@skaile/workspaces 6.9.1 → 6.11.0

package/dist/{chunk-PBEDRYHP.js → chunk-FO2GU5L7.js}

@@ -1,41 +1,41 @@
-import { WorkspacePlugin } from './chunk-2UKNI2HJ.js';
-import { buildWorkspaceToolDefs } from './chunk-EMSU6L7K.js';
-import { findAiAssetsRoot } from './chunk-HQAPUPBE.js';
-import { startModelEndpoint, ModelEndpointError } from './chunk-QIV7H3GJ.js';
-import { WebSocketServerTransport } from './chunk-U3FI4DVT.js';
+import { WorkspacePlugin } from './chunk-RZQCBFIU.js';
+import { buildWorkspaceToolDefs } from './chunk-L74W5TVC.js';
+import { findAiAssetsRoot } from './chunk-V2VDTQ7A.js';
+import { startModelEndpoint, ModelEndpointError } from './chunk-WPTNYDDS.js';
+import { WebSocketServerTransport } from './chunk-7K73MCI6.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
-import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-GYPPVANR.js';
-import { resolveFlowPath } from './chunk-SME3PK4L.js';
-import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-USSP43U3.js';
-import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, fleetMountConnectingMessage, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-AQTAULXT.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-LMADWO4Q.js';
-import { EventNormalizer } from './chunk-7UCPGQCW.js';
-import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-KVTV4LT2.js';
-import { codexLoginFallbackNotice } from './chunk-C324IAXI.js';
-import { CodexNativeStateUnavailable } from './chunk-LOO5CB5M.js';
-import { dispatchCapability } from './chunk-YEOG7CWQ.js';
+import { resolveFlowPath } from './chunk-FVOQPTK2.js';
+import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-LQWOU7S2.js';
+import { ConnectFailureCarryOver, registerBuiltinConnectors, listConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, fleetMountConnectingMessage, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, TRUSTED_GIT_CA_ENV, writeUserGitconfigInclude, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-UHTCOYFJ.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, isKnownSecretRef, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, deriveSingleMaterializedConnectorDeclaration } from './chunk-SBAUZ7XH.js';
+import { EventNormalizer } from './chunk-45XL75RO.js';
+import { sessionSurfaceNotice, approvalCardOf, APPROVE_ONCE, DENY, probeResumeTranscript, transcriptStoreForRuntime } from './chunk-MRTOKIEJ.js';
+import { codexLoginFallbackNotice, prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-WCHGUS7X.js';
+import { CodexNativeStateUnavailable } from './chunk-5KSGZP3E.js';
+import { dispatchCapability } from './chunk-7ZL23M3X.js';
 import { classifyClaudeSdkError } from './chunk-5DE3DGVR.js';
 import { agentExecRequested } from './chunk-7DN6JKP2.js';
-import { toAgentEffort, toMergedRegistry } from './chunk-5J6N6LHL.js';
-import { unresolvedProviderCredentials, harnessCapabilities, createHarness, providerCredentialEnvName, registryCredentialEnv, supportsLiveToolUpdates } from './chunk-7TF5MNFK.js';
+import { toAgentEffort, toMergedRegistry } from './chunk-PZS55HOX.js';
+import { unresolvedProviderCredentials, harnessCapabilities, createHarness, providerCredentialEnvName, registryCredentialEnv, supportsLiveToolUpdates } from './chunk-S6NS3I3P.js';
 import { catalogLayer, AI_PROVIDER_PRESETS } from './chunk-6UP2EDFN.js';
-import { loadFlow } from './chunk-5J6JWGY4.js';
+import { loadFlow } from './chunk-WDG5IVEA.js';
 import { renderStimulusPrompt } from './chunk-WD3L5QSU.js';
