@skaile/workspaces 5.15.1 → 5.16.0

package/dist/{chunk-JJLH4TX4.js → chunk-CQFVKN6S.js}

@@ -1,41 +1,42 @@
-import { WorkspacePlugin } from './chunk-U7YMGW7M.js';
-import { buildWorkspaceToolDefs } from './chunk-NHH3MRSC.js';
-import { findAiAssetsRoot } from './chunk-SZPE55SB.js';
-import { startModelEndpoint } from './chunk-RTYDYSUV.js';
-import { WebSocketServerTransport } from './chunk-NOF73BUH.js';
+import { WorkspacePlugin } from './chunk-DQOAPR4M.js';
+import { buildWorkspaceToolDefs } from './chunk-A7AZ3RL5.js';
+import { findAiAssetsRoot } from './chunk-PGZDSDOB.js';
+import { startModelEndpoint } from './chunk-72KZJE3G.js';
+import { WebSocketServerTransport } from './chunk-L6UMSKDF.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-PHRNUTSG.js';
-import { resolveFlowPath } from './chunk-7Y7UYNGL.js';
-import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-LEOXPIC6.js';
-import { ConnectFailureCarryOver, registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-MUOSKYI2.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-MKTJZLQM.js';
-import { EventNormalizer } from './chunk-PQF5QHVS.js';
-import { probeResumeTranscript, transcriptStoreForRuntime } from './chunk-TCWECSEB.js';
+import { resolveFlowPath } from './chunk-E634MBP6.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-AP24HESN.js';
+import { ConnectFailureCarryOver, registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-OJHPG6HK.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-FSSRBWYL.js';
+import { EventNormalizer } from './chunk-TKI7YDWE.js';
+import { approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-NSNM2ZXF.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
 import { dispatchCapability } from './chunk-PW3TYWOI.js';
 import { classifyClaudeSdkError } from './chunk-B4X2N7JQ.js';
 import { agentExecRequested } from './chunk-YROR332M.js';
-import { toAgentEffort, toMergedRegistry } from './chunk-4AKR4XPQ.js';
-import { unresolvedProviderCredentials, driverCapabilities, createDriver, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-GQ5OYFVD.js';
-import { loadFlow } from './chunk-N36S36OZ.js';
+import { toAgentEffort, toMergedRegistry } from './chunk-HG52NGAV.js';
+import { unresolvedProviderCredentials, driverCapabilities, createDriver, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-6Q7NKTDG.js';
+import { loadFlow } from './chunk-SPV2CXJ3.js';
 import { parseFlowDefinition } from './chunk-X3RMRJNR.js';
 import { renderStimulusPrompt } from './chunk-M3WPBTGJ.js';
 import { TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-D5WTOVLG.js';
-import { knowledgeKindProvider, scanLibraryRoot } from './chunk-OOQ5Q75W.js';
-import { createDefaultKindRegistry } from './chunk-NKDSU4Q7.js';
-import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema } from './chunk-MGM5EJQQ.js';
-import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-4QINFQ27.js';
-import { resolveRuntimeAssets } from './chunk-X7DIT65W.js';
+import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-D3PU3C6F.js';
+import { createDefaultKindRegistry } from './chunk-ES6ARJPQ.js';
+import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-YK3XLEQJ.js';
+import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-PIC23DDE.js';
+import { resolveRuntimeAssets } from './chunk-5RDZ5JHH.js';
 import { DEFAULT_DRIVER_ID, resolveDriverPaths } from './chunk-5BEFNLOR.js';
-import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, resolveAgentDefinitionDir, AgentRefResolutionError, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-J76LDUDS.js';
