@skaile/workspaces 0.8.5

package/dist/runner/src/mixin-resolver.d.ts

@@ -0,0 +1,61 @@
+/**
+ * mixin-resolver.ts
+ *
+ * Resolves agent composition mixin refs (persona, ruleset, knowledge) to text
+ * for rendering into the agent definition at install time.
+ *
+ * Three ref forms:
+ *   Local path  — "./extra-rules.md" or "/abs/path/rules.md"
+ *                 Read directly relative to agentDir (or absolute).
+ *   Bare name   — "skaile-base"
+ *                 Resolved from repos as `${defaultKind}:skaile-base`
+ *   Qualified   — "persona:researcher@ext-repo#v2.0"
+ *                 Full AssetRef syntax; repo qualifier searches specific repo only.
+ *
+ * Knowledge bundles (kind="knowledge") resolve to a directory — all *.md files
+ * inside are loaded in priority order (same priority-based loadKnowledge logic used by the asset-manager).
+ */
+import type { AgentManifest, CatalogEntry } from "@skaile/workspaces/core";
+/**
+ * A resolved mixin with its content loaded from disk.
+ *
+ * @docLink packages/runner/dev-guide#key-conventions
+ */
+export interface ResolvedMixin {
+    /** Text content ready for system prompt injection. */
+    content: string;
+    /** Absolute path to the source file, for debugging. */
+    source: string;
+}
+/**
+ * Pre-built repo catalog map: repoName → CatalogEntry[].
+ * Built by the caller (session-builder) from wsConfig.repositories using
+ * ensureRepo() + scanRepo() from @skaile/workspaces/core/repo-manager.
+ * Local repos are scanned directly; remote repos use the global cache.
+ * @docLink packages/runner/dev-guide#key-conventions
+ */
+export type RepoMap = Record<string, CatalogEntry[]>;
+/**
+ * Content of an agent mixin, loaded from `CONVENTIONS.md` or `RULES.md`.
+ *
+ * @docLink packages/runner/dev-guide#key-conventions
+ */
+export interface AgentMixinContent {
+    personas: ResolvedMixin[];
+    rules: ResolvedMixin[];
+    knowledge: ResolvedMixin[];
+}
+/**
+ * Resolve a single mixin ref to its text content.
+ * Returns null if the ref cannot be resolved (missing file or unknown catalog name).
+ * Never throws — callers filter nulls.
+ * @docLink packages/runner/dev-guide#key-conventions
+ */
+export declare function resolveMixin(ref: string, defaultKind: string, agentDir: string, repos: RepoMap): Promise<ResolvedMixin | null>;
+/**
+ * Resolve all mixin arrays from a manifest.
+ * All three kinds resolve concurrently. Unresolvable refs are silently skipped.
+ * @docLink packages/runner/dev-guide#key-conventions
+ */
+export declare function resolveAgentMixins(manifest: Pick<AgentManifest, "persona" | "rules" | "knowledge">, agentDir: string, repos: RepoMap): Promise<AgentMixinContent>;
+//# sourceMappingURL=mixin-resolver.d.ts.map

package/dist/runner/src/mixin-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mixin-resolver.d.ts","sourceRoot":"","sources":["../../../runner/src/mixin-resolver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAI3E;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,sDAAsD;IACtD,OAAO,EAAE,MAAM,CAAC;IAChB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,KAAK,EAAE,aAAa,EAAE,CAAC;IACvB,SAAS,EAAE,aAAa,EAAE,CAAC;CAC5B;AAID;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA0B/B;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,OAAO,GAAG,WAAW,CAAC,EAChE,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,OAAO,GACb,OAAO,CAAC,iBAAiB,CAAC,CAkB5B"}