-import { TURN_VISIBILITY_EVENT_TYPES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, TERMINAL_AGENT_RUN_STATUSES, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, TURN_VISIBILITY_RUNTIME_FEATURE, PROTOCOL_VERSION, deliveryClassOf } from './chunk-7NN3P6VF.js';
-import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-GZL6RN4Z.js';
-import { createDefaultKindRegistry } from './chunk-5KWQMCH7.js';
+import { TURN_VISIBILITY_EVENT_TYPES, withActivityLabelJsonSchema, TOOL_ACTIVITY_PROMPT_SECTION, TERMINAL_AGENT_RUN_STATUSES, SESSION_ROOT_CONNECTOR_ID, PLATFORM_BLOCKS_RUNTIME_FEATURE, TURN_VISIBILITY_RUNTIME_FEATURE, TURN_IDS_RUNTIME_FEATURE, PROTOCOL_VERSION, TURN_IDS_MAX_COUNT, TURN_ID_MAX_LENGTH, deliveryClassOf } from './chunk-342UX2MG.js';
+import { knowledgeKindProvider, scanLibraryRoot, LocalIndex } from './chunk-7FXOOUOC.js';
+import { createDefaultKindRegistry } from './chunk-DRUAQ7IY.js';
 import { parseFlowDefinition } from './chunk-JRN5QF4C.js';
-import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-WS3BOCAT.js';
-import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-4KPQ6ILH.js';
-import { resolveRuntimeAssets } from './chunk-4ROXSQEG.js';
+import { BindingSchema, effectiveComposes, AgentManifestSchema, AgentTriggerSchema, ANTHROPIC_MODEL_ALIASES } from './chunk-LCXQ4LVP.js';
+import { readLock, buildAgentPromptSections, resolveSettings, loadProviderRegistry, resolveLibraryDir } from './chunk-MEU2HHGV.js';
+import { resolveRuntimeAssets } from './chunk-CJO3XKO7.js';
 import { DEFAULT_HARNESS_ID, resolveHarnessPaths } from './chunk-C5HFK34M.js';
-import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-FZO64PLQ.js';
+import { matchPin, DEFAULT_AGENT_INSTANCE_ID, effectiveAgentInstances, resolveAgentDefinitionDir, AgentRefResolutionError, resolveSkWorkspaceConfig, resolveAgentDir, agentSourceCacheDir, loadMcpServerDeclarations, COMPACTION_DEFAULTS, resolveCompactionThresholdPercent, getGlobalCacheDir, sourceCacheKey, validateAssetRecipeAttr, deriveSingleMaterializedMcpDeclaration, stageMaterializedSkills, readSkillAllowList, isStagedSkillMarkerFor, unstageSkill, STAGED_SKILL_MARKER } from './chunk-BNLXZXZN.js';
 import { globalSkaileDir, globalCacheRoot } from './chunk-L5VSIPQD.js';
 import { harnessNameForHarnessId, SUPPORTED_HARNESSES, HARNESS_TARGETS } from './chunk-VTETQCR6.js';
-import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-GNUA7XT2.js';
-import { parseAssetRef } from './chunk-V5KG6CCV.js';
+import { withFsDeadline, FsDeadlineError, fsDeadlineMs, parseFrontmatter, tryWithFsDeadline } from './chunk-VS6XC5JE.js';
+import { parseAssetRef } from './chunk-7HRZACI4.js';
+import { portableSpawnSync } from './chunk-VSX2G7LA.js';
 import { pickRegistryEntries, registryEntries, resolveEntryBaseUrl, parseModelRef, isEntryEnabled, parseCredentialRef } from './chunk-RXGPFAMN.js';
-import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention, ensureRunStateIgnored, scrubLogText } from './chunk-MDCI4RSG.js';
+import { resolveLogStoreConfig, createLogStoreFromConfig, OnLogBridgeSink, WsLogSink, resolveLogsRetention, enforceLogsRetention, ensureRunStateIgnored, scrubLogText } from './chunk-RZL4TOK3.js';
 import { getLogStore, registerLogStore, createLogger, resetLogStore, isUnwritableStreamError, markStreamBroken, isBrokenPipeError, redactCredentials } from './chunk-BOFL7GIF.js';
 import { __require } from './chunk-NSBPE2FW.js';
 import { createInterface } from 'readline';
@@ -9119,6 +9119,142 @@ var TurnEndContract = class {
   }
 };
 
+// runner/src/turn-ids.ts
+var UNKNOWN = /* @__PURE__ */ Symbol("unknown-turn");
+var MAX_TRACKED_TASKS = 4096;
+var MAX_RUNNING_TASKS = 256;
+function turnIdOf(cmd) {
+  const id = cmd.turnId;
