@skaile/workspaces 6.6.0 → 6.8.0

package/dist/{chunk-AQNW2FET.js → chunk-K7ZGY2BY.js}

@@ -1,34 +1,35 @@
-import { WorkspacePlugin } from './chunk-Z4FERR4U.js';
-import { buildWorkspaceToolDefs } from './chunk-GTGWRKMJ.js';
+import { WorkspacePlugin } from './chunk-RDIGVPXX.js';
+import { buildWorkspaceToolDefs } from './chunk-KHWGUXSF.js';
 import { findAiAssetsRoot } from './chunk-HQAPUPBE.js';
-import { startModelEndpoint } from './chunk-SZKCE7EC.js';
-import { WebSocketServerTransport } from './chunk-6A6HE5LW.js';
+import { startModelEndpoint } from './chunk-REAF7ZFA.js';
+import { WebSocketServerTransport } from './chunk-HLAEYFUN.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-CMXDFTA2.js';
-import { resolveFlowPath } from './chunk-5ETYBC2X.js';
+import { resolveFlowPath } from './chunk-YGP6XEPA.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-USSP43U3.js';
-import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-VXYZ5M7Z.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-4BFEPZ6J.js';
-import { EventNormalizer } from './chunk-YN6N3RBM.js';
-import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-U3UDOX6I.js';
-import { codexLoginFallbackNotice } from './chunk-65UAC3ZR.js';
+import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-LJ6PLEDU.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-ZBA4P5TD.js';
+import { EventNormalizer } from './chunk-XIIIGLSL.js';
+import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-6ZM5X2XW.js';
+import { codexLoginFallbackNotice } from './chunk-Y6LC5PEZ.js';
 import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-KSUT5KAE.js';
+import { dispatchCapability } from './chunk-YEOG7CWQ.js';
 import { classifyClaudeSdkError } from './chunk-5DE3DGVR.js';
 import { agentExecRequested } from './chunk-7DN6JKP2.js';
-import { toAgentEffort, toMergedRegistry } from './chunk-WW5NAU6N.js';
-import { unresolvedProviderCredentials, harnessCapabilities, createHarness, catalogLayer, providerCredentialEnvName, registryCredentialEnv, AI_PROVIDER_PRESETS, supportsLiveToolUpdates } from './chunk-BSMW3PX2.js';
-import { loadFlow } from './chunk-5XHQBCB5.js';
+import { toAgentEffort, toMergedRegistry } from './chunk-ORXV3UB6.js';
+import { unresolvedProviderCredentials, harnessCapabilities, createHarness, providerCredentialEnvName, registryCredentialEnv, supportsLiveToolUpdates } from './chunk-SILFO5RY.js';
+import { catalogLayer, AI_PROVIDER_PRESETS } from './chunk-6UP2EDFN.js';
+import { loadFlow } from './chunk-WFK4MUBL.js';
 import { renderStimulusPrompt } from './chunk-WD3L5QSU.js';
-import { TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-G5SYFFMD.js';
-import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-MMOWIRHP.js';
-import { createDefaultKindRegistry } from './chunk-J4WKNJHO.js';
+import { TURN_VISIBILITY_EVENT_TYPES, TERMINAL_AGENT_RUN_STATUSES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, TURN_VISIBILITY_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-7NN3P6VF.js';
+import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-G44FFUMA.js';
+import { createDefaultKindRegistry } from './chunk-O5Y7VMVQ.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
 import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-VT6G5AJV.js';
-import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-6ARPZHOV.js';
-import { resolveRuntimeAssets } from './chunk-JIQUF3X2.js';
+import { readLock, ensureRunStateIgnored, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-TMJBEGS4.js';
+import { resolveRuntimeAssets } from './chunk-G7NMF5WQ.js';
 import { DEFAULT_HARNESS_ID, resolveHarnessPaths } from './chunk-C5HFK34M.js';
-import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-6SXSVKQY.js';