package/dist/runner/src/prompt-assembly.d.ts

@@ -0,0 +1,42 @@
+/**
+ * prompt-assembly.ts
+ *
+ * Utility for assembling multi-section system prompts. Joins non-empty
+ * parts with the standard section separator (`\n\n---\n\n`) and wraps
+ * registry-driven capability prompt fragments into the v2 `<CAPABILITIES>`
+ * block.
+ */
+import type { CapabilityRegistry } from "./capability-registry.js";
+/**
+ * Join non-empty parts with the standard section separator (`\n\n---\n\n`).
+ *
+ * Returns `undefined` when all parts are empty or falsy, so callers can
+ * use a nullish check instead of inspecting an empty string.
+ *
+ * @param parts - Array of prompt sections; may include `undefined`, `null`,
+ *   or empty strings — those are filtered out before joining.
+ * @returns The assembled prompt string, or `undefined` if nothing to join.
+ * @docLink packages/runner/capabilities#system-prompt-capabilities-block
+ */
+export declare function assembleSystemPrompt(parts: (string | undefined | null)[]): string | undefined;
+/**
+ * Build the protocol-v2 `<CAPABILITIES>` system-prompt block from a
+ * {@link CapabilityRegistry}.
+ *
+ * The block joins every capability's `promptFragment` in the order encoded by
+ * `CapabilityRegistry.composePromptSection()`: framework first, then client
+ * (platform.* and other client-side surfaces), then agent-side surfaces
+ * (skill / flow / mcp / connector / mount). Capabilities without a
+ * `promptFragment` are skipped.
+ *
+ * Replaces the AAP-era `<UI_MANIFEST>` / `<AVAILABLE_COMPONENTS>` injection.
+ * Callers append the returned string to `additionalPromptSections` so the
+ * fragment lands inside the standard `assembleSystemPrompt` pipeline.
+ *
+ * @returns The wrapped block, or `undefined` when the registry has no
+ *   prompt-bearing capabilities (so callers can use a nullish check before
+ *   forwarding to `additionalPromptSections`).
+ * @docLink packages/runner/capabilities#system-prompt-capabilities-block
+ */
+export declare function buildCapabilitiesPromptSection(registry: Pick<CapabilityRegistry, "composePromptSection">): string | undefined;
+//# sourceMappingURL=prompt-assembly.d.ts.map

package/dist/runner/src/prompt-assembly.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prompt-assembly.d.ts","sourceRoot":"","sources":["../../../runner/src/prompt-assembly.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAEnE;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,CAAC,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,EAAE,GAAG,MAAM,GAAG,SAAS,CAI7F;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,8BAA8B,CAC5C,QAAQ,EAAE,IAAI,CAAC,kBAAkB,EAAE,sBAAsB,CAAC,GACzD,MAAM,GAAG,SAAS,CAIpB"}

package/dist/runner/src/recipe-resolver.d.ts

@@ -0,0 +1,18 @@
+export declare class RecipeUnavailableError extends Error {
+    readonly flakeRef: string;
+    readonly attr: string;
+    constructor(flakeRef: string, attr: string, cause?: unknown);
+}
+/**
+ * Per-resolve-pass cache. Created fresh by each call to
+ * `loadMcpServerDeclarations` integration so values don't go stale across
+ * sessions but multiple recipes within one pass dedupe.
+ */
+export type RecipeResolutionCache = Map<string, string>;
+export declare function createRecipeCache(): RecipeResolutionCache;
+/**
+ * Resolves a flake attribute to its /nix/store out-path.
+ * Throws RecipeUnavailableError on missing closure / nix failure.
+ */
+export declare function resolveRecipePath(flakeRef: string, attr: string, cache: RecipeResolutionCache): string;
+//# sourceMappingURL=recipe-resolver.d.ts.map

package/dist/runner/src/recipe-resolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-resolver.d.ts","sourceRoot":"","sources":["../../../runner/src/recipe-resolver.ts"],"names":[],"mappings":"AAYA,qBAAa,sBAAuB,SAAQ,KAAK;aAE7B,QAAQ,EAAE,MAAM;aAChB,IAAI,EAAE,MAAM;gBADZ,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EAC5B,KAAK,CAAC,EAAE,OAAO;CAOlB;AAED;;;;GAIG;AACH,MAAM,MAAM,qBAAqB,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAExD,wBAAgB,iBAAiB,IAAI,qBAAqB,CAEzD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,qBAAqB,GAC3B,MAAM,CA0CR"}

