@rosetears/aili-pi 0.1.8 → 0.1.10

package/src/runtime/persistent-agents/runtime.ts

@@ -0,0 +1,164 @@
+import {
+  SessionManager,
+  type ExtensionAPI,
+  type ExtensionContext,
+} from "@earendil-works/pi-coding-agent";
+import type { TaskExecutionOutput, TaskExecutorInput } from "./task-coordinator.js";
+import { TaskCoordinator } from "./task-coordinator.js";
+import { HUB_TOOL_SCHEMA, HubService, type HubCaller, type LiveAgentAdapter } from "./hub.js";
+import { TASK_TOOL_SCHEMA } from "./task-schema.js";
+import {
+  createChildSessionManager,
+  ensureSidecarLayout,
+  openChildSessionManager,
+  reconcileUnfinishedCoordinator,
+  registerChildSession,
+  resumeCoordinator,
+  type CoordinatorJournal,
+} from "./storage.js";
+import {
+  AsyncDeliveryService,
+  persistFullAgentOutput,
+  readAgentHistory,
+  readAgentOutput,
+  type ParentDeliveryAdapter,
+} from "./output-delivery.js";
+import type { SidecarLayout } from "./types.js";
+
+export interface PersistentRuntimeExecutorInput extends TaskExecutorInput {
+  sessionManager: SessionManager;
+}
+
+export interface PersistentAgentRuntimeOptions {
+  parentSessionPath: string;
+  parentId: string;
+  cwd: string;
+  execute: (input: PersistentRuntimeExecutorInput) => Promise<TaskExecutionOutput>;
+  parentDelivery: ParentDeliveryAdapter;
+  revive: (agentId: string, sessionManager: SessionManager) => Promise<LiveAgentAdapter>;
+  modelHubOperation?: (request: Record<string, unknown>, caller: HubCaller) => Promise<unknown>;
+  onRelease?: (agentId: string) => void | Promise<void>;
+}
+
+export class PersistentAgentRuntime {
+  readonly layout: SidecarLayout;
+  readonly journal: CoordinatorJournal;
+  readonly task: TaskCoordinator;
+  readonly hub: HubService;
+  readonly delivery: AsyncDeliveryService;
+  private readonly childManagers = new Map<string, SessionManager>();
+
+  private constructor(
+    private readonly options: PersistentAgentRuntimeOptions,
+    initialized: { layout: SidecarLayout; journal: CoordinatorJournal },
+  ) {
+    this.layout = initialized.layout;
+    this.journal = initialized.journal;
+    this.delivery = new AsyncDeliveryService(this.layout, this.journal, options.parentDelivery);
+    this.task = new TaskCoordinator({
+      journal: this.journal,
+      execute: async (input) => {
+        const manager = await this.childManager(input.agentId);
+        return await options.execute({ ...input, sessionManager: manager });
+      },
+      onSettled: async (settlement, fullOutput) => {
+        await persistFullAgentOutput(this.layout, settlement.agentId, fullOutput);
+      },
+      onAsyncSettled: async (settlement, fullOutput) => {
+        await this.delivery.complete(settlement, fullOutput);
+      },
+    });
+    this.hub = new HubService({
+      journal: this.journal,
+      revive: async (agent) => {
+        if (!agent.sessionPath) throw new Error(`${agent.id}: no registered child session`);
+        const manager = await openChildSessionManager(this.layout, agent.sessionPath);
+        this.childManagers.set(agent.id, manager);
+        return await options.revive(agent.id, manager);
+      },
+      cancelJob: async (jobId) => await this.task.cancel(jobId),
+      output: async (agent, offset, limit) => await readAgentOutput(this.layout, this.journal, agent.id, offset, limit),
+      history: async (agent, offset, limit) => await readAgentHistory(this.layout, this.journal, agent.id, offset, limit),
+      model: options.modelHubOperation,
+      onRelease: async (agent) => await options.onRelease?.(agent.id),
+    });
+  }
+
+  static async create(options: PersistentAgentRuntimeOptions): Promise<PersistentAgentRuntime> {
+    const layout = await ensureSidecarLayout(options.parentSessionPath);
+    const resumed = await resumeCoordinator(layout, options.parentId);
+    const runtime = new PersistentAgentRuntime(options, { layout, journal: resumed.journal });
+    await runtime.delivery.recoverPending();
+    return runtime;
+  }
+
+  async shutdown(): Promise<void> {
+    await this.task.scheduler.close();
+    await reconcileUnfinishedCoordinator(this.journal, "graceful-shutdown");
+    for (const manager of this.childManagers.values()) void manager;
+    this.childManagers.clear();
+  }
+
+  private async childManager(agentId: string): Promise<SessionManager> {
+    const existing = this.childManagers.get(agentId);
+    if (existing) return existing;
+    const record = this.journal.getState().agents[agentId];
+    if (!record) throw new Error(`${agentId}: unknown Agent before child session creation`);
+    if (record.sessionPath) {
+      const manager = await openChildSessionManager(this.layout, record.sessionPath);
+      this.childManagers.set(agentId, manager);
+      return manager;
+    }
+    const created = await createChildSessionManager(this.layout, this.options.cwd, agentId);
+    await registerChildSession(this.journal, agentId, created.sessionPath);
+    this.childManagers.set(agentId, created.sessionManager);
+    return created.sessionManager;
+  }
+}
+
+export interface InternalPersistentToolRegistrationOptions {
+  runtimeForContext: (context: ExtensionContext) => Promise<PersistentAgentRuntime>;
+  directModelCommand?: (args: string, context: ExtensionContext) => Promise<string>;
+}
+
+/**
+ * Canonical registration surface shared by production and deterministic tests.