+import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-O7ADRMCR.js';
 import { globalSkaileDir, globalCacheRoot } from './chunk-L5VSIPQD.js';
 import { harnessNameForHarnessId, SUPPORTED_HARNESSES, HARNESS_TARGETS } from './chunk-VTETQCR6.js';
 import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-GNUA7XT2.js';
@@ -1429,6 +1430,22 @@ function buildCompositionRunSnapshot(sessionId, items, promptVersion) {
     items: entries
   };
 }
+var MAX_RUN_SNAPSHOTS = 20;
+async function pruneRunSnapshots(projectDir, except, keep) {
+  const dir = path3.join(projectDir, RUN_SNAPSHOT_DIR);
+  try {
+    const names = (await fs8.readdir(dir)).filter((n) => n.endsWith(".json"));
+    const dated = await Promise.all(
+      names.map(async (name) => ({
+        file: path3.join(dir, name),
+        mtime: (await fs8.stat(path3.join(dir, name))).mtimeMs
+      }))
+    );
+    const stale = dated.filter((d) => d.file !== except).sort((a, b) => b.mtime - a.mtime).slice(Math.max(keep - 1, 0));
+    await Promise.all(stale.map((d) => fs8.rm(d.file, { force: true })));
+  } catch {
+  }
+}
 async function saveCompositionRunSnapshot(projectDir, snapshot) {
   const file = compositionRunSnapshotPath(projectDir, snapshot.session_id);
   await fs8.mkdir(path3.dirname(file), { recursive: true });
@@ -1436,6 +1453,8 @@ async function saveCompositionRunSnapshot(projectDir, snapshot) {
   await fs8.writeFile(tmp, `${JSON.stringify(snapshot, null, 2)}
 `, "utf-8");
   await fs8.rename(tmp, file);
+  ensureRunStateIgnored(projectDir);
+  await pruneRunSnapshots(projectDir, file, MAX_RUN_SNAPSHOTS);
 }
 
 // runner/src/composition/resolve-instance.ts
@@ -7126,14 +7145,16 @@ function buildClientCapabilityHandler(args) {
   const gen = args.generateCallId ?? (() => `cap-${Date.now()}-${Math.floor(Math.random() * 1e9)}`);
   return async (input, ctx) => {
     const callId = ctx?.callId ?? gen();
+    const refused2 = () => new Error(`Capability ${args.wire.name} refused: its readers are unknown`);
     if (args.wire.fireAndForget) {
-      args.emit({
+      const sent = args.emit({
         type: "capability_invoked",
         callId,
         name: args.wire.name,
         input,
         invokedBy: "agent"
       });
+      if (sent === false) throw refused2();
       return {};
     }
     if (args.pending.has(callId)) {
@@ -7151,19 +7172,24 @@ function buildClientCapabilityHandler(args) {
         );
       }, timeoutMs);
       args.pending.set(callId, { resolve: resolve5, reject, timer });
-      args.emit({
+      const sent = args.emit({
         type: "capability_invoked",
         callId,
         name: args.wire.name,
         input,
         invokedBy: "agent"
       });
+      if (sent === false) {
+        clearTimeout(timer);
+        args.pending.delete(callId);
+        reject(refused2());
+      }
     });
   };
 }
 async function dispatchRunnerCapabilityInvocation(cmd, deps) {
   try {
-    const result = await deps.invoke(cmd.name, cmd.input);
+    const result = withErrorMirror(await deps.invoke(cmd.name, cmd.input));
     deps.emit({ type: "capability_result", callId: cmd.callId, result });
   } catch (err) {
     deps.emit({
@@ -7173,6 +7199,12 @@ async function dispatchRunnerCapabilityInvocation(cmd, deps) {
     });
   }
 }
+function withErrorMirror(result) {
+  if (typeof result !== "object" || result === null) return result;
+  const r = result;
+  if (r.ok !== false || typeof r.message !== "string" || "error" in r) return result;
+  return { ...result, error: r.message };
+}
 function capabilityFailure(name, err) {
   if (err instanceof Error && err.name === "ZodError" && "issues" in err) {
     const issues = err.issues;
@@ -9696,6 +9728,7 @@ var TurnScheduler = class {
