@tangle-network/sdk-provider-cli-base 0.13.17 → 0.13.18

package/dist/src-Fn8Pu1xq.mjs

@@ -0,0 +1,4586 @@
+import { DEFAULT_INTERACTION_DECISION_TIMEOUT_MS as PERMISSION_DECISION_TIMEOUT_MS, InteractionBroker, InteractionBroker as InteractionBroker$1, InteractionHttpBridge, brokerInteractionTools, brokerInteractionTools as brokerInteractionTools$1 } from "@tangle-network/agent-core/interactions";
+import { CODEX_DISABLED_FEATURE_ARGS, HARNESS_LAUNCH_MATERIALIZE_OPTIONS, UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER, applyWorkspacePlanWithSecretProvider, bindLaunchToolBinDirs, bindSecretSessionView, codexDeveloperInstructionArgs, enforceWorkspacePlanSupport, ensurePublicConcurrentProfileRoots, joinSystemPromptAdditions, keepsHarnessSystemPrompt, materializeProfile, modelIdsMatch, parseSandboxToolBinDirs, preparePublicConcurrentProfileRevision, prepareSecretConcurrentProfileRevision, resolveAgentProfileResources, secretSessionViewWorkspace } from "@tangle-network/agent-profile-materialize";
+import { BridgeClosedError, InvalidAttachmentError, JsonRpcError, RpcRequestTimeoutError, execCli, launchCliProcess, resolveRawCapturePath, spawnCliProcess, spawnRpcBridge } from "@tangle-network/sdk-cli-runner";
+import { createHash, createHmac, randomUUID } from "node:crypto";
+import { AgentExecutionError, AgentExecutionOutcomeSchema, AgentRuntimeAttachmentsSchema, InteractionExecutionBindingSchema, InteractionKind, REASONING_EFFORTS, agentProfileSchema, nativeReasoningControl, normalizeInputParts } from "@tangle-network/agent-interface";
+import { HarnessSessionContractError, assertArgvHonoursSessionContract, assertFlagsHonourSessionContract, assertStoreLocationHonoursSessionContract, compileSessionStoreGlob } from "@tangle-network/cli-agent-registry/session-contract";
+import { MAX_SECRET_PROFILE_REPLAY_CHARS, RESTORED_SESSION_CONTEXT_PREAMBLE, RESTORED_SESSION_CONTEXT_TAG, buildCompleteForkContextBlock, buildForkContextBlock, createMessageStore, createSessionStore, forkSessionWithMessages, readProviderMessageIds } from "@tangle-network/sdk-session-persistence";
+import { mkdir, open, readdir, writeFile } from "node:fs/promises";
+import path, { basename, dirname, isAbsolute, join, normalize, resolve } from "node:path";
+import * as fs$1 from "node:fs";
+import fs, { constants, lstatSync, readFileSync, readdirSync, realpathSync } from "node:fs";
+import { execFile } from "node:child_process";
+import { isDeepStrictEqual, promisify } from "node:util";
+import { messageStorageDirOf } from "@tangle-network/cli-agent-registry";
+import { NATIVE_SESSION_CONTRACTS, NATIVE_SESSION_CONTRACTS as NATIVE_SESSION_CONTRACTS$1, configDirHomeEnv } from "@tangle-network/cli-agent-registry/native-session-contracts";
+import * as W3C from "@tangle-network/agent-trace-contract";
+import { z } from "zod";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { DatabaseSync } from "node:sqlite";
+import { StringDecoder } from "node:string_decoder";
+import { DEFAULT_INTERACTION_MCP_SERVER_NAME, InteractionMcpServer, interactionMcpToolName } from "@tangle-network/agent-core/interactions/mcp";
+import { isRecord, isRecord as isPlainRecord } from "@tangle-network/agent-core";
+//#region src/acp-process-launch.ts
+/** Spawn an ACP agent over NDJSON stdio from `env` alone, never the sidecar's own environment. The adapter owns abort, so no signal. */
+function spawnAcpBridge(request) {
+	return spawnRpcBridge({
+		...request,
+		inheritEnv: false
+	});
+}
+/**
+* A JSON-RPC error with the cause the agent put in `data`: hermes sends
+* `data.details`, codex-acp `data.message`.
+*/
+function jsonRpcErrorText(err) {
+	const data = err.data && typeof err.data === "object" ? err.data : void 0;
+	const cause = [data?.details, data?.message].find((value) => typeof value === "string" && value.length > 0);
+	return cause && cause !== err.message ? `${err.message}: ${cause}` : err.message;
+}
+/**
+* An ACP process env: the spec's keys with the agent environment over them,
+* unset keys dropped. The agent environment is the whole inherited part.
+*/
+function withAgentEnvironment(env, agent) {
+	const merged = {};
+	for (const [key, value] of Object.entries(env ?? {})) if (value !== void 0) merged[key] = value;
+	for (const [key, value] of Object.entries(agent)) if (value !== void 0) merged[key] = value;
+	return merged;
+}
+//#endregion
+//#region src/acp-protocol.ts
+/** The ACP protocol version this client speaks, and the oldest it accepts. */
+const ACP_PROTOCOL_VERSION = 1;
+const ACP_MIN_PROTOCOL_VERSION = 1;
+/** Text carried by ACP content blocks, including tool-call content. */
+function acpContentText(content) {
+	if (!content) return "";
+	const blocks = Array.isArray(content) ? content : [content];
+	const parts = [];
+	for (const block of blocks) {
+		if (!block || typeof block !== "object") continue;
+		if (block.type === "text" && typeof block.text === "string") parts.push(block.text);
+		else if (block.type === "content" && block.content?.type === "text" && typeof block.content.text === "string") parts.push(block.content.text);
+	}
+	return parts.join("");
+}
+//#endregion
+//#region src/reasoning-parts.ts
+/**
+* Assigns a stable part id and an append-only delta to a reasoning block
+* emission, absorbing provider replay/growth patterns:
+*
+* - text exactly matches an already-tracked block → `null` (duplicate
+*   delivery, e.g. a final assistant message replaying streamed content —
+*   emit nothing). Byte-identical distinct blocks therefore dedupe to one
+*   part; safer than duplicate-part spam.
+* - text extends the most recent block → same part id, delta = the suffix
+*   (cumulative re-emission of a growing block).
+* - otherwise → a new block: fresh part id, delta = the full text, so
+*   consumers can be pure appenders (prev text for a fresh id is empty).
+*/
+function trackReasoningBlock(state, blockText) {
+	if (blockText === "") return null;
+	state.reasoningParts ??= [];
+	const parts = state.reasoningParts;
+	if (parts.some((p) => p.text === blockText)) return null;
+	const last = parts[parts.length - 1];
+	if (last && last.text !== "" && blockText.startsWith(last.text)) {
+		const delta = blockText.slice(last.text.length);
+		last.text = blockText;
+		return {
+			partId: last.id,
+			text: blockText,
+			delta,
+			isNewBlock: false
+		};
+	}
+	const id = randomUUID();
+	parts.push({
+		id,
+		text: blockText
+	});
+	return {
+		partId: id,
+		text: blockText,
+		delta: blockText,
+		isNewBlock: true
+	};
+}
+//#endregion
+//#region src/stream-parts.ts
+/**
+* The text, reasoning and tool part emissions every stream-json harness
+* shares. A provider's event mapper decodes its own wire shape, then calls
+* these so part ids, buffers, tool timing and processing phases stay one
+* implementation across claude-code, codex, kimi, amp and factory-droids.
+*/
+/**
+* Records the CLI's native session id on the turn and announces it: the
+* generic `session.updated` plus the provider-attributed observation the
+* turn observer keys evidence on.
+*/
+function sessionObservedEvents(state, provider, sessionId) {
+	state.sessionId = sessionId;
+	return [{
+		type: "session.updated",
+		sessionId
+	}, {
+		type: "native.session.observed",
+		provider,
+		nativeSessionId: sessionId
+	}];
+}
+/** Correlation fields every emitted part carries. */
+function streamPartBase(state, partId) {
+	return {
+		id: partId ?? randomUUID(),
+		sessionID: state.sessionId ?? "",
+		messageID: state.messageId ?? ""
+	};
+}
+function textPartEvent(state, delta) {
+	state.textPartId ??= randomUUID();
+	return {
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, state.textPartId),
+			type: "text",
+			text: state.textBuffer
+		},
+		delta
+	};
+}
+/**
+* Appends a text delta to the turn's single text part. The first text of a
+* turn also signals the `generating` phase.
+*/
+function textDeltaEvents(state, delta) {
+	const first = state.textBuffer.length === 0;
+	state.textBuffer += delta;
+	const update = textPartEvent(state, delta);
+	return first ? [{
+		type: "model-processing",
+		phase: "generating"
+	}, update] : [update];
+}
+/** The whole reply as one text part, for harnesses that do not stream. */
+function finalTextEvent(state, text) {
+	state.textBuffer = text;
+	return textPartEvent(state, text);
+}
+/**
+* Applies a cumulative text frame (the whole assistant text so far). Only the
+* suffix past the buffer is emitted; a frame that does not extend the buffer
+* replaces it and is emitted whole.
+*/
+function textSnapshotEvents(state, text) {
+	const delta = text.startsWith(state.textBuffer) ? text.slice(state.textBuffer.length) : text;
+	if (!delta) return [];
+	state.textBuffer = text;
+	return [textPartEvent(state, delta)];
+}
+/**
+* Records a thinking block under a stable part id (see trackReasoningBlock).
+* With `signalPhase`, the turn's first block also signals `thinking`.
+*/
+function reasoningEvents(state, thinking, options) {
+	const tracked = trackReasoningBlock(state, thinking);
+	if (!tracked) return [];
+	if (tracked.isNewBlock) state.reasoningBuffer.push(tracked.text);
+	else state.reasoningBuffer[state.reasoningBuffer.length - 1] = tracked.text;
+	const update = {
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, tracked.partId),
+			type: "reasoning",
+			text: tracked.text
+		},
+		delta: tracked.delta
+	};
+	return options.signalPhase && tracked.isNewBlock && state.reasoningBuffer.length === 1 ? [{
+		type: "model-processing",
+		phase: "thinking"
+	}, update] : [update];
+}
+/** Registers a running tool call and emits its running part. */
+function toolStartEvents(state, call) {
+	const now = Date.now();
+	state.toolCalls.set(call.id, {
+		id: call.id,
+		name: call.name,
+		input: call.input,
+		startTime: now,
+		status: "running"
+	});
+	const toolState = {
+		status: "running",
+		input: call.input ?? {},
+		time: { start: now }
+	};
+	return [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, call.id),
+			type: "tool",
+			callID: call.id,
+			tool: call.name,
+			state: toolState
+		}
+	}];
+}
+/**
+* Completes a tracked tool call. A successful result emits `afterSuccess`
+* (file parts the provider detected) and then the `tool-result` phase. A
+* result for an untracked call is a warning.
+*/
+function toolResultEvents(state, result) {
+	const toolCall = state.toolCalls.get(result.id);
+	if (!toolCall) return [{
+		type: "warning",
+		code: "UNKNOWN_TOOL_RESULT",
+		message: `Received result for unknown tool call: ${result.id}`
+	}];
+	toolCall.status = result.isError ? "failed" : "completed";
+	toolCall.output = result.content;
+	const now = Date.now();
+	const input = toolCall.input ?? {};
+	const time = {
+		start: toolCall.startTime,
+		end: now
+	};
+	const metadata = result.metadata ? { metadata: result.metadata } : {};
+	const toolState = result.isError ? {
+		status: "failed",
+		input,
+		error: typeof result.content === "string" ? result.content : void 0,
+		output: result.content,
+		...metadata,
+		time
+	} : {
+		status: "completed",
+		input,
+		output: result.content,
+		...metadata,
+		time
+	};
+	const events = [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, result.id),
+			type: "tool",
+			callID: result.id,
+			tool: toolCall.name,
+			state: toolState
+		}
+	}];
+	if (!result.isError) events.push(...result.afterSuccess?.(toolCall) ?? [], {
+		type: "model-processing",
+		phase: "tool-result",
+		toolName: toolCall.name,
+		elapsedMs: now - toolCall.startTime
+	});
+	return events;
+}
+//#endregion
+//#region src/acp-session-updates.ts
+/** An agent message or thought chunk: text extends the message part, thought joins reasoning. */
+function acpMessageChunkEvents(kind, update, state) {
+	const text = acpContentText(update.content);
+	if (!text) return [];
+	if (kind === "agent_message_chunk") return textDeltaEvents(state, text);
+	state.reasoningBuffer.push(text);
+	return [];
+}
+/** A new tool call: recorded as running and reported as its tool part. */
+function acpToolCallEvents(update, state) {
+	const call = update;
+	const name = call.title ?? call.kind ?? "tool";
+	return toolStartEvents(state, {
+		id: call.toolCallId,
+		name,
+		input: call.rawInput
+	});
+}
+/**
+* Fold one tool_call_update into the call's record. Tool output arrives as
+* content blocks; rawOutput is the fallback. Returns the update's text output.
+*/
+function applyAcpToolCallUpdate(existing, mapped, change) {
+	const outputText = acpContentText(change.content);
+	if (mapped === "running" && outputText) existing.output = typeof existing.output === "string" ? existing.output + outputText : outputText;
+	existing.status = mapped;
+	if (mapped === "completed" || mapped === "failed") {
+		if (outputText) existing.output = typeof existing.output === "string" && existing.output.length > 0 ? existing.output + outputText : outputText;
+		else if (change.rawOutput !== void 0) existing.output = change.rawOutput;
+	}
+	return outputText;
+}
+/** The events a call's current record reports: its settled result, or its open part. */
+function acpToolCallUpdateEvents(existing, state) {
+	if (existing.status === "completed" || existing.status === "failed") return toolResultEvents(state, {
+		id: existing.id,
+		content: existing.output,
+		isError: existing.status === "failed"
+	});
+	const input = existing.input ?? {};
+	return [{
+		type: "message.part.updated",
+		part: {
+			...streamPartBase(state, existing.id),
+			type: "tool",
+			tool: existing.name,
+			callID: existing.id,
+			state: existing.status === "running" ? {
+				status: "running",
+				input,
+				time: { start: existing.startTime }
+			} : {
+				status: "pending",
+				input
+			}
+		}
+	}];
+}
+/**
+* Plan entries are the agent's step list. Fold their text into the
+* reasoning record, bounded per notification and per turn so a
+* misbehaving agent cannot grow turn memory or storage without limit.
+*/
+function acpPlanEvents(update, state, provider) {
+	const MAX_ENTRIES_PER_UPDATE = 256;
+	const MAX_REASONING_ENTRIES_PER_TURN = 1024;
+	const MAX_ENTRY_LENGTH = 8 * 1024;
+	const raw = update.entries;
+	const entries = (Array.isArray(raw) ? raw : []).slice(0, MAX_ENTRIES_PER_UPDATE);
+	for (const entry of entries) {
+		if (state.reasoningBuffer.length >= MAX_REASONING_ENTRIES_PER_TURN) break;
+		if (typeof entry.content === "string" && entry.content.length > 0) state.reasoningBuffer.push(entry.content.slice(0, MAX_ENTRY_LENGTH));
+	}
+	return [{
+		type: "raw",
+		backend: provider,
+		event: {
+			sessionUpdate: "plan",
+			entries
+		}
+	}];
+}
+//#endregion
+//#region src/provider-config.ts
+/**
+* Render a value as a digest that does not change with key order. The type
+* parameter keeps the caller's own type at the call site, so the digest of a
+* configuration cannot silently accept a value of an unrelated shape.
+*/
+function stableSerialize(value) {
+	if (value === null) return "null";
+	if (value === void 0) return "undefined";
+	if (typeof value === "string") return JSON.stringify(value);
+	if (typeof value === "number") {
+		if (Number.isNaN(value)) return "number:NaN";
+		if (Object.is(value, -0)) return "number:-0";
+		return `number:${value}`;
+	}
+	if (typeof value === "boolean") return value ? "true" : "false";
+	if (typeof value === "bigint") return `bigint:${value.toString()}`;
+	if (Array.isArray(value)) return `[${value.map((entry) => stableSerialize(entry)).join(",")}]`;
+	if (typeof value === "object") return `{${Object.entries(value).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
+	return `${typeof value}:${String(value)}`;
+}
+function cloneConfig(config) {
+	return structuredClone(config);
+}
+function isInteractionObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeCliProviderConfig(current, next) {
+	const merged = {
+		...current,
+		...next
+	};
+	const currentInteractions = current.interactions;
+	const nextInteractions = next.interactions;
+	if (isInteractionObject(currentInteractions) && isInteractionObject(nextInteractions)) merged.interactions = {
+		...currentInteractions,
+		...nextInteractions
+	};
+	return merged;
+}
+//#endregion
+//#region src/adapter-initialization.ts
+/**
+* The in-flight and settled initialization of one adapter, and the pending
+* shutdown: which `initialize()` call is current, which configuration it
+* carries, and the generation that a `shutdown()` bumps to cancel it.
+*/
+var InitializationTracker = class {
+	generation = 0;
+	promise = null;
+	configKey = null;
+	cancellation = null;
+	initializedConfigKey = null;
+	shutdownPromise;
+	providerTails = /* @__PURE__ */ new Set();
+	constructor(provider) {
+		this.provider = provider;
+	}
+	assertCurrent(generation, cancellation) {
+		if (generation !== this.generation || cancellation.cancelled) throw new Error(`${this.provider()} provider initialization cancelled by shutdown`);
+	}
+	/** Forget `promise` once it settles, unless a newer one replaced it. */
+	clear(promise) {
+		if (this.promise !== promise) return;
+		this.promise = null;
+		this.configKey = null;
+		this.cancellation = null;
+	}
+	/** Cancel the in-flight initialization and invalidate its generation. */
+	cancel() {
+		this.generation += 1;
+		if (this.cancellation) this.cancellation.cancelled = true;
+		this.promise = null;
+		this.configKey = null;
+		this.cancellation = null;
+		this.initializedConfigKey = null;
+	}
+};
+/**
+* The adapter configuration an `initialize()` call produces: the initial
+* configuration overlaid with the host's runtime values. Throws when a
+* trusted-path or identity value is malformed.
+*/
+function overlayProviderConfig(provider, initialConfig, config) {
+	const nextConfig = cloneConfig(initialConfig);
+	const runtimeAttachments = config.runtimeAttachments;
+	if (runtimeAttachments !== void 0) nextConfig.runtimeAttachments = structuredClone(runtimeAttachments);
+	const runtimeSecrets = config.runtimeSecrets;
+	if (runtimeSecrets !== void 0) nextConfig.runtimeSecrets = { ...runtimeSecrets };
+	const runtimeHome = config.runtimeHome;
+	if (runtimeHome !== void 0) {
+		if (typeof runtimeHome !== "string" || !path.isAbsolute(runtimeHome)) throw new Error(`${provider} runtimeHome must be an absolute filesystem path`);
+		nextConfig.runtimeHome = runtimeHome;
+	}
+	const agentHome = config.agentHome;
+	if (agentHome !== void 0) {
+		if (typeof agentHome !== "string" || !path.isAbsolute(agentHome)) throw new Error(`${provider} agentHome must be an absolute filesystem path`);
+		nextConfig.agentHome = agentHome;
+	}
+	const subprocessUser = config.subprocessUser;
+	if (subprocessUser !== void 0) {
+		if (process.getuid?.() !== 0 || !Number.isSafeInteger(subprocessUser.uid) || subprocessUser.uid <= 0 || !Number.isSafeInteger(subprocessUser.gid) || subprocessUser.gid <= 0) throw new Error(`${provider}: invalid trusted subprocess identity`);
+		nextConfig.subprocessUser = { ...subprocessUser };
+		if (config.stableIsolatedIdentity === true) nextConfig.stableIsolatedIdentity = true;
+	}
+	const publicProfileRevisionRoot = config.publicProfileRevisionRoot;
+	if (publicProfileRevisionRoot !== void 0) {
+		if (typeof publicProfileRevisionRoot !== "string" || !path.isAbsolute(publicProfileRevisionRoot)) throw new Error(`${provider} publicProfileRevisionRoot must be an absolute filesystem path`);
+		nextConfig.publicProfileRevisionRoot = publicProfileRevisionRoot;
+	}
+	const privateRevision = config;
+	if (privateRevision.secretProfileRevisionRoot !== void 0 || privateRevision.secretProfileNamingKeyPath !== void 0) {
+		if (!subprocessUser || publicProfileRevisionRoot !== void 0 || !privateRevision.secretProfileRevisionRoot || !path.isAbsolute(privateRevision.secretProfileRevisionRoot) || !privateRevision.secretProfileNamingKeyPath || !path.isAbsolute(privateRevision.secretProfileNamingKeyPath)) throw new Error(`${provider}: invalid secret profile revision root`);
+		nextConfig.secretProfileRevisionRoot = privateRevision.secretProfileRevisionRoot;
+		nextConfig.secretProfileNamingKeyPath = privateRevision.secretProfileNamingKeyPath;
+	}
+	const sandboxedRuntime = config.sandboxedRuntime;
+	if (sandboxedRuntime !== void 0) nextConfig.sandboxedRuntime = sandboxedRuntime === true;
+	const nativeAuthEnv = config.nativeAuthEnv;
+	if (nativeAuthEnv !== void 0) {
+		nextConfig.nativeAuthEnv = { ...nativeAuthEnv };
+		nextConfig.nativeAuthSecretEnv = config.nativeAuthSecretEnv;
+	}
+	if (config.model?.model !== void 0) nextConfig.model = config.model.model;
+	if (config.model?.provider !== void 0) nextConfig.provider = config.model.provider;
+	if (config.model?.apiKey !== void 0) nextConfig.apiKey = config.model.apiKey;
+	if (config.model?.baseUrl !== void 0) nextConfig.baseUrl = config.model.baseUrl;
+	if (config.model?.authMode !== void 0) nextConfig.authMode = config.model.authMode;
+	if (config.model?.authFiles !== void 0) nextConfig.authFiles = config.model.authFiles.map((file) => ({ ...file }));
+	return nextConfig;
+}
+//#endregion
+//#region src/execution-lifecycle.ts
+const lifecycles = /* @__PURE__ */ new WeakMap();
+function executionLifecycle(owner) {
+	let lifecycle = lifecycles.get(owner);
+	if (!lifecycle) {
+		lifecycle = {
+			inFlightExecutions: /* @__PURE__ */ new Set(),
+			shuttingDown: false
+		};
+		lifecycles.set(owner, lifecycle);
+	}
+	return lifecycle;
+}
+function beginExecution(owner, callerAbortSignal) {
+	const lifecycle = executionLifecycle(owner);
+	if (lifecycle.shuttingDown) throw new Error(`${owner.provider} provider is shutting down`);
+	let resolveSettled;
+	const execution = {
+		controller: new AbortController(),
+		settled: new Promise((resolve) => {
+			resolveSettled = resolve;
+		}),
+		resolveSettled: () => resolveSettled()
+	};
+	lifecycle.inFlightExecutions.add(execution);
+	if (callerAbortSignal) {
+		const abortFromCaller = () => execution.controller.abort();
+		execution.callerAbortSignal = callerAbortSignal;
+		execution.callerAbortListener = abortFromCaller;
+		if (callerAbortSignal.aborted) execution.controller.abort();
+		else callerAbortSignal.addEventListener("abort", abortFromCaller, { once: true });
+	}
+	return execution;
+}
+function finishExecution(owner, execution) {
+	executionLifecycle(owner).inFlightExecutions.delete(execution);
+	if (execution.callerAbortSignal && execution.callerAbortListener) execution.callerAbortSignal.removeEventListener("abort", execution.callerAbortListener);
+	execution.resolveSettled();
+}
+//#endregion
+//#region src/writable-home.ts
+/**
+* The nearest ancestor of `target` that exists, or null when even the root of
+* the path is absent. A directory that does not exist yet is usable only if
+* something above it can be written to, so the writability question always
+* resolves against an ancestor that is really there.
+*/
+function nearestExistingAncestor(target) {
+	let current = path.resolve(target);
+	for (;;) {
+		if (fs.existsSync(current)) return current;
+		const parent = path.dirname(current);
+		if (parent === current) return null;
+		current = parent;
+	}
+}
+function isWritableTarget(target) {
+	const ancestor = nearestExistingAncestor(target);
+	if (!ancestor) return false;
+	try {
+		fs.accessSync(ancestor, fs.constants.W_OK);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** `/root` belongs to the calling process, never to the agent subprocess. */
+const READ_ONLY_ROOT_HOME = "/root";
+function isRootHomePath(value) {
+	return value === READ_ONLY_ROOT_HOME || value.startsWith(`${READ_ONLY_ROOT_HOME}/`);
+}
+/**
+* Whether an inherited path must not reach the CLI, given whether it can be
+* written. Two independent reasons, kept apart from the filesystem probe so
+* each is decidable on its own:
+*
+*   - It sits under `/root`. The agent subprocess runs as its own user, so
+*     that path is wrong even while the calling process can write there.
