@tangle-network/sdk-provider-cli-base 0.0.0-stage → 0.12.0

package/dist/index.mjs

@@ -0,0 +1,4394 @@
+import { DEFAULT_INTERACTION_DECISION_TIMEOUT_MS as PERMISSION_DECISION_TIMEOUT_MS, InteractionBroker, InteractionBroker as InteractionBroker$1, InteractionHttpBridge, brokerInteractionTools, brokerInteractionTools as brokerInteractionTools$1 } from "@tangle-network/agent-core/interactions";
+import { BridgeClosedError, InvalidAttachmentError, JsonRpcError, RpcRequestTimeoutError, execCli, launchCliProcess, resolveRawCapturePath, spawnCliProcess, spawnRpcBridge } from "@tangle-network/sdk-cli-runner";
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { AgentExecutionError, AgentExecutionOutcomeSchema, AgentRuntimeAttachmentsSchema, InteractionExecutionBindingSchema, InteractionKind, REASONING_EFFORTS, agentProfileSchema, nativeReasoningControl, normalizeInputParts } from "@tangle-network/agent-interface";
+import { UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, applyWorkspacePlanWithSecretProvider, bindLaunchToolBinDirs, enforceWorkspacePlanSupport, ensurePublicConcurrentProfileRoots, joinSystemPromptAdditions, keepsHarnessSystemPrompt, materializeProfile, modelIdsMatch, parseSandboxToolBinDirs, preparePublicConcurrentProfileRevision, prepareSecretConcurrentProfileRevision, resolveAgentProfileResources } from "@tangle-network/agent-profile-materialize";
+import { HarnessSessionContractError, assertArgvHonoursSessionContract, assertFlagsHonourSessionContract, assertStoreLocationHonoursSessionContract, compileSessionStoreGlob } from "@tangle-network/cli-agent-registry/session-contract";
+import { MAX_SECRET_PROFILE_REPLAY_CHARS, RESTORED_SESSION_CONTEXT_PREAMBLE, RESTORED_SESSION_CONTEXT_TAG, buildCompleteForkContextBlock, buildForkContextBlock, createMessageStore, createSessionStore, forkSessionWithMessages, readProviderMessageIds } from "@tangle-network/sdk-session-persistence";
+import { mkdir, open, readdir, writeFile } from "node:fs/promises";
+import path, { basename, isAbsolute, normalize, resolve } from "node:path";
+import fs, { constants, lstatSync, readFileSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { isDeepStrictEqual, promisify } from "node:util";
+import { messageStorageDirOf } from "@tangle-network/cli-agent-registry";
+import { HARNESS_CONFORMANCE_PENDING, NATIVE_SESSION_CONTRACTS, configDirHomeEnv } from "@tangle-network/cli-agent-registry/native-session-contracts";
+import { z } from "zod";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { StringDecoder } from "node:string_decoder";
+import { DEFAULT_INTERACTION_MCP_SERVER_NAME, InteractionMcpServer as InteractionMcpServer$1, interactionMcpToolName } from "@tangle-network/agent-core/interactions/mcp";
+//#region src/acp-process-launch.ts
+/** Spawn an ACP agent over NDJSON stdio. The adapter owns abort, so no signal. */
+function spawnAcpBridge(request) {
+	return spawnRpcBridge({
+		...request,
+		maxStderrBytes: 65536
+	});
+}
+/**
+* A JSON-RPC error with the cause the agent put in `data`: hermes sends
+* `data.details`, codex-acp `data.message`.
+*/
+function jsonRpcErrorText(err) {
+	const data = err.data && typeof err.data === "object" ? err.data : void 0;
+	const cause = [data?.details, data?.message].find((value) => typeof value === "string" && value.length > 0);
+	return cause && cause !== err.message ? `${err.message}: ${cause}` : err.message;
+}
+/**
+* Overlay the agent environment on an ACP process env, dropping unset keys. An
+* absent env means the inherited one, which the overlay then starts from.
+*/
+function withAgentEnvironment(env, agent) {
+	if (Object.keys(agent).length === 0) return env;
+	const merged = {};
+	for (const [key, value] of Object.entries(env ?? process.env)) if (value !== void 0) merged[key] = value;
+	for (const [key, value] of Object.entries(agent)) if (value !== void 0) merged[key] = value;
+	return merged;
+}
+//#endregion
+//#region src/acp-protocol.ts
+/** The ACP protocol version this client speaks, and the oldest it accepts. */
+const ACP_PROTOCOL_VERSION = 1;
+const ACP_MIN_PROTOCOL_VERSION = 1;
+/** Text carried by ACP content blocks, including tool-call content. */
+function acpContentText(content) {
+	if (!content) return "";
+	const blocks = Array.isArray(content) ? content : [content];
+	const parts = [];
+	for (const block of blocks) {
+		if (!block || typeof block !== "object") continue;
+		if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
+		else if (block.type === "content" && block.content?.type === "text" && typeof block.content.text === "string") parts.push(block.content.text);
+	}
+	return parts.join("");
+}
+/** Map an ACP stop reason onto a turn status. */
+function mapAcpStopReason(reason) {
+	switch (reason) {
+		case "end_turn": return { status: "completed" };
+		case "max_tokens": return {
+			status: "completed",
+			detail: "Stopped at max tokens (output may be truncated)"
+		};
+		case "max_turn_requests": return {
+			status: "failed",
+			detail: "Hit max turn-requests limit"
+		};
+		case "refusal": return {
+			status: "failed",
+			detail: "Agent refused the request"
+		};
+		case "cancelled": return {
+			status: "failed",
+			detail: "Cancelled"
+		};
+		default: return {
+			status: "failed",
+			detail: `Unknown stop reason: ${reason ?? "<missing>"}`
+		};
+	}
+}
+//#endregion
+//#region src/reasoning-parts.ts
+/**
+* Assigns a stable part id and an append-only delta to a reasoning block
+* emission, absorbing provider replay/growth patterns:
+*
+* - text exactly matches an already-tracked block → `null` (duplicate
+*   delivery, e.g. a final assistant message replaying streamed content —
+*   emit nothing). Byte-identical distinct blocks therefore dedupe to one
+*   part; safer than duplicate-part spam.
+* - text extends the most recent block → same part id, delta = the suffix
+*   (cumulative re-emission of a growing block).
+* - otherwise → a new block: fresh part id, delta = the full text, so
+*   consumers can be pure appenders (prev text for a fresh id is empty).
+*/
+function trackReasoningBlock(state, blockText) {
+	if (blockText === "") return null;
+	state.reasoningParts ??= [];
+	const parts = state.reasoningParts;
+	if (parts.some((p) => p.text === blockText)) return null;
+	const last = parts[parts.length - 1];
+	if (last && last.text !== "" && blockText.startsWith(last.text)) {
+		const delta = blockText.slice(last.text.length);
+		last.text = blockText;
+		return {
+			partId: last.id,
+			text: blockText,
+			delta,
+			isNewBlock: false
+		};
+	}
+	const id = randomUUID();
+	parts.push({
+		id,
+		text: blockText
+	});
+	return {
+		partId: id,
+		text: blockText,
+		delta: blockText,
+		isNewBlock: true
+	};
+}
+//#endregion
+//#region src/stream-parts.ts
+/**
+* The text, reasoning and tool part emissions every stream-json harness
+* shares. A provider's event mapper decodes its own wire shape, then calls
+* these so part ids, buffers, tool timing and processing phases stay one
+* implementation across claude-code, codex, kimi, amp and factory-droids.
+*/
+/**
+* Records the CLI's native session id on the turn and announces it: the
+* generic `session.updated` plus the provider-attributed observation the
+* turn observer keys evidence on.
+*/
+function sessionObservedEvents(state, provider, sessionId) {
+	state.sessionId = sessionId;
+	return [{
+		type: "session.updated",
+		sessionId
+	}, {
+		type: "native.session.observed",
+		provider,
+		nativeSessionId: sessionId
+	}];
+}
+/** Correlation fields every emitted part carries. */
+function streamPartBase(state, partId) {
+	return {
+		id: partId ?? randomUUID(),
+		sessionID: state.sessionId ?? "",
+		messageID: state.messageId ?? ""
+	};
+}
+function textPartEvent(state, delta) {
+	state.textPartId ??= randomUUID();
+	return {
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, state.textPartId),
+			type: "text",
+			text: state.textBuffer
+		},
+		delta
+	};
+}
+/**
+* Appends a text delta to the turn's single text part. The first text of a
+* turn also signals the `generating` phase.
+*/
+function textDeltaEvents(state, delta) {
+	const first = state.textBuffer.length === 0;
+	state.textBuffer += delta;
+	const update = textPartEvent(state, delta);
+	return first ? [{
+		type: "model-processing",
+		phase: "generating"
+	}, update] : [update];
+}
+/** The whole reply as one text part, for harnesses that do not stream. */
+function finalTextEvent(state, text) {
+	state.textBuffer = text;
+	return textPartEvent(state, text);
+}
+/**
+* Applies a cumulative text frame (the whole assistant text so far). Only the
+* suffix past the buffer is emitted; a frame that does not extend the buffer
+* replaces it and is emitted whole.
+*/
+function textSnapshotEvents(state, text) {
+	const delta = text.startsWith(state.textBuffer) ? text.slice(state.textBuffer.length) : text;
+	if (!delta) return [];
+	state.textBuffer = text;
+	return [textPartEvent(state, delta)];
+}
+/**
+* Records a thinking block under a stable part id (see trackReasoningBlock).
+* With `signalPhase`, the turn's first block also signals `thinking`.
+*/
+function reasoningEvents(state, thinking, options) {
+	const tracked = trackReasoningBlock(state, thinking);
+	if (!tracked) return [];
+	if (tracked.isNewBlock) state.reasoningBuffer.push(tracked.text);
+	else state.reasoningBuffer[state.reasoningBuffer.length - 1] = tracked.text;
+	const update = {
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, tracked.partId),
+			type: "reasoning",
+			text: tracked.text
+		},
+		delta: tracked.delta
+	};
+	return options.signalPhase && tracked.isNewBlock && state.reasoningBuffer.length === 1 ? [{
+		type: "model-processing",
+		phase: "thinking"
+	}, update] : [update];
+}
+/** Registers a running tool call and emits its running part. */
+function toolStartEvents(state, call) {
+	const now = Date.now();
+	state.toolCalls.set(call.id, {
+		id: call.id,
+		name: call.name,
+		input: call.input,
+		startTime: now,
+		status: "running"
+	});
+	const toolState = {
+		status: "running",
+		input: call.input ?? {},
+		time: { start: now }
+	};
+	return [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, call.id),
+			type: "tool",
+			callID: call.id,
+			tool: call.name,
+			state: toolState
+		}
+	}];
+}
+/**
+* Completes a tracked tool call. A successful result emits `afterSuccess`
+* (file parts the provider detected) and then the `tool-result` phase. A
+* result for an untracked call is a warning.
+*/
+function toolResultEvents(state, result) {
+	const toolCall = state.toolCalls.get(result.id);
+	if (!toolCall) return [{
+		type: "warning",
+		code: "UNKNOWN_TOOL_RESULT",
+		message: `Received result for unknown tool call: ${result.id}`
+	}];
+	toolCall.status = result.isError ? "failed" : "completed";
+	toolCall.output = result.content;
+	const now = Date.now();
+	const input = toolCall.input ?? {};
+	const time = {
+		start: toolCall.startTime,
+		end: now
+	};
+	const metadata = result.metadata ? { metadata: result.metadata } : {};
+	const toolState = result.isError ? {
+		status: "failed",
+		input,
+		error: typeof result.content === "string" ? result.content : void 0,
+		output: result.content,
+		...metadata,
+		time
+	} : {
+		status: "completed",
+		input,
+		output: result.content,
+		...metadata,
+		time
+	};
+	const events = [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, result.id),
+			type: "tool",
+			callID: result.id,
+			tool: toolCall.name,
+			state: toolState
+		}
+	}];
+	if (!result.isError) events.push(...result.afterSuccess?.(toolCall) ?? [], {
+		type: "model-processing",
+		phase: "tool-result",
+		toolName: toolCall.name,
+		elapsedMs: now - toolCall.startTime
+	});
+	return events;
+}
+//#endregion
+//#region src/acp-session-updates.ts
+/** An agent message or thought chunk: text extends the message part, thought joins reasoning. */
+function acpMessageChunkEvents(kind, update, state) {
+	const text = acpContentText(update.content);
+	if (!text) return [];
+	if (kind === "agent_message_chunk") return textDeltaEvents(state, text);
+	state.reasoningBuffer.push(text);
+	return [];
+}
+/** A new tool call: recorded as running and reported as its tool part. */
+function acpToolCallEvents(update, state) {
+	const call = update;
+	const name = call.title ?? call.kind ?? "tool";
+	return toolStartEvents(state, {
+		id: call.toolCallId,
+		name,
+		input: call.rawInput
+	});
+}
+/**
+* Fold one tool_call_update into the call's record. Tool output arrives as
+* content blocks; rawOutput is the fallback. Returns the update's text output.
+*/
+function applyAcpToolCallUpdate(existing, mapped, change) {
+	const outputText = acpContentText(change.content);
+	if (mapped === "running" && outputText) existing.output = typeof existing.output === "string" ? existing.output + outputText : outputText;
+	existing.status = mapped;
+	if (mapped === "completed" || mapped === "failed") {
+		if (outputText) existing.output = typeof existing.output === "string" && existing.output.length > 0 ? existing.output + outputText : outputText;
+		else if (change.rawOutput !== void 0) existing.output = change.rawOutput;
+	}
+	return outputText;
+}
+/** The events a call's current record reports: its settled result, or its open part. */
+function acpToolCallUpdateEvents(existing, state) {
+	if (existing.status === "completed" || existing.status === "failed") return toolResultEvents(state, {
+		id: existing.id,
+		content: existing.output,
+		isError: existing.status === "failed"
+	});
+	const input = existing.input ?? {};
+	return [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, existing.id),
+			type: "tool",
+			tool: existing.name,
+			callID: existing.id,
+			state: existing.status === "running" ? {
+				status: "running",
+				input,
+				time: { start: existing.startTime }
+			} : {
+				status: "pending",
+				input
+			}
+		}
+	}];
+}
+/**
+* Plan entries are the agent's step list. Fold their text into the
+* reasoning record, bounded per notification and per turn so a
+* misbehaving agent cannot grow turn memory or storage without limit.
+*/
+function acpPlanEvents(update, state, provider) {
+	const MAX_ENTRIES_PER_UPDATE = 256;
+	const MAX_REASONING_ENTRIES_PER_TURN = 1024;
+	const MAX_ENTRY_LENGTH = 8 * 1024;
+	const raw = update.entries;
+	const entries = (Array.isArray(raw) ? raw : []).slice(0, MAX_ENTRIES_PER_UPDATE);
+	for (const entry of entries) {
+		if (state.reasoningBuffer.length >= MAX_REASONING_ENTRIES_PER_TURN) break;
+		if (typeof entry.content === "string" && entry.content.length > 0) state.reasoningBuffer.push(entry.content.slice(0, MAX_ENTRY_LENGTH));
+	}
+	return [{
+		type: "raw",
+		backend: provider,
+		event: {
+			sessionUpdate: "plan",
+			entries
+		}
+	}];
+}
+//#endregion
+//#region src/provider-config.ts
+/**
+* Render a value as a digest that does not change with key order. The type
+* parameter keeps the caller's own type at the call site, so the digest of a
+* configuration cannot silently accept a value of an unrelated shape.
+*/
+function stableSerialize(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (Number.isNaN(value)) return "number:NaN";
+		if (Object.is(value, -0)) return "number:-0";
+		return `number:${value}`;
+	}
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "bigint") return `bigint:${value.toString()}`;
+	if (Array.isArray(value)) return `[${value.map((entry) => stableSerialize(entry)).join(",")}]`;
+	if (typeof value === "object") return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
+	return `${typeof value}:${String(value)}`;
+}
+function cloneConfig(config) {
+	return structuredClone(config);
+}
+function isInteractionObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeCliProviderConfig(current, next) {
+	const merged = {
+		...current,
+		...next
+	};
+	const currentInteractions = current.interactions;
+	const nextInteractions = next.interactions;
+	if (isInteractionObject(currentInteractions) && isInteractionObject(nextInteractions)) merged.interactions = {
+		...currentInteractions,
+		...nextInteractions
+	};
+	return merged;
+}
+//#endregion
+//#region src/adapter-initialization.ts
+/**
+* The in-flight and settled initialization of one adapter, and the pending
+* shutdown: which `initialize()` call is current, which configuration it
+* carries, and the generation that a `shutdown()` bumps to cancel it.
+*/
+var InitializationTracker = class {
+	generation = 0;
+	promise = null;
+	configKey = null;
+	cancellation = null;
+	initializedConfigKey = null;
+	shutdownPromise;
+	providerTails = /* @__PURE__ */ new Set();
+	constructor(provider) {
+		this.provider = provider;
+	}
+	assertCurrent(generation, cancellation) {
+		if (generation !== this.generation || cancellation.cancelled) throw new Error(`${this.provider()} provider initialization cancelled by shutdown`);
+	}
+	/** Forget `promise` once it settles, unless a newer one replaced it. */
+	clear(promise) {
+		if (this.promise !== promise) return;
+		this.promise = null;
+		this.configKey = null;
+		this.cancellation = null;
+	}
+	/** Cancel the in-flight initialization and invalidate its generation. */
+	cancel() {
+		this.generation += 1;
+		if (this.cancellation) this.cancellation.cancelled = true;
+		this.promise = null;
+		this.configKey = null;
+		this.cancellation = null;
+		this.initializedConfigKey = null;
+	}
+};
+/**
+* The adapter configuration an `initialize()` call produces: the initial
+* configuration overlaid with the host's runtime values. Throws when a
+* trusted-path or identity value is malformed.
+*/
+function overlayProviderConfig(provider, initialConfig, config) {
+	const nextConfig = cloneConfig(initialConfig);
+	const runtimeAttachments = config.runtimeAttachments;
+	if (runtimeAttachments !== void 0) nextConfig.runtimeAttachments = structuredClone(runtimeAttachments);
+	const runtimeSecrets = config.runtimeSecrets;
+	if (runtimeSecrets !== void 0) nextConfig.runtimeSecrets = { ...runtimeSecrets };
+	const runtimeHome = config.runtimeHome;
+	if (runtimeHome !== void 0) {
+		if (typeof runtimeHome !== "string" || !path.isAbsolute(runtimeHome)) throw new Error(`${provider} runtimeHome must be an absolute filesystem path`);
+		nextConfig.runtimeHome = runtimeHome;
+	}
+	const agentHome = config.agentHome;
+	if (agentHome !== void 0) {
+		if (typeof agentHome !== "string" || !path.isAbsolute(agentHome)) throw new Error(`${provider} agentHome must be an absolute filesystem path`);
+		nextConfig.agentHome = agentHome;
+	}
+	const subprocessUser = config.subprocessUser;
+	if (subprocessUser !== void 0) {
+		if (process.getuid?.() !== 0 || !Number.isSafeInteger(subprocessUser.uid) || subprocessUser.uid <= 0 || !Number.isSafeInteger(subprocessUser.gid) || subprocessUser.gid <= 0) throw new Error(`${provider}: invalid trusted subprocess identity`);
+		nextConfig.subprocessUser = { ...subprocessUser };
+		if (config.stableIsolatedIdentity === true) nextConfig.stableIsolatedIdentity = true;
+	}
+	const publicProfileRevisionRoot = config.publicProfileRevisionRoot;
+	if (publicProfileRevisionRoot !== void 0) {
+		if (typeof publicProfileRevisionRoot !== "string" || !path.isAbsolute(publicProfileRevisionRoot)) throw new Error(`${provider} publicProfileRevisionRoot must be an absolute filesystem path`);
+		nextConfig.publicProfileRevisionRoot = publicProfileRevisionRoot;
+	}
+	const privateRevision = config;
+	if (privateRevision.secretProfileRevisionRoot !== void 0 || privateRevision.secretProfileNamingKeyPath !== void 0) {
+		if (!subprocessUser || publicProfileRevisionRoot !== void 0 || !privateRevision.secretProfileRevisionRoot || !path.isAbsolute(privateRevision.secretProfileRevisionRoot) || !privateRevision.secretProfileNamingKeyPath || !path.isAbsolute(privateRevision.secretProfileNamingKeyPath)) throw new Error(`${provider}: invalid secret profile revision root`);
+		nextConfig.secretProfileRevisionRoot = privateRevision.secretProfileRevisionRoot;
+		nextConfig.secretProfileNamingKeyPath = privateRevision.secretProfileNamingKeyPath;
+	}
+	const sandboxedRuntime = config.sandboxedRuntime;
+	if (sandboxedRuntime !== void 0) nextConfig.sandboxedRuntime = sandboxedRuntime === true;
+	const nativeAuthEnv = config.nativeAuthEnv;
+	if (nativeAuthEnv !== void 0) {
+		nextConfig.nativeAuthEnv = { ...nativeAuthEnv };
+		nextConfig.nativeAuthSecretEnv = config.nativeAuthSecretEnv;
+	}
+	if (config.model?.model !== void 0) nextConfig.model = config.model.model;
+	if (config.model?.provider !== void 0) nextConfig.provider = config.model.provider;
+	if (config.model?.apiKey !== void 0) nextConfig.apiKey = config.model.apiKey;
+	if (config.model?.baseUrl !== void 0) nextConfig.baseUrl = config.model.baseUrl;
+	if (config.model?.authMode !== void 0) nextConfig.authMode = config.model.authMode;
+	if (config.model?.authFiles !== void 0) nextConfig.authFiles = config.model.authFiles.map((file) => ({ ...file }));
+	return nextConfig;
+}
+//#endregion
+//#region src/execution-lifecycle.ts
+const lifecycles = /* @__PURE__ */ new WeakMap();
+function executionLifecycle(owner) {
+	let lifecycle = lifecycles.get(owner);
+	if (!lifecycle) {
+		lifecycle = {
+			inFlightExecutions: /* @__PURE__ */ new Set(),
+			shuttingDown: false
+		};
+		lifecycles.set(owner, lifecycle);
+	}
+	return lifecycle;
+}
+function beginExecution(owner, callerAbortSignal) {
+	const lifecycle = executionLifecycle(owner);
+	if (lifecycle.shuttingDown) throw new Error(`${owner.provider} provider is shutting down`);
+	let resolveSettled;
+	const execution = {
+		controller: new AbortController(),
+		settled: new Promise((resolve) => {
+			resolveSettled = resolve;
+		}),
+		resolveSettled: () => resolveSettled()
+	};
+	lifecycle.inFlightExecutions.add(execution);
+	if (callerAbortSignal) {
+		const abortFromCaller = () => execution.controller.abort();
+		execution.callerAbortSignal = callerAbortSignal;
+		execution.callerAbortListener = abortFromCaller;
+		if (callerAbortSignal.aborted) execution.controller.abort();
+		else callerAbortSignal.addEventListener("abort", abortFromCaller, { once: true });
+	}
+	return execution;
+}
+function finishExecution(owner, execution) {
+	executionLifecycle(owner).inFlightExecutions.delete(execution);
+	if (execution.callerAbortSignal && execution.callerAbortListener) execution.callerAbortSignal.removeEventListener("abort", execution.callerAbortListener);
+	execution.resolveSettled();
+}
+//#endregion
+//#region src/writable-home.ts
+/**
+* The nearest ancestor of `target` that exists, or null when even the root of
+* the path is absent. A directory that does not exist yet is usable only if
+* something above it can be written to, so the writability question always
+* resolves against an ancestor that is really there.
