@usecontextlayer/ctxs 0.5.23 → 0.5.25

package/dist/cli.mjs

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5c792d56-554a-5d58-8c1b-518f322339f4")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3205b84e-0fd0-5843-a715-326779c52b1a")}catch(e){}}();
 import { createRequire } from "node:module";
 import * as Sentry from "@sentry/node";
 import * as fs$2 from "node:fs/promises";
 import { access, mkdir, mkdtemp, open, readFile, readdir, realpath, rename, rm, stat, writeFile } from "node:fs/promises";
 import path, { sep } from "node:path";
-import childProcess, { execFile } from "node:child_process";
+import childProcess, { execFile, spawn } from "node:child_process";
 import { formatWithOptions, promisify, stripVTControlCharacters } from "node:util";
-import { randomUUID } from "node:crypto";
+import { randomBytes, randomInt, randomUUID } from "node:crypto";
 import { serve, upgradeWebSocket } from "@hono/node-server";
 import { Hono } from "hono";
 import { cors } from "hono/cors";
@@ -642,7 +642,7 @@ const _safeParseAsync$1 = (_Err) => async (schema, value, _ctx) => {
 	};
 };
 const safeParseAsync$4 = /* @__PURE__*/ _safeParseAsync$1($ZodRealError$1);
-const _encode$1 = (_Err) => (schema, value, _ctx) => {
+const _encode$2 = (_Err) => (schema, value, _ctx) => {
 	const ctx = _ctx ? {
 		..._ctx,
 		direction: "backward"
@@ -3851,7 +3851,7 @@ const parse$3 = /* @__PURE__ */ _parse$1(ZodRealError$1);
 const parseAsync$1 = /* @__PURE__ */ _parseAsync$1(ZodRealError$1);
 const safeParse$3 = /* @__PURE__ */ _safeParse$1(ZodRealError$1);
 const safeParseAsync$3 = /* @__PURE__ */ _safeParseAsync$1(ZodRealError$1);
-const encode$2 = /* @__PURE__ */ _encode$1(ZodRealError$1);
+const encode$3 = /* @__PURE__ */ _encode$2(ZodRealError$1);
 const decode$3 = /* @__PURE__ */ _decode$1(ZodRealError$1);
 const encodeAsync$1 = /* @__PURE__ */ _encodeAsync$1(ZodRealError$1);
 const decodeAsync$1 = /* @__PURE__ */ _decodeAsync$1(ZodRealError$1);
@@ -3913,7 +3913,7 @@ const ZodType$2 = /*@__PURE__*/ $constructor$1("ZodType", (inst, def) => {
 	inst.parseAsync = async (data, params) => parseAsync$1(inst, data, params, { callee: inst.parseAsync });
 	inst.safeParseAsync = async (data, params) => safeParseAsync$3(inst, data, params);
 	inst.spa = inst.safeParseAsync;
-	inst.encode = (data, params) => encode$2(inst, data, params);
+	inst.encode = (data, params) => encode$3(inst, data, params);
 	inst.decode = (data, params) => decode$3(inst, data, params);
 	inst.encodeAsync = async (data, params) => encodeAsync$1(inst, data, params);
 	inst.decodeAsync = async (data, params) => decodeAsync$1(inst, data, params);
@@ -4418,7 +4418,7 @@ function strictObject$1(shape, params) {
 		...normalizeParams$1(params)
 	});
 }
-function looseObject(shape, params) {
+function looseObject$1(shape, params) {
 	return new ZodObject$2({
 		type: "object",
 		shape,
@@ -4788,7 +4788,7 @@ function normalizedKey(event) {
 
 //#endregion
 //#region package.json
-var version$1 = "0.5.23";
+var version$1 = "0.5.25";
 
 //#endregion
 //#region sentry.ts
@@ -4969,6 +4969,16 @@ function createGuestMemoryProbe(readMetrics) {
 function isNodeError(error) {
 	return error instanceof Error && "code" in error;
 }
+function createSandboxDisposer(input) {
+	let disposePromise = null;
+	return () => {
+		if (disposePromise === null) {
+			input.stopMemoryProbe();
+			disposePromise = input.stopSandbox();
+		}
+		return disposePromise;
+	};
+}
 async function ensureHostFilesystemReady(bindMounts) {
 	for (const mount of bindMounts) {
 		if (mount.hostPathBehavior === "createDir") {
@@ -5008,8 +5018,13 @@ async function bootSandbox(microsandboxLib, config) {
 	});
 	builder = builder.network((nb) => nb.policy(microsandboxLib.NetworkPolicy.allowAll()));
 	const sandbox = await builder.create();
+	const guestMemory = createGuestMemoryProbe(() => sandbox.metrics());
 	return {
-		guestMemory: createGuestMemoryProbe(() => sandbox.metrics()),
+		dispose: createSandboxDisposer({
+			stopMemoryProbe: guestMemory.stop,
+			stopSandbox: () => sandbox.stopWithTimeout(SANDBOX_STOP_TIMEOUT_MS)
+		}),
+		guestMemory,
 		sandbox
 	};
 }
@@ -5118,7 +5133,7 @@ function guestGitEnv(input) {
 		name: input.sub
 	}), entries);
 }
-const execFileAsync = promisify(execFile);
+const execFileAsync$1 = promisify(execFile);
 const CAPTURE_AUTHOR_NAME = "contextlayer";
 const CAPTURE_AUTHOR_EMAIL = "noreply@usecontextlayer.com";
 const BRANCH = "main";
@@ -5281,7 +5296,7 @@ async function runGit(args, options = {}) {
 		})
 	};
 	try {
-		const { stdout, stderr } = await execFileAsync("git", args, {
+		const { stdout, stderr } = await execFileAsync$1("git", args, {
 			cwd: options.cwd,
 			env
 		});
@@ -6439,7 +6454,7 @@ const _safeParseAsync = (_Err) => async (schema, value, _ctx) => {
 	};
 };
 const safeParseAsync$1 = /* @__PURE__*/ _safeParseAsync($ZodRealError);
-const _encode = (_Err) => (schema, value, _ctx) => {
+const _encode$1 = (_Err) => (schema, value, _ctx) => {
