolExecutionSteps, getToolPermissionProfile, hasUsableSecretReference, hasValidationConstraints, hashToolSchema, isAbortFailure, isAssistantMessage, isBroadExecutionAllowRule, isChatEntry, isConfirmed, isDefaultEventService, isEnforcing, isEnvReference, isExecutionControlError, isImageGenerationProvider, isMediaProviderDefinition, isMintedSpanId, isModelEffort, isProgressReportingTool, isProtectedPath, isReadOnlyCommandLine, isRegistryTransactionError, isSystemMessage, isToolDeniedOutright, isToolMessage, isUserMessage, isVideoGenerationProvider, lifecycleOf, logger, lookupModelPrice, matchesAnyPattern, messageToHistoryEntry, modelDeclaresCapability, multiSelectAction, normalizeProviderConfig, normalizeStructuredOutput, outboundTraceContextFor, parseParameterRule, parseStructuredResponseText, peerDriverOf, printablePeerDriver, processEnvResolver, projectPermissionPolicy, projectToolSchema, providerCallSpanId, readModelFallbackNotice, readProviderFailureDetails, readTokenUsageFromMessage, readTokenUsageFromMetadata, registerModelMetadata, registerToolPermissionProfile, removesCriticalPath, requiresFreshApproval, resolveEnvReference, resolveMediaProviderConfig, resolveModelCapabilities, resolveModelCapability, resolveModelEffort, resolvePlatformShell, resolveStructuredOutputCapability, runHooks, runRegistryTransaction, scrubSecrets, selectAction, setGlobalLogLevel, setGlobalLoggerSink, setToolProgressCallback, shellArgumentForDisplay, spanIdFromMintedId, splitCommandSegments, startPeriodicTask, stopPeriodicTask, subprocessTraceEnvironment, sumHistoryUsage, sumMessagesUsage, textAction, toProviderError, toolNameMatches, toolNamesToPatterns, toolTraceContextFor, traceEnvFor, traceHeadersFor, validateAgainstJsonSchema, validateAgentConfig, validateApiKey, validateModelName, validatePermissionPattern, validateProviderName, validateUserInput, verifiedProviderCallUsage, wasToolResultAdmitted, withEventEmission, zodToJsonSchema };
 //# sourceMappingURL=index.d.ts.map