+*/
+function nearestExistingAncestor(target) {
+	let current = path.resolve(target);
+	for (;;) {
+		if (fs.existsSync(current)) return current;
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+/**
+* True when a CLI can create and write `target`.
+*
+* A read-only mount is the case this exists for: the shared tool-cache root is
+* mounted read-only with only named subdirectories bound read-write, so a path
+* under it that has no bind mount refuses `mkdir` with `EROFS`. A CLI that
+* creates its cache directory at startup then dies before it runs, and a
+* caller waiting on that run observes silence, not an error.
+*
+* The check reads permissions and never creates anything. Creating the
+* directory here would run as the sidecar's own user and leave a directory the
+* agent user cannot write, which trades one unusable path for another.
+*
+* A directory the calling process may write but the agent subprocess may not
+* still reads as usable. Ownership is the spawn layer's concern; this answers
+* the mount-level question that silently kills a CLI.
+*/
+function isWritableTarget(target) {
+	const ancestor = nearestExistingAncestor(target);
+	if (!ancestor) return false;
+	try {
+		fs.accessSync(ancestor, fs.constants.W_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** `/root` belongs to the calling process, never to the agent subprocess. */
+const READ_ONLY_ROOT_HOME = "/root";
+function isRootHomePath(value) {
+	return value === READ_ONLY_ROOT_HOME || value.startsWith(`${READ_ONLY_ROOT_HOME}/`);
+}
+/**
+* Whether an inherited path must not reach the CLI, given whether it can be
+* written. Two independent reasons, kept apart from the filesystem probe so
+* each is decidable on its own:
+*
+*   - It sits under `/root`. The agent subprocess runs as its own user, so
+*     that path is wrong even while the calling process can write there.
+*   - Nothing can create it. A read-only mount refuses `mkdir` for every user,
+*     including root.
+*/
+function shouldReplacePath(value, writable) {
+	return isRootHomePath(value) || !writable;
+}
+function mustReplace(value) {
+	return shouldReplacePath(value, isWritableTarget(value));
+}
+/**
+* Point `HOME` and the XDG directories at somewhere a CLI can actually write.
+*
+* An inherited value is kept whenever it is usable, so an operator can still
+* aim a cache at a large volume. An unusable value is replaced by the
+* equivalent path under the writable home, because keeping it only moves the
+* failure into the CLI, where it surfaces as a run that emits nothing.
+*/
+function applyWritableHomeDefaults(env, workspaceRoot) {
+	const next = { ...env };
+	const writableHome = next.SIDECAR_AGENT_HOME?.trim() || next.AGENT_WORKSPACE_ROOT?.trim() || workspaceRoot;
+	const currentHome = next.HOME?.trim();
+	const home = currentHome && !mustReplace(currentHome) ? currentHome : writableHome;
+	for (const [key, fallback] of Object.entries(homeXdgEnv(home))) {
+		const current = next[key]?.trim();
+		if (key === "HOME" || !current || mustReplace(current)) next[key] = fallback;
+	}
+	return next;
+}
+/** HOME and the XDG base directories a CLI resolves under it. */
+function homeXdgEnv(home) {
+	return {
+		HOME: home,
+		XDG_CONFIG_HOME: path.join(home, ".config"),
+		XDG_CACHE_HOME: path.join(home, ".cache"),
+		XDG_DATA_HOME: path.join(home, ".local", "share"),
+		XDG_STATE_HOME: path.join(home, ".local", "state")
+	};
+}
+//#endregion
+//#region src/adapter-lifecycle.ts
+const DEFAULT_CONTEXT_WINDOW = 2e5;
+const execFileAsync = promisify(execFile);
+/**
+* Console-based logger fallback.
+*/
+const consoleLogger = {
+	debug: (msg, meta) => console.debug(`[cli-provider] ${msg}`, meta ?? ""),
+	info: (msg, meta) => console.info(`[cli-provider] ${msg}`, meta ?? ""),
+	warn: (msg, meta) => console.warn(`[cli-provider] ${msg}`, meta ?? ""),
+	error: (msg, meta) => console.error(`[cli-provider] ${msg}`, meta ?? "")
+};
+/** Owns configuration, initialization, cancellation, and subprocess identity. */
+var CliAdapterLifecycle = class {
+	/**
+	* The message log directory when the caller names none. Unset, it is the
+	* registry spec's `messageStorageDir` for `provider`, the one source; only
+	* an adapter for a provider the registry does not know sets it.
+	*/
+	defaultStorageDir;
+	inheritProcessEnv = true;
+	config;
+	initialConfig;
+	logger;
+	sessionStore = null;
+	messageStore = null;
+	storagePath;
+	_storageDir;
+	agentEnvironment;
+	/** The consumer's executor for turn processes; a local spawn when absent. */
+	launcher;
+	/** Whether a turn's leftover process-group members are stopped at exit. */
+	ownProcessGroup;
+	initialized = false;
+	activeProcesses = /* @__PURE__ */ new Set();
+	initialization = new InitializationTracker(() => this.provider);
+	constructor(options = {}) {
+		executionLifecycle(this);
+		this.initialConfig = cloneConfig(options.config ?? {});
+		this.config = cloneConfig(this.initialConfig);
+		this.logger = options.logger ?? consoleLogger;
+		this.storagePath = options.storagePath ?? process.cwd();
+		this._storageDir = options.storageDir;
+		this.agentEnvironment = options.agentEnvironment;
+		this.launcher = options.launcher;
+		this.ownProcessGroup = options.ownProcessGroup ?? false;
+	}
+	/**
+	* Get the storage directory. Uses provided storageDir or falls back to defaultStorageDir.
+	*/
+	get storageDir() {
+		return this._storageDir ?? this.defaultStorageDir ?? messageStorageDirOf(this.provider);
+	}
+	/** Bind a live interaction to the exact provider execution that originated it. */
+	interactionExecutionBinding(input, sessionId) {
+		if (!input.interactionBinding) throw new Error(`${this.provider} interactions require AgentExecutionInput.interactionBinding`);
+		const binding = InteractionExecutionBindingSchema.parse(input.interactionBinding);
+		if (binding.provider !== this.provider) throw new Error(`Interaction binding provider "${binding.provider}" does not match adapter "${this.provider}"`);
+		if (binding.sessionId !== sessionId) throw new Error(`Interaction binding session "${binding.sessionId}" does not match adapter session "${sessionId}"`);
+		return binding;
+	}
+	/**
+	* The uid/gid every CLI process this adapter spawns runs as, or undefined
+	* when the host process is already unprivileged.
+	*
+	* This is an adapter-wide invariant, not a per-callsite option, because
+	* these CLIs seed their own state on first use — a sqlite database, a log
+	* directory, a downloaded-binary cache under the harness HOME. An auxiliary
+	* invocation left at root (`mcp add`, `mcp list`, `--version`) creates that
+	* tree root-owned, and the streamed run, which does drop privileges, then
+	* cannot open its own log and exits before emitting a single event.
+	*/
+	subprocessIdentity() {
+		const assigned = this.config.subprocessUser;
+		if (assigned) {
+			if (process.getuid?.() !== 0 || !Number.isSafeInteger(assigned.uid) || assigned.uid <= 0 || !Number.isSafeInteger(assigned.gid) || assigned.gid <= 0) throw new Error(`${this.provider}: invalid trusted subprocess identity`);
+			return assigned;
+		}
+		if (process.getuid?.() !== 0) return void 0;
+		const rawUid = process.env.AGENT_SUBPROCESS_UID ?? "1000";
+		const rawGid = process.env.AGENT_SUBPROCESS_GID ?? "1000";
+		const uid = Number(rawUid);
+		const gid = Number(rawGid);
+		if (!Number.isInteger(uid) || uid < 0 || !Number.isInteger(gid) || gid < 0) throw new Error(`${this.provider}: AGENT_SUBPROCESS_UID/AGENT_SUBPROCESS_GID must be non-negative integers (got ${rawUid}/${rawGid})`);
+		return {
+			uid,
+			gid
+		};
+	}
+	/** `subprocessIdentity` shaped for `spawn`'s options bag. */
+	subprocessSpawnOptions() {
+		return this.subprocessIdentity() ?? {};
+	}
+	/**
+	* Run a one-shot CLI command under this adapter's subprocess identity.
+	*
+	* Every auxiliary invocation an adapter makes goes through here so the
+	* identity cannot be forgotten at a call site. Auxiliary output stays out
+	* of the streamed turn's raw evidence.
+	*/
+	runCli(config) {
+		return execCli({
+			...config,
+			rawCapturePath: void 0,
+			...this.config.subprocessUser ? { isolatedIdentity: this.config.subprocessUser } : {},
+			spawnOptions: {
+				...this.subprocessSpawnOptions(),
+				...config.spawnOptions
+			}
+		});
+	}
+	/**
+	* Run a builtin-only Node script under this adapter's subprocess identity
+	* and return its stdout. File work inside a directory the CLI user owns goes
+	* through here, so a root sidecar never creates, reads or writes there with
+	* its own rights: a link the agent plants reaches only what the agent could
+	* already reach. The script reads `args` from argv after `--` and `input`
+	* from stdin. A failure carries the script's stderr, not the script text.
+	*/
+	async runNodeAsSubprocess(script, args, input = "") {
+		try {
+			const pending = execFileAsync(process.execPath, [
+				"-e",
+				script,
+				"--",
+				...args
+			], {
+				...this.subprocessSpawnOptions(),
+				cwd: "/",
+				env: {},
+				timeout: 3e4,
+				maxBuffer: 64 * 1024 * 1024
+			});
+			pending.child.stdin?.on("error", () => {});
+			pending.child.stdin?.end(input);
+			return (await pending).stdout;
+		} catch (error) {
+			const stderr = String(error.stderr ?? "").trim();
+			throw new Error((stderr || (error instanceof Error ? error.message : String(error))).slice(-500));
+		}
+	}
+	getCapabilities() {
+		return {
+			streaming: true,
+			toolUse: true,
+			reasoning: true,
+			multimodal: false,
+			contextWindow: DEFAULT_CONTEXT_WINDOW
+		};
+	}
+	initialize(config) {
+		const attachments = config.runtimeAttachments === void 0 ? void 0 : AgentRuntimeAttachmentsSchema.safeParse(config.runtimeAttachments);
+		if (attachments && !attachments.success) return Promise.reject(/* @__PURE__ */ new Error("Invalid runtime MCP attachments"));
+		const capturedConfig = attachments?.success ? {
+			...config,
+			runtimeAttachments: attachments.data
+		} : config;
+		const configKey = stableSerialize(capturedConfig);
+		if (this.initialization.promise) {
+			if (configKey === this.initialization.configKey) return this.initialization.promise;
+			return Promise.reject(/* @__PURE__ */ new Error(`${this.provider} provider cannot start a conflicting initialize() while initialization is in flight; concurrent calls must use the same configuration`));
+		}
+		if (this.initialized) {
+			if (configKey === this.initialization.initializedConfigKey) return Promise.resolve();
+			return Promise.reject(/* @__PURE__ */ new Error(`${this.provider} provider is already initialized with a different configuration; call shutdown() before reinitializing`));
+		}
+		const pendingShutdown = this.initialization.shutdownPromise;
+		const generation = this.initialization.generation;
+		const cancellation = { cancelled: false };
+		const initialization = Promise.resolve().then(async () => {
+			if (pendingShutdown) await pendingShutdown;
+			this.initialization.assertCurrent(generation, cancellation);
+			executionLifecycle(this).shuttingDown = false;
+			await this.initializeAtGeneration(capturedConfig, configKey, generation, cancellation);
+		});
+		this.initialization.promise = initialization;
+		this.initialization.configKey = configKey;
+		this.initialization.cancellation = cancellation;
+		initialization.then(() => this.initialization.clear(initialization), () => this.initialization.clear(initialization));
+		return initialization;
+	}
+	async initializeAtGeneration(config, configKey, generation, cancellation) {
+		this.initialization.assertCurrent(generation, cancellation);
+		const nextStoragePath = config.workspace?.rootPath || this.storagePath;
+		const nextConfig = overlayProviderConfig(this.provider, this.initialConfig, config);
+		const configuredProfile = config.profile ?? nextConfig.profile;
+		if (configuredProfile !== void 0) {
+			nextConfig.profile = await resolveAgentProfileResources(agentProfileSchema.parse(configuredProfile));
+			this.initialization.assertCurrent(generation, cancellation);
+		}
+		const contract = this.sessionContract();
+		if (contract) assertFlagsHonourSessionContract(this.provider, contract, nextConfig.extraFlags ?? [], "extraFlags");
+		const persistenceConfig = {
+			storagePath: nextStoragePath,
+			storageDir: this.storageDir
+		};
+		const nextSessionStore = createSessionStore(persistenceConfig);
+		const nextMessageStore = createMessageStore(persistenceConfig);
+		this.initialization.assertCurrent(generation, cancellation);
+		this.storagePath = nextStoragePath;
+		this.config = nextConfig;
+		this.sessionStore = nextSessionStore;
+		this.messageStore = nextMessageStore;
+		const providerTail = Promise.resolve().then(() => this.afterInitialize(config));
+		this.initialization.providerTails.add(providerTail);
+		try {
+			await providerTail;
+			this.initialization.assertCurrent(generation, cancellation);
+			this.initialized = true;
+			this.initialization.initializedConfigKey = configKey;
+		} catch (error) {
+			if (generation === this.initialization.generation) {
+				this.config = cloneConfig(this.initialConfig);
+				this.sessionStore = null;
+				this.messageStore = null;
+				this.initialized = false;
+				this.initialization.initializedConfigKey = null;
+			}
+			throw error;
+		} finally {
+			this.initialization.providerTails.delete(providerTail);
+		}
+		this.logger.info(`${this.provider} provider initialized`, {
+			storagePath: this.storagePath,
+			storageDir: this.storageDir,
+			model: this.config.model
+		});
+	}
+	/**
+	* Auth/config files the adapter needs on disk that do NOT arrive through
+	* `config.model.authFiles` — e.g. a synthesized `~/.openclaw/openclaw.json`
+	* pointing at the managed router. The sidecar materializes these through the
+	* hardened `materializeCliAuthFiles` path AFTER `initialize()`, so an adapter
+	* can derive them from the resolved config/env. Default: none.
+	*/
+	getManagedAuthFiles() {
+		return [];
+	}
+	/** Provider-specific initialization runs inside the tracked lifecycle. */
+	async afterInitialize(_config) {}
+	/**
+	* The harness session contract this adapter honours (cli-agent-registry
+	* NATIVE_SESSION_CONTRACTS), or null for a provider that declares none.
+	* Registration refuses a harness spec without one; ACP overrides this per
+	* sub-agent.
+	*/
+	sessionContract() {
+		return NATIVE_SESSION_CONTRACTS[this.provider] ?? null;
+	}
+	async shutdown() {
+		this.initialization.cancel();
+		this.initialized = false;
+		executionLifecycle(this).shuttingDown = true;
+		this.config = cloneConfig(this.initialConfig);
+		if (this.initialization.shutdownPromise) return this.initialization.shutdownPromise;
+		const executions = [...executionLifecycle(this).inFlightExecutions];
+		const processes = [...this.activeProcesses];
+		const providerInitializationTails = [...this.initialization.providerTails];
+		for (const execution of executions) execution.controller.abort();
+		const trackedShutdown = (async () => {
+			await Promise.allSettled([
+				...providerInitializationTails,
+				...processes.map((process) => terminateTurnProcess(process, this.activeProcesses)),
+				...executions.map((execution) => execution.settled)
+			]);
+			this.sessionStore = null;
+			this.messageStore = null;
+			executionLifecycle(this).shuttingDown = false;
+			this.logger.info(`${this.provider} provider shut down`);
+		})().finally(() => {
+			if (this.initialization.shutdownPromise === trackedShutdown) this.initialization.shutdownPromise = void 0;
+		});
+		this.initialization.shutdownPromise = trackedShutdown;
+		return trackedShutdown;
+	}
+	async healthCheck() {
+		try {
+			return (await this.runAuxiliaryCli(["--version"], 5e3)).exit.success;
+		} catch {
+			return false;
+		}
+	}
+	/** Run this CLI's own one-shot command (version, MCP) in the workspace. */
+	runAuxiliaryCli(args, timeoutMs) {
+		return this.runCli({
+			command: this.getCliPath(),
+			args,
+			cwd: this.storagePath,
+			env: this.applyWritableHomeDefaults(this.buildNativeExecutionEnvironment(this.config), this.storagePath),
+			inheritEnv: this.inheritProcessEnv,
+			timeoutMs
+		});
+	}
+	async updateConfig(config) {
+		const resolvedConfig = { ...config };
+		if (config.profile !== void 0) resolvedConfig.profile = await resolveAgentProfileResources(agentProfileSchema.parse(config.profile));
+		this.config = mergeCliProviderConfig(this.config, resolvedConfig);
+		return this.config;
+	}
+	/** Apply private native credentials to every CLI subprocess through one path. */
+	buildNativeExecutionEnvironment(config) {
+		const env = this.buildExecEnv(config);
+		if (config.nativeAuthSecretEnv) env[config.nativeAuthSecretEnv] = void 0;
+		return {
+			...env,
+			...config.nativeAuthEnv
+		};
+	}
+	getCliPath() {
+		return this.config.cliPath ?? this.defaultCliPath;
+	}
+	ensureInitialized() {
+		if (executionLifecycle(this).shuttingDown) throw new Error(`${this.provider} provider is shutting down`);
+		if (!this.initialized) throw new Error(`${this.provider} provider not initialized. Call initialize() first.`);
+	}
+	getSessionStore() {
+		if (!this.sessionStore) throw new Error("Session store not initialized");
+		return this.sessionStore;
+	}
+	getMessageStore() {
+		if (!this.messageStore) throw new Error("Message store not initialized");
+		return this.messageStore;
+	}
+	/** The agent environment the host supplied (CliProviderOptions.agentEnvironment). */
+	agentEnvironmentValues() {
+		return this.agentEnvironment?.() ?? {};
+	}
+	applyWritableHomeDefaults(adapterEnv, workspaceRoot) {
+		const env = {
+			...this.agentEnvironmentValues(),
+			...adapterEnv
+		};
+		const runtimeHome = this.config.runtimeHome?.trim();
+		if (!runtimeHome) return applyWritableHomeDefaults(env, workspaceRoot);
+		const agentHome = this.config.agentHome?.trim();
+		const configDir = agentHome ? configDirHomeEnv(this.provider, runtimeHome, agentHome) : void 0;
+		if (configDir) {
+			const adapterStores = Object.keys(configDir).flatMap((name) => {
+				if (name === "HOME" || name.startsWith("XDG_")) return [];
+				const value = adapterEnv[name]?.trim();
+				return value && value !== process.env[name] ? [[name, value]] : [];
+			});
+			return applyWritableHomeDefaults({
+				...env,
+				...configDir,
+				...Object.fromEntries(adapterStores)
+			}, workspaceRoot);
+		}
+		return applyWritableHomeDefaults({
+			...env,
+			...homeXdgEnv(runtimeHome)
+		}, workspaceRoot);
+	}
+};
+async function terminateTurnProcess(process, activeProcesses) {
+	process.kill();
+	const escalation = setTimeout(() => process.kill("SIGKILL"), 1e3);
+	escalation.unref();
+	try {
+		await process.exitPromise;
+	} finally {
+		clearTimeout(escalation);
+		activeProcesses.delete(process);
+	}
+}
+//#endregion
+//#region src/execution-request-headers.ts
+const headerValue = z.string().regex(/^[\x21-\x2b\x2d-\x7e]{1,256}$/);
+const CORRELATION_FIELDS = {
+	"X-Tangle-Environment-ID": "environmentId",
+	"X-Tangle-Session-ID": "sessionId",
+	"X-Tangle-Execution-ID": "executionId"
+};
+/** Router column that joins a model request to the turn trace that caused it. */
+const EXECUTION_TRACE_HEADER = "X-Tangle-Trace-ID";
+const MANAGED_QUOTE_VERSION_HEADER = "X-Tangle-Managed-Quote-Version";
+const managedQuoteVersion = z.string().regex(/^mmq_[a-f0-9]{40}$/);
+/**
+* Capture diagnostic identity without forwarding caller-supplied transport headers.
+* `traceId` is the turn's trace id; a value no header can carry is omitted,
+* because a trace is diagnostic and must never refuse the run.
+*/
+function executionCorrelationHeaders(binding, traceId, quoteVersion) {
+	const quote = quoteVersion === void 0 ? void 0 : managedQuoteVersion.parse(quoteVersion);
+	if (quote !== void 0 && binding === void 0) throw new Error("Managed quote requires an exact execution binding");
+	const trace = headerValue.safeParse(traceId);
+	const traced = trace.success ? { [EXECUTION_TRACE_HEADER]: trace.data } : {};
+	if (binding === void 0) return trace.success ? Object.freeze(traced) : void 0;
+	const headers = { ...traced };
+	if (quote !== void 0) headers[MANAGED_QUOTE_VERSION_HEADER] = quote;
+	for (const [name, field] of Object.entries(CORRELATION_FIELDS)) {
+		const value = headerValue.safeParse(binding[field]);
+		if (!value.success) throw new Error(`Execution correlation ${field} must contain 1–256 printable ASCII characters without spaces or commas`);
+		headers[name] = value.data;
+	}
+	return Object.freeze(headers);
+}
+//#endregion
+//#region src/profile-config.ts
+/**
+* Per-turn credential delivery wins over host-env resolution; the host box
+* environment stays the fallback for references the turn did not deliver.
+* With no turn secrets the host provider is returned unchanged, so the
+* overlay adds no behavior to executions that never asked for it.
+*/
+function runtimeSecretsOverlay(runtimeSecrets, fallback) {
+	if (!runtimeSecrets || Object.keys(runtimeSecrets).length === 0) return fallback;
+	return { get: async (key) => runtimeSecrets[key] ?? await fallback.get(key) };
+}
+function hasPortableProfileControls(profile) {
+	return profile.prompt !== void 0 || profile.model !== void 0 || profile.harness !== void 0 || profile.permissions !== void 0 || profile.tools !== void 0 || profile.mcp !== void 0 || profile.connections !== void 0 || profile.subagents !== void 0 || profile.resources !== void 0 || profile.hooks !== void 0 || profile.modes !== void 0 || profile.confidential !== void 0 || profile.extensions !== void 0;
+}
+function resolveSystemPrompt(requestPrompt, profilePrompt) {
+	if (profilePrompt === void 0) return requestPrompt;
+	if (requestPrompt !== void 0 && requestPrompt.length > 0 && requestPrompt !== profilePrompt) throw new Error("execution system prompt conflicts with the materialized AgentProfile");
+	return profilePrompt;
+}
+function profileForExecution(profile, requestPrompt) {
+	const profilePrompt = profile?.prompt?.systemPrompt;
+	if (!profile || profilePrompt === void 0 || requestPrompt === void 0 || requestPrompt.length === 0 || requestPrompt === profilePrompt) return profile;
+	if (!requestPrompt.startsWith(`${profilePrompt}\n\n`)) throw new Error("execution system prompt conflicts with the materialized AgentProfile");
+	return {
+		...profile,
+		prompt: {
+			...profile.prompt,
+			systemPrompt: requestPrompt
+		}
+	};
+}
+/**
+* Refuse to dispatch an execution against a model the profile did not
+* materialize — a caller must not silently get a different model than the one
+* the workspace was built for.
