@rynx-ai/daemon 0.1.11-beta.2 → 0.1.11-beta.21

package/dist/plugin-host-rpc.d.ts

@@ -1,5 +1,5 @@
-import { type AgentSpec, type AgentCapabilities, type AgentRuntimeId, type AgentSessionStore, type ConversationRuntime, type ResolvedExecutionSnapshot, type SessionRegistry, type SessionWorkspaceSnapshot } from "@rynx-ai/core";
-import { type PluginAgentSummary, type PluginCapability, type PluginHostEvent, type PluginResolvedSessionExecution, type PluginSessionExecutionSnapshot, type PluginSessionInteractionResolveDisposition } from "@rynx-ai/plugin-sdk";
+import { type AdmissionReservation, type AgentSpec, type AgentCapabilities, type AgentRuntimeId, type AgentSessionStore, type ConversationRuntime, type ResolvedExecutionSnapshot, type SessionRegistry, type SessionWorkspaceSnapshot } from "@rynx-ai/core";
+import { type PluginAgentSummary, type PluginHostEvent, type PluginResolvedSessionExecution, type PluginSessionExecutionSnapshot, type PluginSessionInteractionResolveDisposition } from "@rynx-ai/plugin-sdk";
 import type { SessionInteractionResolution } from "@rynx-ai/protocol";
 import { PluginRunnerError } from "@rynx-ai/plugin-runner";
 /** Leaves ample room for the RPC envelope below the runner's 1 MiB line cap. */
@@ -18,10 +18,11 @@ export interface PluginAgentCatalogHost {
 export interface PluginSessionLaunchSelection {
     projectId?: string;
     managedCwd?: string;
+    workspace?: SessionWorkspaceSnapshot;
     agent?: string;
     config?: AgentSpec;
     provider?: AgentRuntimeId;
-    model?: string;
+    model?: string | null;
     reasoningEffort?: string;
     title?: string;
 }
@@ -44,7 +45,15 @@ export interface PluginHostServices {
     sessionLaunch: {
         resolve(input: PluginSessionLaunchSelection): Promise<PluginResolvedSessionLaunch>;
     };
+    sessionExecution: {
+        update(input: {
+            sessionId: string;
+            model: string | null;
+            reasoningEffort: string | null;
+        }): Promise<void>;
+    };
     interruptSession?(sessionId: string): Promise<boolean>;
+    terminateSession?(sessionId: string): Promise<boolean>;
     resolveSessionInteraction?(sessionId: string, interactionId: string, resolution: SessionInteractionResolution): Promise<{
         disposition: PluginSessionInteractionResolveDisposition;
     }>;
@@ -56,6 +65,13 @@ export interface PluginHostServices {
         sessionId: string;
         disposition: "created" | "replayed";
     }>;
+    admissionOpen?: () => boolean;
+    admissionReserve?: () => AdmissionReservation | undefined;
+    sessionPortal?: {
+        scheme: "http" | "https";
+        bindHost: string;
+        port: number;
+    };
 }
 export interface PluginHostRpcOptions {
     /** Manifest id returned by host.info. */
@@ -63,16 +79,19 @@ export interface PluginHostRpcOptions {
     /** Marketplace-qualified principal used for ownership and proof scopes. */
     principalId?: string;
     daemonInstanceId: string;
-    capabilities: readonly PluginCapability[];
+    productVersion: string;
+    cliVersion: string;
     services: PluginHostServices;
     /** Canonical plugin-owned root permitted for the Workspace plugin's isolated
      * Session directory. Omitted for every other plugin. */
     managedWorkspaceRoot?: string;
     /** Resolving this promise is the stream's backpressure acknowledgement. */
     emit(event: PluginHostEvent): void | Promise<void>;
+    /** Bounded graceful-stop window used while disposing this Host. */
+    disposeForceAfterMs?: number;
 }
 /**
- * One authenticated plugin's capability-gated Host RPC surface.