+  return typeof id === "string" && id.length > 0 && id.length <= TURN_ID_MAX_LENGTH ? id : null;
+}
+function union(a, b) {
+  if (a === UNKNOWN || b === UNKNOWN) return UNKNOWN;
+  if (a.length === 0) return b;
+  if (b.length === 0) return a;
+  return [.../* @__PURE__ */ new Set([...a, ...b])];
+}
+var TurnIdStamp = class {
+  /** Every turn holding the harness, by the handle {@link enter} gave it. */
+  holders = /* @__PURE__ */ new Map();
+  nextHolder = 0;
+  /** The self-started turn running now, if any, and the turns whose work it reads. */
+  selfTurn = void 0;
+  /** Launching turns of every task seen to start, oldest first. */
+  tasks = /* @__PURE__ */ new Map();
+  /** Background tasks started and not yet settled, with their launching turns. */
+  running = /* @__PURE__ */ new Map();
+  runningOverflow = false;
+  /**
+   * A host turn now holds the harness; `null` when it was sent without an id.
+   * Returns the call that ends its hold, which ends no other turn's.
+   */
+  enter(turnId) {
+    return this.hold(turnId === null ? UNKNOWN : [turnId]);
+  }
+  /** A turn the host did not send holds the harness: a flow turn, a compaction. */
+  enterForeign() {
+    return this.hold(UNKNOWN);
+  }
+  /**
+   * A reply was taken by the turn paused on its question: the rest of that turn
+   * answers to the reply's sender as well. Which holder paused is not known, so
+   * every one does. With none, the paused turn is a self-started one, or one
+   * this stamp lost track of.
+   */
+  join(turnId) {
+    const ids = turnId === null ? UNKNOWN : [turnId];
+    if (this.holders.size > 0) {
+      for (const [handle, held] of this.holders) this.holders.set(handle, union(held, ids));
+    } else {
+      this.selfTurn = this.selfTurn === void 0 ? UNKNOWN : union(this.selfTurn, ids);
+    }
+  }
+  /** Feed every raw harness event before it is normalized: task ids are gone after. */
+  observeHarnessEvent(raw) {
+    if (typeof raw !== "object" || raw === null) return;
+    const event = raw;
+    switch (event.type) {
+      case "self_turn_started": {
+        const ids = Array.isArray(event.taskIds) ? event.taskIds : [];
+        let owner = ids.length === 0 ? UNKNOWN : [];
+        for (const id of ids)
+          owner = union(owner, typeof id === "string" ? this.tasks.get(id) ?? UNKNOWN : UNKNOWN);
+        this.selfTurn = owner;
+        return;
+      }
+      case "background_task_started": {
+        if (typeof event.taskId !== "string") return;
+        const main = this.mainIds();
+        const owner = main !== UNKNOWN && main.length === 0 ? UNKNOWN : main;
+        this.tasks.delete(event.taskId);
+        this.tasks.set(event.taskId, owner);
+        if (this.tasks.size > MAX_TRACKED_TASKS) {
+          const oldest = this.tasks.keys().next().value;
+          if (oldest !== void 0) this.tasks.delete(oldest);
+        }
+        if (this.running.size >= MAX_RUNNING_TASKS && !this.running.has(event.taskId))
+          this.runningOverflow = true;
+        else this.running.set(event.taskId, owner);
+        return;
+      }
+      case "background_task_settled":
+        if (typeof event.taskId === "string") this.running.delete(event.taskId);
+        return;
+      case "background_tasks_reset":
+        this.running.clear();
+        this.runningOverflow = false;
+        this.selfTurn = void 0;
+        return;
+    }
+  }
+  /**
+   * The event as it goes on the wire, with the turn ids it carries. Call after
+   * any other stamp: only `capability_invoked` and `finished` are touched, and
+   * a top-level terminal ends the self-started turn's attribution.