package/dist/runner/src/recipe-templating.d.ts

@@ -0,0 +1,20 @@
+export declare function substituteRecipeTemplating(value: string, recipeOutPaths: ReadonlyMap<string, string>): string;
+export declare function substituteRecipeMap(obj: Record<string, string> | undefined, recipeOutPaths: ReadonlyMap<string, string>): Record<string, string> | undefined;
+export interface MissingSubstitutedPath {
+    field: string;
+    path: string;
+    error: string;
+}
+/**
+ * Checks that the resolved binary path (command and args[0]) produced by
+ * recipe substitution actually exists on the filesystem.
+ *
+ * Only checks `command` and `args[0]` — these are the fields where ENOENT
+ * is most user-visible (subprocess spawn fails immediately). Other args and
+ * env values are not checked to keep this focused.
+ *
+ * Returns an array of missing-path entries; an empty array means all checks
+ * passed. The caller in resources.ts skips the declaration when non-empty.
+ */
+export declare function validateSubstitutedPaths(command: string | undefined, args: string[] | undefined): MissingSubstitutedPath[];
+//# sourceMappingURL=recipe-templating.d.ts.map

package/dist/runner/src/recipe-templating.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipe-templating.d.ts","sourceRoot":"","sources":["../../../runner/src/recipe-templating.ts"],"names":[],"mappings":"AAoBA,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,MAAM,EACb,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1C,MAAM,CAYR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EACvC,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAC1C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAOpC;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,MAAM,EAAE,GAAG,SAAS,GACzB,sBAAsB,EAAE,CAqB1B"}

package/dist/runner/src/refresh-flag-dispatcher.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Refresh-flag dispatcher — wake-mid-401 hardening for Tier-2 git mounts.
+ *
+ * The Tier-2 git credential-helper script (rendered by
+ * `connectors/credential-helper-script.ts`) touches a workspace-level
+ * refresh-flag file when it detects a stale credentials file. The runner
+ * watches that flag via `fs.watch` and on `change` invokes the dispatcher
+ * here, which:
+ *
+ *   1. Lists git mounts whose `exposeAccessToken === true` AND
+ *      `auth === 'backend'` (Tier-2 backend-mediated only — PAT mounts
+ *      can't be refreshed runtime-side).
+ *   2. For each eligible mount, calls the GitDriver's
+ *      `refreshExposedCredential(mountId, handle)` — which mediates a fresh
+ *      access token via the runner-supplied `tokenMediator` and rewrites
+ *      the credentials file via `atomicReplaceCredential`.
+ *
+ * Extracted into its own module so the watcher logic can be unit-tested
+ * without spinning up the full WebSocket server.
+ *
+ * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md` Step 9a.
+ */
+import type { Logger } from "@skaile/workspaces/types";
+/**
+ * Minimal mount-manager surface the dispatcher needs. Matches the public
+ * interface of `MountManager` (`listGitMounts`, `get`) but stays structural
+ * so tests can pass mocks without importing the full class.
+ */
+export interface DispatchMountManager {
+    listGitMounts(): Array<{
+        id: string;
+        source: string;
+        exposeAccessToken: boolean;
+        auth?: string;
+    }>;
+    get(id: string): {
+        driver: {
+            refreshExposedCredential?: (mountId: string, handle: unknown) => Promise<void>;
+        };
+        handle: unknown;
+    };
+}
+/**
+ * Iterate every currently mounted git mount and refresh the credential for
+ * those eligible (Tier-2 backend-mediated). Failures on one mount do not
+ * abort the rest.
+ *
+ * @param mountManager - The active mount manager. Pass `null` to short-circuit
+ *   (used during the brief window between session boot and provisioning).
+ * @param log - Logger. The dispatcher emits `info` on success and `warn` on
+ *   per-mount failure.
+ */
+export declare function dispatchRefreshToExposedGitMounts(mountManager: DispatchMountManager | null, log: Logger): Promise<void>;
+//# sourceMappingURL=refresh-flag-dispatcher.d.ts.map