+ * One authenticated plugin's Host RPC surface.
  *
  * This adapter is deliberately the only place that maps public string methods
  * to trusted runtime objects. The runner receives neither this class nor its
@@ -82,21 +101,27 @@ export declare class PluginHostRpc {
     private readonly pluginId;
     private readonly principalId;
     private readonly daemonInstanceId;
-    private readonly capabilities;
+    private readonly productVersion;
+    private readonly cliVersion;
     private readonly services;
     private readonly managedWorkspaceRoot;
     private readonly emit;
+    private readonly disposeForceAfterMs;
     private readonly activeRuns;
     private readonly activeSessionRuns;
     private readonly activeRunsByOperation;
     private disposed;
+    private disposePromise?;
     constructor(options: PluginHostRpcOptions);
     call(method: string, params: unknown, signal?: AbortSignal): Promise<unknown>;
     dispose(): Promise<void>;
     private ensureSession;
+    private ensureSessionAdmitted;
     private resolveManagedWorkspace;
+    private resolveWorkspaceSnapshot;
     private sessionEnsureResult;
     private runSession;
+    private runSessionAdmitted;
     private pumpRun;
     private releaseRun;
     private steerSession;
@@ -110,9 +135,13 @@ export declare class PluginHostRpc {
     private withOwnedSession;
     private resolveSessionInteraction;
     private forkSession;
+    private forkSessionAdmitted;
+    private reserveAdmission;
+    private withAdmission;
     private setSessionTitle;
     private resolveAgentExecution;
     private issueControlLink;
+    private issueSessionPortalLink;
     private ownedSession;
     private isOwned;
 }

package/dist/plugin-host-rpc.js

@@ -1,11 +1,12 @@
 import { createHash, randomUUID } from "node:crypto";
-import { realpath } from "node:fs/promises";
+import { realpath, stat } from "node:fs/promises";
 import path from "node:path";
 import { AgentRuntimeError, agentSpecSchema, resolvedExecutionSnapshotSchema, sessionWorkspaceSnapshotSchema, SteerController, } from "@rynx-ai/core";
 import { PLUGIN_HOST_MAX_ACTIVE_RUNS, } from "@rynx-ai/plugin-sdk";
 import { PluginRunnerError } from "@rynx-ai/plugin-runner";
 import { ensurePluginSessionLaunch, replayPluginSessionLaunch, SessionLaunchOperationConflictError, SessionLaunchOperationTargetDeletedError, } from "./session-launch-operations.js";
 import { createControlLink } from "./control-link-store.js";
+import { issueSessionPortalTicket } from "./session-portal-grant-store.js";
 const MAX_MESSAGE_LENGTH = 1_000_000;
 /** Leaves ample room for the RPC envelope below the runner's 1 MiB line cap. */
 export const MAX_PLUGIN_HOST_EVENT_BYTES = 512 * 1024;
@@ -13,31 +14,8 @@ const MAX_PLUGIN_RUN_FINAL_RESPONSE_BYTES = 64 * 1024;
 const MAX_DELTA_CHUNK_CODE_UNITS = 64 * 1024;
 const SESSION_INTERACTION_RESOLUTION_MAX_BYTES = 128 * 1024;
 const AGENT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
-const METHOD_CAPABILITY = {
-    "installation.proof.sign": "installation.proof",
-    "agent.catalog.list": "agent.catalog.read",
-    "agent.catalog.get": "agent.catalog.read",
-    "agent.execution.resolve": "agent.catalog.read",
-    "session.ensure": "session.provision",
-    "session.run": "conversation.run",
-    "session.steer": "conversation.run",
-    "session.interrupt": "session.cancel",
-    "session.interaction.resolve": "conversation.run",
-    "session.models": "runtime.catalog.read",
-    "session.binding.get": "session.binding.read",
-    "session.binding.list": "session.binding.read",
-    "session.binding.find": "session.binding.read",
-    "session.goal.get": "session.goal.read",
-    "session.goal.set": "session.goal.write",
-    "session.goal.clear": "session.goal.write",
-    "session.fork": "session.fork",
-    "session.meta.get": "session.meta.read",
-    "session.meta.list": "session.meta.read",
-    "session.meta.setTitle": "session.meta.title.write",
-    "control.link.issue": "control-link.issue",
-};
 /**
- * One authenticated plugin's capability-gated Host RPC surface.
