@tangle-network/sdk-provider-cli-base 0.12.0 → 0.13.1

package/dist/index.mjs

@@ -1,27 +1,30 @@
 import { DEFAULT_INTERACTION_DECISION_TIMEOUT_MS as PERMISSION_DECISION_TIMEOUT_MS, InteractionBroker, InteractionBroker as InteractionBroker$1, InteractionHttpBridge, brokerInteractionTools, brokerInteractionTools as brokerInteractionTools$1 } from "@tangle-network/agent-core/interactions";
+import { CODEX_DISABLED_FEATURE_ARGS, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, applyWorkspacePlanWithSecretProvider, bindLaunchToolBinDirs, bindSecretSessionView, codexDeveloperInstructionArgs, enforceWorkspacePlanSupport, ensurePublicConcurrentProfileRoots, joinSystemPromptAdditions, keepsHarnessSystemPrompt, materializeProfile, modelIdsMatch, parseSandboxToolBinDirs, preparePublicConcurrentProfileRevision, prepareSecretConcurrentProfileRevision, resolveAgentProfileResources, secretSessionViewWorkspace } from "@tangle-network/agent-profile-materialize";
 import { BridgeClosedError, InvalidAttachmentError, JsonRpcError, RpcRequestTimeoutError, execCli, launchCliProcess, resolveRawCapturePath, spawnCliProcess, spawnRpcBridge } from "@tangle-network/sdk-cli-runner";
 import { createHash, createHmac, randomUUID } from "node:crypto";
 import { AgentExecutionError, AgentExecutionOutcomeSchema, AgentRuntimeAttachmentsSchema, InteractionExecutionBindingSchema, InteractionKind, REASONING_EFFORTS, agentProfileSchema, nativeReasoningControl, normalizeInputParts } from "@tangle-network/agent-interface";
-import { UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, applyWorkspacePlanWithSecretProvider, bindLaunchToolBinDirs, enforceWorkspacePlanSupport, ensurePublicConcurrentProfileRoots, joinSystemPromptAdditions, keepsHarnessSystemPrompt, materializeProfile, modelIdsMatch, parseSandboxToolBinDirs, preparePublicConcurrentProfileRevision, prepareSecretConcurrentProfileRevision, resolveAgentProfileResources } from "@tangle-network/agent-profile-materialize";
 import { HarnessSessionContractError, assertArgvHonoursSessionContract, assertFlagsHonourSessionContract, assertStoreLocationHonoursSessionContract, compileSessionStoreGlob } from "@tangle-network/cli-agent-registry/session-contract";
 import { MAX_SECRET_PROFILE_REPLAY_CHARS, RESTORED_SESSION_CONTEXT_PREAMBLE, RESTORED_SESSION_CONTEXT_TAG, buildCompleteForkContextBlock, buildForkContextBlock, createMessageStore, createSessionStore, forkSessionWithMessages, readProviderMessageIds } from "@tangle-network/sdk-session-persistence";
 import { mkdir, open, readdir, writeFile } from "node:fs/promises";
-import path, { basename, isAbsolute, normalize, resolve } from "node:path";
-import fs, { constants, lstatSync, readFileSync } from "node:fs";
+import path, { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
+import * as fs$1 from "node:fs";
+import fs, { constants, lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
 import { execFile } from "node:child_process";
 import { isDeepStrictEqual, promisify } from "node:util";
 import { messageStorageDirOf } from "@tangle-network/cli-agent-registry";
-import { HARNESS_CONFORMANCE_PENDING, NATIVE_SESSION_CONTRACTS, configDirHomeEnv } from "@tangle-network/cli-agent-registry/native-session-contracts";
+import { NATIVE_SESSION_CONTRACTS, NATIVE_SESSION_CONTRACTS as NATIVE_SESSION_CONTRACTS$1, configDirHomeEnv } from "@tangle-network/cli-agent-registry/native-session-contracts";
 import { z } from "zod";
 import { fileURLToPath, pathToFileURL } from "node:url";
+import { DatabaseSync } from "node:sqlite";
 import { StringDecoder } from "node:string_decoder";
 import { DEFAULT_INTERACTION_MCP_SERVER_NAME, InteractionMcpServer as InteractionMcpServer$1, interactionMcpToolName } from "@tangle-network/agent-core/interactions/mcp";
+import { isRecord, isRecord as isPlainRecord } from "@tangle-network/agent-core";
 //#region src/acp-process-launch.ts
-/** Spawn an ACP agent over NDJSON stdio. The adapter owns abort, so no signal. */
+/** Spawn an ACP agent over NDJSON stdio from `env` alone, never the sidecar's own environment. The adapter owns abort, so no signal. */
 function spawnAcpBridge(request) {
 	return spawnRpcBridge({
 		...request,
-		maxStderrBytes: 65536
+		inheritEnv: false
 	});
 }
 /**
@@ -34,13 +37,12 @@ function jsonRpcErrorText(err) {
 	return cause && cause !== err.message ? `${err.message}: ${cause}` : err.message;
 }
 /**
-* Overlay the agent environment on an ACP process env, dropping unset keys. An
-* absent env means the inherited one, which the overlay then starts from.
+* An ACP process env: the spec's keys with the agent environment over them,
+* unset keys dropped. The agent environment is the whole inherited part.
 */
 function withAgentEnvironment(env, agent) {
-	if (Object.keys(agent).length === 0) return env;
 	const merged = {};
-	for (const [key, value] of Object.entries(env ?? process.env)) if (value !== void 0) merged[key] = value;
+	for (const [key, value] of Object.entries(env ?? {})) if (value !== void 0) merged[key] = value;
 	for (const [key, value] of Object.entries(agent)) if (value !== void 0) merged[key] = value;
 	return merged;
 }
@@ -61,32 +63,6 @@ function acpContentText(content) {
 	}
 	return parts.join("");
 }
-/** Map an ACP stop reason onto a turn status. */
-function mapAcpStopReason(reason) {
-	switch (reason) {
-		case "end_turn": return { status: "completed" };
-		case "max_tokens": return {
-			status: "completed",
-			detail: "Stopped at max tokens (output may be truncated)"
-		};
-		case "max_turn_requests": return {
-			status: "failed",
-			detail: "Hit max turn-requests limit"
-		};
-		case "refusal": return {
-			status: "failed",
-			detail: "Agent refused the request"
-		};
-		case "cancelled": return {
-			status: "failed",
-			detail: "Cancelled"
-		};
-		default: return {
-			status: "failed",
-			detail: `Unknown stop reason: ${reason ?? "<missing>"}`
-		};
-	}
-}
 //#endregion
 //#region src/reasoning-parts.ts
 /**
@@ -578,23 +554,6 @@ function nearestExistingAncestor(target) {
 		current = parent;
 	}
 }
-/**
-* True when a CLI can create and write `target`.
-*
-* A read-only mount is the case this exists for: the shared tool-cache root is
-* mounted read-only with only named subdirectories bound read-write, so a path
-* under it that has no bind mount refuses `mkdir` with `EROFS`. A CLI that
-* creates its cache directory at startup then dies before it runs, and a
-* caller waiting on that run observes silence, not an error.
-*
-* The check reads permissions and never creates anything. Creating the
-* directory here would run as the sidecar's own user and leave a directory the
-* agent user cannot write, which trades one unusable path for another.
-*
-* A directory the calling process may write but the agent subprocess may not
-* still reads as usable. Ownership is the spawn layer's concern; this answers
-* the mount-level question that silently kills a CLI.
-*/
 function isWritableTarget(target) {
 	const ancestor = nearestExistingAncestor(target);
 	if (!ancestor) return false;
@@ -659,9 +618,7 @@ function homeXdgEnv(home) {
 //#region src/adapter-lifecycle.ts
 const DEFAULT_CONTEXT_WINDOW = 2e5;
 const execFileAsync = promisify(execFile);
-/**
-* Console-based logger fallback.
-*/
+/** Console-based logger fallback. */
 const consoleLogger = {
 	debug: (msg, meta) => console.debug(`[cli-provider] ${msg}`, meta ?? ""),
 	info: (msg, meta) => console.info(`[cli-provider] ${msg}`, meta ?? ""),
@@ -670,13 +627,9 @@ const consoleLogger = {
 };
 /** Owns configuration, initialization, cancellation, and subprocess identity. */
 var CliAdapterLifecycle = class {
-	/**
-	* The message log directory when the caller names none. Unset, it is the
-	* registry spec's `messageStorageDir` for `provider`, the one source; only
-	* an adapter for a provider the registry does not know sets it.
-	*/
+	/** The message log directory when the caller names none. */
 	defaultStorageDir;
-	inheritProcessEnv = true;
+	inheritProcessEnv;
 	config;
 	initialConfig;
 	logger;
@@ -700,12 +653,10 @@ var CliAdapterLifecycle = class {
 		this.storagePath = options.storagePath ?? process.cwd();
 		this._storageDir = options.storageDir;
 		this.agentEnvironment = options.agentEnvironment;
+		this.inheritProcessEnv = options.agentEnvironment === void 0;
 		this.launcher = options.launcher;
 		this.ownProcessGroup = options.ownProcessGroup ?? false;
 	}
-	/**
-	* Get the storage directory. Uses provided storageDir or falls back to defaultStorageDir.
-	*/
 	get storageDir() {
 		return this._storageDir ?? this.defaultStorageDir ?? messageStorageDirOf(this.provider);
 	}
@@ -717,17 +668,7 @@ var CliAdapterLifecycle = class {
 		if (binding.sessionId !== sessionId) throw new Error(`Interaction binding session "${binding.sessionId}" does not match adapter session "${sessionId}"`);
 		return binding;
 	}
-	/**
-	* The uid/gid every CLI process this adapter spawns runs as, or undefined
-	* when the host process is already unprivileged.
-	*
-	* This is an adapter-wide invariant, not a per-callsite option, because
-	* these CLIs seed their own state on first use — a sqlite database, a log
-	* directory, a downloaded-binary cache under the harness HOME. An auxiliary
-	* invocation left at root (`mcp add`, `mcp list`, `--version`) creates that
-	* tree root-owned, and the streamed run, which does drop privileges, then
-	* cannot open its own log and exits before emitting a single event.
-	*/
+	/** The uid/gid every CLI process this adapter spawns runs as, or undefined when the host process is already unprivileged. */
 	subprocessIdentity() {
 		const assigned = this.config.subprocessUser;
 		if (assigned) {
@@ -749,16 +690,11 @@ var CliAdapterLifecycle = class {
 	subprocessSpawnOptions() {
 		return this.subprocessIdentity() ?? {};
 	}
-	/**
-	* Run a one-shot CLI command under this adapter's subprocess identity.
-	*
-	* Every auxiliary invocation an adapter makes goes through here so the
-	* identity cannot be forgotten at a call site. Auxiliary output stays out
-	* of the streamed turn's raw evidence.
-	*/
+	/** Run a one-shot CLI command under this adapter's subprocess identity. */
 	runCli(config) {
 		return execCli({
 			...config,
+			inheritEnv: this.inheritProcessEnv && config.inheritEnv !== false,
 			rawCapturePath: void 0,
 			...this.config.subprocessUser ? { isolatedIdentity: this.config.subprocessUser } : {},
 			spawnOptions: {
@@ -767,14 +703,7 @@ var CliAdapterLifecycle = class {
 			}
 		});
 	}
-	/**
-	* Run a builtin-only Node script under this adapter's subprocess identity
-	* and return its stdout. File work inside a directory the CLI user owns goes
-	* through here, so a root sidecar never creates, reads or writes there with
-	* its own rights: a link the agent plants reaches only what the agent could
-	* already reach. The script reads `args` from argv after `--` and `input`
-	* from stdin. A failure carries the script's stderr, not the script text.
-	*/
+	/** Run a builtin-only Node script under this adapter's subprocess identity and return its stdout. */
 	async runNodeAsSubprocess(script, args, input = "") {
 		try {
 			const pending = execFileAsync(process.execPath, [
@@ -884,26 +813,26 @@ var CliAdapterLifecycle = class {
 			model: this.config.model
 		});
 	}
-	/**
-	* Auth/config files the adapter needs on disk that do NOT arrive through
-	* `config.model.authFiles` — e.g. a synthesized `~/.openclaw/openclaw.json`
-	* pointing at the managed router. The sidecar materializes these through the
-	* hardened `materializeCliAuthFiles` path AFTER `initialize()`, so an adapter
-	* can derive them from the resolved config/env. Default: none.
-	*/
+	/** Auth/config files the adapter needs on disk that do NOT arrive through `config.model.authFiles` — e.g. */
 	getManagedAuthFiles() {
 		return [];
 	}
 	/** Provider-specific initialization runs inside the tracked lifecycle. */
 	async afterInitialize(_config) {}
-	/**
-	* The harness session contract this adapter honours (cli-agent-registry
-	* NATIVE_SESSION_CONTRACTS), or null for a provider that declares none.
-	* Registration refuses a harness spec without one; ACP overrides this per
-	* sub-agent.