+ * It registers only task/hub plus the direct-user model command when configured;
+ * no legacy compatibility alias is created.
+ */
+export function registerPersistentAgentTools(pi: ExtensionAPI, options: InternalPersistentToolRegistrationOptions): void {
+  pi.registerTool({
+    name: "task",
+    label: "Task",
+    description: "Create one or more parent-scoped persistent AILI Agents; omitted agent defaults to general. Use async:false to wait synchronously or async:true for background execution. Never send blocking: it is profile-only internal metadata.",
+    parameters: TASK_TOOL_SCHEMA,
+    async execute(_toolCallId, params, signal, _onUpdate, context) {
+      const runtime = await options.runtimeForContext(context);
+      const result = await runtime.task.submit(params, undefined, signal);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], details: result };
+    },
+  });
+  pi.registerTool({
+    name: "hub",
+    label: "Hub",
+    description: "Inspect and control persistent Agents, jobs, messages, output, history, cancellation, and model requests.",
+    parameters: HUB_TOOL_SCHEMA,
+    async execute(_toolCallId, params, _signal, _onUpdate, context) {
+      const runtime = await options.runtimeForContext(context);
+      const result = await runtime.hub.execute(params);
+      return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }], details: result };
+    },
+  });
+  if (options.directModelCommand) {
+    pi.registerCommand("aili-agent-model", {
+      description: "Direct user operation for AILI Agent instance/global/project model overrides",
+      handler: async (args, context) => {
+        try {
+          context.ui.notify(await options.directModelCommand!(args, context), "info");
+        } catch (error) {
+          context.ui.notify(error instanceof Error ? error.message : String(error), "error");
+        }
+      },
+    });
+  }
+}

package/src/runtime/persistent-agents/sandbox.ts

@@ -0,0 +1,68 @@
+import { lstat } from "node:fs/promises";
+import { createRequire } from "node:module";
+import { isAbsolute, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { createBashToolDefinition, type BashOperations, type ToolDefinition } from "@earendil-works/pi-coding-agent";
+import { profileToConfig, readOnlyOverride, type SandboxConfig } from "pi-permission-modes/src/config-load.ts";
+import { createSandboxedBashOps } from "pi-permission-modes/src/sandbox.ts";
+import type { SandboxProfile } from "pi-permission-modes/src/schema.ts";
+import { resolvePermissionModesPackageRoot } from "../package-resolution.js";
+
+type SandboxManagerType = Parameters<typeof createSandboxedBashOps>[0];
+let managerPromise: Promise<SandboxManagerType> | undefined;
+
+function resolveProfilePath(cwd: string, path: string): string {
+  if (path === ".") return cwd;
+  if (path.startsWith("./") || path.startsWith("../")) return resolve(cwd, path);
+  return isAbsolute(path) ? path : path;
+}
+
+async function installedSandboxManager(): Promise<SandboxManagerType> {
+  managerPromise ??= (async () => {
+    const permissionRoot = resolvePermissionModesPackageRoot();
+    const requireFromPermissionModes = createRequire(new URL("package.json", permissionRoot));
+    const entry = requireFromPermissionModes.resolve("@anthropic-ai/sandbox-runtime");
+    const loaded = await import(pathToFileURL(entry).href) as { SandboxManager?: SandboxManagerType };
+    if (!loaded.SandboxManager) throw new Error("sandbox runtime did not export SandboxManager");
+    return loaded.SandboxManager;
+  })();
+  return await managerPromise;
+}
+
+export function childSandboxConfig(profile: SandboxProfile, cwd: string): Partial<SandboxConfig> {
+  const projected = profileToConfig({
+    ...profile,
+    allowWrite: (profile.allowWrite ?? []).map((path) => resolveProfilePath(cwd, path)),
+    denyWrite: (profile.denyWrite ?? []).map((path) => resolveProfilePath(cwd, path)),
