@theokit/sdk 2.28.0 → 2.30.0

package/dist/eval.js

@@ -1,9 +1,9 @@
 import { z, toJSONSchema } from 'zod';
 import { createRequire } from 'module';
-import { randomUUID, randomBytes, createHash } from 'crypto';
-import { mkdir, writeFile, readFile, unlink, open, rename, statfs, stat, rm, readdir, appendFile, access } from 'fs/promises';
-import { join, dirname, resolve, sep, relative, isAbsolute } from 'path';
+import { randomUUID, createHash, randomBytes } from 'crypto';
 import { readFileSync, mkdirSync, appendFileSync, readdirSync, existsSync, realpathSync, lstatSync, readlinkSync } from 'fs';
+import { join, dirname, resolve, sep, relative, isAbsolute } from 'path';
+import { mkdir, writeFile, rm, readdir, readFile, unlink, open, rename, statfs, stat, access, appendFile } from 'fs/promises';
 import { AsyncLocalStorage } from 'async_hooks';
 import { homedir } from 'os';
 import { execFile, spawn } from 'child_process';
@@ -779,6 +779,155 @@ var init_cwd_mutex = __esm({
     tails = /* @__PURE__ */ new Map();
   }
 });
+function safePathJoin(base, ...parts) {
+  if (base === "") {
+    throw new Error("safePathJoin: base must be non-empty");
+  }
+  rejectNulAndControlChars(base, "base");
+  for (const part of parts) {
+    rejectNulAndControlChars(part, "path segment");
+  }
+  const baseResolved = resolve(base);
+  const target = resolve(base, ...parts);
+  if (target !== baseResolved && !target.startsWith(baseResolved + sep)) {
+    throw new PathTraversalError(parts.join("/"), target);
+  }
+  return target;
+}
+function rejectNulAndControlChars(input, role) {
+  for (let i = 0; i < input.length; i++) {
+    const code = input.charCodeAt(i);
+    if (code === 0 || code >= 1 && code <= 31 || code === 127) {
+      const label = code === 0 ? "<nul-byte>" : `<control-char-0x${code.toString(16)}>`;
+      throw new PathTraversalError(`${role}: ${input}`, label);
+    }
+  }
+}
+function assertNoSymlinkEscape(path, base) {
+  rejectNulAndControlChars(path, "path");
+  rejectNulAndControlChars(base, "base");
+  let baseResolved;
+  try {
+    baseResolved = realpathSync(base);
+  } catch {
+    baseResolved = resolve(base);
+  }
+  const resolved = realpathOfDeepestExisting(path);
+  if (resolved === void 0) return;
+  if (resolved !== baseResolved && !resolved.startsWith(baseResolved + sep)) {
+    throw new PathTraversalError(`symlink ${path}`, resolved);
+  }
+}
+function realpathOfDeepestExisting(path) {
+  try {
+    return realpathSync(path);
+  } catch {
+  }
+  try {
+    const stat6 = lstatSync(path);
+    if (stat6.isSymbolicLink()) {
+      const target = readlinkSync(path);
+      const parentReal = realpathOfDeepestExisting(dirname(path));
+      const parentBase = parentReal ?? dirname(path);
+      return resolve(parentBase, target);
+    }
+  } catch {
+  }
+  let cursor = dirname(path);
+  let suffix = path.slice(cursor.length);
+  while (cursor !== dirname(cursor)) {
+    try {
+      const real = realpathSync(cursor);
+      return resolve(real, `.${suffix}`);
+    } catch {
+      suffix = path.slice(dirname(cursor).length);
+      cursor = dirname(cursor);
+    }
+  }
+  return void 0;
+}
+function validateArtifactPath(input) {
+  rejectKnownPrefixVectors(input);
+  const normalized = decodeAndNormalize(input);
+  rejectParentTraversal(input, normalized);
+}
+function rejectKnownPrefixVectors(input) {
+  if (input.includes("\0")) {
+    throw new PathTraversalError(input, "<nul-byte>");
+  }
+  if (input.startsWith("/") || input.startsWith("~")) {
+    throw new PathTraversalError(input, input);
+  }
+  if (/^[A-Za-z]:[\\/]?/.test(input)) {
+    throw new PathTraversalError(input, input);
+  }
+}
+function decodeAndNormalize(input) {
+  let decoded = input;
+  for (let i = 0; i < 2; i += 1) {
+    try {
+      const next = decodeURIComponent(decoded);
+      if (next === decoded) break;
+      decoded = next;
+    } catch {
+      throw new PathTraversalError(input, "<malformed-url-encoding>");
+    }
+  }
+  return decoded.replace(/\\/g, "/");
+}
+function rejectParentTraversal(input, normalized) {
+  for (const segment of normalized.split("/")) {
+    if (segment === ".." || segment === "..%00") {
+      throw new PathTraversalError(input, normalized);
+    }
+  }
+  if (normalized.includes("..")) {
+    throw new PathTraversalError(input, normalized);
+  }
+}
+function sanitizeIdentifier(input, options) {
+  const maxLen = options?.maxLen ?? 64;
+  if (input.length === 0 || input.length > maxLen) {
+    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): "${input}"`, {
+      code: "invalid_identifier"
+    });
+  }
+  rejectNulAndControlChars(input, "identifier");
+  if (!IDENTIFIER_PATTERN.test(input)) {
+    throw new ConfigurationError(`Identifier contains invalid characters: "${input}"`, {
+      code: "invalid_identifier"
+    });
+  }
+  return input.toLowerCase();
+}
+function safeFilenameForId(id, options) {
+  if (id.length === 0) {
+    throw new ConfigurationError("Filename id must be a non-empty string", {
+      code: "invalid_filename_id"
+    });
+  }
+  const maxLen = options?.maxLen ?? 128;
+  const lower = id.toLowerCase();
+  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {
+    return lower;
+  }
+  return `h-${createHash("sha256").update(id).digest("hex").slice(0, 16)}`;
+}
+var PathTraversalError, IDENTIFIER_PATTERN;
+var init_path_guard = __esm({
+  "src/internal/security/path-guard.ts"() {
+    init_errors();
+    PathTraversalError = class extends ConfigurationError {
+      name = "PathTraversalError";
+      constructor(input, resolvedPath) {
+        super(`Path traversal attempt: ${input} \u2192 ${resolvedPath}`, {
+          code: "path_traversal"
+        });
+      }
+    };
+    IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\-_]*$/i;
+  }
+});
 function detectNetworkFsName(typeMagic) {
   return NETWORK_FS_MAGIC.get(typeMagic) ?? null;
 }
@@ -843,6 +992,80 @@ var init_atomic_write = __esm({
   }
 });
 