-	*/
+	/** The harness session contract this adapter honours (cli-agent-registry NATIVE_SESSION_CONTRACTS), or null for a provider that declares none. */
 	sessionContract() {
-		return NATIVE_SESSION_CONTRACTS[this.provider] ?? null;
+		return NATIVE_SESSION_CONTRACTS$1[this.provider] ?? null;
+	}
+	async withExecution(signal, run) {
+		const execution = beginExecution(this, signal);
+		try {
+			return await run(execution.controller.signal);
+		} catch (error) {
+			execution.controller.abort();
+			throw error;
+		} finally {
+			finishExecution(this, execution);
+		}
 	}
 	async shutdown() {
 		this.initialization.cancel();
@@ -981,7 +910,8 @@ var CliAdapterLifecycle = class {
 	}
 	/** The agent environment the host supplied (CliProviderOptions.agentEnvironment). */
 	agentEnvironmentValues() {
-		return this.agentEnvironment?.() ?? {};
+		const secretProfile = !!this.config.secretProfileRevisionRoot;
+		return this.agentEnvironment?.({ secretProfile }) ?? (secretProfile ? {} : { ...process.env });
 	}
 	applyWritableHomeDefaults(adapterEnv, workspaceRoot) {
 		const env = {
@@ -1068,15 +998,19 @@ function runtimeSecretsOverlay(runtimeSecrets, fallback) {
 function hasPortableProfileControls(profile) {
 	return profile.prompt !== void 0 || profile.model !== void 0 || profile.harness !== void 0 || profile.permissions !== void 0 || profile.tools !== void 0 || profile.mcp !== void 0 || profile.connections !== void 0 || profile.subagents !== void 0 || profile.resources !== void 0 || profile.hooks !== void 0 || profile.modes !== void 0 || profile.confidential !== void 0 || profile.extensions !== void 0;
 }
+function systemPromptConflict(request, profile) {
+	return /* @__PURE__ */ new Error(`execution system prompt (${request.length} chars) conflicts with the materialized AgentProfile prompt.systemPrompt (${profile.length} chars); send no systemPrompt, or move the addition to appendSystemPrompt`);
+}
+/** A blank profile prompt declares none, so the request prompt stands. */
 function resolveSystemPrompt(requestPrompt, profilePrompt) {
-	if (profilePrompt === void 0) return requestPrompt;
-	if (requestPrompt !== void 0 && requestPrompt.length > 0 && requestPrompt !== profilePrompt) throw new Error("execution system prompt conflicts with the materialized AgentProfile");
+	if (!profilePrompt?.trim()) return requestPrompt;
+	if (requestPrompt && requestPrompt !== profilePrompt) throw systemPromptConflict(requestPrompt, profilePrompt);
 	return profilePrompt;
 }
 function profileForExecution(profile, requestPrompt) {
 	const profilePrompt = profile?.prompt?.systemPrompt;
-	if (!profile || profilePrompt === void 0 || requestPrompt === void 0 || requestPrompt.length === 0 || requestPrompt === profilePrompt) return profile;
-	if (!requestPrompt.startsWith(`${profilePrompt}\n\n`)) throw new Error("execution system prompt conflicts with the materialized AgentProfile");
+	if (!profile || !profilePrompt?.trim() || !requestPrompt || requestPrompt === profilePrompt) return profile;
+	if (!requestPrompt.startsWith(`${profilePrompt}\n\n`)) throw systemPromptConflict(requestPrompt, profilePrompt);
 	return {
 		...profile,
 		prompt: {
@@ -1101,10 +1035,10 @@ function resolveModel(requestModel, profileModel, configuredModel, profileProvid
 }
 //#endregion
 //#region src/profile-revision-receipts.ts
-/** Receipts belong to their adapter; they never become subclass controls. */
+/** Receipts belong to their adapter; resolved secrets never enter them. */
 var ProfileRevisionReceipts = class {
-	publicProfileRevisionReceipts = /* @__PURE__ */ new WeakMap();
-	secretProfileRevisionReceipts = /* @__PURE__ */ new WeakMap();
+	public = /* @__PURE__ */ new WeakMap();
+	secret = /* @__PURE__ */ new WeakMap();
 };
 const receiptsByAdapter = /* @__PURE__ */ new WeakMap();
 function profileRevisionReceipts(owner) {
@@ -1116,18 +1050,31 @@ function profileRevisionReceipts(owner) {
 	return receipts;
 }
 function assertExecutionProfileRevision(owner, getConfig, input, profilePlan) {
-	if (getConfig().publicProfileRevisionRoot && profilePlan && !profileRevisionReceipts(owner).publicProfileRevisionReceipts.has(profilePlan)) throw new Error("Provider added public profile launch controls after immutable revision preparation");
-	if (getConfig().secretProfileRevisionRoot && profilePlan && !profileRevisionReceipts(owner).secretProfileRevisionReceipts.has(profilePlan)) throw new Error("Provider added secret profile launch controls after immutable revision preparation");
-	const expectedSecretReceipt = input.expectedSecretProfileReceipt;
-	if (getConfig().secretProfileRevisionRoot) {
-		const actual = profilePlan ? profileRevisionReceipts(owner).secretProfileRevisionReceipts.get(profilePlan) : void 0;
-		if (!expectedSecretReceipt || !actual || actual.executorReceipt !== expectedSecretReceipt) throw new Error("Secret native profile receipt mismatch before native spawn");
-	} else if (expectedSecretReceipt !== void 0) throw new Error("Secret native profile execution is unavailable");
-	const expectedRevision = input.expectedPublicProfileRevision;
-	if (expectedRevision !== void 0) {
-		const actualRevision = profilePlan ? profileRevisionReceipts(owner).publicProfileRevisionReceipts.get(profilePlan) : void 0;
-		if (!actualRevision || actualRevision.workspacePlanDigest !== expectedRevision.workspacePlanDigest || actualRevision.materializedDigest !== expectedRevision.materializedDigest || actualRevision.launchDigest !== expectedRevision.launchDigest) throw new Error("Public native profile revision mismatch before native spawn");
-	}
+	const config = getConfig();
+	const receipts = profileRevisionReceipts(owner);
+	const actualPublic = profilePlan ? receipts.public.get(profilePlan) : void 0;
+	const actualSecret = profilePlan ? receipts.secret.get(profilePlan) : void 0;
+	for (const [root, receipt, kind] of [[
+		config.publicProfileRevisionRoot,
+		actualPublic,
+		"public"
+	], [
+		config.secretProfileRevisionRoot,
+		actualSecret,
+		"secret"
+	]]) if (root && profilePlan && !receipt) throw new Error(`Provider added ${kind} profile launch controls after immutable revision preparation`);
+	const { expectedSecretProfileReceipt, expectedPublicProfileRevision } = input;
+	if (config.secretProfileRevisionRoot) {
+		if (!expectedSecretProfileReceipt || !actualSecret || actualSecret.executorReceipt !== expectedSecretProfileReceipt) throw new Error("Secret native profile receipt mismatch before native spawn");
+	} else if (expectedSecretProfileReceipt !== void 0) throw new Error("Secret native profile execution is unavailable");
+	assertPublicReceipt(actualPublic, expectedPublicProfileRevision);
+}
+function assertPublicReceipt(actual, expected) {
+	if (expected !== void 0 && (!actual || [
+		"workspacePlanDigest",
+		"materializedDigest",
+		"launchDigest"
+	].some((key) => actual[key] !== expected[key]))) throw new Error("Public native profile revision mismatch before native spawn");
 }
 //#endregion
 //#region src/errors.ts
@@ -1230,23 +1177,6 @@ function buildFileUrl(input) {
 function deterministicFilePartId(messageId, key) {
 	return `file-${sha1Hex(`${messageId}|${key}`).slice(0, 16)}`;
 }
-/**
-* Stateless derivation of the canonical file-part fields for one observed
-* path: resolve-once (normalize, then anchor a relative path to
-* `workspaceRoot`), and from that single resolved path derive the dedupe
-* `key`, the deterministic `id`, the `filename`, the inferred `mediaType`,
-* and the percent-encoded `file://` `url` — so every consumer that surfaces
-* the same file agrees on all five.
-*
-* Returns `null` for a relative path with no `workspaceRoot` to anchor it:
-* detection is opportunistic and a fabricated location is worse than a
-* missing part (see `trackFilePart` for the full rationale).
-*
-* This is the ONE derivation chain. `trackFilePart` (exec path, with
-* ExecutionState memoization) and stateless mappers that own no
-* ExecutionState (codex's app-server item mapper) both call it — never
-* re-implement the chain, or the two paths drift.
-*/
 function deriveFilePart(input) {
 	const normalized = normalize(input.path);
 	let resolvedPath;
@@ -1262,33 +1192,6 @@ function deriveFilePart(input) {
 		url: buildFileUrl({ path: resolvedPath })
 	};
 }
-/**
-* Tracks a file an adapter observed being created/modified (e.g. from a
-* write-tool call) and returns the canonical `FilePart` fields to stream,
-* deduping by resolved-absolute-path or data-URI content so repeated writes
-* to the same file update one part instead of appending duplicates.
-*
-* The path is normalized and resolved to an absolute form ONCE, and that same
-* resolved value drives both the dedupe key and the `file://` url — so two
-* observations of the same file that differ only in spelling (`./chart.png`
-* vs `/workspace/chart.png`, or `/workspace/sub/../chart.png` vs
-* `/workspace/chart.png`) unify on one part with one stable url, satisfying
-* the stream invariant that a given part id keeps a stable url.
-*
-* A relative path can only be resolved against `state.workspaceRoot` (set by
-* the adapter from the CLI's cwd). Detection here is opportunistic — a
-* tool-call observation, not a guarantee of an absolute path — so when no
-* workspaceRoot is available to anchor a relative path, we drop the
-* observation (`null`) rather than fabricate an anchor (e.g. resolving
-* against "/"): a wrong url is worse than a missing part, and a caller that
-* genuinely lost the file would get a wrong, permanent url once it's on the
-* stream.
-*
-* Detection is opportunistic for other reasons too: a delete, or an
-* observation carrying neither a path nor a data URI, also yields no part
-* (`null`) rather than an error — callers are not required to have a file
-* signal on every tool result.
-*/
 function trackFilePart(state, args) {
 	if (args.changeKind === "delete") return null;
 	if (args.path === void 0 && args.dataUri === void 0) return null;
@@ -1536,51 +1439,23 @@ function enabledInteractionKinds(config, supported) {
 	if (typeof config !== "object" || config === null) return [];
 	return supported.filter((kind) => config[kind] === true);
 }
-/**
-* Read a turn's ephemeral context, rejecting a wrong-typed value loudly.
-*
-* The published `AgentExecutionInput` does not declare the field, so nothing
-* type-checks it at the process boundary. Left unchecked, a caller passing a
-* non-string gets it stringified into the model prompt (`[object Object]`) —
-* a corrupted turn with no error anywhere. `undefined`/`null` mean "no context
-* this turn"; an empty string is likewise nothing to append.
-*/
 function readEphemeralContext(input) {
 	const context = input.ephemeralContext;
 	if (context === void 0 || context === null) return void 0;
 	if (typeof context !== "string") throw new TypeError(`ephemeralContext must be a string, received ${typeof context}`);
 	return context || void 0;
 }
-/**
-* Compose the model-facing prompt for a turn: the caller's own text, then this
-* turn's ephemeral context. Call it at the point the prompt is handed to the
-* provider — NEVER on the parts handed to `recordUserMessage` or the message
-* store.
-*/
+/** Compose the model-facing prompt for a turn: the caller's own text, then this turn's ephemeral context. */
 function withEphemeralContext(promptText, input) {
 	const context = readEphemeralContext(input);
 	if (!context) return promptText;
 	return promptText ? `${promptText}\n\n${context}` : context;
 }
-/**
-* Resolve whether an interaction kind is active for THIS turn. When the turn
-* carries `interactions` it is authoritative — a complete set that can also
-* turn a kind OFF mid-session; otherwise the adapter falls back to its latched
-* config (the initialize-time wiring, or a direct non-sidecar caller's option).
-*/
 function turnInteractionEnabled(input, latched, kind) {
 	const perTurn = input.interactions;
 	return interactionToggleEnabled(perTurn !== void 0 ? perTurn : latched, kind);
 }
-/**
-* Overlay this turn's interactions onto a latched config, returning a NEW
-* object (no shared mutation — safe when one adapter instance serves concurrent
-* turns from different sessions). When the turn omits `interactions` the config
-* is returned unchanged, preserving behavior for direct non-sidecar callers.
-* Adapters read plan/permission/question posture off the returned config so a
-* mid-session toggle takes effect and can turn a kind off (which the latched
-* config, only ever merged by updateConfig, cannot).
-*/
+/** Overlay this turn's interactions onto a latched config, returning a NEW object (no shared mutation — safe when. */
 function withTurnInteractions(config, input) {
 	if (input.interactions === void 0) return config;
 	return {
@@ -1588,29 +1463,30 @@ function withTurnInteractions(config, input) {
 		interactions: input.interactions
 	};
 }
-//#endregion
-//#region src/adapter-profile.ts
 /**
-* Revisions that already passed the native health check in this process, by
-* the verifier's scope and the revision's materialized digest. The check asks
-* whether the pinned native CLI loads this revision's bytes: a function of
-* those bytes and that CLI, not of the session or subprocess UID that will
-* read them (the ACL grant that publishes a revision to a UID throws when it
-* fails). A session's identity changes whenever its profile variant or turn
-* credential does, so keying by the session's receipt checked an unchanged
-* profile again every turn. Secret values are excluded from the digest.
-* Agents are rebuilt per request, so this outlives any adapter.
-* Insertion-ordered and bounded: the oldest entry is forgotten first.
+* The one precedence every engine names a failed turn's end with (#16404): an
+* end the abort, the timeout or the harness named is theirs; only an
+* unexplained death is the link's, the memory limit's or the harness's.
 */
+function turnEndReason(end) {
+	if (end.aborted) return "abort";
+	if (end.timedOut) return "timeout";
+	if (end.harnessFailed) return "failed";
+	if (end.linkLost) return "gateway_disconnect";
+	if (end.memoryKilled) return "memory_limit";
+	return end.signal ? "harness_exit" : "failed";
+}
+//#endregion
+//#region src/adapter-profile.ts
+/** Revisions that already passed the native health check in this process, by the verifier's scope and the revision's materialized digest. */
 const verifiedSecretProfileRevisions = /* @__PURE__ */ new Set();
 const VERIFIED_SECRET_PROFILE_REVISIONS_MAX = 1024;
 function rememberVerifiedSecretProfileRevision(key) {
 	verifiedSecretProfileRevisions.delete(key);
 	verifiedSecretProfileRevisions.add(key);
-	while (verifiedSecretProfileRevisions.size > VERIFIED_SECRET_PROFILE_REVISIONS_MAX) {
+	if (verifiedSecretProfileRevisions.size > VERIFIED_SECRET_PROFILE_REVISIONS_MAX) {
 		const oldest = verifiedSecretProfileRevisions.values().next().value;
-		if (oldest === void 0) break;
-		verifiedSecretProfileRevisions.delete(oldest);
+		if (oldest !== void 0) verifiedSecretProfileRevisions.delete(oldest);
 	}
 }
 /** The executor's naming key, refused unless root owns it alone. */
@@ -1628,35 +1504,19 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 	supportsSecretProfileRevisions = false;
 	profileSecretProvider;
 	secretProfileRuntimeKeyProvider;
-	/**
-	* The materialized digest behind each secret revision. It stays here: the
-	* executor receipt is all a caller sees of a revision's resolved contents.
-	*/
-	secretProfileMaterializedDigests = /* @__PURE__ */ new WeakMap();
-	/**
-	* The value behind each `{env:NAME}` reference in a secret revision's
-	* config, by that revision's application. Executor memory only: no launch
-	* environment, argv or file ever carries them.
