@skaile/workspaces 1.8.1 → 1.9.1

package/dist/{chunk-FK2L3MTF.js → chunk-HGLQYLZB.js}

@@ -1,4 +1,4 @@
-import { WorkspacePlugin } from './chunk-35OWUKOD.js';
+import { WorkspacePlugin } from './chunk-VWSR6K7C.js';
 import { WebSocketServerTransport } from './chunk-WQ7DE5UC.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { EventNormalizer } from './chunk-HKX5VSWQ.js';
@@ -6,10 +6,10 @@ import { SUPPORTED_CLOUDS, CLOUD_SECRET_ENV_KEYS } from './chunk-ISQWMBKD.js';
 import { classifyClaudeSdkError } from './chunk-GAH4YRCI.js';
 import { createDriver } from './chunk-TNSCHS4I.js';
 import { deployCatalogEntry, undeployCatalogEntry } from './chunk-LV2HPH3C.js';
-import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-VBRXFLIP.js';
+import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, ConnectorStartupError, buildSdkConnectorTools } from './chunk-JCKGYBWY.js';
 import { loadConnectorDeclarations, SecretProviderChain, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-Y6FV73IH.js';
 import { renderStimulusPrompt, buildOrchestratorPrompt } from './chunk-DEYYRFQU.js';
-import { PROTOCOL_VERSION } from './chunk-PK7Q7MC7.js';
+import { PROTOCOL_VERSION } from './chunk-XJOPAGZX.js';
 import { resolveSettings, resolveApiKey, providerEnvKey } from './chunk-5NZ56R63.js';
 import { resolveRuntimeAssets } from './chunk-7J7LQP6T.js';
 import { resolveSkWorkspaceConfig, resolveAgentDir, cloudConfigFromProfile, stageMaterializedSkills, loadMcpServerDeclarations, COMPACTION_DEFAULTS, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration } from './chunk-ISA7R7PK.js';
@@ -3292,6 +3292,137 @@ function rewriteFileChangedPath(event, cwd, mounts) {
   }
   return event;
 }
+function parseFleetHealthBody(body) {
+  const trimmed = body.trim().toLowerCase();
+  if (trimmed === "healthy") return "healthy";
+  if (trimmed === "degraded") return "degraded";
+  return "error";
+}
+async function dispatchFleetHealthFlag(dir, fileName, manager, log) {
+  if (!manager) return;
+  const connectorId = fileName;
+  if (!connectorId || connectorId.startsWith(".")) return;
+  let verdict;
+  try {
+    verdict = parseFleetHealthBody(await readFile(join(dir, connectorId), "utf8"));
+  } catch {
+    verdict = "error";
+  }
+  try {
+    await manager.reportFleetHealth(connectorId, verdict);
+    log.debug("fleet-health flag dispatched", { connectorId, verdict });
+  } catch (err) {
+    log.warn("fleet-health flag dispatch failed", {
+      connectorId,
+      error: err instanceof Error ? err.message : String(err)
+    });
+  }
+}
+
+// runner/src/refresh-flag-dispatcher.ts
+async function dispatchRefreshToExposedGitMounts(manager, log) {
+  if (!manager) return;
+  let gitConnectors;
+  try {
+    gitConnectors = manager.listGitConnectors();
+  } catch (err) {
+    log.warn("listGitConnectors failed during refresh-flag dispatch", {
+      error: err instanceof Error ? err.message : String(err)
+    });
+    return;
+  }
+  const eligible = gitConnectors.filter(
+    (m) => m.exposeAccessToken === true && m.auth === "backend"
+  );
+  if (eligible.length === 0) {
+    log.debug("refresh-flag fired but no eligible git connectors (Tier-2 backend) found");
+    return;
+  }
+  log.info("refresh-flag fired -- dispatching backend mediation", {
+    connectorIds: eligible.map((m) => m.id)
+  });
+  await Promise.all(
+    eligible.map(async (m) => {
+      try {
+        const entry = manager.get(m.id);
+        if (typeof entry.connector.refreshExposedCredential !== "function") {
+          log.debug("connector lacks refreshExposedCredential -- skipping", {
+            connectorId: m.id
+          });
+          return;
+        }
+        await entry.connector.refreshExposedCredential(m.id, entry.handle);
+      } catch (err) {
+        log.warn("refresh-flag dispatch failed for connector", {
+          connectorId: m.id,
+          error: err instanceof Error ? err.message : String(err)