 	const ctx = _ctx ? {
 		..._ctx,
 		direction: "backward"
@@ -9025,7 +9040,7 @@ const parse$2 = /* @__PURE__ */ _parse(ZodRealError);
 const parseAsync = /* @__PURE__ */ _parseAsync(ZodRealError);
 const safeParse$2 = /* @__PURE__ */ _safeParse(ZodRealError);
 const safeParseAsync$2 = /* @__PURE__ */ _safeParseAsync(ZodRealError);
-const encode$1 = /* @__PURE__ */ _encode(ZodRealError);
+const encode$2 = /* @__PURE__ */ _encode$1(ZodRealError);
 const decode$2 = /* @__PURE__ */ _decode(ZodRealError);
 const encodeAsync = /* @__PURE__ */ _encodeAsync(ZodRealError);
 const decodeAsync = /* @__PURE__ */ _decodeAsync(ZodRealError);
@@ -9084,7 +9099,7 @@ const ZodType$1 = /*@__PURE__*/ $constructor("ZodType", (inst, def) => {
 	inst.parseAsync = async (data, params) => parseAsync(inst, data, params, { callee: inst.parseAsync });
 	inst.safeParseAsync = async (data, params) => safeParseAsync$2(inst, data, params);
 	inst.spa = inst.safeParseAsync;
-	inst.encode = (data, params) => encode$1(inst, data, params);
+	inst.encode = (data, params) => encode$2(inst, data, params);
 	inst.decode = (data, params) => decode$2(inst, data, params);
 	inst.encodeAsync = async (data, params) => encodeAsync(inst, data, params);
 	inst.decodeAsync = async (data, params) => decodeAsync(inst, data, params);
@@ -9499,6 +9514,14 @@ function strictObject(shape, params) {
 		...normalizeParams(params)
 	});
 }
+function looseObject(shape, params) {
+	return new ZodObject$1({
+		type: "object",
+		shape,
+		catchall: unknown$2(),
+		...normalizeParams(params)
+	});
+}
 const ZodUnion$1 = /*@__PURE__*/ $constructor("ZodUnion", (inst, def) => {
 	$ZodUnion.init(inst, def);
 	ZodType$1.init(inst, def);
@@ -9831,7 +9854,7 @@ function superRefine(fn, params) {
 			freshness: {
 				props: {
 					text: { $concat: ["Updated ", { $relativeDay: {
-						now: { $state: "/now" },
+						today: { $state: "/today" },
 						value: { $maxBy: {
 							field: "last_updated",
 							items: { $state: "/items" }
@@ -9938,6 +9961,11 @@ const sessionMetaSchema$1 = object$3({
 	sessionId: string$4()
 });
 record$1(string$4(), sessionMetaSchema$1);
+looseObject({
+	timestamp: string$4().optional(),
+	type: string$4(),
+	uuid: string$4().optional()
+});
 async function ensureWorkspaceCheckout(workspaceId, ctx) {
 	const repo = await resolveRepo({
 		platformUrl: ctx.platformUrl,
@@ -13300,7 +13328,7 @@ function concat(...buffers) {
 	}
 	return buf;
 }
-function encode(string) {
+function encode$1(string) {
 	const bytes = new Uint8Array(string.length);
 	for (let i = 0; i < string.length; i++) {
 		const code = string.charCodeAt(i);
@@ -14021,7 +14049,7 @@ async function flattenedVerify(jws, key, options) {
 		resolvedKey = true;
 	}
 	checkKeyType(alg, key, "verify");
-	const data = concat(jws.protected !== void 0 ? encode(jws.protected) : new Uint8Array(), encode("."), typeof jws.payload === "string" ? b64 ? encode(jws.payload) : encoder.encode(jws.payload) : jws.payload);
+	const data = concat(jws.protected !== void 0 ? encode$1(jws.protected) : new Uint8Array(), encode$1("."), typeof jws.payload === "string" ? b64 ? encode$1(jws.payload) : encoder.encode(jws.payload) : jws.payload);
 	const signature = decodeBase64url(jws.signature, "signature", JWSInvalid);
 	const k = await normalizeKey$1(key, alg);
 	if (!await verify(alg, k, signature, data)) throw new JWSSignatureVerificationFailed();
@@ -14636,6 +14664,99 @@ function createDevJwtVerifier() {
 	};
 }
 
+//#endregion
+//#region ../../node_modules/.pnpm/js-base64@3.9.1/node_modules/js-base64/base64.mjs
+const _TD = typeof TextDecoder === "function" ? new TextDecoder("utf-8", { ignoreBOM: true }) : void 0;
+const _TE = typeof TextEncoder === "function" ? new TextEncoder() : void 0;
+const b64chs = Array.prototype.slice.call("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=");
+const b64tab = ((a) => {
+	let tab = {};
+	a.forEach((c, i) => tab[c] = i);
+	return tab;
+})(b64chs);
+const b64re = /^(?:[A-Za-z\d+\/]{4})*?(?:[A-Za-z\d+\/]{2}(?:==)?|[A-Za-z\d+\/]{3}=?)?$/;
+const _fromCC = String.fromCharCode.bind(String);
+const _U8Afrom = typeof Uint8Array.from === "function" ? Uint8Array.from.bind(Uint8Array) : (it) => new Uint8Array(Array.prototype.slice.call(it, 0));
+const _mkUriSafe = (src) => src.replace(/=/g, "").replace(/[+\/]/g, (m0) => m0 == "+" ? "-" : "_");
+const _tidyB64 = (s) => s.replace(/[^A-Za-z0-9\+\/]/g, "");
+/**
+* polyfill version of `btoa`
+*/
+const btoaPolyfill = (bin) => {
+	let u32, c0, c1, c2, asc = "";
+	const pad = bin.length % 3;
+	for (let i = 0; i < bin.length;) {
+		if ((c0 = bin.charCodeAt(i++)) > 255 || (c1 = bin.charCodeAt(i++)) > 255 || (c2 = bin.charCodeAt(i++)) > 255) throw new TypeError("invalid character found");
+		u32 = c0 << 16 | c1 << 8 | c2;
+		asc += b64chs[u32 >> 18 & 63] + b64chs[u32 >> 12 & 63] + b64chs[u32 >> 6 & 63] + b64chs[u32 & 63];
+	}
+	return pad ? asc.slice(0, pad - 3) + "===".substring(pad) : asc;
+};
+/**
+* does what `window.btoa` of web browsers do.