-	*/
-	secretProfileReferenceValues = /* @__PURE__ */ new WeakMap();
+	/** Private native preparation state; never part of a returned receipt. */
+	secretProfileRevisions = /* @__PURE__ */ new WeakMap();
 	constructor(options = {}) {
 		super(options);
-		profileRevisionReceipts(this);
 		this.profileSecretProvider = options.profileSecretProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
 		this.secretProfileRuntimeKeyProvider = options.secretProfileRuntimeKeyProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
 	}
-	/** Apply captured diagnostic identity to this spawn, after profile composition. */
 	/** The exact child environment a turn uses; shared with prewarm paths. */
 	buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders) {
 		const merged = this.mergeProfilePlanEnvironment(this.buildNativeExecutionEnvironment(executionConfig), profilePlan, executionConfig.nativeAuthEnv !== void 0 || (executionConfig.authFiles?.length ?? 0) > 0);
 		return this.bindExecutionCorrelation(this.applyWritableHomeDefaults(this.bindProfileToolBinDirs(merged, profilePlan), workspaceRoot), correlationHeaders);
 	}
-	/**
-	* A profile's declared executable tools, sealed in its revision, stand in
-	* for the app's own tool dirs on this launch's PATH tail. A secret profile's
-	* env no longer names the app's dirs (app env is scrubbed), so the sidecar's
-	* own SANDBOX_TOOL_BIN_DIRS says which inherited PATH entries they are.
-	*/
+	/** A profile's declared executable tools, sealed in its revision, stand in for the app's own tool dirs on this launch's PATH tail. */
 	bindProfileToolBinDirs(env, profilePlan) {
 		const toolBinDirs = profilePlan?.spawn.toolBinDirs;
 		if (!toolBinDirs?.length) return env;
@@ -1669,35 +1529,45 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 		if (correlationHeaders !== void 0 && Object.keys(correlationHeaders).some((name) => name !== "X-Tangle-Trace-ID")) this.logger.warn("Native model request correlation is unsupported", { provider: this.provider });
 		return environment;
 	}
-	/**
-	* Provision the inline profile's files and native execution controls with the
-	* shared materializer used by cli-bridge. Unsupported portable controls fail
-	* before spawn unless the profile is explicitly best-effort
-	* (resources.failOnError: false), which materializes the supported subset
-	* and warns about the rest.
-	*/
-	/**
-	* Launcher controls this adapter OWNS on the spawn it starts — see
-	* `BINDABLE_LAUNCH_CONTROLS` in the materializer. Empty by default: a plan
-	* whose intent needs a launcher binding then fails closed instead of being
-	* silently dropped. An adapter that really applies the plan's launch flags
-	* to its own spawn (sdk-provider-opencode selecting the plan's primary
-	* agent via `--agent`) overrides this with the controls it honors.
-	*/
+	/** Launcher controls this adapter OWNS on the spawn it starts — see `BINDABLE_LAUNCH_CONTROLS` in the materializer. */
 	profileMaterializationBinds() {
 		return [];
 	}
-	/** Optional native instruction root. The adapter owns how its runtime locates this directory. */
+	/** Optional native instruction root. */
 	profileAgentDirectory(_workspaceRoot) {}
 	/** Provider transport bound into the private immutable revision and receipt. */
 	secretProfileProviderConfig() {}
-	/**
-	* The values behind a secret revision's `{env:NAME}` config references, for
-	* an executor that serves those references itself. Never pass them to the
-	* native process.
-	*/
+	/** The values behind a secret revision's `{env:NAME}` config references, for an executor that serves those references itself. */
 	secretProfileReferences(application) {
-		return application ? this.secretProfileReferenceValues.get(application) : void 0;
+		return application ? this.secretProfileRevisions.get(application)?.references : void 0;
+	}
+	/** The one sealed session view repointed only while its native turn owns the queue. */
+	secretProfileSessionView(sessionId) {
+		const root = this.config.secretProfileRevisionRoot;
+		const subprocessUid = this.config.subprocessUser?.uid;
+		if (!root || subprocessUid === void 0) throw new Error("Secret profile session view is unavailable");
+		const launchRoot = join(root, "launch");
+		return {
+			launchRoot,
+			view: secretSessionViewWorkspace({
+				launchRoot,
+				sharedWorkspaceDir: this.storagePath,
+				sessionId,
+				subprocessUid
+			}),
+			subprocessUid
+		};
+	}
+	/** Bind the private revision into the session's stable native cwd. */
+	bindSecretProfileSessionView(revisionWorkspaceDir, sessionId) {
+		const { launchRoot, view, subprocessUid } = this.secretProfileSessionView(sessionId);
+		bindSecretSessionView({
+			launchRoot,
+			viewWorkspaceDir: view,
+			revisionWorkspaceDir,
+			subprocessUid
+		});
+		return view;
 	}
 	async materializeProfileResources(inputProfile, workspaceRoot, ownerId, sessionId, scope = "turn") {
 		if (!inputProfile && !this.config.runtimeAttachments) return void 0;
@@ -1743,7 +1613,7 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 			});
 			const launchDigest = revision.manifest.launchDigest;
 			if (!launchDigest) throw new Error("Concurrent profile launch digest was not recorded");
-			profileRevisionReceipts(this).publicProfileRevisionReceipts.set(revision.application, {
+			profileRevisionReceipts(this).public.set(revision.application, {
 				workspacePlanDigest: revision.manifest.workspacePlanDigest,
 				materializedDigest: revision.manifest.materializedDigest,
 				launchDigest,
@@ -1763,10 +1633,7 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 		});
 		return application;
 	}
-	/**
-	* Publish the profile as an executor-sealed revision for this session's
-	* subprocess identity, and record the receipt that binds it to the turn.
-	*/
+	/** Publish the profile as an executor-sealed revision for this session's subprocess identity, and record the receipt that binds it to the turn. */
 	async applySecretProfileRevision(plan, secretProfileRevisionRoot, workspaceRoot, ownerId, sessionId) {
 		if (!this.supportsSecretProfileRevisions || !ownerId || !sessionId || !this.config.subprocessUser) throw new Error("Secret concurrent profile needs an opted-in adapter, a session, and per-turn runtime secrets only");
 		const namingKey = readSecretProfileNamingKey(this.config.secretProfileNamingKeyPath);
@@ -1784,25 +1651,24 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 		const launchDigest = revision.manifest.launchDigest;
 		if (!launchDigest) throw new Error("Secret concurrent profile launch digest is absent");
 		const executorReceipt = `hmac-sha256:${createHmac("sha256", namingKey).update(ownerId).update("\0").update(sessionId).update("\0").update(String(this.config.subprocessUser.uid)).update("\0").update(revision.manifest.workspacePlanDigest).update("\0").update(revision.manifest.materializedDigest).update("\0").update(launchDigest).digest("hex")}`;
-		this.secretProfileReferenceValues.set(revision.application, revision.secretReferences);
-		this.secretProfileMaterializedDigests.set(revision.application, revision.manifest.materializedDigest);
-		profileRevisionReceipts(this).secretProfileRevisionReceipts.set(revision.application, {
+		this.secretProfileRevisions.set(revision.application, {
+			materializedDigest: revision.manifest.materializedDigest,
+			references: revision.secretReferences
+		});
+		profileRevisionReceipts(this).secret.set(revision.application, {
 			workspacePlanDigest: revision.manifest.workspacePlanDigest,
 			executorReceipt,
 			conflicts: revision.manifest.conflicts.map((conflict) => ({ ...conflict }))
 		});
 		return revision.application;
 	}
-	/**
-	* Prepare the same provider-composed native plan that execute() will check.
-	* This may publish an immutable public revision, but never starts a model turn.
-	*/
+	/** Prepare the same provider-composed native plan that execute() will check. */
 	async preparePublicProfileRevision(input) {
 		if (!this.config.publicProfileRevisionRoot) throw new Error("Concurrent public profile materialization is disabled");
 		const sessionScope = input.userId ?? input.sessionId;
 		if (!sessionScope) throw new Error("Concurrent public profile preparation needs a session scope");
 		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
-		const receipt = application ? profileRevisionReceipts(this).publicProfileRevisionReceipts.get(application) : void 0;
+		const receipt = application ? profileRevisionReceipts(this).public.get(application) : void 0;
 		if (!receipt) throw new Error("Concurrent public profile preparation produced no native plan");
 		return receipt;
 	}
@@ -1814,9 +1680,9 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 		const startedAt = performance.now();
 		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
 		const materializedAt = performance.now();
-		const receipt = application ? profileRevisionReceipts(this).secretProfileRevisionReceipts.get(application) : void 0;
+		const receipt = application ? profileRevisionReceipts(this).secret.get(application) : void 0;
 		if (!application || !receipt) throw new Error("Secret profile preparation produced no native plan");
-		const materializedDigest = this.secretProfileMaterializedDigests.get(application);
+		const materializedDigest = this.secretProfileRevisions.get(application)?.materializedDigest;
 		if (!materializedDigest) throw new Error("Secret profile preparation produced no revision digest");
 		const verification = `${this.secretProfileVerificationScope()}\0${materializedDigest}`;
 		const verifyCached = verifiedSecretProfileRevisions.has(verification);
@@ -1829,11 +1695,7 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 		});
 		return receipt;
 	}
-	/**
-	* What the native health check's verdict depends on besides a revision's
-	* bytes: the executable that loads them. A provider whose check runs
-	* through a configurable binary names it here.
-	*/
+	/** What the native health check's verdict depends on besides a revision's bytes: the executable that loads them. */
 	secretProfileVerificationScope() {
 		return this.provider;
 	}
@@ -1862,18 +1724,18 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 			extraFlags: [...config.extraFlags ?? [], ...profilePlan.spawn.flags]
 		};
 	}
+	/** A profile's addition precedes host context while preserving its harness prompt. */
+	resolveProfilePrompts(input, plan, profile = this.resolveExecutionProfileForInput(input)) {
+		const addition = plan?.spawn.appendSystemPrompt;
+		const keep = keepsHarnessSystemPrompt(profile, this.profileHarness);
+		return {
+			systemPrompt: keep ? void 0 : this.resolveProfileSystemPrompt(input.systemPrompt, plan),
+			appendSystemPrompt: keep ? joinSystemPromptAdditions(addition, input.systemPrompt, input.appendSystemPrompt) : input.appendSystemPrompt ? joinSystemPromptAdditions(addition, input.appendSystemPrompt) : addition
+		};
+	}
 	resolveProfileSystemPrompt(requestPrompt, profilePlan) {
 		return resolveSystemPrompt(requestPrompt, profilePlan?.spawn.systemPrompt);
 	}
-	/**
-	* The plan's additive prompt intent for this spawn. No request-level
-	* counterpart exists (`AgentExecutionInput` carries only the replacement),
-	* so unlike {@link resolveProfileSystemPrompt} there is nothing to
-	* conflict-check against.
-	*/
-	resolveProfileAppendSystemPrompt(profilePlan) {
-		return profilePlan?.spawn.appendSystemPrompt;
-	}
 	resolveProfileModel(requestModel) {
 		return resolveModel(requestModel, this.config.profile?.model?.default, this.config.model, this.config.profile?.model?.provider);
 	}
@@ -1893,26 +1755,20 @@ var CliAdapterProfile = class extends CliAdapterLifecycle {
 	}
 	async preparePromptInput(parts, workspaceRoot, sessionId, options) {
 		return preparePromptInputParts(parts, workspaceRoot, sessionId, {
-			nativeAttachmentKinds: options?.nativeAttachmentKinds ?? this.nativeAttachmentKinds(),
-			...options?.inlineImageBudgetBytes !== void 0 ? { inlineImageBudgetBytes: options.inlineImageBudgetBytes } : {}
+			...options,
+			nativeAttachmentKinds: options?.nativeAttachmentKinds ?? this.nativeAttachmentKinds()
 		});
 	}
-	/**
-	* Attachment kinds this adapter forwards natively via buildExecArgs (argv
-	* flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]`
-	* text marker. The base adapter omits those kinds' markers from the prompt
-	* text — an adapter that opts a kind in MUST deliver every attachment of
-	* that kind itself, or the model never sees it.
-	*/
+	/** Attachment kinds this adapter forwards natively via buildExecArgs (argv flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]` text marker. */
 	nativeAttachmentKinds() {
 		return [];
 	}
 };
 //#endregion
 //#region src/native-session-enforcement.ts
-/** Store location and identity deadlines apply once a receipt proves the contract. */
-function sessionContractFullyEnforced(provider) {
-	return !Object.hasOwn(HARNESS_CONFORMANCE_PENDING, provider);
+/** Every shipped harness is enforced. A missing receipt is a failed proof, not a skip. */
+function sessionContractFullyEnforced(_provider) {
+	return true;
 }
 //#endregion
 //#region src/adapter-sessions.ts
@@ -2177,30 +2033,25 @@ const FAILURE_STDERR_TAIL_LIMIT = 600;
 * message.
 *
 * A provider that reports its OWN terminal failure — an empty event stream, an
-* unfinished model step — explains what it saw but not how the process ended,
-* and those are different defects: a CLI that exited 0 having emitted nothing
-* is misconfigured, one killed on the timeout is stuck, one that exited 9 with
-* stderr crashed. The exit status and the CLI's stderr are in hand at the
-* point the error is built; without this they reached only a log line and the
-* caller got a bare sentence to debug from.
-*
-* Each part is skipped when the message already states it, so a message
-* derived FROM stderr or from the exit code is never doubled.
+* unfinished model step — explains what it saw but not how the process ended:
+* a CLI that exited 0 having emitted nothing is misconfigured, one killed on the
+* timeout is stuck, one that exited 9 with stderr crashed. Each part is skipped
+* when the message already states it, so a message derived FROM stderr or the
+* exit code is never doubled.
 */
 function withCliExitDiagnostics(message, exit, stderr) {
 	const parts = [];
 	if (exit.stdinError && !message.includes(exit.stdinError)) parts.push(`stdin failed: ${exit.stdinError}`);
-	if (exit.timedOut) {
-		const timeoutDetail = exit.timeoutDiagnostic;
-		if (timeoutDetail) {
-			if (!message.includes(timeoutDetail)) parts.push(timeoutDetail);
-		} else if (!/timed out/i.test(message)) parts.push("timed out");
-	}
+	const timeout = exit.timedOut ? exit.timeoutDiagnostic ?? "timed out" : "";
+	if (timeout && !message.toLowerCase().includes(timeout.toLowerCase())) parts.push(timeout);
 	if (exit.code !== null) {
 		if (!message.includes(`code ${exit.code}`)) parts.push(`exit code ${exit.code}`);
 	} else if (exit.signal) parts.push(`killed by ${exit.signal}`);
 	const trimmedStderr = stderr.trim();
-	if (trimmedStderr && !message.includes(trimmedStderr)) parts.push(`stderr: ${trimmedStderr.length > FAILURE_STDERR_TAIL_LIMIT ? `…${trimmedStderr.slice(-FAILURE_STDERR_TAIL_LIMIT)}` : trimmedStderr}`);
+	if (trimmedStderr && !message.includes(trimmedStderr)) {
+		const tail = trimmedStderr.slice(-FAILURE_STDERR_TAIL_LIMIT);
+		parts.push(`stderr: ${tail === trimmedStderr ? "" : "…"}${tail}`);
+	}
 	return parts.length === 0 ? message : `${message} (${parts.join("; ")})`;
 }
 //#endregion
@@ -2366,9 +2217,20 @@ var CliAdapterMcp = class extends CliAdapterSessions {
 };
 //#endregion
 //#region src/execution-state.ts
-/**
-* Creates a new execution state.