+// src/internal/security/index.ts
+var init_security = __esm({
+  "src/internal/security/index.ts"() {
+    init_path_guard();
+    init_redact();
+  }
+});
+
+// src/internal/persistence/file-lock.ts
+async function getProperLockfile() {
+  if (cached !== void 0) return cached;
+  try {
+    const mod = await import('proper-lockfile');
+    if (!validateLockModule(mod)) {
+      if (!warnedStructural) {
+        warnedStructural = true;
+        process.stderr.write(
+          "[theokit-sdk] proper-lockfile: imported module does NOT expose the expected `lock`/`unlock` API surface. This may indicate a supply-chain compromise or an incompatible major version. Falling back to in-process mutex (no cross-process safety). Reinstall with: pnpm add proper-lockfile@^11\n"
+        );
+      }
+      cached = null;
+      return cached;
+    }
+    cached = mod;
+  } catch {
+    cached = null;
+  }
+  return cached;
+}
+function validateLockModule(mod) {
+  if (mod === null || mod === void 0 || typeof mod !== "object") return false;
+  const m = mod;
+  return typeof m.lock === "function" && typeof m.unlock === "function";
+}
+async function withFileLock(path, fn, options) {
+  const lib = await getProperLockfile();
+  if (lib === null) {
+    if (!warnedMissing) {
+      warnedMissing = true;
+      process.stderr.write(
+        "[theokit-sdk] proper-lockfile not installed; cross-process file lock unavailable. Install with: pnpm add proper-lockfile\n"
+      );
+    }
+    return withCwdMutex(`file-lock:${path}`, fn);
+  }
+  return withCwdMutex(`file-lock:${path}`, async () => {
+    const release = await lib.lock(path, {
+      // EC-1: companion lockfile, target path may not exist yet.
+      lockfilePath: `${path}.lock`,
+      realpath: false,
+      stale: 3e4,
+      retries: {
+        retries: 5,
+        factor: 1.5,
+        minTimeout: 100,
+        maxTimeout: 5e3
+      }
+    });
+    try {
+      return await fn();
+    } finally {
+      await release();
+    }
+  });
+}
+var cached, warnedMissing, warnedStructural;
+var init_file_lock = __esm({
+  "src/internal/persistence/file-lock.ts"() {
+    init_cwd_mutex();
+    warnedMissing = false;
+    warnedStructural = false;
+  }
+});
+
 // src/internal/runtime/context/yaml-frontmatter.ts
 function parseSimpleYaml(text) {
   const fields = {};
@@ -1034,21 +1257,386 @@ function buildConfigFromMarkdown(entities) {
       command: entity.frontmatter.command,
       matcher: entity.frontmatter.matcher
     };
-    if (entity.frontmatter.timeoutMs !== void 0) {
-      command.timeoutMs = entity.frontmatter.timeoutMs;
-    }
-    list.push(command);
-    grouped[event] = list;
-  }
-  return { hooks: grouped };
-}
-var warned;
-var init_hooks_source = __esm({
-  "src/internal/runtime/hooks/hooks-source.ts"() {
-    init_errors();
-    init_markdown_config_loader();
-    init_hooks_frontmatter();
-    warned = /* @__PURE__ */ new Set();
+    if (entity.frontmatter.timeoutMs !== void 0) {
+      command.timeoutMs = entity.frontmatter.timeoutMs;
+    }
+    list.push(command);
+    grouped[event] = list;
+  }
+  return { hooks: grouped };
+}
+var warned;
+var init_hooks_source = __esm({
+  "src/internal/runtime/hooks/hooks-source.ts"() {
+    init_errors();
+    init_markdown_config_loader();
+    init_hooks_frontmatter();
+    warned = /* @__PURE__ */ new Set();
+  }
+});
+function sessionFilePath(cwd, agentId) {
+  const safe3 = sanitizeIdentifier(agentId, { maxLen: 128 });
+  return safePathJoin(cwd, ".theokit", "agents", safe3, "messages.jsonl");
+}
+async function readJsonlLines(cwd, agentId) {
+  const path = sessionFilePath(cwd, agentId);
+  try {
+    const raw = await readFile(path, "utf8");
+    return raw.split("\n").filter((line) => line.length > 0);
+  } catch {
+    return [];
+  }
+}
+function warnMalformed(agentId, line) {
+  process.stderr.write(
+    `[theokit-sdk] skipping malformed line in messages.jsonl (${agentId}): ${line.slice(0, 80)}...
+`
+  );
+}
+function hydrateSessionLine(parsed) {
+  if (typeof parsed.text !== "string" || parsed.role === void 0) return void 0;
+  if (parsed.role === "user" || parsed.role === "assistant") {
+    return { role: parsed.role, text: parsed.text };
+  }
+  if (parsed.role === "tool_call" || parsed.role === "tool_result") {
+    const label = parsed.role === "tool_call" ? "tool call" : "tool result";
+    return { role: "assistant", text: `[${label}] ${parsed.text}` };
+  }
+  return void 0;
+}
+async function readSessionFile(cwd, agentId) {
+  const lines = await readJsonlLines(cwd, agentId);
+  const messages = [];
+  for (const line of lines) {
+    try {
+      const msg = hydrateSessionLine(JSON.parse(line));
+      if (msg !== void 0) messages.push(msg);
+    } catch {
+      warnMalformed(agentId, line);
+    }
+  }
+  return messages;
+}
+async function readAllPersistedMessages(cwd, agentId) {
+  const lines = await readJsonlLines(cwd, agentId);
+  const messages = [];
+  for (const line of lines) {
+    try {
+      const parsed = JSON.parse(line);
+      if (parsed.role !== void 0 && VALID_ROLES.has(parsed.role) && typeof parsed.text === "string") {
+        messages.push({
+          role: parsed.role,
+          text: parsed.text,
+          at: typeof parsed.at === "number" ? parsed.at : Date.now()
+        });
+      }
+    } catch {
+      warnMalformed(agentId, line);
+    }
+  }
+  return messages;
+}
+async function appendAnyPersistedMessage(cwd, agentId, record) {
+  await appendPersistedMessages(cwd, agentId, [record]);
+}
+async function appendPersistedMessages(cwd, agentId, records) {
+  if (records.length === 0) return;
+  const path = sessionFilePath(cwd, agentId);
+  const payload = records.map((r) => `${redactSecrets(JSON.stringify(r))}
+`).join("");
+  const dir = dirname(path);
+  let written = false;
+  const attempt = async () => {
+    await mkdir(dir, { recursive: true });
+    await withFileLock(path, async () => {
+      await appendFile(path, payload, "utf8");
+      written = true;
+    });
+  };
+  try {
+    await attempt();
+  } catch (cause) {
+    if (written || cause.code !== "ENOENT") throw cause;
+    await attempt();
+  }
+}
+async function rewriteLockedSession(path, transform) {
+  await withFileLock(path, async () => {
+    let raw;
+    try {
+      raw = await readFile(path, "utf8");
+    } catch {
+      return;
+    }
+    const lines = raw.split("\n").filter((line) => line.length > 0);
+    const next = transform(lines);
+    if (next === void 0) return;
+    await replaceFileAtomic(path, next);
+  });
+}
+async function compactSessionFile(cwd, agentId, maxTurns) {
+  const path = sessionFilePath(cwd, agentId);
+  if (!existsSync(path)) return;
+  await rewriteLockedSession(
+    path,
+    (lines) => lines.length <= maxTurns * 2 ? void 0 : `${lines.slice(-maxTurns).join("\n")}
+`
+  );
+}
+async function truncateSessionTo(cwd, agentId, keepCount) {
+  const path = sessionFilePath(cwd, agentId);
+  if (!existsSync(path)) return 0;
+  let kept = 0;
+  await rewriteLockedSession(path, (lines) => {
+    const keep = Math.max(0, Math.min(keepCount, lines.length));
+    kept = keep;
+    if (keep === lines.length) return void 0;
+    return keep === 0 ? "" : `${lines.slice(0, keep).join("\n")}
+`;
+  });
+  return kept;
+}
+var VALID_ROLES;
+var init_agent_session_store = __esm({
+  "src/internal/runtime/session/agent-session-store.ts"() {
+    init_atomic_write();
+    init_file_lock();
+    init_security();
+    VALID_ROLES = /* @__PURE__ */ new Set([
+      "user",
+      "assistant",
+      "system",
+      "tool_call",
+      "tool_result"
+    ]);
+  }
+});
+
+// src/internal/persistence/objective-coerce.ts
+function coerceOptions(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const o = raw;
+  const out = {};
+  if (typeof o.maxRuns === "number") out.maxRuns = o.maxRuns;
+  if (typeof o.judgeModel === "string") out.judgeModel = o.judgeModel;
+  if (typeof o.prompt === "string") out.prompt = o.prompt;
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function coerceObjectiveRecord(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const o = raw;
+  if (o._schemaVersion !== 1) return void 0;
+  if (typeof o.objective !== "string") return void 0;
+  if (typeof o.runsUsed !== "number") return void 0;
+  if (typeof o.status !== "string" || !STATUSES.includes(o.status))
+    return void 0;
+  const options = coerceOptions(o.options);