+*   - Nothing can create it. A read-only mount refuses `mkdir` for every user,
+*     including root.
+*/
+function shouldReplacePath(value, writable) {
+	return isRootHomePath(value) || !writable;
+}
+function mustReplace(value) {
+	return shouldReplacePath(value, isWritableTarget(value));
+}
+/**
+* Point `HOME` and the XDG directories at somewhere a CLI can actually write.
+*
+* An inherited value is kept whenever it is usable, so an operator can still
+* aim a cache at a large volume. An unusable value is replaced by the
+* equivalent path under the writable home, because keeping it only moves the
+* failure into the CLI, where it surfaces as a run that emits nothing.
+*/
+function applyWritableHomeDefaults(env, workspaceRoot) {
+	const next = { ...env };
+	const writableHome = next.SIDECAR_AGENT_HOME?.trim() || next.AGENT_WORKSPACE_ROOT?.trim() || workspaceRoot;
+	const currentHome = next.HOME?.trim();
+	const home = currentHome && !mustReplace(currentHome) ? currentHome : writableHome;
+	for (const [key, fallback] of Object.entries(homeXdgEnv(home))) {
+		const current = next[key]?.trim();
+		if (key === "HOME" || !current || mustReplace(current)) next[key] = fallback;
+	}
+	return next;
+}
+/** HOME and the XDG base directories a CLI resolves under it. */
+function homeXdgEnv(home) {
+	return {
+		HOME: home,
+		XDG_CONFIG_HOME: path.join(home, ".config"),
+		XDG_CACHE_HOME: path.join(home, ".cache"),
+		XDG_DATA_HOME: path.join(home, ".local", "share"),
+		XDG_STATE_HOME: path.join(home, ".local", "state")
+	};
+}
+//#endregion
+//#region src/adapter-lifecycle.ts
+const DEFAULT_CONTEXT_WINDOW = 2e5;
+const execFileAsync = promisify(execFile);
+/** Console-based logger fallback. */
+const consoleLogger = {
+	debug: (msg, meta) => console.debug(`[cli-provider] ${msg}`, meta ?? ""),
+	info: (msg, meta) => console.info(`[cli-provider] ${msg}`, meta ?? ""),
+	warn: (msg, meta) => console.warn(`[cli-provider] ${msg}`, meta ?? ""),
+	error: (msg, meta) => console.error(`[cli-provider] ${msg}`, meta ?? "")
+};
+/** Owns configuration, initialization, cancellation, and subprocess identity. */
+var CliAdapterLifecycle = class {
+	/** The message log directory when the caller names none. */
+	defaultStorageDir;
+	inheritProcessEnv;
+	config;
+	initialConfig;
+	logger;
+	sessionStore = null;
+	messageStore = null;
+	storagePath;
+	_storageDir;
+	agentEnvironment;
+	/** The consumer's executor for turn processes; a local spawn when absent. */
+	launcher;
+	/** Whether a turn's leftover process-group members are stopped at exit. */
+	ownProcessGroup;
+	initialized = false;
+	activeProcesses = /* @__PURE__ */ new Set();
+	initialization = new InitializationTracker(() => this.provider);
+	constructor(options = {}) {
+		executionLifecycle(this);
+		this.initialConfig = cloneConfig(options.config ?? {});
+		this.config = cloneConfig(this.initialConfig);
+		this.logger = options.logger ?? consoleLogger;
+		this.storagePath = options.storagePath ?? process.cwd();
+		this._storageDir = options.storageDir;
+		this.agentEnvironment = options.agentEnvironment;
+		this.inheritProcessEnv = options.agentEnvironment === void 0;
+		this.launcher = options.launcher;
+		this.ownProcessGroup = options.ownProcessGroup ?? false;
+	}
+	get storageDir() {
+		return this._storageDir ?? this.defaultStorageDir ?? messageStorageDirOf(this.provider);
+	}
+	/** Bind a live interaction to the exact provider execution that originated it. */
+	interactionExecutionBinding(input, sessionId) {
+		if (!input.interactionBinding) throw new Error(`${this.provider} interactions require AgentExecutionInput.interactionBinding`);
+		const binding = InteractionExecutionBindingSchema.parse(input.interactionBinding);
+		if (binding.provider !== this.provider) throw new Error(`Interaction binding provider "${binding.provider}" does not match adapter "${this.provider}"`);
+		if (binding.sessionId !== sessionId) throw new Error(`Interaction binding session "${binding.sessionId}" does not match adapter session "${sessionId}"`);
+		return binding;
+	}
+	/** The uid/gid every CLI process this adapter spawns runs as, or undefined when the host process is already unprivileged. */
+	subprocessIdentity() {
+		const assigned = this.config.subprocessUser;
+		if (assigned) {
+			if (process.getuid?.() !== 0 || !Number.isSafeInteger(assigned.uid) || assigned.uid <= 0 || !Number.isSafeInteger(assigned.gid) || assigned.gid <= 0) throw new Error(`${this.provider}: invalid trusted subprocess identity`);
+			return assigned;
+		}
+		if (process.getuid?.() !== 0) return void 0;
+		const rawUid = process.env.AGENT_SUBPROCESS_UID ?? "1000";
+		const rawGid = process.env.AGENT_SUBPROCESS_GID ?? "1000";
+		const uid = Number(rawUid);
+		const gid = Number(rawGid);
+		if (!Number.isInteger(uid) || uid < 0 || !Number.isInteger(gid) || gid < 0) throw new Error(`${this.provider}: AGENT_SUBPROCESS_UID/AGENT_SUBPROCESS_GID must be non-negative integers (got ${rawUid}/${rawGid})`);
+		return {
+			uid,
+			gid
+		};
+	}
+	/** `subprocessIdentity` shaped for `spawn`'s options bag. */
+	subprocessSpawnOptions() {
+		return this.subprocessIdentity() ?? {};
+	}
+	/** Run a one-shot CLI command under this adapter's subprocess identity. */
+	runCli(config) {
+		return execCli({
+			...config,
+			inheritEnv: this.inheritProcessEnv && config.inheritEnv !== false,
+			rawCapturePath: void 0,
+			...this.config.subprocessUser ? { isolatedIdentity: this.config.subprocessUser } : {},
+			spawnOptions: {
+				...this.subprocessSpawnOptions(),
+				...config.spawnOptions
+			}
+		});
+	}
+	/** Run a builtin-only Node script under this adapter's subprocess identity and return its stdout. */
+	async runNodeAsSubprocess(script, args, input = "") {
+		try {
+			const pending = execFileAsync(process.execPath, [
+				"-e",
+				script,
+				"--",
+				...args
+			], {
+				...this.subprocessSpawnOptions(),
+				cwd: "/",
+				env: {},
+				timeout: 3e4,
+				maxBuffer: 64 * 1024 * 1024
+			});
+			pending.child.stdin?.on("error", () => {});
+			pending.child.stdin?.end(input);
+			return (await pending).stdout;
+		} catch (error) {
+			const stderr = String(error.stderr ?? "").trim();
+			throw new Error((stderr || (error instanceof Error ? error.message : String(error))).slice(-500));
+		}
+	}
+	getCapabilities() {
+		return {
+			streaming: true,
+			toolUse: true,
+			reasoning: true,
+			multimodal: false,
+			contextWindow: DEFAULT_CONTEXT_WINDOW
+		};
+	}
+	initialize(config) {
+		const attachments = config.runtimeAttachments === void 0 ? void 0 : AgentRuntimeAttachmentsSchema.safeParse(config.runtimeAttachments);
+		if (attachments && !attachments.success) return Promise.reject(/* @__PURE__ */ new Error("Invalid runtime MCP attachments"));
+		const capturedConfig = attachments?.success ? {
+			...config,
+			runtimeAttachments: attachments.data
+		} : config;
+		const configKey = stableSerialize(capturedConfig);
+		if (this.initialization.promise) {
+			if (configKey === this.initialization.configKey) return this.initialization.promise;
+			return Promise.reject(/* @__PURE__ */ new Error(`${this.provider} provider cannot start a conflicting initialize() while initialization is in flight; concurrent calls must use the same configuration`));
+		}
+		if (this.initialized) {
+			if (configKey === this.initialization.initializedConfigKey) return Promise.resolve();
+			return Promise.reject(/* @__PURE__ */ new Error(`${this.provider} provider is already initialized with a different configuration; call shutdown() before reinitializing`));
+		}
+		const pendingShutdown = this.initialization.shutdownPromise;
+		const generation = this.initialization.generation;
+		const cancellation = { cancelled: false };
+		const initialization = Promise.resolve().then(async () => {
+			if (pendingShutdown) await pendingShutdown;
+			this.initialization.assertCurrent(generation, cancellation);
+			executionLifecycle(this).shuttingDown = false;
+			await this.initializeAtGeneration(capturedConfig, configKey, generation, cancellation);
+		});
+		this.initialization.promise = initialization;
+		this.initialization.configKey = configKey;
+		this.initialization.cancellation = cancellation;
+		initialization.then(() => this.initialization.clear(initialization), () => this.initialization.clear(initialization));
+		return initialization;
+	}
+	async initializeAtGeneration(config, configKey, generation, cancellation) {
+		this.initialization.assertCurrent(generation, cancellation);
+		const nextStoragePath = config.workspace?.rootPath || this.storagePath;
+		const nextConfig = overlayProviderConfig(this.provider, this.initialConfig, config);
+		const configuredProfile = config.profile ?? nextConfig.profile;
+		if (configuredProfile !== void 0) {
+			nextConfig.profile = await resolveAgentProfileResources(agentProfileSchema.parse(configuredProfile));
+			this.initialization.assertCurrent(generation, cancellation);
+		}
+		const contract = this.sessionContract();
+		if (contract) assertFlagsHonourSessionContract(this.provider, contract, nextConfig.extraFlags ?? [], "extraFlags");
+		const persistenceConfig = {
+			storagePath: nextStoragePath,
+			storageDir: this.storageDir
+		};
+		const nextSessionStore = createSessionStore(persistenceConfig);
+		const nextMessageStore = createMessageStore(persistenceConfig);
+		this.initialization.assertCurrent(generation, cancellation);
+		this.storagePath = nextStoragePath;
+		this.config = nextConfig;
+		this.sessionStore = nextSessionStore;
+		this.messageStore = nextMessageStore;
+		const providerTail = Promise.resolve().then(() => this.afterInitialize(config));
+		this.initialization.providerTails.add(providerTail);
+		try {
+			await providerTail;
+			this.initialization.assertCurrent(generation, cancellation);
+			this.initialized = true;
+			this.initialization.initializedConfigKey = configKey;
+		} catch (error) {
+			if (generation === this.initialization.generation) {
+				this.config = cloneConfig(this.initialConfig);
+				this.sessionStore = null;
+				this.messageStore = null;
+				this.initialized = false;
+				this.initialization.initializedConfigKey = null;
+			}
+			throw error;
+		} finally {
+			this.initialization.providerTails.delete(providerTail);
+		}
+		this.logger.info(`${this.provider} provider initialized`, {
+			storagePath: this.storagePath,
+			storageDir: this.storageDir,
+			model: this.config.model
+		});
+	}
+	/** Auth/config files the adapter needs on disk that do NOT arrive through `config.model.authFiles` — e.g. */
+	getManagedAuthFiles() {
+		return [];
+	}
+	/** Provider-specific initialization runs inside the tracked lifecycle. */
+	async afterInitialize(_config) {}
+	/** The harness session contract this adapter honours (cli-agent-registry NATIVE_SESSION_CONTRACTS), or null for a provider that declares none. */
+	sessionContract() {
+		return NATIVE_SESSION_CONTRACTS[this.provider] ?? null;
+	}
+	async withExecution(signal, run) {
+		const execution = beginExecution(this, signal);
+		try {
+			return await run(execution.controller.signal);
+		} catch (error) {
+			execution.controller.abort();
+			throw error;
+		} finally {
+			finishExecution(this, execution);
+		}
+	}
+	async shutdown() {
+		this.initialization.cancel();
+		this.initialized = false;
+		executionLifecycle(this).shuttingDown = true;
+		this.config = cloneConfig(this.initialConfig);
+		if (this.initialization.shutdownPromise) return this.initialization.shutdownPromise;
+		const executions = [...executionLifecycle(this).inFlightExecutions];
+		const processes = [...this.activeProcesses];
+		const providerInitializationTails = [...this.initialization.providerTails];
+		for (const execution of executions) execution.controller.abort();
+		const trackedShutdown = (async () => {
+			await Promise.allSettled([
+				...providerInitializationTails,
+				...processes.map((process) => terminateTurnProcess(process, this.activeProcesses)),
+				...executions.map((execution) => execution.settled)
+			]);
+			this.sessionStore = null;
+			this.messageStore = null;
+			executionLifecycle(this).shuttingDown = false;
+			this.logger.info(`${this.provider} provider shut down`);
+		})().finally(() => {
+			if (this.initialization.shutdownPromise === trackedShutdown) this.initialization.shutdownPromise = void 0;
+		});
+		this.initialization.shutdownPromise = trackedShutdown;
+		return trackedShutdown;
+	}
+	async healthCheck() {
+		try {
+			return (await this.runAuxiliaryCli(["--version"], 5e3)).exit.success;
+		} catch {
+			return false;
+		}
+	}
+	/** Run this CLI's own one-shot command (version, MCP) in the workspace. */
+	runAuxiliaryCli(args, timeoutMs) {
+		return this.runCli({
+			command: this.getCliPath(),
+			args,
+			cwd: this.storagePath,
+			env: this.applyWritableHomeDefaults(this.buildNativeExecutionEnvironment(this.config), this.storagePath),
+			inheritEnv: this.inheritProcessEnv,
+			timeoutMs
+		});
+	}
+	async updateConfig(config) {
+		const resolvedConfig = { ...config };
+		if (config.profile !== void 0) resolvedConfig.profile = await resolveAgentProfileResources(agentProfileSchema.parse(config.profile));
+		this.config = mergeCliProviderConfig(this.config, resolvedConfig);
+		return this.config;
+	}
+	/** Apply private native credentials to every CLI subprocess through one path. */
+	buildNativeExecutionEnvironment(config) {
+		const env = this.buildExecEnv(config);
+		if (config.nativeAuthSecretEnv) env[config.nativeAuthSecretEnv] = void 0;
+		return {
+			...env,
+			...config.nativeAuthEnv
+		};
+	}
+	getCliPath() {
+		return this.config.cliPath ?? this.defaultCliPath;
+	}
+	ensureInitialized() {
+		if (executionLifecycle(this).shuttingDown) throw new Error(`${this.provider} provider is shutting down`);
+		if (!this.initialized) throw new Error(`${this.provider} provider not initialized. Call initialize() first.`);
+	}
+	getSessionStore() {
+		if (!this.sessionStore) throw new Error("Session store not initialized");
+		return this.sessionStore;
+	}
+	getMessageStore() {
+		if (!this.messageStore) throw new Error("Message store not initialized");
+		return this.messageStore;
+	}
+	/** The agent environment the host supplied (CliProviderOptions.agentEnvironment). */
+	agentEnvironmentValues() {
+		const secretProfile = !!this.config.secretProfileRevisionRoot;
+		return this.agentEnvironment?.({ secretProfile }) ?? (secretProfile ? {} : { ...process.env });
+	}
+	applyWritableHomeDefaults(adapterEnv, workspaceRoot) {
+		const env = {
+			...this.agentEnvironmentValues(),
+			...adapterEnv
+		};
+		const runtimeHome = this.config.runtimeHome?.trim();
+		if (!runtimeHome) return applyWritableHomeDefaults(env, workspaceRoot);
+		const agentHome = this.config.agentHome?.trim();
+		const configDir = agentHome ? configDirHomeEnv(this.provider, runtimeHome, agentHome) : void 0;
+		if (configDir) {
+			const adapterStores = Object.keys(configDir).flatMap((name) => {
+				if (name === "HOME" || name.startsWith("XDG_")) return [];
+				const value = adapterEnv[name]?.trim();
+				return value && value !== process.env[name] ? [[name, value]] : [];
+			});
+			return applyWritableHomeDefaults({
+				...env,
+				...configDir,
+				...Object.fromEntries(adapterStores)
+			}, workspaceRoot);
+		}
+		return applyWritableHomeDefaults({
+			...env,
+			...homeXdgEnv(runtimeHome)
+		}, workspaceRoot);
+	}
+};
+async function terminateTurnProcess(process, activeProcesses) {
+	process.kill();
+	const escalation = setTimeout(() => process.kill("SIGKILL"), 1e3);
+	escalation.unref();
+	try {
+		await process.exitPromise;
+	} finally {
+		clearTimeout(escalation);
+		activeProcesses.delete(process);
+	}
+}
+//#endregion
+//#region src/execution-request-headers.ts
+const headerValue = z.string().regex(/^[\x21-\x2b\x2d-\x7e]{1,256}$/);
+const EXECUTION_ID_HEADER = "X-Tangle-Execution-ID";
+const CORRELATION_FIELDS = {
+	"X-Tangle-Environment-ID": "environmentId",
+	"X-Tangle-Session-ID": "sessionId",
+	[EXECUTION_ID_HEADER]: "executionId"
+};
+/** Router column that joins a model request to the turn trace that caused it. */
+const EXECUTION_TRACE_HEADER = "X-Tangle-Trace-ID";
+const MANAGED_QUOTE_VERSION_HEADER = "X-Tangle-Managed-Quote-Version";
+/** Every header a turn's correlation may set, lowercased. */
+const EXECUTION_CORRELATION_HEADERS = [
+	...Object.keys(CORRELATION_FIELDS),
+	EXECUTION_TRACE_HEADER,
+	MANAGED_QUOTE_VERSION_HEADER,
+	"traceparent"
+].map((name) => name.toLowerCase());
+const managedQuoteVersion = z.string().regex(/^mmq_[a-f0-9]{40}$/);
+/**
+* Capture diagnostic identity without forwarding caller-supplied transport headers.
+* `traceId` is the turn's trace id; a value no header can carry is omitted,
+* because a trace is diagnostic and must never refuse the run.
+*/
+function executionCorrelationHeaders(binding, traceId, quoteVersion) {
+	const quote = managedQuoteVersion.optional().parse(quoteVersion);
+	if (quote !== void 0 && binding === void 0) throw new Error("Managed quote requires an exact execution binding");
+	const trace = headerValue.safeParse(traceId);
+	const headers = {};
+	if (trace.success) {
+		headers[EXECUTION_TRACE_HEADER] = trace.data;
+		const span = W3C.toW3CSpanId(`${trace.data}:sidecar`);
+		headers.traceparent = `00-${W3C.toW3CTraceId(trace.data)}-${span}-01`;
+	}
+	if (binding === void 0) return trace.success ? Object.freeze(headers) : void 0;
+	if (quote !== void 0) headers[MANAGED_QUOTE_VERSION_HEADER] = quote;
+	for (const [name, field] of Object.entries(CORRELATION_FIELDS)) {
+		const value = headerValue.safeParse(binding[field]);
+		if (!value.success) throw new Error(`Execution correlation ${field} must contain 1–256 printable ASCII characters without spaces or commas`);
+		headers[name] = value.data;
+	}
+	return Object.freeze(headers);
+}
+//#endregion
+//#region src/profile-config.ts
+/**
+* Per-turn credential delivery wins over host-env resolution; the host box
+* environment stays the fallback for references the turn did not deliver.
+* With no turn secrets the host provider is returned unchanged, so the
+* overlay adds no behavior to executions that never asked for it.
+*/
+function runtimeSecretsOverlay(runtimeSecrets, fallback) {
+	if (!runtimeSecrets || Object.keys(runtimeSecrets).length === 0) return fallback;
+	return { get: async (key) => runtimeSecrets[key] ?? await fallback.get(key) };
+}
+function hasPortableProfileControls(profile) {
+	return profile.prompt !== void 0 || profile.model !== void 0 || profile.harness !== void 0 || profile.permissions !== void 0 || profile.tools !== void 0 || profile.mcp !== void 0 || profile.connections !== void 0 || profile.subagents !== void 0 || profile.resources !== void 0 || profile.hooks !== void 0 || profile.modes !== void 0 || profile.confidential !== void 0 || profile.extensions !== void 0;
+}
+function systemPromptConflict(request, profile) {
+	return /* @__PURE__ */ new Error(`execution system prompt (${request.length} chars) conflicts with the materialized AgentProfile prompt.systemPrompt (${profile.length} chars); send no systemPrompt, or move the addition to appendSystemPrompt`);
+}
+/** A blank profile prompt declares none, so the request prompt stands. */
+function resolveSystemPrompt(requestPrompt, profilePrompt) {
+	if (!profilePrompt?.trim()) return requestPrompt;
+	if (requestPrompt && requestPrompt !== profilePrompt) throw systemPromptConflict(requestPrompt, profilePrompt);
+	return profilePrompt;
+}
+function profileForExecution(profile, requestPrompt) {
+	const profilePrompt = profile?.prompt?.systemPrompt;
+	if (!profile || !profilePrompt?.trim() || !requestPrompt || requestPrompt === profilePrompt) return profile;
+	if (!requestPrompt.startsWith(`${profilePrompt}\n\n`)) throw systemPromptConflict(requestPrompt, profilePrompt);
+	return {
+		...profile,
+		prompt: {
+			...profile.prompt,
+			systemPrompt: requestPrompt
+		}
+	};
+}
+/**
+* Refuse to dispatch an execution against a model the profile did not
+* materialize — a caller must not silently get a different model than the one
+* the workspace was built for.
+*
+* The request and the profile carry the same model at different qualification
+* levels: the request is the id the caller sent, the profile default is that id
+* qualified with its provider. Both go through the one shared canonicalization
+* so only a genuinely different model is a conflict.
+*/
+function resolveModel(requestModel, profileModel, configuredModel, profileProvider) {
+	if (profileModel !== void 0 && requestModel !== void 0 && !modelIdsMatch(requestModel, profileModel, profileProvider)) throw new Error("execution model conflicts with the materialized AgentProfile");
+	return profileModel ?? requestModel ?? configuredModel;
+}
+//#endregion
+//#region src/profile-revision-receipts.ts
+/** Receipts belong to their adapter; resolved secrets never enter them. */
+var ProfileRevisionReceipts = class {
+	public = /* @__PURE__ */ new WeakMap();
+	secret = /* @__PURE__ */ new WeakMap();
+};
+const receiptsByAdapter = /* @__PURE__ */ new WeakMap();
+function profileRevisionReceipts(owner) {
+	let receipts = receiptsByAdapter.get(owner);
+	if (!receipts) {
+		receipts = new ProfileRevisionReceipts();
+		receiptsByAdapter.set(owner, receipts);
+	}
+	return receipts;
+}
+function assertExecutionProfileRevision(owner, getConfig, input, profilePlan) {
+	const config = getConfig();
+	const receipts = profileRevisionReceipts(owner);
+	const actualPublic = profilePlan ? receipts.public.get(profilePlan) : void 0;
+	const actualSecret = profilePlan ? receipts.secret.get(profilePlan) : void 0;
+	for (const [root, receipt, kind] of [[
+		config.publicProfileRevisionRoot,
+		actualPublic,
+		"public"
+	], [
+		config.secretProfileRevisionRoot,
+		actualSecret,
+		"secret"
+	]]) if (root && profilePlan && !receipt) throw new Error(`Provider added ${kind} profile launch controls after immutable revision preparation`);
+	const { expectedSecretProfileReceipt, expectedPublicProfileRevision } = input;
+	if (config.secretProfileRevisionRoot) {
+		if (!expectedSecretProfileReceipt || !actualSecret || actualSecret.executorReceipt !== expectedSecretProfileReceipt) throw new Error("Secret native profile receipt mismatch before native spawn");
+	} else if (expectedSecretProfileReceipt !== void 0) throw new Error("Secret native profile execution is unavailable");
+	assertPublicReceipt(actualPublic, expectedPublicProfileRevision);
+}
+function assertPublicReceipt(actual, expected) {
+	if (expected !== void 0 && (!actual || [
+		"workspacePlanDigest",
+		"materializedDigest",
+		"launchDigest"
+	].some((key) => actual[key] !== expected[key]))) throw new Error("Public native profile revision mismatch before native spawn");
+}
+//#endregion
+//#region src/errors.ts
+/**
+* A session's persisted transcript exists but could not be read for replay
+* into the fresh provider session this turn starts. The turn fails instead
+* of serving an empty conversation under the same session id. The sidecar's
+* client-visible whitelist matches on `code`; the wire contract is the
+* duck-typed field, not class identity.