+   */
+  stamp(event) {
+    if (event.type === "capability_invoked") {
+      return withIds(event, union(this.mainIds(), this.runningIds()));
+    }
+    const parent = event.parentToolUseId;
+    const terminal = event.type === "finished" || event.type === "error" && event.fatal === true && event.retrying !== true;
+    if (!terminal || typeof parent === "string") return event;
+    this.selfTurn = void 0;
+    if (event.type !== "finished" || event.selfStarted === true)
+      return event;
+    const { turnId: _stale, ...rest } = event;
+    const [only] = this.holders.size === 1 ? this.holders.values() : [];
+    if (only === void 0 || only === UNKNOWN || only.length === 0) return rest;
+    return { ...rest, turnId: only[0] };
+  }
+  hold(ids) {
+    const handle = this.nextHolder++;
+    this.holders.set(handle, ids);
+    return () => {
+      this.holders.delete(handle);
+    };
+  }
+  /** The main thread: every turn holding the harness and any self-started turn running too. */
+  mainIds() {
+    let ids = [];
+    for (const held of this.holders.values()) ids = union(ids, held);
+    return this.selfTurn === void 0 ? ids : union(ids, this.selfTurn);
+  }
+  /** The launching turns of every background task still running. */
+  runningIds() {
+    if (this.runningOverflow) return UNKNOWN;
+    let ids = [];
+    for (const owner of this.running.values()) ids = union(ids, owner);
+    return ids;
+  }
+};
+function withIds(event, ids) {
+  const { turnIds: _stale, ...rest } = event;
+  if (ids === UNKNOWN || ids.length === 0 || ids.length > TURN_IDS_MAX_COUNT)
+    return rest;
+  return { ...rest, turnIds: [...ids] };
+}
+
 // runner/src/compaction-gate.ts
 var CompactionGate = class {
   /**
@@ -9553,6 +9689,7 @@ var TurnScheduler = class {
       const paused = this.deps.getHarness();
       if (paused.hasPendingQuestion()) {
         if (paused.answerQuestion(turn.answer, turn.question, turn.requestId)) {
+          this.deps.turnIds?.join(turn.turnId ?? null);
           turn.onAnswered?.();
           return;
         }
@@ -9578,14 +9715,16 @@ var TurnScheduler = class {
         return;
       }
       if (!endTurn) return;
-      this.deps.turnEnd?.begin();
+      const leaveTurnIds = this.deps.turnIds?.enter(turn.turnId ?? null);
       try {
+        this.deps.turnEnd?.begin();
         await this.deps.getHarness().prompt(freshTurnReplyPrompt(turn.answer, turn.question));
       } catch (err) {
         this.deps.sendEvent(replyFailed(err));
       } finally {
         this.deps.turnEnd?.end();
         this.deps.turnEnd?.settle();
+        leaveTurnIds?.();
         endTurn();
       }
     });
@@ -9606,6 +9745,7 @@ var TurnScheduler = class {
         if (!await this.awaitCompactionIdle("flow turn"))
           throw new Error(FLOW_TURN_COMPACTION_TIMEOUT);
         const endTurn = await this.swaps.beginQueuedTurn();
+        let leaveTurnIds;
         if (this.swaps.isSwapping() || !this.compactions.isIdle()) {
           endTurn();
           continue;
@@ -9613,9 +9753,12 @@ var TurnScheduler = class {
         try {
           await this.deps.ensureHarnessStarted();
           this.deps.turnEnd?.foreignTurn();
+          leaveTurnIds = this.deps.turnIds?.enterForeign();
           await awaitAgentEnd(this.deps.getHarness(), prompt, timeoutMs);
           return;
         } finally {
+          leaveTurnIds?.();
+          leaveTurnIds = void 0;
           endTurn();