+  return {
+    _schemaVersion: 1,
+    objective: o.objective,
+    ...options !== void 0 ? { options } : {},
+    status: o.status,
+    runsUsed: o.runsUsed
+  };
+}
+var STATUSES;
+var init_objective_coerce = __esm({
+  "src/internal/persistence/objective-coerce.ts"() {
+    STATUSES = ["active", "done", "paused"];
+  }
+});
+
+// src/internal/persistence/pagination.ts
+function paginate(items, opts) {
+  if (opts === void 0 || opts.offset === void 0 && opts.limit === void 0) return items;
+  const start = Math.max(0, opts.offset ?? 0);
+  const end = opts.limit === void 0 ? items.length : start + Math.max(0, opts.limit);
+  return items.slice(start, end);
+}
+var init_pagination = __esm({
+  "src/internal/persistence/pagination.ts"() {
+  }
+});
+
+// src/internal/persistence/session-meta.ts
+function applyMetaPatch(current, patch) {
+  const next = {};
+  if (current.title !== void 0) next.title = current.title;
+  if (current.tag !== void 0) next.tag = current.tag;
+  if (patch.title === null) delete next.title;
+  else if (patch.title !== void 0) next.title = patch.title;
+  if (patch.tag === null) delete next.tag;
+  else if (patch.tag !== void 0) next.tag = patch.tag;
+  return next;
+}
+function coerceSessionMeta(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const obj = raw;
+  const meta = {};
+  if (typeof obj.title === "string") meta.title = obj.title;
+  if (typeof obj.tag === "string") meta.tag = obj.tag;
+  return meta.title === void 0 && meta.tag === void 0 ? void 0 : meta;
+}
+var init_session_meta = __esm({
+  "src/internal/persistence/session-meta.ts"() {
+  }
+});
+function toStoredMessage(record) {
+  return {
+    role: record.role,
+    content: record.text,
+    at: record.at
+  };
+}
+function toRecord(message) {
+  return { role: message.role, text: message.content, at: message.at ?? Date.now() };
+}
+var FileSystemConversationStorage;
+var init_conversation_storage_fs = __esm({
+  "src/internal/persistence/conversation-storage-fs.ts"() {
+    init_agent_session_store();
+    init_security();
+    init_path_guard();
+    init_file_lock();
+    init_objective_coerce();
+    init_pagination();
+    init_session_meta();
+    FileSystemConversationStorage = class {
+      #root;
+      constructor(opts = {}) {
+        this.#root = opts.root ?? process.cwd();
+      }
+      /** Exposed for tests + diagnostics. The path is sanitized at use sites. */
+      get root() {
+        return this.#root;
+      }
+      async getMessages(conversationId, opts) {
+        const records = await readAllPersistedMessages(this.#root, conversationId);
+        const all = records.map(toStoredMessage);
+        return paginate(all, opts);
+      }
+      async appendMessage(conversationId, message) {
+        await appendAnyPersistedMessage(this.#root, conversationId, toRecord(message));
+      }
+      async appendMessages(conversationId, messages) {
+        await appendPersistedMessages(this.#root, conversationId, messages.map(toRecord));
+      }
+      async truncateConversation(conversationId, keepCount) {
+        return truncateSessionTo(this.#root, conversationId, keepCount);
+      }
+      async deleteConversation(conversationId) {
+        const safe3 = sanitizeIdentifier(conversationId, { maxLen: 128 });
+        const dirPath = safePathJoin(this.#root, ".theokit", "agents", safe3);
+        await rm(dirPath, { recursive: true, force: true });
+      }
+      async deleteScope(prefix) {
+        const ids = await this.listConversationIds();
+        const matching = ids.filter((id) => id.startsWith(prefix));
+        for (const id of matching) await this.deleteConversation(id);
+        return matching.length;
+      }
+      async listConversationIds(opts = {}) {
+        const agentsRoot = safePathJoin(this.#root, ".theokit", "agents");
+        let entries;
+        try {
+          entries = await readdir(agentsRoot);
+        } catch (cause) {
+          if (cause.code === "ENOENT") return [];
+          throw cause;
+        }
+        if (opts.limit !== void 0) return entries.slice(0, opts.limit);
+        return entries;
+      }
+      async compact(conversationId, maxTurns) {
+        await compactSessionFile(this.#root, conversationId, maxTurns);
+      }
+      // SE4 — session metadata persisted as a per-conversation sidecar
+      // `<root>/.theokit/agents/<safeId>/session.json` (same sanitized perimeter as
+      // the transcript). Kept separate from messages.jsonl so a title/tag write does
+      // not rewrite the append-only log.
+      #metaPath(conversationId) {
+        const safe3 = sanitizeIdentifier(conversationId, { maxLen: 128 });
+        return safePathJoin(this.#root, ".theokit", "agents", safe3, "session.json");
+      }
+      async getSessionMeta(conversationId) {
+        try {
+          const raw = await readFile(this.#metaPath(conversationId), "utf8");
+          return coerceSessionMeta(JSON.parse(raw));
+        } catch (cause) {
+          if (cause.code === "ENOENT") return void 0;
+          throw cause;
+        }
+      }
+      async setSessionMeta(conversationId, patch) {
+        const metaPath = this.#metaPath(conversationId);
+        await mkdir(dirname(metaPath), { recursive: true });
+        await withFileLock(metaPath, async () => {
+          let current = {};
+          try {
+            current = coerceSessionMeta(JSON.parse(await readFile(metaPath, "utf8"))) ?? {};
+          } catch (cause) {
+            if (cause.code !== "ENOENT") throw cause;
+          }
+          const next = applyMetaPatch(current, patch);
+          await writeFile(metaPath, redactSecrets(JSON.stringify(next)), "utf8");
+        });
+      }
+      // SE33 — the durable objective is kept in `objective.json` beside the
+      // transcript (separate from messages.jsonl + session.json). Uses the TOTAL
+      // `safeFilenameForId` (not `sanitizeIdentifier`) so a caller-supplied
+      // `threadId` with exotic characters (e.g. "user@example.com") hashes to a
+      // deterministic dir instead of throwing — honoring the objective methods'
+      // never-throw contract (ADR D6). Conforming ids pass through unchanged, so
+      // the objective still sits beside the transcript for the normal case.
+      #objectivePath(conversationId) {
+        const safe3 = safeFilenameForId(conversationId, { maxLen: 128 });
+        return safePathJoin(this.#root, ".theokit", "agents", safe3, "objective.json");
+      }
+      async getObjectiveRecord(conversationId) {
+        try {
+          const raw = await readFile(this.#objectivePath(conversationId), "utf8");
+          return coerceObjectiveRecord(JSON.parse(raw));
+        } catch (cause) {
+          if (cause.code === "ENOENT") return void 0;
+          throw cause;
+        }
+      }
+      async setObjectiveRecord(conversationId, record) {
+        const path = this.#objectivePath(conversationId);
+        if (record === null) {
+          await rm(path, { force: true });
+          return;
+        }
+        await mkdir(dirname(path), { recursive: true });
+        await withFileLock(path, async () => {
+          await writeFile(path, redactSecrets(JSON.stringify(record)), "utf8");
+        });
+      }
+      // SE33 (HIGH-1 fix) — atomic read-modify-write: the read that feeds `mutate`
+      // happens INSIDE the same file lock as the write, so two concurrent progress
+      // write-backs on one thread cannot both read a stale `runsUsed` and drop turns.
+      async updateObjectiveRecord(conversationId, mutate) {
+        const path = this.#objectivePath(conversationId);
+        await mkdir(dirname(path), { recursive: true });
+        await withFileLock(path, async () => {
+          let current;
+          try {
+            current = coerceObjectiveRecord(JSON.parse(await readFile(path, "utf8")));
+          } catch (cause) {
+            if (cause.code !== "ENOENT") throw cause;
+          }
+          const next = mutate(current);
+          if (next === void 0) return;
+          if (next === null) {
+            await rm(path, { force: true });
+            return;
+          }
+          await writeFile(path, redactSecrets(JSON.stringify(next)), "utf8");
+        });
+      }
+      async dispose() {
+      }
+    };
   }
 });
 async function withToolWhitelist(whitelist, fn) {
@@ -1424,6 +2012,151 @@ var init_credential_pool_context = __esm({
   }
 });
 