+*
+* The request and the profile carry the same model at different qualification
+* levels: the request is the id the caller sent, the profile default is that id
+* qualified with its provider. Both go through the one shared canonicalization
+* so only a genuinely different model is a conflict.
+*/
+function resolveModel(requestModel, profileModel, configuredModel, profileProvider) {
+	if (profileModel !== void 0 && requestModel !== void 0 && !modelIdsMatch(requestModel, profileModel, profileProvider)) throw new Error("execution model conflicts with the materialized AgentProfile");
+	return profileModel ?? requestModel ?? configuredModel;
+}
+//#endregion
+//#region src/profile-revision-receipts.ts
+/** Receipts belong to their adapter; they never become subclass controls. */
+var ProfileRevisionReceipts = class {
+	publicProfileRevisionReceipts = /* @__PURE__ */ new WeakMap();
+	secretProfileRevisionReceipts = /* @__PURE__ */ new WeakMap();
+};
+const receiptsByAdapter = /* @__PURE__ */ new WeakMap();
+function profileRevisionReceipts(owner) {
+	let receipts = receiptsByAdapter.get(owner);
+	if (!receipts) {
+		receipts = new ProfileRevisionReceipts();
+		receiptsByAdapter.set(owner, receipts);
+	}
+	return receipts;
+}
+function assertExecutionProfileRevision(owner, getConfig, input, profilePlan) {
+	if (getConfig().publicProfileRevisionRoot && profilePlan && !profileRevisionReceipts(owner).publicProfileRevisionReceipts.has(profilePlan)) throw new Error("Provider added public profile launch controls after immutable revision preparation");
+	if (getConfig().secretProfileRevisionRoot && profilePlan && !profileRevisionReceipts(owner).secretProfileRevisionReceipts.has(profilePlan)) throw new Error("Provider added secret profile launch controls after immutable revision preparation");
+	const expectedSecretReceipt = input.expectedSecretProfileReceipt;
+	if (getConfig().secretProfileRevisionRoot) {
+		const actual = profilePlan ? profileRevisionReceipts(owner).secretProfileRevisionReceipts.get(profilePlan) : void 0;
+		if (!expectedSecretReceipt || !actual || actual.executorReceipt !== expectedSecretReceipt) throw new Error("Secret native profile receipt mismatch before native spawn");
+	} else if (expectedSecretReceipt !== void 0) throw new Error("Secret native profile execution is unavailable");
+	const expectedRevision = input.expectedPublicProfileRevision;
+	if (expectedRevision !== void 0) {
+		const actualRevision = profilePlan ? profileRevisionReceipts(owner).publicProfileRevisionReceipts.get(profilePlan) : void 0;
+		if (!actualRevision || actualRevision.workspacePlanDigest !== expectedRevision.workspacePlanDigest || actualRevision.materializedDigest !== expectedRevision.materializedDigest || actualRevision.launchDigest !== expectedRevision.launchDigest) throw new Error("Public native profile revision mismatch before native spawn");
+	}
+}
+//#endregion
+//#region src/errors.ts
+/**
+* A session's persisted transcript exists but could not be read for replay
+* into the fresh provider session this turn starts. The turn fails instead
+* of serving an empty conversation under the same session id. The sidecar's
+* client-visible whitelist matches on `code`; the wire contract is the
+* duck-typed field, not class identity.
+*/
+var SessionRehydrationError = class extends Error {
+	code = "session_rehydration_failed";
+	constructor(message, cause) {
+		super(message, { cause });
+		this.name = "SessionRehydrationError";
+	}
+};
+const NOT_LAUNCHED = Symbol.for("@tangle-network/sdk-provider-cli-base.not-launched");
+/**
+* Marks a turn failure the adapter raised before it planned the launch:
+* session preparation or profile materialization refused, so no native
+* process received this turn and it left no native transcript to copy.
+* Only the adapter marks, on the error object it caught; error text never
+* does, so a provider message that reads the same is not marked.
+*/
+function rejectNotLaunched(error) {
+	if (error instanceof Error && !Object.isFrozen(error)) Object.defineProperty(error, NOT_LAUNCHED, { value: true });
+	throw error;
+}
+/** Whether this error is one the adapter raised before launching anything. */
+function wasNeverLaunched(error) {
+	return Object.getOwnPropertyDescriptor(error, NOT_LAUNCHED)?.value === true;
+}
+//#endregion
+//#region src/file-parts.ts
+/** Extension → MIME type, keyed by lowercased extension without the dot. */
+const EXTENSION_TO_MEDIA_TYPE = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	webp: "image/webp",
+	svg: "image/svg+xml",
+	pdf: "application/pdf",
+	mp3: "audio/mpeg",
+	wav: "audio/wav",
+	mp4: "video/mp4",
+	webm: "video/webm",
+	txt: "text/plain",
+	md: "text/markdown",
+	csv: "text/csv",
+	json: "application/json",
+	html: "text/html",
+	markdown: "text/markdown",
+	htm: "text/html",
+	xml: "application/xml",
+	yaml: "application/yaml",
+	yml: "application/yaml",
+	js: "text/javascript",
+	ts: "application/typescript",
+	py: "text/x-python"
+};
+/**
+* Inverse of the table above, for synthesizing a filename from a media type.
+* Built once from the first extension seen per media type (e.g. image/jpeg
+* → "jpg", not "jpeg") so the mapping is stable across calls.
+*/
+const MEDIA_TYPE_TO_EXTENSION = Object.entries(EXTENSION_TO_MEDIA_TYPE).reduce((acc, [ext, mediaType]) => {
+	if (!(mediaType in acc)) acc[mediaType] = ext;
+	return acc;
+}, {});
+function sha1Hex(value) {
+	return createHash("sha1").update(value).digest("hex");
+}
+/** Infers a MIME type from a filename's extension. Unknown/no extension → undefined. */
+function inferMediaType(filename) {
+	const dot = filename.lastIndexOf(".");
+	if (dot < 0 || dot === filename.length - 1) return void 0;
+	return EXTENSION_TO_MEDIA_TYPE[filename.slice(dot + 1).toLowerCase()];
+}
+/**
+* Builds the canonical URL for a file part. A data URI passes through
+* verbatim; a path is returned unchanged if it already carries a recognized
+* scheme, else converted to a percent-encoded `file://` URL.
+*
+* Callers must pass an already-resolved absolute path — `trackFilePart`
+* resolves relative paths (or drops the observation when it can't) before
+* ever reaching here, so a relative path arriving at this layer means a
+* caller bypassed that resolution. We throw rather than mint a malformed
+* `file://` URL (e.g. `file://./chart.png`, whose authority is `.`).
+*/
+function buildFileUrl(input) {
+	if (input.dataUri !== void 0) return input.dataUri;
+	if (input.path === void 0) throw new Error("buildFileUrl requires either `path` or `dataUri` to build a file part URL");
+	if (input.path.startsWith("file://") || input.path.startsWith("http://") || input.path.startsWith("https://") || input.path.startsWith("data:")) return input.path;
+	if (!isAbsolute(input.path)) throw new Error(`buildFileUrl requires an absolute path to build a file:// URL, got "${input.path}" — resolve it against a workspace root before calling buildFileUrl`);
+	return pathToFileURL(input.path).href;
+}
+/** Deterministic, stable part id for a file announced within one message. */
+function deterministicFilePartId(messageId, key) {
+	return `file-${sha1Hex(`${messageId}|${key}`).slice(0, 16)}`;
+}
+/**
+* Stateless derivation of the canonical file-part fields for one observed
+* path: resolve-once (normalize, then anchor a relative path to
+* `workspaceRoot`), and from that single resolved path derive the dedupe
+* `key`, the deterministic `id`, the `filename`, the inferred `mediaType`,
+* and the percent-encoded `file://` `url` — so every consumer that surfaces
+* the same file agrees on all five.
+*
+* Returns `null` for a relative path with no `workspaceRoot` to anchor it:
+* detection is opportunistic and a fabricated location is worse than a
+* missing part (see `trackFilePart` for the full rationale).
+*
+* This is the ONE derivation chain. `trackFilePart` (exec path, with
+* ExecutionState memoization) and stateless mappers that own no
+* ExecutionState (codex's app-server item mapper) both call it — never
+* re-implement the chain, or the two paths drift.
+*/
+function deriveFilePart(input) {
+	const normalized = normalize(input.path);
+	let resolvedPath;
+	if (isAbsolute(normalized)) resolvedPath = normalized;
+	else if (input.workspaceRoot !== void 0) resolvedPath = resolve(input.workspaceRoot, normalized);
+	else return null;
+	const filename = basename(resolvedPath);
+	return {
+		id: deterministicFilePartId(input.messageId, resolvedPath),
+		key: resolvedPath,
+		filename,
+		mediaType: inferMediaType(filename),
+		url: buildFileUrl({ path: resolvedPath })
+	};
+}
+/**
+* Tracks a file an adapter observed being created/modified (e.g. from a
+* write-tool call) and returns the canonical `FilePart` fields to stream,
+* deduping by resolved-absolute-path or data-URI content so repeated writes
+* to the same file update one part instead of appending duplicates.
+*
+* The path is normalized and resolved to an absolute form ONCE, and that same
+* resolved value drives both the dedupe key and the `file://` url — so two
+* observations of the same file that differ only in spelling (`./chart.png`
+* vs `/workspace/chart.png`, or `/workspace/sub/../chart.png` vs
+* `/workspace/chart.png`) unify on one part with one stable url, satisfying
+* the stream invariant that a given part id keeps a stable url.
+*
+* A relative path can only be resolved against `state.workspaceRoot` (set by
+* the adapter from the CLI's cwd). Detection here is opportunistic — a
+* tool-call observation, not a guarantee of an absolute path — so when no
+* workspaceRoot is available to anchor a relative path, we drop the
+* observation (`null`) rather than fabricate an anchor (e.g. resolving
+* against "/"): a wrong url is worse than a missing part, and a caller that
+* genuinely lost the file would get a wrong, permanent url once it's on the
+* stream.
+*
+* Detection is opportunistic for other reasons too: a delete, or an
+* observation carrying neither a path nor a data URI, also yields no part
+* (`null`) rather than an error — callers are not required to have a file
+* signal on every tool result.
+*/
+function trackFilePart(state, args) {
+	if (args.changeKind === "delete") return null;
+	if (args.path === void 0 && args.dataUri === void 0) return null;
+	if (state.messageId === void 0) throw new Error("trackFilePart requires state.messageId (set by createExecutionState) to derive a stable part id");
+	let derived = null;
+	if (args.path !== void 0) {
+		derived = deriveFilePart({
+			path: args.path,
+			messageId: state.messageId,
+			workspaceRoot: state.workspaceRoot
+		});
+		if (derived === null) return null;
+	}
+	state.fileParts ??= [];
+	const parts = state.fileParts;
+	const key = derived !== null ? derived.key : `data:${sha1Hex(args.dataUri)}`;
+	const url = derived !== null ? derived.url : buildFileUrl({ dataUri: args.dataUri });
+	const existing = parts.find((p) => p.key === key);
+	let filename = args.filename ?? derived?.filename ?? existing?.filename;
+	const mediaType = args.mediaType ?? (filename !== void 0 ? inferMediaType(filename) : void 0) ?? existing?.mediaType;
+	if (filename === void 0 && args.path === void 0) {
+		const priorDataUriEntries = parts.filter((p) => p.key.startsWith("data:")).length;
+		const ext = mediaType ? MEDIA_TYPE_TO_EXTENSION[mediaType] ?? "bin" : "bin";
+		filename = `attachment-${priorDataUriEntries + 1}.${ext}`;
+	}
+	if (existing) {
+		existing.filename = filename;
+		existing.mediaType = mediaType;
+		existing.url = url;
+		return {
+			id: existing.id,
+			filename: existing.filename,
+			mediaType: existing.mediaType,
+			url: existing.url
+		};
+	}
+	const id = derived !== null ? derived.id : deterministicFilePartId(state.messageId, key);
+	parts.push({
+		id,
+		key,
+		filename,
+		mediaType,
+		url
+	});
+	return {
+		id,
+		filename,
+		mediaType,
+		url
+	};
+}
+//#endregion
+//#region src/prompt-input.ts
+/** Raw-byte ceiling for inlining one image as base64 (~1.33x expansion in
+*  memory and on the wire); larger images keep only their `path` and the
+*  adapter falls back to path-based delivery. */
+const MAX_INLINE_IMAGE_BYTES = 10 * 1024 * 1024;
+/** Aggregate raw-byte budget for inlined images across one request's parts —
+*  the request schema admits up to 64 parts, so a per-image cap alone would
+*  still let one request hold hundreds of MB of base64 until execution. */
+const MAX_TOTAL_INLINE_IMAGE_BYTES = 32 * 1024 * 1024;
+async function readImageBase64(filePath, wroteFile, budgetBytes) {
+	const limit = Math.min(MAX_INLINE_IMAGE_BYTES, budgetBytes);
+	if (limit <= 0) return void 0;
+	let handle;
+	try {
+		handle = await open(filePath, constants.O_RDONLY | constants.O_NONBLOCK);
+		const stats = await handle.stat();
+		if (!stats.isFile() || stats.size > limit) return void 0;
+		const buffer = Buffer.alloc(stats.size + 1);
+		let offset = 0;
+		while (offset < buffer.length) {
+			const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset);
+			if (bytesRead === 0) break;
+			offset += bytesRead;
+		}
+		if (offset > stats.size) return void 0;
+		return {
+			base64: buffer.subarray(0, offset).toString("base64"),
+			rawBytes: offset
+		};
+	} catch (error) {
+		if (wroteFile) throw error;
+		return;
+	} finally {
+		await handle?.close();
+	}
+}
+function inferExtension(mediaType) {
+	if (!mediaType) return "bin";
+	if (mediaType === "application/pdf") return "pdf";
+	if (mediaType.startsWith("image/")) return mediaType.split("/")[1] || "img";
+	if (mediaType.startsWith("audio/")) return mediaType.split("/")[1] || "audio";
+	if (mediaType.startsWith("video/")) return mediaType.split("/")[1] || "video";
+	return mediaType.includes("/") ? mediaType.split("/")[1] || "bin" : "bin";
+}
+function sanitizeFilename(filename) {
+	return filename.replace(/[^a-zA-Z0-9._-]/g, "-") || `attachment-${randomUUID()}`;
+}
+const TEXT_MEDIA_TYPES = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/x-yaml",
+	"application/javascript",
+	"application/csv"
+]);
+function isTextMediaType(mediaType) {
+	if (!mediaType) return true;
+	const essence = (mediaType.split(";")[0] ?? "").trim().toLowerCase();
+	if (essence.startsWith("text/")) return true;
+	if (TEXT_MEDIA_TYPES.has(essence)) return true;
+	return essence.endsWith("+json") || essence.endsWith("+xml");
+}
+async function materializeAttachmentPart(part, workspaceRoot, sessionId, index) {
+	const attachmentDir = path.join(workspaceRoot, ".agent-inputs", sessionId);
+	await mkdir(attachmentDir, { recursive: true });
+	let dataUriMatch;
+	if (part.url?.startsWith("data:")) {
+		const match = part.url.match(/^data:([^;,]+)?;base64,(.*)$/s);
+		if (!match) throw new InvalidAttachmentError(`Invalid data URI for ${part.type} attachment`);
+		dataUriMatch = match;
+	}
+	const mediaType = part.mediaType || dataUriMatch?.[1] || void 0;
+	const filename = sanitizeFilename(part.filename || (part.path ? path.basename(part.path) : void 0) || `${part.type}-${index + 1}.${inferExtension(mediaType)}`);
+	const targetPath = path.join(attachmentDir, filename);
+	let referencePath = part.path ? path.resolve(workspaceRoot, part.path) : targetPath;
+	let wroteFile = false;
+	const content = "content" in part ? part.content : void 0;
+	const payload = dataUriMatch ? Buffer.from(dataUriMatch[2], "base64") : typeof content === "string" ? content : void 0;
+	if (payload !== void 0) {
+		if (!dataUriMatch && !isTextMediaType(part.mediaType)) throw new InvalidAttachmentError(`Cannot write binary attachment "${filename}" (mediaType: ${part.mediaType}) via "content" — deliver it as a base64 data: URL (data:${part.mediaType};base64,...) or via "path"/"file://" url instead.`);
+		const partDirectory = path.join(attachmentDir, `part-${randomUUID()}`);
+		await mkdir(partDirectory);
+		referencePath = path.join(partDirectory, filename);
+		await writeFile(referencePath, payload, { flag: "wx" });
+		wroteFile = true;
+	} else if (part.url?.startsWith("file://")) try {
+		referencePath = fileURLToPath(part.url);
+	} catch (err) {
+		throw new InvalidAttachmentError(`Invalid file:// URL for ${part.type} attachment: ${JSON.stringify(part.url)} (${err instanceof Error ? err.message : String(err)})`);
+	}
+	else if (part.url && /^https?:\/\//i.test(part.url)) referencePath = part.url;
+	const isHttpReference = referencePath.startsWith("http://") || referencePath.startsWith("https://");
+	return {
+		reference: referencePath,
+		filename,
+		...mediaType ? { mediaType } : {},
+		wroteFile,
+		persistedPart: {
+			type: "file",
+			filename,
+			mediaType,
+			url: isHttpReference ? referencePath : buildFileUrl({ path: referencePath })
+		}
+	};
+}
+async function preparePromptInputParts(parts, workspaceRoot, sessionId, options) {
+	const nativeKinds = new Set(options?.nativeAttachmentKinds ?? []);
+	const promptSections = [];
+	const attachmentRefs = [];
+	const persistedParts = [];
+	const attachments = [];
+	const inlineImages = nativeKinds.has("image");
+	let inlineBudget = options?.inlineImageBudgetBytes ?? 33554432;
+	for (const [index, part] of parts.entries()) {
+		if (part.type === "text") {
+			if (!part.text) continue;
+			promptSections.push(part.text);
+			persistedParts.push({
+				type: "text",
+				text: part.text
+			});
+			continue;
+		}
+		const materialized = await materializeAttachmentPart(part, workspaceRoot, sessionId, index);
+		const marker = `[${part.type === "image" ? "Image" : "File"}: ${materialized.reference}]`;
+		if (!nativeKinds.has(part.type)) attachmentRefs.push(marker);
+		persistedParts.push(materialized.persistedPart);
+		const isRemote = /^https?:\/\//i.test(materialized.reference);
+		const attachment = {
+			kind: part.type,
+			filename: materialized.filename,
+			marker,
+			...materialized.mediaType ? { mediaType: materialized.mediaType } : {},
+			...isRemote ? { url: materialized.reference } : { path: materialized.reference }
+		};
+		if (part.type === "image" && attachment.path && inlineImages) {
+			const inlined = await readImageBase64(attachment.path, materialized.wroteFile, inlineBudget);
+			if (inlined) {
+				attachment.base64 = inlined.base64;
+				inlineBudget -= inlined.rawBytes;
+			}
+		}
+		attachments.push(attachment);
+	}
+	if (attachmentRefs.length > 0) promptSections.push(`Attached files:\n${attachmentRefs.join("\n")}`);
+	return {
+		promptText: promptSections.join("\n\n").trim(),
+		persistedParts,
+		attachments
+	};
+}
+/**
+* Partition a turn's image attachments into the ones the adapter will
+* forward natively and the "stranded" rest, folding each stranded image's
+* `[Image: ...]` marker back into the message text. Once an adapter's
+* nativeAttachmentKinds() claims "image", the base prompt renderer omits
+* every image marker — so any image the mechanism can't carry (no base64
+* for a stdin block, no local path for an argv flag, beyond a single-path
+* flag's capacity) MUST re-enter the prompt here or the model never sees
+* a reference to it. Uses the same "Attached files:" block format the
+* renderer itself emits for non-native kinds.
+*/
+function partitionImageAttachments(options) {
+	const { message, attachments, qualifies, maxNative } = options;
+	const native = [];
+	const strandedMarkers = [];
+	for (const attachment of attachments ?? []) {
+		if (attachment.kind !== "image") continue;
+		if ((maxNative === void 0 || native.length < maxNative) && qualifies(attachment)) native.push(attachment);
+		else strandedMarkers.push(attachment.marker);
+	}
+	return {
+		native,
+		message: strandedMarkers.length > 0 ? `${message}\n\nAttached files:\n${strandedMarkers.join("\n")}` : message
+	};
+}
+/** Separates the sections a harness receives as one user message. */
+const PROMPT_SECTION_SEPARATOR = "\n\n---\n\n";
+/**
+* Puts `section` (a system prompt or replayed context) ahead of the message
+* for harnesses that take no separate channel for it.
+*/
+function prependPromptSection(section, body) {
+	return section ? `${section}${PROMPT_SECTION_SEPARATOR}${body}` : body;
+}
+//#endregion
+//#region src/types.ts
+function interactionToggleEnabled(config, kind) {
+	return config === true || typeof config === "object" && config !== null && config[kind] === true;
+}
+function enabledInteractionKinds(config, supported) {
+	if (config === true) return [...supported];
+	if (typeof config !== "object" || config === null) return [];
+	return supported.filter((kind) => config[kind] === true);
+}
+/**
+* Read a turn's ephemeral context, rejecting a wrong-typed value loudly.
+*
+* The published `AgentExecutionInput` does not declare the field, so nothing
+* type-checks it at the process boundary. Left unchecked, a caller passing a
+* non-string gets it stringified into the model prompt (`[object Object]`) —
+* a corrupted turn with no error anywhere. `undefined`/`null` mean "no context
+* this turn"; an empty string is likewise nothing to append.
+*/
+function readEphemeralContext(input) {
+	const context = input.ephemeralContext;
+	if (context === void 0 || context === null) return void 0;
+	if (typeof context !== "string") throw new TypeError(`ephemeralContext must be a string, received ${typeof context}`);
+	return context || void 0;
+}
+/**
+* Compose the model-facing prompt for a turn: the caller's own text, then this
+* turn's ephemeral context. Call it at the point the prompt is handed to the
+* provider — NEVER on the parts handed to `recordUserMessage` or the message
+* store.
+*/
+function withEphemeralContext(promptText, input) {
+	const context = readEphemeralContext(input);
+	if (!context) return promptText;
+	return promptText ? `${promptText}\n\n${context}` : context;
+}
+/**
+* Resolve whether an interaction kind is active for THIS turn. When the turn
+* carries `interactions` it is authoritative — a complete set that can also
+* turn a kind OFF mid-session; otherwise the adapter falls back to its latched
+* config (the initialize-time wiring, or a direct non-sidecar caller's option).
+*/
+function turnInteractionEnabled(input, latched, kind) {
+	const perTurn = input.interactions;
+	return interactionToggleEnabled(perTurn !== void 0 ? perTurn : latched, kind);
+}
+/**
+* Overlay this turn's interactions onto a latched config, returning a NEW
+* object (no shared mutation — safe when one adapter instance serves concurrent
+* turns from different sessions). When the turn omits `interactions` the config
+* is returned unchanged, preserving behavior for direct non-sidecar callers.
+* Adapters read plan/permission/question posture off the returned config so a
+* mid-session toggle takes effect and can turn a kind off (which the latched
+* config, only ever merged by updateConfig, cannot).