+ * One authenticated plugin's Host RPC surface.
  *
  * This adapter is deliberately the only place that maps public string methods
  * to trusted runtime objects. The runner receives neither this class nor its
@@ -47,24 +25,29 @@ export class PluginHostRpc {
     pluginId;
     principalId;
     daemonInstanceId;
-    capabilities;
+    productVersion;
+    cliVersion;
     services;
     managedWorkspaceRoot;
     emit;
+    disposeForceAfterMs;
     activeRuns = new Map();
     activeSessionRuns = new Map();
     activeRunsByOperation = new Map();
     disposed = false;
+    disposePromise;
     constructor(options) {
         this.pluginId = requiredString(options.pluginId, "pluginId", 64);
         this.principalId = requiredString(options.principalId ?? options.pluginId, "principalId", 160);
         this.daemonInstanceId = requiredString(options.daemonInstanceId, "daemonInstanceId", 128);
-        this.capabilities = new Set(options.capabilities);
+        this.productVersion = requiredString(options.productVersion, "productVersion", 128);
+        this.cliVersion = requiredString(options.cliVersion, "cliVersion", 128);
         this.services = options.services;
         this.managedWorkspaceRoot = options.managedWorkspaceRoot
             ? path.resolve(options.managedWorkspaceRoot)
             : undefined;
         this.emit = options.emit;
+        this.disposeForceAfterMs = options.disposeForceAfterMs ?? 10_000;
     }
     async call(method, params, signal) {
         if (this.disposed)
@@ -75,20 +58,18 @@ export class PluginHostRpc {
                 pluginId: this.pluginId,
                 installationId: this.services.installationId,
                 daemonInstanceId: this.daemonInstanceId,
+                productVersion: this.productVersion,
+                cliVersion: this.cliVersion,
                 installationProof: {
                     algorithm: this.services.installationProof.algorithm,
                     publicKey: this.services.installationProof.publicKey,
                 },
                 protocolVersion: 1,
-                capabilities: [...this.capabilities],
+                ...(this.services.sessionPortal
+                    ? { sessionPortal: { ...this.services.sessionPortal } }
+                    : {}),
             };
         }
-        const capability = METHOD_CAPABILITY[method];
-        if (!capability)
-            throw new PluginHostCallError("METHOD_NOT_FOUND", `unknown host method: ${method}`);
-        if (!this.capabilities.has(capability)) {
-            throw new PluginHostCallError("CAPABILITY_NOT_DECLARED", `host method ${method} is missing manifest capability ${capability}`);
-        }
         try {
             switch (method) {
                 case "installation.proof.sign": {
@@ -142,6 +123,16 @@ export class PluginHostRpc {
                     return this.setSessionTitle(params);
                 case "control.link.issue":
                     return this.issueControlLink(params);
+                case "session.portal.plugin.issue": {
+                    const access = requiredSessionPortalAccess(params);
+                    return this.issueSessionPortalLink("plugin_sessions", access);
+                }
+                case "session.portal.session.issue": {
+                    const input = record(params);
+                    const sessionId = requiredSessionId(input);
+                    this.ownedSession(sessionId);
+                    return this.issueSessionPortalLink("single_session", requiredSessionPortalAccess(input), sessionId);
+                }
                 default:
                     throw new PluginHostCallError("METHOD_NOT_FOUND", `unknown host method: ${method}`);
             }
@@ -151,51 +142,85 @@ export class PluginHostRpc {
         }
     }
     async dispose() {
-        if (this.disposed)
-            return;
+        if (this.disposePromise)
+            return this.disposePromise;
         this.disposed = true;
         const runs = [...this.activeRuns.values()];
-        this.activeRuns.clear();
-        this.activeSessionRuns.clear();
-        this.activeRunsByOperation.clear();
-        for (const run of runs) {
-            run.interruptRequested = true;
-            if (run.interruptResult && await run.interruptResult.catch(() => false))
-                continue;
-            if (this.services.interruptSession) {