+// src/internal/runtime/objective/objective-store.ts
+function canPersist(a) {
+  return typeof a.getObjectiveRecord === "function" && typeof a.setObjectiveRecord === "function";
+}
+async function mutateObjective(adapter, conversationId, mutate) {
+  if (typeof adapter.updateObjectiveRecord === "function") {
+    await adapter.updateObjectiveRecord(conversationId, mutate);
+    return;
+  }
+  const current = await adapter.getObjectiveRecord(conversationId);
+  const next = mutate(current);
+  if (next === void 0) return;
+  await adapter.setObjectiveRecord(conversationId, next);
+}
+async function getObjective(adapter, conversationId) {
+  if (!canPersist(adapter)) return void 0;
+  return adapter.getObjectiveRecord(conversationId);
+}
+async function setObjective(adapter, conversationId, objective, options) {
+  if (!canPersist(adapter)) return;
+  const record = {
+    _schemaVersion: 1,
+    objective,
+    ...options !== void 0 ? { options } : {},
+    status: "active",
+    runsUsed: 0
+  };
+  await adapter.setObjectiveRecord(conversationId, record);
+}
+async function updateObjectiveOptions(adapter, conversationId, patch) {
+  if (!canPersist(adapter)) return;
+  await mutateObjective(
+    adapter,
+    conversationId,
+    (current) => current === void 0 ? void 0 : { ...current, options: { ...current.options, ...patch } }
+  );
+}
+async function writeObjectiveProgress(adapter, conversationId, progress) {
+  if (!canPersist(adapter)) return;
+  await mutateObjective(
+    adapter,
+    conversationId,
+    (current) => current === void 0 ? void 0 : { ...current, runsUsed: progress.runsUsed, status: progress.status }
+  );
+}
+async function clearObjective(adapter, conversationId) {
+  if (!canPersist(adapter)) return;
+  await adapter.setObjectiveRecord(conversationId, null);
+}
+var init_objective_store = __esm({
+  "src/internal/runtime/objective/objective-store.ts"() {
+  }
+});
+
+// src/internal/runtime/local-agent/local-agent-goal-extensions.ts
+var local_agent_goal_extensions_exports = {};
+__export(local_agent_goal_extensions_exports, {
+  formatObjectiveProjection: () => formatObjectiveProjection,
+  localAgentClearObjective: () => localAgentClearObjective,
+  localAgentGetObjective: () => localAgentGetObjective,
+  localAgentSetObjective: () => localAgentSetObjective,
+  localAgentUpdateObjectiveOptions: () => localAgentUpdateObjectiveOptions,
+  persistDurableProgress: () => persistDurableProgress,
+  resolveCurrentObjectiveText: () => resolveCurrentObjectiveText,
+  resolveDurableRun: () => resolveDurableRun
+});
+function resolveAdapter(handle) {
+  return typeof handle === "string" ? new FileSystemConversationStorage({ root: handle }) : handle;
+}
+function assertValidGoalOptions(options) {
+  if (options.maxRuns !== void 0 && (!Number.isInteger(options.maxRuns) || options.maxRuns <= 0)) {
+    throw new ConfigurationError(`maxRuns must be a positive integer, got ${options.maxRuns}`, {
+      code: "invalid_objective_max_runs"
+    });
+  }
+}
+async function localAgentSetObjective(handle, objective, opts) {
+  const { threadId, ...options } = opts;
+  assertValidGoalOptions(options);
+  await setObjective(
+    resolveAdapter(handle),
+    threadId,
+    objective,
+    Object.keys(options).length > 0 ? options : void 0
+  );
+}
+async function localAgentGetObjective(handle, opts) {
+  return getObjective(resolveAdapter(handle), opts.threadId);
+}
+async function localAgentUpdateObjectiveOptions(handle, opts) {
+  const { threadId, ...patch } = opts;
+  assertValidGoalOptions(patch);
+  await updateObjectiveOptions(resolveAdapter(handle), threadId, patch);
+}
+async function localAgentClearObjective(handle, opts) {
+  await clearObjective(resolveAdapter(handle), opts.threadId);
+}
+async function resolveCurrentObjectiveText(handle, threadId) {
+  const record = await getObjective(resolveAdapter(handle), threadId);
+  return record?.status === "active" ? record.objective : void 0;
+}
+function formatObjectiveProjection(objective, assembled) {
+  const signal = `<current-objective>
+${objective}
+</current-objective>`;
+  return assembled === void 0 || assembled.length === 0 ? signal : `${signal}
+
+${assembled}`;
+}
+async function resolveDurableRun(handle, goalConfig, threadId, callerOptions) {
+  const record = await getObjective(resolveAdapter(handle), threadId);
+  if (record === void 0) return { kind: "none" };
+  const judgeModel = callerOptions?.judgeModel ?? record.options?.judgeModel ?? goalConfig?.judgeModel;
+  if (judgeModel === void 0) return { kind: "inert" };
+  const totalBudget = record.options?.maxRuns ?? goalConfig?.maxRuns ?? DEFAULT_MAX_RUNS;
+  const remaining = Math.max(0, totalBudget - record.runsUsed);
+  if (remaining === 0) return { kind: "exhausted" };
+  const perCall = callerOptions?.maxTurns;
+  const maxTurns = perCall !== void 0 ? Math.min(perCall, remaining) : remaining;
+  return {
+    kind: "run",
+    goal: record.objective,
+    options: { ...callerOptions, maxTurns, judgeModel }
+  };
+}
+async function persistDurableProgress(handle, threadId, result) {
+  const adapter = resolveAdapter(handle);
+  const record = await getObjective(adapter, threadId);
+  if (record === void 0) return;
+  const status = result.status === "completed" ? "done" : result.status === "paused" ? "paused" : "active";
+  await writeObjectiveProgress(adapter, threadId, {
+    runsUsed: record.runsUsed + result.turnsUsed,
+    status
+  });
+}
+var DEFAULT_MAX_RUNS;
+var init_local_agent_goal_extensions = __esm({
+  "src/internal/runtime/local-agent/local-agent-goal-extensions.ts"() {
+    init_errors();
+    init_conversation_storage_fs();
+    init_objective_store();
+    DEFAULT_MAX_RUNS = 20;
+  }
+});
+
 // src/internal/personality/context.ts
 var context_exports = {};
 __export(context_exports, {
@@ -3210,152 +3943,7 @@ function structurableAnswerOrThrow(result, GenerateObjectError2) {
 // src/internal/runtime/cloud/cloud-agent.ts
 init_errors();
 init_cwd_mutex();
-
-// src/internal/security/path-guard.ts
-init_errors();
-var PathTraversalError = class extends ConfigurationError {
-  name = "PathTraversalError";
-  constructor(input, resolvedPath) {
-    super(`Path traversal attempt: ${input} \u2192 ${resolvedPath}`, {
-      code: "path_traversal"
-    });
-  }
-};
-function safePathJoin(base, ...parts) {
-  if (base === "") {
-    throw new Error("safePathJoin: base must be non-empty");
-  }
-  rejectNulAndControlChars(base, "base");
-  for (const part of parts) {
-    rejectNulAndControlChars(part, "path segment");
-  }
-  const baseResolved = resolve(base);
-  const target = resolve(base, ...parts);
-  if (target !== baseResolved && !target.startsWith(baseResolved + sep)) {
-    throw new PathTraversalError(parts.join("/"), target);
-  }
-  return target;
-}
-function rejectNulAndControlChars(input, role) {
-  for (let i = 0; i < input.length; i++) {
-    const code = input.charCodeAt(i);
-    if (code === 0 || code >= 1 && code <= 31 || code === 127) {
-      const label = code === 0 ? "<nul-byte>" : `<control-char-0x${code.toString(16)}>`;
-      throw new PathTraversalError(`${role}: ${input}`, label);
-    }
-  }
-}
-function assertNoSymlinkEscape(path, base) {
-  rejectNulAndControlChars(path, "path");
-  rejectNulAndControlChars(base, "base");
-  let baseResolved;
-  try {
-    baseResolved = realpathSync(base);
-  } catch {
-    baseResolved = resolve(base);
-  }
-  const resolved = realpathOfDeepestExisting(path);
-  if (resolved === void 0) return;
-  if (resolved !== baseResolved && !resolved.startsWith(baseResolved + sep)) {
-    throw new PathTraversalError(`symlink ${path}`, resolved);
-  }
-}
-function realpathOfDeepestExisting(path) {
-  try {
-    return realpathSync(path);
-  } catch {
-  }
-  try {
-    const stat6 = lstatSync(path);
-    if (stat6.isSymbolicLink()) {
-      const target = readlinkSync(path);
-      const parentReal = realpathOfDeepestExisting(dirname(path));
-      const parentBase = parentReal ?? dirname(path);
-      return resolve(parentBase, target);
-    }
-  } catch {
-  }
-  let cursor = dirname(path);
-  let suffix = path.slice(cursor.length);
-  while (cursor !== dirname(cursor)) {
-    try {
-      const real = realpathSync(cursor);
-      return resolve(real, `.${suffix}`);
-    } catch {
-      suffix = path.slice(dirname(cursor).length);
-      cursor = dirname(cursor);
-    }
-  }
-  return void 0;
-}
-var IDENTIFIER_PATTERN = /^[a-z0-9][a-z0-9\-_]*$/i;
-function validateArtifactPath(input) {
-  rejectKnownPrefixVectors(input);
-  const normalized = decodeAndNormalize(input);
-  rejectParentTraversal(input, normalized);
-}
-function rejectKnownPrefixVectors(input) {
-  if (input.includes("\0")) {
-    throw new PathTraversalError(input, "<nul-byte>");
-  }
-  if (input.startsWith("/") || input.startsWith("~")) {
-    throw new PathTraversalError(input, input);
-  }
-  if (/^[A-Za-z]:[\\/]?/.test(input)) {
-    throw new PathTraversalError(input, input);
-  }
-}
-function decodeAndNormalize(input) {
-  let decoded = input;
-  for (let i = 0; i < 2; i += 1) {
-    try {
-      const next = decodeURIComponent(decoded);
-      if (next === decoded) break;
-      decoded = next;
-    } catch {
-      throw new PathTraversalError(input, "<malformed-url-encoding>");
-    }
-  }
-  return decoded.replace(/\\/g, "/");
-}
-function rejectParentTraversal(input, normalized) {
-  for (const segment of normalized.split("/")) {
-    if (segment === ".." || segment === "..%00") {
-      throw new PathTraversalError(input, normalized);
-    }
-  }
-  if (normalized.includes("..")) {
-    throw new PathTraversalError(input, normalized);
-  }
-}
-function sanitizeIdentifier(input, options) {
-  const maxLen = options?.maxLen ?? 64;
-  if (input.length === 0 || input.length > maxLen) {
-    throw new ConfigurationError(`Identifier length out of range (1-${maxLen}): "${input}"`, {
-      code: "invalid_identifier"
-    });
-  }
-  rejectNulAndControlChars(input, "identifier");
-  if (!IDENTIFIER_PATTERN.test(input)) {
-    throw new ConfigurationError(`Identifier contains invalid characters: "${input}"`, {
-      code: "invalid_identifier"
-    });
-  }
-  return input.toLowerCase();
-}
-function safeFilenameForId(id, options) {
-  if (id.length === 0) {
-    throw new ConfigurationError("Filename id must be a non-empty string", {
-      code: "invalid_filename_id"
-    });
-  }
-  const maxLen = options?.maxLen;
-  const lower = id.toLowerCase();
-  if (lower.length <= maxLen && IDENTIFIER_PATTERN.test(lower)) {
-    return lower;
-  }
-  return `h-${createHash("sha256").update(id).digest("hex").slice(0, 16)}`;
-}
+init_path_guard();
 