+*/
+function withTurnInteractions(config, input) {
+	if (input.interactions === void 0) return config;
+	return {
+		...config,
+		interactions: input.interactions
+	};
+}
+//#endregion
+//#region src/adapter-profile.ts
+/**
+* Revisions that already passed the native health check in this process, by
+* the verifier's scope and the revision's materialized digest. The check asks
+* whether the pinned native CLI loads this revision's bytes: a function of
+* those bytes and that CLI, not of the session or subprocess UID that will
+* read them (the ACL grant that publishes a revision to a UID throws when it
+* fails). A session's identity changes whenever its profile variant or turn
+* credential does, so keying by the session's receipt checked an unchanged
+* profile again every turn. Secret values are excluded from the digest.
+* Agents are rebuilt per request, so this outlives any adapter.
+* Insertion-ordered and bounded: the oldest entry is forgotten first.
+*/
+const verifiedSecretProfileRevisions = /* @__PURE__ */ new Set();
+const VERIFIED_SECRET_PROFILE_REVISIONS_MAX = 1024;
+function rememberVerifiedSecretProfileRevision(key) {
+	verifiedSecretProfileRevisions.delete(key);
+	verifiedSecretProfileRevisions.add(key);
+	while (verifiedSecretProfileRevisions.size > VERIFIED_SECRET_PROFILE_REVISIONS_MAX) {
+		const oldest = verifiedSecretProfileRevisions.values().next().value;
+		if (oldest === void 0) break;
+		verifiedSecretProfileRevisions.delete(oldest);
+	}
+}
+/** The executor's naming key, refused unless root owns it alone. */
+function readSecretProfileNamingKey(keyPath) {
+	if (!keyPath) throw new Error("Secret profile naming key is unavailable");
+	const keyStat = lstatSync(keyPath);
+	if (!keyStat.isFile() || keyStat.isSymbolicLink() || keyStat.uid !== 0 || (keyStat.mode & 511) !== 384 || keyStat.size !== 32) throw new Error("Secret profile naming key is not root-owned");
+	return readFileSync(keyPath);
+}
+/** Owns native profile revisions, launch controls, and prompt composition. */
+var CliAdapterProfile = class extends CliAdapterLifecycle {
+	/** Native profile lowering explicitly owned by this adapter, never inferred from a path. */
+	profileHarness = void 0;
+	/** Trusted implementation capabilities; never read from caller-owned configuration. */
+	supportsSecretProfileRevisions = false;
+	profileSecretProvider;
+	secretProfileRuntimeKeyProvider;
+	/**
+	* The materialized digest behind each secret revision. It stays here: the
+	* executor receipt is all a caller sees of a revision's resolved contents.
+	*/
+	secretProfileMaterializedDigests = /* @__PURE__ */ new WeakMap();
+	/**
+	* The value behind each `{env:NAME}` reference in a secret revision's
+	* config, by that revision's application. Executor memory only: no launch
+	* environment, argv or file ever carries them.
+	*/
+	secretProfileReferenceValues = /* @__PURE__ */ new WeakMap();
+	constructor(options = {}) {
+		super(options);
+		profileRevisionReceipts(this);
+		this.profileSecretProvider = options.profileSecretProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
+		this.secretProfileRuntimeKeyProvider = options.secretProfileRuntimeKeyProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
+	}
+	/** Apply captured diagnostic identity to this spawn, after profile composition. */
+	/** The exact child environment a turn uses; shared with prewarm paths. */
+	buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders) {
+		const merged = this.mergeProfilePlanEnvironment(this.buildNativeExecutionEnvironment(executionConfig), profilePlan, executionConfig.nativeAuthEnv !== void 0 || (executionConfig.authFiles?.length ?? 0) > 0);
+		return this.bindExecutionCorrelation(this.applyWritableHomeDefaults(this.bindProfileToolBinDirs(merged, profilePlan), workspaceRoot), correlationHeaders);
+	}
+	/**
+	* A profile's declared executable tools, sealed in its revision, stand in
+	* for the app's own tool dirs on this launch's PATH tail. A secret profile's
+	* env no longer names the app's dirs (app env is scrubbed), so the sidecar's
+	* own SANDBOX_TOOL_BIN_DIRS says which inherited PATH entries they are.
+	*/
+	bindProfileToolBinDirs(env, profilePlan) {
+		const toolBinDirs = profilePlan?.spawn.toolBinDirs;
+		if (!toolBinDirs?.length) return env;
+		return bindLaunchToolBinDirs("PATH" in env || !this.inheritProcessEnv || process.env.PATH === void 0 ? env : {
+			...env,
+			PATH: process.env.PATH
+		}, toolBinDirs, [...parseSandboxToolBinDirs(env.SANDBOX_TOOL_BIN_DIRS), ...parseSandboxToolBinDirs(process.env.SANDBOX_TOOL_BIN_DIRS)]);
+	}
+	bindExecutionCorrelation(environment, correlationHeaders) {
+		if (correlationHeaders !== void 0 && Object.keys(correlationHeaders).some((name) => name !== "X-Tangle-Trace-ID")) this.logger.warn("Native model request correlation is unsupported", { provider: this.provider });
+		return environment;
+	}
+	/**
+	* Provision the inline profile's files and native execution controls with the
+	* shared materializer used by cli-bridge. Unsupported portable controls fail
+	* before spawn unless the profile is explicitly best-effort
+	* (resources.failOnError: false), which materializes the supported subset
+	* and warns about the rest.
+	*/
+	/**
+	* Launcher controls this adapter OWNS on the spawn it starts — see
+	* `BINDABLE_LAUNCH_CONTROLS` in the materializer. Empty by default: a plan
+	* whose intent needs a launcher binding then fails closed instead of being
+	* silently dropped. An adapter that really applies the plan's launch flags
+	* to its own spawn (sdk-provider-opencode selecting the plan's primary
+	* agent via `--agent`) overrides this with the controls it honors.
+	*/
+	profileMaterializationBinds() {
+		return [];
+	}
+	/** Optional native instruction root. The adapter owns how its runtime locates this directory. */
+	profileAgentDirectory(_workspaceRoot) {}
+	/** Provider transport bound into the private immutable revision and receipt. */
+	secretProfileProviderConfig() {}
+	/**
+	* The values behind a secret revision's `{env:NAME}` config references, for
+	* an executor that serves those references itself. Never pass them to the
+	* native process.
+	*/
+	secretProfileReferences(application) {
+		return application ? this.secretProfileReferenceValues.get(application) : void 0;
+	}
+	async materializeProfileResources(inputProfile, workspaceRoot, ownerId, sessionId, scope = "turn") {
+		if (!inputProfile && !this.config.runtimeAttachments) return void 0;
+		const started = performance.now();
+		try {
+			return await this.applyProfileResources(inputProfile, workspaceRoot, ownerId, sessionId);
+		} finally {
+			this.logger.observePhase?.("profile_materialize", performance.now() - started, scope);
+		}
+	}
+	async applyProfileResources(inputProfile, workspaceRoot, ownerId, sessionId) {
+		const profile = inputProfile ?? {};
+		const harness = this.profileHarness;
+		if (!harness) {
+			if (hasPortableProfileControls(profile) || this.config.runtimeAttachments !== void 0) throw new Error(`${this.provider} does not support portable AgentProfile controls`);
+			return;
+		}
+		const agentDir = this.profileAgentDirectory(workspaceRoot);
+		const plan = materializeProfile(profile, harness, {
+			runtimeAttachments: this.config.runtimeAttachments,
+			binds: this.profileMaterializationBinds(),
+			...agentDir === void 0 ? {} : { instructionsRoot: "agent" }
+		});
+		const unsupported = enforceWorkspacePlanSupport(plan, profile.resources?.failOnError);
+		if (unsupported.length > 0) this.logger.warn("profile contains unsupported best-effort resources", {
+			harness,
+			unsupported
+		});
+		if (this.config.secretProfileRevisionRoot) return await this.applySecretProfileRevision(plan, this.config.secretProfileRevisionRoot, workspaceRoot, ownerId, sessionId);
+		if (this.config.publicProfileRevisionRoot) {
+			if (!ownerId) throw new Error("Concurrent public profile launch requires a session scope; idle prewarm is unsupported");
+			const revision = await preparePublicConcurrentProfileRevision({
+				plan,
+				...ensurePublicConcurrentProfileRoots(this.config.publicProfileRevisionRoot),
+				sharedWorkspaceDir: workspaceRoot,
+				ownerId,
+				secretProvider: runtimeSecretsOverlay(this.config.runtimeSecrets, this.profileSecretProvider)
+			});
+			this.logger.debug("materialized public concurrent profile revision", {
+				harness,
+				directory: revision.directory,
+				digest: revision.manifest.materializedDigest
+			});
+			const launchDigest = revision.manifest.launchDigest;
+			if (!launchDigest) throw new Error("Concurrent profile launch digest was not recorded");
+			profileRevisionReceipts(this).publicProfileRevisionReceipts.set(revision.application, {
+				workspacePlanDigest: revision.manifest.workspacePlanDigest,
+				materializedDigest: revision.manifest.materializedDigest,
+				launchDigest,
+				conflicts: revision.manifest.conflicts
+			});
+			return revision.application;
+		}
+		const application = await applyWorkspacePlanWithSecretProvider(plan, workspaceRoot, runtimeSecretsOverlay(this.config.runtimeSecrets, this.profileSecretProvider), {
+			ownership: this.subprocessIdentity(),
+			...agentDir === void 0 ? {} : { agentDir }
+		});
+		this.logger.debug("materialized profile resources", {
+			harness,
+			files: plan.files.length,
+			flags: plan.flags.length,
+			environment: Object.keys(plan.env).length
+		});
+		return application;
+	}
+	/**
+	* Publish the profile as an executor-sealed revision for this session's
+	* subprocess identity, and record the receipt that binds it to the turn.
+	*/
+	async applySecretProfileRevision(plan, secretProfileRevisionRoot, workspaceRoot, ownerId, sessionId) {
+		if (!this.supportsSecretProfileRevisions || !ownerId || !sessionId || !this.config.subprocessUser) throw new Error("Secret concurrent profile needs an opted-in adapter, a session, and per-turn runtime secrets only");
+		const namingKey = readSecretProfileNamingKey(this.config.secretProfileNamingKeyPath);
+		const roots = ensurePublicConcurrentProfileRoots(secretProfileRevisionRoot);
+		const revision = await prepareSecretConcurrentProfileRevision({
+			plan,
+			providerConfig: this.secretProfileProviderConfig(),
+			...roots,
+			sharedWorkspaceDir: workspaceRoot,
+			ownerId,
+			subprocessUid: this.config.subprocessUser.uid,
+			namingKey,
+			secretProvider: runtimeSecretsOverlay(this.config.runtimeSecrets, this.secretProfileRuntimeKeyProvider)
+		});
+		const launchDigest = revision.manifest.launchDigest;
+		if (!launchDigest) throw new Error("Secret concurrent profile launch digest is absent");
+		const executorReceipt = `hmac-sha256:${createHmac("sha256", namingKey).update(ownerId).update("\0").update(sessionId).update("\0").update(String(this.config.subprocessUser.uid)).update("\0").update(revision.manifest.workspacePlanDigest).update("\0").update(revision.manifest.materializedDigest).update("\0").update(launchDigest).digest("hex")}`;
+		this.secretProfileReferenceValues.set(revision.application, revision.secretReferences);
+		this.secretProfileMaterializedDigests.set(revision.application, revision.manifest.materializedDigest);
+		profileRevisionReceipts(this).secretProfileRevisionReceipts.set(revision.application, {
+			workspacePlanDigest: revision.manifest.workspacePlanDigest,
+			executorReceipt,
+			conflicts: revision.manifest.conflicts.map((conflict) => ({ ...conflict }))
+		});
+		return revision.application;
+	}
+	/**
+	* Prepare the same provider-composed native plan that execute() will check.
+	* This may publish an immutable public revision, but never starts a model turn.
+	*/
+	async preparePublicProfileRevision(input) {
+		if (!this.config.publicProfileRevisionRoot) throw new Error("Concurrent public profile materialization is disabled");
+		const sessionScope = input.userId ?? input.sessionId;
+		if (!sessionScope) throw new Error("Concurrent public profile preparation needs a session scope");
+		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
+		const receipt = application ? profileRevisionReceipts(this).publicProfileRevisionReceipts.get(application) : void 0;
+		if (!receipt) throw new Error("Concurrent public profile preparation produced no native plan");
+		return receipt;
+	}
+	/** Prepare the private native plan and return only an opaque executor receipt. */
+	async prepareSecretProfileRevision(input) {
+		if (!this.config.secretProfileRevisionRoot) throw new Error("Secret concurrent profile materialization is disabled");
+		const sessionScope = input.userId ?? input.sessionId;
+		if (!sessionScope) throw new Error("Secret profile preparation needs a session scope");
+		const startedAt = performance.now();
+		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
+		const materializedAt = performance.now();
+		const receipt = application ? profileRevisionReceipts(this).secretProfileRevisionReceipts.get(application) : void 0;
+		if (!application || !receipt) throw new Error("Secret profile preparation produced no native plan");
+		const materializedDigest = this.secretProfileMaterializedDigests.get(application);
+		if (!materializedDigest) throw new Error("Secret profile preparation produced no revision digest");
+		const verification = `${this.secretProfileVerificationScope()}\0${materializedDigest}`;
+		const verifyCached = verifiedSecretProfileRevisions.has(verification);
+		if (!verifyCached) await this.verifyPreparedSecretProfileRevision(input, application);
+		rememberVerifiedSecretProfileRevision(verification);
+		this.logger.info("prepared secret profile revision", {
+			materializeMs: Math.round(materializedAt - startedAt),
+			verifyMs: Math.round(performance.now() - materializedAt),
+			verifyCached
+		});
+		return receipt;
+	}
+	/**
+	* What the native health check's verdict depends on besides a revision's
+	* bytes: the executable that loads them. A provider whose check runs
+	* through a configurable binary names it here.
+	*/
+	secretProfileVerificationScope() {
+		return this.provider;
+	}
+	/** A secret receipt is issued only after the provider can load this revision. */
+	async verifyPreparedSecretProfileRevision(_input, _application) {
+		throw new Error(`${this.provider} has no native secret profile health check`);
+	}
+	/** Resolve the canonical profile used for this execution. */
+	resolveExecutionProfile(requestPrompt) {
+		return profileForExecution(this.config.profile, requestPrompt);
+	}
+	/** Select the profile materialized for this exact turn. */
+	resolveExecutionProfileForInput(input) {
+		return this.resolveExecutionProfile(input.systemPrompt);
+	}
+	/** Compose the provider's user-message channel for this exact turn. */
+	composePromptText(promptText, input) {
+		return withEphemeralContext(promptText, input);
+	}
+	withProfilePlan(config, profilePlan) {
+		if (!profilePlan || profilePlan.spawn.flags.length === 0) return config;
+		const contract = this.sessionContract();
+		if (contract) assertFlagsHonourSessionContract(this.provider, contract, profilePlan.spawn.flags, "profile flags");
+		return {
+			...config,
+			extraFlags: [...config.extraFlags ?? [], ...profilePlan.spawn.flags]
+		};
+	}
+	resolveProfileSystemPrompt(requestPrompt, profilePlan) {
+		return resolveSystemPrompt(requestPrompt, profilePlan?.spawn.systemPrompt);
+	}
+	/**
+	* The plan's additive prompt intent for this spawn. No request-level
+	* counterpart exists (`AgentExecutionInput` carries only the replacement),
+	* so unlike {@link resolveProfileSystemPrompt} there is nothing to
+	* conflict-check against.
+	*/
+	resolveProfileAppendSystemPrompt(profilePlan) {
+		return profilePlan?.spawn.appendSystemPrompt;
+	}
+	resolveProfileModel(requestModel) {
+		return resolveModel(requestModel, this.config.profile?.model?.default, this.config.model, this.config.profile?.model?.provider);
+	}
+	mergeProfilePlanEnvironment(environment, profilePlan, preserveClearedVariables = false) {
+		if (!profilePlan || Object.keys(profilePlan.spawn.env).length === 0) return environment;
+		const merged = { ...environment };
+		for (const [name, value] of Object.entries(profilePlan.spawn.env)) {
+			const existing = merged[name];
+			if (existing !== void 0 && existing !== value || preserveClearedVariables && existing === void 0 && Object.hasOwn(environment, name) && !this.profilePlanMayFillClearedEnvironmentVariable(name, value)) throw new Error(`profile environment conflicts with provider environment: ${name}`);
+			merged[name] = value;
+		}
+		return merged;
+	}
+	/** Provider-owned allowlist for a generated revision control after env scrub. */
+	profilePlanMayFillClearedEnvironmentVariable(_name, _value) {
+		return false;
+	}
+	async preparePromptInput(parts, workspaceRoot, sessionId, options) {
+		return preparePromptInputParts(parts, workspaceRoot, sessionId, {
+			nativeAttachmentKinds: options?.nativeAttachmentKinds ?? this.nativeAttachmentKinds(),
+			...options?.inlineImageBudgetBytes !== void 0 ? { inlineImageBudgetBytes: options.inlineImageBudgetBytes } : {}
+		});
+	}
+	/**
+	* Attachment kinds this adapter forwards natively via buildExecArgs (argv
+	* flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]`
+	* text marker. The base adapter omits those kinds' markers from the prompt
+	* text — an adapter that opts a kind in MUST deliver every attachment of
+	* that kind itself, or the model never sees it.
+	*/
+	nativeAttachmentKinds() {
+		return [];
+	}
+};
+//#endregion
+//#region src/native-session-enforcement.ts
+/** Store location and identity deadlines apply once a receipt proves the contract. */
+function sessionContractFullyEnforced(provider) {
+	return !Object.hasOwn(HARNESS_CONFORMANCE_PENDING, provider);
+}
+//#endregion
+//#region src/adapter-sessions.ts
+/** Providers without a repair tool share one empty set. */
+const NO_REPAIR_TOOL_NAMES$1 = /* @__PURE__ */ new Set();
+/** Owns durable transcripts, provider-native session bindings and the turn hooks providers override. */
+var CliAdapterSessions = class extends CliAdapterProfile {
+	async createSession(options) {
+		this.ensureInitialized();
+		const session = await this.getSessionStore().create({ workspaceRoot: options?.workspaceRoot ?? this.storagePath });
+		this.logger.debug("Created session", { sessionId: session.id });
+		return session.id;
+	}
+	async deleteSession(sessionId) {
+		this.ensureInitialized();
+		await this.getMessageStore().clear(sessionId);
+		const deleted = await this.getSessionStore().delete(sessionId);
+		this.logger.debug("Deleted session", {
+			sessionId,
+			deleted
+		});
+		return deleted;
+	}
+	/**
+	* Choose the native ID before its argv check, durable binding, and
+	* reservation. `input` and `timeoutMs` are the turn's, for a harness that
+	* decides here whether a process started earlier can serve it.
+	*/
+	mintNativeSessionId(_context) {
+		return randomUUID();
+	}
+	/**
+	* Make a pre-minted native session durable before the CLI starts, for a
+	* harness that would otherwise write nothing until its first model reply
+	* (Pi). Called after the argv check and before spawn.
+	*/
+	reserveNativeSession(_nativeSessionId, _context) {}
+	/**
+	* Verify that the provider can resume the native session binding. By
+	* default a session in a per-session store is resumable only when one of
+	* its declared files exists under the runtime HOME; a pre-minted id whose
+	* first turn died before the CLI wrote anything is not.
+	*/
+	providerSessionIsResumable(runtimeHome, providerSessionId) {
+		const contract = this.sessionContract();
+		if (!contract) return true;
+		if (!sessionContractFullyEnforced(this.provider) && contract.identity.kind !== "pre-minted") return true;
+		return declaredSessionExists(contract, runtimeHome, providerSessionId);
+	}
+	/**
+	* Resolve the provider-native session id the next turn can resume, or
+	* undefined when no usable binding exists. Provider session data lives
+	* under the runtime home that minted it. A different home or missing
+	* provider storage cannot resume that session. A record without a home
+	* stamp predates the field, so treat it as same-home.
+	*/
+	async resumableProviderSessionId(session) {
+		if (!session.providerSessionId) return void 0;
+		const currentHome = this.config.runtimeHome?.trim() || void 0;
+		const mintedHome = session.providerSessionHome?.trim() || void 0;
+		if (currentHome !== void 0 && mintedHome !== void 0 && mintedHome !== currentHome) return;
+		if (currentHome !== void 0) {
+			if (!await this.providerSessionIsResumable(currentHome, session.providerSessionId)) return;
+		}
+		return session.providerSessionId;
+	}
+	/** Bind a checkpoint-proven native session to this provider identity before execution. */
+	async seedNativeSessionForResume(input, nativeSessionId) {
+		if (!input.sessionId) throw new Error("Native resume requires a named session");
+		const runtimeHome = this.config.runtimeHome?.trim();
+		if (!runtimeHome || !await this.providerSessionIsResumable(runtimeHome, nativeSessionId)) throw new Error("Native resume session is absent from this provider home");
+		const store = this.getSessionStore();
+		const existing = await store.get(input.sessionId);
+		if (!existing) await store.create({
+			id: input.sessionId,
+			workspaceRoot: input.workspaceRoot ?? this.storagePath,
+			providerSessionId: nativeSessionId,
+			providerSessionHome: runtimeHome
+		});
+		else if (existing.providerSessionId !== nativeSessionId || existing.providerSessionHome !== runtimeHome) await store.update(input.sessionId, {
+			providerSessionId: nativeSessionId,
+			providerSessionHome: runtimeHome
+		});
+	}
+	/**
+	* Forks the persisted session and copies its messages up to `messageId`.
+	* The forked record carries no provider session id, so its first turn
+	* starts a fresh CLI session and receives the copied transcript as
+	* execution-only context. Callers that address turns by their own session
+	* id (the sidecar) pass that id as `targetSessionId` so later turns find
+	* the forked record.
+	*/
+	async forkSession(options) {
+		this.ensureInitialized();
+		const result = await forkSessionWithMessages(this.getSessionStore(), this.getMessageStore(), options.sessionId, {
+			id: options.targetSessionId,
+			messageId: options.messageId,
+			workspaceRoot: options.workspaceRoot
+		});
+		this.logger.debug("Forked session", {
+			parentId: options.sessionId,
+			newId: result.session.id,
+			messagesCopied: result.messagesCopied
+		});
+		return result.session.id;
+	}
+	async getMessages(options) {
+		this.ensureInitialized();
+		return (await this.getMessageStore().list(options.sessionId, {
+			limit: options.limit,
+			offset: options.offset
+		})).map((msg) => this.toBackendMessage(msg));
+	}
+	toBackendMessage(msg) {
+		return {
+			id: msg.id,
+			role: msg.role,
+			parts: msg.parts,
+			timestamp: msg.timestamp.toISOString(),
+			metadata: msg.metadata
+		};
+	}
+	buildAssistantParts(state) {
+		const parts = [];
+		for (const reasoning of state.reasoningBuffer) parts.push({
+			type: "reasoning",
+			text: reasoning
+		});
+		if (state.textBuffer) parts.push({
+			type: "text",
+			text: state.textBuffer
+		});
+		for (const toolCall of state.toolCalls.values()) {
+			const inputRecord = toolCall.input ?? {};
+			let toolState;
+			if (toolCall.status === "completed") toolState = {
+				status: "completed",
+				input: inputRecord,
+				output: toolCall.output
+			};
+			else if (toolCall.status === "failed") toolState = {
+				status: "failed",
+				input: inputRecord,
+				error: toolCall.output ? String(toolCall.output) : void 0
+			};
+			else if (toolCall.status === "running") toolState = {
+				status: "running",
+				input: inputRecord
+			};
+			else toolState = {
+				status: "pending",
+				input: inputRecord
+			};
+			parts.push({
+				type: "tool",
+				tool: toolCall.name,
+				callID: toolCall.id,
+				state: toolState
+			});
+		}
+		for (const file of state.fileParts ?? []) parts.push({
+			type: "file",
+			id: file.id,
+			filename: file.filename,
+			mediaType: file.mediaType,
+			url: file.url
+		});
+		return parts;
+	}
+	extractToolInvocations(state) {
+		const invocations = [];
+		for (const toolCall of state.toolCalls.values()) invocations.push({
+			toolName: toolCall.name,
+			input: toolCall.input,
+			result: toolCall.output,
+			...toolCall.status === "failed" ? { isError: true } : {}
+		});
+		return invocations;
+	}
+	/**
+	* Names of tools this provider substitutes for a model tool call it could
+	* not parse into any real tool.