+* @param {String} bin binary string
+* @returns {string} Base64-encoded string
+*/
+const _btoa = typeof btoa === "function" ? (bin) => btoa(bin) : btoaPolyfill;
+const _fromUint8Array = typeof Uint8Array.prototype.toBase64 === "function" ? (u8a) => u8a.toBase64() : (u8a) => {
+	const maxargs = 4096;
+	let strs = [];
+	for (let i = 0, l = u8a.length; i < l; i += maxargs) strs.push(_fromCC.apply(null, u8a.subarray(i, i + maxargs)));
+	return _btoa(strs.join(""));
+};
+const cb_utob = (c) => {
+	if (c.length < 2) {
+		var cc = c.charCodeAt(0);
+		return cc < 128 ? c : cc < 2048 ? _fromCC(192 | cc >>> 6) + _fromCC(128 | cc & 63) : _fromCC(224 | cc >>> 12 & 15) + _fromCC(128 | cc >>> 6 & 63) + _fromCC(128 | cc & 63);
+	} else {
+		var cc = 65536 + (c.charCodeAt(0) - 55296) * 1024 + (c.charCodeAt(1) - 56320);
+		return _fromCC(240 | cc >>> 18 & 7) + _fromCC(128 | cc >>> 12 & 63) + _fromCC(128 | cc >>> 6 & 63) + _fromCC(128 | cc & 63);
+	}
+};
+const re_utob = /[\uD800-\uDBFF][\uDC00-\uDFFFF]|[^\x00-\x7F]/g;
+/**
+* @deprecated should have been internal use only.
+* @param {string} src UTF-8 string
+* @returns {string} UTF-16 string
+*/
+const utob = (u) => u.replace(re_utob, cb_utob);
+const _encode = _TE ? (s) => _fromUint8Array(_TE.encode(s)) : (s) => _btoa(utob(s));
+/**
+* converts a UTF-8-encoded string to a Base64 string.
+* @param {boolean} [urlsafe] if `true` make the result URL-safe
+* @returns {string} Base64 string
+*/
+const encode = (src, urlsafe = false) => urlsafe ? _mkUriSafe(_encode(src)) : _encode(src);
+/**
+* converts a UTF-8-encoded string to URL-safe Base64 RFC4648 §5.
+* @returns {string} Base64 string
+*/
+const encodeURI$1 = (src) => encode(src, true);
+/**
+* polyfill version of `atob`
+*/
+const atobPolyfill = (asc) => {
+	asc = asc.replace(/\s+/g, "");
+	if (!b64re.test(asc)) throw new TypeError("malformed base64.");
+	asc += "==".slice(2 - (asc.length & 3));
+	let u24, r1, r2;
+	let binArray = [];
+	for (let i = 0; i < asc.length;) {
+		u24 = b64tab[asc.charAt(i++)] << 18 | b64tab[asc.charAt(i++)] << 12 | (r1 = b64tab[asc.charAt(i++)]) << 6 | (r2 = b64tab[asc.charAt(i++)]);
+		if (r1 === 64) binArray.push(_fromCC(u24 >> 16 & 255));
+		else if (r2 === 64) binArray.push(_fromCC(u24 >> 16 & 255, u24 >> 8 & 255));
+		else binArray.push(_fromCC(u24 >> 16 & 255, u24 >> 8 & 255, u24 & 255));
+	}
+	return binArray.join("");
+};
+/**
+* does what `window.atob` of web browsers do.
+* @param {String} asc Base64-encoded string
+* @returns {string} binary string
+*/
+const _atob = typeof atob === "function" ? (asc) => atob(_tidyB64(asc)) : atobPolyfill;
+const _toUint8Array = typeof Uint8Array.fromBase64 === "function" ? (a) => Uint8Array.fromBase64(a) : (a) => _U8Afrom(_atob(a).split("").map((c) => c.charCodeAt(0)));
+
 //#endregion
 //#region ../slate-shared/dist/index.mjs
 const INBOX_DOCS_TREE = {
@@ -14781,6 +14902,8 @@ export default async ({ docs }) => {
 		},
 		{ sort },
 	)
+	// This neutral dev fixture has no customer timezone, so its calendar day is UTC.