-*/
+/** A file of the sandbox's cgroup (#7571); undefined off Linux or outside one. */
+function readCgroupFile(name) {
+	try {
+		return readFileSync(`/sys/fs/cgroup/${name}`, "utf8").trim();
+	} catch {
+		return;
+	}
+}
+/** The sandbox's OOM-kill count: a running total for the whole box. */
+function oomKills() {
+	const events = readCgroupFile("memory.events") ?? "";
+	return Number(/^oom_kill (\d+)$/m.exec(events)?.[1] ?? 0);
+}
+/** Creates a new execution state. */
 function createExecutionState(sessionId, messageId, workspaceRoot) {
 	return {
 		sessionId,
@@ -2376,7 +2238,8 @@ function createExecutionState(sessionId, messageId, workspaceRoot) {
 		workspaceRoot,
 		toolCalls: /* @__PURE__ */ new Map(),
 		textBuffer: "",
-		reasoningBuffer: []
+		reasoningBuffer: [],
+		oomKillsAtStart: oomKills()
 	};
 }
 //#endregion
@@ -2438,10 +2301,9 @@ async function findCachedTurn(recorder, input, logger, sessionId) {
 		turnId: input.turnId,
 		sessionId
 	});
-	const outcome = cached.outcome === void 0 ? { type: "completed" } : AgentExecutionOutcomeSchema.parse(cached.outcome);
 	return {
 		...cached,
-		outcome
+		outcome: AgentExecutionOutcomeSchema.parse(cached.outcome)
 	};
 }
 /**
@@ -2482,7 +2344,98 @@ function armNativeSessionDeadline(params) {
 	deadline.unref();
 	return deadline;
 }
-/** Accumulate a turn process's stderr as text. */
+function idIn(glob, rel) {
+	const g = glob.split("/");
+	const r = rel.split("/");
+	let gi = 0;
+	let ri = 0;
+	let id = null;
+	while (gi < g.length && ri < r.length) {
+		const part = g[gi];
+		if (part === "**") {
+			const rest = g.slice(gi + 1).join("/");
+			if (!rest) return id;
+			for (let k = ri; k < r.length; k++) {
+				const found = idIn(rest, r.slice(k).join("/"));
+				if (found) return found;
+			}
+			return null;
+		}
+		if (part?.includes("{id}")) {
+			const [pre, post] = part.split("{id}");
+			const name = r[ri] ?? "";
+			if (!name.startsWith(pre ?? "") || !name.endsWith(post ?? "")) return null;
+			id = name.slice((pre ?? "").length, name.length - (post ?? "").length);
+		} else if (part !== "*" && part !== r[ri]) return null;
+		gi += 1;
+		ri += 1;
+	}
+	return gi === g.length && ri === r.length ? id : null;
+}
+function filesUnder(dir, prefix, out) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const name = String(entry.name);
+		const rel = prefix ? `${prefix}/${name}` : name;
+		if (entry.isDirectory()) filesUnder(join(dir, name), rel, out);
+		else out.push(rel);
+	}
+}
+function idsNow(home, stores) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const store of stores) {
+		const root = join(home, store.root);
+		if (store.shared && store.write === "sqlite-wal") {
+			try {
+				const db = new DatabaseSync(join(root, store.files[0] ?? "state.db"), { readOnly: true });
+				try {
+					let rows;
+					try {
+						rows = db.prepare("SELECT id FROM sessions").all();
+					} catch {
+						rows = db.prepare("SELECT session_id AS id FROM session_windows").all();
+					}
+					for (const row of rows) if (row.id) ids.add(row.id);
+				} finally {
+					db.close();
+				}
+			} catch {}
+			continue;
+		}
+		const found = [];
+		filesUnder(root, "", found);
+		for (const rel of found) for (const glob of store.files) {
+			const id = idIn(glob, rel);
+			if (id) ids.add(id);
+		}
+	}
+	return ids;
+}
+function watchNewSessionIds(params) {
+	const home = params.runtimeHome?.trim().replace(/\/+$/u, "");
+	const contract = params.sessionContract;
+	if (!home || contract?.identity.kind !== "first-event") return () => {};
+	const seen = idsNow(home, contract.stores);
+	const timer = setInterval(() => {
+		if (params.observer.nativeSessionObserved) return;
+		for (const id of idsNow(home, contract.stores)) {
+			if (seen.has(id)) continue;
+			seen.add(id);
+			params.observer.onEvent({
+				type: "native.session.observed",
+				provider: params.provider,
+				nativeSessionId: id
+			});
+		}
+	}, 200);
+	timer.unref();
+	return () => clearInterval(timer);
+}
 function collectStderr(cliProcess) {
 	let text = "";
 	const stderrDecoder = new StringDecoder("utf8");
@@ -2496,16 +2449,46 @@ function collectStderr(cliProcess) {
 		return text;
 	} };
 }
-/** The message a failed turn reports, from the strongest available cause. */
-function describeCliFailure(params) {
-	const { provider, state, exitResult, stderr, command, nixBinPath } = params;
-	const spawnFailure = exitResult.spawnError ? `Failed to spawn "${command}": ${exitResult.spawnError}` + (exitResult.spawnError.includes("ENOENT") ? ` — binary not found in PATH${nixBinPath ? ` (NIX_BIN_PATH=${nixBinPath})` : " (NIX_BIN_PATH unset — is the Nix profile mounted?)"}` : "") : null;
-	const failureCause = state.failure?.message ?? state.lastDiagnostic ?? (exitResult.timedOut ? exitResult.timeoutDiagnostic ?? "Execution timed out" : void 0) ?? (stderr.trim() || (state.terminalStatus === "failed" ? `${provider} reported a failed terminal status` : `Process exited with code ${exitResult.code}`));
-	return spawnFailure ?? withCliExitDiagnostics(failureCause, exitResult, stderr);
+/** A turn's stderr or ACP error when its link to its harness's server dropped (#8819). */
+const HARNESS_LINK_LOST = /\b(?:ECONNRESET|ECONNREFUSED|EPIPE|UND_ERR_SOCKET)\b|ended before (?:it|the turn) completed|Gateway disconnected/u;
+/**
+* Names a SIGKILL from the memory limit (#7571): the CLI runs in the sandbox's
+* cgroup, whose `memory.events` counts OOM kills under the `memory.max` limit.
+* The count is the box's running total, so only a kill since the turn started
+* is this turn's.
+*/
+function memoryLimitKill(killsAtStart = 0) {
+	const kills = oomKills() - killsAtStart;
+	if (kills < 1) return void 0;
+	const max = readCgroupFile("memory.max") ?? "max";
+	return `The sandbox's ${max === "max" ? "host" : `${Number(max) / 2 ** 20} MiB`} memory limit OOM-killed ${kills} process(es) during this turn: give the sandbox more memory or make the tool use less`;
 }
-/** The error a failed turn throws, carrying the stream's failure details. */
-function buildTurnFailure(params) {
-	const { provider, errorMessage, state, startTime, endTime } = params;
+/**
+* A failed CLI turn's end and error (#16404): a guard's end is its own, the
+* rest is `turnEndReason`'s; a session death and a memory-limit kill carry
+* their wire code.
+*/
+function endFailedTurn(params) {
+	const { provider, state, exitResult, stderr, startTime, endTime } = params;
+	const oom = exitResult.signal === "SIGKILL" && memoryLimitKill(state.oomKillsAtStart);
+	state.endReason ??= turnEndReason({
+		aborted: params.aborted,
+		timedOut: exitResult.timedOut,
+		harnessFailed: Boolean(state.terminalStatus),
+		linkLost: HARNESS_LINK_LOST.test(stderr),
+		memoryKilled: Boolean(oom),
+		signal: exitResult.signal
+	});
+	if (oom && state.endReason === "memory_limit") state.failure ??= {
+		code: "MEMORY_LIMIT_KILLED",
+		message: oom
+	};
+	if (["gateway_disconnect", "harness_exit"].includes(state.endReason)) state.failure ??= {
+		code: "SESSION_DIED",
+		message: `Harness session died (${state.endReason}): start a new session, or send the next turn to this session to resume it`
+	};
+	const nix = params.nixBinPath ? ` (NIX_BIN_PATH=${params.nixBinPath})` : " (NIX_BIN_PATH unset — is the Nix profile mounted?)";
+	const errorMessage = exitResult.spawnError ? `Failed to spawn "${params.command}": ${exitResult.spawnError}${exitResult.spawnError.includes("ENOENT") ? ` — binary not found in PATH${nix}` : ""}` : withCliExitDiagnostics(state.failure?.message ?? state.lastDiagnostic ?? (exitResult.timedOut ? exitResult.timeoutDiagnostic ?? "Execution timed out" : void 0) ?? (stderr.trim() || (state.terminalStatus === "failed" ? `${provider} reported a failed terminal status` : `Process exited with code ${exitResult.code}`)), exitResult, stderr);
 	const failure = new AgentExecutionError(`${provider} execution failed: ${errorMessage}`, {
 		...state.tokenUsage ? { tokenUsage: state.tokenUsage } : {},
 		timing: {
@@ -2514,14 +2497,19 @@ function buildTurnFailure(params) {
 			durationMs: endTime - startTime
 		}
 	});
-	if (state.failure) Object.assign(failure, {
-		...state.failure.code ? { code: state.failure.code } : {},
-		...state.failure.statusCode === void 0 ? {} : {
+	Object.assign(failure, {
+		reason: state.endReason,
+		...state.failure?.code ? { code: state.failure.code } : {},
+		...state.failure?.statusCode === void 0 ? {} : {
 			statusCode: state.failure.statusCode,
 			status: state.failure.statusCode
-		}
+		},
+		...state.failure?.resetAt ? { resetAt: state.failure.resetAt } : {}
 	});
-	return failure;
+	return {
+		errorMessage,
+		failure
+	};
 }
 /**
 * Best-effort: stamp the assistant message interrupted so reattach can
@@ -2570,14 +2558,12 @@ function buildExecutionResult(params) {
 		}
 	};
 }
-/** A turn whose provider session record failed to persist ends failed. */
 function failOnProviderSessionPersistence(observer, state) {
 	if (!observer.providerSessionPersistenceError) return;
 	const message = observer.providerSessionPersistenceError instanceof Error ? observer.providerSessionPersistenceError.message : String(observer.providerSessionPersistenceError);
 	state.terminalStatus = "failed";
 	state.lastDiagnostic = `Provider session persistence failed: ${message}`;
 }
-/** Log a non-zero exit the provider accepted, and the stderr a successful turn left. */
 function logAcceptedCliExit(logger, exitResult, stderr) {
 	if (!exitResult.success) logger.info("CLI process exited non-zero but was treated as success by provider", {
 		exitCode: exitResult.code,
@@ -2683,14 +2669,20 @@ function describeFailure(part, repairToolNames) {
 }
 function createRepeatedToolFailureGuard(options) {
 	const { limit } = options;
-	if (!Number.isInteger(limit) || limit < 1) throw new Error(`Repeated tool-failure limit must be a positive whole number (got ${limit})`);
 	const repairToolNames = options.repairToolNames ?? NO_REPAIR_TOOL_NAMES;
 	let signature;
 	let previousInput;
 	let count = 0;
 	let lastScoredPartId;
 	let tripped = false;
-	return { observe(part) {
+	return { 
+	/**
+	* Feed one tool part. Returns the trip on the call that reaches the limit,
+	* and `undefined` every other time. A tripped guard stays tripped and
+	* reports once, so a caller can kill the turn without racing the events
+	* still in flight behind it.
+	*/
+observe(part) {
 		if (tripped) return void 0;
 		if (isUnresolved(part.state)) return void 0;
 		if (part.id === lastScoredPartId) return void 0;
@@ -2716,22 +2708,6 @@ function createRepeatedToolFailureGuard(options) {
 }
 //#endregion
 //#region src/turn-liveness.ts
-/**
-* How long the provider stream stays quiet before the adapter emits a liveness
-* event, and how often it re-checks that quiet window.
-*
-* A model that reasons for a minute and a run that died look the same on the
-* wire: an open stream with nothing on it. A consumer that must show progress
-* resolves the ambiguity with an inactivity timeout. The Blueprint Agent
-* frontend allows 20 s (blueprint-agent
-* apps/web/src/ui-provider/devcontainer-events/hooks/useStreamWatchdog.ts).
-* It then aborts a turn that the CLI is still running.
-*
-* A ping on quiet feeds that timeout without inventing content. The check
-* interval bounds the longest silence at quiet plus check, so these values put
-* the worst case at 6 s. A provider that emits more often than the quiet
-* window never trips the ticker, so nothing double-emits.
-*/
 const STREAM_LIVENESS_QUIET_MS = 5e3;
 const STREAM_LIVENESS_CHECK_MS = 1e3;
 /**
@@ -2821,7 +2797,6 @@ const REPEATED_TOOL_FAILURE_LIMIT = 3;
 var TurnObserver = class {
 	providerSessionPersistence = Promise.resolve();
 	providerSessionPersistenceError;
-	repeatedToolFailureTripped = false;
 	nativeSessionObserved = false;
 	partUpdates;
 	liveness;
@@ -2875,7 +2850,7 @@ var TurnObserver = class {
 		});
 		if (repeated) {
 			const detail = `${provider} sent the same ${repeated.tool} call ${repeated.count} times and every one was rejected. The turn stopped before it ran the model again: ${repeated.detail}`;
-			this.repeatedToolFailureTripped = true;
+			state.endReason = "repeated_tool_failure";
 			state.terminalStatus = "failed";
 			state.lastDiagnostic = detail;
 			logger.error("Repeated tool-call rejection stopped the turn", {
@@ -2951,26 +2926,7 @@ function cliTurnProcess(child, logger, spawnStarted) {
 }
 //#endregion
 //#region src/base-adapter.ts
-/**
-* Base adapter for CLI-based AI agent providers.