-                await this.services.interruptSession(run.sessionId).catch(() => false);
-            }
-            else {
-                run.abort.abort();
+        this.disposePromise = (async () => {
+            const stopped = await Promise.allSettled(runs.map(async (run) => {
+                if (this.activeRuns.get(run.runId) !== run)
+                    return;
+                run.interruptRequested = true;
+                const graceful = run.interruptResult ?? (this.services.interruptSession
+                    ? Promise.resolve().then(() => this.services.interruptSession(run.sessionId))
+                    : Promise.resolve().then(() => {
+                        run.abort.abort();
+                        return false;
+                    }));
+                const authoritative = forceStoppedInterrupt(graceful, this.disposeForceAfterMs, () => this.services.terminateSession?.(run.sessionId) ?? Promise.resolve(false));
+                run.interruptResult = authoritative;
+                if (!(await authoritative)) {
+                    throw new Error(`could not prove Session ${run.sessionId} stopped`);
+                }
+                this.releaseRun(run);
+            }));
+            const failures = stopped
+                .filter((result) => result.status === "rejected")
+                .map((result) => result.reason);
+            if (failures.length > 0) {
+                throw new AggregateError(failures, "plugin Host could not stop every active run");
             }
-        }
+        })();
+        return this.disposePromise;
     }
     async ensureSession(params) {
+        return this.withAdmission(() => this.ensureSessionAdmitted(params));
+    }
+    async ensureSessionAdmitted(params) {
         const input = record(params);
         const scopeId = requiredString(input.scopeId, "scopeId", 512);
         const operationId = requiredString(input.operationId, "operationId", 512);
         const parsedSelection = sessionLaunchSelection(input.session);
+        if (parsedSelection.managedCwd && !this.managedWorkspaceRoot) {
+            throw new PluginHostCallError("INVALID_PARAMS", "session.managedCwd is reserved for the built-in Workspace plugin");
+        }
+        const rawRequestHash = hashCanonicalJson(parsedSelection);
+        const replay = replayPluginSessionLaunch({
+            pluginId: this.principalId,
+            scopeId,
+            operationId,
+            requestHash: rawRequestHash,
+            allowRequestHashMismatch: true,
+        });
+        if (replay)
+            return this.sessionEnsureResult(replay);
         const selection = parsedSelection.managedCwd
             ? {
                 ...parsedSelection,
                 managedCwd: await this.resolveManagedWorkspace(parsedSelection.managedCwd),
             }
-            : parsedSelection;
+            : parsedSelection.workspace
+                ? {
+                    ...parsedSelection,
+                    workspace: await this.resolveWorkspaceSnapshot(parsedSelection.workspace),
+                }
+                : parsedSelection;
         const requestHash = hashCanonicalJson(selection);
-        const replay = replayPluginSessionLaunch({
+        const canonicalReplay = replayPluginSessionLaunch({
             pluginId: this.principalId,
             scopeId,
             operationId,
             requestHash,
         });
-        if (replay)
-            return this.sessionEnsureResult(replay);
+        if (canonicalReplay)
+            return this.sessionEnsureResult(canonicalReplay);
         const resolved = await this.services.sessionLaunch.resolve(selection);
         const ensured = ensurePluginSessionLaunch({
             pluginId: this.principalId,
             scopeId,
             operationId,
             requestHash,
+            rawRequestHash,
             session: {
                 workspace: sessionWorkspaceSnapshotSchema.parse(resolved.workspace),
                 execution: resolvedExecutionSnapshotSchema.parse(resolved.execution),
@@ -231,6 +256,33 @@ export class PluginHostRpc {
         }
         return canonicalDirectory;
     }
+    async resolveWorkspaceSnapshot(workspace) {
+        const directories = [workspace.cwd, ...workspace.allowedDirs];
+        if (directories.some((directory) => !path.isAbsolute(directory))) {