+	const today = new Date().toISOString().slice(0, 10)
 	const items = rows.map((u) => {
 		const proposedTitle = u.proposed_title ?? ""
 		const separatorIndex = proposedTitle.indexOf(" - ")
@@ -14798,7 +14921,7 @@ export default async ({ docs }) => {
 					: proposedTitle || u.path,
 		}
 	})
-	return { items }
+	return { items, today }
 }
 `,
 	"docs/views/inbox.render-spec.json": `${JSON.stringify({
@@ -14808,7 +14931,7 @@ export default async ({ docs }) => {
 				freshness: {
 					props: {
 						text: { $concat: ["Updated ", { $relativeDay: {
-							now: { $state: "/now" },
+							today: { $state: "/today" },
 							value: { $maxBy: {
 								field: "last_updated",
 								items: { $state: "/items" }
@@ -14892,7 +15015,24 @@ export default async ({ docs }) => {
 		}
 	}, null, "	")}\n`
 };
+const DEV_IDENTITY = {
+	email: "joeblack@gmail.com",
+	name: "Joe Black",
+	sub: "user-dev"
+};
 const docPathSchema = string$5().min(1, "a doc path must be non-empty").refine((docPath) => !docPath.startsWith("/"), { message: "a doc path must be root-relative, not absolute" }).refine((docPath) => !docPath.split("/").includes(".."), { message: "a doc path must not contain a '..' segment" });
+function encodeBase64UrlJson(value) {
+	return encodeURI$1(JSON.stringify(value));
+}
+function mintUnsignedCtxToken(sub) {
+	return `${encodeBase64UrlJson({
+		alg: "none",
+		typ: "JWT"
+	})}.${encodeBase64UrlJson({
+		aud: "ctx",
+		sub
+	})}.`;
+}
 const renderSpecSchema = strictObject$1({
 	params: record$2(string$5().min(1), strictObject$1({ default: string$5().min(1) })).optional().describe("URL search params this surface accepts, each with its default. Resolution is `URL value ?? default`; the default is stripped back out of the URL, and an undeclared URL key is ignored. What a value MEANS — which are legal, what each expands to — is the loader's job, in JS."),
 	render: unknown$3().describe("The render tree — a @json-render Spec. Its elements name the components and directives published under `components` and `directives` in this artifact, and those contracts govern what each element may carry. This envelope does not constrain the tree's contents.")
@@ -14917,6 +15057,40 @@ const sessionMetaSchema = object$4({
 	sessionId: string$5()
 });
 const claudeIndexSchema = record$2(string$5(), sessionMetaSchema);
+const sessionStoreEntrySchema = looseObject$1({
+	timestamp: string$5().optional(),
+	type: string$5(),
+	uuid: string$5().optional()
+});
+function parseSessionStoreJsonl(jsonl, malformedEntryPolicy) {
+	const entries = [];
+	for (const [index, line] of jsonl.split("\n").entries()) {
+		if (line.trim() === "") continue;
+		try {
+			const parsed = JSON.parse(line);
+			entries.push(malformedEntryPolicy === "throw" ? sessionStoreEntrySchema.parse(parsed) : parsed);
+		} catch (cause) {
+			if (malformedEntryPolicy === "skip") continue;
+			throw new Error(`invalid session transcript entry at line ${index + 1}`, { cause });
+		}
+	}
+	return entries;
+}
+function singleSessionStore(sessionId, entries) {
+	return {
+		append: () => {
+			throw new Error("singleSessionStore is read-only; append() is not supported");
+		},
+		listSessions: async () => [{
+			mtime: 0,
+			sessionId
+		}],
+		load: async (key) => {
+			if (key.sessionId !== sessionId || key.subpath) return null;
+			return entries;
+		}
+	};
+}
 
 //#endregion
 //#region ../../node_modules/.pnpm/undici@8.8.0/node_modules/undici/lib/core/symbols.js
@@ -40450,7 +40624,7 @@ const SafeUrlSchema = url().superRefine((val, ctx) => {
 /**
 * RFC 9728 OAuth Protected Resource Metadata
 */
-const OAuthProtectedResourceMetadataSchema = looseObject({
+const OAuthProtectedResourceMetadataSchema = looseObject$1({
 	resource: string$5().url(),
 	authorization_servers: array$1(SafeUrlSchema).optional(),
 	jwks_uri: string$5().url().optional(),
@@ -40469,7 +40643,7 @@ const OAuthProtectedResourceMetadataSchema = looseObject({
 /**
 * RFC 8414 OAuth 2.0 Authorization Server Metadata
 */
-const OAuthMetadataSchema = looseObject({
+const OAuthMetadataSchema = looseObject$1({
 	issuer: string$5(),
 	authorization_endpoint: SafeUrlSchema,
 	token_endpoint: SafeUrlSchema,
@@ -40494,7 +40668,7 @@ const OAuthMetadataSchema = looseObject({
 * OpenID Connect Discovery 1.0 Provider Metadata
 * see: https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata
 */
-const OpenIdProviderMetadataSchema = looseObject({
+const OpenIdProviderMetadataSchema = looseObject$1({
 	issuer: string$5(),
 	authorization_endpoint: SafeUrlSchema,
 	token_endpoint: SafeUrlSchema,
@@ -40729,7 +40903,7 @@ const CursorSchema = string$5();
 /**
 * Task creation parameters, used to ask that the server create a task to represent a request.
 */
-const TaskCreationParamsSchema = looseObject({
+const TaskCreationParamsSchema = looseObject$1({
 	/**
 	* Requested duration in milliseconds to retain task from creation.
 	*/
@@ -40745,7 +40919,7 @@ const TaskMetadataSchema = object$4({ ttl: number$4().optional() });
 * Include this in the `_meta` field under the key `io.modelcontextprotocol/related-task`.