 // src/internal/runtime/model-selection.ts
 init_errors();
@@ -3845,8 +4433,8 @@ function serializeMemory2(memory) {
   return result;
 }
 
-// src/internal/security/index.ts
-init_redact();
+// src/internal/runtime/fixtures/fixture-responder.ts
+init_security();
 
 // src/internal/runtime/fixtures/fixture-events.ts
 function assistantOnlyConversation(text) {
@@ -3965,6 +4553,10 @@ function sanitizeMcpName(name) {
 // src/internal/memory/storage/markdown-store.ts
 init_atomic_write();
 init_cwd_mutex();
+
+// src/internal/memory/types.ts
+init_path_guard();
+init_security();
 function legacyMemoryJsonPath(cwd, config) {
   if (config.storePath !== void 0) {
     return resolve(cwd, config.storePath);
@@ -5282,78 +5874,17 @@ function isStdioCommandConfig(config) {
   if (obj.type !== void 0 && obj.type !== "stdio") return false;
   return typeof obj.command === "string" && obj.command.length > 0;
 }
-function isLocalPath(command) {
-  return command.startsWith("/") || command.startsWith("~/") || command.startsWith("./") || command.startsWith("../");
-}
-
-// src/internal/runtime/local-agent/local-agent.ts
-init_errors();
-init_cwd_mutex();
-
-// src/internal/personality/store.ts
-init_atomic_write();
-
-// src/internal/persistence/file-lock.ts
-init_cwd_mutex();
-var cached;
-var warnedMissing = false;
-var warnedStructural = false;
-async function getProperLockfile() {
-  if (cached !== void 0) return cached;
-  try {
-    const mod = await import('proper-lockfile');
-    if (!validateLockModule(mod)) {
-      if (!warnedStructural) {
-        warnedStructural = true;
-        process.stderr.write(
-          "[theokit-sdk] proper-lockfile: imported module does NOT expose the expected `lock`/`unlock` API surface. This may indicate a supply-chain compromise or an incompatible major version. Falling back to in-process mutex (no cross-process safety). Reinstall with: pnpm add proper-lockfile@^11\n"
-        );
-      }
-      cached = null;
-      return cached;
-    }
-    cached = mod;
-  } catch {
-    cached = null;
-  }
-  return cached;
-}
-function validateLockModule(mod) {
-  if (mod === null || mod === void 0 || typeof mod !== "object") return false;
-  const m = mod;
-  return typeof m.lock === "function" && typeof m.unlock === "function";
-}
-async function withFileLock(path, fn, options) {
-  const lib = await getProperLockfile();
-  if (lib === null) {
-    if (!warnedMissing) {
-      warnedMissing = true;
-      process.stderr.write(
-        "[theokit-sdk] proper-lockfile not installed; cross-process file lock unavailable. Install with: pnpm add proper-lockfile\n"
-      );
-    }
-    return withCwdMutex(`file-lock:${path}`, fn);
-  }
-  return withCwdMutex(`file-lock:${path}`, async () => {
-    const release = await lib.lock(path, {
-      // EC-1: companion lockfile, target path may not exist yet.
-      lockfilePath: `${path}.lock`,
-      realpath: false,
-      stale: 3e4,
-      retries: {
-        retries: 5,
-        factor: 1.5,
-        minTimeout: 100,
-        maxTimeout: 5e3
-      }
-    });
-    try {
-      return await fn();
-    } finally {
-      await release();
-    }
-  });
-}
+function isLocalPath(command) {
+  return command.startsWith("/") || command.startsWith("~/") || command.startsWith("./") || command.startsWith("../");
+}
+
+// src/internal/runtime/local-agent/local-agent.ts
+init_errors();
+init_cwd_mutex();
+
+// src/internal/personality/store.ts
+init_atomic_write();
+init_file_lock();
 var THEOKIT_DIR_NAME = ".theokit";
 function getTheokitHome(cwd) {
   const override = process.env.THEOKIT_HOME?.trim();
@@ -5795,6 +6326,9 @@ var HISTOGRAM_NAMES = {
   /** M3 #66 — count of finishes where the provider omitted usage (silent undercount). */
   LLM_USAGE_MISSING: "theokit_llm_usage_missing"
 };
+
+// src/internal/telemetry/tracer.ts
+init_security();
 function safeRequire(moduleName) {
   try {
     const r = createRequire(import.meta.url);
@@ -6367,6 +6901,7 @@ function parseDecisionFromStdout(stdout) {
 