+    denyRead: (profile.denyRead ?? []).map((path) => resolveProfilePath(cwd, path)),
+  });
+  return profile.writable ? projected : readOnlyOverride(projected);
+}
+
+export async function childGitMetadataBlocksSandbox(cwd: string): Promise<boolean> {
+  try {
+    return (await lstat(resolve(cwd, ".git"))).isFile();
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") return false;
+    throw error;
+  }
+}
+
+export async function createChildSandboxBash(
+  profile: SandboxProfile,
+  cwd: string,
+): Promise<{ operations?: BashOperations; definition?: ToolDefinition; reason?: string }> {
+  if (!profile.enabled) return { reason: "sandbox-disabled-by-mode" };
+  if (await childGitMetadataBlocksSandbox(cwd)) return { reason: "sandbox-unavailable-for-git-worktree-metadata" };
+  try {
+    const manager = await installedSandboxManager();
+    if (!manager.isSandboxingEnabled()) return { reason: "parent-sandbox-controller-unavailable" };
+    const operations = createSandboxedBashOps(manager, childSandboxConfig(profile, cwd));
+    return {
+      operations,
+      definition: createBashToolDefinition(cwd, { operations }) as unknown as ToolDefinition,
+    };
+  } catch (error) {
+    return { reason: `sandbox-load-failed:${error instanceof Error ? error.message : String(error)}` };
+  }
+}

package/src/runtime/persistent-agents/scheduler.ts

@@ -0,0 +1,190 @@
+export const DEFAULT_PARENT_CONCURRENCY = 32;
+export const DEFAULT_AGENT_MAX_RUNTIME_MS = 0;
+export const DEFAULT_AGENT_SOFT_REQUEST_BUDGET = 0;
+
+export class ScheduledTaskCancelledError extends Error {
+  constructor(readonly jobId: string, readonly beforeStart: boolean) {
+    super(`${jobId}: scheduled task cancelled${beforeStart ? " before start" : ""}`);
+    this.name = "ScheduledTaskCancelledError";
+  }
+}
+
+export interface SchedulerPermit {
+  readonly ownerJobId: string;
+  readonly token: symbol;
+}
+
+export interface ScheduledExecutionContext {
+  signal: AbortSignal;
+  permit: SchedulerPermit;
+  maxRuntimeMs: 0;
+  softRequestBudget: 0;
+  nested: boolean;
+}
+
+export interface ScheduledHandle<T> {
+  jobId: string;
+  result: Promise<T>;
+  state(): "queued" | "running" | "settled" | "cancelled";
+}
+
+interface QueueEntry<T> {
+  jobId: string;
+  controller: AbortController;
+  run: (context: ScheduledExecutionContext) => Promise<T>;
+  onCancelBeforeStart?: () => void | Promise<void>;
+  resolve: (result: T) => void;
+  reject: (error: unknown) => void;
+  state: "queued" | "running" | "settled" | "cancelled";
+  permit?: SchedulerPermit;
+}
+
+export class FifoTurnScheduler {
+  private readonly queue: Array<QueueEntry<unknown>> = [];
+  private readonly running = new Map<string, QueueEntry<unknown>>();
+  private readonly known = new Set<string>();
+  private readonly permitTokens = new Set<symbol>();
+  private readonly nestedTails = new Map<symbol, Promise<void>>();
+  private closed = false;
+
+  constructor(readonly capacity = DEFAULT_PARENT_CONCURRENCY) {
+    if (!Number.isSafeInteger(capacity) || capacity <= 0) throw new Error("scheduler capacity must be a positive integer");
+  }
+
+  enqueue<T>(
+    jobId: string,
+    run: (context: ScheduledExecutionContext) => Promise<T>,
+    onCancelBeforeStart?: () => void | Promise<void>,
+  ): ScheduledHandle<T> {
+    if (this.closed) throw new Error("scheduler is closed");
+    if (this.known.has(jobId)) throw new Error(`${jobId}: duplicate scheduled job`);
+    this.known.add(jobId);
+    let resolveResult!: (result: T) => void;
+    let rejectResult!: (error: unknown) => void;
+    const result = new Promise<T>((resolve, reject) => {
+      resolveResult = resolve;
+      rejectResult = reject;
+    });
+    const entry: QueueEntry<T> = {
+      jobId,
+      controller: new AbortController(),
+      run,
+      onCancelBeforeStart,
+      resolve: resolveResult,
+      reject: rejectResult,
+      state: "queued",
+    };