 */
 const RelatedTaskMetadataSchema = object$4({ taskId: string$5() });
-const RequestMetaSchema = looseObject({
+const RequestMetaSchema = looseObject$1({
 	/**
 	* If specified, the caller is requesting out-of-band progress notifications for this request (as represented by notifications/progress). The value of this parameter is an opaque token that will be attached to any subsequent notifications. The receiver is not obligated to provide these notifications.
 	*/
@@ -40797,7 +40971,7 @@ const NotificationSchema = object$4({
 	method: string$5(),
 	params: NotificationsParamsSchema.loose().optional()
 });
-const ResultSchema = looseObject({ 
+const ResultSchema = looseObject$1({ 
 /**
 * See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
 * for notes on _meta usage.
@@ -41011,7 +41185,7 @@ const ElicitationCapabilitySchema = preprocess$1((value) => {
 /**
 * Task capabilities for clients, indicating which request types support task creation.
 */
-const ClientTasksCapabilitySchema = looseObject({
+const ClientTasksCapabilitySchema = looseObject$1({
 	/**
 	* Present if the client supports listing tasks.
 	*/
@@ -41023,21 +41197,21 @@ const ClientTasksCapabilitySchema = looseObject({
 	/**
 	* Capabilities for task creation on specific request types.
 	*/
-	requests: looseObject({
+	requests: looseObject$1({
 		/**
 		* Task support for sampling requests.
 		*/
-		sampling: looseObject({ createMessage: AssertObjectSchema.optional() }).optional(),
+		sampling: looseObject$1({ createMessage: AssertObjectSchema.optional() }).optional(),
 		/**
 		* Task support for elicitation requests.
 		*/
-		elicitation: looseObject({ create: AssertObjectSchema.optional() }).optional()
+		elicitation: looseObject$1({ create: AssertObjectSchema.optional() }).optional()
 	}).optional()
 });
 /**
 * Task capabilities for servers, indicating which request types support task creation.
 */
-const ServerTasksCapabilitySchema = looseObject({
+const ServerTasksCapabilitySchema = looseObject$1({
 	/**
 	* Present if the server supports listing tasks.
 	*/
@@ -41049,11 +41223,11 @@ const ServerTasksCapabilitySchema = looseObject({
 	/**
 	* Capabilities for task creation on specific request types.
 	*/
-	requests: looseObject({ 
+	requests: looseObject$1({ 
 	/**
 	* Task support for tool requests.
 	*/
-tools: looseObject({ call: AssertObjectSchema.optional() }).optional() }).optional()
+tools: looseObject$1({ call: AssertObjectSchema.optional() }).optional() }).optional()
 });
 /**
 * Capabilities a client may support. Known capabilities are defined here, in this schema, but this is not a closed set: any client can define its own, additional capabilities.
@@ -41434,7 +41608,7 @@ const ResourceSchema = object$4({
 	* See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
 	* for notes on _meta usage.
 	*/
-	_meta: optional$3(looseObject({}))
+	_meta: optional$3(looseObject$1({}))
 });
 /**
 * A template description for resources available on the server.
@@ -41464,7 +41638,7 @@ const ResourceTemplateSchema = object$4({
 	* See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
 	* for notes on _meta usage.
 	*/
-	_meta: optional$3(looseObject({}))
+	_meta: optional$3(looseObject$1({}))
 });
 /**
 * Sent from the client to request a list of resources the server has.
@@ -41577,7 +41751,7 @@ const PromptSchema = object$4({
 	* See [MCP specification](https://github.com/modelcontextprotocol/modelcontextprotocol/blob/47339c03c143bb4ec01a26e721a1b8fe66634ebe/docs/specification/draft/basic/index.mdx#general-fields)
 	* for notes on _meta usage.
 	*/
-	_meta: optional$3(looseObject({}))
+	_meta: optional$3(looseObject$1({}))
 });
 /**
 * Sent from the client to request a list of prompts and prompt templates the server has.
@@ -42513,7 +42687,7 @@ function assertCompleteRequestResourceTemplate(request) {
 /**
 * The server's response to a completion/complete request
 */
-const CompleteResultSchema = ResultSchema.extend({ completion: looseObject({
+const CompleteResultSchema = ResultSchema.extend({ completion: looseObject$1({
 	/**
 	* An array of completion values. Must not exceed 100 items.