+            throw new PluginHostCallError("INVALID_PARAMS", "session.workspace paths must be absolute");
+        }
+        let canonical;
+        try {
+            canonical = await Promise.all(directories.map(async (directory) => {
+                const resolved = await realpath(directory);
+                if (!(await stat(resolved)).isDirectory()) {
+                    throw new Error("not a directory");
+                }
+                return resolved;
+            }));
+        }
+        catch {
+            throw new PluginHostCallError("INVALID_PARAMS", "session.workspace paths must be existing directories");
+        }
+        const parsed = sessionWorkspaceSnapshotSchema.safeParse({
+            cwd: canonical[0],
+            allowedDirs: canonical.slice(1),
+        });
+        if (!parsed.success) {
+            throw new PluginHostCallError("INVALID_PARAMS", `invalid session.workspace: ${parsed.error.issues[0]?.message ?? "invalid snapshot"}`);
+        }
+        return parsed.data;
+    }
     sessionEnsureResult(result) {
         const session = this.ownedSession(result.sessionId);
         return {
@@ -243,10 +295,21 @@ export class PluginHostRpc {
         };
     }
     async runSession(params, signal) {
+        return this.withAdmission(() => this.runSessionAdmitted(params, signal));
+    }
+    async runSessionAdmitted(params, signal) {
         const input = record(params);
         const sessionId = requiredSessionId(input);
         const operationId = optionalString(input.operationId, "operationId", 512);
-        const session = this.ownedSession(sessionId);
+        const modelProvided = input.model !== undefined;
+        const requestedModel = input.model === null || input.model === ""
+            ? null
+            : optionalString(input.model, "model", 256);
+        const reasoningEffortProvided = input.reasoningEffort !== undefined;
+        const requestedReasoningEffort = input.reasoningEffort === null || input.reasoningEffort === ""
+            ? null
+            : optionalString(input.reasoningEffort, "reasoningEffort", 64);
+        let session = this.ownedSession(sessionId);
         if (operationId && this.activeRunsByOperation.has(operationId)) {
             throw new PluginHostCallError("RUN_ALREADY_ACTIVE", `operation already has an active run: ${operationId}`, true);
         }
@@ -257,6 +320,19 @@ export class PluginHostRpc {
             throw new PluginHostCallError("RUN_LIMIT", "plugin has too many active session runs", true);
         }
         const message = requiredText(input.message, "message", MAX_MESSAGE_LENGTH);
+        const nextModel = modelProvided ? requestedModel ?? null : session.execution.model;
+        const nextReasoningEffort = reasoningEffortProvided
+            ? requestedReasoningEffort ?? null
+            : session.execution.reasoningEffort;
+        if (nextModel !== session.execution.model ||
+            nextReasoningEffort !== session.execution.reasoningEffort) {
+            await this.services.sessionExecution.update({
+                sessionId,
+                model: nextModel,
+                reasoningEffort: nextReasoningEffort,
+            });
+            session = this.ownedSession(sessionId);
+        }
         const abort = new AbortController();
         const cancel = () => abort.abort(signal?.reason);
         if (signal?.aborted) {
@@ -411,6 +487,10 @@ export class PluginHostRpc {
     async interruptRun(params) {
         const input = record(params);
         const run = this.activeRunByIdentity(input);
+        const forceAfterMs = optionalPositiveNumber(input.forceAfterMs, "forceAfterMs");
+        if (forceAfterMs !== undefined && forceAfterMs > 30_000) {
+            throw new PluginHostCallError("INVALID_PARAMS", "forceAfterMs must not exceed 30000");
+        }
         if (run.interruptResult) {
             return { interrupted: await run.interruptResult };
         }
@@ -418,7 +498,7 @@ export class PluginHostRpc {
         // the authoritative stop is pending wait for its result: true suppresses
         // them, while false/error lets genuine native progress/terminal continue.
         run.interruptRequested = true;
-        const interruptResult = this.services.interruptSession
+        const graceful = this.services.interruptSession
             // ConversationRuntime wires AbortSignal to this same native operation.