         }
       }
@@ -9669,6 +9812,7 @@ var TurnScheduler = class {
     const generation = ++this.hooksGeneration;
     const superseded = () => generation !== this.hooksGeneration;
     let hold = null;
+    let leaveTurnIds;
     return {
       // A user turn that already holds a slot keeps the harness; the compaction
       // waits for it rather than prompting the harness under it. A platform call
@@ -9689,6 +9833,8 @@ var TurnScheduler = class {
       },
       onCompactionStart: (trigger) => {
         this.deps.turnEnd?.foreignTurn();
+        leaveTurnIds?.();
+        leaveTurnIds = this.deps.turnIds?.enterForeign();
         hold = this.compactions.begin();
         this.suppressedBy = hold;
         this.deps.sendEvent({ type: "status", phase: "compacting" });
@@ -9704,6 +9850,8 @@ var TurnScheduler = class {
       onCompactionSettled: () => {
         if (hold !== null && this.suppressedBy === hold) this.suppressedBy = null;
         if (hold !== null) this.snapshotTurns.delete(hold);
+        leaveTurnIds?.();
+        leaveTurnIds = void 0;
         this.compactions.settle(hold);
         hold = null;
       }
@@ -9760,9 +9908,10 @@ var TurnScheduler = class {
       return { kind: "dropped" };
     }
     this.deps.turnVisibility?.enter(turn.visibility ?? null);
-    this.deps.turnEnd?.begin();
+    const leaveTurnIds = this.deps.turnIds?.enter(turn.turnId ?? null);
     const endsBefore = this.turnEndReports;
     try {
+      this.deps.turnEnd?.begin();
       turn.onStart?.();
       await turn.dispatch();
     } catch (err) {
@@ -9775,6 +9924,7 @@ var TurnScheduler = class {
       this.deps.turnEnd?.end();
       this.deps.turnEnd?.settle();
       this.deps.turnVisibility?.exit();
+      leaveTurnIds?.();
       endTurn();
     }
     return { kind: "ran" };
@@ -9872,7 +10022,7 @@ function turnVisibilityOf(cmd) {
   if (readers.length === 0) return "no-readers";
   return { visibilityMode: "Private", privateRecipientIds: readers };
 }
-var UNKNOWN = /* @__PURE__ */ Symbol("unknown-owner");
+var UNKNOWN2 = /* @__PURE__ */ Symbol("unknown-owner");
 var MAX_TRACKED = 4096;
 var MAX_OUTSTANDING = 256;
 var PARENTLESS_CHILD_TYPES = /* @__PURE__ */ new Set([
@@ -9882,11 +10032,11 @@ var PARENTLESS_CHILD_TYPES = /* @__PURE__ */ new Set([
 ]);
 var QUESTION_TOOL = "AskUserQuestion";
 function intersect(a, b) {
-  if (a === UNKNOWN || b === UNKNOWN) return UNKNOWN;
+  if (a === UNKNOWN2 || b === UNKNOWN2) return UNKNOWN2;
   if (a === null) return b;
   if (b === null) return a;
   const readers = a.privateRecipientIds.filter((id) => b.privateRecipientIds.includes(id));
-  return readers.length > 0 ? { visibilityMode: "Private", privateRecipientIds: readers } : UNKNOWN;
+  return readers.length > 0 ? { visibilityMode: "Private", privateRecipientIds: readers } : UNKNOWN2;
 }
 var BoundedMap = class {
   entries = /* @__PURE__ */ new Map();
@@ -9899,7 +10049,7 @@ var BoundedMap = class {
     }
   }
   resolve(key) {
-    return this.entries.has(key) ? this.entries.get(key) : UNKNOWN;
+    return this.entries.has(key) ? this.entries.get(key) : UNKNOWN2;
   }
 };
 var WITHHELD_KEPT_FIELDS = [
@@ -9954,9 +10104,9 @@ var TurnVisibilityStamp = class {
     switch (event.type) {
       case "self_turn_started": {
         const ids = Array.isArray(event.taskIds) ? event.taskIds : [];
-        let owner = ids.length === 0 ? UNKNOWN : null;
+        let owner = ids.length === 0 ? UNKNOWN2 : null;