 	*/
@@ -58964,7 +59138,7 @@ function createScheduleApiClient(config) {
 		})
 	};
 }
-const SERVER_VERSION = "0.5.23";
+const SERVER_VERSION = "0.5.25";
 /** The most operations one OperationSet will carry. The service's own ceiling. */
 const MAX_OPERATIONS = 200;
 /**
@@ -95483,6 +95657,9 @@ function stemOf(relPath) {
 function isMarkdownPath(relPath) {
 	return normalizeRelativePath(relPath).endsWith(".md");
 }
+function isVisibleIndexPath(relPath) {
+	return normalizeRelativePath(relPath).split("/").every((segment) => !segment.startsWith("."));
+}
 function escapesIndexRoot(target) {
 	return normalizedPathEscapesRoot(normalizeAuthoredPath(target));
 }
@@ -95559,26 +95736,6 @@ function unique(values) {
 function uniqueSorted(values) {
 	return unique(values).sort(comparePath);
 }
-function computeBacklinks(docs) {
-	const backlinks = /* @__PURE__ */ new Map();
-	for (const doc of docs) backlinks.set(normalizeLinkTarget(doc.path), backlinks.get(normalizeLinkTarget(doc.path)) ?? []);
-	for (const doc of docs) {
-		const targets = new Set([...doc.outgoingLinks, ...Object.values(doc.relationships).flat()]);
-		for (const target of targets) {
-			const normalized = normalizeLinkTarget(target);
-			addBacklink(backlinks, normalized, doc.path);
-			const resolved = resolveWikilink(normalized, docs);
-			if (resolved) addBacklink(backlinks, normalizeLinkTarget(resolved.path), doc.path);
-		}
-	}
-	for (const [target, sources] of backlinks) backlinks.set(target, sources.sort(comparePath));
-	return backlinks;
-}
-function addBacklink(backlinks, target, source) {
-	const sources = backlinks.get(target) ?? [];
-	if (!sources.includes(source)) sources.push(source);
-	backlinks.set(target, sources);
-}
 const MDAST_OPTIONS = {
 	extensions: [frontmatter()],
 	mdastExtensions: [frontmatterFromMarkdown()]
@@ -95662,6 +95819,26 @@ function extractRelationships(frontmatter) {
 	}
 	return relationships;
 }
+function computeBacklinks(docs) {
+	const backlinks = /* @__PURE__ */ new Map();
+	for (const doc of docs) backlinks.set(normalizeLinkTarget(doc.path), backlinks.get(normalizeLinkTarget(doc.path)) ?? []);
+	for (const doc of docs) {
+		const targets = new Set([...doc.outgoingLinks, ...Object.values(doc.relationships).flat()]);
+		for (const target of targets) {
+			const normalized = normalizeLinkTarget(target);
+			addBacklink(backlinks, normalized, doc.path);
+			const resolved = resolveWikilink(normalized, docs);
+			if (resolved) addBacklink(backlinks, normalizeLinkTarget(resolved.path), doc.path);
+		}
+	}
+	for (const [target, sources] of backlinks) backlinks.set(target, sources.sort(comparePath));
+	return backlinks;
+}
+function addBacklink(backlinks, target, source) {
+	const sources = backlinks.get(target) ?? [];
+	if (!sources.includes(source)) sources.push(source);
+	backlinks.set(target, sources);
+}
 const RESERVED = new Set([
 	"type",
 	"title",
@@ -95964,7 +96141,7 @@ var Docs = class {
 		const dirents = await this.fs.readdir(absDir, { withFileTypes: true });
 		for (const dirent of dirents) {
 			const relPath = normalizeRelativePath(posixJoin(relDir, dirent.name));
-			if (dirent.name.startsWith(".")) continue;
+			if (!isVisibleIndexPath(relPath)) continue;
 			if (dirent.isDirectory()) {
 				const child = await this.walk(this.abs(relPath), relPath);
 				markdownFiles.push(...child.markdownFiles);
@@ -97934,7 +98111,82 @@ function osUsername() {
 }
 
 //#endregion
-//#region ../slate-bridge/dist/goldens-CkMPmJl8.mjs
+//#region ../db-infra/dist/postgres-DrlDW_Ri.mjs
+const env$2 = { NODE_ENV: process.env.NODE_ENV };
+
+//#endregion
+//#region ../db-infra/dist/ephemeral.mjs
+const PG_HOST = "postgres://postgres:postgres@127.0.0.1:6489";
+const ADMIN_URL = `${PG_HOST}/postgres`;
+async function createEphemeralDatabase(baseName) {
+	const name = `${baseName}_${randomBytes(4).toString("hex")}`;
+	const admin = src_default(ADMIN_URL, { max: 1 });
+	try {
+		await admin.unsafe(`CREATE DATABASE ${name}`);
+	} finally {
+		await admin.end();
+	}
+	return {
+		async drop() {
+			const admin2 = src_default(ADMIN_URL, { max: 1 });
+			try {
+				await admin2`SELECT pg_terminate_backend(pid) FROM pg_stat_activity
+					WHERE datname = ${name} AND pid <> pg_backend_pid()`;
+				await admin2.unsafe(`DROP DATABASE IF EXISTS ${name}`);
+			} finally {
+				await admin2.end();
+			}
+		},
+		url: `${PG_HOST}/${name}`
+	};
+}
+function isPerKeyMode(opts) {
+	return opts.migrators !== void 0;
+}
+/**
+* A composition's whole database dance in one call: CREATE a fresh database per
+* base name, run the migrate step, and hand back the urls + one `dropAll`. If
+* ANY create or migrate fails, every database already created is dropped before
+* the error rethrows — a failed boot must not leak `ctx_*_<hex8>` litter.