             // Invoke it directly once so this boolean is the authoritative result;
             // aborting first would trigger a duplicate, unobserved interrupt.
@@ -429,6 +509,9 @@ export class PluginHostRpc {
                 // effort and cannot prove that native execution stopped.
                 return false;
             });
+        const interruptResult = forceAfterMs === undefined
+            ? graceful
+            : forceStoppedInterrupt(graceful, forceAfterMs, () => this.services.terminateSession?.(run.sessionId) ?? Promise.resolve(false));
         run.interruptResult = interruptResult;
         try {
             const interrupted = await interruptResult;
@@ -510,6 +593,9 @@ export class PluginHostRpc {
         return await resolve(sessionId, interactionId, resolution);
     }
     async forkSession(params) {
+        return this.withAdmission(() => this.forkSessionAdmitted(params));
+    }
+    async forkSessionAdmitted(params) {
         const input = record(params);
         const sourceSessionId = requiredString(input.sourceSessionId, "sourceSessionId", 512);
         const operationId = requiredString(input.operationId, "operationId", 512);
@@ -524,6 +610,24 @@ export class PluginHostRpc {
             ...(title ? { title } : {}),
         });
     }
+    reserveAdmission() {
+        const reservation = this.services.admissionReserve?.();
+        if (reservation)
+            return reservation;
+        if (!this.services.admissionReserve && this.services.admissionOpen?.() !== false) {
+            return { release() { } };
+        }
+        throw new PluginHostCallError("HOST_CALL_FAILED", "daemon maintenance is in progress", true);
+    }
+    async withAdmission(operation) {
+        const reservation = this.reserveAdmission();
+        try {
+            return await operation();
+        }
+        finally {
+            reservation.release();
+        }
+    }
     setSessionTitle(params) {
         const input = record(params);
         const sessionId = requiredSessionId(input);
@@ -551,6 +655,17 @@ export class PluginHostRpc {
             ...(ttlSeconds === undefined ? {} : { ttlMs: ttlSeconds * 1_000 }),
         });
     }
+    issueSessionPortalLink(scope, access, sessionId) {
+        if (!this.services.sessionPortal) {
+            throw new PluginHostCallError("HOST_CALL_FAILED", "the Session Portal is not configured");
+        }
+        return issueSessionPortalTicket({
+            pluginId: this.principalId,
+            scope,
+            access,
+            ...(sessionId ? { sessionId } : {}),
+        });
+    }
     ownedSession(sessionId) {
         const session = this.services.sessionRegistry.get(sessionId);
         if (!session || !this.isOwned(session)) {
@@ -612,14 +727,18 @@ function sessionLaunchSelection(value) {
     assertJsonValue(input, "session");
     const projectId = optionalString(input.projectId, "session.projectId", 512);
     const managedCwd = optionalString(input.managedCwd, "session.managedCwd", 16_384);
+    const workspace = optionalSessionWorkspace(input.workspace);
     const agent = optionalAgentId(input.agent, "session.agent");
     const config = input.config === undefined ? undefined : agentSpecSchema.parse(input.config);
     const provider = optionalRuntimeValue(input.provider);
-    const model = optionalString(input.model, "session.model", 256);
+    const modelProvided = input.model !== undefined;
+    const model = input.model === null || input.model === ""
+        ? null
+        : optionalString(input.model, "session.model", 256);
     const reasoningEffort = optionalString(input.reasoningEffort, "session.reasoningEffort", 128);
     const title = optionalString(input.title, "session.title", 1_000);