+        });
+      }
+    })
+  );
+}
+var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
+async function writeClaudeCodeCredentialsFile(home, json) {
+  const claudeDir = join(home, ".claude");
+  await mkdir(claudeDir, { recursive: true, mode: 448 });
+  const finalPath = join(claudeDir, ".credentials.json");
+  const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
+  await writeFile(tmpPath, json, { mode: 384 });
+  await rename(tmpPath, finalPath);
+  return finalPath;
+}
+async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
+  const credPath = join(home, ".claude", ".credentials.json");
+  let merged = {};
+  if (existsSync(credPath)) {
+    try {
+      merged = JSON.parse(readFileSync(credPath, "utf-8"));
+    } catch {
+      merged = {};
+    }
+  }
+  const oauthBlock = merged.claudeAiOauth ?? {};
+  oauthBlock.accessToken = accessToken;
+  if (expiresAt) oauthBlock.expiresAt = expiresAt;
+  merged.claudeAiOauth = oauthBlock;
+  merged.accessToken = accessToken;
+  return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
+}
+function extractClaudeAiOauthExpiresAt(json) {
+  let parsed;
+  try {
+    parsed = JSON.parse(json);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  const oauth = obj.claudeAiOauth;
+  const raw = oauth?.expiresAt ?? obj.expiresAt;
+  if (raw == null) return null;
+  if (typeof raw === "string") {
+    const t = Date.parse(raw);
+    return Number.isFinite(t) ? new Date(t).toISOString() : null;
+  }
+  if (typeof raw === "number" && Number.isFinite(raw)) {
+    return new Date(raw).toISOString();
+  }
+  return null;
+}
+function readCurrentClaudeAccessToken(home) {
+  const credPath = join(home, ".claude", ".credentials.json");
+  if (!existsSync(credPath)) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(readFileSync(credPath, "utf-8"));
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object") return null;
+  const obj = parsed;
+  const raw = obj.claudeAiOauth?.accessToken ?? obj.accessToken;
+  return typeof raw === "string" && raw.length > 0 ? raw : null;
+}
 
 // runner/src/lifecycle-handler.ts
 function buildLifecycleHandler(deps) {
@@ -3534,75 +3665,6 @@ function buildMcpRuntimeHandlers(deps) {
     }
   };
 }
-function parseFleetHealthBody(body) {
-  const trimmed = body.trim().toLowerCase();
-  if (trimmed === "healthy") return "healthy";
-  if (trimmed === "degraded") return "degraded";
-  return "error";
-}
-async function dispatchFleetHealthFlag(dir, fileName, manager, log) {
-  if (!manager) return;
-  const connectorId = fileName;
-  if (!connectorId || connectorId.startsWith(".")) return;
-  let verdict;
-  try {
-    verdict = parseFleetHealthBody(await readFile(join(dir, connectorId), "utf8"));
-  } catch {
-    verdict = "error";
-  }
-  try {
-    await manager.reportFleetHealth(connectorId, verdict);
-    log.debug("fleet-health flag dispatched", { connectorId, verdict });
-  } catch (err) {
-    log.warn("fleet-health flag dispatch failed", {
-      connectorId,
-      error: err instanceof Error ? err.message : String(err)
-    });
-  }
-}
-
-// runner/src/refresh-flag-dispatcher.ts
-async function dispatchRefreshToExposedGitMounts(manager, log) {
-  if (!manager) return;
-  let gitConnectors;
-  try {
-    gitConnectors = manager.listGitConnectors();
-  } catch (err) {
-    log.warn("listGitConnectors failed during refresh-flag dispatch", {
-      error: err instanceof Error ? err.message : String(err)
-    });
-    return;
-  }
-  const eligible = gitConnectors.filter(
-    (m) => m.exposeAccessToken === true && m.auth === "backend"
-  );
-  if (eligible.length === 0) {
-    log.debug("refresh-flag fired but no eligible git connectors (Tier-2 backend) found");
-    return;
-  }
-  log.info("refresh-flag fired -- dispatching backend mediation", {
-    connectorIds: eligible.map((m) => m.id)
-  });
-  await Promise.all(