 // src/internal/memory/storage/session-summary-writer.ts
 init_atomic_write();
+init_path_guard();
 var MAX_TURN_CHARS = 2e3;
 function sessionsDir(cwd) {
   return join(memoryDir(cwd), "sessions");
@@ -6427,262 +6962,9 @@ function resolveActiveMemorySummaryForSend(legacySummary, portPathEnabled) {
   return legacySummary;
 }
 
-// src/internal/runtime/session/agent-session-store.ts
-init_atomic_write();
-var VALID_ROLES = /* @__PURE__ */ new Set([
-  "user",
-  "assistant",
-  "system",
-  "tool_call",
-  "tool_result"
-]);
-function sessionFilePath(cwd, agentId) {
-  const safe3 = sanitizeIdentifier(agentId, { maxLen: 128 });
-  return safePathJoin(cwd, ".theokit", "agents", safe3, "messages.jsonl");
-}
-async function readJsonlLines(cwd, agentId) {
-  const path = sessionFilePath(cwd, agentId);
-  try {
-    const raw = await readFile(path, "utf8");
-    return raw.split("\n").filter((line) => line.length > 0);
-  } catch {
-    return [];
-  }
-}
-function warnMalformed(agentId, line) {
-  process.stderr.write(
-    `[theokit-sdk] skipping malformed line in messages.jsonl (${agentId}): ${line.slice(0, 80)}...
-`
-  );
-}
-function hydrateSessionLine(parsed) {
-  if (typeof parsed.text !== "string" || parsed.role === void 0) return void 0;
-  if (parsed.role === "user" || parsed.role === "assistant") {
-    return { role: parsed.role, text: parsed.text };
-  }
-  if (parsed.role === "tool_call" || parsed.role === "tool_result") {
-    const label = parsed.role === "tool_call" ? "tool call" : "tool result";
-    return { role: "assistant", text: `[${label}] ${parsed.text}` };
-  }
-  return void 0;
-}
-async function readSessionFile(cwd, agentId) {
-  const lines = await readJsonlLines(cwd, agentId);
-  const messages = [];
-  for (const line of lines) {
-    try {
-      const msg = hydrateSessionLine(JSON.parse(line));
-      if (msg !== void 0) messages.push(msg);
-    } catch {
-      warnMalformed(agentId, line);
-    }
-  }
-  return messages;
-}
-async function readAllPersistedMessages(cwd, agentId) {
-  const lines = await readJsonlLines(cwd, agentId);
-  const messages = [];
-  for (const line of lines) {
-    try {
-      const parsed = JSON.parse(line);
-      if (parsed.role !== void 0 && VALID_ROLES.has(parsed.role) && typeof parsed.text === "string") {
-        messages.push({
-          role: parsed.role,
-          text: parsed.text,
-          at: typeof parsed.at === "number" ? parsed.at : Date.now()
-        });
-      }
-    } catch {
-      warnMalformed(agentId, line);
-    }
-  }
-  return messages;
-}
-async function appendAnyPersistedMessage(cwd, agentId, record) {
-  await appendPersistedMessages(cwd, agentId, [record]);
-}
-async function appendPersistedMessages(cwd, agentId, records) {
-  if (records.length === 0) return;
-  const path = sessionFilePath(cwd, agentId);
-  const payload = records.map((r) => `${redactSecrets(JSON.stringify(r))}
-`).join("");
-  const dir = dirname(path);
-  let written = false;
-  const attempt = async () => {
-    await mkdir(dir, { recursive: true });
-    await withFileLock(path, async () => {
-      await appendFile(path, payload, "utf8");
-      written = true;
-    });
-  };
-  try {
-    await attempt();
-  } catch (cause) {
-    if (written || cause.code !== "ENOENT") throw cause;
-    await attempt();
-  }
-}
-async function rewriteLockedSession(path, transform) {
-  await withFileLock(path, async () => {
-    let raw;
-    try {
-      raw = await readFile(path, "utf8");
-    } catch {
-      return;
-    }
-    const lines = raw.split("\n").filter((line) => line.length > 0);
-    const next = transform(lines);
-    if (next === void 0) return;
-    await replaceFileAtomic(path, next);
-  });
-}
-async function compactSessionFile(cwd, agentId, maxTurns) {
-  const path = sessionFilePath(cwd, agentId);
-  if (!existsSync(path)) return;
-  await rewriteLockedSession(
-    path,
-    (lines) => lines.length <= maxTurns * 2 ? void 0 : `${lines.slice(-maxTurns).join("\n")}
-`
-  );
-}
-async function truncateSessionTo(cwd, agentId, keepCount) {
-  const path = sessionFilePath(cwd, agentId);
-  if (!existsSync(path)) return 0;
-  let kept = 0;
-  await rewriteLockedSession(path, (lines) => {
-    const keep = Math.max(0, Math.min(keepCount, lines.length));
-    kept = keep;
-    if (keep === lines.length) return void 0;
-    return keep === 0 ? "" : `${lines.slice(0, keep).join("\n")}
-`;
-  });
-  return kept;
-}
-
-// src/internal/persistence/pagination.ts
-function paginate(items, opts) {
-  if (opts === void 0 || opts.offset === void 0 && opts.limit === void 0) return items;
-  const start = Math.max(0, opts.offset ?? 0);
-  const end = opts.limit === void 0 ? items.length : start + Math.max(0, opts.limit);
-  return items.slice(start, end);
-}
-
-// src/internal/persistence/session-meta.ts
-function applyMetaPatch(current, patch) {
-  const next = {};
-  if (current.title !== void 0) next.title = current.title;
-  if (current.tag !== void 0) next.tag = current.tag;
-  if (patch.title === null) delete next.title;
-  else if (patch.title !== void 0) next.title = patch.title;
-  if (patch.tag === null) delete next.tag;
-  else if (patch.tag !== void 0) next.tag = patch.tag;
-  return next;
-}
-function coerceSessionMeta(raw) {
-  if (typeof raw !== "object" || raw === null) return void 0;
-  const obj = raw;
-  const meta = {};
-  if (typeof obj.title === "string") meta.title = obj.title;
-  if (typeof obj.tag === "string") meta.tag = obj.tag;
-  return meta.title === void 0 && meta.tag === void 0 ? void 0 : meta;
-}
-
-// src/internal/persistence/conversation-storage-fs.ts
-var FileSystemConversationStorage = class {
-  #root;
-  constructor(opts = {}) {
-    this.#root = opts.root ?? process.cwd();
-  }
-  /** Exposed for tests + diagnostics. The path is sanitized at use sites. */
-  get root() {
-    return this.#root;
-  }
-  async getMessages(conversationId, opts) {
-    const records = await readAllPersistedMessages(this.#root, conversationId);
-    const all = records.map(toStoredMessage);
-    return paginate(all, opts);
-  }
-  async appendMessage(conversationId, message) {
-    await appendAnyPersistedMessage(this.#root, conversationId, toRecord(message));
-  }
-  async appendMessages(conversationId, messages) {
-    await appendPersistedMessages(this.#root, conversationId, messages.map(toRecord));
-  }
-  async truncateConversation(conversationId, keepCount) {
-    return truncateSessionTo(this.#root, conversationId, keepCount);
-  }
-  async deleteConversation(conversationId) {
-    const safe3 = sanitizeIdentifier(conversationId, { maxLen: 128 });
-    const dirPath = safePathJoin(this.#root, ".theokit", "agents", safe3);
-    await rm(dirPath, { recursive: true, force: true });
-  }
-  async deleteScope(prefix) {
-    const ids = await this.listConversationIds();
-    const matching = ids.filter((id) => id.startsWith(prefix));
-    for (const id of matching) await this.deleteConversation(id);
-    return matching.length;
-  }
-  async listConversationIds(opts = {}) {
-    const agentsRoot = safePathJoin(this.#root, ".theokit", "agents");
-    let entries;
-    try {
-      entries = await readdir(agentsRoot);
-    } catch (cause) {
-      if (cause.code === "ENOENT") return [];
-      throw cause;
-    }
-    if (opts.limit !== void 0) return entries.slice(0, opts.limit);
-    return entries;
-  }
-  async compact(conversationId, maxTurns) {
-    await compactSessionFile(this.#root, conversationId, maxTurns);
-  }
-  // SE4 — session metadata persisted as a per-conversation sidecar
-  // `<root>/.theokit/agents/<safeId>/session.json` (same sanitized perimeter as
-  // the transcript). Kept separate from messages.jsonl so a title/tag write does
-  // not rewrite the append-only log.
-  #metaPath(conversationId) {
-    const safe3 = sanitizeIdentifier(conversationId, { maxLen: 128 });
-    return safePathJoin(this.#root, ".theokit", "agents", safe3, "session.json");
-  }
-  async getSessionMeta(conversationId) {
-    try {
-      const raw = await readFile(this.#metaPath(conversationId), "utf8");
-      return coerceSessionMeta(JSON.parse(raw));
-    } catch (cause) {
-      if (cause.code === "ENOENT") return void 0;
-      throw cause;
-    }
-  }
-  async setSessionMeta(conversationId, patch) {
-    const metaPath = this.#metaPath(conversationId);
-    await mkdir(dirname(metaPath), { recursive: true });
-    await withFileLock(metaPath, async () => {
-      let current = {};
-      try {
-        current = coerceSessionMeta(JSON.parse(await readFile(metaPath, "utf8"))) ?? {};
-      } catch (cause) {
-        if (cause.code !== "ENOENT") throw cause;
-      }
-      const next = applyMetaPatch(current, patch);
-      await writeFile(metaPath, redactSecrets(JSON.stringify(next)), "utf8");
-    });
-  }
-  async dispose() {
-  }
-};
-function toStoredMessage(record) {
-  return {
-    role: record.role,
-    content: record.text,
-    at: record.at
-  };
-}
-function toRecord(message) {
-  return { role: message.role, text: message.content, at: message.at ?? Date.now() };
-}
-
 // src/internal/runtime/session/agent-session.ts
+init_conversation_storage_fs();
+init_agent_session_store();
 var DEFAULT_MAX_TURNS = 200;
 var COMPACTION_CHECK_INTERVAL = 50;
 var sessions = /* @__PURE__ */ new Map();
@@ -7122,6 +7404,7 @@ function parseFrontmatterFields(frontmatter) {
 