+    this.queue.push(entry as QueueEntry<unknown>);
+    this.drain();
+    return { jobId, result, state: () => entry.state };
+  }
+
+  runNested<T>(
+    jobId: string,
+    inheritedPermit: SchedulerPermit,
+    run: (context: ScheduledExecutionContext) => Promise<T>,
+  ): ScheduledHandle<T> {
+    if (this.closed) throw new Error("scheduler is closed");
+    if (!this.permitTokens.has(inheritedPermit.token)) throw new Error(`${jobId}: nested execution requires an active ancestor permit`);
+    if (this.known.has(jobId)) throw new Error(`${jobId}: duplicate scheduled job`);
+    this.known.add(jobId);
+    let state: "queued" | "running" | "settled" | "cancelled" = "queued";
+    const controller = new AbortController();
+    const previous = this.nestedTails.get(inheritedPermit.token) ?? Promise.resolve();
+    const operation = previous.then(async () => {
+      state = "running";
+      return await run({
+        signal: controller.signal,
+        permit: inheritedPermit,
+        maxRuntimeMs: DEFAULT_AGENT_MAX_RUNTIME_MS,
+        softRequestBudget: DEFAULT_AGENT_SOFT_REQUEST_BUDGET,
+        nested: true,
+      });
+    });
+    const result = operation.then(
+      (value) => {
+        state = "settled";
+        return value;
+      },
+      (error) => {
+        state = controller.signal.aborted ? "cancelled" : "settled";
+        throw error;
+      },
+    );
+    this.nestedTails.set(inheritedPermit.token, result.then(() => undefined, () => undefined));
+    return { jobId, result, state: () => state };
+  }
+
+  async cancel(jobId: string): Promise<"queued" | "running" | "not-found"> {
+    const queuedIndex = this.queue.findIndex((entry) => entry.jobId === jobId);
+    if (queuedIndex >= 0) {
+      const [entry] = this.queue.splice(queuedIndex, 1);
+      entry!.state = "cancelled";
+      entry!.controller.abort(new ScheduledTaskCancelledError(jobId, true));
+      try {
+        await entry!.onCancelBeforeStart?.();
+      } finally {
+        entry!.reject(new ScheduledTaskCancelledError(jobId, true));
+      }
+      return "queued";
+    }
+    const running = this.running.get(jobId);
+    if (running) {
+      running.controller.abort(new ScheduledTaskCancelledError(jobId, false));
+      return "running";
+    }
+    return "not-found";
+  }
+
+  isPermitActive(permit: SchedulerPermit): boolean {
+    return this.permitTokens.has(permit.token);
+  }
+
+  stats(): { active: number; capacity: number; queued: string[]; running: string[]; closed: boolean } {
+    return {
+      active: this.running.size,
+      capacity: this.capacity,
+      queued: this.queue.map((entry) => entry.jobId),
+      running: [...this.running.keys()],
+      closed: this.closed,
+    };
+  }
+
+  async close(): Promise<void> {
+    this.closed = true;
+    for (const entry of [...this.queue]) await this.cancel(entry.jobId);
+    for (const entry of this.running.values()) entry.controller.abort(new ScheduledTaskCancelledError(entry.jobId, false));
+  }
+
+  private drain(): void {
+    while (!this.closed && this.running.size < this.capacity && this.queue.length > 0) {
+      const entry = this.queue.shift()!;
+      entry.state = "running";
+      const permit: SchedulerPermit = { ownerJobId: entry.jobId, token: Symbol(entry.jobId) };
+      entry.permit = permit;
+      this.permitTokens.add(permit.token);
+      this.running.set(entry.jobId, entry);
+      void entry.run({
+        signal: entry.controller.signal,
+        permit,
+        maxRuntimeMs: DEFAULT_AGENT_MAX_RUNTIME_MS,
+        softRequestBudget: DEFAULT_AGENT_SOFT_REQUEST_BUDGET,
+        nested: false,
+      }).then(
+        (result) => {
+          entry.state = "settled";
+          entry.resolve(result);
+        },
+        (error) => {
+          entry.state = entry.controller.signal.aborted ? "cancelled" : "settled";
+          entry.reject(error);
+        },
+      ).finally(() => {