-    eligible.map(async (m) => {
-      try {
-        const entry = manager.get(m.id);
-        if (typeof entry.connector.refreshExposedCredential !== "function") {
-          log.debug("connector lacks refreshExposedCredential -- skipping", {
-            connectorId: m.id
-          });
-          return;
-        }
-        await entry.connector.refreshExposedCredential(m.id, entry.handle);
-      } catch (err) {
-        log.warn("refresh-flag dispatch failed for connector", {
-          connectorId: m.id,
-          error: err instanceof Error ? err.message : String(err)
-        });
-      }
-    })
-  );
-}
 var RUNNER_CAP_ORIGIN = { kind: "framework" };
 function notImplemented(name) {
   return {
@@ -3823,67 +3885,68 @@ function buildRunnerCapabilities(handlers) {
     })
   ];
 }
-var CLAUDE_CODE_CREDENTIALS_KEY = "CLAUDE_CODE_CREDENTIALS_JSON";
-async function writeClaudeCodeCredentialsFile(home, json) {
-  const claudeDir = join(home, ".claude");
-  await mkdir(claudeDir, { recursive: true, mode: 448 });
-  const finalPath = join(claudeDir, ".credentials.json");
-  const tmpPath = `${finalPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2)}`;
-  await writeFile(tmpPath, json, { mode: 384 });
-  await rename(tmpPath, finalPath);
-  return finalPath;
-}
-async function mergeAndRewriteCredentialsFile(home, accessToken, expiresAt) {
-  const credPath = join(home, ".claude", ".credentials.json");
-  let merged = {};
-  if (existsSync(credPath)) {
-    try {
-      merged = JSON.parse(readFileSync(credPath, "utf-8"));
-    } catch {
-      merged = {};
-    }
-  }
-  const oauthBlock = merged.claudeAiOauth ?? {};
-  oauthBlock.accessToken = accessToken;
-  if (expiresAt) oauthBlock.expiresAt = expiresAt;
-  merged.claudeAiOauth = oauthBlock;
-  merged.accessToken = accessToken;
-  return writeClaudeCodeCredentialsFile(home, JSON.stringify(merged));
-}
-function extractClaudeAiOauthExpiresAt(json) {
-  let parsed;
-  try {
-    parsed = JSON.parse(json);
-  } catch {
-    return null;
-  }
-  if (!parsed || typeof parsed !== "object") return null;
-  const obj = parsed;
-  const oauth = obj.claudeAiOauth;
-  const raw = oauth?.expiresAt ?? obj.expiresAt;
-  if (raw == null) return null;
-  if (typeof raw === "string") {
-    const t = Date.parse(raw);
-    return Number.isFinite(t) ? new Date(t).toISOString() : null;
-  }
-  if (typeof raw === "number" && Number.isFinite(raw)) {
-    return new Date(raw).toISOString();
-  }
-  return null;
-}
-function readCurrentClaudeAccessToken(home) {
-  const credPath = join(home, ".claude", ".credentials.json");
-  if (!existsSync(credPath)) return null;
-  let parsed;
-  try {
-    parsed = JSON.parse(readFileSync(credPath, "utf-8"));
-  } catch {
-    return null;
+
+// runner/src/session-capability-wiring.ts
+function wireSessionCapabilities(deps) {
+  const {
+    capabilityRegistry,
+    remoteCapabilityInvoker,
+    getResourceManager,
+    getPreMintedSecrets,
+    emitResourcesAvailable,
+    driverPicksUpToolsLive,
+    getOrCreateMcpManager,
+    getCompactionOrchestrator,
+    getProjectDir,
+    attachSkillInstance,
+    log
+  } = deps;
+  capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
+  const { attachConnectorInstance, ...resourceCaps } = buildSessionResourceHandlers({
+    getResourceManager,
+    getPreMintedSecrets,
+    emitResourcesAvailable,
+    log,
+    getProjectDir
+  });
+  const mcpHandlers = buildMcpRuntimeHandlers({
+    getOrCreateMcpManager,
+    getPreMintedSecrets: () => getPreMintedSecrets() ?? null,
+    driverPicksUpToolsLive,
+    emitResourcesAvailable,
+    log,
+    getProjectDir
+  });
+  const runnerCaps = buildRunnerCapabilities({
+    ...resourceCaps,
+    ...mcpHandlers,
+    // attach_instance routes by kind: skills stage-then-fast-restart,
+    // connectors materialize-then-connect; everything else stays on the
+    // MCP attach path.