-*
-* Subclasses must implement:
-* - provider: string identifier
-* - defaultCliPath: default CLI executable name
-* - buildExecArgs(): build CLI execution arguments
-* - buildExecEnv(): build environment variables
-* - createEventParser(): create JSONL event parser
-* - mapEventToStreamEvents(): map parsed events to StreamEvents
-*
-* The message log directory is the registry spec's `messageStorageDir` for
-* `provider` (cli-agent-registry `messageStorageDirOf`); only an adapter for
-* a provider the registry does not know sets `defaultStorageDir`.
-*
-* Optional overrides:
-* - buildMcpAddArgs(): MCP add command arguments
-* - buildMcpListArgs(): MCP list command arguments (if supported)
-* - parseMcpListOutput(): parse MCP list output
-*/
+/** Base adapter for CLI-based AI agent providers. */
 var CliProviderAdapterBase = class extends CliAdapterMcp {
 	supportsManagedQuote = false;
 	async execute(input, services, onEvent) {
@@ -2978,13 +2934,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 		const quoteVersion = input.managedQuoteVersion;
 		if (quoteVersion !== void 0 && !this.supportsManagedQuote) throw new Error(`${this.provider} does not support the managed-quote native model transport`);
 		const correlationHeaders = executionCorrelationHeaders(input.interactionBinding, input.traceId, quoteVersion);
-		const execution = beginExecution(this, input.abortSignal);
-		const result = this.executeInternal(input, services, onEvent, execution.controller.signal, correlationHeaders);
-		result.then(() => finishExecution(this, execution), () => {
-			execution.controller.abort();
-			finishExecution(this, execution);
-		});
-		return result;
+		return this.withExecution(input.abortSignal, (signal) => this.executeInternal(input, services, onEvent, signal, correlationHeaders));
 	}
 	async executeInternal(input, services, onEvent, executionSignal, correlationHeaders) {
 		const startTime = Date.now();
@@ -3046,7 +2996,8 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			stderr,
 			state
 		});
-		if (!exitResult.success && !benignNonZeroExit || state.terminalStatus === "failed" || observer.repeatedToolFailureTripped) return this.failCliTurn({
+		if (!exitResult.success && !benignNonZeroExit || state.terminalStatus === "failed" || state.endReason) return this.failCliTurn({
+			aborted: executionSignal.aborted,
 			onEvent,
 			recorder,
 			observer,
@@ -3070,10 +3021,6 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			endTime
 		});
 	}
-	/**
-	* Record a successful turn: the provider session id, the assistant message,
-	* and the result, cached for a same-turnId retry.
-	*/
 	async completeTurn(params) {
 		const { input, sessionId, state, recorder, profilePlan } = params;
 		if (state.sessionId && sessionId && state.sessionId !== sessionId) await this.getSessionStore().update(sessionId, {
@@ -3093,7 +3040,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 				outputTokens: state.tokenUsage.outputTokens
 			} : void 0
 		});
-		const publicProfileRevision = profilePlan ? profileRevisionReceipts(this).publicProfileRevisionReceipts.get(profilePlan) : void 0;
+		const publicProfileRevision = profilePlan ? profileRevisionReceipts(this).public.get(profilePlan) : void 0;
 		const result = buildExecutionResult({
 			outcome: await this.executionOutcome(state, input),
 			state,
@@ -3110,14 +3057,16 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 	async failCliTurn(params) {
 		const { onEvent, recorder, observer, state, exitResult, stderr } = params;
 		const { launch, startTime, endTime } = params;
-		const { env, execArgs } = launch;
-		const errorMessage = describeCliFailure({
+		const { errorMessage, failure } = endFailedTurn({
 			provider: this.provider,
 			state,
 			exitResult,
 			stderr,
-			command: execArgs.command,
-			nixBinPath: env.NIX_BIN_PATH
+			aborted: params.aborted,
+			command: launch.execArgs.command,
+			nixBinPath: launch.env.NIX_BIN_PATH,
+			startTime,
+			endTime
 		});
 		this.logger.error("CLI process failed", {
 			exitCode: exitResult.code,
@@ -3129,7 +3078,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			stderr: stderr.slice(0, 2e3),
 			diagnostic: state.lastDiagnostic,
 			durationMs: endTime - startTime,
-			command: execArgs.command
+			command: launch.execArgs.command
 		});
 		if (exitResult.timedOut) onEvent?.({
 			type: "warning",
@@ -3141,13 +3090,6 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			status: "failed",
 			detail: errorMessage
 		});
-		const failure = buildTurnFailure({
-			provider: this.provider,
-			errorMessage,
-			state,
-			startTime,
-			endTime
-		});
 		await recordTurnInterruption({
 			recorder,
 			observer,
@@ -3158,11 +3100,6 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 		});
 		throw failure;
 	}
-	/**
-	* Open the turn's session (sidecar/provider persistence only; native CLI
-	* startup is measured separately). A same-turnId retry of a completed turn
-	* gets that turn's cached result instead of running again.
-	*/
 	async openTurnSession(input, recorder, onEvent) {
 		const sessionPrepareStarted = performance.now();
 		const adapter = this;
@@ -3204,14 +3141,13 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 				cached
 			};
 		}
-		if (input.turnId && recorder.setTurnId) recorder.setTurnId(input.turnId);
+		if (input.turnId) recorder.setTurnId?.(input.turnId);
 		return {
 			...prepared,
 			providerMessageIds,
 			cached: void 0
 		};
 	}
-	/** Provision the profile's cwd-native dimensions for this turn. */
 	async materializeTurnProfile(input, sessionId) {
 		const executionProfile = this.resolveExecutionProfileForInput(input);
 		const profilePlan = await this.materializeProfileResources(executionProfile, input.workspaceRoot ?? this.storagePath, input.userId ?? sessionId, sessionId);
@@ -3221,14 +3157,9 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			profilePlan
 		};
 	}
-	/**
-	* Prepare the prompt and record the caller's own parts. `promptText`
-	* additionally carries the replayed transcript and this turn's ephemeral
-	* context, which are execution-only and stay out of both stores.
-	*/
-	async recordTurnPrompt(input, session, recorder) {
+	async recordTurnPrompt(input, session, recorder, attachmentOptions) {
 		const { sessionId, providerMessageIds } = session;
-		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), input.workspaceRoot ?? this.storagePath, sessionId);
+		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), input.workspaceRoot ?? this.storagePath, sessionId, attachmentOptions);
 		const transcriptContext = await buildTranscriptContext({
 			provider: this.provider,
 			sessionId,
@@ -3265,13 +3196,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			sessionId: providerSessionId,
 			...mintedSessionId ? { mintedSessionId } : {},
 			workspaceRoot,
-			...keepsHarnessSystemPrompt(executionProfile, this.profileHarness) ? {
-				systemPrompt: void 0,
-				appendSystemPrompt: joinSystemPromptAdditions(this.resolveProfileAppendSystemPrompt(profilePlan), input.systemPrompt, input.appendSystemPrompt)
-			} : {
-				systemPrompt: this.resolveProfileSystemPrompt(input.systemPrompt, profilePlan),
-				appendSystemPrompt: input.appendSystemPrompt ? joinSystemPromptAdditions(this.resolveProfileAppendSystemPrompt(profilePlan), input.appendSystemPrompt) : this.resolveProfileAppendSystemPrompt(profilePlan)
-			},
+			...this.resolveProfilePrompts(input, profilePlan, executionProfile),
 			attachments,
 			profilePlan
 		});
@@ -3329,10 +3254,9 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			});
 			await observer.providerSessionPersistence;
 			if (observer.providerSessionPersistenceError) throw observer.providerSessionPersistenceError;
+			this.logger.observePhase?.("native_session_bind", performance.now() - nativeBindStarted);
 		}
-		if (knownNativeSessionId) this.logger.observePhase?.("native_session_bind", performance.now() - nativeBindStarted);
 	}
-	/** Spawn the turn's process, feed its input, and wait for it to exit. */
 	async runCliTurn(params) {
 		const { input, sessionId, providerSessionId, executionSignal } = params;
 		const { launch, promptText, state, observer, startTime } = params;
@@ -3353,6 +3277,17 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 		const cliProcess = spawnedProcess instanceof Promise ? await spawnedProcess : spawnedProcess;
 		this.activeProcesses.add(cliProcess);
 		observer.attachProcess(cliProcess);
+		const stopSessionWatch = watchNewSessionIds({
+			provider: this.provider,
+			runtimeHome: this.config.runtimeHome,
+			sessionContract: launch.sessionContract,
+			observer
+		});
+		if (providerSessionId && launch.sessionContract?.identity.kind === "first-event") observer.onEvent({
+			type: "native.session.observed",
+			provider: this.provider,
+			nativeSessionId: providerSessionId
+		});
 		const identityDeadline = armNativeSessionDeadline({
 			provider: this.provider,
 			sessionId,
@@ -3367,8 +3302,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 		let exitResult;
 		try {
 			if (execArgs.useStdin) {
-				const stdinMessage = execArgs.stdin && execArgs.stdin.length > 0 ? execArgs.stdin : promptText;
-				cliProcess.write(this.formatStdinMessage(stdinMessage));
+				cliProcess.write(this.formatStdinMessage(execArgs.stdin || promptText));
 				cliProcess.closeInput();
 			}
 			exitResult = await cliProcess.exitPromise;
@@ -3377,6 +3311,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			await cliProcess.exitPromise;
 			throw error;
 		} finally {
+			stopSessionWatch();
 			clearInterval(livenessTicker);
 			if (identityDeadline) clearTimeout(identityDeadline);
 			this.activeProcesses.delete(cliProcess);
@@ -3407,13 +3342,7 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 			subprocessSpawnOptions: this.subprocessSpawnOptions()
 		});
 	}
-	/**
-	* The launch one turn would make, without starting it: the spawn config
-	* (argv, cwd, environment, identity or launcher), the stdin payload, and
-	* the profile files written into the workspace. Session and message
-	* stores are untouched and no held process is reserved, so a caller that
-	* runs the process itself (`execCli`) owns its output and lifecycle.
-	*/
+	/** The launch one turn would make, without starting it: the spawn config (argv, cwd, environment, identity or launcher). */
 	async prepareLaunch(input, options = {}) {
 		this.ensureInitialized();
 		const sessionId = input.sessionId ?? randomUUID();
@@ -3436,12 +3365,11 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 		const { execArgs } = launch;
 		return {
 			spawn: this.turnSpawnConfig(execArgs, launch.workspaceRoot, launch.env),
-			...execArgs.useStdin ? { stdin: this.formatStdinMessage(execArgs.stdin && execArgs.stdin.length > 0 ? execArgs.stdin : promptText) } : {},
+			...execArgs.useStdin ? { stdin: this.formatStdinMessage(execArgs.stdin || promptText) } : {},
 			...launch.mintedSessionId ? { nativeSessionId: launch.mintedSessionId } : {},
 			...profilePlan ? { workspacePlan: profilePlan.receipt } : {}
 		};
 	}
-	/** Override only when the provider has a turn transport besides a CLI child. */
 	spawnExecutionProcess(request) {
 		const { execArgs, workspaceRoot, env, signal, timeoutMs, parser } = request;
 		const spawnStarted = performance.now();
@@ -3459,103 +3387,245 @@ var CliProviderAdapterBase = class extends CliAdapterMcp {
 	}
 };
 //#endregion
-//#region src/acp-session-adapter.ts
-const DEFAULT_PROMPT_TIMEOUT_MS = 6e5;
-const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 12e4;
-const DEFAULT_BRIDGE_IDLE_MS = 300 * 1e3;
-/**
-* Grace between `session/cancel` and closing the bridge: long enough for the
-* agent to answer the in-flight `session/prompt` with `stopReason:
-* "cancelled"`, short enough that abort stays prompt.
-*/
-const ABORT_GRACE_MS = 250;
-/**
-* Shared lifecycle of a provider that drives an Agent Client Protocol agent
-* over a JSON-RPC stdio bridge: one cached process and native ACP session per
-* Tangle session, `initialize` then `session/new` (or `session/load` for a
-* provider that resumes), serialized `session/prompt` turns, the cancel
-* sequence (`session/cancel`, grace, close), `session/update` translation,
-* idle reaping and eviction on process exit or turn failure.
-*
-* A provider supplies only its translation: how a turn resolves its config,
-* how the process starts, the prompt blocks, and its own failure signals.
-*/
-var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
-	acpSessions = /* @__PURE__ */ new Map();
-	/** Spawn the bridge. Tests override it to swap the child process. */
-	spawnBridge(request) {
-		return spawnAcpBridge(request);
-	}
-	/** Refuse an agent version beyond the provider's own floor. */
-	checkAgentProtocolVersion(_advertised, _turn) {}
-	/**
-	* Configure a native session the process just opened or loaded, before its
-	* first prompt (e.g. `session/set_model`). A failure fails the acquire.
-	*/
-	async onSessionOpened(_bridge, _acpSessionId, _turn, _options) {}
-	/** Install reverse-call handlers on a new bridge, before `initialize`. */
-	onBridgeSpawned(_bridge, _sessionId, _turn) {}
-	/** Start per-turn state; the returned function ends it on every exit. */
-	beginTurn(_sessionId, _input, _onEvent) {
-		return () => {};
-	}
-	/** Inspect a failed tool's output; returned events precede its part update. */
-	onToolFailed(_sessionId, _failureText) {
-		return [];
-	}
-	/**
-	* A failure the provider recorded for this session during the turn,
-	* cleared on read. It outranks the error the turn surfaced as.
-	*/
-	takeTurnFailure(_sessionId) {}
-	/** Release provider state tied to a session's process. */
-	onSessionEvicted(_sessionId) {}
-	/** Extra fields for the turn-failure log line. */
-	turnLogContext(_turn) {
-		return {};
-	}
-	/**
-	* One turn through the base turn pipeline: session open with transcript
-	* replay and cached-turn replay, then input and result recording around the
-	* bridge's `session/prompt`. The agent owns its profile, so the base's
-	* profile materialization does not run.