package/dist/runner/src/refresh-flag-dispatcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-flag-dispatcher.d.ts","sourceRoot":"","sources":["../../../runner/src/refresh-flag-dispatcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAEvD;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,aAAa,IAAI,KAAK,CAAC;QACrB,EAAE,EAAE,MAAM,CAAC;QACX,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,OAAO,CAAC;QAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG;QACf,MAAM,EAAE;YACN,wBAAwB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;SAChF,CAAC;QACF,MAAM,EAAE,OAAO,CAAC;KACjB,CAAC;CACH;AAED;;;;;;;;;GASG;AACH,wBAAsB,iCAAiC,CACrD,YAAY,EAAE,oBAAoB,GAAG,IAAI,EACzC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CA0Cf"}

package/dist/runner/src/resource-handler.d.ts

@@ -0,0 +1,22 @@
+/**
+ * resource-handler.ts — handles resource_request commands from the frontend.
+ *
+ * Dispatches list/read/write/delete/search operations to the ConnectorManager
+ * (for connectors) or the filesystem (for mounts), and emits resource_response
+ * events back through the transport.
+ */
+import type { ConnectorManager, MountManager } from "@skaile/workspaces/connectors";
+import type { AgentEvent, ConnectorRequestCommand } from "@skaile/workspaces/types";
+/**
+ * Handle a resource_request command by dispatching to the ConnectorManager
+ * and emitting a resource_response event.
+ * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
+ */
+export declare function handleResourceRequest(command: ConnectorRequestCommand, manager: ConnectorManager, emit: (event: AgentEvent) => void): Promise<void>;
+/**
+ * Handle a mount-specific resource request.
+ *
+ * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
+ */
+export declare function handleMountResourceRequest(command: ConnectorRequestCommand, volManager: MountManager, emit: (event: AgentEvent) => void): void;
+//# sourceMappingURL=resource-handler.d.ts.map

package/dist/runner/src/resource-handler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource-handler.d.ts","sourceRoot":"","sources":["../../../runner/src/resource-handler.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAcH,OAAO,KAAK,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AACpF,OAAO,KAAK,EAAE,UAAU,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAMpF;;;;GAIG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,uBAAuB,EAChC,OAAO,EAAE,gBAAgB,EACzB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,OAAO,CAAC,IAAI,CAAC,CAyCf;AAgCD;;;;GAIG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,YAAY,EACxB,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,KAAK,IAAI,GAChC,IAAI,CAuGN"}