       this.deps.logPhase("harness_start", startedAt, { ok, attempts });
     }
     if (!endTurn) return;
+    this.deps.turnVisibility?.enter(turn.visibility ?? null);
     this.deps.turnEnd?.begin();
     const endsBefore = this.turnEndReports;
     try {
@@ -9709,6 +9742,7 @@ var TurnScheduler = class {
     } finally {
       this.deps.turnEnd?.end();
       this.deps.turnEnd?.settle();
+      this.deps.turnVisibility?.exit();
       endTurn();
     }
   }
@@ -9789,6 +9823,211 @@ function awaitAgentEnd(harness, prompt, timeoutMs) {
   });
 }
 
+// runner/src/turn-visibility.ts
+var AGENT_RECIPIENT = "__agent__";
+var STAMPED_TYPES = new Set(TURN_VISIBILITY_EVENT_TYPES);
+function turnVisibilityOf(cmd) {
+  if (cmd.visibilityMode !== "Private") return null;
+  const ids = Array.isArray(cmd.privateRecipientIds) ? cmd.privateRecipientIds : [];
+  const readers = [
+    ...new Set(
+      ids.filter(
+        (id) => typeof id === "string" && id.length > 0 && id !== AGENT_RECIPIENT
+      )
+    )
+  ];
+  if (readers.length === 0) return "no-readers";
+  return { visibilityMode: "Private", privateRecipientIds: readers };
+}
+var UNKNOWN = /* @__PURE__ */ Symbol("unknown-owner");
+var MAX_TRACKED = 4096;
+var MAX_OUTSTANDING = 256;
+var PARENTLESS_CHILD_TYPES = /* @__PURE__ */ new Set([
+  "capability_invoked",
+  "render_invoked",
+  "custom_message"
+]);
+var QUESTION_TOOL = "AskUserQuestion";
+function intersect(a, b) {
+  if (a === UNKNOWN || b === UNKNOWN) return UNKNOWN;
+  if (a === null) return b;
+  if (b === null) return a;
+  const readers = a.privateRecipientIds.filter((id) => b.privateRecipientIds.includes(id));
+  return readers.length > 0 ? { visibilityMode: "Private", privateRecipientIds: readers } : UNKNOWN;
+}
+var BoundedMap = class {
+  entries = /* @__PURE__ */ new Map();
+  set(key, value) {
+    this.entries.delete(key);
+    this.entries.set(key, value);
+    if (this.entries.size > MAX_TRACKED) {
+      const oldest = this.entries.keys().next().value;
+      if (oldest !== void 0) this.entries.delete(oldest);
+    }
+  }
+  resolve(key) {
+    return this.entries.has(key) ? this.entries.get(key) : UNKNOWN;
+  }
+};
+var WITHHELD_KEPT_FIELDS = [
+  "selfStarted",
+  "cancelled",
+  "retrying",
+  "retryReason",
+  "category",
+  "costUsd",
+  "tokens",
+  "modelUsage",
+  "contextTokens",
+  "contextWindow"
+];
+var WITHHELD_ERROR_MESSAGE = "Output withheld: the people allowed to read it could not be established.";
+var TurnVisibilityStamp = class {
+  current = null;
+  /** The self-started turn running now, if any, and whose work it reads. */
+  selfTurn = void 0;
+  toolUses = new BoundedMap();
+  tasks = new BoundedMap();
+  /** Background tasks started and not yet settled, with their launching turn's readers. */
+  running = /* @__PURE__ */ new Map();
+  /** More tasks ran than {@link MAX_OUTSTANDING}: which are still running is no longer known. */
+  runningOverflow = false;
+  /**
+   * Owner of the `AskUserQuestion` block in the raw event observed last. serve
+   * normalizes and sends that event's `question` synchronously, before it
+   * observes the next one.
+   */
+  questionOwner = void 0;
+  privateSeen = false;
+  /** Content events withheld so far, for the log. */
+  withheldCount = 0;
+  /** Stamp the prompt turn's own events until {@link exit}; `null` stamps nothing. */
+  enter(visibility) {
+    this.current = visibility;
+    if (visibility) this.privateSeen = true;
+  }
+  exit() {
+    this.current = null;
+  }
+  /**
+   * Feed every raw harness event before it is normalized: it carries the ids of
+   * the tool uses a turn starts and of the background tasks it launches, which
+   * normalized events no longer have.