+*/
+var SessionRehydrationError = class extends Error {
+	code = "session_rehydration_failed";
+	constructor(message, cause) {
+		super(message, { cause });
+		this.name = "SessionRehydrationError";
+	}
+};
+const NOT_LAUNCHED = Symbol.for("@tangle-network/sdk-provider-cli-base.not-launched");
+/**
+* Marks a turn failure the adapter raised before it planned the launch:
+* session preparation or profile materialization refused, so no native
+* process received this turn and it left no native transcript to copy.
+* Only the adapter marks, on the error object it caught; error text never
+* does, so a provider message that reads the same is not marked.
+*/
+function rejectNotLaunched(error) {
+	if (error instanceof Error && !Object.isFrozen(error)) Object.defineProperty(error, NOT_LAUNCHED, { value: true });
+	throw error;
+}
+/** Whether this error is one the adapter raised before launching anything. */
+function wasNeverLaunched(error) {
+	return Object.getOwnPropertyDescriptor(error, NOT_LAUNCHED)?.value === true;
+}
+//#endregion
+//#region src/file-parts.ts
+/** Extension → MIME type, keyed by lowercased extension without the dot. */
+const EXTENSION_TO_MEDIA_TYPE = {
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	webp: "image/webp",
+	svg: "image/svg+xml",
+	pdf: "application/pdf",
+	mp3: "audio/mpeg",
+	wav: "audio/wav",
+	mp4: "video/mp4",
+	webm: "video/webm",
+	txt: "text/plain",
+	md: "text/markdown",
+	csv: "text/csv",
+	json: "application/json",
+	html: "text/html",
+	markdown: "text/markdown",
+	htm: "text/html",
+	xml: "application/xml",
+	yaml: "application/yaml",
+	yml: "application/yaml",
+	js: "text/javascript",
+	ts: "application/typescript",
+	py: "text/x-python"
+};
+/**
+* Inverse of the table above, for synthesizing a filename from a media type.
+* Built once from the first extension seen per media type (e.g. image/jpeg
+* → "jpg", not "jpeg") so the mapping is stable across calls.
+*/
+const MEDIA_TYPE_TO_EXTENSION = Object.entries(EXTENSION_TO_MEDIA_TYPE).reduce((acc, [ext, mediaType]) => {
+	if (!(mediaType in acc)) acc[mediaType] = ext;
+	return acc;
+}, {});
+function sha1Hex(value) {
+	return createHash("sha1").update(value).digest("hex");
+}
+/** Infers a MIME type from a filename's extension. Unknown/no extension → undefined. */
+function inferMediaType(filename) {
+	const dot = filename.lastIndexOf(".");
+	if (dot < 0 || dot === filename.length - 1) return void 0;
+	return EXTENSION_TO_MEDIA_TYPE[filename.slice(dot + 1).toLowerCase()];
+}
+/**
+* Builds the canonical URL for a file part. A data URI passes through
+* verbatim; a path is returned unchanged if it already carries a recognized
+* scheme, else converted to a percent-encoded `file://` URL.
+*
+* Callers must pass an already-resolved absolute path — `trackFilePart`
+* resolves relative paths (or drops the observation when it can't) before
+* ever reaching here, so a relative path arriving at this layer means a
+* caller bypassed that resolution. We throw rather than mint a malformed
+* `file://` URL (e.g. `file://./chart.png`, whose authority is `.`).
+*/
+function buildFileUrl(input) {
+	if (input.dataUri !== void 0) return input.dataUri;
+	if (input.path === void 0) throw new Error("buildFileUrl requires either `path` or `dataUri` to build a file part URL");
+	if (input.path.startsWith("file://") || input.path.startsWith("http://") || input.path.startsWith("https://") || input.path.startsWith("data:")) return input.path;
+	if (!isAbsolute(input.path)) throw new Error(`buildFileUrl requires an absolute path to build a file:// URL, got "${input.path}" — resolve it against a workspace root before calling buildFileUrl`);
+	return pathToFileURL(input.path).href;
+}
+/** Deterministic, stable part id for a file announced within one message. */
+function deterministicFilePartId(messageId, key) {
+	return `file-${sha1Hex(`${messageId}|${key}`).slice(0, 16)}`;
+}
+function deriveFilePart(input) {
+	const normalized = normalize(input.path);
+	let resolvedPath;
+	if (isAbsolute(normalized)) resolvedPath = normalized;
+	else if (input.workspaceRoot !== void 0) resolvedPath = resolve(input.workspaceRoot, normalized);
+	else return null;
+	const filename = basename(resolvedPath);
+	return {
+		id: deterministicFilePartId(input.messageId, resolvedPath),
+		key: resolvedPath,
+		filename,
+		mediaType: inferMediaType(filename),
+		url: buildFileUrl({ path: resolvedPath })
+	};
+}
+function trackFilePart(state, args) {
+	if (args.changeKind === "delete") return null;
+	if (args.path === void 0 && args.dataUri === void 0) return null;
+	if (state.messageId === void 0) throw new Error("trackFilePart requires state.messageId (set by createExecutionState) to derive a stable part id");
+	let derived = null;
+	if (args.path !== void 0) {
+		derived = deriveFilePart({
+			path: args.path,
+			messageId: state.messageId,
+			workspaceRoot: state.workspaceRoot
+		});
+		if (derived === null) return null;
+	}
+	state.fileParts ??= [];
+	const parts = state.fileParts;
+	const key = derived !== null ? derived.key : `data:${sha1Hex(args.dataUri)}`;
+	const url = derived !== null ? derived.url : buildFileUrl({ dataUri: args.dataUri });
+	const existing = parts.find((p) => p.key === key);
+	let filename = args.filename ?? derived?.filename ?? existing?.filename;
+	const mediaType = args.mediaType ?? (filename !== void 0 ? inferMediaType(filename) : void 0) ?? existing?.mediaType;
+	if (filename === void 0 && args.path === void 0) {
+		const priorDataUriEntries = parts.filter((p) => p.key.startsWith("data:")).length;
+		const ext = mediaType ? MEDIA_TYPE_TO_EXTENSION[mediaType] ?? "bin" : "bin";
+		filename = `attachment-${priorDataUriEntries + 1}.${ext}`;
+	}
+	if (existing) {
+		existing.filename = filename;
+		existing.mediaType = mediaType;
+		existing.url = url;
+		return {
+			id: existing.id,
+			filename: existing.filename,
+			mediaType: existing.mediaType,
+			url: existing.url
+		};
+	}
+	const id = derived !== null ? derived.id : deterministicFilePartId(state.messageId, key);
+	parts.push({
+		id,
+		key,
+		filename,
+		mediaType,
+		url
+	});
+	return {
+		id,
+		filename,
+		mediaType,
+		url
+	};
+}
+//#endregion
+//#region src/prompt-input.ts
+/** Raw-byte ceiling for inlining one image as base64 (~1.33x expansion in
+*  memory and on the wire); larger images keep only their `path` and the
+*  adapter falls back to path-based delivery. */
+const MAX_INLINE_IMAGE_BYTES = 10 * 1024 * 1024;
+/** Aggregate raw-byte budget for inlined images across one request's parts —
+*  the request schema admits up to 64 parts, so a per-image cap alone would
+*  still let one request hold hundreds of MB of base64 until execution. */
+const MAX_TOTAL_INLINE_IMAGE_BYTES = 32 * 1024 * 1024;
+async function readImageBase64(filePath, wroteFile, budgetBytes) {
+	const limit = Math.min(MAX_INLINE_IMAGE_BYTES, budgetBytes);
+	if (limit <= 0) return void 0;
+	let handle;
+	try {
+		handle = await open(filePath, constants.O_RDONLY | constants.O_NONBLOCK);
+		const stats = await handle.stat();
+		if (!stats.isFile() || stats.size > limit) return void 0;
+		const buffer = Buffer.alloc(stats.size + 1);
+		let offset = 0;
+		while (offset < buffer.length) {
+			const { bytesRead } = await handle.read(buffer, offset, buffer.length - offset, offset);
+			if (bytesRead === 0) break;
+			offset += bytesRead;
+		}
+		if (offset > stats.size) return void 0;
+		return {
+			base64: buffer.subarray(0, offset).toString("base64"),
+			rawBytes: offset
+		};
+	} catch (error) {
+		if (wroteFile) throw error;
+		return;
+	} finally {
+		await handle?.close();
+	}
+}
+function inferExtension(mediaType) {
+	if (!mediaType) return "bin";
+	if (mediaType === "application/pdf") return "pdf";
+	if (mediaType.startsWith("image/")) return mediaType.split("/")[1] || "img";
+	if (mediaType.startsWith("audio/")) return mediaType.split("/")[1] || "audio";
+	if (mediaType.startsWith("video/")) return mediaType.split("/")[1] || "video";
+	return mediaType.includes("/") ? mediaType.split("/")[1] || "bin" : "bin";
+}
+function sanitizeFilename(filename) {
+	return filename.replace(/[^a-zA-Z0-9._-]/g, "-") || `attachment-${randomUUID()}`;
+}
+const TEXT_MEDIA_TYPES = new Set([
+	"application/json",
+	"application/xml",
+	"application/yaml",
+	"application/x-yaml",
+	"application/javascript",
+	"application/csv"
+]);
+function isTextMediaType(mediaType) {
+	if (!mediaType) return true;
+	const essence = (mediaType.split(";")[0] ?? "").trim().toLowerCase();
+	if (essence.startsWith("text/")) return true;
+	if (TEXT_MEDIA_TYPES.has(essence)) return true;
+	return essence.endsWith("+json") || essence.endsWith("+xml");
+}
+async function materializeAttachmentPart(part, workspaceRoot, sessionId, index) {
+	const attachmentDir = path.join(workspaceRoot, ".agent-inputs", sessionId);
+	await mkdir(attachmentDir, { recursive: true });
+	let dataUriMatch;
+	if (part.url?.startsWith("data:")) {
+		const match = part.url.match(/^data:([^;,]+)?;base64,(.*)$/s);
+		if (!match) throw new InvalidAttachmentError(`Invalid data URI for ${part.type} attachment`);
+		dataUriMatch = match;
+	}
+	const mediaType = part.mediaType || dataUriMatch?.[1] || void 0;
+	const filename = sanitizeFilename(part.filename || (part.path ? path.basename(part.path) : void 0) || `${part.type}-${index + 1}.${inferExtension(mediaType)}`);
+	const targetPath = path.join(attachmentDir, filename);
+	let referencePath = part.path ? path.resolve(workspaceRoot, part.path) : targetPath;
+	let wroteFile = false;
+	const content = "content" in part ? part.content : void 0;
+	const payload = dataUriMatch ? Buffer.from(dataUriMatch[2], "base64") : typeof content === "string" ? content : void 0;
+	if (payload !== void 0) {
+		if (!dataUriMatch && !isTextMediaType(part.mediaType)) throw new InvalidAttachmentError(`Cannot write binary attachment "${filename}" (mediaType: ${part.mediaType}) via "content" — deliver it as a base64 data: URL (data:${part.mediaType};base64,...) or via "path"/"file://" url instead.`);
+		const partDirectory = path.join(attachmentDir, `part-${randomUUID()}`);
+		await mkdir(partDirectory);
+		referencePath = path.join(partDirectory, filename);
+		await writeFile(referencePath, payload, { flag: "wx" });
+		wroteFile = true;
+	} else if (part.url?.startsWith("file://")) try {
+		referencePath = fileURLToPath(part.url);
+	} catch (err) {
+		throw new InvalidAttachmentError(`Invalid file:// URL for ${part.type} attachment: ${JSON.stringify(part.url)} (${err instanceof Error ? err.message : String(err)})`);
+	}
+	else if (part.url && /^https?:\/\//i.test(part.url)) referencePath = part.url;
+	const isHttpReference = referencePath.startsWith("http://") || referencePath.startsWith("https://");
+	return {
+		reference: referencePath,
+		filename,
+		...mediaType ? { mediaType } : {},
+		wroteFile,
+		persistedPart: {
+			type: "file",
+			filename,
+			mediaType,
+			url: isHttpReference ? referencePath : buildFileUrl({ path: referencePath })
+		}
+	};
+}
+async function preparePromptInputParts(parts, workspaceRoot, sessionId, options) {
+	const nativeKinds = new Set(options?.nativeAttachmentKinds ?? []);
+	const promptSections = [];
+	const attachmentRefs = [];
+	const persistedParts = [];
+	const attachments = [];
+	const inlineImages = nativeKinds.has("image");
+	let inlineBudget = options?.inlineImageBudgetBytes ?? 33554432;
+	for (const [index, part] of parts.entries()) {
+		if (part.type === "text") {
+			if (!part.text) continue;
+			promptSections.push(part.text);
+			persistedParts.push({
+				type: "text",
+				text: part.text
+			});
+			continue;
+		}
+		const materialized = await materializeAttachmentPart(part, workspaceRoot, sessionId, index);
+		const marker = `[${part.type === "image" ? "Image" : "File"}: ${materialized.reference}]`;
+		if (!nativeKinds.has(part.type)) attachmentRefs.push(marker);
+		persistedParts.push(materialized.persistedPart);
+		const isRemote = /^https?:\/\//i.test(materialized.reference);
+		const attachment = {
+			kind: part.type,
+			filename: materialized.filename,
+			marker,
+			...materialized.mediaType ? { mediaType: materialized.mediaType } : {},
+			...isRemote ? { url: materialized.reference } : { path: materialized.reference }
+		};
+		if (part.type === "image" && attachment.path && inlineImages) {
+			const inlined = await readImageBase64(attachment.path, materialized.wroteFile, inlineBudget);
+			if (inlined) {
+				attachment.base64 = inlined.base64;
+				inlineBudget -= inlined.rawBytes;
+			}
+		}
+		attachments.push(attachment);
+	}
+	if (attachmentRefs.length > 0) promptSections.push(`Attached files:\n${attachmentRefs.join("\n")}`);
+	return {
+		promptText: promptSections.join("\n\n").trim(),
+		persistedParts,
+		attachments
+	};
+}
+/**
+* Partition a turn's image attachments into the ones the adapter will
+* forward natively and the "stranded" rest, folding each stranded image's
+* `[Image: ...]` marker back into the message text. Once an adapter's
+* nativeAttachmentKinds() claims "image", the base prompt renderer omits
+* every image marker — so any image the mechanism can't carry (no base64
+* for a stdin block, no local path for an argv flag, beyond a single-path
+* flag's capacity) MUST re-enter the prompt here or the model never sees
+* a reference to it. Uses the same "Attached files:" block format the
+* renderer itself emits for non-native kinds.
+*/
+function partitionImageAttachments(options) {
+	const { message, attachments, qualifies, maxNative } = options;
+	const native = [];
+	const strandedMarkers = [];
+	for (const attachment of attachments ?? []) {
+		if (attachment.kind !== "image") continue;
+		if ((maxNative === void 0 || native.length < maxNative) && qualifies(attachment)) native.push(attachment);
+		else strandedMarkers.push(attachment.marker);
+	}
+	return {
+		native,
+		message: strandedMarkers.length > 0 ? `${message}\n\nAttached files:\n${strandedMarkers.join("\n")}` : message
+	};
+}
+/** Separates the sections a harness receives as one user message. */
+const PROMPT_SECTION_SEPARATOR = "\n\n---\n\n";
+/**
+* Puts `section` (a system prompt or replayed context) ahead of the message
+* for harnesses that take no separate channel for it.
+*/
+function prependPromptSection(section, body) {
+	return section ? `${section}${PROMPT_SECTION_SEPARATOR}${body}` : body;
+}
+//#endregion
+//#region src/types.ts
+function interactionToggleEnabled(config, kind) {
+	return config === true || typeof config === "object" && config !== null && config[kind] === true;
+}
+function enabledInteractionKinds(config, supported) {
+	if (config === true) return [...supported];
+	if (typeof config !== "object" || config === null) return [];
+	return supported.filter((kind) => config[kind] === true);
+}
+function readEphemeralContext(input) {
+	const context = input.ephemeralContext;
+	if (context === void 0 || context === null) return void 0;
+	if (typeof context !== "string") throw new TypeError(`ephemeralContext must be a string, received ${typeof context}`);
+	return context || void 0;
+}
+/** Compose the model-facing prompt for a turn: the caller's own text, then this turn's ephemeral context. */
+function withEphemeralContext(promptText, input) {
+	const context = readEphemeralContext(input);
+	if (!context) return promptText;
+	return promptText ? `${promptText}\n\n${context}` : context;
+}
+function turnInteractionEnabled(input, latched, kind) {
+	const perTurn = input.interactions;
+	return interactionToggleEnabled(perTurn !== void 0 ? perTurn : latched, kind);
+}
+/** Overlay this turn's interactions onto a latched config, returning a NEW object (no shared mutation — safe when. */
+function withTurnInteractions(config, input) {
+	if (input.interactions === void 0) return config;
+	return {
+		...config,
+		interactions: input.interactions
+	};
+}
+/**
+* The one precedence every engine names a failed turn's end with (#16404): an
+* end the abort, the timeout or the harness named is theirs; only an
+* unexplained death is the link's, the memory limit's or the harness's.