package/dist/runner/src/resources.d.ts

@@ -0,0 +1,102 @@
+/**
+ * resources.ts
+ *
+ * Shared mounts + connector lifecycle for agent sessions — mount, connect,
+ * watch, and build tool injection for all driver types.
+ *
+ * Used by agent.ts (REPL), base-assets/connectors/flow/run-flow.ts (flow), and serve.ts (WebSocket server).
+ * Extracted from duplicated inline blocks in each of those files.
+ */
+import { type ConnectorChangeEvent, type MountChangeEvent, type PreMintedSecretProvider, type SyncStatusPayload, type TokenMediator } from "@skaile/workspaces/connectors";
+import { type RuntimeAssetsResult } from "@skaile/workspaces/core";
+/**
+ * Result of {@link buildAgentResources}.
+ *
+ * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
+ */
+export interface AgentResourcesResult {
+    /** Connected ConnectorManager instance — null if no connectors declared or package missing. */
+    resourceManager: any | null;
+    /** Mounted MountManager instance — null if no mounts declared or package missing. */
+    mountManager: any | null;
+    /** Markdown section to append to the system prompt — empty string if no resources. */
+    resourcePromptSection: string;
+    /**
+     * In-process MCP server map to pass as `mcpServers` in `AgentConfig`.
+     * Populated only for the `claude-sdk` driver; undefined for all others.
+     */
+    mcpServers: Record<string, unknown> | undefined;
+    /**
+     * Resolved runtime assets — catalog entries, implicit refs, npm deps, warnings.
+     * Held by the session so live-update paths (add_resource, configure)
+     * can call `runtimeAssets.refresh()` and consume the same shared view.
+     * `null` only when @skaile/workspaces/connectors or skaile.yaml parsing failed.
+     */
+    runtimeAssets: RuntimeAssetsResult | null;
+    /** Disconnect all connectors, unmount all mounts, and stop watchers. */
+    dispose: () => Promise<void>;
+    /**
+     * Start filesystem and connector watchers. Call AFTER the transport is
+     * listening — watching can be slow on large directory trees and must not
+     * block session startup.
+     */
+    startWatching: () => void;
+}
+/**
+ * Callback hooks for filesystem and connector lifecycle events.
+ *
+ * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
+ */
+export interface ResourceWatchCallbacks {
+    /**
+     * Called by mountable adapters to report incremental sync progress.
+     * Used by serve.ts to forward sync_status events to the frontend.
+     */
+    onSyncStatus?: (connectorId: string, status: SyncStatusPayload) => void;
+    /**
+     * Called when a watched connector detects an in-process change.
+     * Used by serve.ts to forward file_changed events to the frontend.
+     * Change events are deduplicated within `dedupTtlMs` per path.
+     */
+    onFileChanged?: (connectorId: string, event: ConnectorChangeEvent) => void;
+    /**
+     * Called when a watched mount detects a filesystem change.
+     * Used by serve.ts to forward file_changed events to the frontend.
+     */
+    onMountChanged?: (mountId: string, event: MountChangeEvent) => void;
+    /** Dedup window for file_changed events in milliseconds. Default: 500. */
+    dedupTtlMs?: number;
+}
+/**
+ * Set up all mounts and connectors declared in `skaile.yaml` for an agent session.
+ *
+ * Steps:
+ *   1. Register built-in drivers and adapters
+ *   2. Load mounts + connector declarations from skaile.yaml
+ *   3. Mount all mounts via MountManager
+ *   4. Connect all connectors via ConnectorManager
+ *   5. Optionally start filesystem watchers (serve.ts use case)
+ *   6. Build system prompt sections (mounts paths + connector tools)
+ *   7. Build in-process MCP server (claude-sdk only)
+ *
+ * @param projectDir       Workspace root — where skaile.yaml lives
+ * @param driverType       Active bridge driver ID: "omp" | "claude-sdk"
+ * @param onLog            Optional log callback; silently ignored if omitted
+ * @param watch            Optional watch callbacks; watching is skipped if omitted
+ * @param secretProvider   Optional secret provider chain for connector field
+ *                         resolution and `env:NAME` lookups
+ * @param sessionMeta      Provider/model/sessionId metadata used for logging
+ * @param tokenMediator    Optional callback for `auth: backend` mounts to mint
+ *                         short-lived tokens. Threaded into `MountManager`.
+ * @param preMintedSecrets Optional v3 pre-minted credential provider — when
+ *                         supplied, `auth: backend` mounts find their initial
+ *                         token in-process instead of paying a
+ *                         `request_access_token` round-trip at mount time.
+ * @docLink packages/runner/dev-guide#flow-execution-turn-based-model
+ */
+export declare function buildAgentResources(projectDir: string, driverType: string, _onLog?: (line: string) => void, watch?: ResourceWatchCallbacks, secretProvider?: unknown, sessionMeta?: {
+    provider?: string;
+    model?: string;
+    sessionId?: string;
+}, tokenMediator?: TokenMediator, preMintedSecrets?: PreMintedSecretProvider): Promise<AgentResourcesResult>;
+//# sourceMappingURL=resources.d.ts.map

package/dist/runner/src/resources.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.d.ts","sourceRoot":"","sources":["../../../runner/src/resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAIL,KAAK,oBAAoB,EAMzB,KAAK,gBAAgB,EAGrB,KAAK,uBAAuB,EAG5B,KAAK,iBAAiB,EACtB,KAAK,aAAa,EACnB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAGL,KAAK,mBAAmB,EAEzB,MAAM,yBAAyB,CAAC;AAejC;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,+FAA+F;IAC/F,eAAe,EAAE,GAAG,GAAG,IAAI,CAAC;IAC5B,qFAAqF;IACrF,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,sFAAsF;IACtF,qBAAqB,EAAE,MAAM,CAAC;IAC9B;;;OAGG;IACH,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC;IAChD;;;;;OAKG;IACH,aAAa,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC1C,wEAAwE;IACxE,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B;;;;OAIG;IACH,aAAa,EAAE,MAAM,IAAI,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;OAGG;IACH,YAAY,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IACxE;;;;OAIG;IACH,aAAa,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,oBAAoB,KAAK,IAAI,CAAC;IAC3E;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;IACpE,0EAA0E;IAC1E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAsB,mBAAmB,CACvC,UAAU,EAAE,MAAM,EAClB,UAAU,EAAE,MAAM,EAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC/B,KAAK,CAAC,EAAE,sBAAsB,EAC9B,cAAc,CAAC,EAAE,OAAO,EACxB,WAAW,CAAC,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,EACvE,aAAa,CAAC,EAAE,aAAa,EAC7B,gBAAgB,CAAC,EAAE,uBAAuB,GACzC,OAAO,CAAC,oBAAoB,CAAC,CAmW/B"}