+    attachInstance: async (input) => {
+      if (input.kind === "skill") {
+        return attachSkillInstance(input.name);
+      }
+      if (input.kind === "connector") {
+        return attachConnectorInstance(input.name, input.preMintedToken);
+      }
+      return mcpHandlers.attachInstance ? mcpHandlers.attachInstance(input) : {
+        ok: false,
+        code: "not_implemented",
+        message: "attach_instance handler not configured"
+      };
+    },
+    // setLogLevel left undefined (the cap self-falls-back to getLogStore);
+    // setState remains a stub (not resource hot-plug).
+    lifecycle: buildLifecycleHandler({
+      getCompactionOrchestrator,
+      getResourceManager,
+      log
+    })
+  });
+  for (const cap of runnerCaps) {
+    capabilityRegistry.register(cap, "agent");
   }
-  if (!parsed || typeof parsed !== "object") return null;
-  const obj = parsed;
-  const raw = obj.claudeAiOauth?.accessToken ?? obj.accessToken;
-  return typeof raw === "string" && raw.length > 0 ? raw : null;
 }
 
 // runner/src/session-stimulus.ts
@@ -4032,6 +4095,11 @@ function splitConnectorsForWire(manager) {
   }
   return { mounts, connectors };
 }
+function pickRepointedManager(next, current, disposed) {
+  if (next !== null) return next;
+  if (current !== null && current === disposed) return null;
+  return current;
+}
 function buildResourcesAvailablePayload(manager, mcpManager, driverLive, bakedServerIds) {
   const { mounts, connectors } = splitConnectorsForWire(manager);
   const mcp_servers = (mcpManager?.listServers() ?? []).map((s) => ({
@@ -4152,6 +4220,50 @@ function buildConnectorTokenMediator(deps) {
     }
   };
 }
+function planFlowMutate(cmd, ctx) {
+  const isBareFlowId = cmd.id === "flow";
+  const flowIntercept = ctx.isExistingFlow || isBareFlowId;
+  const payload = cmd.payload ?? {};
+  if (cmd.op === "start" && flowIntercept) {
+    const flowDef = payload.flow;
+    const seed = payload.seed;
+    if (!flowDef?.id || !seed?.runId || !seed?.startedBy) {
+      return {
+        kind: "reject",
+        reason: "flow.start payload missing required fields (need payload.flow.id, payload.seed.runId, payload.seed.startedBy)"
+      };
+    }
+    if (ctx.hasActiveFlow) {
+      return {
+        kind: "reject",
+        reason: "flow.start ignored: a flow is already active (one active flow per session; cancel it first)"
+      };
+    }
+    return { kind: "create-start", flowDef, seed };
+  }
+  if (cmd.op === "hydrate" && flowIntercept && !ctx.hasActiveFlow) {
+    const state = payload.state;
+    if (!state || typeof state !== "object" || typeof state.runId !== "string") {
+      return {
+        kind: "reject",
+        reason: "flow.hydrate payload missing required field payload.state (FlowExecution snapshot)"
+      };
+    }
+    const flowDef = payload.flow;
+    if (!flowDef?.id) {
+      return {
+        kind: "reject",
+        reason: "flow.hydrate cannot bootstrap a cold container without payload.flow (FlowDefinition required when no flow is active)"
+      };
+    }
+    return { kind: "create-hydrate", flowDef, execution: state };
+  }
+  let dispatchId = cmd.id;
+  if (!ctx.targetExists && isBareFlowId && ctx.onlyActiveConnectorId) {
+    dispatchId = ctx.onlyActiveConnectorId;
+  }
+  return { kind: "dispatch", dispatchId };
+}
 async function startAgentServer(opts) {
   const port = opts.port ?? 8080;
   const sessionId = opts.sessionId ?? process.env.SKAILE_SESSION_ID ?? "session-unknown";
@@ -4487,6 +4599,15 @@ async function startAgentServer(opts) {
     captureBakedMcpServers();
   }
   let resourceManager = secretsMode === "env" ? agentSession.resourceManager : null;
+  const driverPicksUpToolsLive = () => agentSession?.driverType !== "claude-sdk";