+*/
+function turnEndReason(end) {
+	if (end.aborted) return "abort";
+	if (end.timedOut) return "timeout";
+	if (end.harnessFailed) return "failed";
+	if (end.linkLost) return "gateway_disconnect";
+	if (end.memoryKilled) return "memory_limit";
+	return end.signal ? "harness_exit" : "failed";
+}
+//#endregion
+//#region src/adapter-profile.ts
+/** Revisions that already passed the native health check in this process, by the verifier's scope and the revision's materialized digest. */
+const verifiedSecretProfileRevisions = /* @__PURE__ */ new Set();
+const VERIFIED_SECRET_PROFILE_REVISIONS_MAX = 1024;
+function rememberVerifiedSecretProfileRevision(key) {
+	verifiedSecretProfileRevisions.delete(key);
+	verifiedSecretProfileRevisions.add(key);
+	if (verifiedSecretProfileRevisions.size > VERIFIED_SECRET_PROFILE_REVISIONS_MAX) {
+		const oldest = verifiedSecretProfileRevisions.values().next().value;
+		if (oldest !== void 0) verifiedSecretProfileRevisions.delete(oldest);
+	}
+}
+/** The executor's naming key, refused unless root owns it alone. */
+function readSecretProfileNamingKey(keyPath) {
+	if (!keyPath) throw new Error("Secret profile naming key is unavailable");
+	const keyStat = lstatSync(keyPath);
+	if (!keyStat.isFile() || keyStat.isSymbolicLink() || keyStat.uid !== 0 || (keyStat.mode & 511) !== 384 || keyStat.size !== 32) throw new Error("Secret profile naming key is not root-owned");
+	return readFileSync(keyPath);
+}
+/** Owns native profile revisions, launch controls, and prompt composition. */
+var CliAdapterProfile = class extends CliAdapterLifecycle {
+	/** Native profile lowering explicitly owned by this adapter, never inferred from a path. */
+	profileHarness = void 0;
+	/** Trusted implementation capabilities; never read from caller-owned configuration. */
+	supportsSecretProfileRevisions = false;
+	profileSecretProvider;
+	secretProfileRuntimeKeyProvider;
+	/** Private native preparation state; never part of a returned receipt. */
+	secretProfileRevisions = /* @__PURE__ */ new WeakMap();
+	constructor(options = {}) {
+		super(options);
+		this.profileSecretProvider = options.profileSecretProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
+		this.secretProfileRuntimeKeyProvider = options.secretProfileRuntimeKeyProvider ?? UNAVAILABLE_AGENT_PROFILE_SECRET_PROVIDER;
+	}
+	/** The exact child environment a turn uses; shared with prewarm paths. */
+	buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders) {
+		const merged = this.mergeProfilePlanEnvironment(this.buildNativeExecutionEnvironment(executionConfig), profilePlan, executionConfig.nativeAuthEnv !== void 0 || (executionConfig.authFiles?.length ?? 0) > 0);
+		return this.bindExecutionCorrelation(this.applyWritableHomeDefaults(this.bindProfileToolBinDirs(merged, profilePlan), workspaceRoot), correlationHeaders);
+	}
+	/** A profile's declared executable tools, sealed in its revision, stand in for the app's own tool dirs on this launch's PATH tail. */
+	bindProfileToolBinDirs(env, profilePlan) {
+		const toolBinDirs = profilePlan?.spawn.toolBinDirs;
+		if (!toolBinDirs?.length) return env;
+		return bindLaunchToolBinDirs("PATH" in env || !this.inheritProcessEnv || process.env.PATH === void 0 ? env : {
+			...env,
+			PATH: process.env.PATH
+		}, toolBinDirs, [...parseSandboxToolBinDirs(env.SANDBOX_TOOL_BIN_DIRS), ...parseSandboxToolBinDirs(process.env.SANDBOX_TOOL_BIN_DIRS)]);
+	}
+	bindExecutionCorrelation(environment, correlationHeaders) {
+		if (correlationHeaders?.["X-Tangle-Execution-ID"] !== void 0) this.logger.warn("Native model request correlation is unsupported", { provider: this.provider });
+		return environment;
+	}
+	/** Launcher controls this adapter OWNS on the spawn it starts; the pre-box verdict reads the same table. */
+	profileMaterializationBinds() {
+		const harness = this.profileHarness;
+		return (harness && HARNESS_LAUNCH_MATERIALIZE_OPTIONS[harness]?.binds) ?? [];
+	}
+	/** Optional native instruction root. */
+	profileAgentDirectory(_workspaceRoot) {}
+	/** Provider transport bound into the private immutable revision and receipt. */
+	secretProfileProviderConfig() {}
+	/** The values behind a secret revision's `{env:NAME}` config references, for an executor that serves those references itself. */
+	secretProfileReferences(application) {
+		return application ? this.secretProfileRevisions.get(application)?.references : void 0;
+	}
+	/** The one sealed session view repointed only while its native turn owns the queue. */
+	secretProfileSessionView(sessionId) {
+		const root = this.config.secretProfileRevisionRoot;
+		const subprocessUid = this.config.subprocessUser?.uid;
+		if (!root || subprocessUid === void 0) throw new Error("Secret profile session view is unavailable");
+		const launchRoot = join(root, "launch");
+		return {
+			launchRoot,
+			view: secretSessionViewWorkspace({
+				launchRoot,
+				sharedWorkspaceDir: this.storagePath,
+				sessionId,
+				subprocessUid
+			}),
+			subprocessUid
+		};
+	}
+	/** Bind the private revision into the session's stable native cwd. */
+	bindSecretProfileSessionView(revisionWorkspaceDir, sessionId) {
+		const { launchRoot, view, subprocessUid } = this.secretProfileSessionView(sessionId);
+		bindSecretSessionView({
+			launchRoot,
+			viewWorkspaceDir: view,
+			revisionWorkspaceDir,
+			subprocessUid
+		});
+		return view;
+	}
+	async materializeProfileResources(inputProfile, workspaceRoot, ownerId, sessionId, scope = "turn") {
+		if (!inputProfile && !this.config.runtimeAttachments) return void 0;
+		const started = performance.now();
+		try {
+			return await this.applyProfileResources(inputProfile, workspaceRoot, ownerId, sessionId);
+		} finally {
+			this.logger.observePhase?.("profile_materialize", performance.now() - started, scope);
+		}
+	}
+	/** This spawn's plan: a strict refusal throws, a best-effort one is logged. */
+	planProfile(profile, harness, agentInstructions = false) {
+		const plan = materializeProfile(profile, harness, {
+			runtimeAttachments: this.config.runtimeAttachments,
+			binds: this.profileMaterializationBinds(),
+			...agentInstructions ? { instructionsRoot: "agent" } : {}
+		});
+		const unsupported = enforceWorkspacePlanSupport(plan, profile.resources?.failOnError);
+		if (unsupported.length > 0) this.logger.warn("profile contains unsupported best-effort resources", {
+			harness,
+			unsupported
+		});
+		return plan;
+	}
+	async applyProfileResources(inputProfile, workspaceRoot, ownerId, sessionId) {
+		const profile = inputProfile ?? {};
+		const harness = this.profileHarness;
+		if (!harness) {
+			if (hasPortableProfileControls(profile) || this.config.runtimeAttachments !== void 0) throw new Error(`${this.provider} does not support portable AgentProfile controls`);
+			return;
+		}
+		const agentDir = this.profileAgentDirectory(workspaceRoot);
+		const plan = this.planProfile(profile, harness, agentDir !== void 0);
+		if (this.config.secretProfileRevisionRoot) return await this.applySecretProfileRevision(plan, this.config.secretProfileRevisionRoot, workspaceRoot, ownerId, sessionId);
+		if (this.config.publicProfileRevisionRoot) {
+			if (!ownerId) throw new Error("Concurrent public profile launch requires a session scope; idle prewarm is unsupported");
+			const revision = await preparePublicConcurrentProfileRevision({
+				plan,
+				...ensurePublicConcurrentProfileRoots(this.config.publicProfileRevisionRoot),
+				sharedWorkspaceDir: workspaceRoot,
+				ownerId,
+				secretProvider: runtimeSecretsOverlay(this.config.runtimeSecrets, this.profileSecretProvider)
+			});
+			this.logger.debug("materialized public concurrent profile revision", {
+				harness,
+				directory: revision.directory,
+				digest: revision.manifest.materializedDigest
+			});
+			const launchDigest = revision.manifest.launchDigest;
+			if (!launchDigest) throw new Error("Concurrent profile launch digest was not recorded");
+			profileRevisionReceipts(this).public.set(revision.application, {
+				workspacePlanDigest: revision.manifest.workspacePlanDigest,
+				materializedDigest: revision.manifest.materializedDigest,
+				launchDigest,
+				conflicts: revision.manifest.conflicts
+			});
+			return revision.application;
+		}
+		const application = await applyWorkspacePlanWithSecretProvider(plan, workspaceRoot, runtimeSecretsOverlay(this.config.runtimeSecrets, this.profileSecretProvider), {
+			ownership: this.subprocessIdentity(),
+			...agentDir === void 0 ? {} : { agentDir }
+		});
+		this.logger.debug("materialized profile resources", {
+			harness,
+			files: plan.files.length,
+			flags: plan.flags.length,
+			environment: Object.keys(plan.env).length
+		});
+		return application;
+	}
+	/** Publish the profile as an executor-sealed revision for this session's subprocess identity, and record the receipt that binds it to the turn. */
+	async applySecretProfileRevision(plan, secretProfileRevisionRoot, workspaceRoot, ownerId, sessionId) {
+		if (!this.supportsSecretProfileRevisions || !ownerId || !sessionId || !this.config.subprocessUser) throw new Error("Secret concurrent profile needs an opted-in adapter, a session, and per-turn runtime secrets only");
+		const namingKey = readSecretProfileNamingKey(this.config.secretProfileNamingKeyPath);
+		const roots = ensurePublicConcurrentProfileRoots(secretProfileRevisionRoot);
+		const revision = await prepareSecretConcurrentProfileRevision({
+			plan,
+			providerConfig: this.secretProfileProviderConfig(),
+			...roots,
+			sharedWorkspaceDir: workspaceRoot,
+			ownerId,
+			subprocessUid: this.config.subprocessUser.uid,
+			namingKey,
+			secretProvider: runtimeSecretsOverlay(this.config.runtimeSecrets, this.secretProfileRuntimeKeyProvider)
+		});
+		const launchDigest = revision.manifest.launchDigest;
+		if (!launchDigest) throw new Error("Secret concurrent profile launch digest is absent");
+		const executorReceipt = `hmac-sha256:${createHmac("sha256", namingKey).update(ownerId).update("\0").update(sessionId).update("\0").update(String(this.config.subprocessUser.uid)).update("\0").update(revision.manifest.workspacePlanDigest).update("\0").update(revision.manifest.materializedDigest).update("\0").update(launchDigest).digest("hex")}`;
+		this.secretProfileRevisions.set(revision.application, {
+			materializedDigest: revision.manifest.materializedDigest,
+			references: revision.secretReferences
+		});
+		profileRevisionReceipts(this).secret.set(revision.application, {
+			workspacePlanDigest: revision.manifest.workspacePlanDigest,
+			executorReceipt,
+			conflicts: revision.manifest.conflicts.map((conflict) => ({ ...conflict }))
+		});
+		return revision.application;
+	}
+	/** Prepare the same provider-composed native plan that execute() will check. */
+	async preparePublicProfileRevision(input) {
+		if (!this.config.publicProfileRevisionRoot) throw new Error("Concurrent public profile materialization is disabled");
+		const sessionScope = input.userId ?? input.sessionId;
+		if (!sessionScope) throw new Error("Concurrent public profile preparation needs a session scope");
+		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
+		const receipt = application ? profileRevisionReceipts(this).public.get(application) : void 0;
+		if (!receipt) throw new Error("Concurrent public profile preparation produced no native plan");
+		return receipt;
+	}
+	/** Prepare the private native plan and return only an opaque executor receipt. */
+	async prepareSecretProfileRevision(input) {
+		if (!this.config.secretProfileRevisionRoot) throw new Error("Secret concurrent profile materialization is disabled");
+		const sessionScope = input.userId ?? input.sessionId;
+		if (!sessionScope) throw new Error("Secret profile preparation needs a session scope");
+		const startedAt = performance.now();
+		const application = await this.materializeProfileResources(this.resolveExecutionProfileForInput(input), input.workspaceRoot ?? this.storagePath, sessionScope, input.sessionId);
+		const materializedAt = performance.now();
+		const receipt = application ? profileRevisionReceipts(this).secret.get(application) : void 0;
+		if (!application || !receipt) throw new Error("Secret profile preparation produced no native plan");
+		const materializedDigest = this.secretProfileRevisions.get(application)?.materializedDigest;
+		if (!materializedDigest) throw new Error("Secret profile preparation produced no revision digest");
+		const verification = `${this.secretProfileVerificationScope()}\0${materializedDigest}`;
+		const verifyCached = verifiedSecretProfileRevisions.has(verification);
+		if (!verifyCached) await this.verifyPreparedSecretProfileRevision(input, application);
+		rememberVerifiedSecretProfileRevision(verification);
+		this.logger.info("prepared secret profile revision", {
+			materializeMs: Math.round(materializedAt - startedAt),
+			verifyMs: Math.round(performance.now() - materializedAt),
+			verifyCached
+		});
+		return receipt;
+	}
+	/** What the native health check's verdict depends on besides a revision's bytes: the executable that loads them. */
+	secretProfileVerificationScope() {
+		return this.provider;
+	}
+	/** A secret receipt is issued only after the provider can load this revision. */
+	async verifyPreparedSecretProfileRevision(_input, _application) {
+		throw new Error(`${this.provider} has no native secret profile health check`);
+	}
+	/** Resolve the canonical profile used for this execution. */
+	resolveExecutionProfile(requestPrompt) {
+		return profileForExecution(this.config.profile, requestPrompt);
+	}
+	/** Select the profile materialized for this exact turn. */
+	resolveExecutionProfileForInput(input) {
+		return this.resolveExecutionProfile(input.systemPrompt);
+	}
+	/** Compose the provider's user-message channel for this exact turn. */
+	composePromptText(promptText, input) {
+		return withEphemeralContext(promptText, input);
+	}
+	withProfilePlan(config, profilePlan) {
+		if (!profilePlan || profilePlan.spawn.flags.length === 0) return config;
+		const contract = this.sessionContract();
+		if (contract) assertFlagsHonourSessionContract(this.provider, contract, profilePlan.spawn.flags, "profile flags");
+		return {
+			...config,
+			extraFlags: [...config.extraFlags ?? [], ...profilePlan.spawn.flags]
+		};
+	}
+	/** A profile's addition precedes host context while preserving its harness prompt. */
+	resolveProfilePrompts(input, plan, profile = this.resolveExecutionProfileForInput(input)) {
+		const addition = plan?.spawn.appendSystemPrompt;
+		const keep = keepsHarnessSystemPrompt(profile, this.profileHarness);
+		return {
+			systemPrompt: keep ? void 0 : this.resolveProfileSystemPrompt(input.systemPrompt, plan),
+			appendSystemPrompt: keep ? joinSystemPromptAdditions(addition, input.systemPrompt, input.appendSystemPrompt) : input.appendSystemPrompt ? joinSystemPromptAdditions(addition, input.appendSystemPrompt) : addition
+		};
+	}
+	resolveProfileSystemPrompt(requestPrompt, profilePlan) {
+		return resolveSystemPrompt(requestPrompt, profilePlan?.spawn.systemPrompt);
+	}
+	resolveProfileModel(requestModel) {
+		return resolveModel(requestModel, this.config.profile?.model?.default, this.config.model, this.config.profile?.model?.provider);
+	}
+	mergeProfilePlanEnvironment(environment, profilePlan, preserveClearedVariables = false) {
+		if (!profilePlan || Object.keys(profilePlan.spawn.env).length === 0) return environment;
+		const merged = { ...environment };
+		for (const [name, value] of Object.entries(profilePlan.spawn.env)) {
+			const existing = merged[name];
+			if (existing !== void 0 && existing !== value || preserveClearedVariables && existing === void 0 && Object.hasOwn(environment, name) && !this.profilePlanMayFillClearedEnvironmentVariable(name, value)) throw new Error(`profile environment conflicts with provider environment: ${name}`);
+			merged[name] = value;
+		}
+		return merged;
+	}
+	/** Provider-owned allowlist for a generated revision control after env scrub. */
+	profilePlanMayFillClearedEnvironmentVariable(_name, _value) {
+		return false;
+	}
+	async preparePromptInput(parts, workspaceRoot, sessionId, options) {
+		return preparePromptInputParts(parts, workspaceRoot, sessionId, {
+			...options,
+			nativeAttachmentKinds: options?.nativeAttachmentKinds ?? this.nativeAttachmentKinds()
+		});
+	}
+	/** Attachment kinds this adapter forwards natively via buildExecArgs (argv flag / stdin content block) instead of the `[Image: ...]` / `[File: ...]` text marker. */
+	nativeAttachmentKinds() {
+		return [];
+	}
+};
+//#endregion
+//#region src/native-session-enforcement.ts
+/** Every shipped harness is enforced. A missing receipt is a failed proof, not a skip. */
+function sessionContractFullyEnforced(_provider) {
+	return true;
+}
+//#endregion
+//#region src/adapter-sessions.ts
+/** Providers without a repair tool share one empty set. */
+const NO_REPAIR_TOOL_NAMES$1 = /* @__PURE__ */ new Set();
+/** Owns durable transcripts, provider-native session bindings and the turn hooks providers override. */
+var CliAdapterSessions = class extends CliAdapterProfile {
+	async createSession(options) {
+		this.ensureInitialized();
+		const session = await this.getSessionStore().create({ workspaceRoot: options?.workspaceRoot ?? this.storagePath });
+		this.logger.debug("Created session", { sessionId: session.id });
+		return session.id;
+	}
+	async deleteSession(sessionId) {
+		this.ensureInitialized();
+		await this.getMessageStore().clear(sessionId);
+		const deleted = await this.getSessionStore().delete(sessionId);
+		this.logger.debug("Deleted session", {
+			sessionId,
+			deleted
+		});
+		return deleted;
+	}
+	/**
+	* Choose the native ID before its argv check, durable binding, and
+	* reservation. `input` and `timeoutMs` are the turn's, for a harness that
+	* decides here whether a process started earlier can serve it.
+	*/
+	mintNativeSessionId(_context) {
+		return randomUUID();
+	}
+	/**
+	* Make a pre-minted native session durable before the CLI starts, for a
+	* harness that would otherwise write nothing until its first model reply
+	* (Pi). Called after the argv check and before spawn.
+	*/
+	reserveNativeSession(_nativeSessionId, _context) {}
+	/**
+	* Verify that the provider can resume the native session binding. By
+	* default a session in a per-session store is resumable only when one of
+	* its declared files exists under the runtime HOME; a pre-minted id whose
+	* first turn died before the CLI wrote anything is not.
+	*/
+	providerSessionIsResumable(runtimeHome, providerSessionId) {
+		const contract = this.sessionContract();
+		if (!contract) return true;
+		if (!sessionContractFullyEnforced(this.provider) && contract.identity.kind !== "pre-minted") return true;
+		return declaredSessionExists(contract, runtimeHome, providerSessionId);
+	}
+	/**
+	* Resolve the provider-native session id the next turn can resume, or
+	* undefined when no usable binding exists. Provider session data lives
+	* under the runtime home that minted it. A different home or missing
+	* provider storage cannot resume that session. A record without a home
+	* stamp predates the field, so treat it as same-home.
+	*/
+	async resumableProviderSessionId(session) {
+		if (!session.providerSessionId) return void 0;
+		const currentHome = this.config.runtimeHome?.trim() || void 0;
+		const mintedHome = session.providerSessionHome?.trim() || void 0;
+		if (currentHome !== void 0 && mintedHome !== void 0 && mintedHome !== currentHome) return;
+		if (currentHome !== void 0) {
+			if (!await this.providerSessionIsResumable(currentHome, session.providerSessionId)) return;
+		}
+		return session.providerSessionId;
+	}
+	/** Bind a checkpoint-proven native session to this provider identity before execution. */
+	async seedNativeSessionForResume(input, nativeSessionId) {
+		if (!input.sessionId) throw new Error("Native resume requires a named session");
+		const runtimeHome = this.config.runtimeHome?.trim();
+		if (!runtimeHome || !await this.providerSessionIsResumable(runtimeHome, nativeSessionId)) throw new Error("Native resume session is absent from this provider home");
+		const store = this.getSessionStore();
+		const existing = await store.get(input.sessionId);
+		if (!existing) await store.create({
+			id: input.sessionId,
+			workspaceRoot: input.workspaceRoot ?? this.storagePath,
+			providerSessionId: nativeSessionId,
+			providerSessionHome: runtimeHome
+		});
+		else if (existing.providerSessionId !== nativeSessionId || existing.providerSessionHome !== runtimeHome) await store.update(input.sessionId, {
+			providerSessionId: nativeSessionId,
+			providerSessionHome: runtimeHome
+		});
+	}
+	/**
+	* Forks the persisted session and copies its messages up to `messageId`.
+	* The forked record carries no provider session id, so its first turn
+	* starts a fresh CLI session and receives the copied transcript as
+	* execution-only context. Callers that address turns by their own session
+	* id (the sidecar) pass that id as `targetSessionId` so later turns find
+	* the forked record.
+	*/
+	async forkSession(options) {
+		this.ensureInitialized();
+		const result = await forkSessionWithMessages(this.getSessionStore(), this.getMessageStore(), options.sessionId, {
+			id: options.targetSessionId,
+			messageId: options.messageId,
+			workspaceRoot: options.workspaceRoot
+		});
+		this.logger.debug("Forked session", {
+			parentId: options.sessionId,
+			newId: result.session.id,
+			messagesCopied: result.messagesCopied
+		});
+		return result.session.id;
+	}
+	async getMessages(options) {
+		this.ensureInitialized();
+		return (await this.getMessageStore().list(options.sessionId, {
+			limit: options.limit,
+			offset: options.offset
+		})).map((msg) => this.toBackendMessage(msg));
+	}
+	toBackendMessage(msg) {
+		return {
+			id: msg.id,
+			role: msg.role,
+			parts: msg.parts,
+			timestamp: msg.timestamp.toISOString(),
+			metadata: msg.metadata
+		};
+	}
+	buildAssistantParts(state) {
+		const parts = [];
+		for (const reasoning of state.reasoningBuffer) parts.push({
+			type: "reasoning",
+			text: reasoning
+		});
+		if (state.textBuffer) parts.push({
+			type: "text",
+			text: state.textBuffer
+		});
+		for (const toolCall of state.toolCalls.values()) {
+			const inputRecord = toolCall.input ?? {};
+			let toolState;
+			if (toolCall.status === "completed") toolState = {
+				status: "completed",
+				input: inputRecord,
+				output: toolCall.output
+			};
+			else if (toolCall.status === "failed") toolState = {
+				status: "failed",
+				input: inputRecord,
+				error: toolCall.output ? String(toolCall.output) : void 0
+			};
+			else if (toolCall.status === "running") toolState = {
+				status: "running",
+				input: inputRecord
+			};
+			else toolState = {
+				status: "pending",
+				input: inputRecord
+			};
+			parts.push({
+				type: "tool",
+				tool: toolCall.name,
+				callID: toolCall.id,
+				state: toolState
+			});
+		}
+		for (const file of state.fileParts ?? []) parts.push({
+			type: "file",
+			id: file.id,
+			filename: file.filename,
+			mediaType: file.mediaType,
+			url: file.url
+		});
+		return parts;
+	}
+	extractToolInvocations(state) {
+		const invocations = [];
+		for (const toolCall of state.toolCalls.values()) invocations.push({
+			toolName: toolCall.name,
+			input: toolCall.input,
+			result: toolCall.output,
+			...toolCall.status === "failed" ? { isError: true } : {}
+		});
+		return invocations;
+	}
+	/**
+	* Names of tools this provider substitutes for a model tool call it could
+	* not parse into any real tool.
+	*
+	* Default: none. A provider that has one must say so, because these calls
+	* do not present as failures. OpenCode's `invalid` reports the parse error
+	* as its output and completes, so the repeated-failure guard reads a run of
+	* them as progress and clears its count on every one.
+	*/
+	toolCallRepairToolNames() {
+		return NO_REPAIR_TOOL_NAMES$1;
+	}
+	/**
+	* Decide whether a non-zero exit should be treated as success.
+	*
+	* Default: no — any non-zero exit is a failure.
+	*
+	* Providers override this when their CLI has a known "exits non-zero
+	* on a successful run" quirk (e.g. kimi writes its resume trailer to
+	* stderr and exits non-zero even when the task completed cleanly).
+	*
+	* The decision is made AFTER the stream has drained and the exit
+	* code is known, so `state` reflects the full set of events the
+	* parser emitted (including any terminal `result` / `done` event).
+	* A safe heuristic is: "non-zero exit + stderr matches known trailer
+	* pattern + at least one assistant part was recorded".
+	*/
+	isBenignNonZeroExit(_params) {
+		return false;
+	}
+	/** Observe settled process output before success/failure classification. */
+	async afterCliProcessExit(_params) {}
+	executionOutcome(_state, _input) {
+		return { type: "completed" };
+	}
+	/**
+	* Format a message for stdin input.
+	*/
+	formatStdinMessage(message) {
+		return message;
+	}
+};
+/**
+* Whether any file below `root` (relative path) matches one of `matchers`.
+* Bounded: native stores nest a few levels and hold one file per session.
+*/
+async function anyFileMatches(root, matchers) {
+	const pending = [""];
+	let visited = 0;
+	while (pending.length > 0 && visited < 2e4) {
+		const relative = pending.pop();
+		if (relative === void 0) break;
+		let entries;
+		try {
+			entries = await readdir(path.join(root, relative), { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			visited++;
+			const child = relative ? `${relative}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) pending.push(child);
+			else if (entry.isFile() && matchers.some((matcher) => matcher.test(child))) return true;
+		}
+	}
+	return false;
+}
+/** Whether a per-session store holds a declared file for this id. */
+async function declaredSessionExists(contract, runtimeHome, nativeSessionId) {
+	for (const store of contract.stores) {
+		if (store.shared) return true;
+		const matchers = store.files.map((glob) => compileSessionStoreGlob(glob, nativeSessionId));
+		if (await anyFileMatches(path.join(runtimeHome, store.root), matchers)) return true;
+	}
+	return false;
+}
+//#endregion
+//#region src/cli-exit-diagnostics.ts
+/** Characters of stderr a failure message carries, taken from the tail. */
+const FAILURE_STDERR_TAIL_LIMIT = 600;
+/**
+* Attach the process-level diagnostics this run already collected to a failure
+* message.
+*
+* A provider that reports its OWN terminal failure — an empty event stream, an
+* unfinished model step — explains what it saw but not how the process ended:
+* a CLI that exited 0 having emitted nothing is misconfigured, one killed on the
+* timeout is stuck, one that exited 9 with stderr crashed. Each part is skipped
+* when the message already states it, so a message derived FROM stderr or the
+* exit code is never doubled.
+*/
+function withCliExitDiagnostics(message, exit, stderr) {
+	const parts = [];
+	if (exit.stdinError && !message.includes(exit.stdinError)) parts.push(`stdin failed: ${exit.stdinError}`);
+	const timeout = exit.timedOut ? exit.timeoutDiagnostic ?? "timed out" : "";
+	if (timeout && !message.toLowerCase().includes(timeout.toLowerCase())) parts.push(timeout);
+	if (exit.code !== null) {
+		if (!message.includes(`code ${exit.code}`)) parts.push(`exit code ${exit.code}`);
+	} else if (exit.signal) parts.push(`killed by ${exit.signal}`);
+	const trimmedStderr = stderr.trim();
+	if (trimmedStderr && !message.includes(trimmedStderr)) {
+		const tail = trimmedStderr.slice(-FAILURE_STDERR_TAIL_LIMIT);
+		parts.push(`stderr: ${tail === trimmedStderr ? "" : "…"}${tail}`);
+	}
+	return parts.length === 0 ? message : `${message} (${parts.join("; ")})`;
+}
+//#endregion
+//#region src/mcp-commands.ts
+/** Execute one prepared MCP registration command. Serialization belongs to the adapter. */
+async function addCliMcp(options) {
+	const { name, config, run, logger } = options;
+	logger.debug("Adding MCP server", {
+		name,
+		type: config.type
+	});
+	const result = await run();
+	if (!result.exit.success) throw new Error(`Failed to add MCP server "${name}": ${result.stderr || `exit code ${result.exit.code}`}`);
+	logger.info("Added MCP server", { name });
+}
+/** List native MCP servers with the provider's parser and command budget. */
+async function listCliMcps(options) {
+	const { provider, args, run, logger, parse } = options;
+	if (!args) {
+		logger.warn(`getMcpStatus: ${provider} CLI does not support listing MCP servers`);
+		return { servers: {} };
+	}
+	const result = await run(args);
+	if (!result.exit.success) throw new Error(withCliExitDiagnostics(`${provider} failed to list MCP servers`, result.exit, result.stderr));
+	return parse(result.stdout ?? "");
+}
+const MCP_STATUSES = [
+	"connected",
+	"disconnected",
+	"error",
+	"unknown"
+];
+const MCP_TYPES = [
+	"local",
+	"remote",
+	"stdio",
+	"http"
+];
+function pick(known, value, fallback) {
+	return known.includes(value) ? value : fallback;
+}
+/**
+* Read an `mcp list` report: a JSON array of `{name, status, type}`, a JSON
+* object keyed by name, or a whitespace table whose first column is the name
+* and whose next columns may hold the type and the status.
+*/
+function parseMcpListReport(output) {
+	const servers = {};
+	const add = (name, status, type) => {
+		servers[name] = {
+			name,
+			status: pick(MCP_STATUSES, status, "unknown"),
+			type: pick(MCP_TYPES, type, "stdio")
+		};
+	};
+	let data;
+	try {
+		data = JSON.parse(output);
+	} catch {
+		for (const line of output.trim().split("\n")) {
+			if (!line.trim() || line.includes("NAME") || line.startsWith("-")) continue;
+			const [name = "", type, status] = line.trim().split(/\s{2,}/);
+			add(name, status, type);
+		}
+		return { servers };
+	}
+	if (Array.isArray(data)) for (const server of data) add(server.name, server.status ?? "connected", server.type);
+	else if (typeof data === "object" && data !== null) for (const [name, info] of Object.entries(data)) add(name, info.status, void 0);
+	return { servers };
+}
+/** A local MCP server's argv: the `command` array, or `command` then `args`. */
+function localMcpArgv(config) {
+	const local = config;
+	return Array.isArray(local.command) ? local.command : [local.command, ...local.args ?? []];
+}
+/**
+* A local MCP server's environment, from `environment` (agent-backend-types)
+* or `env` (agent-interface): reading one drops the other family's variables.