+*/
+async function provisionEphemeralDatabases(opts) {
+	let baseNames;
+	let migrate;
+	if (isPerKeyMode(opts)) {
+		const { migrators } = opts;
+		baseNames = Object.keys(migrators);
+		migrate = async (urls) => {
+			await Promise.all(Object.keys(migrators).map((baseName) => migrators[baseName](urls[baseName])));
+		};
+	} else ({migrate, baseNames} = opts);
+	const settled = await Promise.allSettled(baseNames.map(async (baseName) => ({
+		baseName,
+		db: await createEphemeralDatabase(baseName)
+	})));
+	const created = settled.filter((r) => r.status === "fulfilled").map((r) => r.value);
+	const dropAll = async () => {
+		await Promise.all(created.map(({ db }) => db.drop()));
+	};
+	const failed = settled.find((r) => r.status === "rejected");
+	if (failed) {
+		await dropAll();
+		throw failed.reason;
+	}
+	const urls = Object.fromEntries(created.map(({ baseName, db }) => [baseName, db.url]));
+	try {
+		await migrate(urls);
+	} catch (err) {
+		await dropAll();
+		throw err;
+	}
+	return {
+		dropAll,
+		urls
+	};
+}
+
+//#endregion
+//#region ../slate-bridge/dist/platform-harness-CL-GGo8J.mjs
 const nonEmptyStringSchema = string$5().trim().min(1);
 const portSchema = number$3().int().min(0).max(65535).default(7777);
 const envSchema = object$4({
@@ -97943,7 +98195,7 @@ const envSchema = object$4({
 	CTX_PLATFORM_URL: url().default("http://127.0.0.1:3010").transform((url) => url.replace(/\/+$/, "")),
 	CTX_WEB_URL: url().default("http://localhost:3000").transform((url) => url.replace(/\/+$/, "")),
 	CTXS_BRIDGE_PORT: portSchema,
-	CTXS_CLAUDE_IMAGE: nonEmptyStringSchema.default("ghcr.io/usecontextlayer/ctx-sandbox:0.5.23"),
+	CTXS_CLAUDE_IMAGE: nonEmptyStringSchema.default("ghcr.io/usecontextlayer/ctx-sandbox:0.5.25"),
 	CTXS_CLAUDE_MODEL: nonEmptyStringSchema.default("opus"),
 	CTXS_HOST_CLAUDE_JSON_PATH: nonEmptyStringSchema.default(() => path.join(os.homedir(), ".claude.json")),
 	NODE_ENV: _enum$1([
@@ -97982,7 +98234,6 @@ Do this bookkeeping quietly. Don't narrate routine git operations — mention gi
 The workspace's synced source data — email, meetings, tasks, whatever the user connected — lives in a Postgres database called the base. Query it with the \`ctxb\` CLI, following the contextbase skill. \`CTXB_DATABASE_URL\` is already set when this workspace has a base; if it is unset, no base is connected. Answer data questions from the base, not from memory.`;
 const BUILTIN_ALLOWED_TOOLS = [
 	"Agent",
-	"AskUserQuestion",
 	"Bash",
 	"BashOutput",
 	"Edit",
@@ -98004,6 +98255,7 @@ const BUILTIN_ALLOWED_TOOLS = [
 	"WebSearch",
 	"Write"
 ];
+const BUILTIN_DISALLOWED_TOOLS = ["AskUserQuestion"];
 const CLAUDE_ARGS = [
 	"--input-format",
 	"stream-json",
@@ -98029,12 +98281,13 @@ function resolveChatBaseId(baseIds, workspaceId) {
 }
 function buildChatSpawnPlan(input) {
 	const { allowedTools, disallowedTools } = input.mcpToolRules;
+	const deniedTools = [...BUILTIN_DISALLOWED_TOOLS, ...disallowedTools];
 	return {
 		args: [
 			...CLAUDE_ARGS,
 			"--allowedTools",
 			[...BUILTIN_ALLOWED_TOOLS, ...allowedTools].join(","),
-			...disallowedTools.length > 0 ? ["--disallowedTools", disallowedTools.join(",")] : [],
+			...deniedTools.length > 0 ? ["--disallowedTools", deniedTools.join(",")] : [],
 			...input.mcpConfigArgs ?? [],
 			"--model",
 			input.model,
@@ -98361,16 +98614,9 @@ async function createClaudeMicrosandbox(options) {
 		workdir: options.hostProjectDir
 	});
 	await ensureHostFilesystemReady(bootConfig.bindMounts);
-	const { guestMemory, sandbox } = await bootSandbox(await import("microsandbox"), bootConfig);
-	let disposePromise = null;
+	const { dispose, guestMemory, sandbox } = await bootSandbox(await import("microsandbox"), bootConfig);
 	return {
-		dispose: () => {
-			if (disposePromise === null) {
-				guestMemory.stop();
-				disposePromise = sandbox.stopWithTimeout(SANDBOX_STOP_TIMEOUT_MS);
-			}
-			return disposePromise;
-		},
+		dispose,
 		guestMemory: () => guestMemory.read(),
 		spawn: (spawnOptions) => spawnClaudeProcess(sandbox, spawnOptions)
 	};
@@ -98487,11 +98733,7 @@ function generateSandboxName() {
 }
 const VIEW_NAME = /^[\w-]+$/;
 const EVAL_TIMEOUT_MS = 1e4;
-const RESERVED_STATE_KEYS = [
-	"now",
-	"params",
-	"workspaceId"
-];
+const RESERVED_STATE_KEYS = ["params", "workspaceId"];
 async function runWorkspaceView(opts) {
 	if (!VIEW_NAME.test(opts.view)) throw new Error(`views/run: invalid view name "${opts.view}"`);
 	return runSurfacePair({
@@ -99056,6 +99298,190 @@ async function createBridgeServer(opts) {
 		port: boundPort
 	};
 }
+const REPO_ROOT = path.resolve(fileURLToPath(new URL(".", import.meta.url)), "..", "..", "..");
+const EPHEMERAL_SECRETS_ENCRYPTION_KEY_HEX = "0".repeat(64);
+function platformEnv(extra) {
+	const env = {
+		...process.env,
+		...extra
+	};
+	delete env.CTX_AUTH_SUB_ID;
+	return env;
+}
+const PLATFORM_DATABASES = [
+	"ctx_base_platform",
+	"ctx_pggit",
+	"ctx_secrets",