+import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-ZVZTCDUN.js';
 import { globalSkaileDir } from './chunk-L5VSIPQD.js';
 import { driverTargetForDriver, SUPPORTED_DRIVER_TARGETS, DRIVER_TARGETS } from './chunk-IG5LZ3WU.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-SP5NGNBV.js';
-import { parseAssetRef } from './chunk-VY6NTFE7.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-YW2BNDSE.js';
+import { parseAssetRef } from './chunk-FT4ZHLYR.js';
 import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention } from './chunk-DKXNKFKP.js';
 import { pickRegistryEntries, registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-MJHSLODD.js';
 import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError, redactCredentials } from './chunk-BOFL7GIF.js';
 import { __require } from './chunk-NSBPE2FW.js';
+import { createInterface } from 'readline';
 import pc from 'picocolors';
 import path3, { resolve, basename, join, dirname, relative, sep, isAbsolute } from 'path';
 import { Marked } from 'marked';
@@ -43,9 +44,9 @@ import { markedTerminal } from 'marked-terminal';
 import { createHash, randomUUID, randomBytes, timingSafeEqual } from 'crypto';
 import * as z5 from 'zod';
 import { z } from 'zod';
-import fs8, { readFile, readdir, lstat, stat, rm, unlink, mkdir, writeFile, realpath, rename, open, readlink, mkdtemp } from 'fs/promises';
-import { parse } from 'yaml';
 import { constants, unlinkSync, readFileSync, readdirSync, statSync, existsSync, lstatSync, realpathSync, mkdirSync, writeFileSync, watch, chmodSync, accessSync, rmSync } from 'fs';
+import fs8, { readFile, readdir, lstat, realpath, rm, unlink, stat, mkdir, writeFile, readlink, rename, open, mkdtemp } from 'fs/promises';
+import { parse } from 'yaml';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
@@ -368,8 +369,8 @@ async function openLocalIndexIfAvailable(log) {
     return STUB_LIBRARY;
   }
   try {
-    const { LocalIndex } = await import('./library/index.js');
-    return new LocalIndex();
+    const { LocalIndex: LocalIndex2 } = await import('./library/index.js');
+    return new LocalIndex2();
   } catch (err) {
     log?.debug(`Could not open LocalIndex at ${indexPath}: ${err.message}`);
     return STUB_LIBRARY;
@@ -530,6 +531,10 @@ var CatalogScanner = class {
   registry;
   scans = /* @__PURE__ */ new Map();
   roots;
+  /** Every discovered asset of `kind` named `name` under one root (any root, declared or not). */
+  findIn(root, kind, name) {
+    return this.scan(root).filter((hit) => hit.asset.kind === kind && hit.asset.name === name);
+  }
   /** Every discovered asset of `kind` named `name`, across all roots. */
   find(kind, name) {
     const out = [];
@@ -590,6 +595,26 @@ function defaultCatalogRoots(projectDir) {
   }
   return [...roots];
 }
+function normalizeRemote(url) {
+  return url.trim().replace(/^git@([^:]+):/, "https://$1/").replace(/^[a-z]+:\/\//i, "").replace(/\/+$/, "").replace(/\.git$/i, "").replace(/\/+$/, "").toLowerCase();
+}
+async function registeredLibraryRoots(origin) {
+  let index;
+  try {
+    index = new LocalIndex();
+    const libraries = await index.listSources();
+    const byName = libraries.filter((l) => l.name === origin.name);
+    const byUrl = byName.length === 0 && origin.url ? libraries.filter((l) => {
+      const url = l.backendConfig.url;
+      return typeof url === "string" && normalizeRemote(url) === normalizeRemote(origin.url ?? "");
+    }) : [];