+	*
+	* Default: none. A provider that has one must say so, because these calls
+	* do not present as failures. OpenCode's `invalid` reports the parse error
+	* as its output and completes, so the repeated-failure guard reads a run of
+	* them as progress and clears its count on every one.
+	*/
+	toolCallRepairToolNames() {
+		return NO_REPAIR_TOOL_NAMES$1;
+	}
+	/**
+	* Decide whether a non-zero exit should be treated as success.
+	*
+	* Default: no — any non-zero exit is a failure.
+	*
+	* Providers override this when their CLI has a known "exits non-zero
+	* on a successful run" quirk (e.g. kimi writes its resume trailer to
+	* stderr and exits non-zero even when the task completed cleanly).
+	*
+	* The decision is made AFTER the stream has drained and the exit
+	* code is known, so `state` reflects the full set of events the
+	* parser emitted (including any terminal `result` / `done` event).
+	* A safe heuristic is: "non-zero exit + stderr matches known trailer
+	* pattern + at least one assistant part was recorded".
+	*/
+	isBenignNonZeroExit(_params) {
+		return false;
+	}
+	/** Observe settled process output before success/failure classification. */
+	async afterCliProcessExit(_params) {}
+	executionOutcome(_state, _input) {
+		return { type: "completed" };
+	}
+	/**
+	* Format a message for stdin input.
+	*/
+	formatStdinMessage(message) {
+		return message;
+	}
+};
+/**
+* Whether any file below `root` (relative path) matches one of `matchers`.
+* Bounded: native stores nest a few levels and hold one file per session.
+*/
+async function anyFileMatches(root, matchers) {
+	const pending = [""];
+	let visited = 0;
+	while (pending.length > 0 && visited < 2e4) {
+		const relative = pending.pop();
+		if (relative === void 0) break;
+		let entries;
+		try {
+			entries = await readdir(path.join(root, relative), { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			visited++;
+			const child = relative ? `${relative}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) pending.push(child);
+			else if (entry.isFile() && matchers.some((matcher) => matcher.test(child))) return true;
+		}
+	}
+	return false;
+}
+/** Whether a per-session store holds a declared file for this id. */
+async function declaredSessionExists(contract, runtimeHome, nativeSessionId) {
+	for (const store of contract.stores) {
+		if (store.shared) return true;
+		const matchers = store.files.map((glob) => compileSessionStoreGlob(glob, nativeSessionId));
+		if (await anyFileMatches(path.join(runtimeHome, store.root), matchers)) return true;
+	}
+	return false;
+}
+//#endregion
+//#region src/cli-exit-diagnostics.ts
+/** Characters of stderr a failure message carries, taken from the tail. */
+const FAILURE_STDERR_TAIL_LIMIT = 600;
+/**
+* Attach the process-level diagnostics this run already collected to a failure
+* message.
+*
+* A provider that reports its OWN terminal failure — an empty event stream, an
+* unfinished model step — explains what it saw but not how the process ended,
+* and those are different defects: a CLI that exited 0 having emitted nothing
+* is misconfigured, one killed on the timeout is stuck, one that exited 9 with
+* stderr crashed. The exit status and the CLI's stderr are in hand at the
+* point the error is built; without this they reached only a log line and the
+* caller got a bare sentence to debug from.
+*
+* Each part is skipped when the message already states it, so a message
+* derived FROM stderr or from the exit code is never doubled.
+*/
+function withCliExitDiagnostics(message, exit, stderr) {
+	const parts = [];
+	if (exit.stdinError && !message.includes(exit.stdinError)) parts.push(`stdin failed: ${exit.stdinError}`);
+	if (exit.timedOut) {
+		const timeoutDetail = exit.timeoutDiagnostic;
+		if (timeoutDetail) {
+			if (!message.includes(timeoutDetail)) parts.push(timeoutDetail);
+		} else if (!/timed out/i.test(message)) parts.push("timed out");
+	}
+	if (exit.code !== null) {
+		if (!message.includes(`code ${exit.code}`)) parts.push(`exit code ${exit.code}`);
+	} else if (exit.signal) parts.push(`killed by ${exit.signal}`);
+	const trimmedStderr = stderr.trim();
+	if (trimmedStderr && !message.includes(trimmedStderr)) parts.push(`stderr: ${trimmedStderr.length > FAILURE_STDERR_TAIL_LIMIT ? `…${trimmedStderr.slice(-FAILURE_STDERR_TAIL_LIMIT)}` : trimmedStderr}`);
+	return parts.length === 0 ? message : `${message} (${parts.join("; ")})`;
+}
+//#endregion
+//#region src/mcp-commands.ts
+/** Execute one prepared MCP registration command. Serialization belongs to the adapter. */
+async function addCliMcp(options) {
+	const { name, config, run, logger } = options;
+	logger.debug("Adding MCP server", {
+		name,
+		type: config.type
+	});
+	const result = await run();
+	if (!result.exit.success) throw new Error(`Failed to add MCP server "${name}": ${result.stderr || `exit code ${result.exit.code}`}`);
+	logger.info("Added MCP server", { name });
+}
+/** List native MCP servers with the provider's parser and command budget. */
+async function listCliMcps(options) {
+	const { provider, args, run, logger, parse } = options;
+	if (!args) {
+		logger.warn(`getMcpStatus: ${provider} CLI does not support listing MCP servers`);
+		return { servers: {} };
+	}
+	const result = await run(args);
+	if (!result.exit.success) throw new Error(withCliExitDiagnostics(`${provider} failed to list MCP servers`, result.exit, result.stderr));
+	return parse(result.stdout ?? "");
+}
+const MCP_STATUSES = [
+	"connected",
+	"disconnected",
+	"error",
+	"unknown"
+];
+const MCP_TYPES = [
+	"local",
+	"remote",
+	"stdio",
+	"http"
+];
+function pick(known, value, fallback) {
+	return known.includes(value) ? value : fallback;
+}
+/**
+* Read an `mcp list` report: a JSON array of `{name, status, type}`, a JSON
+* object keyed by name, or a whitespace table whose first column is the name
+* and whose next columns may hold the type and the status.
+*/
+function parseMcpListReport(output) {
+	const servers = {};
+	const add = (name, status, type) => {
+		servers[name] = {
+			name,
+			status: pick(MCP_STATUSES, status, "unknown"),
+			type: pick(MCP_TYPES, type, "stdio")
+		};
+	};
+	let data;
+	try {
+		data = JSON.parse(output);
+	} catch {
+		for (const line of output.trim().split("\n")) {
+			if (!line.trim() || line.includes("NAME") || line.startsWith("-")) continue;
+			const [name = "", type, status] = line.trim().split(/\s{2,}/);
+			add(name, status, type);
+		}
+		return { servers };
+	}
+	if (Array.isArray(data)) for (const server of data) add(server.name, server.status ?? "connected", server.type);
+	else if (typeof data === "object" && data !== null) for (const [name, info] of Object.entries(data)) add(name, info.status, void 0);
+	return { servers };
+}
+/** A local MCP server's argv: the `command` array, or `command` then `args`. */
+function localMcpArgv(config) {
+	const local = config;
+	return Array.isArray(local.command) ? local.command : [local.command, ...local.args ?? []];
+}
+/**
+* A local MCP server's environment, from `environment` (agent-backend-types)
+* or `env` (agent-interface): reading one drops the other family's variables.
+*/
+function localMcpEnv(config) {
+	return config.environment ?? config.env;
+}
+const isLocalMcpConfig = (c) => c.type === "local" || c.type === "stdio";
+/** Build MCP add command arguments. Override for CLI-specific syntax. */
+function defaultMcpAddArgs(name, config) {
+	if (isLocalMcpConfig(config)) {
+		const env = Object.entries(localMcpEnv(config) ?? {});
+		return [
+			"mcp",
+			"add",
+			name,
+			"--",
+			...localMcpArgv(config),
+			...env.flatMap(([key, value]) => ["--env", `${key}=${value}`])
+		];
+	}
+	const headers = Object.entries(config.headers ?? {});
+	return [
+		"mcp",
+		"add",
+		name,
+		config.url,
+		...headers.flatMap(([key, value]) => ["--header", `${key}: ${value}`])
+	];
+}
+//#endregion
+//#region src/adapter-mcp.ts
+/** Owns serialized MCP mutations and provider-native MCP status commands. */
+var CliAdapterMcp = class extends CliAdapterSessions {
+	/** Budget for one `mcp list` run, CLI startup and every server's handshake. */
+	mcpStatusTimeoutMs = 1e4;
+	mcpMutationChain = Promise.resolve();
+	async addMcp(name, config) {
+		const run = this.mcpMutationChain.then(() => this.addMcpSerialized(name, config));
+		this.mcpMutationChain = run.catch(() => void 0);
+		return run;
+	}
+	async addMcpSerialized(name, config) {
+		this.ensureInitialized();
+		const args = this.buildMcpAddArgs(name, config);
+		return addCliMcp({
+			name,
+			config,
+			logger: this.logger,
+			run: () => this.runAuxiliaryCli(args, 3e4)
+		});
+	}
+	async getMcpStatus() {
+		this.ensureInitialized();
+		return listCliMcps({
+			provider: this.provider,
+			args: this.buildMcpListArgs(),
+			logger: this.logger,
+			run: (args) => this.runAuxiliaryCli(args, this.mcpStatusTimeoutMs),
+			parse: (output) => this.parseMcpListOutput(output)
+		});
+	}
+	async ensureMcps(required) {
+		const currentStatus = await this.getMcpStatus();
+		const existingServers = new Set(Object.keys(currentStatus.servers));
+		for (const [name, config] of Object.entries(required)) {
+			if (existingServers.has(name)) {
+				this.logger.debug("MCP server already exists, skipping", { name });
+				continue;
+			}
+			await this.addMcp(name, config);
+		}
+	}
+	/** Build MCP add command arguments. Override for CLI-specific syntax. */
+	buildMcpAddArgs(name, config) {
+		return defaultMcpAddArgs(name, config);
+	}
+	/**
+	* Build MCP list command arguments. Return null if not supported.
+	*/
+	buildMcpListArgs() {
+		return null;
+	}
+	/** Parse MCP list output. Override for CLI-specific output format. */
+	parseMcpListOutput(output) {
+		return parseMcpListReport(output);
+	}
+};
+//#endregion
+//#region src/execution-state.ts
+/**
+* Creates a new execution state.
+*/
+function createExecutionState(sessionId, messageId, workspaceRoot) {
+	return {
+		sessionId,
+		messageId: messageId ?? randomUUID(),
+		workspaceRoot,
+		toolCalls: /* @__PURE__ */ new Map(),
+		textBuffer: "",
+		reasoningBuffer: []
+	};
+}
+//#endregion
+//#region src/session-preparation.ts
+async function prepareExecutionSession(context, input) {
+	let sessionId = input.sessionId;
+	let providerSessionId;
+	let transcriptReplay;
+	if (sessionId) {
+		const session = await context.getSessionStore().get(sessionId);
+		if (session) {
+			providerSessionId = await context.resumableProviderSessionId(session);
+			if (session.parentId !== void 0 && session.providerSessionId === void 0) transcriptReplay = "fork";
+			else if (context.config.secretProfileRevisionRoot && session.providerSessionId === void 0 && (await context.getMessageStore().list(sessionId)).length > 0) transcriptReplay = "restored";
+			else if (session.providerSessionId && providerSessionId === void 0) {
+				context.logger.info("Provider session data is not resumable; replaying durable history into a fresh provider session", {
+					sessionId,
+					providerSessionId: session.providerSessionId
+				});
+				transcriptReplay = "restored";
+			}
+			await context.getSessionStore().update(sessionId, {});
+		} else {
+			if (context.config.secretProfileRevisionRoot) try {
+				transcriptReplay = (await context.getMessageStore().list(sessionId, {
+					requireComplete: true,
+					allowAbsent: true
+				})).length > 0 ? "restored" : void 0;
+			} catch (error) {
+				throw new SessionRehydrationError(`Session ${sessionId} has incomplete persisted history`, error);
+			}
+			else transcriptReplay = "restored";
+			await context.getSessionStore().create({
+				id: sessionId,
+				workspaceRoot: input.workspaceRoot ?? context.storagePath
+			});
+		}
+	} else sessionId = await context.createSession({ workspaceRoot: input.workspaceRoot ?? context.storagePath });
+	return {
+		sessionId,
+		providerSessionId,
+		transcriptReplay
+	};
+}
+//#endregion
+//#region src/turn-execution.ts
+/**
+* Turn idempotency: if the caller supplied a turnId and a previously-
+* completed turn with that id exists, return its cached result without
+* re-issuing the upstream LLM call. Both `findCompletedTurn` and
+* `setTurnId` are optional on the recorder interface so providers using
+* a no-op recorder (sdk-backend) still typecheck.
+*/
+async function findCachedTurn(recorder, input, logger, sessionId) {
+	if (!(input.turnId && recorder.findCompletedTurn)) return void 0;
+	const cached = await recorder.findCompletedTurn(input.turnId);
+	if (!cached) return void 0;
+	logger.info("Returning cached turn result (idempotent retry)", {
+		turnId: input.turnId,
+		sessionId
+	});
+	const outcome = cached.outcome === void 0 ? { type: "completed" } : AgentExecutionOutcomeSchema.parse(cached.outcome);
+	return {
+		...cached,
+		outcome
+	};
+}
+/**
+* The persisted transcript, read before this turn's user message is appended
+* so the block never contains the current message. Execution-only: it reaches
+* the model prompt and stays out of both stores.
+*/
+async function buildTranscriptContext(params) {
+	const { provider, sessionId, transcriptReplay, secretProfileRevisionRoot } = params;
+	if (!transcriptReplay) return void 0;
+	try {
+		return (secretProfileRevisionRoot ? buildCompleteForkContextBlock : buildForkContextBlock)(await params.getMessageStore().list(sessionId, { requireComplete: Boolean(secretProfileRevisionRoot) }), transcriptReplay === "restored" ? {
+			preamble: RESTORED_SESSION_CONTEXT_PREAMBLE,
+			tag: RESTORED_SESSION_CONTEXT_TAG,
+			...secretProfileRevisionRoot ? { maxChars: MAX_SECRET_PROFILE_REPLAY_CHARS } : {}
+		} : secretProfileRevisionRoot ? { maxChars: MAX_SECRET_PROFILE_REPLAY_CHARS } : void 0);
+	} catch (error) {
+		throw new SessionRehydrationError(`Session ${sessionId} has persisted history that could not be read for replay into a fresh ${provider} session: ${error instanceof Error ? error.message : String(error)}`, error);
+	}
+}
+/**
+* A harness that can only report its id in an event must do so promptly; a
+* turn whose native session cannot be named is not traceable. Returns the
+* deadline timer, or undefined when the contract sets none.
+*/
+function armNativeSessionDeadline(params) {
+	const { provider, sessionId, sessionContract, state, observer, logger } = params;
+	const identity = sessionContract?.identity;
+	if (identity?.kind !== "first-event" || !sessionContractFullyEnforced(provider)) return;
+	const deadline = setTimeout(() => {
+		if (observer.nativeSessionObserved || state.terminalStatus !== void 0) return;
+		const detail = new HarnessSessionContractError("native_session_id_unobserved", `${provider} reported no native session id within ${identity.deadlineMs} ms`).message;
+		state.terminalStatus = "failed";
+		state.lastDiagnostic = detail;
+		logger.error("Native session id unobserved; stopping turn", { sessionId });
+		params.kill();
+	}, identity.deadlineMs);
+	deadline.unref();
+	return deadline;
+}
+/** Accumulate a turn process's stderr as text. */
+function collectStderr(cliProcess) {
+	let text = "";
+	const stderrDecoder = new StringDecoder("utf8");
+	cliProcess.stderr?.on("data", (chunk) => {
+		text += stderrDecoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	});
+	cliProcess.stderr?.on("end", () => {
+		text += stderrDecoder.end();
+	});
+	return { get text() {
+		return text;
+	} };
+}
+/** The message a failed turn reports, from the strongest available cause. */
+function describeCliFailure(params) {
+	const { provider, state, exitResult, stderr, command, nixBinPath } = params;
+	const spawnFailure = exitResult.spawnError ? `Failed to spawn "${command}": ${exitResult.spawnError}` + (exitResult.spawnError.includes("ENOENT") ? ` — binary not found in PATH${nixBinPath ? ` (NIX_BIN_PATH=${nixBinPath})` : " (NIX_BIN_PATH unset — is the Nix profile mounted?)"}` : "") : null;
+	const failureCause = state.failure?.message ?? state.lastDiagnostic ?? (exitResult.timedOut ? exitResult.timeoutDiagnostic ?? "Execution timed out" : void 0) ?? (stderr.trim() || (state.terminalStatus === "failed" ? `${provider} reported a failed terminal status` : `Process exited with code ${exitResult.code}`));
+	return spawnFailure ?? withCliExitDiagnostics(failureCause, exitResult, stderr);
+}
+/** The error a failed turn throws, carrying the stream's failure details. */
+function buildTurnFailure(params) {
+	const { provider, errorMessage, state, startTime, endTime } = params;
+	const failure = new AgentExecutionError(`${provider} execution failed: ${errorMessage}`, {
+		...state.tokenUsage ? { tokenUsage: state.tokenUsage } : {},
+		timing: {
+			startedAt: startTime,
+			completedAt: endTime,
+			durationMs: endTime - startTime
+		}
+	});
+	if (state.failure) Object.assign(failure, {
+		...state.failure.code ? { code: state.failure.code } : {},
+		...state.failure.statusCode === void 0 ? {} : {
+			statusCode: state.failure.statusCode,
+			status: state.failure.statusCode
+		}
+	});
+	return failure;
+}
+/**
+* Best-effort: stamp the assistant message interrupted so reattach can
+* surface "this turn died" without inferring from absence. Swallow any
+* metadata-write error — the upstream failure is the one the caller
+* needs to see. The coalesced part updates drain first so no stale
+* snapshot lands after the terminal stamp.
+*/
+async function recordTurnInterruption(params) {
+	const { recorder, observer, logger, errorMessage, exitResult } = params;
+	await observer.flushPartUpdates();
+	if (recorder.markTurnInterrupted) try {
+		await recorder.markTurnInterrupted({
+			reason: errorMessage,
+			exitCode: exitResult.code,
+			timedOut: exitResult.timedOut,
+			failureReceipt: params.failure.receipt
+		});
+	} catch (markError) {
+		logger.warn("markTurnInterrupted failed (suppressed to preserve original error)", { error: markError instanceof Error ? markError.message : String(markError) });
+	}
+}
+/** The result of a turn that completed. */
+function buildExecutionResult(params) {
+	const { state, publicProfileRevision, startTime, endTime } = params;
+	return {
+		outcome: params.outcome,
+		text: state.textBuffer,
+		toolInvocations: params.toolInvocations,
+		reasoning: state.reasoningBuffer.length > 0 ? state.reasoningBuffer : void 0,
+		sessionId: params.sessionId,
+		...publicProfileRevision ? { metadata: { publicProfileRevision } } : {},
+		tokenUsage: state.tokenUsage ? {
+			inputTokens: state.tokenUsage.inputTokens ?? 0,
+			outputTokens: state.tokenUsage.outputTokens ?? 0,
+			totalTokens: state.tokenUsage.totalTokens,
+			reasoningTokens: state.tokenUsage.reasoningTokens,
+			cacheReadInputTokens: state.tokenUsage.cacheReadInputTokens,
+			cacheCreationInputTokens: state.tokenUsage.cacheCreationInputTokens,
+			cost: state.tokenUsage.cost
+		} : void 0,
+		timing: {
+			startedAt: startTime,
+			completedAt: endTime,
+			durationMs: endTime - startTime
+		}
+	};
+}
+/** A turn whose provider session record failed to persist ends failed. */
+function failOnProviderSessionPersistence(observer, state) {
+	if (!observer.providerSessionPersistenceError) return;
+	const message = observer.providerSessionPersistenceError instanceof Error ? observer.providerSessionPersistenceError.message : String(observer.providerSessionPersistenceError);
+	state.terminalStatus = "failed";
+	state.lastDiagnostic = `Provider session persistence failed: ${message}`;
+}
+/** Log a non-zero exit the provider accepted, and the stderr a successful turn left. */
+function logAcceptedCliExit(logger, exitResult, stderr) {
+	if (!exitResult.success) logger.info("CLI process exited non-zero but was treated as success by provider", {
+		exitCode: exitResult.code,
+		stderr: stderr.slice(0, 500)
+	});
+	if (stderr.trim()) logger.debug("CLI process stderr (success)", { stderr: stderr.slice(0, 1e3) });
+}
+//#endregion
+//#region src/part-update-queue.ts
+const MAX_PENDING_PART_UPDATES = 256;
+/**
+* Per-chunk persistence backpressure. Accumulated-text providers re-emit
+* the whole part on every token, and each update joins the recorder's
+* serialized write chain — if disk latency exceeds the token rate, the
+* chain grows for the turn's lifetime. Coalescing keeps only the newest
+* pending snapshot per partId (a stale one is a strict prefix of it), so
+* the queue stays O(distinct parts); a single drain loop preserves write
+* order. The terminal paths flush the drain before their final writes so
+* no stale snapshot can land after the consolidated parts.