+  const emitResourcesAvailable = () => sendEvent(
+    buildResourcesAvailablePayload(
+      resourceManager,
+      agentSession?.getExternalMcpManager(),
+      driverPicksUpToolsLive(),
+      bakedMcpServerIds
+    )
+  );
   if (secretsMode === "env") {
     if (!agentSession.provider) {
       log(
@@ -4767,15 +4888,7 @@ async function startAgentServer(opts) {
             log(
               `[serve] restarting driver to register flow connector tools (resume=${prevSessionId ?? "none"})`
             );
-            await agentSession.dispose();
-            agentSession = await createAgentSession({
-              ...sessionConfig,
-              resumeSessionId: prevSessionId
-            });
-            emitSystemPromptComposed(agentSession, sendEvent);
-            swapDriver();
-            rebuildCompactionOrchestrator();
-            captureBakedMcpServers();
+            await recreateAgentSession({ resumeSessionId: prevSessionId });
           }
           driver.config.mcpServers = { "skaile-connectors": server };
           log(`[serve] rebuilt MCP connector tools for flow ${connectorId}`);
@@ -4959,6 +5072,7 @@ async function startAgentServer(opts) {
       cloudSecrets,
       fallbackConnectorDeclarations
     );
+    let needsWireFallbackRecreate = false;
     if (!agentSession) {
       agentSession = await createAgentSession(sessionConfig);
       emitSystemPromptComposed(agentSession, sendEvent);
@@ -4966,88 +5080,61 @@ async function startAgentServer(opts) {
       driver = agentSession.driver;
       rebuildCompactionOrchestrator();
       registerSessionComposition(agentSession);
-      const driverPicksUpToolsLive = () => agentSession?.driverType !== "claude-sdk";
-      const emitResourcesAvailable = () => sendEvent(
-        buildResourcesAvailablePayload(
-          resourceManager,
-          agentSession?.getExternalMcpManager(),
-          driverPicksUpToolsLive(),
-          bakedMcpServerIds
-        )
-      );
       captureBakedMcpServers();
       emitResourcesAvailable();
       agentSession.startWatching();
-      capabilityRegistry.setRemoteInvoker(remoteCapabilityInvoker);
-      const { attachConnectorInstance, ...resourceCaps } = buildSessionResourceHandlers({
-        getResourceManager: () => resourceManager,
-        getPreMintedSecrets: () => preMintedSecrets,
-        emitResourcesAvailable,
-        log,
-        getProjectDir: () => opts.projectDir
-      });
-      const mcpHandlers = buildMcpRuntimeHandlers({
-        getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
-        getPreMintedSecrets: () => preMintedSecrets ?? null,
-        driverPicksUpToolsLive,
-        emitResourcesAvailable,
-        log,
-        getProjectDir: () => opts.projectDir
-      });
-      const runnerCaps = buildRunnerCapabilities({
-        ...resourceCaps,
-        ...mcpHandlers,
-        // attach_instance routes by kind: skills stage-then-fast-restart,
-        // connectors materialize-then-connect; everything else stays on the
-        // MCP attach path.
-        attachInstance: async (input) => {
-          if (input.kind === "skill") {
-            return attachSkillInstance(input.name);
-          }
-          if (input.kind === "connector") {
-            return attachConnectorInstance(input.name, input.preMintedToken);
-          }
-          return mcpHandlers.attachInstance ? mcpHandlers.attachInstance(input) : {
-            ok: false,
-            code: "not_implemented",
-            message: "attach_instance handler not configured"
-          };
-        },
-        // setLogLevel left undefined (the cap self-falls-back to getLogStore);
-        // setState remains a stub (not resource hot-plug).