-	*/
-	async execute(input, services, onEvent) {
-		this.ensureInitialized();
-		const turn = this.resolveTurn(input);
-		const { config } = turn;
-		const { recorder } = services;
-		const startTime = Date.now();
-		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
-		const turnInput = input.sessionId ? input : {
-			...input,
-			sessionId: input.interactionBinding?.sessionId
-		};
-		const opened = await this.openTurnSession(turnInput, recorder, onEvent);
-		if (opened.cached) return opened.cached;
-		const { sessionId, providerSessionId, providerMessageIds } = opened;
-		const endTurn = this.beginTurn(sessionId, input, onEvent);
-		try {
-			const { preparedInput, promptText } = await this.recordTurnPrompt(turnInput, opened, recorder);
-			onEvent?.({
-				type: "status",
-				status: "started"
-			});
-			const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId);
-			let entry;
-			try {
-				entry = await this.acquireAcpSession({
-					sessionId,
-					...this.loadsNativeSessions && providerSessionId ? { providerSessionId } : {},
-					turn,
-					workspaceRoot,
-					onEvent
-				});
-			} catch (err) {
-				onEvent?.({
-					type: "status",
-					status: "failed",
-					detail: err instanceof Error ? err.message : String(err)
+//#region src/metering.ts
+const UsageRecordSchema = z.record(z.string(), z.unknown());
+const UsageNumberSchema = z.union([z.number(), z.string().trim().min(1)]).transform(Number).pipe(z.number().finite().nonnegative());
+const TOKEN_USAGE_INPUT_KEYS = Object.freeze([
+	"inputTokens",
+	"input",
+	"input_tokens",
+	"promptTokens",
+	"prompt_tokens"
+]);
+const TOKEN_USAGE_OUTPUT_KEYS = Object.freeze([
+	"outputTokens",
+	"output",
+	"output_tokens",
+	"completionTokens",
+	"completion_tokens"
+]);
+const TOKEN_USAGE_TOTAL_KEYS = Object.freeze([
+	"totalTokens",
+	"total_tokens",
+	"total"
+]);
+const TOKEN_USAGE_REASONING_KEYS = Object.freeze([
+	"reasoningTokens",
+	"reasoning_tokens",
+	"reasoning",
+	"reasoning_output_tokens"
+]);
+const TOKEN_USAGE_COST_KEYS = Object.freeze([
+	"totalCostUsd",
+	"costUsd",
+	"total_cost_usd",
+	"cost_usd",
+	"cost"
+]);
+const CACHE_READ_INPUT_KEYS = Object.freeze([
+	"cacheReadInputTokens",
+	"cache_read_input_tokens",
+	"cacheRead",
+	"cache_read",
+	"cached_input_tokens"
+]);
+const CACHE_CREATION_INPUT_KEYS = Object.freeze([
+	"cacheCreationInputTokens",
+	"cache_creation_input_tokens",
+	"cacheWrite",
+	"cache_write"
+]);
+const NESTED_COST_KEYS = Object.freeze([
+	"total",
+	"totalUsd",
+	"total_usd",
+	"usd"
+]);
+function asRecord(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	return parsed.success ? parsed.data : void 0;
+}
+function tokenCount(raw) {
+	const parsed = UsageNumberSchema.safeParse(raw);
+	return parsed.success ? Math.trunc(parsed.data) : void 0;
+}
+function firstTokenCount(source, keys) {
+	for (const key of keys) {
+		const count = tokenCount(source[key]);
+		if (count !== void 0) return count;
+	}
+}
+function firstUsageCostUsd(source, keys = TOKEN_USAGE_COST_KEYS) {
+	for (const key of keys) {
+		const parsed = UsageNumberSchema.safeParse(source[key]);
+		if (parsed.success) return parsed.data;
+	}
+}
+function usageRecord(source) {
+	return asRecord(source.tokenUsage) ?? asRecord(source.usage) ?? source;
+}
+function readTokenUsage(source) {
+	const usageSource = usageRecord(source);
+	const inputTokens = firstTokenCount(usageSource, TOKEN_USAGE_INPUT_KEYS);
+	const outputTokens = firstTokenCount(usageSource, TOKEN_USAGE_OUTPUT_KEYS);
+	return inputTokens !== void 0 || outputTokens !== void 0 ? {
+		inputTokens,
+		outputTokens
+	} : void 0;
+}
+function readTokenCostUsd(source) {
+	const usageSource = usageRecord(source);
+	return firstUsageCostUsd(source) ?? firstUsageCostUsd(usageSource) ?? readNestedCostUsd(source) ?? readNestedCostUsd(usageSource);
+}
+function readNestedCostUsd(source) {
+	const cost = asRecord(source.cost);
+	return cost ? firstUsageCostUsd(cost, NESTED_COST_KEYS) : void 0;
+}
+function readCliTokenUsage(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	if (!parsed.success) return void 0;
+	const source = parsed.data;
+	const usageSource = usageRecord(source);
+	const usage = readTokenUsage(source) ?? readTokenUsage(usageSource);
+	const cost = readTokenCostUsd(source);
+	const totalTokens = firstTokenCount(usageSource, TOKEN_USAGE_TOTAL_KEYS);
+	const reasoningTokens = firstTokenCount(usageSource, TOKEN_USAGE_REASONING_KEYS);
+	const cacheReadInputTokens = firstTokenCount(usageSource, CACHE_READ_INPUT_KEYS);
+	const cacheCreationInputTokens = firstTokenCount(usageSource, CACHE_CREATION_INPUT_KEYS);
+	if (!usage && totalTokens === void 0 && reasoningTokens === void 0 && cost === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0) return;
+	return {
+		inputTokens: usage?.inputTokens,
+		outputTokens: usage?.outputTokens,
+		totalTokens,
+		reasoningTokens,
+		cacheReadInputTokens,
+		cacheCreationInputTokens,
+		cost
+	};
+}
+function recordCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (tokenUsage) {
+			state.tokenUsage = tokenUsage;
+			return true;
+		}
+	}
+	return false;
+}
+function addUsage(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	const sum = left + right;
+	return Number.isFinite(sum) ? sum : Math.max(left, right);
+}
+/**
+* Adds one usage report to the running total instead of replacing it.
+*
+* For a CLI that reports usage PER TURN (pi) rather than once per run,
+* `recordCliTokenUsage` would leave the execution billed as its final turn
+* alone. Use this wherever a single execution can produce more than one usage
+* report; use `recordCliTokenUsage` when the CLI emits one cumulative total.
+*
+* Returns true when a usage report was found in `sources` and folded in.
+*/
+function accumulateCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (!tokenUsage) continue;
+		const total = state.tokenUsage;
+		state.tokenUsage = total ? {
+			inputTokens: addUsage(total.inputTokens, tokenUsage.inputTokens),
+			outputTokens: addUsage(total.outputTokens, tokenUsage.outputTokens),
+			totalTokens: addUsage(total.totalTokens, tokenUsage.totalTokens),
+			reasoningTokens: addUsage(total.reasoningTokens, tokenUsage.reasoningTokens),
+			cacheReadInputTokens: addUsage(total.cacheReadInputTokens, tokenUsage.cacheReadInputTokens),
+			cacheCreationInputTokens: addUsage(total.cacheCreationInputTokens, tokenUsage.cacheCreationInputTokens),
+			cost: addUsage(total.cost, tokenUsage.cost)
+		} : tokenUsage;
+		return true;
+	}
+	return false;
+}
+function parseCliUsageLine(line) {
+	if (!line.startsWith("usage:")) return void 0;
+	const raw = line.slice(6).trim();
+	if (!raw) return void 0;
+	if (raw.startsWith("{")) return asRecord(JSON.parse(raw));
+	const fields = {};
+	for (const part of raw.split(/[,\s]+/)) {
+		if (!part) continue;
+		const separator = part.includes("=") ? "=" : part.includes(":") ? ":" : "";
+		if (!separator) continue;
+		const [key, value] = part.split(separator, 2);
+		if (!key || value === void 0) continue;
+		const numeric = Number(value);
+		fields[key] = Number.isFinite(numeric) ? numeric : value;
+	}
+	return Object.keys(fields).length > 0 ? fields : void 0;
+}
+//#endregion
+//#region src/acp-session-adapter.ts
+const DEFAULT_PROMPT_TIMEOUT_MS = 6e5;
+const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 12e4;
+const DEFAULT_BRIDGE_IDLE_MS = 300 * 1e3;
+const ABORT_GRACE_MS = 250;
+var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
+	acpSessions = /* @__PURE__ */ new Map();
+	spawnBridge(request) {
+		return spawnAcpBridge(request);
+	}
+	checkAgentProtocolVersion(_advertised, _turn) {}
+	resumeSessionId() {}
+	async onSessionOpened(_bridge, _acpSessionId, _turn, _options) {}
+	onBridgeSpawned(_bridge, _sessionId, _turn) {}
+	beginTurn(_sessionId, _input, _onEvent) {
+		return () => {};
+	}
+	onToolFailed(_sessionId, _failureText) {
+		return [];
+	}
+	takeTurnFailure(_sessionId) {}
+	onSessionEvicted(_sessionId) {}
+	turnLogContext(_turn) {
+		return {};
+	}
+	async execute(input, services, onEvent) {
+		this.ensureInitialized();
+		const turn = this.resolveTurn(input);
+		const { config } = turn;
+		const { recorder } = services;
+		const startTime = Date.now();
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const turnInput = input.sessionId ? input : {
+			...input,
+			sessionId: input.interactionBinding?.sessionId
+		};
+		const opened = await this.openTurnSession(turnInput, recorder, onEvent);
+		if (opened.cached) return opened.cached;
+		const { sessionId, providerSessionId, providerMessageIds } = opened;
+		const endTurn = this.beginTurn(sessionId, input, onEvent);
+		try {
+			const { preparedInput, promptText } = await this.recordTurnPrompt(turnInput, opened, recorder);
+			onEvent?.({
+				type: "status",
+				status: "started"
+			});
+			const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId);
+			let entry;
+			try {
+				entry = await this.acquireAcpSession({
+					sessionId,
+					...this.loadsNativeSessions && providerSessionId ? { providerSessionId } : {},
+					turn,
+					workspaceRoot,
+					onEvent
+				});
+			} catch (err) {
+				onEvent?.({
+					type: "status",
+					status: "failed",
+					detail: err instanceof Error ? err.message : String(err)
 				});
 				throw err instanceof Error ? err : new Error(String(err));
 			}
@@ -3569,28 +3639,38 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 				provider: this.provider,
 				nativeSessionId: acpSessionId
 			});
+			const timeoutMs = config.promptTimeoutMs ?? DEFAULT_PROMPT_TIMEOUT_MS;
+			const prompt = this.promptBlocks(input, {
+				...preparedInput,
+				promptText
+			}, turn);
+			let promptResult;
 			try {
-				const promptResult = await this.promptAcpSession(entry, {
-					prompt: this.promptBlocks(input, {
-						...preparedInput,
-						promptText
-					}, turn),
-					timeoutMs: config.promptTimeoutMs ?? DEFAULT_PROMPT_TIMEOUT_MS,
-					abortSignal: input.abortSignal,
-					onUpdate: (params) => {
-						for (const event of this.mapAcpUpdate(params, state, sessionId)) onEvent?.(event);
-					}
-				});
+				for (let attempt = 0; attempt < 3; attempt++) try {
+					promptResult = await this.promptAcpSession(entry, {
+						prompt,
+						timeoutMs: Math.min(timeoutMs, 12e4),
+						abortSignal: input.abortSignal,
+						onUpdate: (params) => {
+							for (const event of this.mapAcpUpdate(params, state, sessionId)) onEvent?.(event);
+						}
+					});
+					break;
+				} catch (err) {
+					const detail = this.formatBridgeError(err);
+					if (detail.includes("timed out")) this.interruptStuckTurn();
+					if (attempt === 0 && detail.includes("timed out")) continue;
+					if (attempt < 2 && await this.acknowledgeLostTurn(detail)) continue;
+					throw err;
+				}
 				const recorded = this.takeTurnFailure(sessionId);
 				if (recorded) throw recorded;
-				const finalStatus = mapAcpStopReason(promptResult.stopReason);
-				onEvent?.(finalStatus.detail ? {
-					type: "status",
-					status: finalStatus.status,
-					detail: finalStatus.detail
-				} : {
+				recordCliTokenUsage(state, promptResult);
+				const stop = promptResult?.stopReason;
+				if (stop !== "end_turn" && stop !== "max_tokens") throw new Error(`${this.provider} stopped the turn unfinished (stop reason ${stop ?? "missing"}): send the next turn to continue it`);
+				onEvent?.({
 					type: "status",
-					status: finalStatus.status
+					status: "completed"
 				});
 				await this.getSessionStore().update(sessionId, { providerSessionId: acpSessionId });
 				return await this.completeTurn({
@@ -3603,7 +3683,25 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 					endTime: Date.now()
 				});
 			} catch (err) {
-				return this.failAcpTurn(err, sessionId, turn, bridge, onEvent);
+				const finalError = this.takeTurnFailure(sessionId) ?? err;
+				const detail = this.formatBridgeError(finalError);
+				this.logger.error(`${this.provider} execute failed`, {
+					...this.turnLogContext(turn),
+					error: detail,
+					stderrTail: bridge.getStderrTail().slice(-500)
+				});
+				onEvent?.({
+					type: "status",
+					status: "failed",
+					detail
+				});
+				this.evictAcpSession(sessionId, "execute-error");
+				const error = finalError instanceof JsonRpcError && detail !== finalError.message ? new Error(detail, { cause: finalError }) : finalError instanceof Error ? finalError : new Error(detail);
+				throw Object.assign(error, { reason: error.reason ?? turnEndReason({
+					aborted: input.abortSignal?.aborted,
+					timedOut: finalError instanceof RpcRequestTimeoutError,
+					linkLost: finalError instanceof BridgeClosedError || HARNESS_LINK_LOST.test(detail)
+				}) });
 			} finally {
 				this.scheduleIdleReap(sessionId, config.bridgeIdleMs);
 			}
@@ -3611,23 +3709,9 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 			endTurn();
 		}
 	}
-	/** Report a failed turn, retire its process, and throw its error. */
-	failAcpTurn(err, sessionId, turn, bridge, onEvent) {
-		const finalError = this.takeTurnFailure(sessionId) ?? err;
-		const detail = this.formatBridgeError(finalError);
-		this.logger.error(`${this.provider} execute failed`, {
-			...this.turnLogContext(turn),
-			error: detail,
-			stderrTail: bridge.getStderrTail().slice(-500)
-		});
-		onEvent?.({
-			type: "status",
-			status: "failed",
-			detail
-		});
-		this.evictAcpSession(sessionId, "execute-error");
-		if (finalError instanceof JsonRpcError && detail !== finalError.message) throw new Error(detail, { cause: finalError });
-		throw finalError instanceof Error ? finalError : new Error(detail);
+	interruptStuckTurn() {}
+	async acknowledgeLostTurn(_detail) {
+		return false;
 	}
 	async acquireAcpSession(opts) {
 		const { sessionId, turn, workspaceRoot, onEvent } = opts;
@@ -3640,6 +3724,7 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 			this.logger.warn(`${this.provider}: cached session was started for another process configuration — respawning`, { sessionId });
 			this.evictAcpSession(sessionId, "process-change");
 		}
+		const storedSessionId = opts.providerSessionId ? this.resumeSessionId() : void 0;
 		const spec = await this.processSpec(turn, {
 			sessionId,
 			workspaceRoot
@@ -3684,9 +3769,11 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 			this.checkProtocolVersion(init, requested, turn);
 			acpSessionId = await this.openNativeSession(bridge, {
 				providerSessionId: opts.providerSessionId,
+				storedSessionId,
 				cwd: workspaceRoot,
 				timeoutMs
 			});
+			await this.getSessionStore().update(sessionId, { providerSessionId: acpSessionId });
 			await this.onSessionOpened(bridge, acpSessionId, turn, { timeoutMs });
 			this.logger.observePhase?.("cli_initialize", performance.now() - initializeStarted);
 		} catch (err) {
@@ -3721,31 +3808,35 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 		if (advertised < 1) throw new Error(`${this.provider}: agent advertises protocolVersion ${advertised} but client requires at least 1. The backing agent binary is too old; upgrade it.`);
 		this.checkAgentProtocolVersion(advertised, turn);
 	}
-	/**
-	* Open the native ACP session. A recorded session is loaded when the agent
-	* can; an agent that refuses the load starts a new native session, and the
-	* Tangle transcript stays the record of the earlier turns.