+   */
+  observeHarnessEvent(raw) {
+    this.questionOwner = void 0;
+    if (typeof raw !== "object" || raw === null) return;
+    const event = raw;
+    switch (event.type) {
+      case "self_turn_started": {
+        const ids = Array.isArray(event.taskIds) ? event.taskIds : [];
+        let owner = ids.length === 0 ? UNKNOWN : null;
+        for (const id of ids)
+          owner = intersect(owner, typeof id === "string" ? this.tasks.resolve(id) : UNKNOWN);
+        this.selfTurn = owner;
+        return;
+      }
+      case "background_task_started":
+        if (typeof event.taskId === "string") {
+          const owner = this.mainOwner();
+          this.remember(this.tasks, event.taskId, owner);
+          if (this.running.size >= MAX_OUTSTANDING && !this.running.has(event.taskId))
+            this.runningOverflow = true;
+          else this.running.set(event.taskId, owner);
+        }
+        return;
+      case "background_task_settled":
+        if (typeof event.taskId === "string") this.running.delete(event.taskId);
+        return;
+      case "background_tasks_reset":
+        this.running.clear();
+        this.runningOverflow = false;
+        return;
+      case "tool_call":
+        if (typeof event.toolCallId === "string")
+          this.remember(this.toolUses, event.toolCallId, this.ownerUnder(event.parentToolUseId));
+        return;
+      case "message_start":
+      case "message_end": {
+        const message = event.message;
+        if (!message) return;
+        const owner = this.ownerUnder(message.parentToolUseId);
+        if (Array.isArray(message.content)) {
+          for (const block of message.content) {
+            if (block?.type !== "tool_use") continue;
+            if (typeof block.id === "string") this.remember(this.toolUses, block.id, owner);
+            if (block.name === QUESTION_TOOL) this.questionOwner = owner;
+          }
+        }
+        if (Array.isArray(message.toolCalls)) {
+          for (const call of message.toolCalls) {
+            if (typeof call?.id === "string") this.remember(this.toolUses, call.id, owner);
+          }
+        }
+        return;
+      }
+    }
+  }
+  /**
+   * The event as it goes on the wire: stamped with its owner's readers, or
+   * `null` when it is withheld (see the class doc). `fromCapability` marks an
+   * event a capability emitted whose type does not say so (a render's fallback text).
+   */
+  stamp(event, opts = {}) {
+    const parent = event.parentToolUseId;
+    const selfStarted = event.selfStarted === true;
+    let owner = event.type === "question" && this.questionOwner !== void 0 ? this.questionOwner : selfStarted && typeof parent !== "string" && this.selfTurn === void 0 ? UNKNOWN : this.ownerUnder(parent);
+    if (typeof parent !== "string" && (opts.fromCapability === true || PARENTLESS_CHILD_TYPES.has(event.type)))
+      owner = intersect(owner, this.runningOwner());
+    const terminal = event.type === "finished" || event.type === "error" && event.fatal === true && event.retrying !== true;
+    if (terminal && typeof parent !== "string") this.selfTurn = void 0;
+    if (!STAMPED_TYPES.has(event.type)) return event;
+    if (owner === UNKNOWN) return this.privateSeen ? this.withhold(event) : event;
+    if (owner === null) return event;
+    const stamped = {
+      visibilityMode: owner.visibilityMode,
+      privateRecipientIds: [...owner.privateRecipientIds]
+    };
+    return { ...event, ...stamped };
+  }
+  /** Readers of the main thread: the prompt turn, narrowed by a self-started turn running too. */
+  mainOwner() {
+    return this.selfTurn === void 0 ? this.current : intersect(this.current, this.selfTurn);
+  }
+  /** Readers every running background task's launching turn shares; `null` when none runs. */
+  runningOwner() {
+    if (this.runningOverflow) return UNKNOWN;