+*/
+var PartUpdateQueue = class {
+	pending = /* @__PURE__ */ new Map();
+	drain = null;
+	constructor(recorder, logger) {
+		this.recorder = recorder;
+		this.logger = logger;
+	}
+	schedule(part, delta) {
+		const partId = part.id;
+		if (!partId) {
+			this.recorder.recordAssistantPartUpdate?.(part, delta)?.catch((cause) => {
+				this.logger.warn("Per-chunk persistence failed (continuing stream)", { error: cause instanceof Error ? cause.message : String(cause) });
+			});
+			return;
+		}
+		this.pending.set(partId, {
+			part,
+			delta
+		});
+		if (this.pending.size > MAX_PENDING_PART_UPDATES) {
+			const oldestPending = this.pending.keys().next();
+			if (!oldestPending.done) this.pending.delete(oldestPending.value);
+			this.logger.warn("Part-update persist backlog overflow, dropped oldest pending snapshot", { pendingLimit: MAX_PENDING_PART_UPDATES });
+		}
+		if (!this.drain) this.drain = this.drainPending().finally(() => {
+			this.drain = null;
+		});
+	}
+	async flush() {
+		while (this.drain) await this.drain;
+	}
+	async drainPending() {
+		for (;;) {
+			const oldest = this.pending.keys().next();
+			if (oldest.done) break;
+			const update = this.pending.get(oldest.value);
+			this.pending.delete(oldest.value);
+			if (!update) continue;
+			try {
+				await this.recorder.recordAssistantPartUpdate?.(update.part, update.delta);
+			} catch (err) {
+				this.logger.warn("Per-chunk persistence failed (continuing stream)", { error: err instanceof Error ? err.message : String(err) });
+			}
+		}
+	}
+};
+//#endregion
+//#region src/repeated-tool-failure.ts
+const NO_REPAIR_TOOL_NAMES = /* @__PURE__ */ new Set();
+/** A part in one of these states has not resolved, so it decides nothing. */
+function isUnresolved(state) {
+	return state.status === "pending" || state.status === "running";
+}
+function readString(input, key) {
+	const value = input[key];
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+/** The tool's own error text, for the states that carry one. */
+function readStateError(state) {
+	if (state.status !== "error" && state.status !== "failed") return void 0;
+	return state.error?.trim() ? state.error : void 0;
+}
+/**
+* Describe a resolved tool part as a failure, or return `undefined` when it
+* produced something.
+*
+* A repair tool reports the call it stood in for through its input, so the
+* trip names `write` rather than the substitute. That is the tool the reader
+* has to go and look at.
+*/
+function describeFailure(part, repairToolNames) {
+	const { state } = part;
+	if (isUnresolved(state)) return void 0;
+	if (repairToolNames.has(part.tool)) return {
+		tool: readString(state.input, "tool") ?? part.tool,
+		detail: readString(state.input, "error") ?? readStateError(state) ?? `${part.tool} reported a tool call it could not parse`
+	};
+	if (state.status !== "error" && state.status !== "failed") return void 0;
+	return {
+		tool: part.tool,
+		detail: readStateError(state) ?? `${part.tool} failed without reporting a reason`
+	};
+}
+function createRepeatedToolFailureGuard(options) {
+	const { limit } = options;
+	if (!Number.isInteger(limit) || limit < 1) throw new Error(`Repeated tool-failure limit must be a positive whole number (got ${limit})`);
+	const repairToolNames = options.repairToolNames ?? NO_REPAIR_TOOL_NAMES;
+	let signature;
+	let previousInput;
+	let count = 0;
+	let lastScoredPartId;
+	let tripped = false;
+	return { observe(part) {
+		if (tripped) return void 0;
+		if (isUnresolved(part.state)) return void 0;
+		if (part.id === lastScoredPartId) return void 0;
+		lastScoredPartId = part.id;
+		const failure = describeFailure(part, repairToolNames);
+		if (!failure) {
+			signature = void 0;
+			previousInput = void 0;
+			count = 0;
+			return;
+		}
+		const next = JSON.stringify([failure.tool, failure.detail]);
+		count = next === signature && isDeepStrictEqual(part.state.input, previousInput) ? count + 1 : 1;
+		previousInput = structuredClone(part.state.input);
+		signature = next;
+		if (count < limit) return void 0;
+		tripped = true;
+		return {
+			...failure,
+			count
+		};
+	} };
+}
+//#endregion
+//#region src/turn-liveness.ts
+/**
+* How long the provider stream stays quiet before the adapter emits a liveness
+* event, and how often it re-checks that quiet window.
+*
+* A model that reasons for a minute and a run that died look the same on the
+* wire: an open stream with nothing on it. A consumer that must show progress
+* resolves the ambiguity with an inactivity timeout. The Blueprint Agent
+* frontend allows 20 s (blueprint-agent
+* apps/web/src/ui-provider/devcontainer-events/hooks/useStreamWatchdog.ts).
+* It then aborts a turn that the CLI is still running.
+*
+* A ping on quiet feeds that timeout without inventing content. The check
+* interval bounds the longest silence at quiet plus check, so these values put
+* the worst case at 6 s. A provider that emits more often than the quiet
+* window never trips the ticker, so nothing double-emits.
+*/
+const STREAM_LIVENESS_QUIET_MS = 5e3;
+const STREAM_LIVENESS_CHECK_MS = 1e3;
+/**
+* How long the adapter vouches for an unbroken silence.
+*
+* A ping says the CLI process runs. It cannot say the model makes progress.
+* An unbounded ping stream would hide a CLI that starts and then hangs.
+*
+* No model in use here emits nothing for ten minutes. Past that the ticker
+* stops so the consumer can observe the silence. A later provider event
+* restarts the window.
+*/
+const STREAM_LIVENESS_MAX_QUIET_MS = 6e5;
+/**
+* The clocks and running-tool bookkeeping behind the stream liveness ping.
+*
+* `lastProviderEventAt` moves only on a real provider event, and it bounds
+* how long one silence can run. `lastLivenessAt` also moves on each ping, and
+* it paces the pings.
+*/
+var TurnLiveness = class {
+	lastProviderEventAt = Date.now();
+	lastLivenessAt = this.lastProviderEventAt;
+	runningToolParts = /* @__PURE__ */ new Map();
+	constructor(state, logger, onEvent) {
+		this.state = state;
+		this.logger = logger;
+		this.onEvent = onEvent;
+	}
+	/** A real provider event arrived: reset both clocks. */
+	noteProviderEvent() {
+		this.lastProviderEventAt = Date.now();
+		this.lastLivenessAt = this.lastProviderEventAt;
+	}
+	/** Track a tool part by its reported state; call after `noteProviderEvent`. */
+	noteToolPart(id, tool, status) {
+		if (status === "running") {
+			if (!this.runningToolParts.has(id)) this.runningToolParts.set(id, {
+				toolName: tool,
+				startedAt: this.lastProviderEventAt
+			});
+		} else this.runningToolParts.delete(id);
+	}
+	start(executionSignal, startTime) {
+		const livenessTicker = setInterval(() => {
+			const now = Date.now();
+			if (executionSignal.aborted || this.state.terminalStatus !== void 0 || now - this.lastLivenessAt < STREAM_LIVENESS_QUIET_MS || now - this.lastProviderEventAt > STREAM_LIVENESS_MAX_QUIET_MS) return;
+			this.lastLivenessAt = now;
+			const oldestRunningTool = this.runningToolParts.entries().next();
+			const ping = oldestRunningTool.done ? {
+				type: "model-processing",
+				phase: "thinking",
+				elapsedMs: now - startTime
+			} : {
+				type: "tool-heartbeat",
+				toolName: oldestRunningTool.value[1].toolName,
+				partId: oldestRunningTool.value[0],
+				elapsedMs: now - oldestRunningTool.value[1].startedAt
+			};
+			try {
+				this.onEvent?.(ping);
+			} catch (error) {
+				this.logger.warn("Stream liveness ping failed (continuing turn)", { error: error instanceof Error ? error.message : String(error) });
+			}
+		}, STREAM_LIVENESS_CHECK_MS);
+		livenessTicker.unref();
+		return livenessTicker;
+	}
+};
+//#endregion
+//#region src/turn-observer.ts
+/**
+* How many times a tool call may be rejected identically in a row before the
+* adapter kills the turn.
+*
+* Three separates a model that recovers from one that cannot. The first
+* attempt is the mistake. The second is the model reading the error. A third
+* identical attempt says the error does not reach it. Against a staging run
+* that made 76 attempts, this cuts the turn on the third.
+*/
+const REPEATED_TOOL_FAILURE_LIMIT = 3;
+/**
+* Observes one turn's provider stream: keeps the execution state current,
+* persists parts and the provider session id as they arrive, stops a turn
+* that repeats a rejected tool call, and pings while the stream is quiet.
+*/
+var TurnObserver = class {
+	providerSessionPersistence = Promise.resolve();
+	providerSessionPersistenceError;
+	repeatedToolFailureTripped = false;
+	nativeSessionObserved = false;
+	partUpdates;
+	liveness;
+	repeatedToolFailureGuard;
+	killForRepeatedToolFailure;
+	constructor(options) {
+		this.options = options;
+		const { state, logger, recorder, repairToolNames, onEvent } = options;
+		this.partUpdates = new PartUpdateQueue(recorder, logger);
+		this.liveness = new TurnLiveness(state, logger, onEvent);
+		this.repeatedToolFailureGuard = createRepeatedToolFailureGuard({
+			limit: REPEATED_TOOL_FAILURE_LIMIT,
+			repairToolNames
+		});
+	}
+	flushPartUpdates() {
+		return this.partUpdates.flush();
+	}
+	attachProcess(process) {
+		this.killForRepeatedToolFailure = () => process.kill();
+	}
+	startLiveness(executionSignal, startTime) {
+		return this.liveness.start(executionSignal, startTime);
+	}
+	onEvent = (event) => {
+		const { provider, state, recorder } = this.options;
+		this.liveness.noteProviderEvent();
+		if (event.type === "message.part.updated" && event.part.type === "tool") this.observeToolPart(event.part);
+		const providerSessionId = event.type === "native.session.observed" && event.provider === provider ? event.nativeSessionId : event.type === "session.updated" ? event.sessionId : void 0;
+		if (event.type === "native.session.observed" && event.provider === provider) this.nativeSessionObserved = true;
+		if (providerSessionId) {
+			state.sessionId = providerSessionId;
+			this.persistProviderSession(providerSessionId);
+		}
+		if (event.type === "warning") state.lastDiagnostic = event.message;
+		if (event.type === "status" && (event.status === "completed" || event.status === "failed")) {
+			state.terminalStatus = event.status;
+			if (event.status === "failed" && event.detail) state.lastDiagnostic = event.detail;
+		}
+		if (event.type === "message.part.updated" && recorder.recordAssistantPartUpdate) this.partUpdates.schedule(event.part, event.delta);
+		this.options.onEvent?.(event);
+	};
+	observeToolPart(part) {
+		const { provider, state, logger, sessionId } = this.options;
+		const { id, tool, state: toolState } = part;
+		this.liveness.noteToolPart(id, tool, toolState.status);
+		const repeated = this.repeatedToolFailureGuard.observe({
+			id,
+			tool,
+			state: toolState
+		});
+		if (repeated) {
+			const detail = `${provider} sent the same ${repeated.tool} call ${repeated.count} times and every one was rejected. The turn stopped before it ran the model again: ${repeated.detail}`;
+			this.repeatedToolFailureTripped = true;
+			state.terminalStatus = "failed";
+			state.lastDiagnostic = detail;
+			logger.error("Repeated tool-call rejection stopped the turn", {
+				tool: repeated.tool,
+				attempts: repeated.count,
+				reason: repeated.detail,
+				sessionId
+			});
+			this.killForRepeatedToolFailure?.();
+		}
+	}
+	persistProviderSession(providerSessionId) {
+		const { getRuntimeHome, getSessionStore, sessionId } = this.options;
+		this.providerSessionPersistence = this.providerSessionPersistence.then(async () => {
+			const runtimeHome = getRuntimeHome();
+			if (!await getSessionStore().update(sessionId, {
+				providerSessionId,
+				...runtimeHome?.trim() ? { providerSessionHome: runtimeHome.trim() } : {}
+			})) throw new Error(`Session ${sessionId} disappeared before its provider session could be persisted`);
+		}).catch((error) => {
+			this.providerSessionPersistenceError ??= error;
+		});
+	}
+};
+//#endregion
+//#region src/turn-process.ts
+/** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
+function cliSpawnConfig(params) {
+	const { execArgs, launcher, subprocessUser } = params;
+	const stdio = !execArgs.useStdin ? { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] } : {};
+	return {
+		command: execArgs.command,
+		args: execArgs.args,
+		cwd: execArgs.cwd ?? params.workspaceRoot,
+		env: params.env,
+		inheritEnv: params.inheritEnv,
+		...params.ownProcessGroup ? { ownProcessGroup: true } : {},
+		...launcher ? {
+			launcher,
+			spawnOptions: stdio
+		} : {
+			...subprocessUser ? { isolatedIdentity: subprocessUser } : {},
+			spawnOptions: {
+				...params.subprocessSpawnOptions,
+				...stdio
+			}
+		}
+	};
+}
+/** A started CLI as the turn drives it, timing its spawn and first output. */
+function cliTurnProcess(child, logger, spawnStarted) {
+	if (logger.observePhase) {
+		child.process.once("spawn", () => {
+			logger.observePhase?.("cli_spawn", performance.now() - spawnStarted);
+		});
+		child.process.stdout?.once("data", () => {
+			logger.observePhase?.("cli_boot", performance.now() - spawnStarted);
+		});
+	}
+	return {
+		pid: child.pid,
+		stderr: child.process.stderr ?? void 0,
+		write: child.write,
+		closeInput: child.closeInput,
+		kill: child.kill,
+		exitPromise: child.exitPromise,
+		beginRawCapture: child.beginRawCapture
+	};
+}
+//#endregion
+//#region src/base-adapter.ts
+/**
+* Base adapter for CLI-based AI agent providers.
+*
+* Subclasses must implement:
+* - provider: string identifier
+* - defaultCliPath: default CLI executable name
+* - buildExecArgs(): build CLI execution arguments
+* - buildExecEnv(): build environment variables
+* - createEventParser(): create JSONL event parser
+* - mapEventToStreamEvents(): map parsed events to StreamEvents
+*
+* The message log directory is the registry spec's `messageStorageDir` for
+* `provider` (cli-agent-registry `messageStorageDirOf`); only an adapter for
+* a provider the registry does not know sets `defaultStorageDir`.
+*
+* Optional overrides:
+* - buildMcpAddArgs(): MCP add command arguments
+* - buildMcpListArgs(): MCP list command arguments (if supported)
+* - parseMcpListOutput(): parse MCP list output
+*/
+var CliProviderAdapterBase = class extends CliAdapterMcp {
+	supportsManagedQuote = false;
+	async execute(input, services, onEvent) {
+		this.ensureInitialized();
+		const quoteVersion = input.managedQuoteVersion;
+		if (quoteVersion !== void 0 && !this.supportsManagedQuote) throw new Error(`${this.provider} does not support the managed-quote native model transport`);
+		const correlationHeaders = executionCorrelationHeaders(input.interactionBinding, input.traceId, quoteVersion);
+		const execution = beginExecution(this, input.abortSignal);
+		const result = this.executeInternal(input, services, onEvent, execution.controller.signal, correlationHeaders);
+		result.then(() => finishExecution(this, execution), () => {
+			execution.controller.abort();
+			finishExecution(this, execution);
+		});
+		return result;
+	}
+	async executeInternal(input, services, onEvent, executionSignal, correlationHeaders) {
+		const startTime = Date.now();
+		const recorder = services.recorder;
+		const opened = await this.openTurnSession(input, recorder, onEvent);
+		if (opened.cached) return opened.cached;
+		const { sessionId, providerSessionId, providerMessageIds } = opened;
+		const { executionProfile, profilePlan } = await this.materializeTurnProfile(input, sessionId).catch(rejectNotLaunched);
+		const { preparedInput, promptText } = await this.recordTurnPrompt(input, opened, recorder).catch(rejectNotLaunched);
+		onEvent?.({
+			type: "status",
+			status: "started"
+		});
+		const launch = await this.planLaunch({
+			input,
+			sessionId,
+			providerSessionId,
+			executionSignal,
+			correlationHeaders,
+			executionProfile,
+			profilePlan,
+			attachments: preparedInput.attachments,
+			promptText
+		});
+		const { workspaceRoot } = launch;
+		const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId, workspaceRoot);
+		const observer = new TurnObserver({
+			provider: this.provider,
+			state,
+			sessionId,
+			getRuntimeHome: () => this.config.runtimeHome,
+			recorder,
+			getSessionStore: () => this.getSessionStore(),
+			logger: this.logger,
+			repairToolNames: this.toolCallRepairToolNames(),
+			onEvent
+		});
+		await this.bindNativeSession({
+			launch,
+			providerSessionId,
+			observer
+		});
+		const { exitResult, stderr } = await this.runCliTurn({
+			input,
+			sessionId,
+			providerSessionId,
+			executionSignal,
+			launch,
+			promptText,
+			state,
+			observer,
+			startTime
+		});
+		await observer.providerSessionPersistence;
+		failOnProviderSessionPersistence(observer, state);
+		const endTime = Date.now();
+		const benignNonZeroExit = !exitResult.success && !exitResult.timedOut && exitResult.stdinError === void 0 && this.isBenignNonZeroExit({
+			exitCode: exitResult.code,
+			stderr,
+			state
+		});
+		if (!exitResult.success && !benignNonZeroExit || state.terminalStatus === "failed" || observer.repeatedToolFailureTripped) return this.failCliTurn({
+			onEvent,
+			recorder,
+			observer,
+			state,
+			exitResult,
+			stderr,
+			launch,
+			startTime,
+			endTime
+		});
+		logAcceptedCliExit(this.logger, exitResult, stderr);
+		return this.completeTurn({
+			input,
+			sessionId,
+			state,
+			observer,
+			recorder,
+			providerMessageIds,
+			profilePlan,
+			startTime,
+			endTime
+		});
+	}
+	/**
+	* Record a successful turn: the provider session id, the assistant message,
+	* and the result, cached for a same-turnId retry.
+	*/
+	async completeTurn(params) {
+		const { input, sessionId, state, recorder, profilePlan } = params;
+		if (state.sessionId && sessionId && state.sessionId !== sessionId) await this.getSessionStore().update(sessionId, {
+			providerSessionId: state.sessionId,
+			...this.config.runtimeHome?.trim() ? { providerSessionHome: this.config.runtimeHome.trim() } : {}
+		});
+		const assistantParts = this.buildAssistantParts(state);
+		await params.observer?.flushPartUpdates();
+		await recorder.appendAssistantParts(assistantParts);
+		await this.getMessageStore().append({
+			sessionId,
+			...params.providerMessageIds ? { id: params.providerMessageIds.assistantMessageId } : {},
+			role: "assistant",
+			parts: assistantParts,
+			tokenUsage: state.tokenUsage ? {
+				inputTokens: state.tokenUsage.inputTokens,
+				outputTokens: state.tokenUsage.outputTokens
+			} : void 0
+		});
+		const publicProfileRevision = profilePlan ? profileRevisionReceipts(this).publicProfileRevisionReceipts.get(profilePlan) : void 0;
+		const result = buildExecutionResult({
+			outcome: await this.executionOutcome(state, input),
+			state,
+			toolInvocations: this.extractToolInvocations(state),
+			sessionId,
+			publicProfileRevision,
+			startTime: params.startTime,
+			endTime: params.endTime
+		});
+		if (recorder.markTurnCompleted) await recorder.markTurnCompleted({ result });
+		return result;
+	}
+	/** Report and record a failed turn, then throw its error. */
+	async failCliTurn(params) {
+		const { onEvent, recorder, observer, state, exitResult, stderr } = params;
+		const { launch, startTime, endTime } = params;
+		const { env, execArgs } = launch;
+		const errorMessage = describeCliFailure({
+			provider: this.provider,
+			state,
+			exitResult,
+			stderr,
+			command: execArgs.command,
+			nixBinPath: env.NIX_BIN_PATH
+		});
+		this.logger.error("CLI process failed", {
+			exitCode: exitResult.code,
+			timedOut: exitResult.timedOut,
+			timeoutReason: exitResult.timeoutReason,
+			timeoutDiagnostic: exitResult.timeoutDiagnostic,
+			spawnError: exitResult.spawnError,
+			stdinError: exitResult.stdinError,
+			stderr: stderr.slice(0, 2e3),
+			diagnostic: state.lastDiagnostic,
+			durationMs: endTime - startTime,
+			command: execArgs.command
+		});
+		if (exitResult.timedOut) onEvent?.({
+			type: "warning",
+			code: "TIMEOUT",
+			message: exitResult.timeoutDiagnostic ?? "Execution timed out"
+		});
+		onEvent?.({
+			type: "status",
+			status: "failed",
+			detail: errorMessage
+		});
+		const failure = buildTurnFailure({
+			provider: this.provider,
+			errorMessage,
+			state,
+			startTime,
+			endTime
+		});
+		await recordTurnInterruption({
+			recorder,
+			observer,
+			logger: this.logger,
+			errorMessage,
+			exitResult,
+			failure
+		});
+		throw failure;
+	}
+	/**
+	* Open the turn's session (sidecar/provider persistence only; native CLI
+	* startup is measured separately). A same-turnId retry of a completed turn
+	* gets that turn's cached result instead of running again.
+	*/
+	async openTurnSession(input, recorder, onEvent) {
+		const sessionPrepareStarted = performance.now();
+		const adapter = this;
+		const prepared = await prepareExecutionSession({
+			get config() {
+				return adapter.config;
+			},
+			get logger() {
+				return adapter.logger;
+			},
+			get storagePath() {
+				return adapter.storagePath;
+			},
+			get getSessionStore() {
+				return adapter.getSessionStore.bind(adapter);
+			},
+			get getMessageStore() {
+				return adapter.getMessageStore.bind(adapter);
+			},
+			get resumableProviderSessionId() {
+				return adapter.resumableProviderSessionId.bind(adapter);
+			},
+			get createSession() {
+				return adapter.createSession.bind(adapter);
+			}
+		}, input).catch(rejectNotLaunched);
+		this.logger.observePhase?.("session_prepare", performance.now() - sessionPrepareStarted);
+		this.logger.observePhase?.(prepared.transcriptReplay ? "history_replay" : prepared.providerSessionId ? "native_resume" : "native_session_new", 0);
+		const providerMessageIds = readProviderMessageIds(input);
+		const cached = await findCachedTurn(recorder, input, this.logger, prepared.sessionId);
+		if (cached) {
+			onEvent?.({
+				type: "status",
+				status: "completed"
+			});
+			return {
+				...prepared,
+				providerMessageIds,
+				cached
+			};
+		}
+		if (input.turnId && recorder.setTurnId) recorder.setTurnId(input.turnId);
+		return {
+			...prepared,
+			providerMessageIds,
+			cached: void 0
+		};
+	}
+	/** Provision the profile's cwd-native dimensions for this turn. */
+	async materializeTurnProfile(input, sessionId) {
+		const executionProfile = this.resolveExecutionProfileForInput(input);
+		const profilePlan = await this.materializeProfileResources(executionProfile, input.workspaceRoot ?? this.storagePath, input.userId ?? sessionId, sessionId);
+		assertExecutionProfileRevision(this, () => this.config, input, profilePlan);
+		return {
+			executionProfile,
+			profilePlan
+		};
+	}
+	/**
+	* Prepare the prompt and record the caller's own parts. `promptText`
+	* additionally carries the replayed transcript and this turn's ephemeral
+	* context, which are execution-only and stay out of both stores.