+    return [...byName, ...byUrl].map((l) => l.path).filter((dir) => existsSync(dir));
+  } catch {
+    return [];
+  } finally {
+    index?.close();
+  }
+}
 function createCompositionContentSource(opts) {
   const registry = opts.registry ?? createDefaultKindRegistry([knowledgeKindProvider]);
   const scanner = new CatalogScanner(opts.projectDir, registry, opts.catalogRoots);
@@ -738,9 +763,14 @@ var DefaultCompositionContentSource = class _DefaultCompositionContentSource {
         storeDir
       );
     }
-    const hit = this.scanner.find(kind, pin.name).find(
-      (h) => h.asset.version === pin.version && barePublisher(h.asset.publisher) === pin.publisher
-    );
+    const holdsPin = (h) => h.asset.version === pin.version && barePublisher(h.asset.publisher) === pin.publisher;
+    let hit = this.scanner.find(kind, pin.name).find(holdsPin);
+    if (!hit && entry.library) {
+      for (const root of await registeredLibraryRoots(entry.library)) {
+        hit = this.scanner.findIn(root, kind, pin.name).find(holdsPin);
+        if (hit) break;
+      }
+    }
     if (!hit) {
       throw new CompositionError(
         "composition_asset_missing",
@@ -1366,6 +1396,39 @@ function instanceForSession(config, instanceId, agentDir) {
   const id = instanceId ?? DEFAULT_AGENT_INSTANCE_ID;
   return { instanceId: id, instance: effectiveAgentInstances(config)[id] ?? { ref: agentDir } };
 }
+function instanceSessionOverrides(config, instanceId) {
+  const instance = effectiveAgentInstances(config)[instanceId];
+  const model = instance?.model?.preferred;
+  const maxTurns = instance?.budget?.max_turns ?? instance?.permissions?.max_turns;
+  return {
+    ...model ? { model } : {},
+    ...maxTurns !== void 0 ? { maxTurns } : {}
+  };
+}
+function resolveInstanceAgentDir(projectDir, config, instanceId) {
+  const instances = effectiveAgentInstances(config);
+  const instance = instances[instanceId];
+  if (!instance) {
+    const ids = Object.keys(instances);
+    throw new Error(
+      `No agent instance "${instanceId}" in skaile.yaml. ` + (ids.length > 0 ? `Declared: ${ids.join(", ")}.` : "It declares none: add one under `agents:` (or an `agent:` block for `default`).")
+    );
+  }
+  let dir;
+  try {
+    dir = resolveAgentDefinitionDir(projectDir, instance.ref);
+  } catch (error) {
+    if (!(error instanceof AgentRefResolutionError)) throw error;
+    throw new Error(`Agent instance "${instanceId}": ${error.message}`);
+  }
+  if (dir && path3.basename(dir) === "agent.yaml") dir = path3.dirname(dir);
+  if (!dir || !existsSync(path3.join(dir, "agent.yaml"))) {
+    throw new Error(
+      `Agent instance "${instanceId}": "${instance.ref}" does not resolve to an agent directory with agent.yaml${dir ? ` (looked in ${dir})` : ""}`
+    );
+  }
+  return dir;
+}
 async function resolveAgentInstance(opts) {
   const { instanceId, instance, asset, projectDir, host, sessionId, resumeSessionId, log } = opts;
   const { manifest, dir: agentDir } = asset;
@@ -3706,6 +3769,8 @@ function nestedRoleSessionConfig(parent) {
     getExtraMcpDeclarations: _extra,
     agentDir: _agentDir,
     instanceId: _instance,
+    permissionMode: _permissionMode,
+    unattended: _unattended,
     ...rest
   } = parent;
   return rest;
@@ -3724,6 +3789,10 @@ function nestedLauncher(deps) {
       instanceId: target.id,
       agentDir: target.agentDir,
       sessionId: ctx.run.sessionId,
+      // The role's own `permission_mode`; nobody answers a question of a nested session, so a
+      // call that needs approval is refused there.