 // src/internal/runtime/skills/discover-skills.ts
 init_errors();
+init_path_guard();
 
 // src/internal/runtime/skills/skill-frontmatter.ts
 init_errors();
@@ -8442,6 +8725,7 @@ function tokenizeContent(content) {
 // src/internal/runtime/plugins/plugins-manager.ts
 init_errors();
 init_markdown_config_loader();
+init_path_guard();
 init_hooks_source();
 var PluginFrontmatterSchema = z.object({
   /** Plugin identifier; defaults to folder name if omitted. */
@@ -10901,6 +11185,7 @@ function registerBuiltins() {
 init_errors();
 
 // src/internal/error-mappers/shared.ts
+init_security();
 var RAW_MAX_BYTES = 2048;
 function parseRetryAfter(headers) {
   if (headers === void 0) return void 0;
@@ -13032,6 +13317,7 @@ function selectTransport(profile, apiKey) {
 
 // src/internal/mcp/client.ts
 init_errors();
+init_path_guard();
 function createMcpClient(name, config, fetchImpl = fetch) {
   if (isStdio(config)) return new StdioMcpClient(name, config);
   return new HttpMcpClient(name, config, fetchImpl);
@@ -13741,6 +14027,9 @@ async function readProjectMcpServers(cwd) {
   }
 }
 
+// src/internal/runtime/local-agent/local-agent.ts
+init_local_agent_goal_extensions();
+
 // src/internal/runtime/local-agent/local-agent-invalidate.ts
 async function applyDeferredInvalidation(agentId, pending, refresh) {
   process.stderr.write(
@@ -16071,16 +16360,49 @@ async function localAgentUsePersonality(args) {
 init_local_agent_plugins();
 
 // src/internal/runtime/local-agent/local-agent-runtime-extensions.ts
-function localAgentRunUntil(agent, goal, options) {
+function pausedReason(kind, threadId) {
+  switch (kind) {
+    case "none":
+      return `no durable objective set for thread "${threadId}" \u2014 call setObjective() first`;
+    case "inert":
+      return `durable objective for thread "${threadId}" is inert \u2014 no judge resolved (set a judge to activate)`;
+    case "exhausted":
+      return `durable objective for thread "${threadId}" exhausted its run budget \u2014 raise maxRuns to resume`;
+  }
+}
+function localAgentRunUntil(agent, goal, options, durable) {
   async function* wrap() {
     const { runUntilImpl: runUntilImpl2 } = await Promise.resolve().then(() => (init_run_until(), run_until_exports));
-    const { judgeCallImpl: judgeCallImpl2 } = await Promise.resolve().then(() => (init_judge_call(), judge_call_exports));
-    const { getAgentFacade: getAgentFacade2 } = await Promise.resolve().then(() => (init_agent_factory_registry(), agent_factory_registry_exports));
-    const create = getAgentFacade2().create;
-    const deps = {
-      judge: async (ctx, opts) => judgeCallImpl2(ctx, opts, { create })
+    const buildDeps = async () => {
+      const { judgeCallImpl: judgeCallImpl2 } = await Promise.resolve().then(() => (init_judge_call(), judge_call_exports));
+      const { getAgentFacade: getAgentFacade2 } = await Promise.resolve().then(() => (init_agent_factory_registry(), agent_factory_registry_exports));
+      const create = getAgentFacade2().create;
+      return {
+        judge: (ctx, opts) => judgeCallImpl2(ctx, opts, { create })
+      };
     };
-    return yield* runUntilImpl2(agent, goal, options, deps);
+    if (goal !== void 0) {
+      return yield* runUntilImpl2(agent, goal, options, await buildDeps());
+    }
+    const threadId = options?.threadId;
+    if (durable === void 0 || threadId === void 0) {
+      const reason = "runUntil() called with no goal and no threadId \u2014 nothing to resolve a durable objective from";
+      yield { type: "status_change", status: "paused", reason };
+      return { status: "paused", turnsUsed: 0, finalResponse: void 0 };
+    }
+    const { resolveDurableRun: resolveDurableRun2, persistDurableProgress: persistDurableProgress2 } = await Promise.resolve().then(() => (init_local_agent_goal_extensions(), local_agent_goal_extensions_exports));
+    const resolved = await resolveDurableRun2(durable.handle, durable.goalConfig, threadId, options);
+    if (resolved.kind !== "run") {
+      yield {
+        type: "status_change",
+        status: "paused",
+        reason: pausedReason(resolved.kind, threadId)
+      };
+      return { status: "paused", turnsUsed: 0, finalResponse: void 0 };
+    }
+    const result = yield* runUntilImpl2(agent, resolved.goal, resolved.options, await buildDeps());
+    await persistDurableProgress2(durable.handle, threadId, result);
+    return result;
   }
   return wrap();
 }
@@ -16146,6 +16468,44 @@ function ponyfillAny(signals) {
   return ctrl.signal;
 }
 