+	*/
+	async recordTurnPrompt(input, session, recorder) {
+		const { sessionId, providerMessageIds } = session;
+		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), input.workspaceRoot ?? this.storagePath, sessionId);
+		const transcriptContext = await buildTranscriptContext({
+			provider: this.provider,
+			sessionId,
+			transcriptReplay: session.transcriptReplay,
+			secretProfileRevisionRoot: this.config.secretProfileRevisionRoot,
+			getMessageStore: () => this.getMessageStore()
+		});
+		await recorder.recordUserMessage(preparedInput.persistedParts);
+		await this.getMessageStore().append({
+			sessionId,
+			...providerMessageIds ? { id: providerMessageIds.userMessageId } : {},
+			role: "user",
+			parts: preparedInput.persistedParts
+		});
+		return {
+			preparedInput,
+			promptText: this.composePromptText(prependPromptSection(transcriptContext, preparedInput.promptText), input)
+		};
+	}
+	/** Resolve this turn's config, environment and argv, and check them against the session contract. */
+	async planLaunch(params) {
+		const { input, sessionId, providerSessionId, executionSignal, correlationHeaders, executionProfile, profilePlan, attachments, promptText } = params;
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const turnConfig = withTurnInteractions(this.config, input);
+		const executionConfig = this.withProfilePlan(turnConfig, profilePlan);
+		const sessionContract = this.sessionContract();
+		const executionModel = this.resolveProfileModel(input.model?.model);
+		const env = this.buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders);
+		const buildExecArgs = (mintedSessionId) => this.buildExecArgs({
+			message: promptText,
+			config: executionConfig,
+			correlationHeaders,
+			model: executionModel,
+			sessionId: providerSessionId,
+			...mintedSessionId ? { mintedSessionId } : {},
+			workspaceRoot,
+			...keepsHarnessSystemPrompt(executionProfile, this.profileHarness) ? {
+				systemPrompt: void 0,
+				appendSystemPrompt: joinSystemPromptAdditions(this.resolveProfileAppendSystemPrompt(profilePlan), input.systemPrompt, input.appendSystemPrompt)
+			} : {
+				systemPrompt: this.resolveProfileSystemPrompt(input.systemPrompt, profilePlan),
+				appendSystemPrompt: input.appendSystemPrompt ? joinSystemPromptAdditions(this.resolveProfileAppendSystemPrompt(profilePlan), input.appendSystemPrompt) : this.resolveProfileAppendSystemPrompt(profilePlan)
+			},
+			attachments,
+			profilePlan
+		});
+		const timeoutMs = input.timeoutMs;
+		const mintedSessionId = sessionContract?.identity.kind === "pre-minted" && !providerSessionId ? params.reserveHeldProcess === false ? randomUUID() : await this.mintNativeSessionId({
+			sessionId,
+			workspaceRoot,
+			config: executionConfig,
+			model: executionModel,
+			env,
+			signal: executionSignal,
+			buildExecArgs,
+			input,
+			...timeoutMs === void 0 ? {} : { timeoutMs }
+		}) : void 0;
+		const execArgs = buildExecArgs(mintedSessionId);
+		if (sessionContract) {
+			assertArgvHonoursSessionContract(this.provider, sessionContract, execArgs.args, { ...mintedSessionId ? { mintedId: mintedSessionId } : {} });
+			const runtimeHome = this.config.runtimeHome?.trim();
+			if (runtimeHome && sessionContractFullyEnforced(this.provider)) assertStoreLocationHonoursSessionContract(this.provider, sessionContract, {
+				runtimeHome,
+				cwd: workspaceRoot,
+				env,
+				argv: execArgs.args
+			});
+		}
+		this.logger.debug("CLI execution", {
+			command: execArgs.command,
+			cwd: workspaceRoot,
+			hasSessionId: !!providerSessionId
+		});
+		return {
+			workspaceRoot,
+			executionConfig,
+			executionModel,
+			env,
+			sessionContract,
+			timeoutMs,
+			mintedSessionId,
+			execArgs
+		};
+	}
+	/** Reserve and announce the native session id a pre-minted harness already has. */
+	async bindNativeSession(params) {
+		const { launch, providerSessionId, observer } = params;
+		const { workspaceRoot, sessionContract, mintedSessionId } = launch;
+		const nativeBindStarted = performance.now();
+		if (mintedSessionId) await this.reserveNativeSession(mintedSessionId, { workspaceRoot });
+		const knownNativeSessionId = sessionContract?.identity.kind === "pre-minted" ? mintedSessionId ?? providerSessionId : void 0;
+		if (knownNativeSessionId) {
+			observer.onEvent({
+				type: "native.session.observed",
+				provider: this.provider,
+				nativeSessionId: knownNativeSessionId
+			});
+			await observer.providerSessionPersistence;
+			if (observer.providerSessionPersistenceError) throw observer.providerSessionPersistenceError;
+		}
+		if (knownNativeSessionId) this.logger.observePhase?.("native_session_bind", performance.now() - nativeBindStarted);
+	}
+	/** Spawn the turn's process, feed its input, and wait for it to exit. */
+	async runCliTurn(params) {
+		const { input, sessionId, providerSessionId, executionSignal } = params;
+		const { launch, promptText, state, observer, startTime } = params;
+		const { execArgs, workspaceRoot, env } = launch;
+		const parserConfig = this.createEventParser(state, observer.onEvent);
+		const spawnedProcess = this.spawnExecutionProcess({
+			input,
+			sessionId,
+			providerSessionId,
+			config: launch.executionConfig,
+			execArgs,
+			workspaceRoot,
+			env,
+			signal: executionSignal,
+			timeoutMs: launch.timeoutMs,
+			parser: parserConfig
+		});
+		const cliProcess = spawnedProcess instanceof Promise ? await spawnedProcess : spawnedProcess;
+		this.activeProcesses.add(cliProcess);
+		observer.attachProcess(cliProcess);
+		const identityDeadline = armNativeSessionDeadline({
+			provider: this.provider,
+			sessionId,
+			sessionContract: launch.sessionContract,
+			state,
+			observer,
+			logger: this.logger,
+			kill: () => cliProcess.kill()
+		});
+		const stderr = collectStderr(cliProcess);
+		const livenessTicker = observer.startLiveness(executionSignal, startTime);
+		let exitResult;
+		try {
+			if (execArgs.useStdin) {
+				const stdinMessage = execArgs.stdin && execArgs.stdin.length > 0 ? execArgs.stdin : promptText;
+				cliProcess.write(this.formatStdinMessage(stdinMessage));
+				cliProcess.closeInput();
+			}
+			exitResult = await cliProcess.exitPromise;
+		} catch (error) {
+			cliProcess.kill();
+			await cliProcess.exitPromise;
+			throw error;
+		} finally {
+			clearInterval(livenessTicker);
+			if (identityDeadline) clearTimeout(identityDeadline);
+			this.activeProcesses.delete(cliProcess);
+		}
+		await this.afterCliProcessExit({
+			state,
+			stderr: stderr.text,
+			exit: exitResult,
+			workspaceRoot,
+			env,
+			onEvent: observer.onEvent
+		});
+		return {
+			exitResult,
+			stderr: stderr.text
+		};
+	}
+	/** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
+	turnSpawnConfig(execArgs, workspaceRoot, env) {
+		return cliSpawnConfig({
+			execArgs,
+			workspaceRoot,
+			env,
+			inheritEnv: this.inheritProcessEnv,
+			launcher: this.launcher,
+			ownProcessGroup: this.ownProcessGroup,
+			subprocessUser: this.config.subprocessUser,
+			subprocessSpawnOptions: this.subprocessSpawnOptions()
+		});
+	}
+	/**
+	* The launch one turn would make, without starting it: the spawn config
+	* (argv, cwd, environment, identity or launcher), the stdin payload, and
+	* the profile files written into the workspace. Session and message
+	* stores are untouched and no held process is reserved, so a caller that
+	* runs the process itself (`execCli`) owns its output and lifecycle.
+	*/
+	async prepareLaunch(input, options = {}) {
+		this.ensureInitialized();
+		const sessionId = input.sessionId ?? randomUUID();
+		const { executionProfile, profilePlan } = await this.materializeTurnProfile(input, sessionId);
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), workspaceRoot, sessionId);
+		const promptText = this.composePromptText(preparedInput.promptText, input);
+		const launch = await this.planLaunch({
+			input,
+			sessionId,
+			providerSessionId: options.providerSessionId,
+			executionSignal: input.abortSignal ?? new AbortController().signal,
+			correlationHeaders: executionCorrelationHeaders(input.interactionBinding, input.traceId, void 0),
+			executionProfile,
+			profilePlan,
+			attachments: preparedInput.attachments,
+			promptText,
+			reserveHeldProcess: false
+		});
+		const { execArgs } = launch;
+		return {
+			spawn: this.turnSpawnConfig(execArgs, launch.workspaceRoot, launch.env),
+			...execArgs.useStdin ? { stdin: this.formatStdinMessage(execArgs.stdin && execArgs.stdin.length > 0 ? execArgs.stdin : promptText) } : {},
+			...launch.mintedSessionId ? { nativeSessionId: launch.mintedSessionId } : {},
+			...profilePlan ? { workspacePlan: profilePlan.receipt } : {}
+		};
+	}
+	/** Override only when the provider has a turn transport besides a CLI child. */
+	spawnExecutionProcess(request) {
+		const { execArgs, workspaceRoot, env, signal, timeoutMs, parser } = request;
+		const spawnStarted = performance.now();
+		const config = {
+			...this.turnSpawnConfig(execArgs, workspaceRoot, env),
+			signal,
+			...globalThis.process.getuid?.() === 0 && this.config.runtimeHome?.trim() ? {
+				rawCapturePath: resolveRawCapturePath(this.config.runtimeHome.trim()),
+				...request.deferRawCapture ? { rawCaptureDeferred: true } : {}
+			} : {},
+			...timeoutMs === void 0 ? {} : { timeoutMs }
+		};
+		const turnProcess = (process) => cliTurnProcess(process, this.logger, spawnStarted);
+		return this.launcher ? launchCliProcess(config, parser).then(turnProcess) : turnProcess(spawnCliProcess(config, parser));
+	}
+};
+//#endregion
+//#region src/acp-session-adapter.ts
+const DEFAULT_PROMPT_TIMEOUT_MS = 6e5;
+const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 12e4;
+const DEFAULT_BRIDGE_IDLE_MS = 300 * 1e3;
+/**
+* Grace between `session/cancel` and closing the bridge: long enough for the
+* agent to answer the in-flight `session/prompt` with `stopReason:
+* "cancelled"`, short enough that abort stays prompt.
+*/
+const ABORT_GRACE_MS = 250;
+/**
+* Shared lifecycle of a provider that drives an Agent Client Protocol agent
+* over a JSON-RPC stdio bridge: one cached process and native ACP session per
+* Tangle session, `initialize` then `session/new` (or `session/load` for a
+* provider that resumes), serialized `session/prompt` turns, the cancel
+* sequence (`session/cancel`, grace, close), `session/update` translation,
+* idle reaping and eviction on process exit or turn failure.
+*
+* A provider supplies only its translation: how a turn resolves its config,
+* how the process starts, the prompt blocks, and its own failure signals.
+*/
+var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
+	acpSessions = /* @__PURE__ */ new Map();
+	/** Spawn the bridge. Tests override it to swap the child process. */
+	spawnBridge(request) {
+		return spawnAcpBridge(request);
+	}
+	/** Refuse an agent version beyond the provider's own floor. */
+	checkAgentProtocolVersion(_advertised, _turn) {}
+	/**
+	* Configure a native session the process just opened or loaded, before its
+	* first prompt (e.g. `session/set_model`). A failure fails the acquire.
+	*/
+	async onSessionOpened(_bridge, _acpSessionId, _turn, _options) {}
+	/** Install reverse-call handlers on a new bridge, before `initialize`. */
+	onBridgeSpawned(_bridge, _sessionId, _turn) {}
+	/** Start per-turn state; the returned function ends it on every exit. */
+	beginTurn(_sessionId, _input, _onEvent) {
+		return () => {};
+	}
+	/** Inspect a failed tool's output; returned events precede its part update. */
+	onToolFailed(_sessionId, _failureText) {
+		return [];
+	}
+	/**
+	* A failure the provider recorded for this session during the turn,
+	* cleared on read. It outranks the error the turn surfaced as.
+	*/
+	takeTurnFailure(_sessionId) {}
+	/** Release provider state tied to a session's process. */
+	onSessionEvicted(_sessionId) {}
+	/** Extra fields for the turn-failure log line. */
+	turnLogContext(_turn) {
+		return {};
+	}
+	/**
+	* One turn through the base turn pipeline: session open with transcript
+	* replay and cached-turn replay, then input and result recording around the
+	* bridge's `session/prompt`. The agent owns its profile, so the base's
+	* profile materialization does not run.
+	*/
+	async execute(input, services, onEvent) {
+		this.ensureInitialized();
+		const turn = this.resolveTurn(input);
+		const { config } = turn;
+		const { recorder } = services;
+		const startTime = Date.now();
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const turnInput = input.sessionId ? input : {
+			...input,
+			sessionId: input.interactionBinding?.sessionId
+		};
+		const opened = await this.openTurnSession(turnInput, recorder, onEvent);
+		if (opened.cached) return opened.cached;
+		const { sessionId, providerSessionId, providerMessageIds } = opened;
+		const endTurn = this.beginTurn(sessionId, input, onEvent);
+		try {
+			const { preparedInput, promptText } = await this.recordTurnPrompt(turnInput, opened, recorder);
+			onEvent?.({
+				type: "status",
+				status: "started"
+			});
+			const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId);
+			let entry;
+			try {
+				entry = await this.acquireAcpSession({
+					sessionId,
+					...this.loadsNativeSessions && providerSessionId ? { providerSessionId } : {},
+					turn,
+					workspaceRoot,
+					onEvent
+				});
+			} catch (err) {
+				onEvent?.({
+					type: "status",
+					status: "failed",
+					detail: err instanceof Error ? err.message : String(err)
+				});
+				throw err instanceof Error ? err : new Error(String(err));
+			}
+			const { bridge, acpSessionId } = entry;
+			onEvent?.({
+				type: "session.updated",
+				sessionId
+			});
+			onEvent?.({
+				type: "native.session.observed",
+				provider: this.provider,
+				nativeSessionId: acpSessionId
+			});
+			try {
+				const promptResult = await this.promptAcpSession(entry, {
+					prompt: this.promptBlocks(input, {
+						...preparedInput,
+						promptText
+					}, turn),
+					timeoutMs: config.promptTimeoutMs ?? DEFAULT_PROMPT_TIMEOUT_MS,
+					abortSignal: input.abortSignal,
+					onUpdate: (params) => {
+						for (const event of this.mapAcpUpdate(params, state, sessionId)) onEvent?.(event);
+					}
+				});
+				const recorded = this.takeTurnFailure(sessionId);
+				if (recorded) throw recorded;
+				const finalStatus = mapAcpStopReason(promptResult.stopReason);
+				onEvent?.(finalStatus.detail ? {
+					type: "status",
+					status: finalStatus.status,
+					detail: finalStatus.detail
+				} : {
+					type: "status",
+					status: finalStatus.status
+				});
+				await this.getSessionStore().update(sessionId, { providerSessionId: acpSessionId });
+				return await this.completeTurn({
+					input: turnInput,
+					sessionId,
+					state,
+					recorder,
+					providerMessageIds,
+					startTime,
+					endTime: Date.now()
+				});
+			} catch (err) {
+				return this.failAcpTurn(err, sessionId, turn, bridge, onEvent);
+			} finally {
+				this.scheduleIdleReap(sessionId, config.bridgeIdleMs);
+			}
+		} finally {
+			endTurn();
+		}
+	}
+	/** Report a failed turn, retire its process, and throw its error. */
+	failAcpTurn(err, sessionId, turn, bridge, onEvent) {
+		const finalError = this.takeTurnFailure(sessionId) ?? err;
+		const detail = this.formatBridgeError(finalError);
+		this.logger.error(`${this.provider} execute failed`, {
+			...this.turnLogContext(turn),
+			error: detail,
+			stderrTail: bridge.getStderrTail().slice(-500)
+		});
+		onEvent?.({
+			type: "status",
+			status: "failed",
+			detail
+		});
+		this.evictAcpSession(sessionId, "execute-error");
+		if (finalError instanceof JsonRpcError && detail !== finalError.message) throw new Error(detail, { cause: finalError });
+		throw finalError instanceof Error ? finalError : new Error(detail);
+	}
+	async acquireAcpSession(opts) {
+		const { sessionId, turn, workspaceRoot, onEvent } = opts;
+		const existing = this.acpSessions.get(sessionId);
+		if (existing && !existing.bridge.closed) {
+			if (existing.processKey === turn.processKey) {
+				this.cancelIdleReap(existing);
+				return existing;
+			}
+			this.logger.warn(`${this.provider}: cached session was started for another process configuration — respawning`, { sessionId });
+			this.evictAcpSession(sessionId, "process-change");
+		}
+		const spec = await this.processSpec(turn, {
+			sessionId,
+			workspaceRoot
+		});
+		onEvent?.({
+			type: "status",
+			status: "processing",
+			detail: spec.statusDetail
+		});
+		let bridge;
+		const spawnStarted = performance.now();
+		try {
+			const runtimeHome = this.config.runtimeHome?.trim();
+			bridge = this.spawnBridge({
+				command: spec.command,
+				args: spec.args,
+				cwd: workspaceRoot,
+				env: withAgentEnvironment(spec.env, this.agentEnvironmentValues()),
+				...this.subprocessSpawnOptions(),
+				...globalThis.process.getuid?.() === 0 && runtimeHome ? { rawCapturePath: resolveRawCapturePath(runtimeHome) } : {}
+			});
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(this.spawnFailureMessage({
+				message,
+				missingBinary: message.includes("ENOENT") || message.includes("not found")
+			}, turn));
+		}
+		bridge.process?.once("spawn", () => {
+			this.logger.observePhase?.("cli_spawn", performance.now() - spawnStarted);
+		});
+		this.onBridgeSpawned(bridge, sessionId, turn);
+		const timeoutMs = turn.config.bootstrapTimeoutMs ?? DEFAULT_BOOTSTRAP_TIMEOUT_MS;
+		let acpSessionId;
+		const initializeStarted = performance.now();
+		try {
+			const requested = turn.config.protocolVersion ?? 1;
+			const init = await bridge.request("initialize", {
+				protocolVersion: requested,
+				clientCapabilities: {}
+			}, { timeoutMs });
+			this.checkProtocolVersion(init, requested, turn);
+			acpSessionId = await this.openNativeSession(bridge, {
+				providerSessionId: opts.providerSessionId,
+				cwd: workspaceRoot,
+				timeoutMs
+			});
+			await this.onSessionOpened(bridge, acpSessionId, turn, { timeoutMs });
+			this.logger.observePhase?.("cli_initialize", performance.now() - initializeStarted);
+		} catch (err) {
+			try {
+				await bridge.close();
+			} catch {}
+			throw this.sessionSetupError(err, bridge);
+		}
+		const unsubscribeClose = bridge.onClose((reason) => {
+			this.logger.warn(`${this.provider}: agent process closed unexpectedly — evicting`, {
+				sessionId,
+				reason: reason.reason,
+				code: reason.code,
+				signal: reason.signal
+			});
+			this.evictAcpSession(sessionId, "process-exit");
+		});
+		const entry = {
+			bridge,
+			acpSessionId,
+			processKey: turn.processKey,
+			inflight: Promise.resolve(),
+			unsubscribeClose
+		};
+		this.acpSessions.set(sessionId, entry);
+		return entry;
+	}
+	checkProtocolVersion(init, requested, turn) {
+		const advertised = init.protocolVersion;
+		if (typeof advertised !== "number") throw new Error(`${this.provider}: initialize response missing protocolVersion (got ${JSON.stringify(init)})`);
+		if (advertised > requested) throw new Error(`${this.provider}: agent advertises protocolVersion ${advertised} but client speaks at most ${requested}. Upgrade the provider package or pin an older agent binary.`);
+		if (advertised < 1) throw new Error(`${this.provider}: agent advertises protocolVersion ${advertised} but client requires at least 1. The backing agent binary is too old; upgrade it.`);
+		this.checkAgentProtocolVersion(advertised, turn);
+	}
+	/**
+	* Open the native ACP session. A recorded session is loaded when the agent
+	* can; an agent that refuses the load starts a new native session, and the
+	* Tangle transcript stays the record of the earlier turns.
+	*/
+	async openNativeSession(bridge, opts) {
+		const params = {
+			cwd: opts.cwd,
+			mcpServers: []
+		};
+		if (opts.providerSessionId) try {
+			return (await bridge.request("session/load", {
+				sessionId: opts.providerSessionId,
+				...params
+			}, { timeoutMs: opts.timeoutMs }))?.sessionId ?? opts.providerSessionId;
+		} catch (err) {
+			this.logger.debug("session/load failed, creating new", { error: err instanceof Error ? err.message : String(err) });
+		}
+		return (await bridge.request("session/new", params, { timeoutMs: opts.timeoutMs })).sessionId;
+	}
+	/**
+	* One `session/prompt` turn. Abort sends `session/cancel` before closing so
+	* the agent can settle the turn; the bridge's own signal handling would
+	* close first and lose the notify.
+	*/
+	async promptAcpSession(entry, turn) {
+		const { bridge, acpSessionId } = entry;
+		const unsubscribe = bridge.onNotification("session/update", (params) => {
+			if (!params || params.sessionId !== acpSessionId) return;
+			turn.onUpdate(params);
+		});
+		const onAbort = () => {
+			try {
+				bridge.notify("session/cancel", { sessionId: acpSessionId });
+			} catch (err) {
+				this.logger.warn(`${this.provider}: session/cancel notify failed on abort`, { error: err instanceof Error ? err.message : String(err) });
+			}
+			setTimeout(() => {
+				bridge.close().catch(() => {});
+			}, ABORT_GRACE_MS).unref();
+		};
+		const { abortSignal } = turn;
+		if (abortSignal) if (abortSignal.aborted) onAbort();
+		else abortSignal.addEventListener("abort", onAbort, { once: true });
+		const previous = entry.inflight;
+		let releaseLock;
+		const lock = new Promise((resolve) => {
+			releaseLock = resolve;
+		});
+		entry.inflight = previous.then(() => lock).catch(() => lock);
+		const readyWaitStarted = performance.now();
+		await previous.catch(() => {});
+		this.logger.observePhase?.("cli_ready_wait", performance.now() - readyWaitStarted);
+		try {
+			return await bridge.request("session/prompt", {
+				sessionId: acpSessionId,
+				prompt: turn.prompt
+			}, { timeoutMs: turn.timeoutMs });
+		} finally {
+			unsubscribe();
+			abortSignal?.removeEventListener("abort", onAbort);
+			releaseLock();
+		}
+	}
+	scheduleIdleReap(sessionId, bridgeIdleMs) {
+		const entry = this.acpSessions.get(sessionId);
+		if (!entry) return;
+		const idleMs = bridgeIdleMs ?? DEFAULT_BRIDGE_IDLE_MS;
+		if (idleMs <= 0) {
+			this.evictAcpSession(sessionId, "idle-disabled");
+			return;
+		}
+		if (entry.idleTimer) clearTimeout(entry.idleTimer);
+		entry.idleTimer = setTimeout(() => {
+			this.evictAcpSession(sessionId, "idle-reap");
+		}, idleMs);
+		entry.idleTimer.unref();
+	}
+	cancelIdleReap(entry) {
+		if (entry.idleTimer) {
+			clearTimeout(entry.idleTimer);
+			entry.idleTimer = void 0;
+		}
+	}
+	/** Close a session's agent process and drop it. Idempotent. */
+	evictAcpSession(sessionId, reason) {
+		const entry = this.acpSessions.get(sessionId);
+		if (!entry) return;
+		this.acpSessions.delete(sessionId);
+		this.onSessionEvicted(sessionId);
+		this.cancelIdleReap(entry);
+		try {
+			entry.unsubscribeClose();
+		} catch {}
+		if (!entry.bridge.closed) entry.bridge.close().catch((err) => {
+			this.logger.warn(`${this.provider}: bridge.close threw during evict`, {
+				sessionId,
+				reason,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		});
+	}
+	/** Evict every cached session whose process key matches. */
+	evictAcpSessionsWhere(matches, reason) {
+		for (const [sessionId, entry] of [...this.acpSessions]) if (matches(entry.processKey)) this.evictAcpSession(sessionId, reason);
+	}
+	/** Translate one `session/update` notification into stream events. */
+	mapAcpUpdate(params, state, sessionId) {
+		const update = params.update;
+		if (!update || typeof update !== "object") return [];
+		const kind = update.sessionUpdate;
+		if (kind === "agent_message_chunk" || kind === "agent_thought_chunk") return acpMessageChunkEvents(kind, update, state);
+		if (kind === "tool_call") return acpToolCallEvents(update, state);
+		if (kind === "tool_call_update") {
+			const change = update;
+			const existing = state.toolCalls.get(change.toolCallId);
+			if (!existing) return [];
+			const mapped = this.mapToolStatus(change.status);
+			const outputText = applyAcpToolCallUpdate(existing, mapped, change);
+			return [...mapped === "failed" ? this.onToolFailed(sessionId, typeof existing.output === "string" ? existing.output : outputText || void 0) : [], ...acpToolCallUpdateEvents(existing, state)];
+		}
+		if (kind === "plan") return acpPlanEvents(update, state, this.provider);
+		if (kind === "available_commands_update") return [{
+			type: "raw",
+			backend: this.provider,
+			event: {
+				sessionUpdate: "available_commands_update",
+				availableCommands: update.availableCommands ?? []
+			}
+		}];
+		return [{
+			type: "raw",
+			backend: this.provider,
+			event: update
+		}];
+	}
+	mapToolStatus(status) {
+		switch (status) {
+			case "completed": return "completed";
+			case "failed": return "failed";
+			case "in_progress": return "running";
+			case "pending":
+			case void 0: return "pending";
+			default:
+				this.logger.warn(`${this.provider}: unknown tool_call_update status`, {
+					status,
+					mappedTo: "running"
+				});
+				return "running";
+		}
+	}
+	formatBridgeError(raw) {
+		if (raw instanceof BridgeClosedError) return `${this.provider} bridge closed unexpectedly: ${raw.message}`;
+		if (raw instanceof RpcRequestTimeoutError) return `${this.provider} request "${raw.method}" timed out after ${raw.timeoutMs}ms`;
+		if (raw instanceof JsonRpcError) return jsonRpcErrorText(raw);
+		if (raw instanceof Error) return raw.message;
+		return String(raw);
+	}
+	/**
+	* The error a failed process start surfaces. An agent that exits before its
+	* session opens reports why only on stderr, and an agent's JSON-RPC error
+	* carries its cause in `data`; a bare "process-exit" or "Internal error"
+	* hides both from the caller.