+    let owner = null;
+    for (const taskOwner of this.running.values()) owner = intersect(owner, taskOwner);
+    return owner;
+  }
+  /** Readers of work started under `parent` (a tool use id), or of the main thread without one. */
+  ownerUnder(parent) {
+    return typeof parent === "string" ? this.toolUses.resolve(parent) : this.mainOwner();
+  }
+  /** An owner that is unknown is not remembered, so the id stays unknown. */
+  remember(map, id, owner) {
+    if (owner !== UNKNOWN) map.set(id, owner);
+  }
+  withhold(event) {
+    this.withheldCount += 1;
+    if (event.type !== "finished" && event.type !== "error") return null;
+    const kept = {};
+    for (const key of WITHHELD_KEPT_FIELDS) {
+      const value = event[key];
+      if (value !== void 0) kept[key] = value;
+    }
+    if (event.type === "finished")
+      return { costUsd: 0, ...kept, type: "finished", summary: "" };
+    return {
+      ...kept,
+      type: "error",
+      message: WITHHELD_ERROR_MESSAGE,
+      fatal: event.fatal
+    };
+  }
+};
+
 // runner/src/event-gap-buffer.ts
 var EVENT_GAP_BUFFER_MAX_EVENTS = 1e4;
 var EVENT_GAP_BUFFER_MAX_BYTES = 16 * 1024 * 1024;
@@ -12809,23 +13048,36 @@ function ensureGitConfigInclude(managedGitconfigPath, alsoMatching = []) {
     throw err;
   }
 }
-function userGitconfigToInclude(managedGitconfigPath) {
+function userGitconfigsToInclude(managedGitconfigPath) {
   const home = process.env.HOME || homedir();
-  if (!home) return void 0;
-  const userPath = join(home, ".gitconfig");
-  let text2;
-  try {
-    text2 = readFileSync(userPath, "utf-8");
-  } catch {
-    return void 0;
-  }
+  if (!home) return [];
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const xdgDir = xdg && isAbsolute(xdg) ? xdg : join(home, ".config");
   let realManaged = managedGitconfigPath;
   try {
     realManaged = join(realpathSync(dirname(managedGitconfigPath)), "managed-gitconfig");
   } catch {
   }
-  if (text2.includes(managedGitconfigPath) || text2.includes(realManaged)) return void 0;
-  return userPath;
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const userPath of [join(xdgDir, "git", "config"), join(home, ".gitconfig")]) {
+    let text2;
+    try {
+      text2 = readFileSync(userPath, "utf-8");
+    } catch {
+      continue;
+    }
+    if (text2.includes(managedGitconfigPath) || text2.includes(realManaged)) continue;
+    let identity = userPath;
+    try {
+      identity = realpathSync(userPath);
+    } catch {
+    }
+    if (seen.has(identity)) continue;
+    seen.add(identity);
+    found.push(userPath);
+  }
+  return found;
 }
 function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
   const managedGitconfigPath = join(resolve(projectDir), ".skaile", "managed-gitconfig");
@@ -12833,7 +13085,7 @@ function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
   try {
     writeUserGitconfigInclude({
       gitconfigPath: managedGitconfigPath,
-      userGitconfigPath: includeInHome ? void 0 : userGitconfigToInclude(managedGitconfigPath)
+      userGitconfigPaths: includeInHome ? void 0 : userGitconfigsToInclude(managedGitconfigPath)
     });
   } catch (err) {
     serverLog.warn("failed to write managed-gitconfig \u2014 the agent's git has no global config", {
@@ -13428,7 +13680,8 @@ async function startAgentServer(opts) {
     throw new Error("CODEX_MANAGED_BOOTSTRAP_INVALID");
   const supportedRuntimeFeatures = [
     ...managedHost ? ["codex-app-server-v1"] : [],
-    PLATFORM_BLOCKS_RUNTIME_FEATURE
+    PLATFORM_BLOCKS_RUNTIME_FEATURE,
+    TURN_VISIBILITY_RUNTIME_FEATURE
   ];
   let managedBootstrapClosed = false;
   const port = opts.port ?? 8080;
@@ -13459,7 +13712,8 @@ async function startAgentServer(opts) {
   serverLog.info("ws auth token", {
     source: opts.authToken ? "caller" : takenAuthToken.source
   });