-        lifecycle: buildLifecycleHandler({
-          getCompactionOrchestrator: () => compactionOrchestrator,
-          getResourceManager: () => resourceManager,
-          log
-        })
-      });
-      for (const cap of runnerCaps) {
-        capabilityRegistry.register(cap, "agent");
-      }
       log("[serve] session built from session_init envelope");
     } else if ((fallbackConnectorDeclarations?.length ?? 0) > 0 && !agentSession.resourceManager) {
       log(
         `[serve] session_init: recreating eagerly-built session to apply ${fallbackConnectorDeclarations.length} wire connector declaration(s) (no disk declarations)`
       );
-      return { needsWireFallbackRecreate: true };
+      needsWireFallbackRecreate = true;
     }
-    return { needsWireFallbackRecreate: false };
+    wireSessionCapabilities({
+      capabilityRegistry,
+      remoteCapabilityInvoker,
+      getResourceManager: () => resourceManager,
+      getPreMintedSecrets: () => preMintedSecrets,
+      emitResourcesAvailable,
+      driverPicksUpToolsLive,
+      getOrCreateMcpManager: () => agentSession?.getOrCreateExternalMcpManager() ?? null,
+      getCompactionOrchestrator: () => compactionOrchestrator,
+      getProjectDir: () => opts.projectDir,
+      attachSkillInstance,
+      log
+    });
+    return { needsWireFallbackRecreate };
   }
-  async function recreateSessionForInit(pendingResumeSessionId) {
+  async function recreateAgentSession(overrides) {
+    const disposedManager = agentSession.resourceManager;
     await agentSession.dispose();
-    agentSession = await createAgentSession({
-      ...sessionConfig,
-      ...aiProviderConfigId ? { aiProviderConfigId } : {},
-      ...pendingResumeSessionId ? { resumeSessionId: pendingResumeSessionId } : {}
-    });
+    agentSession = await createAgentSession({ ...sessionConfig, ...overrides });
     emitSystemPromptComposed(agentSession, sendEvent);
     swapDriver();
     rebuildCompactionOrchestrator();
     captureBakedMcpServers();
-    resourceManager = agentSession.resourceManager;
+    const repointed = pickRepointedManager(
+      agentSession.resourceManager,
+      resourceManager,
+      disposedManager
+    );
+    if (resourceManager !== null && resourceManager !== disposedManager && repointed !== resourceManager) {
+      log(
+        "[serve] WARNING: recreate displaced a lazily-created sharedState resource manager \u2014 registered shared-state stores were dropped and must be re-registered"
+      );
+    }
+    resourceManager = repointed;
     agentSession.startWatching();
     emitAvailability();
   }
+  async function recreateSessionForInit(pendingResumeSessionId) {
+    await recreateAgentSession({
+      ...aiProviderConfigId ? { aiProviderConfigId } : {},
+      // Conditional, unlike the skill path's unconditional pass: here an absent
+      // hint must fall through to sessionConfig's, which the platform may have set.