+      ...target.permissionMode ? { permissionMode: target.permissionMode } : {},
+      unattended: true,
       ...Number.isFinite(maxTurns) ? { maxTurns } : {},
       // `model` is what the primary session hands the driver (`--model`); a registry
       // session resolves `modelRef` first. Both are set, so the role runs on its own
@@ -6121,6 +6190,7 @@ async function startRunnerModelEndpoint(options) {
     token,
     host,
     port: options.config.port ?? 0,
+    projectDir: options.projectDir,
     log: options.log
   });
   if (!isLoopbackHost(host)) {
@@ -6320,6 +6390,7 @@ async function createAgentSession(config) {
   if (config.effort === void 0 && wsEffort !== void 0 && effort === void 0) {
     sessionLog.warn("ignoring unknown effort", { effort: wsEffort, source: "skaile.yaml" });
   }
+  const permissionMode = config.permissionMode ?? effectiveAgentInstances(wsConfig)[config.instanceId ?? DEFAULT_AGENT_INSTANCE_ID]?.permissions?.permission_mode ?? wsConfig.agent?.permissions?.permission_mode;
   const maxTurns = maxTurnsOverride ?? manifest?.runtime?.max_turns;
   let driver;
   try {
@@ -6341,7 +6412,8 @@ async function createAgentSession(config) {
       agentDir,
       registry,
       modelRef,
-      credentialEnv
+      credentialEnv,
+      permissionMode
     });
   } catch (error) {
     try {
@@ -6539,6 +6611,11 @@ function logAssembledSystemPrompt(systemPrompt, log) {
     log.debug("system prompt content", { content: systemPrompt ?? "(empty)" });
   }
 }
+function manifestModelForDriver(manifest, driverType) {
+  const preferred = manifest?.model?.preferred;
+  if (!preferred || driverType === "claude-sdk") return preferred;
+  return ANTHROPIC_MODEL_ALIASES.includes(preferred) ? void 0 : preferred;
+}
 function createSessionDriver(args) {
   const {
     config,
@@ -6556,7 +6633,8 @@ function createSessionDriver(args) {
     agentDir,
     registry,
     modelRef,
-    credentialEnv
+    credentialEnv,
+    permissionMode
   } = args;
   return createDriver(driverType, {
     ...config.managedCodex ? {
@@ -6577,9 +6655,12 @@ function createSessionDriver(args) {
           }
         }
       }
-    } : {},
+    } : (
+      // Standalone codex: `interactive` asks codex for its own approval instead of `never`.
+      permissionMode === "interactive" && driverType === "codex" ? { driverOptions: { codex: { approvalPolicy: "on-request" } } } : {}
+    ),
     cwd: agentCwd,
-    model: model ?? manifest?.model?.preferred,
+    model: model ?? manifestModelForDriver(manifest, driverType),
     maxTurns,
     systemPrompt,
     tools: manifest?.tools,
@@ -6592,6 +6673,8 @@ function createSessionDriver(args) {
     ...Object.keys(credentialEnv).length > 0 ? { env: credentialEnv } : {},
     ...thinking ? { thinking } : {},
     ...effort ? { effort } : {},
+    ...permissionMode ? { permissionMode } : {},
+    ...config.unattended ? { unattended: true } : {},
     ...sessionId ? { sessionId } : {},
     ...resumeSessionId ? { resumeSessionId } : {},
     ...mcpServers ? { mcpServers } : {},
@@ -6632,7 +6715,8 @@ async function runAgentChat(opts) {
     subkind: "session",
     instance: sessionId
   });
-  const baseConfig = sessionConfigFor(opts);
+  const attended = opts.unattended === void 0 ? process.stdin.isTTY === true : !opts.unattended;
+  const baseConfig = sessionConfigFor({ ...opts, unattended: !attended });
   const surface = await createStandaloneAgentSurface({
     config: baseConfig,
     // Only `subagent` events come this way; the bridge's event union is a different type.