-  if (!opts.transport && !authToken) {
+  const warnNoAuthAtListen = !opts.transport && !authToken && (opts.port ?? 8080) === 0;
+  if (!opts.transport && !authToken && !warnNoAuthAtListen) {
     serverLog.warn(wsNoAuthWarning(opts.port ?? 8080, opts.host));
   }
   if (takenAuthToken.unlinkError)
@@ -13507,7 +13761,12 @@ async function startAgentServer(opts) {
     onLog: log,
     ...opts.host ? { host: opts.host } : {},
     ...authToken ? { authToken } : {},
-    ...opts.onListening ? { onListening: opts.onListening } : {}
+    ...opts.onListening || warnNoAuthAtListen ? {
+      onListening: (info) => {
+        if (warnNoAuthAtListen) serverLog.warn(wsNoAuthWarning(info.port, opts.host));
+        opts.onListening?.(info);
+      }
+    } : {}
   });
   logStore.addSink(
     new WsLogSink({
@@ -13518,13 +13777,27 @@ async function startAgentServer(opts) {
   );
   const turnStatus = new TurnStatusTracker();
   const eventGapBuffer = new EventGapBuffer();
-  function sendEvent(event) {
+  const turnVisibility = new TurnVisibilityStamp();
+  const initLessRunner = !managedHost && (wsConfig.secrets?.provider ?? "env") === "env";
+  let clientEverConnected = false;
+  transport.onConnect(() => {
+    clientEverConnected = true;
+  });
+  function sendEvent(event, opts2) {
+    const stamped = turnVisibility.stamp(event, opts2);
+    if (stamped) deliverEvent(stamped);
+    else log(`[serve] withheld a ${event.type} event: its readers are unknown`);
+    return stamped !== null;
+  }
+  function deliverEvent(event) {
     turnStatus.observe(event);
     if (transport.connected) {
       transport.send(event);
       return;
     }
-    if (!initAcknowledged) return;
+    if (!initAcknowledged && !(initLessRunner && initGeneration === 0 && clientEverConnected)) {
+      return;
+    }
     eventGapBuffer.push(event, { isStale: settledCapabilityCallCheck(event) });
   }
   function settledCapabilityCallCheck(event) {
@@ -13593,7 +13866,15 @@ async function startAgentServer(opts) {
       });
       signal?.addEventListener("abort", abort, { once: true });
       try {
-        transport.send({ type: "capability_invoked", callId, name, input, invokedBy: "agent" });
+        const invoked = turnVisibility.stamp({
+          type: "capability_invoked",
+          callId,
+          name,
+          input,
+          invokedBy: "agent"
+        });
+        if (invoked) transport.send(invoked);
+        else finish(new Error(`Capability ${name} refused: its readers are unknown`));
       } catch (error) {
         finish(error);
       }
@@ -13780,10 +14061,9 @@ async function startAgentServer(opts) {
       invoke: (name, input, signal, callId) => capabilityRegistry.invoke(name, input, { sessionId, signal, callId }),
       onToolsChanged: (listener) => capabilityRegistry.onToolsChanged(listener),
       emitRender: (event) => sendEvent(event),
-      emitText: (text2) => sendEvent({
-        type: "text",
-        content: text2
-      })
+      emitText: (text2) => {
+        sendEvent({ type: "text", content: text2 }, { fromCapability: true });
+      }
     };
   }
   const sessionInstanceId = opts.instanceId ?? DEFAULT_AGENT_INSTANCE_ID;
@@ -14274,7 +14554,8 @@ async function startAgentServer(opts) {
     },
     log,
     logPhase,
-    turnEnd: turnEndContract
+    turnEnd: turnEndContract,
+    turnVisibility
   });
   let harnessRestartChain = Promise.resolve();
   let toolRestartScheduler;
@@ -14289,6 +14570,7 @@ async function startAgentServer(opts) {
         harness.removeAllListeners("error");
         harness.removeAllListeners("reconfigure-rollback");
         harness.kill();
+        turnVisibility.observeHarnessEvent({ type: "background_tasks_reset" });
       } catch (err) {
         log(
           `[serve] failed to retire previous harness: ${err instanceof Error ? err.message : String(err)}`