-	*/
 	async openNativeSession(bridge, opts) {
-		const params = {
-			cwd: opts.cwd,
-			mcpServers: []
+		const load = async (sessionId) => {
+			try {
+				const loaded = await bridge.request("session/load", {
+					sessionId,
+					cwd: opts.cwd,
+					mcpServers: []
+				}, { timeoutMs: opts.timeoutMs });
+				if (!loaded || typeof loaded !== "object") return void 0;
+				return loaded.sessionId ?? sessionId;
+			} catch (err) {
+				this.logger.debug("session/load failed", { error: err instanceof Error ? err.message : String(err) });
+				return;
+			}
 		};
-		if (opts.providerSessionId) try {
-			return (await bridge.request("session/load", {
-				sessionId: opts.providerSessionId,
-				...params
-			}, { timeoutMs: opts.timeoutMs }))?.sessionId ?? opts.providerSessionId;
-		} catch (err) {
-			this.logger.debug("session/load failed, creating new", { error: err instanceof Error ? err.message : String(err) });
+		const stored = opts.storedSessionId;
+		if (stored) {
+			const loaded = await load(stored);
+			if (loaded) return loaded;
 		}
-		return (await bridge.request("session/new", params, { timeoutMs: opts.timeoutMs })).sessionId;
+		if (opts.providerSessionId && opts.providerSessionId !== stored) {
+			const loaded = await load(opts.providerSessionId);
+			if (loaded) return loaded;
+		}
+		return (await bridge.request("session/new", {
+			cwd: opts.cwd,
+			mcpServers: []
+		}, { timeoutMs: opts.timeoutMs })).sessionId;
 	}
-	/**
-	* One `session/prompt` turn. Abort sends `session/cancel` before closing so
-	* the agent can settle the turn; the bridge's own signal handling would
-	* close first and lose the notify.
-	*/
 	async promptAcpSession(entry, turn) {
 		const { bridge, acpSessionId } = entry;
 		const unsubscribe = bridge.onNotification("session/update", (params) => {
@@ -3805,7 +3896,6 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 			entry.idleTimer = void 0;
 		}
 	}
-	/** Close a session's agent process and drop it. Idempotent. */
 	evictAcpSession(sessionId, reason) {
 		const entry = this.acpSessions.get(sessionId);
 		if (!entry) return;
@@ -3823,11 +3913,9 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 			});
 		});
 	}
-	/** Evict every cached session whose process key matches. */
 	evictAcpSessionsWhere(matches, reason) {
 		for (const [sessionId, entry] of [...this.acpSessions]) if (matches(entry.processKey)) this.evictAcpSession(sessionId, reason);
 	}
-	/** Translate one `session/update` notification into stream events. */
 	mapAcpUpdate(params, state, sessionId) {
 		const update = params.update;
 		if (!update || typeof update !== "object") return [];
@@ -3879,12 +3967,6 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 		if (raw instanceof Error) return raw.message;
 		return String(raw);
 	}
-	/**
-	* The error a failed process start surfaces. An agent that exits before its
-	* session opens reports why only on stderr, and an agent's JSON-RPC error
-	* carries its cause in `data`; a bare "process-exit" or "Internal error"
-	* hides both from the caller.
-	*/
 	sessionSetupError(err, bridge) {
 		if (err instanceof BridgeClosedError) {
 			const stderr = bridge.getStderrTail().trim().slice(-500);
@@ -3910,7 +3992,7 @@ var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
 		throw new Error(`${this.provider}: buildExecArgs is not used — ACP turns run over the RPC bridge`);
 	}
 	buildExecEnv(_config) {
-		return { ...process.env };
+		return {};
 	}
 	createEventParser() {
 		throw new Error(`${this.provider}: createEventParser is not used — session/update notifications arrive over the RPC bridge`);
@@ -3959,7 +4041,7 @@ function jsonEventParser(logger, onEvent, spec) {
 }
 /**
 * Parser for harnesses that print their reply as plain stdout lines (hermes,
-* nanoclaw, forge). Lines classify into provider events; the reply is
+* nanoclaw). Lines classify into provider events; the reply is
 * emitted as one text part when stdout closes. A turn that printed errors
 * but no reply ends `failed` with the last error instead of an empty
 * `completed`.
@@ -4078,22 +4160,6 @@ var TerminalPlanSupport = class {
 };
 //#endregion
 //#region src/interaction-support.ts
-/**
-* Per-execution lifecycle wrapper for an MCP-capable harness. Permission and
-* question tools use the live {@link InteractionBroker}; plan tools commit
-* through {@link TerminalPlanSupport} and end the provider turn.
-*
-* Mirrors the claude-code permission-server pattern, but for the GENERIC
-* `request_permission` / `ask_user` / `request_plan` tools the agent calls
-* itself — there is no harness-specific reply contract, so any MCP-capable CLI
-* (factory-droids, …) composes this with ~10 lines: declare the capability
-* kinds, start/stop around the spawn, inject the server via the CLI's MCP
-* mechanism, and forward `respondToInteraction` here.
-*
-* Unlike claude-code's `--permission-prompt-tool`, these generic tools fire
-* only when the model chooses to call them. Permission is therefore advisory,
-* while plan-capable adapters separately prove the terminal turn boundary.
-*/
 var McpInteractionSupport = class {
 	/** The shared emit → block → respond → fail-closed round-trip. */
 	broker = new InteractionBroker$1();
@@ -4184,182 +4250,129 @@ var McpInteractionSupport = class {
 	}
 };
 //#endregion
-//#region src/metering.ts
-const UsageRecordSchema = z.record(z.string(), z.unknown());
-const UsageNumberSchema = z.union([z.number(), z.string().trim().min(1)]).transform(Number).pipe(z.number().finite().nonnegative());
-const TOKEN_USAGE_INPUT_KEYS = Object.freeze([
-	"inputTokens",
-	"input",
-	"input_tokens",
-	"promptTokens",
-	"prompt_tokens"
-]);
-const TOKEN_USAGE_OUTPUT_KEYS = Object.freeze([
-	"outputTokens",
-	"output",
-	"output_tokens",
-	"completionTokens",
-	"completion_tokens"
-]);
-const TOKEN_USAGE_TOTAL_KEYS = Object.freeze([
-	"totalTokens",
-	"total_tokens",
-	"total"
-]);
-const TOKEN_USAGE_REASONING_KEYS = Object.freeze([
-	"reasoningTokens",
-	"reasoning_tokens",
-	"reasoning",
-	"reasoning_output_tokens"
-]);
-const TOKEN_USAGE_COST_KEYS = Object.freeze([
-	"totalCostUsd",
-	"costUsd",
-	"total_cost_usd",
-	"cost_usd",
-	"cost"
-]);
-const CACHE_READ_INPUT_KEYS = Object.freeze([
-	"cacheReadInputTokens",
-	"cache_read_input_tokens",
-	"cacheRead",
-	"cache_read",
-	"cached_input_tokens"
-]);
-const CACHE_CREATION_INPUT_KEYS = Object.freeze([
-	"cacheCreationInputTokens",
-	"cache_creation_input_tokens",
-	"cacheWrite",
-	"cache_write"
-]);
-const NESTED_COST_KEYS = Object.freeze([
-	"total",
-	"totalUsd",
-	"total_usd",
-	"usd"
-]);
-function asRecord(raw) {
-	const parsed = UsageRecordSchema.safeParse(raw);
-	return parsed.success ? parsed.data : void 0;
-}
-function tokenCount(raw) {
-	const parsed = UsageNumberSchema.safeParse(raw);
-	return parsed.success ? Math.trunc(parsed.data) : void 0;
-}
-function firstTokenCount(source, keys) {
-	for (const key of keys) {
-		const count = tokenCount(source[key]);
-		if (count !== void 0) return count;
-	}
-}
-function firstUsageCostUsd(source, keys = TOKEN_USAGE_COST_KEYS) {
-	for (const key of keys) {
-		const parsed = UsageNumberSchema.safeParse(source[key]);
-		if (parsed.success) return parsed.data;
-	}
-}
-function usageRecord(source) {
-	return asRecord(source.tokenUsage) ?? asRecord(source.usage) ?? source;
-}
-function readTokenUsage(source) {
-	const usageSource = usageRecord(source);
-	const inputTokens = firstTokenCount(usageSource, TOKEN_USAGE_INPUT_KEYS);
-	const outputTokens = firstTokenCount(usageSource, TOKEN_USAGE_OUTPUT_KEYS);
-	return inputTokens !== void 0 || outputTokens !== void 0 ? {
-		inputTokens,
-		outputTokens
-	} : void 0;
-}
-function readTokenCostUsd(source) {
-	const usageSource = usageRecord(source);
-	return firstUsageCostUsd(source) ?? firstUsageCostUsd(usageSource) ?? readNestedCostUsd(source) ?? readNestedCostUsd(usageSource);
-}
-function readNestedCostUsd(source) {
-	const cost = asRecord(source.cost);
-	return cost ? firstUsageCostUsd(cost, NESTED_COST_KEYS) : void 0;
-}
-function readCliTokenUsage(raw) {
-	const parsed = UsageRecordSchema.safeParse(raw);
-	if (!parsed.success) return void 0;
-	const source = parsed.data;
-	const usageSource = usageRecord(source);
-	const usage = readTokenUsage(source) ?? readTokenUsage(usageSource);
-	const cost = readTokenCostUsd(source);
-	const totalTokens = firstTokenCount(usageSource, TOKEN_USAGE_TOTAL_KEYS);
-	const reasoningTokens = firstTokenCount(usageSource, TOKEN_USAGE_REASONING_KEYS);
-	const cacheReadInputTokens = firstTokenCount(usageSource, CACHE_READ_INPUT_KEYS);
-	const cacheCreationInputTokens = firstTokenCount(usageSource, CACHE_CREATION_INPUT_KEYS);
-	if (!usage && totalTokens === void 0 && reasoningTokens === void 0 && cost === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0) return;
-	return {
-		inputTokens: usage?.inputTokens,
-		outputTokens: usage?.outputTokens,
-		totalTokens,
-		reasoningTokens,
-		cacheReadInputTokens,
-		cacheCreationInputTokens,
-		cost
-	};
+//#region src/secret-native-proof.ts
+const proofKey = Symbol.for("tangle.secret-native-binary-proofs");
+const runtime$1 = globalThis;
+const proven = runtime$1[proofKey] ?? /* @__PURE__ */ new Set();
+runtime$1[proofKey] = proven;
+/** Prove an immutable executable, under the launch's own identity and environment. */
+async function provenStoreBinary(expected, config) {
+	if (!config.isolatedIdentity || config.inheritEnv !== false) refuseSecretLaunch("Secret native binary proof requires an isolated identity and environment", { path: config.command });
+	const command = resolveExecutableRealpath(config.command, config.env?.PATH);
+	if (!command || !isTrustedStoreBinary(command)) refuseSecretLaunch("Secret native launch requires a root-owned Nix store binary", { path: command ?? config.command });
+	const key = `${command}\0${expected}`;
+	if (proven.has(key)) return command;
+	const probe = await execCli({
+		command,
+		cwd: config.cwd,
+		env: config.env,
+		inheritEnv: config.inheritEnv,
+		signal: config.signal,
+		isolatedIdentity: config.isolatedIdentity,
+		args: ["--version"],
+		spawnOptions: config.isolatedIdentity,
+		timeoutMs: 15e3
+	});
+	const version = probe.stdout?.trim();
+	if (!probe.exit.success || version !== expected) refuseSecretLaunch(`Secret native launch expected ${expected} at ${command}, received no matching version`, { exitCode: probe.exit.code });
+	proven.add(key);
+	return command;
 }
-function recordCliTokenUsage(state, ...sources) {
-	for (const source of sources) {
-		const tokenUsage = readCliTokenUsage(source);
-		if (tokenUsage) {
-			state.tokenUsage = tokenUsage;
-			return true;
+/** A reported version alone cannot establish an immutable executable. */
+function isTrustedStoreBinary(realpath) {
+	if (!realpath.startsWith("/nix/store/")) return false;
+	try {
+		for (const path of [realpath, dirname(realpath)]) {
+			const stat = fs$1.lstatSync(path);
+			if (stat.uid !== 0 || (stat.mode & 18) !== 0) return false;
 		}
+		return true;
+	} catch {
+		return false;
 	}
-	return false;
 }
-function addUsage(left, right) {
-	if (left === void 0) return right;
-	if (right === void 0) return left;
-	const sum = left + right;
-	return Number.isFinite(sum) ? sum : Math.max(left, right);
+/** The real file a launch of `command` executes under `pathEnv`. */
+function resolveExecutableRealpath(command, pathEnv) {
+	if (command.includes("/") && !isAbsolute(command)) return void 0;
+	const candidates = command.includes("/") ? [command] : (pathEnv ?? "").split(":").filter(isAbsolute).map((dir) => join(dir, command));
+	for (const candidate of candidates) try {
+		fs$1.accessSync(candidate, fs$1.constants.X_OK);
+		if (fs$1.statSync(candidate).isFile()) return fs$1.realpathSync(candidate);
+	} catch {}
 }
-/**
-* Adds one usage report to the running total instead of replacing it.