package/dist/runner/src/runner-capabilities.d.ts

@@ -0,0 +1,120 @@
+import type { CredentialMint } from "@skaile/workspaces/types";
+import { type DefinedCapability } from "./define-capability.js";
+/**
+ * Per-session handlers that runner-side capabilities delegate into. The
+ * caller (typically `serve.ts`) wires these to its own state-mutation
+ * helpers. Each method is optional; capabilities whose handler is
+ * undefined return a structured `not_implemented` error.
+ *
+ * @category Runtime
+ * @since 3.0.0
+ */
+export interface RunnerCapabilityHandlers {
+    /**
+     * Add a mount to the live session. Implementations typically delegate
+     * to `VolumeManager.mount()` after staging the `preMintedToken` into
+     * the secrets provider chain.
+     */
+    addMount?: (input: {
+        declaration: unknown;
+        preMintedToken?: {
+            token: string;
+            expiresAt?: string | null;
+        };
+    }) => Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    /**
+     * Add a connector to the live session. Implementations typically
+     * delegate to `ConnectorManager.connect()` after staging the
+     * `preMintedToken`.
+     */
+    addConnector?: (input: {
+        declaration: unknown;
+        preMintedToken?: {
+            token: string;
+            expiresAt?: string | null;
+        };
+    }) => Promise<{
+        ok: true;
+        id: string;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    /**
+     * Remove a mount or connector by id. The id namespace is shared — the
+     * handler resolves whichever manager owns it.
+     */
+    removeResource?: (input: {
+        id: string;
+    }) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    /**
+     * Replace the pre-minted credential on an existing mount or
+     * connector. Used for proactive rotation before TTL expiry, so the
+     * resource can keep running without a reconnect.
+     */
+    updateCredential?: (input: {
+        kind: "mount" | "connector";
+        id: string;
+        mint: CredentialMint;
+    }) => Promise<{
+        ok: true;
+    } | {
+        ok: false;
+        code: string;
+        message: string;
+    }>;
+    /**
+     * Set the in-container LogStore minimum level. When omitted, the
+     * cap falls back to calling `getLogStore()?.setLevel(level)` itself
+     * (the default behaviour matches the legacy `set_log_level` command).
+     */
+    setLogLevel?: (input: {
+        level: string;
+    }) => Promise<{
+        ok: true;
+    }>;
+    /**
+     * Write into the shared state store. Shape matches the legacy
+     * `state_action` v2 command body so existing platform-side senders
+     * can be migrated mechanically.
+     */
+    setState?: (input: {
+        store: string;
+        key: string;
+        value: unknown;
+    }) => Promise<{
+        ok: true;
+    }>;
+    /** Trigger a session lifecycle transition. */
+    lifecycle?: (input: {
+        action: "hibernate" | "close" | "shutdown";
+    }) => Promise<{
+        ok: true;
+    }>;
+}
+/**
+ * Build the seven `runner.*` capabilities. Caller registers each with
+ * `capabilityRegistry.register(cap, "agent")`.
+ *
+ * The returned capabilities are independent — the caller can also
+ * register a subset, e.g. for a stub runner used in tests.
+ *
+ * @category Runtime
+ * @since 3.0.0
+ */
+export declare function buildRunnerCapabilities(handlers: RunnerCapabilityHandlers): DefinedCapability[];
+//# sourceMappingURL=runner-capabilities.d.ts.map