-    if (Number(Boolean(projectId)) + Number(Boolean(managedCwd)) > 1) {
-        throw new PluginHostCallError("INVALID_PARAMS", "session.projectId and session.managedCwd are mutually exclusive");
+    if (Number(Boolean(projectId)) + Number(Boolean(managedCwd)) + Number(Boolean(workspace)) > 1) {
+        throw new PluginHostCallError("INVALID_PARAMS", "session.projectId, session.managedCwd, and session.workspace are mutually exclusive");
     }
     if (Number(Boolean(agent)) +
         Number(Boolean(config)) +
@@ -630,14 +749,26 @@ function sessionLaunchSelection(value) {
     return {
         ...(projectId ? { projectId } : {}),
         ...(managedCwd ? { managedCwd } : {}),
+        ...(workspace ? { workspace } : {}),
         ...(agent ? { agent } : {}),
         ...(config ? { config } : {}),
         ...(provider ? { provider } : {}),
-        ...(model ? { model } : {}),
+        ...(modelProvided ? { model: model ?? null } : {}),
         ...(reasoningEffort ? { reasoningEffort } : {}),
         ...(title ? { title } : {}),
     };
 }
+function optionalSessionWorkspace(value) {
+    if (value === undefined)
+        return undefined;
+    const input = record(value);
+    const cwd = requiredPathString(input.cwd, "session.workspace.cwd", 16_384);
+    if (!Array.isArray(input.allowedDirs) || input.allowedDirs.length === 0) {
+        throw new PluginHostCallError("INVALID_PARAMS", "session.workspace.allowedDirs must be a non-empty string array");
+    }
+    const allowedDirs = input.allowedDirs.map((directory, index) => requiredPathString(directory, `session.workspace.allowedDirs[${index}]`, 16_384));
+    return { cwd, allowedDirs };
+}
 function sessionExecutionSnapshot(value) {
     const input = record(value);
     const runtime = optionalRuntimeValue(input.runtime);
@@ -654,6 +785,12 @@ function sessionExecutionSnapshot(value) {
 function requiredSessionId(params) {
     return requiredString(record(params).sessionId, "sessionId", 512);
 }
+function requiredSessionPortalAccess(params) {
+    const access = record(params).access;
+    if (access === "read_only" || access === "read_write")
+        return access;
+    throw new PluginHostCallError("INVALID_PARAMS", "access must be read_only or read_write");
+}
 function sessionInteractionResolution(value) {
     const input = record(value);
     const keys = Object.keys(input);
@@ -718,6 +855,15 @@ function requiredString(value, label, maxLength) {
     }
     return value.trim();
 }
+function requiredPathString(value, label, maxLength) {
+    if (typeof value !== "string" || !value.trim()) {
+        throw new PluginHostCallError("INVALID_PARAMS", `${label} is required`);
+    }
+    if (value.length > maxLength) {
+        throw new PluginHostCallError("INVALID_PARAMS", `${label} is too long`);
+    }
+    return value;
+}
 function requiredText(value, label, maxLength) {
     if (typeof value !== "string" || !value.trim()) {
         throw new PluginHostCallError("INVALID_PARAMS", `${label} is required`);
@@ -758,6 +904,23 @@ function optionalPositiveNumber(value, label) {
     }
     return value;
 }
+async function forceStoppedInterrupt(graceful, forceAfterMs, terminate) {
+    let timer;
+    const graceExpired = new Promise((resolve) => {
+        timer = setTimeout(() => resolve(false), forceAfterMs);
+        timer.unref?.();
+    });
+    try {
+        if (await Promise.race([graceful.catch(() => false), graceExpired])) {
+            return true;
+        }
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+    }
+    return terminate();
+}
 function assertJsonValue(value, label, seen = new Set()) {
     if (value === null || typeof value === "string" || typeof value === "boolean")
         return;