-*
-* For a CLI that reports usage PER TURN (pi) rather than once per run,
-* `recordCliTokenUsage` would leave the execution billed as its final turn
-* alone. Use this wherever a single execution can produce more than one usage
-* report; use `recordCliTokenUsage` when the CLI emits one cumulative total.
-*
-* Returns true when a usage report was found in `sources` and folded in.
-*/
-function accumulateCliTokenUsage(state, ...sources) {
-	for (const source of sources) {
-		const tokenUsage = readCliTokenUsage(source);
-		if (!tokenUsage) continue;
-		const total = state.tokenUsage;
-		state.tokenUsage = total ? {
-			inputTokens: addUsage(total.inputTokens, tokenUsage.inputTokens),
-			outputTokens: addUsage(total.outputTokens, tokenUsage.outputTokens),
-			totalTokens: addUsage(total.totalTokens, tokenUsage.totalTokens),
-			reasoningTokens: addUsage(total.reasoningTokens, tokenUsage.reasoningTokens),
-			cacheReadInputTokens: addUsage(total.cacheReadInputTokens, tokenUsage.cacheReadInputTokens),
-			cacheCreationInputTokens: addUsage(total.cacheCreationInputTokens, tokenUsage.cacheCreationInputTokens),
-			cost: addUsage(total.cost, tokenUsage.cost)
-		} : tokenUsage;
-		return true;
+const SEALED_NATIVE_HOME_LAYOUT = {
+	codex: [
+		[
+			".",
+			1016,
+			true
+		],
+		[
+			".codex",
+			1016,
+			true
+		],
+		[
+			".agents",
+			360,
+			true
+		],
+		[
+			".codex/skills",
+			360,
+			true
+		],
+		[
+			".codex/rules",
+			360,
+			true
+		],
+		[
+			".codex/config.toml",
+			288,
+			false
+		],
+		[
+			".codex/AGENTS.md",
+			288,
+			false
+		],
+		[
+			".codex/AGENTS.override.md",
+			288,
+			false
+		],
+		[
+			".codex/hooks.json",
+			288,
+			false
+		]
+	],
+	opencode: [[
+		".",
+		456,
+		true
+	], [
+		".opencode",
+		360,
+		true
+	]]
+};
+function assertSealedNativeHome(home, gid, layout) {
+	for (const [relative, mode, directory] of layout) {
+		const path = join(home, relative);
+		const stat = fs$1.lstatSync(path);
+		if (fs$1.realpathSync(path) !== path || stat.uid !== 0 || stat.gid !== gid || (stat.mode & 4095) !== mode || stat.isDirectory() !== directory) refuseSecretLaunch(`Secret native HOME authority is not sealed at ${path}: expected uid0 gid${gid} mode${mode.toString(8)} directory=${directory}; actual uid${stat.uid} gid${stat.gid} mode${(stat.mode & 4095).toString(8)} directory=${stat.isDirectory()}`);
 	}
-	return false;
 }
-function parseCliUsageLine(line) {
-	if (!line.startsWith("usage:")) return void 0;
-	const raw = line.slice(6).trim();
-	if (!raw) return void 0;
-	if (raw.startsWith("{")) return asRecord(JSON.parse(raw));
-	const fields = {};
-	for (const part of raw.split(/[,\s]+/)) {
-		if (!part) continue;
-		const separator = part.includes("=") ? "=" : part.includes(":") ? ":" : "";
-		if (!separator) continue;
-		const [key, value] = part.split(separator, 2);
-		if (!key || value === void 0) continue;
-		const numeric = Number(value);
-		fields[key] = Number.isFinite(numeric) ? numeric : value;
-	}
-	return Object.keys(fields).length > 0 ? fields : void 0;
+/** Only selected structural facts enter a refusal; payloads and causes never do. */
+function refuseSecretLaunch(reason, { path, expected, actual, exitCode } = {}) {
+	const detail = JSON.stringify({
+		path,
+		expected,
+		actual
+	}).slice(0, 768);
+	throw new Error(detail === "{}" ? reason : `${reason} ${detail}`, { cause: typeof exitCode === "number" || exitCode === null ? { exitCode } : void 0 });
 }
 //#endregion
 //#region src/reasoning-effort.ts
@@ -4389,6 +4402,160 @@ function kimiThinkingArgs(level, modelId) {
 	return off ? ["--no-thinking"] : ["--thinking"];
 }
 //#endregion
-export { ACP_MIN_PROTOCOL_VERSION, ACP_PROTOCOL_VERSION, AcpProviderAdapterBase, CliProviderAdapterBase, DEFAULT_INTERACTION_MCP_SERVER_NAME, EXECUTION_TRACE_HEADER, InteractionBroker, InteractionHttpBridge, InteractionMcpServer, InvalidAttachmentError, MANAGED_QUOTE_VERSION_HEADER, MAX_INLINE_IMAGE_BYTES, MAX_TOTAL_INLINE_IMAGE_BYTES, McpInteractionSupport, PERMISSION_DECISION_TIMEOUT_MS, PROMPT_SECTION_SEPARATOR, SessionRehydrationError, TerminalPlanSupport, accumulateCliTokenUsage, acpContentText, brokerInteractionTools, buildFileUrl, createExecutionState, createRepeatedToolFailureGuard, deriveFilePart, deterministicFilePartId, enabledInteractionKinds, executionCorrelationHeaders, finalTextEvent, homeXdgEnv, inferMediaType, interactionMcpToolName, interactionToggleEnabled, isLocalMcpConfig, jsonEventParser, kimiThinkingArgs, localMcpArgv, localMcpEnv, mapAcpStopReason, nativeEffortArgs, parseCliUsageLine, partitionImageAttachments, plaintextResponseParser, preparePromptInputParts, prependPromptSection, readCliTokenUsage, readEphemeralContext, reasoningEvents, recordCliTokenUsage, rejectNotLaunched, runtimeSecretsOverlay, sessionObservedEvents, spawnAcpBridge, streamPartBase, textDeltaEvents, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, trackReasoningBlock, turnInteractionEnabled, wasNeverLaunched, withEphemeralContext, withTurnInteractions };
+//#region src/secret-profile-mcp.ts
+/** Executor-held MCP credentials shared by native private-profile adapters. */
+const SECRET_REFERENCE_PREFIX = "TANGLE_PROFILE_SECRET_";
+const SECRET_REFERENCE = /\{env:(TANGLE_PROFILE_SECRET_[0-9A-F]{24})\}/g;
+function requireRecord(raw, message) {
+	return isRecord(raw) ? raw : refuseSecretLaunch(message);
+}
+/** A config value with its secret references resolved, or undefined. */
+function resolveReferences(value, references) {
+	let unresolved = false;
+	const resolved = value.replace(SECRET_REFERENCE, (_match, reference) => {
+		const secret = references[reference];
+		if (secret === void 0) unresolved = true;
+		return secret ?? "";
+	});
+	return unresolved || /\{(?:env|file):/.test(resolved) ? void 0 : resolved;
+}
+/** A stdio server the executor can run: its command and its environment with every secret reference resolved. */
+function servableStdioServer(name, entry, references) {
+	const command = entry.command;
+	if (!Array.isArray(command) || command.length === 0 || command.some((part) => typeof part !== "string" || /\{(?:env|file):/.test(part))) return "its command is not a fixed argument list";
+	if (entry.cwd !== void 0) return "it names a working directory";
+	const declared = entry.environment === void 0 ? {} : entry.environment;
+	if (!isRecord(declared)) return "its environment is not a map";
+	const environment = {};
+	const secrets = /* @__PURE__ */ new Set();
+	for (const [variable, value] of Object.entries(declared)) {
+		if (typeof value !== "string") return `its ${variable} is not text`;
+		const resolved = resolveReferences(value, references);
+		if (resolved === void 0) return `its ${variable} names a value the executor cannot resolve`;
+		environment[variable] = resolved;
+		for (const [, reference] of value.matchAll(SECRET_REFERENCE)) {
+			const secret = references[reference];
+			if (secret) secrets.add(secret);
+		}
+	}
+	return {
+		name,
+		command,
+		environment,
+		secrets: [...secrets]
+	};
+}
+/** A remote server the executor can serve: its fixed upstream URL and every header with its secret references resolved. */
+function servableMcpServer(name, entry, references) {
+	const url = entry.url;
+	if (typeof url !== "string" || /\{(?:env|file):/.test(url)) return "its URL is not a fixed address";
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return "its URL is not http(s)";
+	} catch {
+		return "its URL is not a fixed address";
+	}
+	const headers = {};
+	const declared = entry.headers === void 0 ? {} : entry.headers;
+	if (!isRecord(declared)) return "its headers are not a map";
+	for (const [header, value] of Object.entries(declared)) {
+		if (typeof value !== "string") return `its ${header} header is not text`;
+		const resolved = resolveReferences(value, references);
+		if (resolved === void 0) return `its ${header} header names a value the executor cannot resolve`;
+		headers[header] = resolved;
+	}
+	return {
+		name,
+		url,
+		headers
+	};
+}
+/** Join the queue at `key`; `previous` settles when earlier holders release. */
+function joinQueue(queues, key) {
+	const previous = queues.get(key) ?? Promise.resolve();
+	let release;
+	const finished = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.then(() => finished);
+	queues.set(key, tail);
+	tail.then(() => {
+		if (queues.get(key) === tail) queues.delete(key);
+	});
+	return {
+		previous,
+		release
+	};
+}
+function untilSettledOrAborted(previous, signal) {
+	const aborted = () => signal.reason ?? /* @__PURE__ */ new Error("Secret native turn aborted before its session view was free");
+	if (signal.aborted) return Promise.reject(aborted());
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(aborted());
+		signal.addEventListener("abort", onAbort, { once: true });
+		previous.then(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		});
+	});
+}
+/** Every native discovery ancestor is sealed and free of ambient configuration. */
+function assertSealedNativeSearchPath(cwd, configNames) {
+	for (let child = cwd, parent = dirname(cwd);; child = parent, parent = dirname(parent)) {
+		const stat = lstatSync(child);
+		if (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(child) !== child || stat.uid !== 0 || (stat.mode & 18) !== 0 || child !== cwd && configNames.some((name) => lstatSync(join(child, name), { throwIfNoEntry: false }))) throw new Error("Secret native launch has mutable or ambient discovery authority");
+		if (parent === child) break;
+	}
+}
+/** One session view changes only after its previous physical native process exits. */
+const turnsKey = Symbol.for("tangle.secret-native-session-turns");
+const turnsRuntime = globalThis;
+const sessionTurns = turnsRuntime[turnsKey] ?? /* @__PURE__ */ new Map();
+turnsRuntime[turnsKey] = sessionTurns;
+function secretSessionTurnQueue(view) {
+	return joinQueue(sessionTurns, view);
+}
+/** An HTTP URL on loopback with an explicit port and no URL credentials. */
+function isLoopbackEndpoint(value) {
+	if (typeof value !== "string") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" && [
+			"127.0.0.1",
+			"[::1]",
+			"localhost"
+		].includes(url.hostname) && url.port !== "" && !url.username && !url.password;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/secret-profile-scope.ts
+const key = Symbol.for("tangle.secret-profile-mcp.scopes");
+const runtime = globalThis;
+const openScopes = runtime[key] ??= /* @__PURE__ */ new Map();
+function secretMcpScope(sessionId, uid, owner) {
+	if (sessionId.includes("\0")) throw new Error("A secret MCP session id has no NUL");
+	const scope = `${sessionId}\0${uid ?? ""}`;
+	if (owner?.proxy) {
+		const owners = openScopes.get(scope) ?? /* @__PURE__ */ new Set();
+		owners.add(owner);
+		openScopes.set(scope, owners);
+	}
+	return scope;
+}
+async function forgetSessionScopes(target) {
+	for (const [scope, owners] of openScopes) {
+		if ("sessionId" in target && !scope.startsWith(`${target.sessionId}\0`)) continue;
+		for (const owner of [...owners]) {
+			if ("owner" in target && owner !== target.owner) continue;
+			if (![...owners].some((other) => other !== owner && other.proxy === owner.proxy)) await owner.proxy.forget(scope);
+			owners.delete(owner);
+		}
+		if (owners.size === 0) openScopes.delete(scope);
+	}
+}
+//#endregion
+export { ACP_MIN_PROTOCOL_VERSION, ACP_PROTOCOL_VERSION, AcpProviderAdapterBase, CODEX_DISABLED_FEATURE_ARGS, CliProviderAdapterBase, DEFAULT_INTERACTION_MCP_SERVER_NAME, EXECUTION_TRACE_HEADER, InteractionBroker, InteractionHttpBridge, InteractionMcpServer, InvalidAttachmentError, MANAGED_QUOTE_VERSION_HEADER, MAX_INLINE_IMAGE_BYTES, MAX_TOTAL_INLINE_IMAGE_BYTES, McpInteractionSupport, NATIVE_SESSION_CONTRACTS, PERMISSION_DECISION_TIMEOUT_MS, PROMPT_SECTION_SEPARATOR, SEALED_NATIVE_HOME_LAYOUT, SECRET_REFERENCE, SECRET_REFERENCE_PREFIX, SessionRehydrationError, TerminalPlanSupport, accumulateCliTokenUsage, acpContentText, assertSealedNativeHome, assertSealedNativeSearchPath, brokerInteractionTools, buildFileUrl, codexDeveloperInstructionArgs, createExecutionState, createRepeatedToolFailureGuard, deriveFilePart, deterministicFilePartId, enabledInteractionKinds, executionCorrelationHeaders, finalTextEvent, forgetSessionScopes, homeXdgEnv, inferMediaType, interactionMcpToolName, interactionToggleEnabled, isLocalMcpConfig, isLoopbackEndpoint, isPlainRecord, isTrustedStoreBinary, joinQueue, jsonEventParser, kimiThinkingArgs, localMcpArgv, localMcpEnv, nativeEffortArgs, parseCliUsageLine, partitionImageAttachments, plaintextResponseParser, preparePromptInputParts, prependPromptSection, provenStoreBinary, readCliTokenUsage, readEphemeralContext, reasoningEvents, recordCliTokenUsage, refuseSecretLaunch, rejectNotLaunched, requireRecord, resolveExecutableRealpath, resolveReferences, runtimeSecretsOverlay, secretMcpScope, secretSessionTurnQueue, servableMcpServer, servableStdioServer, sessionObservedEvents, spawnAcpBridge, streamPartBase, textDeltaEvents, textSnapshotEvents, toolResultEvents, toolStartEvents, trackFilePart, trackReasoningBlock, turnEndReason, turnInteractionEnabled, untilSettledOrAborted, wasNeverLaunched, withEphemeralContext, withTurnInteractions };
 
 //# sourceMappingURL=index.mjs.map