+*/
+function localMcpEnv(config) {
+	return config.environment ?? config.env;
+}
+const isLocalMcpConfig = (c) => c.type === "local" || c.type === "stdio";
+/** Build MCP add command arguments. Override for CLI-specific syntax. */
+function defaultMcpAddArgs(name, config) {
+	if (isLocalMcpConfig(config)) {
+		const env = Object.entries(localMcpEnv(config) ?? {});
+		return [
+			"mcp",
+			"add",
+			name,
+			"--",
+			...localMcpArgv(config),
+			...env.flatMap(([key, value]) => ["--env", `${key}=${value}`])
+		];
+	}
+	const headers = Object.entries(config.headers ?? {});
+	return [
+		"mcp",
+		"add",
+		name,
+		config.url,
+		...headers.flatMap(([key, value]) => ["--header", `${key}: ${value}`])
+	];
+}
+//#endregion
+//#region src/adapter-mcp.ts
+/** Owns serialized MCP mutations and provider-native MCP status commands. */
+var CliAdapterMcp = class extends CliAdapterSessions {
+	/** Budget for one `mcp list` run, CLI startup and every server's handshake. */
+	mcpStatusTimeoutMs = 1e4;
+	mcpMutationChain = Promise.resolve();
+	async addMcp(name, config) {
+		const run = this.mcpMutationChain.then(() => this.addMcpSerialized(name, config));
+		this.mcpMutationChain = run.catch(() => void 0);
+		return run;
+	}
+	async addMcpSerialized(name, config) {
+		this.ensureInitialized();
+		const args = this.buildMcpAddArgs(name, config);
+		return addCliMcp({
+			name,
+			config,
+			logger: this.logger,
+			run: () => this.runAuxiliaryCli(args, 3e4)
+		});
+	}
+	async getMcpStatus() {
+		this.ensureInitialized();
+		return listCliMcps({
+			provider: this.provider,
+			args: this.buildMcpListArgs(),
+			logger: this.logger,
+			run: (args) => this.runAuxiliaryCli(args, this.mcpStatusTimeoutMs),
+			parse: (output) => this.parseMcpListOutput(output)
+		});
+	}
+	async ensureMcps(required) {
+		const currentStatus = await this.getMcpStatus();
+		const existingServers = new Set(Object.keys(currentStatus.servers));
+		for (const [name, config] of Object.entries(required)) {
+			if (existingServers.has(name)) {
+				this.logger.debug("MCP server already exists, skipping", { name });
+				continue;
+			}
+			await this.addMcp(name, config);
+		}
+	}
+	/** Build MCP add command arguments. Override for CLI-specific syntax. */
+	buildMcpAddArgs(name, config) {
+		return defaultMcpAddArgs(name, config);
+	}
+	/**
+	* Build MCP list command arguments. Return null if not supported.
+	*/
+	buildMcpListArgs() {
+		return null;
+	}
+	/** Parse MCP list output. Override for CLI-specific output format. */
+	parseMcpListOutput(output) {
+		return parseMcpListReport(output);
+	}
+};
+//#endregion
+//#region src/execution-state.ts
+/** A file of the sandbox's cgroup (#7571); undefined off Linux or outside one. */
+function readCgroupFile(name) {
+	try {
+		return readFileSync(`/sys/fs/cgroup/${name}`, "utf8").trim();
+	} catch {
+		return;
+	}
+}
+/** The sandbox's OOM-kill count: a running total for the whole box. */
+function oomKills() {
+	const events = readCgroupFile("memory.events") ?? "";
+	return Number(/^oom_kill (\d+)$/m.exec(events)?.[1] ?? 0);
+}
+/** Creates a new execution state. */
+function createExecutionState(sessionId, messageId, workspaceRoot) {
+	return {
+		sessionId,
+		messageId: messageId ?? randomUUID(),
+		workspaceRoot,
+		toolCalls: /* @__PURE__ */ new Map(),
+		textBuffer: "",
+		reasoningBuffer: [],
+		oomKillsAtStart: oomKills()
+	};
+}
+//#endregion
+//#region src/session-preparation.ts
+async function prepareExecutionSession(context, input) {
+	let sessionId = input.sessionId;
+	let providerSessionId;
+	let transcriptReplay;
+	if (sessionId) {
+		const session = await context.getSessionStore().get(sessionId);
+		if (session) {
+			providerSessionId = await context.resumableProviderSessionId(session);
+			if (session.parentId !== void 0 && session.providerSessionId === void 0) transcriptReplay = "fork";
+			else if (context.config.secretProfileRevisionRoot && session.providerSessionId === void 0 && (await context.getMessageStore().list(sessionId)).length > 0) transcriptReplay = "restored";
+			else if (session.providerSessionId && providerSessionId === void 0) {
+				context.logger.info("Provider session data is not resumable; replaying durable history into a fresh provider session", {
+					sessionId,
+					providerSessionId: session.providerSessionId
+				});
+				transcriptReplay = "restored";
+			}
+			await context.getSessionStore().update(sessionId, {});
+		} else {
+			if (context.config.secretProfileRevisionRoot) try {
+				transcriptReplay = (await context.getMessageStore().list(sessionId, {
+					requireComplete: true,
+					allowAbsent: true
+				})).length > 0 ? "restored" : void 0;
+			} catch (error) {
+				throw new SessionRehydrationError(`Session ${sessionId} has incomplete persisted history`, error);
+			}
+			else transcriptReplay = "restored";
+			await context.getSessionStore().create({
+				id: sessionId,
+				workspaceRoot: input.workspaceRoot ?? context.storagePath
+			});
+		}
+	} else sessionId = await context.createSession({ workspaceRoot: input.workspaceRoot ?? context.storagePath });
+	return {
+		sessionId,
+		providerSessionId,
+		transcriptReplay
+	};
+}
+//#endregion
+//#region src/turn-execution.ts
+/**
+* Turn idempotency: if the caller supplied a turnId and a previously-
+* completed turn with that id exists, return its cached result without
+* re-issuing the upstream LLM call. Both `findCompletedTurn` and
+* `setTurnId` are optional on the recorder interface so providers using
+* a no-op recorder (sdk-backend) still typecheck.
+*/
+async function findCachedTurn(recorder, input, logger, sessionId) {
+	if (!(input.turnId && recorder.findCompletedTurn)) return void 0;
+	const cached = await recorder.findCompletedTurn(input.turnId);
+	if (!cached) return void 0;
+	logger.info("Returning cached turn result (idempotent retry)", {
+		turnId: input.turnId,
+		sessionId
+	});
+	return {
+		...cached,
+		outcome: AgentExecutionOutcomeSchema.parse(cached.outcome)
+	};
+}
+/**
+* The persisted transcript, read before this turn's user message is appended
+* so the block never contains the current message. Execution-only: it reaches
+* the model prompt and stays out of both stores.
+*/
+async function buildTranscriptContext(params) {
+	const { provider, sessionId, transcriptReplay, secretProfileRevisionRoot } = params;
+	if (!transcriptReplay) return void 0;
+	try {
+		return (secretProfileRevisionRoot ? buildCompleteForkContextBlock : buildForkContextBlock)(await params.getMessageStore().list(sessionId, { requireComplete: Boolean(secretProfileRevisionRoot) }), transcriptReplay === "restored" ? {
+			preamble: RESTORED_SESSION_CONTEXT_PREAMBLE,
+			tag: RESTORED_SESSION_CONTEXT_TAG,
+			...secretProfileRevisionRoot ? { maxChars: MAX_SECRET_PROFILE_REPLAY_CHARS } : {}
+		} : secretProfileRevisionRoot ? { maxChars: MAX_SECRET_PROFILE_REPLAY_CHARS } : void 0);
+	} catch (error) {
+		throw new SessionRehydrationError(`Session ${sessionId} has persisted history that could not be read for replay into a fresh ${provider} session: ${error instanceof Error ? error.message : String(error)}`, error);
+	}
+}
+/**
+* A harness that can only report its id in an event must do so promptly; a
+* turn whose native session cannot be named is not traceable. Returns the
+* deadline timer, or undefined when the contract sets none.
+*/
+function armNativeSessionDeadline(params) {
+	const { provider, sessionId, sessionContract, state, observer, logger } = params;
+	const identity = sessionContract?.identity;
+	if (identity?.kind !== "first-event" || !sessionContractFullyEnforced(provider)) return;
+	const deadline = setTimeout(() => {
+		if (observer.nativeSessionObserved || state.terminalStatus !== void 0) return;
+		const detail = new HarnessSessionContractError("native_session_id_unobserved", `${provider} reported no native session id within ${identity.deadlineMs} ms`).message;
+		state.terminalStatus = "failed";
+		state.lastDiagnostic = detail;
+		logger.error("Native session id unobserved; stopping turn", { sessionId });
+		params.kill();
+	}, identity.deadlineMs);
+	deadline.unref();
+	return deadline;
+}
+function idIn(glob, rel) {
+	const g = glob.split("/");
+	const r = rel.split("/");
+	let gi = 0;
+	let ri = 0;
+	let id = null;
+	while (gi < g.length && ri < r.length) {
+		const part = g[gi];
+		if (part === "**") {
+			const rest = g.slice(gi + 1).join("/");
+			if (!rest) return id;
+			for (let k = ri; k < r.length; k++) {
+				const found = idIn(rest, r.slice(k).join("/"));
+				if (found) return found;
+			}
+			return null;
+		}
+		if (part?.includes("{id}")) {
+			const [pre, post] = part.split("{id}");
+			const name = r[ri] ?? "";
+			if (!name.startsWith(pre ?? "") || !name.endsWith(post ?? "")) return null;
+			id = name.slice((pre ?? "").length, name.length - (post ?? "").length);
+		} else if (part !== "*" && part !== r[ri]) return null;
+		gi += 1;
+		ri += 1;
+	}
+	return gi === g.length && ri === r.length ? id : null;
+}
+function filesUnder(dir, prefix, out) {
+	let entries;
+	try {
+		entries = readdirSync(dir, { withFileTypes: true });
+	} catch {
+		return;
+	}
+	for (const entry of entries) {
+		const name = String(entry.name);
+		const rel = prefix ? `${prefix}/${name}` : name;
+		if (entry.isDirectory()) filesUnder(join(dir, name), rel, out);
+		else out.push(rel);
+	}
+}
+function idsNow(home, stores) {
+	const ids = /* @__PURE__ */ new Set();
+	for (const store of stores) {
+		const root = join(home, store.root);
+		if (store.shared && store.write === "sqlite-wal") {
+			try {
+				const db = new DatabaseSync(join(root, store.files[0] ?? "state.db"), { readOnly: true });
+				try {
+					let rows;
+					try {
+						rows = db.prepare("SELECT id FROM sessions").all();
+					} catch {
+						rows = db.prepare("SELECT session_id AS id FROM session_windows").all();
+					}
+					for (const row of rows) if (row.id) ids.add(row.id);
+				} finally {
+					db.close();
+				}
+			} catch {}
+			continue;
+		}
+		const found = [];
+		filesUnder(root, "", found);
+		for (const rel of found) for (const glob of store.files) {
+			const id = idIn(glob, rel);
+			if (id) ids.add(id);
+		}
+	}
+	return ids;
+}
+function watchNewSessionIds(params) {
+	const home = params.runtimeHome?.trim().replace(/\/+$/u, "");
+	const contract = params.sessionContract;
+	if (!home || contract?.identity.kind !== "first-event") return () => {};
+	const seen = idsNow(home, contract.stores);
+	const timer = setInterval(() => {
+		if (params.observer.nativeSessionObserved) return;
+		for (const id of idsNow(home, contract.stores)) {
+			if (seen.has(id)) continue;
+			seen.add(id);
+			params.observer.onEvent({
+				type: "native.session.observed",
+				provider: params.provider,
+				nativeSessionId: id
+			});
+		}
+	}, 200);
+	timer.unref();
+	return () => clearInterval(timer);
+}
+function collectStderr(cliProcess) {
+	let text = "";
+	const stderrDecoder = new StringDecoder("utf8");
+	cliProcess.stderr?.on("data", (chunk) => {
+		text += stderrDecoder.write(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+	});
+	cliProcess.stderr?.on("end", () => {
+		text += stderrDecoder.end();
+	});
+	return { get text() {
+		return text;
+	} };
+}
+/** A turn's stderr or ACP error when its link to its harness's server dropped (#8819). */
+const HARNESS_LINK_LOST = /\b(?:ECONNRESET|ECONNREFUSED|EPIPE|UND_ERR_SOCKET)\b|ended before (?:it|the turn) completed|Gateway disconnected/u;
+/**
+* Names a SIGKILL from the memory limit (#7571): the CLI runs in the sandbox's
+* cgroup, whose `memory.events` counts OOM kills under the `memory.max` limit.
+* The count is the box's running total, so only a kill since the turn started
+* is this turn's.
+*/
+function memoryLimitKill(killsAtStart = 0) {
+	const kills = oomKills() - killsAtStart;
+	if (kills < 1) return void 0;
+	const max = readCgroupFile("memory.max") ?? "max";
+	return `The sandbox's ${max === "max" ? "host" : `${Number(max) / 2 ** 20} MiB`} memory limit OOM-killed ${kills} process(es) during this turn: give the sandbox more memory or make the tool use less`;
+}
+/**
+* A failed CLI turn's end and error (#16404): a guard's end is its own, the
+* rest is `turnEndReason`'s; a session death and a memory-limit kill carry
+* their wire code.
+*/
+function endFailedTurn(params) {
+	const { provider, state, exitResult, stderr, startTime, endTime } = params;
+	const oom = exitResult.signal === "SIGKILL" && memoryLimitKill(state.oomKillsAtStart);
+	state.endReason ??= turnEndReason({
+		aborted: params.aborted,
+		timedOut: exitResult.timedOut,
+		harnessFailed: Boolean(state.terminalStatus),
+		linkLost: HARNESS_LINK_LOST.test(stderr),
+		memoryKilled: Boolean(oom),
+		signal: exitResult.signal
+	});
+	if (oom && state.endReason === "memory_limit") state.failure ??= {
+		code: "MEMORY_LIMIT_KILLED",
+		message: oom
+	};
+	if (["gateway_disconnect", "harness_exit"].includes(state.endReason)) state.failure ??= {
+		code: "SESSION_DIED",
+		message: `Harness session died (${state.endReason}): start a new session, or send the next turn to this session to resume it`
+	};
+	const nix = params.nixBinPath ? ` (NIX_BIN_PATH=${params.nixBinPath})` : " (NIX_BIN_PATH unset — is the Nix profile mounted?)";
+	const errorMessage = exitResult.spawnError ? `Failed to spawn "${params.command}": ${exitResult.spawnError}${exitResult.spawnError.includes("ENOENT") ? ` — binary not found in PATH${nix}` : ""}` : withCliExitDiagnostics(state.failure?.message ?? state.lastDiagnostic ?? (exitResult.timedOut ? exitResult.timeoutDiagnostic ?? "Execution timed out" : void 0) ?? (stderr.trim() || (state.terminalStatus === "failed" ? `${provider} reported a failed terminal status` : `Process exited with code ${exitResult.code}`)), exitResult, stderr);
+	const failure = new AgentExecutionError(`${provider} execution failed: ${errorMessage}`, {
+		...state.tokenUsage ? { tokenUsage: state.tokenUsage } : {},
+		timing: {
+			startedAt: startTime,
+			completedAt: endTime,
+			durationMs: endTime - startTime
+		}
+	});
+	Object.assign(failure, {
+		reason: state.endReason,
+		...state.failure?.code ? { code: state.failure.code } : {},
+		...state.failure?.statusCode === void 0 ? {} : {
+			statusCode: state.failure.statusCode,
+			status: state.failure.statusCode
+		},
+		...state.failure?.resetAt ? { resetAt: state.failure.resetAt } : {}
+	});
+	return {
+		errorMessage,
+		failure
+	};
+}
+/**
+* Best-effort: stamp the assistant message interrupted so reattach can
+* surface "this turn died" without inferring from absence. Swallow any
+* metadata-write error — the upstream failure is the one the caller
+* needs to see. The coalesced part updates drain first so no stale
+* snapshot lands after the terminal stamp.
+*/
+async function recordTurnInterruption(params) {
+	const { recorder, observer, logger, errorMessage, exitResult } = params;
+	await observer.flushPartUpdates();
+	if (recorder.markTurnInterrupted) try {
+		await recorder.markTurnInterrupted({
+			reason: errorMessage,
+			exitCode: exitResult.code,
+			timedOut: exitResult.timedOut,
+			failureReceipt: params.failure.receipt
+		});
+	} catch (markError) {
+		logger.warn("markTurnInterrupted failed (suppressed to preserve original error)", { error: markError instanceof Error ? markError.message : String(markError) });
+	}
+}
+/** The result of a turn that completed. */
+function buildExecutionResult(params) {
+	const { state, publicProfileRevision, startTime, endTime } = params;
+	return {
+		outcome: params.outcome,
+		text: state.textBuffer,
+		toolInvocations: params.toolInvocations,
+		reasoning: state.reasoningBuffer.length > 0 ? state.reasoningBuffer : void 0,
+		sessionId: params.sessionId,
+		...publicProfileRevision ? { metadata: { publicProfileRevision } } : {},
+		tokenUsage: state.tokenUsage ? {
+			inputTokens: state.tokenUsage.inputTokens ?? 0,
+			outputTokens: state.tokenUsage.outputTokens ?? 0,
+			totalTokens: state.tokenUsage.totalTokens,
+			reasoningTokens: state.tokenUsage.reasoningTokens,
+			cacheReadInputTokens: state.tokenUsage.cacheReadInputTokens,
+			cacheCreationInputTokens: state.tokenUsage.cacheCreationInputTokens,
+			cost: state.tokenUsage.cost
+		} : void 0,
+		timing: {
+			startedAt: startTime,
+			completedAt: endTime,
+			durationMs: endTime - startTime
+		}
+	};
+}
+function failOnProviderSessionPersistence(observer, state) {
+	if (!observer.providerSessionPersistenceError) return;
+	const message = observer.providerSessionPersistenceError instanceof Error ? observer.providerSessionPersistenceError.message : String(observer.providerSessionPersistenceError);
+	state.terminalStatus = "failed";
+	state.lastDiagnostic = `Provider session persistence failed: ${message}`;
+}
+function logAcceptedCliExit(logger, exitResult, stderr) {
+	if (!exitResult.success) logger.info("CLI process exited non-zero but was treated as success by provider", {
+		exitCode: exitResult.code,
+		stderr: stderr.slice(0, 500)
+	});
+	if (stderr.trim()) logger.debug("CLI process stderr (success)", { stderr: stderr.slice(0, 1e3) });
+}
+//#endregion
+//#region src/part-update-queue.ts
+const MAX_PENDING_PART_UPDATES = 256;
+/**
+* Per-chunk persistence backpressure. Accumulated-text providers re-emit
+* the whole part on every token, and each update joins the recorder's
+* serialized write chain — if disk latency exceeds the token rate, the
+* chain grows for the turn's lifetime. Coalescing keeps only the newest
+* pending snapshot per partId (a stale one is a strict prefix of it), so
+* the queue stays O(distinct parts); a single drain loop preserves write
+* order. The terminal paths flush the drain before their final writes so
+* no stale snapshot can land after the consolidated parts.
+*/
+var PartUpdateQueue = class {
+	pending = /* @__PURE__ */ new Map();
+	drain = null;
+	constructor(recorder, logger) {
+		this.recorder = recorder;
+		this.logger = logger;
+	}
+	schedule(part, delta) {
+		const partId = part.id;
+		if (!partId) {
+			this.recorder.recordAssistantPartUpdate?.(part, delta)?.catch((cause) => {
+				this.logger.warn("Per-chunk persistence failed (continuing stream)", { error: cause instanceof Error ? cause.message : String(cause) });
+			});
+			return;
+		}
+		this.pending.set(partId, {
+			part,
+			delta
+		});
+		if (this.pending.size > MAX_PENDING_PART_UPDATES) {
+			const oldestPending = this.pending.keys().next();
+			if (!oldestPending.done) this.pending.delete(oldestPending.value);
+			this.logger.warn("Part-update persist backlog overflow, dropped oldest pending snapshot", { pendingLimit: MAX_PENDING_PART_UPDATES });
+		}
+		if (!this.drain) this.drain = this.drainPending().finally(() => {
+			this.drain = null;
+		});
+	}
+	async flush() {
+		while (this.drain) await this.drain;
+	}
+	async drainPending() {
+		for (;;) {
+			const oldest = this.pending.keys().next();
+			if (oldest.done) break;
+			const update = this.pending.get(oldest.value);
+			this.pending.delete(oldest.value);
+			if (!update) continue;
+			try {
+				await this.recorder.recordAssistantPartUpdate?.(update.part, update.delta);
+			} catch (err) {
+				this.logger.warn("Per-chunk persistence failed (continuing stream)", { error: err instanceof Error ? err.message : String(err) });
+			}
+		}
+	}
+};
+//#endregion
+//#region src/repeated-tool-failure.ts
+const NO_REPAIR_TOOL_NAMES = /* @__PURE__ */ new Set();
+/** A part in one of these states has not resolved, so it decides nothing. */
+function isUnresolved(state) {
+	return state.status === "pending" || state.status === "running";
+}
+function readString(input, key) {
+	const value = input[key];
+	return typeof value === "string" && value.trim() !== "" ? value : void 0;
+}
+/** The tool's own error text, for the states that carry one. */
+function readStateError(state) {
+	if (state.status !== "error" && state.status !== "failed") return void 0;
+	return state.error?.trim() ? state.error : void 0;
+}
+/**
+* Describe a resolved tool part as a failure, or return `undefined` when it
+* produced something.
+*
+* A repair tool reports the call it stood in for through its input, so the
+* trip names `write` rather than the substitute. That is the tool the reader
+* has to go and look at.
+*/
+function describeFailure(part, repairToolNames) {
+	const { state } = part;
+	if (isUnresolved(state)) return void 0;
+	if (repairToolNames.has(part.tool)) return {
+		tool: readString(state.input, "tool") ?? part.tool,
+		detail: readString(state.input, "error") ?? readStateError(state) ?? `${part.tool} reported a tool call it could not parse`
+	};
+	if (state.status !== "error" && state.status !== "failed") return void 0;
+	return {
+		tool: part.tool,
+		detail: readStateError(state) ?? `${part.tool} failed without reporting a reason`
+	};
+}
+function createRepeatedToolFailureGuard(options) {
+	const { limit } = options;
+	const repairToolNames = options.repairToolNames ?? NO_REPAIR_TOOL_NAMES;
+	let signature;
+	let previousInput;
+	let count = 0;
+	let lastScoredPartId;
+	let tripped = false;
+	return { 
+	/**
+	* Feed one tool part. Returns the trip on the call that reaches the limit,
+	* and `undefined` every other time. A tripped guard stays tripped and
+	* reports once, so a caller can kill the turn without racing the events
+	* still in flight behind it.
+	*/
+observe(part) {
+		if (tripped) return void 0;
+		if (isUnresolved(part.state)) return void 0;
+		if (part.id === lastScoredPartId) return void 0;
+		lastScoredPartId = part.id;
+		const failure = describeFailure(part, repairToolNames);
+		if (!failure) {
+			signature = void 0;
+			previousInput = void 0;
+			count = 0;
+			return;
+		}
+		const next = JSON.stringify([failure.tool, failure.detail]);
+		count = next === signature && isDeepStrictEqual(part.state.input, previousInput) ? count + 1 : 1;
+		previousInput = structuredClone(part.state.input);
+		signature = next;
+		if (count < limit) return void 0;
+		tripped = true;
+		return {
+			...failure,
+			count
+		};
+	} };
+}
+//#endregion
+//#region src/turn-liveness.ts
+const STREAM_LIVENESS_QUIET_MS = 5e3;
+const STREAM_LIVENESS_CHECK_MS = 1e3;
+/**
+* How long the adapter vouches for an unbroken silence.
+*
+* A ping says the CLI process runs. It cannot say the model makes progress.
+* An unbounded ping stream would hide a CLI that starts and then hangs.
+*
+* No model in use here emits nothing for ten minutes. Past that the ticker
+* stops so the consumer can observe the silence. A later provider event
+* restarts the window.
+*/
+const STREAM_LIVENESS_MAX_QUIET_MS = 6e5;
+/**
+* The clocks and running-tool bookkeeping behind the stream liveness ping.
+*
+* `lastProviderEventAt` moves only on a real provider event, and it bounds
+* how long one silence can run. `lastLivenessAt` also moves on each ping, and
+* it paces the pings.