@@ -6673,6 +6757,12 @@ async function runAgentChat(opts) {
   driver.on("agent-event", (event) => {
     opts.onEvent?.(event);
     printUnstreamed(event);
+    const card = attended ? approvalCardOf(event) : void 0;
+    if (card) {
+      void askApprovalOnTerminal(card.question, card.details).then((approved) => {
+        driver.answerQuestion(approved ? APPROVE_ONCE : DENY, card.question, card.requestId);
+      });
+    }
     if (event.type === "message_update") {
       const delta = event._textDelta;
       if (delta) writeText(delta);
@@ -6736,13 +6826,33 @@ ${message}`;
     disposeLogStore();
   }
 }
+async function askApprovalOnTerminal(question, details) {
+  const rl = createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    process.stderr.write(`
+  ${pc.yellow("?")} ${question}
+`);
+    for (const line of details) process.stderr.write(`    ${pc.dim(line)}
+`);
+    return await new Promise((resolve4) => {
+      rl.question("  Approve once? [y/N] ", (answer) => resolve4(/^y(es)?$/i.test(answer.trim())));
+      rl.once("close", () => resolve4(false));
+    });
+  } finally {
+    rl.close();
+  }
+}
 function sessionConfigFor(opts) {
   const agentDir = opts.agentDir ?? resolveAgentDir(opts.projectDir);
   return {
     projectDir: opts.projectDir,
     agentDir,
+    ...opts.instanceId ? { instanceId: opts.instanceId } : {},
     driver: opts.driver,
     model: opts.model,
+    ...opts.modelRef ? { modelRef: opts.modelRef } : {},
+    ...opts.maxTurns !== void 0 ? { maxTurns: opts.maxTurns } : {},
+    ...opts.unattended ? { unattended: true } : {},
     promptsDir: opts.promptsDir,
     onLog: opts.onLog
   };
@@ -7321,6 +7431,14 @@ async function handleMountResourceRequest(command, manager, emit) {
     if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
       throw new Error("Path traversal outside mount");
     }
+    if (MOUNT_WRITE_OPERATIONS.has(operation) && entry.declaration.access === "read-only") {
+      throw new Error(`Connector "${mountId}" is read-only`);
+    }
+    const realMount = await withFsDeadline(`realpath ${mountPath}`, () => realpath(mountPath));
+    const actPath = operation === "delete" && rel !== "" ? join(await resolveOnDisk(dirname(targetPath)), basename(targetPath)) : await resolveOnDisk(targetPath);
+    if (!isWithin2(realMount, operation === "delete" && rel !== "" ? dirname(actPath) : actPath)) {
+      throw new Error("Path escapes the mount through a symlink");
+    }
     let data;
     switch (operation) {
       case "list": {
@@ -7346,13 +7464,14 @@ async function handleMountResourceRequest(command, manager, emit) {
               );
             }
             const entryRel = relDir ? `${relDir}/${e.name}` : e.name;
-            const isDir = e.isDirectory();
+            const linked = e.isSymbolicLink() ? await resolveMountLink(realMount, join(absDir, e.name)) : null;
+            const isDir = linked ? linked.isDirectory : e.isDirectory();
             const result = {
               name: e.name,
               path: entryRel,
               type: isDir ? "directory" : "file"
             };
-            if (!isDir) {
+            if (!isDir && !(e.isSymbolicLink() && !linked)) {
               try {
                 const st = await withFsDeadline(
                   `stat ${join(absDir, e.name)}`,
@@ -7364,10 +7483,12 @@ async function handleMountResourceRequest(command, manager, emit) {
               }
             }
             collected.push(result);
-            if (isDir && recursive) await walk(join(absDir, e.name), entryRel, depth + 1);
+            if (isDir && recursive && !e.isSymbolicLink()) {
+              await walk(join(absDir, e.name), entryRel, depth + 1);
+            }
           }
         };
-        await walk(targetPath, reqPath ?? "", 0);
+        await walk(actPath, reqPath ?? "", 0);
         data = collected;
         break;
       }
@@ -7377,7 +7498,7 @@ async function handleMountResourceRequest(command, manager, emit) {
         if (readRange) {
           const sizeFn2 = getAuthoritativeSize(entry.handle.state);
           const chunk = await readMountRange(
-            targetPath,
+            actPath,
             readRange,
             sizeFn2 ? () => sizeFn2(reqPath ?? "") : void 0
           );
@@ -7390,8 +7511,8 @@ async function handleMountResourceRequest(command, manager, emit) {