+// src/internal/runtime/lifecycle/wrap-completion-check-run.ts
+function wrapRunWithCompletionCheck(args) {
+  const check = args.completionCheck;
+  if (check === void 0) return args.run;
+  const compute = async () => {
+    const result = await args.run.wait();
+    if (result.status !== "finished" || result.result === void 0) return result;
+    const judgeOpts = {};
+    if (check.judgeModel !== void 0) judgeOpts.judgeModel = check.judgeModel;
+    if (check.apiKey !== void 0) judgeOpts.apiKey = check.apiKey;
+    const verdict = await args.deps.judge(
+      { goal: check.criteria, lastResponse: result.result },
+      judgeOpts
+    );
+    const complete = !verdict.parseFailed && verdict.verdict === "done";
+    emitRunEvent(args.onRunEvent, {
+      type: "completion_check",
+      complete,
+      reason: verdict.reason
+    });
+    return {
+      ...result,
+      completionCheck: { complete, reason: verdict.reason, parseFailed: verdict.parseFailed }
+    };
+  };
+  let judged;
+  const wrappedWait = () => {
+    judged ??= compute();
+    return judged;
+  };
+  return new Proxy(args.run, {
+    get(target, prop, receiver) {
+      if (prop === "wait") return wrappedWait;
+      return Reflect.get(target, prop, receiver);
+    }
+  });
+}
+
 // src/internal/runtime/processors/run-processors.ts
 var ProcessorAbort = class {
   constructor(processorId, reason) {
@@ -16285,6 +16645,9 @@ function wrapRunWithOutputProcessors(args) {
   });
 }
 
+// src/internal/runtime/local-agent/local-agent-send.ts
+init_local_agent_goal_extensions();
+
 // src/internal/runtime/local-agent/local-agent-memory-hooks.ts
 var DEFAULT_MAX_RECALL_BYTES = 16e3;
 async function applyPreUserSendHook(args) {
@@ -16400,6 +16763,11 @@ async function executeSendLocked(inputs, message, options) {
     memoryFacts,
     activeMemorySummary
   );
+  const projectedSystemPrompt = await projectCurrentObjective(
+    inputs.storageHandle,
+    options.objectiveThreadId,
+    assembledSystemPrompt
+  );
   const composedOptions = {
     ...options,
     signal: anySignal([options.signal, inputs.lifecycleAbortController.signal])
@@ -16407,7 +16775,7 @@ async function executeSendLocked(inputs, message, options) {
   const run = await inputs.dispatchRun(
     adaptedMessage,
     composedOptions,
-    assembledSystemPrompt,
+    projectedSystemPrompt,
     memoryFacts,
     priorMessages,
     memoryTools,
@@ -16420,18 +16788,43 @@ async function executeSendLocked(inputs, message, options) {
     agentId: inputs.agentId,
     onRunEvent: options.onRunEvent
   }) : run;
-  return wrapRunWithPostReplyHook({
+  const hookedRun = wrapRunWithPostReplyHook({
     pluginManager: inputs.pluginManagerCode,
     agentId: inputs.agentId,
     options: inputs.options,
     run: processedRun,
     userText
   });
+  return wrapRunWithCompletionCheck({
+    run: hookedRun,
+    completionCheck: options.completionCheck,
+    onRunEvent: options.onRunEvent,
+    deps: buildCompletionCheckDeps()
+  });
+}
+function buildCompletionCheckDeps() {
+  return {
+    judge: async (ctx, opts) => {
+      const { judgeCallImpl: judgeCallImpl2 } = await Promise.resolve().then(() => (init_judge_call(), judge_call_exports));
+      const { getAgentFacade: getAgentFacade2 } = await Promise.resolve().then(() => (init_agent_factory_registry(), agent_factory_registry_exports));
+      return judgeCallImpl2(ctx, opts, { create: getAgentFacade2().create });
+    }
+  };
 }
 function readMemoryForSend(workspaceCwd, memoryConfig) {
   if (memoryConfig?.enabled !== true) return Promise.resolve([]);
   return safeCall(() => readMemoryFacts(workspaceCwd, memoryConfig), [], "memory read");
 }
+async function projectCurrentObjective(storageHandle, objectiveThreadId, assembled) {
+  if (objectiveThreadId === void 0) return assembled;
+  const objective = await safeCall(
+    () => resolveCurrentObjectiveText(storageHandle, objectiveThreadId),
+    void 0,
+    "objective projection"
+  );
+  if (objective === void 0) return assembled;
+  return formatObjectiveProjection(objective, assembled);
+}
 
 // src/internal/runtime/local-agent/local-agent-task-wrap.ts
 init_registry();
@@ -16794,20 +17187,33 @@ var LocalAgent = class {
       ...opts !== void 0 ? { opts } : {}
     });
   }
+  // biome-ignore format: G8 budget — artifact stubs (local agents have no artifacts); kept 1-line each.
   listArtifacts() {
     return Promise.resolve([]);
   }
+  // biome-ignore format: G8 budget — see listArtifacts.
   downloadArtifact(_path) {
-    return Promise.reject(
-      new UnsupportedRunOperationError(
-        "Artifacts are not supported for local agents",
-        "downloadArtifact"
-      )
-    );
+    return Promise.reject(new UnsupportedRunOperationError("Artifacts are not supported for local agents", "downloadArtifact"));
   }
   // biome-ignore format: G8 budget — both methods delegate to `local-agent-runtime-extensions.ts`; signatures kept as 1-line each.
   runUntil(goal, options) {
-    return localAgentRunUntil(this, goal, options);
+    return localAgentRunUntil(this, goal, options, { handle: this.storageHandle(), goalConfig: this.options.goal });
+  }
+  // biome-ignore format: SE33 G8 budget — objective methods delegate to `local-agent-goal-extensions.ts`.
+  setObjective(objective, opts) {
+    return localAgentSetObjective(this.storageHandle(), objective, opts);
+  }
+  // biome-ignore format: SE33 G8 budget — see setObjective above.
+  getObjective(opts) {
+    return localAgentGetObjective(this.storageHandle(), opts);
+  }
+  // biome-ignore format: SE33 G8 budget — see setObjective above.
+  updateObjectiveOptions(opts) {
+    return localAgentUpdateObjectiveOptions(this.storageHandle(), opts);
+  }
+  // biome-ignore format: SE33 G8 budget — see setObjective above.
+  clearObjective(opts) {
+    return localAgentClearObjective(this.storageHandle(), opts);
   }
   // biome-ignore format: G8 budget — see runUntil comment above.
   fork(options) {