+*/
+var TurnLiveness = class {
+	lastProviderEventAt = Date.now();
+	lastLivenessAt = this.lastProviderEventAt;
+	runningToolParts = /* @__PURE__ */ new Map();
+	constructor(state, logger, onEvent) {
+		this.state = state;
+		this.logger = logger;
+		this.onEvent = onEvent;
+	}
+	/** A real provider event arrived: reset both clocks. */
+	noteProviderEvent() {
+		this.lastProviderEventAt = Date.now();
+		this.lastLivenessAt = this.lastProviderEventAt;
+	}
+	/** Track a tool part by its reported state; call after `noteProviderEvent`. */
+	noteToolPart(id, tool, status) {
+		if (status === "running") {
+			if (!this.runningToolParts.has(id)) this.runningToolParts.set(id, {
+				toolName: tool,
+				startedAt: this.lastProviderEventAt
+			});
+		} else this.runningToolParts.delete(id);
+	}
+	start(executionSignal, startTime) {
+		const livenessTicker = setInterval(() => {
+			const now = Date.now();
+			if (executionSignal.aborted || this.state.terminalStatus !== void 0 || now - this.lastLivenessAt < STREAM_LIVENESS_QUIET_MS || now - this.lastProviderEventAt > STREAM_LIVENESS_MAX_QUIET_MS) return;
+			this.lastLivenessAt = now;
+			const oldestRunningTool = this.runningToolParts.entries().next();
+			const ping = oldestRunningTool.done ? {
+				type: "model-processing",
+				phase: "thinking",
+				elapsedMs: now - startTime
+			} : {
+				type: "tool-heartbeat",
+				toolName: oldestRunningTool.value[1].toolName,
+				partId: oldestRunningTool.value[0],
+				elapsedMs: now - oldestRunningTool.value[1].startedAt
+			};
+			try {
+				this.onEvent?.(ping);
+			} catch (error) {
+				this.logger.warn("Stream liveness ping failed (continuing turn)", { error: error instanceof Error ? error.message : String(error) });
+			}
+		}, STREAM_LIVENESS_CHECK_MS);
+		livenessTicker.unref();
+		return livenessTicker;
+	}
+};
+//#endregion
+//#region src/turn-observer.ts
+/**
+* How many times a tool call may be rejected identically in a row before the
+* adapter kills the turn.
+*
+* Three separates a model that recovers from one that cannot. The first
+* attempt is the mistake. The second is the model reading the error. A third
+* identical attempt says the error does not reach it. Against a staging run
+* that made 76 attempts, this cuts the turn on the third.
+*/
+const REPEATED_TOOL_FAILURE_LIMIT = 3;
+/**
+* Observes one turn's provider stream: keeps the execution state current,
+* persists parts and the provider session id as they arrive, stops a turn
+* that repeats a rejected tool call, and pings while the stream is quiet.
+*/
+var TurnObserver = class {
+	providerSessionPersistence = Promise.resolve();
+	providerSessionPersistenceError;
+	nativeSessionObserved = false;
+	partUpdates;
+	liveness;
+	repeatedToolFailureGuard;
+	killForRepeatedToolFailure;
+	constructor(options) {
+		this.options = options;
+		const { state, logger, recorder, repairToolNames, onEvent } = options;
+		this.partUpdates = new PartUpdateQueue(recorder, logger);
+		this.liveness = new TurnLiveness(state, logger, onEvent);
+		this.repeatedToolFailureGuard = createRepeatedToolFailureGuard({
+			limit: REPEATED_TOOL_FAILURE_LIMIT,
+			repairToolNames
+		});
+	}
+	flushPartUpdates() {
+		return this.partUpdates.flush();
+	}
+	attachProcess(process) {
+		this.killForRepeatedToolFailure = () => process.kill();
+	}
+	startLiveness(executionSignal, startTime) {
+		return this.liveness.start(executionSignal, startTime);
+	}
+	onEvent = (event) => {
+		const { provider, state, recorder } = this.options;
+		this.liveness.noteProviderEvent();
+		if (event.type === "message.part.updated" && event.part.type === "tool") this.observeToolPart(event.part);
+		const providerSessionId = event.type === "native.session.observed" && event.provider === provider ? event.nativeSessionId : event.type === "session.updated" ? event.sessionId : void 0;
+		if (event.type === "native.session.observed" && event.provider === provider) this.nativeSessionObserved = true;
+		if (providerSessionId) {
+			state.sessionId = providerSessionId;
+			this.persistProviderSession(providerSessionId);
+		}
+		if (event.type === "warning") {
+			state.lastDiagnostic = event.message;
+			if (event.code === "EXECUTION_INTERRUPTED") state.failure ??= {
+				code: event.code,
+				message: event.message
+			};
+		}
+		if (event.type === "status" && (event.status === "completed" || event.status === "failed")) {
+			state.terminalStatus = event.status;
+			if (event.status === "failed" && event.detail) state.lastDiagnostic = event.detail;
+		}
+		if (event.type === "message.part.updated" && recorder.recordAssistantPartUpdate) this.partUpdates.schedule(event.part, event.delta);
+		this.options.onEvent?.(event);
+	};
+	observeToolPart(part) {
+		const { provider, state, logger, sessionId } = this.options;
+		const { id, tool, state: toolState } = part;
+		this.liveness.noteToolPart(id, tool, toolState.status);
+		const repeated = this.repeatedToolFailureGuard.observe({
+			id,
+			tool,
+			state: toolState
+		});
+		if (repeated) {
+			const detail = `${provider} sent the same ${repeated.tool} call ${repeated.count} times and every one was rejected. The turn stopped before it ran the model again: ${repeated.detail}`;
+			state.endReason = "repeated_tool_failure";
+			state.terminalStatus = "failed";
+			state.lastDiagnostic = detail;
+			logger.error("Repeated tool-call rejection stopped the turn", {
+				tool: repeated.tool,
+				attempts: repeated.count,
+				reason: repeated.detail,
+				sessionId
+			});
+			this.killForRepeatedToolFailure?.();
+		}
+	}
+	persistProviderSession(providerSessionId) {
+		const { getRuntimeHome, getSessionStore, sessionId } = this.options;
+		this.providerSessionPersistence = this.providerSessionPersistence.then(async () => {
+			const runtimeHome = getRuntimeHome();
+			if (!await getSessionStore().update(sessionId, {
+				providerSessionId,
+				...runtimeHome?.trim() ? { providerSessionHome: runtimeHome.trim() } : {}
+			})) throw new Error(`Session ${sessionId} disappeared before its provider session could be persisted`);
+		}).catch((error) => {
+			this.providerSessionPersistenceError ??= error;
+		});
+	}
+};
+//#endregion
+//#region src/turn-process.ts
+/** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
+function cliSpawnConfig(params) {
+	const { execArgs, launcher, subprocessUser } = params;
+	const stdio = !execArgs.useStdin ? { stdio: [
+		"ignore",
+		"pipe",
+		"pipe"
+	] } : {};
+	return {
+		command: execArgs.command,
+		args: execArgs.args,
+		cwd: execArgs.cwd ?? params.workspaceRoot,
+		env: params.env,
+		inheritEnv: params.inheritEnv,
+		...params.ownProcessGroup ? { ownProcessGroup: true } : {},
+		...launcher ? {
+			launcher,
+			spawnOptions: stdio
+		} : {
+			...subprocessUser ? { isolatedIdentity: subprocessUser } : {},
+			spawnOptions: {
+				...params.subprocessSpawnOptions,
+				...stdio
+			}
+		}
+	};
+}
+/** A started CLI as the turn drives it, timing its spawn and first output. */
+function cliTurnProcess(child, logger, spawnStarted) {
+	if (logger.observePhase) {
+		child.process.once("spawn", () => {
+			logger.observePhase?.("cli_spawn", performance.now() - spawnStarted);
+		});
+		child.process.stdout?.once("data", () => {
+			logger.observePhase?.("cli_boot", performance.now() - spawnStarted);
+		});
+	}
+	return {
+		pid: child.pid,
+		stderr: child.process.stderr ?? void 0,
+		write: child.write,
+		closeInput: child.closeInput,
+		kill: child.kill,
+		exitPromise: child.exitPromise,
+		beginRawCapture: child.beginRawCapture
+	};
+}
+//#endregion
+//#region src/base-adapter.ts
+/** Base adapter for CLI-based AI agent providers. */
+var CliProviderAdapterBase = class extends CliAdapterMcp {
+	supportsManagedQuote = false;
+	async execute(input, services, onEvent) {
+		this.ensureInitialized();
+		const quoteVersion = input.managedQuoteVersion;
+		if (quoteVersion !== void 0 && !this.supportsManagedQuote) throw new Error(`${this.provider} does not support the managed-quote native model transport`);
+		const correlationHeaders = executionCorrelationHeaders(input.interactionBinding, input.traceId, quoteVersion);
+		return this.withExecution(input.abortSignal, (signal) => this.executeInternal(input, services, onEvent, signal, correlationHeaders));
+	}
+	async executeInternal(input, services, onEvent, executionSignal, correlationHeaders) {
+		const startTime = Date.now();
+		const recorder = services.recorder;
+		const opened = await this.openTurnSession(input, recorder, onEvent);
+		if (opened.cached) return opened.cached;
+		const { sessionId, providerSessionId, providerMessageIds } = opened;
+		const { executionProfile, profilePlan } = await this.materializeTurnProfile(input, sessionId).catch(rejectNotLaunched);
+		const { preparedInput, promptText } = await this.recordTurnPrompt(input, opened, recorder).catch(rejectNotLaunched);
+		onEvent?.({
+			type: "status",
+			status: "started"
+		});
+		const launch = await this.planLaunch({
+			input,
+			sessionId,
+			providerSessionId,
+			executionSignal,
+			correlationHeaders,
+			executionProfile,
+			profilePlan,
+			attachments: preparedInput.attachments,
+			promptText
+		});
+		const { workspaceRoot } = launch;
+		const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId, workspaceRoot);
+		const observer = new TurnObserver({
+			provider: this.provider,
+			state,
+			sessionId,
+			getRuntimeHome: () => this.config.runtimeHome,
+			recorder,
+			getSessionStore: () => this.getSessionStore(),
+			logger: this.logger,
+			repairToolNames: this.toolCallRepairToolNames(),
+			onEvent
+		});
+		await this.bindNativeSession({
+			launch,
+			providerSessionId,
+			observer
+		});
+		const { exitResult, stderr } = await this.runCliTurn({
+			input,
+			sessionId,
+			providerSessionId,
+			executionSignal,
+			launch,
+			promptText,
+			state,
+			observer,
+			startTime
+		});
+		await observer.providerSessionPersistence;
+		failOnProviderSessionPersistence(observer, state);
+		const endTime = Date.now();
+		const benignNonZeroExit = !exitResult.success && !exitResult.timedOut && exitResult.stdinError === void 0 && this.isBenignNonZeroExit({
+			exitCode: exitResult.code,
+			stderr,
+			state
+		});
+		if (!exitResult.success && !benignNonZeroExit || state.terminalStatus === "failed" || state.endReason) return this.failCliTurn({
+			aborted: executionSignal.aborted,
+			onEvent,
+			recorder,
+			observer,
+			state,
+			exitResult,
+			stderr,
+			launch,
+			startTime,
+			endTime
+		});
+		logAcceptedCliExit(this.logger, exitResult, stderr);
+		return this.completeTurn({
+			input,
+			sessionId,
+			state,
+			observer,
+			recorder,
+			providerMessageIds,
+			profilePlan,
+			startTime,
+			endTime
+		});
+	}
+	async completeTurn(params) {
+		const { input, sessionId, state, recorder, profilePlan } = params;
+		if (state.sessionId && sessionId && state.sessionId !== sessionId) await this.getSessionStore().update(sessionId, {
+			providerSessionId: state.sessionId,
+			...this.config.runtimeHome?.trim() ? { providerSessionHome: this.config.runtimeHome.trim() } : {}
+		});
+		const assistantParts = this.buildAssistantParts(state);
+		await params.observer?.flushPartUpdates();
+		await recorder.appendAssistantParts(assistantParts);
+		await this.getMessageStore().append({
+			sessionId,
+			...params.providerMessageIds ? { id: params.providerMessageIds.assistantMessageId } : {},
+			role: "assistant",
+			parts: assistantParts,
+			tokenUsage: state.tokenUsage ? {
+				inputTokens: state.tokenUsage.inputTokens,
+				outputTokens: state.tokenUsage.outputTokens
+			} : void 0
+		});
+		const publicProfileRevision = profilePlan ? profileRevisionReceipts(this).public.get(profilePlan) : void 0;
+		const result = buildExecutionResult({
+			outcome: await this.executionOutcome(state, input),
+			state,
+			toolInvocations: this.extractToolInvocations(state),
+			sessionId,
+			publicProfileRevision,
+			startTime: params.startTime,
+			endTime: params.endTime
+		});
+		if (recorder.markTurnCompleted) await recorder.markTurnCompleted({ result });
+		return result;
+	}
+	/** Report and record a failed turn, then throw its error. */
+	async failCliTurn(params) {
+		const { onEvent, recorder, observer, state, exitResult, stderr } = params;
+		const { launch, startTime, endTime } = params;
+		const { errorMessage, failure } = endFailedTurn({
+			provider: this.provider,
+			state,
+			exitResult,
+			stderr,
+			aborted: params.aborted,
+			command: launch.execArgs.command,
+			nixBinPath: launch.env.NIX_BIN_PATH,
+			startTime,
+			endTime
+		});
+		this.logger.error("CLI process failed", {
+			exitCode: exitResult.code,
+			timedOut: exitResult.timedOut,
+			timeoutReason: exitResult.timeoutReason,
+			timeoutDiagnostic: exitResult.timeoutDiagnostic,
+			spawnError: exitResult.spawnError,
+			stdinError: exitResult.stdinError,
+			stderr: stderr.slice(0, 2e3),
+			diagnostic: state.lastDiagnostic,
+			durationMs: endTime - startTime,
+			command: launch.execArgs.command
+		});
+		if (exitResult.timedOut) onEvent?.({
+			type: "warning",
+			code: "TIMEOUT",
+			message: exitResult.timeoutDiagnostic ?? "Execution timed out"
+		});
+		onEvent?.({
+			type: "status",
+			status: "failed",
+			detail: errorMessage
+		});
+		await recordTurnInterruption({
+			recorder,
+			observer,
+			logger: this.logger,
+			errorMessage,
+			exitResult,
+			failure
+		});
+		throw failure;
+	}
+	async openTurnSession(input, recorder, onEvent) {
+		const sessionPrepareStarted = performance.now();
+		const adapter = this;
+		const prepared = await prepareExecutionSession({
+			get config() {
+				return adapter.config;
+			},
+			get logger() {
+				return adapter.logger;
+			},
+			get storagePath() {
+				return adapter.storagePath;
+			},
+			get getSessionStore() {
+				return adapter.getSessionStore.bind(adapter);
+			},
+			get getMessageStore() {
+				return adapter.getMessageStore.bind(adapter);
+			},
+			get resumableProviderSessionId() {
+				return adapter.resumableProviderSessionId.bind(adapter);
+			},
+			get createSession() {
+				return adapter.createSession.bind(adapter);
+			}
+		}, input).catch(rejectNotLaunched);
+		this.logger.observePhase?.("session_prepare", performance.now() - sessionPrepareStarted);
+		this.logger.observePhase?.(prepared.transcriptReplay ? "history_replay" : prepared.providerSessionId ? "native_resume" : "native_session_new", 0);
+		const providerMessageIds = readProviderMessageIds(input);
+		const cached = await findCachedTurn(recorder, input, this.logger, prepared.sessionId);
+		if (cached) {
+			onEvent?.({
+				type: "status",
+				status: "completed"
+			});
+			return {
+				...prepared,
+				providerMessageIds,
+				cached
+			};
+		}
+		if (input.turnId) recorder.setTurnId?.(input.turnId);
+		return {
+			...prepared,
+			providerMessageIds,
+			cached: void 0
+		};
+	}
+	async materializeTurnProfile(input, sessionId) {
+		const executionProfile = this.resolveExecutionProfileForInput(input);
+		const profilePlan = await this.materializeProfileResources(executionProfile, input.workspaceRoot ?? this.storagePath, input.userId ?? sessionId, sessionId);
+		assertExecutionProfileRevision(this, () => this.config, input, profilePlan);
+		return {
+			executionProfile,
+			profilePlan
+		};
+	}
+	async recordTurnPrompt(input, session, recorder, attachmentOptions) {
+		const { sessionId, providerMessageIds } = session;
+		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), input.workspaceRoot ?? this.storagePath, sessionId, attachmentOptions);
+		const transcriptContext = await buildTranscriptContext({
+			provider: this.provider,
+			sessionId,
+			transcriptReplay: session.transcriptReplay,
+			secretProfileRevisionRoot: this.config.secretProfileRevisionRoot,
+			getMessageStore: () => this.getMessageStore()
+		});
+		await recorder.recordUserMessage(preparedInput.persistedParts);
+		await this.getMessageStore().append({
+			sessionId,
+			...providerMessageIds ? { id: providerMessageIds.userMessageId } : {},
+			role: "user",
+			parts: preparedInput.persistedParts
+		});
+		return {
+			preparedInput,
+			promptText: this.composePromptText(prependPromptSection(transcriptContext, preparedInput.promptText), input)
+		};
+	}
+	/** Resolve this turn's config, environment and argv, and check them against the session contract. */
+	async planLaunch(params) {
+		const { input, sessionId, providerSessionId, executionSignal, correlationHeaders, executionProfile, profilePlan, attachments, promptText } = params;
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const turnConfig = withTurnInteractions(this.config, input);
+		const executionConfig = this.withProfilePlan(turnConfig, profilePlan);
+		const sessionContract = this.sessionContract();
+		const executionModel = this.resolveProfileModel(input.model?.model);
+		const env = this.buildTurnEnvironment(executionConfig, profilePlan, workspaceRoot, correlationHeaders);
+		const buildExecArgs = (mintedSessionId) => this.buildExecArgs({
+			message: promptText,
+			config: executionConfig,
+			correlationHeaders,
+			model: executionModel,
+			sessionId: providerSessionId,
+			...mintedSessionId ? { mintedSessionId } : {},
+			workspaceRoot,
+			...this.resolveProfilePrompts(input, profilePlan, executionProfile),
+			attachments,
+			profilePlan
+		});
+		const timeoutMs = input.timeoutMs;
+		const mintedSessionId = sessionContract?.identity.kind === "pre-minted" && !providerSessionId ? params.reserveHeldProcess === false ? randomUUID() : await this.mintNativeSessionId({
+			sessionId,
+			workspaceRoot,
+			config: executionConfig,
+			model: executionModel,
+			env,
+			signal: executionSignal,
+			buildExecArgs,
+			input,
+			...timeoutMs === void 0 ? {} : { timeoutMs }
+		}) : void 0;
+		const execArgs = buildExecArgs(mintedSessionId);
+		if (sessionContract) {
+			assertArgvHonoursSessionContract(this.provider, sessionContract, execArgs.args, { ...mintedSessionId ? { mintedId: mintedSessionId } : {} });
+			const runtimeHome = this.config.runtimeHome?.trim();
+			if (runtimeHome && sessionContractFullyEnforced(this.provider)) assertStoreLocationHonoursSessionContract(this.provider, sessionContract, {
+				runtimeHome,
+				cwd: workspaceRoot,
+				env,
+				argv: execArgs.args
+			});
+		}
+		this.logger.debug("CLI execution", {
+			command: execArgs.command,
+			cwd: workspaceRoot,
+			hasSessionId: !!providerSessionId
+		});
+		return {
+			workspaceRoot,
+			executionConfig,
+			executionModel,
+			env,
+			sessionContract,
+			timeoutMs,
+			mintedSessionId,
+			execArgs
+		};
+	}
+	/** Reserve and announce the native session id a pre-minted harness already has. */
+	async bindNativeSession(params) {
+		const { launch, providerSessionId, observer } = params;
+		const { workspaceRoot, sessionContract, mintedSessionId } = launch;
+		const nativeBindStarted = performance.now();
+		if (mintedSessionId) await this.reserveNativeSession(mintedSessionId, { workspaceRoot });
+		const knownNativeSessionId = sessionContract?.identity.kind === "pre-minted" ? mintedSessionId ?? providerSessionId : void 0;
+		if (knownNativeSessionId) {
+			observer.onEvent({
+				type: "native.session.observed",
+				provider: this.provider,
+				nativeSessionId: knownNativeSessionId
+			});
+			await observer.providerSessionPersistence;
+			if (observer.providerSessionPersistenceError) throw observer.providerSessionPersistenceError;
+			this.logger.observePhase?.("native_session_bind", performance.now() - nativeBindStarted);
+		}
+	}
+	async runCliTurn(params) {
+		const { input, sessionId, providerSessionId, executionSignal } = params;
+		const { launch, promptText, state, observer, startTime } = params;
+		const { execArgs, workspaceRoot, env } = launch;
+		const parserConfig = this.createEventParser(state, observer.onEvent);
+		const spawnedProcess = this.spawnExecutionProcess({
+			input,
+			sessionId,
+			providerSessionId,
+			config: launch.executionConfig,
+			execArgs,
+			workspaceRoot,
+			env,
+			signal: executionSignal,
+			timeoutMs: launch.timeoutMs,
+			parser: parserConfig
+		});
+		const cliProcess = spawnedProcess instanceof Promise ? await spawnedProcess : spawnedProcess;
+		this.activeProcesses.add(cliProcess);
+		observer.attachProcess(cliProcess);
+		const stopSessionWatch = watchNewSessionIds({
+			provider: this.provider,
+			runtimeHome: this.config.runtimeHome,
+			sessionContract: launch.sessionContract,
+			observer
+		});
+		if (providerSessionId && launch.sessionContract?.identity.kind === "first-event") observer.onEvent({
+			type: "native.session.observed",
+			provider: this.provider,
+			nativeSessionId: providerSessionId
+		});
+		const identityDeadline = armNativeSessionDeadline({
+			provider: this.provider,
+			sessionId,
+			sessionContract: launch.sessionContract,
+			state,
+			observer,
+			logger: this.logger,
+			kill: () => cliProcess.kill()
+		});
+		const stderr = collectStderr(cliProcess);
+		const livenessTicker = observer.startLiveness(executionSignal, startTime);
+		let exitResult;
+		try {
+			if (execArgs.useStdin) {
+				cliProcess.write(this.formatStdinMessage(execArgs.stdin || promptText));
+				cliProcess.closeInput();
+			}
+			exitResult = await cliProcess.exitPromise;
+		} catch (error) {
+			cliProcess.kill();
+			await cliProcess.exitPromise;
+			throw error;
+		} finally {
+			stopSessionWatch();
+			clearInterval(livenessTicker);
+			if (identityDeadline) clearTimeout(identityDeadline);
+			this.activeProcesses.delete(cliProcess);
+		}
+		await this.afterCliProcessExit({
+			state,
+			stderr: stderr.text,
+			exit: exitResult,
+			workspaceRoot,
+			env,
+			onEvent: observer.onEvent
+		});
+		return {
+			exitResult,
+			stderr: stderr.text
+		};
+	}
+	/** How one turn's argv runs: cwd, environment, identity or launcher, stdio. */
+	turnSpawnConfig(execArgs, workspaceRoot, env) {
+		return cliSpawnConfig({
+			execArgs,
+			workspaceRoot,
+			env,
+			inheritEnv: this.inheritProcessEnv,
+			launcher: this.launcher,
+			ownProcessGroup: this.ownProcessGroup,
+			subprocessUser: this.config.subprocessUser,
+			subprocessSpawnOptions: this.subprocessSpawnOptions()
+		});
+	}
+	/** The launch one turn would make, without starting it: the spawn config (argv, cwd, environment, identity or launcher). */
+	async prepareLaunch(input, options = {}) {
+		this.ensureInitialized();
+		const sessionId = input.sessionId ?? randomUUID();
+		const { executionProfile, profilePlan } = await this.materializeTurnProfile(input, sessionId);
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const preparedInput = await this.preparePromptInput(normalizeInputParts(input), workspaceRoot, sessionId);
+		const promptText = this.composePromptText(preparedInput.promptText, input);
+		const launch = await this.planLaunch({
+			input,
+			sessionId,
+			providerSessionId: options.providerSessionId,
+			executionSignal: input.abortSignal ?? new AbortController().signal,
+			correlationHeaders: executionCorrelationHeaders(input.interactionBinding, input.traceId),
+			executionProfile,
+			profilePlan,
+			attachments: preparedInput.attachments,
+			promptText,
+			reserveHeldProcess: false
+		});
+		const { execArgs } = launch;
+		return {
+			spawn: this.turnSpawnConfig(execArgs, launch.workspaceRoot, launch.env),
+			...execArgs.useStdin ? { stdin: this.formatStdinMessage(execArgs.stdin || promptText) } : {},
+			...launch.mintedSessionId ? { nativeSessionId: launch.mintedSessionId } : {},
+			...profilePlan ? { workspacePlan: profilePlan.receipt } : {}
+		};
+	}
+	spawnExecutionProcess(request) {
+		const { execArgs, workspaceRoot, env, signal, timeoutMs, parser } = request;
+		const spawnStarted = performance.now();
+		const config = {
+			...this.turnSpawnConfig(execArgs, workspaceRoot, env),
+			signal,
+			...globalThis.process.getuid?.() === 0 && this.config.runtimeHome?.trim() ? {
+				rawCapturePath: resolveRawCapturePath(this.config.runtimeHome.trim()),
+				...request.deferRawCapture ? { rawCaptureDeferred: true } : {}
+			} : {},
+			...timeoutMs === void 0 ? {} : { timeoutMs }
+		};
+		const turnProcess = (process) => cliTurnProcess(process, this.logger, spawnStarted);
+		return this.launcher ? launchCliProcess(config, parser).then(turnProcess) : turnProcess(spawnCliProcess(config, parser));
+	}
+};
+//#endregion
+//#region src/metering.ts
+const UsageRecordSchema = z.record(z.string(), z.unknown());
+const UsageNumberSchema = z.union([z.number(), z.string().trim().min(1)]).transform(Number).pipe(z.number().finite().nonnegative());
+const TOKEN_USAGE_INPUT_KEYS = Object.freeze([
+	"inputTokens",
+	"input",
+	"input_tokens",
+	"promptTokens",
+	"prompt_tokens"
+]);
+const TOKEN_USAGE_OUTPUT_KEYS = Object.freeze([
+	"outputTokens",
+	"output",
+	"output_tokens",
+	"completionTokens",
+	"completion_tokens"
+]);
+const TOKEN_USAGE_TOTAL_KEYS = Object.freeze([
+	"totalTokens",
+	"total_tokens",
+	"total"
+]);
+const TOKEN_USAGE_REASONING_KEYS = Object.freeze([
+	"reasoningTokens",
+	"reasoning_tokens",
+	"reasoning",
+	"reasoning_output_tokens"
+]);
+const TOKEN_USAGE_COST_KEYS = Object.freeze([
+	"totalCostUsd",
+	"costUsd",
+	"total_cost_usd",
+	"cost_usd",
+	"cost"
+]);
+const CACHE_READ_INPUT_KEYS = Object.freeze([
+	"cacheReadInputTokens",
+	"cache_read_input_tokens",
+	"cacheRead",
+	"cache_read",
+	"cached_input_tokens"
+]);
+const CACHE_CREATION_INPUT_KEYS = Object.freeze([
+	"cacheCreationInputTokens",
+	"cache_creation_input_tokens",
+	"cacheWrite",
+	"cache_write"
+]);
+const NESTED_COST_KEYS = Object.freeze([
+	"total",
+	"totalUsd",
+	"total_usd",
+	"usd"
+]);
+function asRecord(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	return parsed.success ? parsed.data : void 0;
+}
+function tokenCount(raw) {
+	const parsed = UsageNumberSchema.safeParse(raw);
+	return parsed.success ? Math.trunc(parsed.data) : void 0;
+}
+function firstTokenCount(source, keys) {
+	for (const key of keys) {
+		const count = tokenCount(source[key]);
+		if (count !== void 0) return count;
+	}
+}
+function firstUsageCostUsd(source, keys = TOKEN_USAGE_COST_KEYS) {
+	for (const key of keys) {
+		const parsed = UsageNumberSchema.safeParse(source[key]);
+		if (parsed.success) return parsed.data;
+	}
+}
+function usageRecord(source) {
+	return asRecord(source.tokenUsage) ?? asRecord(source.usage) ?? source;
+}
+function readTokenUsage(source) {
+	const usageSource = usageRecord(source);
+	const inputTokens = firstTokenCount(usageSource, TOKEN_USAGE_INPUT_KEYS);
+	const outputTokens = firstTokenCount(usageSource, TOKEN_USAGE_OUTPUT_KEYS);
+	return inputTokens !== void 0 || outputTokens !== void 0 ? {
+		inputTokens,
+		outputTokens
+	} : void 0;
+}
+function readTokenCostUsd(source) {
+	const usageSource = usageRecord(source);
+	return firstUsageCostUsd(source) ?? firstUsageCostUsd(usageSource) ?? readNestedCostUsd(source) ?? readNestedCostUsd(usageSource);
+}
+function readNestedCostUsd(source) {
+	const cost = asRecord(source.cost);
+	return cost ? firstUsageCostUsd(cost, NESTED_COST_KEYS) : void 0;
+}
+function readCliTokenUsage(raw) {
+	const parsed = UsageRecordSchema.safeParse(raw);
+	if (!parsed.success) return void 0;
+	const source = parsed.data;
+	const usageSource = usageRecord(source);
+	const usage = readTokenUsage(source) ?? readTokenUsage(usageSource);
+	const cost = readTokenCostUsd(source);
+	const totalTokens = firstTokenCount(usageSource, TOKEN_USAGE_TOTAL_KEYS);
+	const reasoningTokens = firstTokenCount(usageSource, TOKEN_USAGE_REASONING_KEYS);
+	const cacheReadInputTokens = firstTokenCount(usageSource, CACHE_READ_INPUT_KEYS);
+	const cacheCreationInputTokens = firstTokenCount(usageSource, CACHE_CREATION_INPUT_KEYS);
+	if (!usage && totalTokens === void 0 && reasoningTokens === void 0 && cost === void 0 && cacheReadInputTokens === void 0 && cacheCreationInputTokens === void 0) return;
+	return {
+		inputTokens: usage?.inputTokens,
+		outputTokens: usage?.outputTokens,
+		totalTokens,
+		reasoningTokens,
+		cacheReadInputTokens,
+		cacheCreationInputTokens,
+		cost
+	};
+}
+function recordCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (tokenUsage) {
+			state.tokenUsage = tokenUsage;
+			return true;
+		}
+	}
+	return false;
+}
+function addUsage(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	const sum = left + right;
+	return Number.isFinite(sum) ? sum : Math.max(left, right);
+}
+/**
+* Adds one usage report to the running total instead of replacing it.