           break;
         }
         const buf = await withFsDeadline(
-          `readFile ${targetPath}`,
-          () => readFile(targetPath),
+          `readFile ${actPath}`,
+          () => readFile(actPath),
           fsDeadlineMs() * MOUNT_READ_DEADLINE_FACTOR
         );
         let bytes = buf;
@@ -7427,28 +7548,28 @@ async function handleMountResourceRequest(command, manager, emit) {
         break;
       }
       case "write": {
-        const parentDir = dirname(targetPath);
+        const parentDir = dirname(actPath);
         await withFsDeadline(`mkdir ${parentDir}`, () => mkdir(parentDir, { recursive: true }));
         const writeContent = typeof content === "string" ? content : content?.data ?? "";
         const encoding = typeof content === "string" ? void 0 : content?.encoding;
         await withFsDeadline(
-          `writeFile ${targetPath}`,
-          () => encoding === "binary" ? writeFile(targetPath, Buffer.from(writeContent, "base64")) : writeFile(targetPath, writeContent, "utf-8")
+          `writeFile ${actPath}`,
+          () => encoding === "binary" ? writeFile(actPath, Buffer.from(writeContent, "base64")) : writeFile(actPath, writeContent, "utf-8")
         );
         data = true;
         break;
       }
       case "write_range": {
         if (rel === "") throw new Error("A file path is required");
-        data = await writeRangeChunk(targetPath, options, content);
+        data = await writeRangeChunk(actPath, options, content);
         break;
       }
       case "mkdir": {
         if (rel === "") throw new Error("A folder path is required");
-        const parentDir = dirname(targetPath);
+        const parentDir = dirname(actPath);
         await withFsDeadline(`mkdir ${parentDir}`, () => mkdir(parentDir, { recursive: true }));
         try {
-          await withFsDeadline(`mkdir ${targetPath}`, () => mkdir(targetPath));
+          await withFsDeadline(`mkdir ${actPath}`, () => mkdir(actPath));
         } catch (mkdirErr) {
           if (mkdirErr.code === "EEXIST") {
             throw new ResourceOperationError(
@@ -7463,7 +7584,7 @@ async function handleMountResourceRequest(command, manager, emit) {
       }
       case "stat": {
         const statOptions = options;
-        const st = await withFsDeadline(`stat ${targetPath}`, () => stat(targetPath));
+        const st = await withFsDeadline(`stat ${actPath}`, () => stat(actPath));
         const isDir = st.isDirectory();
         const result = {
           name: rel === "" ? "" : basename(targetPath),
@@ -7476,7 +7597,7 @@ async function handleMountResourceRequest(command, manager, emit) {
         const createdAt = isoTime(st.birthtime);
         if (createdAt) result.createdAt = createdAt;
         if (isDir && statOptions?.recursive) {
-          result.totals = await computeDirectoryTotals(targetPath, {
+          result.totals = await computeDirectoryTotals(actPath, {
             includeHidden: Boolean(statOptions.includeHidden),
             maxEntries: lowerCap(statOptions.maxEntries, MOUNT_STAT_MAX_ENTRIES),
             budgetMs: lowerCap(statOptions.timeoutMs, MOUNT_STAT_BUDGET_MS),
@@ -7487,15 +7608,15 @@ async function handleMountResourceRequest(command, manager, emit) {
         break;
       }
       case "delete": {
-        const st = await withFsDeadline(`stat ${targetPath}`, () => stat(targetPath));
+        const st = await withFsDeadline(`lstat ${actPath}`, () => lstat(actPath));
         if (st.isDirectory()) {
           await withFsDeadline(
-            `rm -r ${targetPath}`,
-            () => rm(targetPath, { recursive: true, force: true }),
+            `rm -r ${actPath}`,
+            () => rm(actPath, { recursive: true, force: true }),
             fsDeadlineMs() * MOUNT_TREE_OP_DEADLINE_FACTOR
           );
         } else {
-          await withFsDeadline(`unlink ${targetPath}`, () => unlink(targetPath));
+          await withFsDeadline(`unlink ${actPath}`, () => unlink(actPath));
         }
         data = true;
         break;
@@ -7562,6 +7683,23 @@ async function readDanglingLink(absPath) {
   }
   return withFsDeadline(`readlink ${absPath}`, () => readlink(absPath));
 }
+var MOUNT_WRITE_OPERATIONS = /* @__PURE__ */ new Set([
+  "write",
+  "write_range",
+  "mkdir",
+  "delete"
+]);
+async function resolveMountLink(realMount, linkPath) {