         for (const id of ids)
-          owner = intersect(owner, typeof id === "string" ? this.tasks.resolve(id) : UNKNOWN);
+          owner = intersect(owner, typeof id === "string" ? this.tasks.resolve(id) : UNKNOWN2);
         this.selfTurn = owner;
         return;
       }
@@ -10009,13 +10159,13 @@ var TurnVisibilityStamp = class {
   stamp(event, opts = {}) {
     const parent = event.parentToolUseId;
     const selfStarted = event.selfStarted === true;
-    let owner = event.type === "question" && this.questionOwner !== void 0 ? this.questionOwner : selfStarted && typeof parent !== "string" && this.selfTurn === void 0 ? UNKNOWN : this.ownerUnder(parent);
+    let owner = event.type === "question" && this.questionOwner !== void 0 ? this.questionOwner : selfStarted && typeof parent !== "string" && this.selfTurn === void 0 ? UNKNOWN2 : this.ownerUnder(parent);
     if (typeof parent !== "string" && (opts.fromCapability === true || PARENTLESS_CHILD_TYPES.has(event.type)))
       owner = intersect(owner, this.runningOwner());
     const terminal = event.type === "finished" || event.type === "error" && event.fatal === true && event.retrying !== true;
     if (terminal && typeof parent !== "string") this.selfTurn = void 0;
     if (!STAMPED_TYPES.has(event.type)) return event;
-    if (owner === UNKNOWN) return this.privateSeen ? this.withhold(event) : event;
+    if (owner === UNKNOWN2) return this.privateSeen ? this.withhold(event) : event;
     if (owner === null) return event;
     const stamped = {
       visibilityMode: owner.visibilityMode,
@@ -10029,7 +10179,7 @@ var TurnVisibilityStamp = class {
   }
   /** Readers every running background task's launching turn shares; `null` when none runs. */
   runningOwner() {
-    if (this.runningOverflow) return UNKNOWN;
+    if (this.runningOverflow) return UNKNOWN2;
     let owner = null;
     for (const taskOwner of this.running.values()) owner = intersect(owner, taskOwner);
     return owner;
@@ -10040,7 +10190,7 @@ var TurnVisibilityStamp = class {
   }
   /** An owner that is unknown is not remembered, so the id stays unknown. */
   remember(map, id, owner) {
-    if (owner !== UNKNOWN) map.set(id, owner);
+    if (owner !== UNKNOWN2) map.set(id, owner);
   }
   withhold(event) {
     this.withheldCount += 1;
@@ -13233,13 +13383,33 @@ function userGitconfigsToInclude(managedGitconfigPath) {
   }
   return found;
 }
+function userCaInfoPath() {
+  const home = process.env.HOME || homedir();
+  if (!home) return void 0;
+  const xdg = process.env.XDG_CONFIG_HOME;
+  const xdgDir = xdg && isAbsolute(xdg) ? xdg : join(home, ".config");
+  let found;
+  for (const userPath of [join(xdgDir, "git", "config"), join(home, ".gitconfig")]) {
+    if (!existsSync(userPath)) continue;
+    const res = portableSpawnSync(
+      ["git", "config", "--file", userPath, "--type=path", "--get", "http.sslCAInfo"],
+      { timeoutMs: 5e3 }
+    );
+    const value = res.exitCode === 0 ? res.stdout.trim() : "";
+    if (value && isAbsolute(value)) found = value;
+  }
+  return found;
+}
 function setupManagedGitconfig(projectDir, serverLog, includeInHome) {
   const managedGitconfigPath = join(resolve(projectDir), ".skaile", "managed-gitconfig");
   process.env.GIT_CONFIG_GLOBAL = managedGitconfigPath;
+  const userCaInfo = userCaInfoPath();
+  if (userCaInfo) process.env[TRUSTED_GIT_CA_ENV] = userCaInfo;
   try {