+	*/
+	sessionSetupError(err, bridge) {
+		if (err instanceof BridgeClosedError) {
+			const stderr = bridge.getStderrTail().trim().slice(-500);
+			return new Error(`${this.provider}: agent exited before its session opened (${err.message})${stderr ? `; stderr: ${stderr}` : ""}`, { cause: err });
+		}
+		if (err instanceof JsonRpcError) return new Error(`${this.provider}: ${jsonRpcErrorText(err)}`, { cause: err });
+		return err instanceof Error ? err : new Error(String(err));
+	}
+	async healthCheck() {
+		return true;
+	}
+	async shutdown() {
+		this.evictAcpSessionsWhere(() => true, "adapter-shutdown");
+		await super.shutdown();
+	}
+	async addMcp(_name, _config) {
+		throw new Error(`${this.provider}: addMcp is not supported — an ACP agent takes MCP servers through session/new`);
+	}
+	async getMcpStatus() {
+		return { servers: {} };
+	}
+	buildExecArgs() {
+		throw new Error(`${this.provider}: buildExecArgs is not used — ACP turns run over the RPC bridge`);
+	}
+	buildExecEnv(_config) {
+		return { ...process.env };
+	}
+	createEventParser() {
+		throw new Error(`${this.provider}: createEventParser is not used — session/update notifications arrive over the RPC bridge`);
+	}
+	buildMcpAddArgs(_name, _config) {
+		throw new Error(`${this.provider}: buildMcpAddArgs is not used`);
+	}
+};
+//#endregion
+//#region src/event-parsers.ts
+/**
+* Parser for harnesses that print one JSON event per line (claude-code,
+* codex, amp, factory-droids). Values that fail `accept` are logged and
+* dropped; unparseable lines become a `PARSE_ERROR` warning. The first event
+* `isReady` accepts reports the CLI's own start time as `cli_initialize`,
+* measured from parser creation, which immediately precedes the spawn.
+*/
+function jsonEventParser(logger, onEvent, spec) {
+	const startedAt = performance.now();
+	let readyReported = false;
+	return {
+		transform: (raw) => {
+			if (spec.accept(raw)) return raw;
+			logger.warn(`Received non-${spec.label} event`, { raw });
+			return null;
+		},
+		onEvent: (event) => {
+			if (!readyReported && spec.isReady?.(event)) {
+				readyReported = true;
+				logger.observePhase?.("cli_initialize", performance.now() - startedAt);
+			}
+			for (const stream of spec.map(event)) onEvent?.(stream);
+		},
+		onError: (error, line) => {
+			logger.warn("Failed to parse event", {
+				error: error.message,
+				line
+			});
+			onEvent?.({
+				type: "warning",
+				code: "PARSE_ERROR",
+				message: `Failed to parse event: ${error.message}`
+			});
+		}
+	};
+}
+/**
+* Parser for harnesses that print their reply as plain stdout lines (hermes,
+* nanoclaw, forge). Lines classify into provider events; the reply is
+* emitted as one text part when stdout closes. A turn that printed errors
+* but no reply ends `failed` with the last error instead of an empty
+* `completed`.
+*/
+function plaintextResponseParser(state, onEvent, spec) {
+	const lines = [];
+	let errorSeen = false;
+	let lastError;
+	const response = {
+		text: (line) => {
+			lines.push(line);
+		},
+		error: (message) => {
+			errorSeen = true;
+			lastError = message;
+		}
+	};
+	return {
+		parseAs: "lines",
+		transform: (raw) => spec.classify(String(raw)),
+		onEvent: (event) => {
+			for (const stream of spec.map(event, response)) onEvent?.(stream);
+		},
+		onComplete: () => {
+			const text = lines.join("\n").trimEnd();
+			if (text.length > 0) {
+				const reply = finalTextEvent(state, text);
+				onEvent?.(reply);
+				onEvent?.({
+					type: "status",
+					status: "completed"
+				});
+			} else if (errorSeen) onEvent?.({
+				type: "status",
+				status: "failed",
+				detail: lastError ?? spec.emptyFailureDetail
+			});
+		}
+	};
+}
+//#endregion
+//#region src/interaction-mcp-server.ts
+var InteractionMcpServer = class extends InteractionMcpServer$1 {
+	constructor(config) {
+		super({
+			...config,
+			onStop: config.onStop ?? (() => void 0)
+		});
+	}
+};
+//#endregion
+//#region src/terminal-plan-support.ts
+/** One-shot durable plan submission for a single provider turn. */
+var TerminalPlanSupport = class {
+	committed;
+	submittedBody;
+	inFlight;
+	confirmInFlight;
+	confirmed = false;
+	constructor(options) {
+		this.options = options;
+	}
+	get plan() {
+		return this.committed;
+	}
+	/** Wait for a submission already accepted by this turn before failure cleanup. */
+	async settleSubmission() {
+		await this.inFlight?.catch(() => void 0);
+	}
+	async submit(body, sourceToolCallId) {
+		const normalized = body.trim();
+		if (!normalized) throw new Error("Plan body must not be empty");
+		if (this.submittedBody && this.submittedBody !== normalized) throw new Error(this.committed ? "This turn already submitted a different plan" : "This turn is already submitting a different plan");
+		if (this.committed) return this.committed;
+		if (this.inFlight) return this.inFlight;
+		this.submittedBody = normalized;
+		this.inFlight = this.options.planHost.submit({
+			body: normalized,
+			sourceToolCallId,
+			providerState: this.options.providerState()
+		}).then(async (plan) => {
+			this.committed = plan;
+			await this.options.onCommitted?.(plan);
+			return plan;
+		}).catch((error) => {
+			this.inFlight = void 0;
+			if (!this.committed) this.submittedBody = void 0;
+			throw error;
+		});
+		return this.inFlight;
+	}
+	async confirm() {
+		if (!this.committed) throw new Error("No durable plan has been committed by this turn");
+		if (this.confirmed) return this.committed;
+		if (this.confirmInFlight) return this.confirmInFlight;
+		const committed = this.committed;
+		this.confirmInFlight = this.options.planHost.confirm(committed.id).then(() => {
+			this.confirmed = true;
+			try {
+				this.options.emit?.({
+					type: "plan.submitted",
+					plan: committed
+				});
+			} catch {}
+			return committed;
+		}).catch((error) => {
+			this.confirmInFlight = void 0;
+			throw error;
+		});
+		return this.confirmInFlight;
+	}
+	async withdraw(reason) {
+		if (!this.committed) return;
+		await this.options.planHost.withdraw(this.committed.id, reason);
+	}
+};
+//#endregion
+//#region src/interaction-support.ts
+/**
+* Per-execution lifecycle wrapper for an MCP-capable harness. Permission and
+* question tools use the live {@link InteractionBroker}; plan tools commit
+* through {@link TerminalPlanSupport} and end the provider turn.
+*
+* Mirrors the claude-code permission-server pattern, but for the GENERIC
+* `request_permission` / `ask_user` / `request_plan` tools the agent calls
+* itself — there is no harness-specific reply contract, so any MCP-capable CLI
+* (factory-droids, …) composes this with ~10 lines: declare the capability
+* kinds, start/stop around the spawn, inject the server via the CLI's MCP
+* mechanism, and forward `respondToInteraction` here.
+*
+* Unlike claude-code's `--permission-prompt-tool`, these generic tools fire
+* only when the model chooses to call them. Permission is therefore advisory,
+* while plan-capable adapters separately prove the terminal turn boundary.
+*/
+var McpInteractionSupport = class {
+	/** The shared emit → block → respond → fail-closed round-trip. */
+	broker = new InteractionBroker$1();
+	activeServer;
+	terminalPlan;
+	constructor(serverName, kinds) {
+		this.serverName = serverName;
+		this.kinds = kinds;
+	}
+	/** The interaction kinds to advertise from `getCapabilities().interactions`. */
+	capabilityKinds() {
+		return [...this.kinds];
+	}
+	/** The active per-execution server (its `url`/`token`), once started. */
+	get server() {
+		return this.activeServer;
+	}
+	/**
+	* Start a per-execution server bound to 127.0.0.1 with an ephemeral bearer
+	* token, registering only the enabled tools. `emit` is the live event sink;
+	* broker-backed tools block on an answer, while plans emit only after their
+	* terminal confirmation. Returns the server for CLI injection.
+	*/
+	async start(sessionId, binding, emit, plan) {
+		const tools = brokerInteractionTools$1(this.broker, {
+			sessionId,
+			binding,
+			emit
+		});
+		const has = (kind) => this.kinds.includes(kind);
+		if (has(InteractionKind.Plan) && !plan) throw new Error("Plan interaction requires a durable plan host and provider resume state");
+		this.terminalPlan = plan ? new TerminalPlanSupport({
+			...plan,
+			emit
+		}) : void 0;
+		const server = new InteractionMcpServer$1({
+			serverName: this.serverName,
+			onStop: tools.onStop,
+			...has(InteractionKind.Permission) ? { requestPermission: tools.requestPermission } : {},
+			...has(InteractionKind.Question) ? { askUser: tools.askUser } : {},
+			...has(InteractionKind.Plan) && this.terminalPlan ? { requestPlan: ({ plan: body, sourceToolCallId }) => this.terminalPlan.submit(body, sourceToolCallId) } : {}
+		});
+		await server.start();
+		this.activeServer = server;
+		return server;
+	}
+	async confirmSubmittedPlan() {
+		if (!this.terminalPlan) throw new Error("No terminal plan support is active for this turn");
+		return this.terminalPlan.confirm();
+	}
+	async withdrawSubmittedPlan(reason) {
+		await this.terminalPlan?.withdraw(reason);
+	}
+	/** Close the request boundary before inspecting or withdrawing its plan. */
+	async drainSubmittedPlan(sessionId) {
+		this.broker.failSession(sessionId);
+		let stopError;
+		try {
+			await this.activeServer?.stop();
+			this.activeServer = void 0;
+		} catch (error) {
+			stopError = error;
+		}
+		await this.terminalPlan?.settleSubmission();
+		if (stopError) throw stopError;
+	}
+	/**
+	* Fail-closed every pending interaction for the session, then stop the server.
+	* `failSession` runs FIRST so any request still blocked in the server resolves
+	* (deny) before close, and the whole thing swallows errors — it runs in adapter
+	* `finally` blocks and must never mask the turn's real error.
+	*/
+	async stop(sessionId) {
+		try {
+			this.broker.failSession(sessionId);
+			const server = this.activeServer;
+			this.activeServer = void 0;
+			await server?.stop();
+		} catch {}
+	}
+	/**
+	* Route an inbound live `/interactions` response for permission or question.
+	* Plans are durable records and never enter this response channel.
+	*/
+	respond(response) {
+		if (this.broker.respond(response)) return true;
+		return this.broker.respondQuestion(response);
+	}
+};
+//#endregion
+//#region src/metering.ts
+const UsageRecordSchema = z.record(z.string(), z.unknown());
+const UsageNumberSchema = z.union([z.number(), z.string().trim().min(1)]).transform(Number).pipe(z.number().finite().nonnegative());
+const TOKEN_USAGE_INPUT_KEYS = Object.freeze([
+	"inputTokens",
+	"input",
+	"input_tokens",
+	"promptTokens",
+	"prompt_tokens"
+]);
+const TOKEN_USAGE_OUTPUT_KEYS = Object.freeze([
+	"outputTokens",
+	"output",
+	"output_tokens",
+	"completionTokens",
+	"completion_tokens"
+]);
+const TOKEN_USAGE_TOTAL_KEYS = Object.freeze([
+	"totalTokens",
+	"total_tokens",
+	"total"
+]);
+const TOKEN_USAGE_REASONING_KEYS = Object.freeze([
+	"reasoningTokens",
+	"reasoning_tokens",
+	"reasoning",
+	"reasoning_output_tokens"
+]);
+const TOKEN_USAGE_COST_KEYS = Object.freeze([
+	"totalCostUsd",
+	"costUsd",
+	"total_cost_usd",
+	"cost_usd",
+	"cost"
+]);
+const CACHE_READ_INPUT_KEYS = Object.freeze([
+	"cacheReadInputTokens",
+	"cache_read_input_tokens",
+	"cacheRead",
+	"cache_read",
+	"cached_input_tokens"
+]);
+const CACHE_CREATION_INPUT_KEYS = Object.freeze([
+	"cacheCreationInputTokens",
+	"cache_creation_input_tokens",
+	"cacheWrite",
+	"cache_write"
+]);
+const NESTED_COST_KEYS = Object.freeze([
+	"total",
+	"totalUsd",
+	"total_usd",
+	"usd"
+]);
+function asRecord(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	return parsed.success ? parsed.data : void 0;
+}
+function tokenCount(raw) {
+	const parsed = UsageNumberSchema.safeParse(raw);
+	return parsed.success ? Math.trunc(parsed.data) : void 0;
+}
+function firstTokenCount(source, keys) {
+	for (const key of keys) {
+		const count = tokenCount(source[key]);
+		if (count !== void 0) return count;
+	}
+}
+function firstUsageCostUsd(source, keys = TOKEN_USAGE_COST_KEYS) {
+	for (const key of keys) {
+		const parsed = UsageNumberSchema.safeParse(source[key]);
+		if (parsed.success) return parsed.data;
+	}
+}
+function usageRecord(source) {
+	return asRecord(source.tokenUsage) ?? asRecord(source.usage) ?? source;
+}
+function readTokenUsage(source) {
+	const usageSource = usageRecord(source);
+	const inputTokens = firstTokenCount(usageSource, TOKEN_USAGE_INPUT_KEYS);
+	const outputTokens = firstTokenCount(usageSource, TOKEN_USAGE_OUTPUT_KEYS);
+	return inputTokens !== void 0 || outputTokens !== void 0 ? {
+		inputTokens,
+		outputTokens
+	} : void 0;
+}
+function readTokenCostUsd(source) {
+	const usageSource = usageRecord(source);
+	return firstUsageCostUsd(source) ?? firstUsageCostUsd(usageSource) ?? readNestedCostUsd(source) ?? readNestedCostUsd(usageSource);
+}
+function readNestedCostUsd(source) {
+	const cost = asRecord(source.cost);
+	return cost ? firstUsageCostUsd(cost, NESTED_COST_KEYS) : void 0;
+}
+function readCliTokenUsage(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	if (!parsed.success) return void 0;
+	const source = parsed.data;
+	const usageSource = usageRecord(source);
+	const usage = readTokenUsage(source) ?? readTokenUsage(usageSource);
+	const cost = readTokenCostUsd(source);
+	const totalTokens = firstTokenCount(usageSource, TOKEN_USAGE_TOTAL_KEYS);
+	const reasoningTokens = firstTokenCount(usageSource, TOKEN_USAGE_REASONING_KEYS);
+	const cacheReadInputTokens = firstTokenCount(usageSource, CACHE_READ_INPUT_KEYS);
+	const cacheCreationInputTokens = firstTokenCount(usageSource, CACHE_CREATION_INPUT_KEYS);
+	if (!usage && totalTokens === void 0 && reasoningTokens === void 0 && cost === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0) return;
+	return {
+		inputTokens: usage?.inputTokens,
+		outputTokens: usage?.outputTokens,
+		totalTokens,
+		reasoningTokens,
+		cacheReadInputTokens,
+		cacheCreationInputTokens,
+		cost
+	};
+}
+function recordCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (tokenUsage) {
+			state.tokenUsage = tokenUsage;
+			return true;
+		}
+	}
+	return false;
+}
+function addUsage(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	const sum = left + right;
+	return Number.isFinite(sum) ? sum : Math.max(left, right);
+}
+/**
+* Adds one usage report to the running total instead of replacing it.
+*
+* For a CLI that reports usage PER TURN (pi) rather than once per run,
+* `recordCliTokenUsage` would leave the execution billed as its final turn
+* alone. Use this wherever a single execution can produce more than one usage
+* report; use `recordCliTokenUsage` when the CLI emits one cumulative total.
+*
+* Returns true when a usage report was found in `sources` and folded in.
+*/
+function accumulateCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (!tokenUsage) continue;
+		const total = state.tokenUsage;
+		state.tokenUsage = total ? {
+			inputTokens: addUsage(total.inputTokens, tokenUsage.inputTokens),
+			outputTokens: addUsage(total.outputTokens, tokenUsage.outputTokens),
+			totalTokens: addUsage(total.totalTokens, tokenUsage.totalTokens),
+			reasoningTokens: addUsage(total.reasoningTokens, tokenUsage.reasoningTokens),
+			cacheReadInputTokens: addUsage(total.cacheReadInputTokens, tokenUsage.cacheReadInputTokens),
+			cacheCreationInputTokens: addUsage(total.cacheCreationInputTokens, tokenUsage.cacheCreationInputTokens),
+			cost: addUsage(total.cost, tokenUsage.cost)
+		} : tokenUsage;
+		return true;
+	}
+	return false;
+}
+function parseCliUsageLine(line) {
+	if (!line.startsWith("usage:")) return void 0;
+	const raw = line.slice(6).trim();
+	if (!raw) return void 0;
+	if (raw.startsWith("{")) return asRecord(JSON.parse(raw));
+	const fields = {};
+	for (const part of raw.split(/[,\s]+/)) {
+		if (!part) continue;
+		const separator = part.includes("=") ? "=" : part.includes(":") ? ":" : "";
+		if (!separator) continue;
+		const [key, value] = part.split(separator, 2);
+		if (!key || value === void 0) continue;
+		const numeric = Number(value);
+		fields[key] = Number.isFinite(numeric) ? numeric : value;
+	}
+	return Object.keys(fields).length > 0 ? fields : void 0;
+}
+//#endregion
+//#region src/reasoning-effort.ts
+/** How each CLI takes agent-interface's native control token on its argv. */
+const EFFORT_FLAG = {
+	"claude-code": (value) => ["--effort", value],
+	codex: (value) => ["-c", `model_reasoning_effort=${value}`],
+	openclaw: (value) => ["--thinking", value],
+	pi: (value) => ["--thinking", value]
+};
+/** The argv carrying `nativeReasoningControl` for a profile effort, or none. */
+function nativeEffortArgs(harness, effort) {
+	const value = nativeReasoningControl(harness, effort ?? null);
+	const flag = EFFORT_FLAG[harness];
+	return value === null || flag === void 0 ? [] : flag(value);
+}
+/**
+* Kimi stays local until #14839: the sandbox ships kimi-cli 1.49.0 as
+* `kimi-code` (binary `--thinking`/`--no-thinking`) while other paths run
+* kimi-code 2.x. A model whose name has "thinking" or "reason" always thinks
+* (kimi-cli `derive_model_capabilities`), so `off` throws there.
+*/
+function kimiThinkingArgs(level, modelId) {
+	if (level === void 0) return [];
+	const off = level === "none" || level === "minimal";
+	if (!REASONING_EFFORTS.includes(level) || off && /thinking|reason/i.test(modelId ?? "")) throw new Error(`kimi-code cannot honor reasoning effort "${level}"`);
+	return off ? ["--no-thinking"] : ["--thinking"];
+}
+//#endregion
+export { ACP_MIN_PROTOCOL_VERSION, ACP_PROTOCOL_VERSION, AcpProviderAdapterBase, CliProviderAdapterBase, DEFAULT_INTERACTION_MCP_SERVER_NAME, EXECUTION_TRACE_HEADER, InteractionBroker, InteractionHttpBridge, InteractionMcpServer, InvalidAttachmentError, MANAGED_QUOTE_VERSION_HEADER, MAX_INLINE_IMAGE_BYTES, MAX_TOTAL_INLINE_IMAGE_BYTES, McpInteractionSupport, PERMISSION_DECISION_TIMEOUT_MS, PROMPT_SECTION_SEPARATOR, SessionRehydrationError, TerminalPlanSupport, accumulateCliTokenUsage, acpContentText, brokerInteractionTools, buildFileUrl, createExecutionState, createRepeatedToolFailureGuard, deriveFilePart, deterministicFilePartId, enabledInteractionKinds, executionCorrelationHeaders, finalTextEvent, homeXdgEnv, inferMediaType, interactionMcpToolName, interactionToggleEnabled, isLocalMcpConfig, jsonEventParser, kimiThinkingArgs, localMcpArgv, localMcpEnv, mapAcpStopReason, nativeEffortArgs, parseCliUsageLine, partitionImageAttachments, plaintextResponseParser, preparePromptInputParts, prependPromptSection, readCliTokenUsage, readEphemeralContext, reasoningEvents, recordCliTokenUsage, rejectNotLaunched, runtimeSecretsOverlay, sessionObservedEvents, spawnAcpBridge, streamPartBase, textDeltaEvents, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, trackReasoningBlock, turnInteractionEnabled, wasNeverLaunched, withEphemeralContext, withTurnInteractions };
+
+//# sourceMappingURL=index.mjs.map