+*
+* For a CLI that reports usage PER TURN (pi) rather than once per run,
+* `recordCliTokenUsage` would leave the execution billed as its final turn
+* alone. Use this wherever a single execution can produce more than one usage
+* report; use `recordCliTokenUsage` when the CLI emits one cumulative total.
+*
+* Returns true when a usage report was found in `sources` and folded in.
+*/
+function accumulateCliTokenUsage(state, ...sources) {
+	for (const source of sources) {
+		const tokenUsage = readCliTokenUsage(source);
+		if (!tokenUsage) continue;
+		const total = state.tokenUsage;
+		state.tokenUsage = total ? {
+			inputTokens: addUsage(total.inputTokens, tokenUsage.inputTokens),
+			outputTokens: addUsage(total.outputTokens, tokenUsage.outputTokens),
+			totalTokens: addUsage(total.totalTokens, tokenUsage.totalTokens),
+			reasoningTokens: addUsage(total.reasoningTokens, tokenUsage.reasoningTokens),
+			cacheReadInputTokens: addUsage(total.cacheReadInputTokens, tokenUsage.cacheReadInputTokens),
+			cacheCreationInputTokens: addUsage(total.cacheCreationInputTokens, tokenUsage.cacheCreationInputTokens),
+			cost: addUsage(total.cost, tokenUsage.cost)
+		} : tokenUsage;
+		return true;
+	}
+	return false;
+}
+function parseCliUsageLine(line) {
+	if (!line.startsWith("usage:")) return void 0;
+	const raw = line.slice(6).trim();
+	if (!raw) return void 0;
+	if (raw.startsWith("{")) return asRecord(JSON.parse(raw));
+	const fields = {};
+	for (const part of raw.split(/[,\s]+/)) {
+		if (!part) continue;
+		const separator = part.includes("=") ? "=" : part.includes(":") ? ":" : "";
+		if (!separator) continue;
+		const [key, value] = part.split(separator, 2);
+		if (!key || value === void 0) continue;
+		const numeric = Number(value);
+		fields[key] = Number.isFinite(numeric) ? numeric : value;
+	}
+	return Object.keys(fields).length > 0 ? fields : void 0;
+}
+//#endregion
+//#region src/acp-session-adapter.ts
+const DEFAULT_PROMPT_TIMEOUT_MS = 6e5;
+const DEFAULT_BOOTSTRAP_TIMEOUT_MS = 12e4;
+const DEFAULT_BRIDGE_IDLE_MS = 300 * 1e3;
+const ABORT_GRACE_MS = 250;
+var AcpProviderAdapterBase = class extends CliProviderAdapterBase {
+	acpSessions = /* @__PURE__ */ new Map();
+	spawnBridge(request) {
+		return spawnAcpBridge(request);
+	}
+	checkAgentProtocolVersion(_advertised, _turn) {}
+	resumeSessionId() {}
+	async onSessionOpened(_bridge, _acpSessionId, _turn, _options) {}
+	onBridgeSpawned(_bridge, _sessionId, _turn) {}
+	beginTurn(_sessionId, _input, _onEvent) {
+		return () => {};
+	}
+	onToolFailed(_sessionId, _failureText) {
+		return [];
+	}
+	takeTurnFailure(_sessionId) {}
+	onSessionEvicted(_sessionId) {}
+	turnLogContext(_turn) {
+		return {};
+	}
+	async execute(input, services, onEvent) {
+		this.ensureInitialized();
+		const turn = this.resolveTurn(input);
+		const { config } = turn;
+		const { recorder } = services;
+		const startTime = Date.now();
+		const workspaceRoot = input.workspaceRoot ?? this.storagePath;
+		const turnInput = input.sessionId ? input : {
+			...input,
+			sessionId: input.interactionBinding?.sessionId
+		};
+		const opened = await this.openTurnSession(turnInput, recorder, onEvent);
+		if (opened.cached) return opened.cached;
+		const { sessionId, providerSessionId, providerMessageIds } = opened;
+		const endTurn = this.beginTurn(sessionId, input, onEvent);
+		try {
+			const { preparedInput, promptText } = await this.recordTurnPrompt(turnInput, opened, recorder);
+			onEvent?.({
+				type: "status",
+				status: "started"
+			});
+			const state = createExecutionState(sessionId, providerMessageIds?.assistantMessageId);
+			let entry;
+			try {
+				entry = await this.acquireAcpSession({
+					sessionId,
+					...this.loadsNativeSessions && providerSessionId ? { providerSessionId } : {},
+					turn,
+					workspaceRoot,
+					onEvent
+				});
+			} catch (err) {
+				onEvent?.({
+					type: "status",
+					status: "failed",
+					detail: err instanceof Error ? err.message : String(err)
+				});
+				throw err instanceof Error ? err : new Error(String(err));
+			}
+			const { bridge, acpSessionId } = entry;
+			onEvent?.({
+				type: "session.updated",
+				sessionId
+			});
+			onEvent?.({
+				type: "native.session.observed",
+				provider: this.provider,
+				nativeSessionId: acpSessionId
+			});
+			const timeoutMs = config.promptTimeoutMs ?? DEFAULT_PROMPT_TIMEOUT_MS;
+			const prompt = this.promptBlocks(input, {
+				...preparedInput,
+				promptText
+			}, turn);
+			let promptResult;
+			try {
+				for (let attempt = 0; attempt < 3; attempt++) try {
+					promptResult = await this.promptAcpSession(entry, {
+						prompt,
+						timeoutMs: Math.min(timeoutMs, 12e4),
+						abortSignal: input.abortSignal,
+						onUpdate: (params) => {
+							for (const event of this.mapAcpUpdate(params, state, sessionId)) onEvent?.(event);
+						}
+					});
+					break;
+				} catch (err) {
+					const detail = this.formatBridgeError(err);
+					if (detail.includes("timed out")) this.interruptStuckTurn();
+					if (attempt === 0 && detail.includes("timed out")) continue;
+					if (attempt < 2 && await this.acknowledgeLostTurn(detail)) continue;
+					throw err;
+				}
+				const recorded = this.takeTurnFailure(sessionId);
+				if (recorded) throw recorded;
+				recordCliTokenUsage(state, promptResult);
+				const stop = promptResult?.stopReason;
+				if (stop !== "end_turn" && stop !== "max_tokens") throw new Error(`${this.provider} stopped the turn unfinished (stop reason ${stop ?? "missing"}): send the next turn to continue it`);
+				onEvent?.({
+					type: "status",
+					status: "completed"
+				});
+				await this.getSessionStore().update(sessionId, { providerSessionId: acpSessionId });
+				return await this.completeTurn({
+					input: turnInput,
+					sessionId,
+					state,
+					recorder,
+					providerMessageIds,
+					startTime,
+					endTime: Date.now()
+				});
+			} catch (err) {
+				const finalError = this.takeTurnFailure(sessionId) ?? err;
+				const detail = this.formatBridgeError(finalError);
+				this.logger.error(`${this.provider} execute failed`, {
+					...this.turnLogContext(turn),
+					error: detail,
+					stderrTail: bridge.getStderrTail().slice(-500)
+				});
+				onEvent?.({
+					type: "status",
+					status: "failed",
+					detail
+				});
+				this.evictAcpSession(sessionId, "execute-error");
+				const error = finalError instanceof JsonRpcError && detail !== finalError.message ? new Error(detail, { cause: finalError }) : finalError instanceof Error ? finalError : new Error(detail);
+				throw Object.assign(error, { reason: error.reason ?? turnEndReason({
+					aborted: input.abortSignal?.aborted,
+					timedOut: finalError instanceof RpcRequestTimeoutError,
+					linkLost: finalError instanceof BridgeClosedError || HARNESS_LINK_LOST.test(detail)
+				}) });
+			} finally {
+				this.scheduleIdleReap(sessionId, config.bridgeIdleMs);
+			}
+		} finally {
+			endTurn();
+		}
+	}
+	interruptStuckTurn() {}
+	async acknowledgeLostTurn(_detail) {
+		return false;
+	}
+	async acquireAcpSession(opts) {
+		const { sessionId, turn, workspaceRoot, onEvent } = opts;
+		const existing = this.acpSessions.get(sessionId);
+		if (existing && !existing.bridge.closed) {
+			if (existing.processKey === turn.processKey) {
+				this.cancelIdleReap(existing);
+				return existing;
+			}
+			this.logger.warn(`${this.provider}: cached session was started for another process configuration — respawning`, { sessionId });
+			this.evictAcpSession(sessionId, "process-change");
+		}
+		const storedSessionId = opts.providerSessionId ? this.resumeSessionId() : void 0;
+		const spec = await this.processSpec(turn, {
+			sessionId,
+			workspaceRoot
+		});
+		onEvent?.({
+			type: "status",
+			status: "processing",
+			detail: spec.statusDetail
+		});
+		let bridge;
+		const spawnStarted = performance.now();
+		try {
+			const runtimeHome = this.config.runtimeHome?.trim();
+			bridge = this.spawnBridge({
+				command: spec.command,
+				args: spec.args,
+				cwd: workspaceRoot,
+				env: withAgentEnvironment(spec.env, this.agentEnvironmentValues()),
+				...this.subprocessSpawnOptions(),
+				...globalThis.process.getuid?.() === 0 && runtimeHome ? { rawCapturePath: resolveRawCapturePath(runtimeHome) } : {}
+			});
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			throw new Error(this.spawnFailureMessage({
+				message,
+				missingBinary: message.includes("ENOENT") || message.includes("not found")
+			}, turn));
+		}
+		bridge.process?.once("spawn", () => {
+			this.logger.observePhase?.("cli_spawn", performance.now() - spawnStarted);
+		});
+		this.onBridgeSpawned(bridge, sessionId, turn);
+		const timeoutMs = turn.config.bootstrapTimeoutMs ?? DEFAULT_BOOTSTRAP_TIMEOUT_MS;
+		let acpSessionId;
+		const initializeStarted = performance.now();
+		try {
+			const requested = turn.config.protocolVersion ?? 1;
+			const init = await bridge.request("initialize", {
+				protocolVersion: requested,
+				clientCapabilities: {}
+			}, { timeoutMs });
+			this.checkProtocolVersion(init, requested, turn);
+			acpSessionId = await this.openNativeSession(bridge, {
+				providerSessionId: opts.providerSessionId,
+				storedSessionId,
+				cwd: workspaceRoot,
+				timeoutMs
+			});
+			await this.getSessionStore().update(sessionId, { providerSessionId: acpSessionId });
+			await this.onSessionOpened(bridge, acpSessionId, turn, { timeoutMs });
+			this.logger.observePhase?.("cli_initialize", performance.now() - initializeStarted);
+		} catch (err) {
+			try {
+				await bridge.close();
+			} catch {}
+			throw this.sessionSetupError(err, bridge);
+		}
+		const unsubscribeClose = bridge.onClose((reason) => {
+			this.logger.warn(`${this.provider}: agent process closed unexpectedly — evicting`, {
+				sessionId,
+				reason: reason.reason,
+				code: reason.code,
+				signal: reason.signal
+			});
+			this.evictAcpSession(sessionId, "process-exit");
+		});
+		const entry = {
+			bridge,
+			acpSessionId,
+			processKey: turn.processKey,
+			inflight: Promise.resolve(),
+			unsubscribeClose
+		};
+		this.acpSessions.set(sessionId, entry);
+		return entry;
+	}
+	checkProtocolVersion(init, requested, turn) {
+		const advertised = init.protocolVersion;
+		if (typeof advertised !== "number") throw new Error(`${this.provider}: initialize response missing protocolVersion (got ${JSON.stringify(init)})`);
+		if (advertised > requested) throw new Error(`${this.provider}: agent advertises protocolVersion ${advertised} but client speaks at most ${requested}. Upgrade the provider package or pin an older agent binary.`);
+		if (advertised < 1) throw new Error(`${this.provider}: agent advertises protocolVersion ${advertised} but client requires at least 1. The backing agent binary is too old; upgrade it.`);
+		this.checkAgentProtocolVersion(advertised, turn);
+	}
+	async openNativeSession(bridge, opts) {
+		const load = async (sessionId) => {
+			try {
+				const loaded = await bridge.request("session/load", {
+					sessionId,
+					cwd: opts.cwd,
+					mcpServers: []
+				}, { timeoutMs: opts.timeoutMs });
+				if (!loaded || typeof loaded !== "object") return void 0;
+				return loaded.sessionId ?? sessionId;
+			} catch (err) {
+				this.logger.debug("session/load failed", { error: err instanceof Error ? err.message : String(err) });
+				return;
+			}
+		};
+		const stored = opts.storedSessionId;
+		if (stored) {
+			const loaded = await load(stored);
+			if (loaded) return loaded;
+		}
+		if (opts.providerSessionId && opts.providerSessionId !== stored) {
+			const loaded = await load(opts.providerSessionId);
+			if (loaded) return loaded;
+		}
+		return (await bridge.request("session/new", {
+			cwd: opts.cwd,
+			mcpServers: []
+		}, { timeoutMs: opts.timeoutMs })).sessionId;
+	}
+	async promptAcpSession(entry, turn) {
+		const { bridge, acpSessionId } = entry;
+		const unsubscribe = bridge.onNotification("session/update", (params) => {
+			if (!params || params.sessionId !== acpSessionId) return;
+			turn.onUpdate(params);
+		});
+		const onAbort = () => {
+			try {
+				bridge.notify("session/cancel", { sessionId: acpSessionId });
+			} catch (err) {
+				this.logger.warn(`${this.provider}: session/cancel notify failed on abort`, { error: err instanceof Error ? err.message : String(err) });
+			}
+			setTimeout(() => {
+				bridge.close().catch(() => {});
+			}, ABORT_GRACE_MS).unref();
+		};
+		const { abortSignal } = turn;
+		if (abortSignal) if (abortSignal.aborted) onAbort();
+		else abortSignal.addEventListener("abort", onAbort, { once: true });
+		const previous = entry.inflight;
+		let releaseLock;
+		const lock = new Promise((resolve) => {
+			releaseLock = resolve;
+		});
+		entry.inflight = previous.then(() => lock).catch(() => lock);
+		const readyWaitStarted = performance.now();
+		await previous.catch(() => {});
+		this.logger.observePhase?.("cli_ready_wait", performance.now() - readyWaitStarted);
+		try {
+			return await bridge.request("session/prompt", {
+				sessionId: acpSessionId,
+				prompt: turn.prompt
+			}, { timeoutMs: turn.timeoutMs });
+		} finally {
+			unsubscribe();
+			abortSignal?.removeEventListener("abort", onAbort);
+			releaseLock();
+		}
+	}
+	scheduleIdleReap(sessionId, bridgeIdleMs) {
+		const entry = this.acpSessions.get(sessionId);
+		if (!entry) return;
+		const idleMs = bridgeIdleMs ?? DEFAULT_BRIDGE_IDLE_MS;
+		if (idleMs <= 0) {
+			this.evictAcpSession(sessionId, "idle-disabled");
+			return;
+		}
+		if (entry.idleTimer) clearTimeout(entry.idleTimer);
+		entry.idleTimer = setTimeout(() => {
+			this.evictAcpSession(sessionId, "idle-reap");
+		}, idleMs);
+		entry.idleTimer.unref();
+	}
+	cancelIdleReap(entry) {
+		if (entry.idleTimer) {
+			clearTimeout(entry.idleTimer);
+			entry.idleTimer = void 0;
+		}
+	}
+	evictAcpSession(sessionId, reason) {
+		const entry = this.acpSessions.get(sessionId);
+		if (!entry) return;
+		this.acpSessions.delete(sessionId);
+		this.onSessionEvicted(sessionId);
+		this.cancelIdleReap(entry);
+		try {
+			entry.unsubscribeClose();
+		} catch {}
+		if (!entry.bridge.closed) entry.bridge.close().catch((err) => {
+			this.logger.warn(`${this.provider}: bridge.close threw during evict`, {
+				sessionId,
+				reason,
+				error: err instanceof Error ? err.message : String(err)
+			});
+		});
+	}
+	evictAcpSessionsWhere(matches, reason) {
+		for (const [sessionId, entry] of [...this.acpSessions]) if (matches(entry.processKey)) this.evictAcpSession(sessionId, reason);
+	}
+	mapAcpUpdate(params, state, sessionId) {
+		const update = params.update;
+		if (!update || typeof update !== "object") return [];
+		const kind = update.sessionUpdate;
+		if (kind === "agent_message_chunk" || kind === "agent_thought_chunk") return acpMessageChunkEvents(kind, update, state);
+		if (kind === "tool_call") return acpToolCallEvents(update, state);
+		if (kind === "tool_call_update") {
+			const change = update;
+			const existing = state.toolCalls.get(change.toolCallId);
+			if (!existing) return [];
+			const mapped = this.mapToolStatus(change.status);
+			const outputText = applyAcpToolCallUpdate(existing, mapped, change);
+			return [...mapped === "failed" ? this.onToolFailed(sessionId, typeof existing.output === "string" ? existing.output : outputText || void 0) : [], ...acpToolCallUpdateEvents(existing, state)];
+		}
+		if (kind === "plan") return acpPlanEvents(update, state, this.provider);
+		if (kind === "available_commands_update") return [{
+			type: "raw",
+			backend: this.provider,
+			event: {
+				sessionUpdate: "available_commands_update",
+				availableCommands: update.availableCommands ?? []
+			}
+		}];
+		return [{
+			type: "raw",
+			backend: this.provider,
+			event: update
+		}];
+	}
+	mapToolStatus(status) {
+		switch (status) {
+			case "completed": return "completed";
+			case "failed": return "failed";
+			case "in_progress": return "running";
+			case "pending":
+			case void 0: return "pending";
+			default:
+				this.logger.warn(`${this.provider}: unknown tool_call_update status`, {
+					status,
+					mappedTo: "running"
+				});
+				return "running";
+		}
+	}
+	formatBridgeError(raw) {
+		if (raw instanceof BridgeClosedError) return `${this.provider} bridge closed unexpectedly: ${raw.message}`;
+		if (raw instanceof RpcRequestTimeoutError) return `${this.provider} request "${raw.method}" timed out after ${raw.timeoutMs}ms`;
+		if (raw instanceof JsonRpcError) return jsonRpcErrorText(raw);
+		if (raw instanceof Error) return raw.message;
+		return String(raw);
+	}
+	sessionSetupError(err, bridge) {
+		if (err instanceof BridgeClosedError) {
+			const stderr = bridge.getStderrTail().trim().slice(-500);
+			return new Error(`${this.provider}: agent exited before its session opened (${err.message})${stderr ? `; stderr: ${stderr}` : ""}`, { cause: err });
+		}
+		if (err instanceof JsonRpcError) return new Error(`${this.provider}: ${jsonRpcErrorText(err)}`, { cause: err });
+		return err instanceof Error ? err : new Error(String(err));
+	}
+	async healthCheck() {
+		return true;
+	}
+	async shutdown() {
+		this.evictAcpSessionsWhere(() => true, "adapter-shutdown");
+		await super.shutdown();
+	}
+	async addMcp(_name, _config) {
+		throw new Error(`${this.provider}: addMcp is not supported — an ACP agent takes MCP servers through session/new`);
+	}
+	async getMcpStatus() {
+		return { servers: {} };
+	}
+	buildExecArgs() {
+		throw new Error(`${this.provider}: buildExecArgs is not used — ACP turns run over the RPC bridge`);
+	}
+	buildExecEnv(_config) {
+		return {};
+	}
+	createEventParser() {
+		throw new Error(`${this.provider}: createEventParser is not used — session/update notifications arrive over the RPC bridge`);
+	}
+	buildMcpAddArgs(_name, _config) {
+		throw new Error(`${this.provider}: buildMcpAddArgs is not used`);
+	}
+};
+//#endregion
+//#region src/event-parsers.ts
+/**
+* Parser for harnesses that print one JSON event per line (claude-code,
+* codex, amp, factory-droids). Values that fail `accept` are logged and
+* dropped; unparseable lines become a `PARSE_ERROR` warning. The first event
+* `isReady` accepts reports the CLI's own start time as `cli_initialize`,
+* measured from parser creation, which immediately precedes the spawn.