     writeUserGitconfigInclude({
       gitconfigPath: managedGitconfigPath,
-      userGitconfigPaths: includeInHome ? void 0 : userGitconfigsToInclude(managedGitconfigPath)
+      userGitconfigPaths: includeInHome ? void 0 : userGitconfigsToInclude(managedGitconfigPath),
+      userCaInfo
     });
   } catch (err) {
     serverLog.warn("failed to write managed-gitconfig \u2014 the agent's git has no global config", {
@@ -13835,7 +14005,8 @@ async function startAgentServer(opts) {
   const supportedRuntimeFeatures = [
     ...managedHost ? ["codex-app-server-v1"] : [],
     PLATFORM_BLOCKS_RUNTIME_FEATURE,
-    TURN_VISIBILITY_RUNTIME_FEATURE
+    TURN_VISIBILITY_RUNTIME_FEATURE,
+    TURN_IDS_RUNTIME_FEATURE
   ];
   let managedBootstrapClosed = false;
   const port = opts.port ?? 8080;
@@ -13933,6 +14104,7 @@ async function startAgentServer(opts) {
   const turnTaps = /* @__PURE__ */ new Set();
   const eventGapBuffer = new EventGapBuffer();
   const turnVisibility = new TurnVisibilityStamp();
+  const turnIds = new TurnIdStamp();
   const initLessRunner = !managedHost && (wsConfig.secrets?.provider ?? "env") === "env";
   let clientEverConnected = false;
   transport.onConnect(() => {
@@ -13940,8 +14112,11 @@ async function startAgentServer(opts) {
   });
   function sendEvent(event, opts2) {
     const stamped = turnVisibility.stamp(event, opts2);
-    if (stamped) deliverEvent(stamped);
-    else log(`[serve] withheld a ${event.type} event: its readers are unknown`);
+    if (stamped) deliverEvent(turnIds.stamp(stamped));
+    else {
+      turnIds.stamp(event);
+      log(`[serve] withheld a ${event.type} event: its readers are unknown`);
+    }
     return stamped !== null;
   }
   function deliverEvent(event) {
@@ -14035,7 +14210,7 @@ async function startAgentServer(opts) {
           input,
           invokedBy: "agent"
         });
-        if (invoked) transport.send(invoked);
+        if (invoked) transport.send(turnIds.stamp(invoked));
         else finish(new Error(`Capability ${name} refused: its readers are unknown`));
       } catch (error) {
         finish(error);
@@ -14720,7 +14895,8 @@ async function startAgentServer(opts) {
     log,
     logPhase,
     turnEnd: turnEndContract,
-    turnVisibility
+    turnVisibility,
+    turnIds
   });
   agentLoop = createAgentLoop({
     notReady: () => {
@@ -14755,6 +14931,7 @@ async function startAgentServer(opts) {
         harness.removeAllListeners("reconfigure-rollback");
         harness.kill();
         turnVisibility.observeHarnessEvent({ type: "background_tasks_reset" });
+        turnIds.observeHarnessEvent({ type: "background_tasks_reset" });
       } catch (err) {
         log(
           `[serve] failed to retire previous harness: ${err instanceof Error ? err.message : String(err)}`
@@ -14883,6 +15060,7 @@ async function startAgentServer(opts) {
               event
             );
             turnVisibility.observeHarnessEvent(event);
+            turnIds.observeHarnessEvent(event);
             const normalized = normalizer.normalize(event);
             const turnEnded = event.type === "agent_end";
             for (const e of normalized) {
@@ -16100,7 +16278,8 @@ async function startAgentServer(opts) {
       toolAllowlist: cmd.toolAllowlist,
       platformBlocks: cmd.platformBlocks,
       owner: { senderId: cmd.senderId, messageId: cmd.messageId },
-      visibility
+      visibility,
+      turnId: turnIdOf(cmd)
     });