+        this.running.delete(entry.jobId);
+        this.permitTokens.delete(permit.token);
+        this.nestedTails.delete(permit.token);
+        this.drain();
+      });
+    }
+  }
+}

package/src/runtime/persistent-agents/session-factory.ts

@@ -0,0 +1,184 @@
+import {
+  createAgentSession,
+  DefaultResourceLoader,
+  SettingsManager,
+  type AgentSession,
+  type CreateAgentSessionOptions,
+  type ExtensionAPI,
+  type ExtensionFactory,
+  type InlineExtension,
+  type SessionManager,
+} from "@earendil-works/pi-coding-agent";
+import { bashMentionsCredentialPath, isProtectedChildPath } from "../credential-guard.js";
+import { findCredentialMaterial } from "./permission.js";
+import type { ChildPromptAssembly, EffectiveToolPolicy } from "./policy.js";
+
+export type ChildPermissionAction = "allow" | "ask" | "deny";
+
+export interface ChildApprovalPacket {
+  agentId: string;
+  jobId?: string;
+  toolName: string;
+  summary: string;
+}
+
+export interface ChildApprovalBridgeOptions {
+  agentId: string;
+  jobId?: string;
+  cwd: string;
+  decide: (toolName: string, input: Record<string, unknown>) => ChildPermissionAction | Promise<ChildPermissionAction>;
+  requestApproval: (packet: ChildApprovalPacket) => "allow" | "deny" | Promise<"allow" | "deny">;
+}
+
+const FILE_TOOLS = new Set(["read", "write", "edit", "ls", "grep", "find"]);
+
+function redactedSummary(toolName: string, input: Record<string, unknown>): string {
+  if (FILE_TOOLS.has(toolName) && typeof input.path === "string") return `${toolName} ${input.path}`.slice(0, 500);
+  if (toolName === "bash" && typeof input.command === "string") {
+    const command = input.command
+      .replace(/\b(authorization:\s*bearer|bearer)\s+\S+/gi, "$1 <redacted>")
+      .replace(/\b(token|secret|password|passwd|api[_-]?key|private[_-]?key)=\S+/gi, "$1=<redacted>")
+      .replace(/\s+/g, " ")
+      .trim();
+    return `bash ${command}`.slice(0, 500);
+  }
+  return `${toolName} request`;
+}
+
+async function credentialDenial(cwd: string, toolName: string, input: Record<string, unknown>): Promise<string | undefined> {
+  if (FILE_TOOLS.has(toolName) && typeof input.path === "string" && await isProtectedChildPath(cwd, input.path)) {
+    return "AILI child denied credential/auth/private-key path access before approval";
+  }
+  if (toolName === "bash" && typeof input.command === "string" && bashMentionsCredentialPath(input.command)) {
+    return "AILI child denied credential/auth/private-key path access in bash before approval";
+  }
+  const generic = await findCredentialMaterial(input, cwd);
+  if (generic) return `AILI child denied credential/auth/private-key material before approval (${generic.reason})`;
+  return undefined;
+}
+
+export function createChildApprovalBridge(options: ChildApprovalBridgeOptions): ExtensionFactory {
+  return (pi: ExtensionAPI) => {
+    pi.on("tool_call", async (event) => {
+      const input = (event.input && typeof event.input === "object" ? event.input : {}) as Record<string, unknown>;
+      const hardDenial = await credentialDenial(options.cwd, event.toolName, input);
+      if (hardDenial) return { block: true, reason: hardDenial };
+      let action: ChildPermissionAction;
+      try {
+        action = await options.decide(event.toolName, input);
+      } catch {
+        return { block: true, reason: "AILI child permission classification failed closed" };
+      }
+      if (action === "deny") return { block: true, reason: "AILI child permission policy denied this tool call" };
+      if (action === "allow") return undefined;
+      try {
+        const decision = await options.requestApproval({
+          agentId: options.agentId,
+          jobId: options.jobId,
+          toolName: event.toolName,
+          summary: redactedSummary(event.toolName, input),
+        });
+        return decision === "allow" ? undefined : { block: true, reason: "AILI parent approval denied or dismissed" };