+*/
+function jsonEventParser(logger, onEvent, spec) {
+	const startedAt = performance.now();
+	let readyReported = false;
+	return {
+		transform: (raw) => {
+			if (spec.accept(raw)) return raw;
+			logger.warn(`Received non-${spec.label} event`, { raw });
+			return null;
+		},
+		onEvent: (event) => {
+			if (!readyReported && spec.isReady?.(event)) {
+				readyReported = true;
+				logger.observePhase?.("cli_initialize", performance.now() - startedAt);
+			}
+			for (const stream of spec.map(event)) onEvent?.(stream);
+		},
+		onError: (error, line) => {
+			logger.warn("Failed to parse event", {
+				error: error.message,
+				line
+			});
+			onEvent?.({
+				type: "warning",
+				code: "PARSE_ERROR",
+				message: `Failed to parse event: ${error.message}`
+			});
+		}
+	};
+}
+/**
+* Parser for harnesses that print their reply as plain stdout lines (hermes,
+* nanoclaw). Lines classify into provider events; the reply is
+* emitted as one text part when stdout closes. A turn that printed errors
+* but no reply ends `failed` with the last error instead of an empty
+* `completed`.
+*/
+function plaintextResponseParser(state, onEvent, spec) {
+	const lines = [];
+	let errorSeen = false;
+	let lastError;
+	const response = {
+		text: (line) => {
+			lines.push(line);
+		},
+		error: (message) => {
+			errorSeen = true;
+			lastError = message;
+		}
+	};
+	return {
+		parseAs: "lines",
+		transform: (raw) => spec.classify(String(raw)),
+		onEvent: (event) => {
+			for (const stream of spec.map(event, response)) onEvent?.(stream);
+		},
+		onComplete: () => {
+			const text = lines.join("\n").trimEnd();
+			if (text.length > 0) {
+				const reply = finalTextEvent(state, text);
+				onEvent?.(reply);
+				onEvent?.({
+					type: "status",
+					status: "completed"
+				});
+			} else if (errorSeen) onEvent?.({
+				type: "status",
+				status: "failed",
+				detail: lastError ?? spec.emptyFailureDetail
+			});
+		}
+	};
+}
+//#endregion
+//#region src/interaction-mcp-server.ts
+var InteractionMcpServer$1 = class extends InteractionMcpServer {
+	constructor(config) {
+		super({
+			...config,
+			onStop: config.onStop ?? (() => void 0)
+		});
+	}
+};
+//#endregion
+//#region src/terminal-plan-support.ts
+/** One-shot durable plan submission for a single provider turn. */
+var TerminalPlanSupport = class {
+	committed;
+	submittedBody;
+	inFlight;
+	confirmInFlight;
+	confirmed = false;
+	constructor(options) {
+		this.options = options;
+	}
+	get plan() {
+		return this.committed;
+	}
+	/** Wait for a submission already accepted by this turn before failure cleanup. */
+	async settleSubmission() {
+		await this.inFlight?.catch(() => void 0);
+	}
+	async submit(body, sourceToolCallId) {
+		const normalized = body.trim();
+		if (!normalized) throw new Error("Plan body must not be empty");
+		if (this.submittedBody && this.submittedBody !== normalized) throw new Error(this.committed ? "This turn already submitted a different plan" : "This turn is already submitting a different plan");
+		if (this.committed) return this.committed;
+		if (this.inFlight) return this.inFlight;
+		this.submittedBody = normalized;
+		this.inFlight = this.options.planHost.submit({
+			body: normalized,
+			sourceToolCallId,
+			providerState: this.options.providerState()
+		}).then(async (plan) => {
+			this.committed = plan;
+			await this.options.onCommitted?.(plan);
+			return plan;
+		}).catch((error) => {
+			this.inFlight = void 0;
+			if (!this.committed) this.submittedBody = void 0;
+			throw error;
+		});
+		return this.inFlight;
+	}
+	async confirm() {
+		if (!this.committed) throw new Error("No durable plan has been committed by this turn");
+		if (this.confirmed) return this.committed;
+		if (this.confirmInFlight) return this.confirmInFlight;
+		const committed = this.committed;
+		this.confirmInFlight = this.options.planHost.confirm(committed.id).then(() => {
+			this.confirmed = true;
+			try {
+				this.options.emit?.({
+					type: "plan.submitted",
+					plan: committed
+				});
+			} catch {}
+			return committed;
+		}).catch((error) => {
+			this.confirmInFlight = void 0;
+			throw error;
+		});
+		return this.confirmInFlight;
+	}
+	async withdraw(reason) {
+		if (!this.committed) return;
+		await this.options.planHost.withdraw(this.committed.id, reason);
+	}
+};
+//#endregion
+//#region src/interaction-support.ts
+var McpInteractionSupport = class {
+	/** The shared emit → block → respond → fail-closed round-trip. */
+	broker = new InteractionBroker();
+	activeServer;
+	terminalPlan;
+	constructor(serverName, kinds) {
+		this.serverName = serverName;
+		this.kinds = kinds;
+	}
+	/** The interaction kinds to advertise from `getCapabilities().interactions`. */
+	capabilityKinds() {
+		return [...this.kinds];
+	}
+	/** The active per-execution server (its `url`/`token`), once started. */
+	get server() {
+		return this.activeServer;
+	}
+	/**
+	* Start a per-execution server bound to 127.0.0.1 with an ephemeral bearer
+	* token, registering only the enabled tools. `emit` is the live event sink;
+	* broker-backed tools block on an answer, while plans emit only after their
+	* terminal confirmation. Returns the server for CLI injection.
+	*/
+	async start(sessionId, binding, emit, plan) {
+		const tools = brokerInteractionTools(this.broker, {
+			sessionId,
+			binding,
+			emit
+		});
+		const has = (kind) => this.kinds.includes(kind);
+		if (has(InteractionKind.Plan) && !plan) throw new Error("Plan interaction requires a durable plan host and provider resume state");
+		this.terminalPlan = plan ? new TerminalPlanSupport({
+			...plan,
+			emit
+		}) : void 0;
+		const server = new InteractionMcpServer({
+			serverName: this.serverName,
+			onStop: tools.onStop,
+			...has(InteractionKind.Permission) ? { requestPermission: tools.requestPermission } : {},
+			...has(InteractionKind.Question) ? { askUser: tools.askUser } : {},
+			...has(InteractionKind.Plan) && this.terminalPlan ? { requestPlan: ({ plan: body, sourceToolCallId }) => this.terminalPlan.submit(body, sourceToolCallId) } : {}
+		});
+		await server.start();
+		this.activeServer = server;
+		return server;
+	}
+	async confirmSubmittedPlan() {
+		if (!this.terminalPlan) throw new Error("No terminal plan support is active for this turn");
+		return this.terminalPlan.confirm();
+	}
+	async withdrawSubmittedPlan(reason) {
+		await this.terminalPlan?.withdraw(reason);
+	}
+	/** Close the request boundary before inspecting or withdrawing its plan. */
+	async drainSubmittedPlan(sessionId) {
+		this.broker.failSession(sessionId);
+		let stopError;
+		try {
+			await this.activeServer?.stop();
+			this.activeServer = void 0;
+		} catch (error) {
+			stopError = error;
+		}
+		await this.terminalPlan?.settleSubmission();
+		if (stopError) throw stopError;
+	}
+	/**
+	* Fail-closed every pending interaction for the session, then stop the server.
+	* `failSession` runs FIRST so any request still blocked in the server resolves
+	* (deny) before close, and the whole thing swallows errors — it runs in adapter
+	* `finally` blocks and must never mask the turn's real error.
+	*/
+	async stop(sessionId) {
+		try {
+			this.broker.failSession(sessionId);
+			const server = this.activeServer;
+			this.activeServer = void 0;
+			await server?.stop();
+		} catch {}
+	}
+	/**
+	* Route an inbound live `/interactions` response for permission or question.
+	* Plans are durable records and never enter this response channel.
+	*/
+	respond(response) {
+		if (this.broker.respond(response)) return true;
+		return this.broker.respondQuestion(response);
+	}
+};
+//#endregion
+//#region src/secret-native-proof.ts
+const proofKey = Symbol.for("tangle.secret-native-binary-proofs");
+const runtime$1 = globalThis;
+const proven = runtime$1[proofKey] ?? /* @__PURE__ */ new Set();
+runtime$1[proofKey] = proven;
+/** Prove an immutable executable, under the launch's own identity and environment. */
+async function provenStoreBinary(expected, config) {
+	if (!config.isolatedIdentity || config.inheritEnv !== false) refuseSecretLaunch("Secret native binary proof requires an isolated identity and environment", { path: config.command });
+	const command = resolveExecutableRealpath(config.command, config.env?.PATH);
+	if (!command || !isTrustedStoreBinary(command)) refuseSecretLaunch("Secret native launch requires a root-owned Nix store binary", { path: command ?? config.command });
+	const key = `${command}\0${expected}`;
+	if (proven.has(key)) return command;
+	const probe = await execCli({
+		command,
+		cwd: config.cwd,
+		env: config.env,
+		inheritEnv: config.inheritEnv,
+		signal: config.signal,
+		isolatedIdentity: config.isolatedIdentity,
+		args: ["--version"],
+		spawnOptions: config.isolatedIdentity,
+		timeoutMs: 15e3
+	});
+	const version = probe.stdout?.trim();
+	if (!probe.exit.success || version !== expected) refuseSecretLaunch(`Secret native launch expected ${expected} at ${command}, received no matching version`, { exitCode: probe.exit.code });
+	proven.add(key);
+	return command;
+}
+/** A reported version alone cannot establish an immutable executable. */
+function isTrustedStoreBinary(realpath) {
+	if (!realpath.startsWith("/nix/store/")) return false;
+	try {
+		for (const path of [realpath, dirname(realpath)]) {
+			const stat = fs$1.lstatSync(path);
+			if (stat.uid !== 0 || (stat.mode & 18) !== 0) return false;
+		}
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** The real file a launch of `command` executes under `pathEnv`. */
+function resolveExecutableRealpath(command, pathEnv) {
+	if (command.includes("/") && !isAbsolute(command)) return void 0;
+	const candidates = command.includes("/") ? [command] : (pathEnv ?? "").split(":").filter(isAbsolute).map((dir) => join(dir, command));
+	for (const candidate of candidates) try {
+		fs$1.accessSync(candidate, fs$1.constants.X_OK);
+		if (fs$1.statSync(candidate).isFile()) return fs$1.realpathSync(candidate);
+	} catch {}
+}
+const SEALED_NATIVE_HOME_LAYOUT = {
+	codex: [
+		[
+			".",
+			1016,
+			true
+		],
+		[
+			".codex",
+			1016,
+			true
+		],
+		[
+			".agents",
+			360,
+			true
+		],
+		[
+			".codex/skills",
+			360,
+			true
+		],
+		[
+			".codex/rules",
+			360,
+			true
+		],
+		[
+			".codex/config.toml",
+			288,
+			false
+		],
+		[
+			".codex/AGENTS.md",
+			288,
+			false
+		],
+		[
+			".codex/AGENTS.override.md",
+			288,
+			false
+		],
+		[
+			".codex/hooks.json",
+			288,
+			false
+		]
+	],
+	opencode: [[
+		".",
+		456,
+		true
+	], [
+		".opencode",
+		360,
+		true
+	]]
+};
+function assertSealedNativeHome(home, gid, layout) {
+	for (const [relative, mode, directory] of layout) {
+		const path = join(home, relative);
+		const stat = fs$1.lstatSync(path);
+		if (fs$1.realpathSync(path) !== path || stat.uid !== 0 || stat.gid !== gid || (stat.mode & 4095) !== mode || stat.isDirectory() !== directory) refuseSecretLaunch(`Secret native HOME authority is not sealed at ${path}: expected uid0 gid${gid} mode${mode.toString(8)} directory=${directory}; actual uid${stat.uid} gid${stat.gid} mode${(stat.mode & 4095).toString(8)} directory=${stat.isDirectory()}`);
+	}
+}
+/** Only selected structural facts enter a refusal; payloads and causes never do. */
+function refuseSecretLaunch(reason, { path, expected, actual, exitCode } = {}) {
+	const detail = JSON.stringify({
+		path,
+		expected,
+		actual
+	}).slice(0, 768);
+	throw new Error(detail === "{}" ? reason : `${reason} ${detail}`, { cause: typeof exitCode === "number" || exitCode === null ? { exitCode } : void 0 });
+}
+//#endregion
+//#region src/reasoning-effort.ts
+/** How each CLI takes agent-interface's native control token on its argv. */
+const EFFORT_FLAG = {
+	"claude-code": (value) => ["--effort", value],
+	codex: (value) => ["-c", `model_reasoning_effort=${value}`],
+	openclaw: (value) => ["--thinking", value],
+	pi: (value) => ["--thinking", value]
+};
+/** The argv carrying `nativeReasoningControl` for a profile effort, or none. */
+function nativeEffortArgs(harness, effort) {
+	const value = nativeReasoningControl(harness, effort ?? null);
+	const flag = EFFORT_FLAG[harness];
+	return value === null || flag === void 0 ? [] : flag(value);
+}
+/**
+* Kimi stays local until #14839: the sandbox ships kimi-cli 1.49.0 as
+* `kimi-code` (binary `--thinking`/`--no-thinking`) while other paths run
+* kimi-code 2.x. A model whose name has "thinking" or "reason" always thinks
+* (kimi-cli `derive_model_capabilities`), so `off` throws there.
+*/
+function kimiThinkingArgs(level, modelId) {
+	if (level === void 0) return [];
+	const off = level === "none" || level === "minimal";
+	if (!REASONING_EFFORTS.includes(level) || off && /thinking|reason/i.test(modelId ?? "")) throw new Error(`kimi-code cannot honor reasoning effort "${level}"`);
+	return off ? ["--no-thinking"] : ["--thinking"];
+}
+//#endregion
+//#region src/secret-profile-mcp.ts
+/** Executor-held MCP credentials shared by native private-profile adapters. */
+const SECRET_REFERENCE_PREFIX = "TANGLE_PROFILE_SECRET_";
+const SECRET_REFERENCE = /\{env:(TANGLE_PROFILE_SECRET_[0-9A-F]{24})\}/g;
+function requireRecord(raw, message) {
+	return isRecord(raw) ? raw : refuseSecretLaunch(message);
+}
+/** A config value with its secret references resolved, or undefined. */
+function resolveReferences(value, references) {
+	let unresolved = false;
+	const resolved = value.replace(SECRET_REFERENCE, (_match, reference) => {
+		const secret = references[reference];
+		if (secret === void 0) unresolved = true;
+		return secret ?? "";
+	});
+	return unresolved || /\{(?:env|file):/.test(resolved) ? void 0 : resolved;
+}
+/** A stdio server the executor can run: its command and its environment with every secret reference resolved. */
+function servableStdioServer(name, entry, references) {
+	const command = entry.command;
+	if (!Array.isArray(command) || command.length === 0 || command.some((part) => typeof part !== "string" || /\{(?:env|file):/.test(part))) return "its command is not a fixed argument list";
+	if (entry.cwd !== void 0) return "it names a working directory";
+	const declared = entry.environment === void 0 ? {} : entry.environment;
+	if (!isRecord(declared)) return "its environment is not a map";
+	const environment = {};
+	const secrets = /* @__PURE__ */ new Set();
+	for (const [variable, value] of Object.entries(declared)) {
+		if (typeof value !== "string") return `its ${variable} is not text`;
+		const resolved = resolveReferences(value, references);
+		if (resolved === void 0) return `its ${variable} names a value the executor cannot resolve`;
+		environment[variable] = resolved;
+		for (const [, reference] of value.matchAll(SECRET_REFERENCE)) {
+			const secret = references[reference];
+			if (secret) secrets.add(secret);
+		}
+	}
+	return {
+		name,
+		command,
+		environment,
+		secrets: [...secrets]
+	};
+}
+/** A remote server the executor can serve: its fixed upstream URL and every header with its secret references resolved. */
+function servableMcpServer(name, entry, references) {
+	const url = entry.url;
+	if (typeof url !== "string" || /\{(?:env|file):/.test(url)) return "its URL is not a fixed address";
+	try {
+		const parsed = new URL(url);
+		if (parsed.protocol !== "https:" && parsed.protocol !== "http:") return "its URL is not http(s)";
+	} catch {
+		return "its URL is not a fixed address";
+	}
+	const headers = {};
+	const declared = entry.headers === void 0 ? {} : entry.headers;
+	if (!isRecord(declared)) return "its headers are not a map";
+	for (const [header, value] of Object.entries(declared)) {
+		if (typeof value !== "string") return `its ${header} header is not text`;
+		const resolved = resolveReferences(value, references);
+		if (resolved === void 0) return `its ${header} header names a value the executor cannot resolve`;
+		headers[header] = resolved;
+	}
+	return {
+		name,
+		url,
+		headers
+	};
+}
+/** Join the queue at `key`; `previous` settles when earlier holders release. */
+function joinQueue(queues, key) {
+	const previous = queues.get(key) ?? Promise.resolve();
+	let release;
+	const finished = new Promise((resolve) => {
+		release = resolve;
+	});
+	const tail = previous.then(() => finished);
+	queues.set(key, tail);
+	tail.then(() => {
+		if (queues.get(key) === tail) queues.delete(key);
+	});
+	return {
+		previous,
+		release
+	};
+}
+function untilSettledOrAborted(previous, signal) {
+	const aborted = () => signal.reason ?? /* @__PURE__ */ new Error("Secret native turn aborted before its session view was free");
+	if (signal.aborted) return Promise.reject(aborted());
+	return new Promise((resolve, reject) => {
+		const onAbort = () => reject(aborted());
+		signal.addEventListener("abort", onAbort, { once: true });
+		previous.then(() => {
+			signal.removeEventListener("abort", onAbort);
+			resolve();
+		});
+	});
+}
+/** Every native discovery ancestor is sealed and free of ambient configuration. */
+function assertSealedNativeSearchPath(cwd, configNames) {
+	for (let child = cwd, parent = dirname(cwd);; child = parent, parent = dirname(parent)) {
+		const stat = lstatSync(child);
+		if (!stat.isDirectory() || stat.isSymbolicLink() || realpathSync(child) !== child || stat.uid !== 0 || (stat.mode & 18) !== 0 || child !== cwd && configNames.some((name) => lstatSync(join(child, name), { throwIfNoEntry: false }))) throw new Error("Secret native launch has mutable or ambient discovery authority");
+		if (parent === child) break;
+	}
+}
+/** One session view changes only after its previous physical native process exits. */
+const turnsKey = Symbol.for("tangle.secret-native-session-turns");
+const turnsRuntime = globalThis;
+const sessionTurns = turnsRuntime[turnsKey] ?? /* @__PURE__ */ new Map();
+turnsRuntime[turnsKey] = sessionTurns;
+function secretSessionTurnQueue(view) {
+	return joinQueue(sessionTurns, view);
+}
+/** An HTTP URL on loopback with an explicit port and no URL credentials. */
+function isLoopbackEndpoint(value) {
+	if (typeof value !== "string") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "http:" && [
+			"127.0.0.1",
+			"[::1]",
+			"localhost"
+		].includes(url.hostname) && url.port !== "" && !url.username && !url.password;
+	} catch {
+		return false;
+	}
+}
+//#endregion
+//#region src/secret-profile-scope.ts
+const key = Symbol.for("tangle.secret-profile-mcp.scopes");
+const runtime = globalThis;
+const openScopes = runtime[key] ??= /* @__PURE__ */ new Map();
+function secretMcpScope(sessionId, uid, owner) {
+	if (sessionId.includes("\0")) throw new Error("A secret MCP session id has no NUL");
+	const scope = `${sessionId}\0${uid ?? ""}`;
+	if (owner?.proxy) {
+		const owners = openScopes.get(scope) ?? /* @__PURE__ */ new Set();
+		owners.add(owner);
+		openScopes.set(scope, owners);
+	}
+	return scope;
+}
+async function forgetSessionScopes(target) {
+	for (const [scope, owners] of openScopes) {
+		if ("sessionId" in target && !scope.startsWith(`${target.sessionId}\0`)) continue;
+		for (const owner of [...owners]) {
+			if ("owner" in target && owner !== target.owner) continue;
+			if (![...owners].some((other) => other !== owner && other.proxy === owner.proxy)) await owner.proxy.forget(scope);
+			owners.delete(owner);
+		}
+		if (owners.size === 0) openScopes.delete(scope);
+	}
+}
+//#endregion
+export { withEphemeralContext as $, TerminalPlanSupport as A, toolStartEvents as At, readCliTokenUsage as B, SEALED_NATIVE_HOME_LAYOUT as C, finalTextEvent as Ct, refuseSecretLaunch as D, textDeltaEvents as Dt, provenStoreBinary as E, streamPartBase as Et, jsonEventParser as F, spawnAcpBridge as Ft, isLocalMcpConfig as G, CliProviderAdapterBase as H, plaintextResponseParser as I, enabledInteractionKinds as J, localMcpArgv as K, AcpProviderAdapterBase as L, InteractionMcpServer$1 as M, ACP_MIN_PROTOCOL_VERSION as Mt, brokerInteractionTools$1 as N, ACP_PROTOCOL_VERSION as Nt, resolveExecutableRealpath as O, textSnapshotEvents as Ot, interactionMcpToolName as P, acpContentText as Pt, turnInteractionEnabled as Q, accumulateCliTokenUsage as R, NATIVE_SESSION_CONTRACTS$1 as S, homeXdgEnv as St, isTrustedStoreBinary as T, sessionObservedEvents as Tt, createRepeatedToolFailureGuard as U, recordCliTokenUsage as V, createExecutionState as W, readEphemeralContext as X, interactionToggleEnabled as Y, turnEndReason as Z, servableMcpServer as _, EXECUTION_CORRELATION_HEADERS as _t, codexDeveloperInstructionArgs as a, preparePromptInputParts as at, kimiThinkingArgs as b, MANAGED_QUOTE_VERSION_HEADER as bt, SECRET_REFERENCE as c, deriveFilePart as ct, isLoopbackEndpoint as d, trackFilePart as dt, withTurnInteractions as et, isPlainRecord as f, InvalidAttachmentError as ft, secretSessionTurnQueue as g, runtimeSecretsOverlay as gt, resolveReferences as h, wasNeverLaunched as ht, PERMISSION_DECISION_TIMEOUT_MS as i, partitionImageAttachments as it, DEFAULT_INTERACTION_MCP_SERVER_NAME as j, trackReasoningBlock as jt, McpInteractionSupport as k, toolResultEvents as kt, SECRET_REFERENCE_PREFIX as l, deterministicFilePartId as lt, requireRecord as m, rejectNotLaunched as mt, InteractionBroker$1 as n, MAX_TOTAL_INLINE_IMAGE_BYTES as nt, forgetSessionScopes as o, prependPromptSection as ot, joinQueue as p, SessionRehydrationError as pt, localMcpEnv as q, InteractionHttpBridge as r, PROMPT_SECTION_SEPARATOR as rt, secretMcpScope as s, buildFileUrl as st, CODEX_DISABLED_FEATURE_ARGS as t, MAX_INLINE_IMAGE_BYTES as tt, assertSealedNativeSearchPath as u, inferMediaType as ut, servableStdioServer as v, EXECUTION_ID_HEADER as vt, assertSealedNativeHome as w, reasoningEvents as wt, nativeEffortArgs as x, executionCorrelationHeaders as xt, untilSettledOrAborted as y, EXECUTION_TRACE_HEADER as yt, parseCliUsageLine as z };
+
+//# sourceMappingURL=src-Fn8Pu1xq.mjs.map