   }
   async function runChatPrompt(input) {
@@ -16112,6 +16291,7 @@ async function startAgentServer(opts) {
     const outcome = await turnScheduler.prompt({
       owner: input.owner,
       visibility: input.visibility ?? null,
+      turnId: input.turnId ?? null,
       ...input.onStart ? { onStart: input.onStart } : {},
       ...input.isAborted ? { cancelled: input.isAborted } : {},
       // The turn ahead may be paused on a question it can only leave through
@@ -16251,6 +16431,7 @@ async function startAgentServer(opts) {
       answer: escapeReservedPlatformTags(cmd.answer),
       question: cmd.question,
       requestId: cmd.requestId,
+      turnId: turnIdOf(cmd),
       // Tells every other attached client the question is answered, so none
       // keeps a stale question card or a shut status gate.
       onAnswered: () => sendEvent({
@@ -16932,5 +17113,5 @@ function touchSession(state) {
 }
 
 export { AgentRunError, CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, CompileManifestEntrySchema, CompositionError, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, DEFAULT_MAX_FINISHED_TREES, DEFAULT_RUN_LIMITS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MOUNT_WRITE_MAX_CHUNK_BYTES, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, UnknownCompositionKindError, WRITE_RANGE_PARTIAL_TTL_MS, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildCompositionRunSnapshot, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildRunnerAgentSections, buildStoreSnapshotReplay, builtinCapabilities, canonicalJson, capabilityLogInstance, capabilitySignatureInputs, clearPreInitRingSink, clearSession, compileComposition, compositionRunSnapshotPath, computeCapabilitySignature, computeDirectoryTotals, computeRevisionHash, connectorRefreshKind, createAgentSession, createCompositionContentSource, createFinalTextFallback, createFlowConnectorReadiness, createInMemoryRunStore, createManagedCodexSubpromptHarness, createRunController, createSessionStimulusBus, defineCapability, deleteSession, describeComposition, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowStartNeedsHarnessRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, harnessActiveAfterTurnEnd, hasNonTerminalFlow, hashAgentFiles, hashContent, hostOpResumeStimulus, installPreInitRingSink, instanceForSession, instanceSessionOverrides, isCompilePinCurrent, isCompositionError, isEmptyKnowledgeIndex, isSessionRootPathAllowed, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadCompositionRunSnapshot, loadKnowledgeDir, loadManagedCodexHostConfig, loadSession, loadSessionById, logConnectorReport, manifestModelForHarness, mcpAuthSecretKey, modelForHarness, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, reconnectedRunNeedsAgentTurn, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentInstance, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveInstanceAgentDir, resolveMixin, resolveSessionId, restoredRunHasWorkToResume, runAgentChat, saveCompositionRunSnapshot, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, stripFrontmatter, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, unresolvedCredentialNotices, validateInputResponse, verifyConventionItems, writeClaudeCodeCredentialsFile, writeRangeChunk, writeRangePartialPath };
-//# sourceMappingURL=chunk-PBEDRYHP.js.map
-//# sourceMappingURL=chunk-PBEDRYHP.js.map
+//# sourceMappingURL=chunk-FO2GU5L7.js.map
+//# sourceMappingURL=chunk-FO2GU5L7.js.map