+      ...pendingResumeSessionId ? { resumeSessionId: pendingResumeSessionId } : {}
+    });
+  }
   async function applyInitSharedState(sharedState) {
     if (!ensureResourceManagerForSharedState()) {
       sendEvent({ type: "configured" });
@@ -5226,15 +5313,7 @@ async function startAgentServer(opts) {
     }
     const prevSessionId = driver.runtimeSessionId;
     log(`[serve] restarting driver to pick up skill changes (resume=${prevSessionId ?? "none"})`);
-    await agentSession.dispose();
-    agentSession = await createAgentSession({
-      ...sessionConfig,
-      resumeSessionId: prevSessionId
-    });
-    emitSystemPromptComposed(agentSession, sendEvent);
-    swapDriver();
-    rebuildCompactionOrchestrator();
-    captureBakedMcpServers();
+    await recreateAgentSession({ resumeSessionId: prevSessionId });
     sendEvent({
       type: "skills_changed",
       skills: catalogActions.map((a) => ({
@@ -5473,36 +5552,48 @@ async function startAgentServer(opts) {
       if (!resourceManager) throw new Error("connector_mutate before resources ready");
       const targetEntry = resourceManager.has?.(cmd.id) ? resourceManager.get(cmd.id) : null;
       const isExistingFlow = targetEntry?.connector?.name === "flow";
-      const isBareFlowId = cmd.id === "flow";
-      if (cmd.op === "start") {
-        if (isExistingFlow || isBareFlowId) {
-          const payload = cmd.payload ?? {};
-          const flowDef = payload.flow;
-          const seed = payload.seed;
-          if (flowDef?.id && seed?.runId && seed?.startedBy) {
-            if (activeFlows.size > 0) {
-              serverLog.warn("connector_mutate flow.start: another flow already active", {
-                activeRunIds: Array.from(activeFlows.keys())
-              });
-              return;
-            }
-            const entry = await createActiveFlow(flowDef, { seed });
-            serverLog.info("connector_mutate flow.start", {
-              runId: entry.runId,
-              flowId: flowDef.id
-            });
-            return;
-          }
+      const plan = planFlowMutate(cmd, {
+        targetExists: !!targetEntry,
+        isExistingFlow,
+        hasActiveFlow: activeFlows.size > 0,
+        onlyActiveConnectorId: getOnlyActiveFlow()?.connectorId ?? null
+      });
+      switch (plan.kind) {
+        case "create-start": {
+          const entry = await createActiveFlow(plan.flowDef, { seed: plan.seed });
+          serverLog.info("connector_mutate flow.start", {
+            runId: entry.runId,
+            flowId: plan.flowDef.id
+          });
+          return;
         }
-      }
-      let dispatchId = cmd.id;
-      if (!targetEntry && isBareFlowId) {
-        const onlyActive = getOnlyActiveFlow();
-        if (onlyActive) {
-          dispatchId = onlyActive.connectorId;
+        case "create-hydrate": {
+          const entry = await createActiveFlow(plan.flowDef, { execution: plan.execution });
+          serverLog.info("connector_mutate flow.hydrate (bootstrap)", {
+            runId: entry.runId,
+            flowId: plan.flowDef.id
+          });
+          return;
+        }
+        case "reject": {
+          serverLog.warn("connector_mutate rejected", {
+            id: cmd.id,
+            op: cmd.op,
+            reason: plan.reason
+          });
+          sendEvent({
+            type: "error",
+            message: `connector_mutate rejected (id=${cmd.id}, op=${cmd.op}): ${plan.reason}`,
+            fatal: false,
+            category: "validation"
+          });
+          return;
+        }
+        case "dispatch": {
+          await resourceManager.executeOp(plan.dispatchId, cmd.op, cmd.payload ?? {});
+          return;
         }
       }
-      await resourceManager.executeOp(dispatchId, cmd.op, cmd.payload ?? {});
     } catch (err) {
       serverLog.warn("connector_mutate failed", {
         id: cmd.id,
@@ -5599,7 +5690,7 @@ async function startAgentServer(opts) {
   }
   async function handleDebug(cmd) {
     if (!await awaitSessionReadyOrFail()) return;
-    log(`[serve] debug query=${cmd.query}`);
+    serverLog.debug(`[serve] debug query=${cmd.query}`);
     let result;
     try {
       result = await computeDebugResult(cmd);
@@ -5948,6 +6039,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-FK2L3MTF.js.map
-//# sourceMappingURL=chunk-FK2L3MTF.js.map
+export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, MarkdownStreamer, PreInitRingSink, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, connectorRefreshKind, createAgentSession, createSessionStimulusBus, defineCapability, deleteSession, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureGitConfigInclude, extractClaudeAiOauthExpiresAt, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, installPreInitRingSink, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadSession, loadSessionById, mcpAuthSecretKey, newSession, pickRepointedManager, planFlowMutate, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveMixin, runAgentChat, saveSession, setCurrentSession, startAgentServer, touchSession, writeClaudeCodeCredentialsFile };
+//# sourceMappingURL=chunk-HGLQYLZB.js.map
+//# sourceMappingURL=chunk-HGLQYLZB.js.map