@@ -14416,6 +14698,7 @@ async function startAgentServer(opts) {
               liveHarnessActiveAfterTurn,
               event
             );
+            turnVisibility.observeHarnessEvent(event);
             const normalized = normalizer.normalize(event);
             const turnEnded = event.type === "agent_end";
             for (const e of normalized) {
@@ -15316,6 +15599,7 @@ async function startAgentServer(opts) {
     const initReceivedAt = Date.now();
     const thisInit = ++initGeneration;
     initAcknowledged = false;
+    if (thisInit === 1) eventGapBuffer.clear();
     if (cmd.protocolVersion.major !== PROTOCOL_VERSION.major) {
       log(
         `[serve] incompatible protocol: agent=${PROTOCOL_VERSION.major} platform=${cmd.protocolVersion.major}`
@@ -15620,8 +15904,17 @@ async function startAgentServer(opts) {
   }
   async function handlePrompt(cmd) {
     if (cmd.messageId) sendEvent({ type: "prompt_ack", messageId: cmd.messageId });
+    const visibility = turnVisibilityOf(cmd);
+    if (visibility === "no-readers") {
+      refusePrompt(
+        "Prompt refused: a private prompt must name at least one person who may read the answer.",
+        { onReceipt: true }
+      );
+      return;
+    }
     await turnScheduler.prompt({
       owner: { senderId: cmd.senderId, messageId: cmd.messageId },
+      visibility,
       // The turn ahead may be paused on a question it can only leave through
       // this harness's rule for a new prompt; apply it now, not after that turn.
       onQueued: () => harness?.supersedePendingQuestion?.(),
@@ -15666,6 +15959,10 @@ async function startAgentServer(opts) {
           refusePrompt("Prompt refused: a tool allowlist cannot apply while a flow runs.");
           return false;
         }
+        if (visibility) {
+          refusePrompt("Prompt refused: a private message cannot stay private while a flow runs.");
+          return false;
+        }
         if (Array.isArray(cmd.platformBlocks))
           pendingFlowPlatformBlocks.push(...cmd.platformBlocks);
         return async () => {
@@ -15726,9 +16023,11 @@ async function startAgentServer(opts) {
       }
     });
   }
-  function refusePrompt(message) {
+  function refusePrompt(message, opts2 = {}) {
     log(`[serve] ${message}`);
-    sendEvent({ type: "error", message, fatal: false, category: "validation" });
+    const event = { type: "error", message, fatal: false, category: "validation" };
+    if (opts2.onReceipt) deliverEvent(event);
+    else sendEvent(event);
   }
   async function handleReply(cmd) {
     await turnScheduler.reply({
@@ -16157,7 +16456,8 @@ async function startAgentServer(opts) {
   });
   transport.onConnect(() => {
     if (!eventGapBuffer.hasPending) return;
-    if (!initAcknowledged || sessionReadyOutcome === "rejected") {
+    const initLessTurn = initLessRunner && initGeneration === 0;
+    if (!initAcknowledged && !initLessTurn || sessionReadyOutcome === "rejected") {
       const discarded = eventGapBuffer.clear();
       serverLog.warn(
         `[serve] discarded ${discarded} event(s) buffered while disconnected: the init they belong to is no longer acknowledged`
@@ -16417,5 +16717,5 @@ function touchSession(state) {
 }
 
 export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptHarness, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsHarnessRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, harnessActiveAfterTurnEnd, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompilePinCurrent, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, logConnectorReport, manifestModelForHarness, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
-//# sourceMappingURL=chunk-AQNW2FET.js.map
-//# sourceMappingURL=chunk-AQNW2FET.js.map
+//# sourceMappingURL=chunk-K7ZGY2BY.js.map
+//# sourceMappingURL=chunk-K7ZGY2BY.js.map