package/dist/runner/src/runner-capabilities.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-capabilities.d.ts","sourceRoot":"","sources":["../../../runner/src/runner-capabilities.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,cAAc,EAAY,MAAM,0BAA0B,CAAC;AAEzE,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAElF;;;;;;;;GAQG;AACH,MAAM,WAAW,wBAAwB;IACvC;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QACjB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;;OAIG;IACH,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE;QACrB,WAAW,EAAE,OAAO,CAAC;QACrB,cAAc,CAAC,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;KAC/D,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAEvF;;;OAGG;IACH,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE;QACvB,EAAE,EAAE,MAAM,CAAC;KACZ,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,CAAC,KAAK,EAAE;QACzB,IAAI,EAAE,OAAO,GAAG,WAAW,CAAC;QAC5B,EAAE,EAAE,MAAM,CAAC;QACX,IAAI,EAAE,cAAc,CAAC;KACtB,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG;QAAE,EAAE,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAE3E;;;;OAIG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAElE;;;;OAIG;IACH,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;IAE5F,8CAA8C;IAC9C,SAAS,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,MAAM,EAAE,WAAW,GAAG,OAAO,GAAG,UAAU,CAAA;KAAE,KAAK,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC;CAC9F;AAwFD;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,wBAAwB,GAAG,iBAAiB,EAAE,CA6I/F"}

package/dist/runner/src/serve-credentials.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Credentials-file helpers used by `serve.ts` for Claude Code subscription
+ * credentials. Extracted so other modules (e.g. AI 401 mediation) can reuse
+ * the atomic rewrite without importing from the much larger `serve.ts`.
+ *
+ * @category Credentials
+ * @since 3.3.0
+ */
+/**
+ * Well-known platform key for the Claude Code OAuth credentials JSON blob
+ * forwarded by `provision_secrets`. The runner writes it to
+ * `<home>/.claude/.credentials.json` instead of the secret provider since
+ * the SDK reads it as a file.
+ *
+ * @docLink packages/runner/dev-guide#environment-variables
+ */
+export declare const CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
+/**
+ * Writes the Claude Code credentials JSON blob to the Claude user config dir
+ * at the current canonical Linux path, `~/.claude/.credentials.json`, with
+ * mode `0600`. Creates the parent directory with mode `0700` if needed.
+ *
+ * Atomic via tmp-file + rename within the same directory.
+ *
+ * Exported for unit tests + the AI 401 mediation helper.
+ *
+ * @docLink packages/runner/dev-guide#environment-variables
+ */
+export declare function writeClaudeCodeCredentialsFile(home: string, json: string): Promise<string>;
+/**
+ * Atomically merge a fresh `accessToken` into the credentials JSON at
+ * `<home>/.claude/.credentials.json`, preserving any other top-level fields
+ * and the nested `claudeAiOauth` shape the platform writes at provision time.
+ *
+ * Read-modify-write under {@link writeClaudeCodeCredentialsFile}'s atomic-
+ * rename semantics. Used by the runner's `onAuthError` callback (in
+ * `serve.ts`) when the bridge driver asks for a credential refresh after
+ * a 401 from the underlying agent.
+ *
+ * @param home - The home directory under which `.claude/.credentials.json`
+ *   lives.
+ * @param accessToken - The fresh access token to persist.
+ * @param expiresAt - Optional ISO timestamp for the rotated token.
+ * @returns The path to the rewritten credentials file.
+ *
+ * Spec: `_devlog/specs/2026-05-07-unified-credential-mediation.md`
+ * § "Runner-side handling on 401" (now bridge-side).
+ */
+export declare function mergeAndRewriteCredentialsFile(home: string, accessToken: string, expiresAt?: string | null): Promise<string>;
+//# sourceMappingURL=serve-credentials.d.ts.map

package/dist/runner/src/serve-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve-credentials.d.ts","sourceRoot":"","sources":["../../../runner/src/serve-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH;;;;;;;GAOG;AACH,eAAO,MAAM,2BAA2B,iCAAiC,CAAC;AAE1E;;;;;;;;;;GAUG;AACH,wBAAsB,8BAA8B,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQhG;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,8BAA8B,CAClD,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,OAAO,CAAC,MAAM,CAAC,CAkBjB"}