+      } catch {
+        return { block: true, reason: "AILI parent approval bridge unavailable" };
+      }
+    });
+  };
+}
+
+export interface ChildResourceLoaderOptions {
+  cwd: string;
+  agentDir: string;
+  projectTrusted: boolean;
+  systemPrompt: string;
+  childExtensions?: Array<{ name: string; factory: ExtensionFactory }>;
+  topLevelExtensionNames?: string[];
+}
+
+export async function createChildResourceLoader(options: ChildResourceLoaderOptions): Promise<{
+  loader: DefaultResourceLoader;
+  settingsManager: SettingsManager;
+}> {
+  const forbidden = new Set(options.topLevelExtensionNames ?? ["aili-top-coordinator", "aili-runtime"]);
+  const extensions: InlineExtension[] = [];
+  for (const extension of options.childExtensions ?? []) {
+    if (forbidden.has(extension.name)) throw new Error(`${extension.name}: top-level Extension cannot be loaded in a child Agent`);
+    if (extensions.some((candidate) => candidate.name === extension.name)) throw new Error(`${extension.name}: duplicate child Extension`);
+    extensions.push({ name: extension.name, factory: extension.factory, hidden: true });
+  }
+  const settingsManager = SettingsManager.inMemory({}, { projectTrusted: options.projectTrusted });
+  const loader = new DefaultResourceLoader({
+    cwd: options.cwd,
+    agentDir: options.agentDir,
+    settingsManager,
+    noExtensions: true,
+    noSkills: true,
+    noPromptTemplates: true,
+    noThemes: true,
+    noContextFiles: true,
+    systemPrompt: options.systemPrompt,
+    extensionFactories: extensions,
+    extensionsOverride: (base) => ({
+      ...base,
+      extensions: base.extensions.filter((extension) => ![...forbidden].some((name) => extension.path === `<inline:${name}>` || extension.path.endsWith(`/${name}`))),
+    }),
+  });
+  await loader.reload();
+  const errors = loader.getExtensions().errors;
+  if (errors.length > 0) throw new Error(`child resource loader failed: ${errors.map((error) => error.error).join("; ")}`);
+  return { loader, settingsManager };
+}
+
+export interface CreatePersistentChildSessionOptions {
+  cwd: string;
+  agentDir: string;
+  projectTrusted: boolean;
+  sessionManager: SessionManager;
+  prompt: ChildPromptAssembly;
+  policy: EffectiveToolPolicy;
+  childExtensions?: Array<{ name: string; factory: ExtensionFactory }>;
+  topLevelExtensionNames?: string[];
+  model?: CreateAgentSessionOptions["model"];
+  thinkingLevel?: CreateAgentSessionOptions["thinkingLevel"];
+}
+
+export interface PersistentChildSessionRuntime {
+  session: AgentSession;
+  initialMessage: string;
+  dispose(): Promise<void>;
+}
+
+export async function createPersistentChildSession(options: CreatePersistentChildSessionOptions): Promise<PersistentChildSessionRuntime> {
+  const { loader, settingsManager } = await createChildResourceLoader({
+    cwd: options.cwd,
+    agentDir: options.agentDir,
+    projectTrusted: options.projectTrusted,
+    systemPrompt: options.prompt.systemPrompt,
+    childExtensions: options.childExtensions,
+    topLevelExtensionNames: options.topLevelExtensionNames,
+  });
+  const created = await createAgentSession({
+    cwd: options.cwd,
+    agentDir: options.agentDir,
+    model: options.model,
+    thinkingLevel: options.thinkingLevel,
+    resourceLoader: loader,
+    settingsManager,
+    sessionManager: options.sessionManager,
+    tools: options.policy.effectiveTools,
+    customTools: options.policy.customTools,
+  });
+  const active = created.session.getActiveToolNames();
+  const missing = options.policy.effectiveTools.filter((name) => !active.includes(name));
+  if (missing.length > 0) {
+    created.session.dispose();
+    throw new Error(`child runtime could not activate approved tools: ${missing.join(", ")}`);
+  }
+  return {
+    session: created.session,
+    initialMessage: options.prompt.initialMessage,
+    async dispose() {
+      created.session.dispose();
+    },
+  };
+}