+  try {
+    const real = await withFsDeadline(`realpath ${linkPath}`, () => realpath(linkPath));
+    if (!isWithin2(realMount, real)) return null;
+    const st = await withFsDeadline(`stat ${real}`, () => stat(real));
+    return { isDirectory: st.isDirectory() };
+  } catch (err) {
+    if (err instanceof FsDeadlineError) throw err;
+    return null;
+  }
+}
 async function handleSessionRootResourceRequest(command, rootDir, emit) {
   const { requestId, connectorId, operation, path: reqPath, content } = command;
   try {
@@ -11398,9 +11536,7 @@ function buildRunnerCapabilities(handlers) {
       kind: "effect",
       input: setStateInput,
       handler: async (input) => {
-        if (!handlers.setState) {
-          return notImplemented("runner.set_state");
-        }
+        if (!handlers.setState) return notImplemented("runner.set_state");
         return handlers.setState({
           store: input.store,
           key: input.key,
@@ -11451,6 +11587,7 @@ function wireSessionCapabilities(deps) {
     capabilityRegistry,
     remoteCapabilityInvoker,
     getResourceManager,
+    isSharedStateStore,
     getPreMintedSecrets,
     emitResourcesAvailable,
     driverPicksUpToolsLive,
@@ -11514,8 +11651,37 @@ function wireSessionCapabilities(deps) {
         message: `detach_instance does not support kind "${input.kind}"`
       };
     },
-    // setLogLevel left undefined (the cap self-falls-back to getLogStore);
-    // setState remains a stub (not resource hot-plug).
+    // setLogLevel left undefined (the cap self-falls-back to getLogStore).
+    setState: async (input) => {
+      const rm3 = getResourceManager();
+      if (!rm3) return { ok: false, code: "no_session", message: "session resources not ready" };
+      if (!isSharedStateStore(input.store) || !rm3.has(input.store)) {
+        return {
+          ok: false,
+          code: "store_not_found",
+          message: `no shared state store "${input.store}" \u2014 declare it in session_init.sharedState`
+        };
+      }
+      const connector = rm3.get(input.store).connector;
+      if (typeof connector.onStoreChange !== "function") {
+        return {
+          ok: false,
+          code: "not_a_state_store",
+          message: `"${input.store}" is not a shared state store`
+        };
+      }
+      try {
+        await rm3.executeOp(input.store, "set", {
+          key: input.key,
+          value: typeof input.value === "string" ? JSON.stringify(input.value) : input.value
+        });
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        log(`[session-state] runner.set_state failed for ${input.store}: ${message}`);
+        return { ok: false, code: "set_failed", message };
+      }
+      return { ok: true };
+    },
     lifecycle: buildLifecycleHandler({
       getCompactionOrchestrator,
       getResourceManager,
@@ -12777,7 +12943,8 @@ async function startAgentServer(opts) {
     port,
     onLog: log,
     ...opts.host ? { host: opts.host } : {},
-    ...authToken ? { authToken } : {}
+    ...authToken ? { authToken } : {},
+    ...opts.onListening ? { onListening: opts.onListening } : {}
   });
   logStore.addSink(
     new WsLogSink({
@@ -14115,6 +14282,7 @@ async function startAgentServer(opts) {
       capabilityRegistry,
       remoteCapabilityInvoker,
       getResourceManager: () => resourceManager,
+      isSharedStateStore: (id) => lastInitSharedState?.some((c) => c.id === id) ?? false,
       getPreMintedSecrets: () => preMintedSecrets,
       emitResourcesAvailable,
       driverPicksUpToolsLive,
@@ -15645,6 +15813,6 @@ function touchSession(state) {
   return { ...state, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
 }
 
-export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptDriver, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, driverActiveAfterTurnEnd, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
-//# sourceMappingURL=chunk-JJLH4TX4.js.map
-//# sourceMappingURL=chunk-JJLH4TX4.js.map
+export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptDriver, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, driverActiveAfterTurnEnd, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, manifestModelForDriver, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
+//# sourceMappingURL=chunk-CQFVKN6S.js.map
+//# sourceMappingURL=chunk-CQFVKN6S.js.map