+	"ctx_slate_platform"
+];
+function toPlatformDatabaseEnv(urls) {
+	return {
+		CTX_BASE_DATABASE_URL: urls.ctx_base_platform,
+		CTX_PGGIT_DATABASE_URL: urls.ctx_pggit,
+		CTX_SECRETS_DATABASE_URL: urls.ctx_secrets,
+		CTX_SECRETS_ENCRYPTION_KEY: EPHEMERAL_SECRETS_ENCRYPTION_KEY_HEX,
+		CTX_SLATE_DATABASE_URL: urls.ctx_slate_platform
+	};
+}
+async function provisionPlatformDatabases() {
+	const provisioned = await provisionEphemeralDatabases({
+		baseNames: PLATFORM_DATABASES,
+		migrate: (urls) => migrateAll(toPlatformDatabaseEnv(urls))
+	});
+	return {
+		databaseEnv: toPlatformDatabaseEnv(provisioned.urls),
+		dropAll: provisioned.dropAll
+	};
+}
+async function migrateAll(databaseEnv) {
+	await runToCompletion([
+		"--filter",
+		"@usecontextlayer/platform",
+		"run",
+		"db.latest"
+	], platformEnv(databaseEnv));
+}
+function runToCompletion(args, env) {
+	return new Promise((resolve, reject) => {
+		const proc = spawn("pnpm", args, {
+			cwd: REPO_ROOT,
+			env,
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			]
+		});
+		let err = "";
+		proc.stderr?.on("data", (c) => {
+			err += c.toString("utf-8");
+		});
+		proc.once("error", reject);
+		proc.once("exit", (code) => code === 0 ? resolve() : reject(/* @__PURE__ */ new Error(`pnpm ${args.join(" ")} exited ${code}\n${err}`)));
+	});
+}
+async function bootPlatform(databaseEnv) {
+	const port = randomInt(2e4, 6e4);
+	const proc = spawn("pnpm", [
+		"--filter",
+		"@usecontextlayer/platform",
+		"run",
+		"start"
+	], {
+		cwd: REPO_ROOT,
+		detached: true,
+		env: platformEnv({
+			...databaseEnv,
+			CTX_AUTH_SKIP_VERIFY_JWT: "true",
+			CTX_PLATFORM_PORT: String(port)
+		}),
+		stdio: [
+			"ignore",
+			"pipe",
+			"pipe"
+		]
+	});
+	proc.stderr?.on("data", (c) => process.stderr.write(c));
+	const exited = new Promise((resolve, reject) => {
+		proc.once("exit", (code) => resolve(code));
+		proc.once("error", reject);
+	});
+	const platformUrl = `http://127.0.0.1:${port}`;
+	const exitedBeforeReady = exited.then((code) => {
+		throw new Error(`platform exited before ready (code ${code})`);
+	});
+	await Promise.race([exitedBeforeReady, waitForHttpReady(`${platformUrl}/doc`, 3e4)]);
+	return {
+		close: async () => {
+			proc.kill("SIGTERM");
+			await exited;
+		},
+		platformUrl
+	};
+}
+async function waitForHttpReady(url, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	let last;
+	while (Date.now() < deadline) {
+		try {
+			const res = await fetch(url, { signal: AbortSignal.timeout(2e3) });
+			if (res.status < 500) return;
+			last = /* @__PURE__ */ new Error(`HTTP ${res.status}`);
+		} catch (e) {
+			last = e;
+		}
+		await new Promise((r) => setTimeout(r, 250));
+	}
+	throw new Error(`${url} not ready in ${timeoutMs}ms (last: ${last instanceof Error ? last.message : String(last)})`);
+}
+async function seedWorkspaceViaSdk(opts) {
+	return (await new SlateAPIClient({
+		environment: opts.platformUrl,
+		...ctxAuthHeaders(() => Promise.resolve(opts.token))
+	}).workspaces.createWorkspace({
+		baseIds: opts.baseIds ?? [],
+		model: opts.model ?? "haiku",
+		name: opts.name ?? "capstone-test",
+		...opts.claudeToken ? { claudeOauthTokenSecret: opts.claudeToken } : {}
+	})).workspaceId;
+}
+strictObject$1({
+	bases: array$1(strictObject$1({
+		base_id: string$5().uuid(),
+		dsn: string$5().min(1),
+		name: string$5().min(1)
+	})),
+	model: string$5().min(1).nullable(),
+	name: string$5().min(1),
+	platform_origin: string$5().min(1),
+	pulled_at: string$5().min(1),
+	slug: string$5().min(1),
+	workspace_id: string$5().uuid()
+});
+async function pushRepo(platformUrl, token, repoId, files) {
+	const base = await mkdtemp(path.join(os.tmpdir(), "seed-push-"));
+	try {
+		const repo = await resolveRepo({
+			platformUrl,
+			repoId,
+			token
+		}, base);
+		if (await remoteHead(repo.remote) !== null) await cloneRepo(repo);
+		for (const [rel, content] of Object.entries(files)) {
+			await mkdir(path.join(repo.hostDir, path.dirname(rel)), { recursive: true });
+			await writeFile(path.join(repo.hostDir, rel), content);
+		}
+		await pushSnapshot(repo, { message: `seed ${repoId}` });
+	} finally {
+		await rm(base, {
+			force: true,
+			recursive: true
+		});
+	}
+}
+async function pushDocsTree(opts) {
+	const repoId = buildRepoId({
+		kind: "workspace",
+		owner: "slate",
+		workspaceId: opts.workspaceId
+	});
+	await pushRepo(opts.platformUrl, opts.token, repoId, opts.files);
+}
+async function pushClaudeHome(opts) {
+	const repoId = buildRepoId({
+		kind: "claude",
+		owner: "slate",
+		userId: opts.userId,
+		workspaceId: opts.workspaceId
+	});
+	await pushRepo(opts.platformUrl, opts.token, repoId, opts.files);
+}
+function turnPrompt(turn) {
+	return typeof turn === "string" ? turn : turn.prompt;
+}
+function turnInterruptPhase(turn) {
+	return typeof turn === "string" ? void 0 : turn.interrupt;
+}
 const PARITY_SCENARIOS = [
 	{
 		name: "text-only",
@@ -99107,6 +99533,13 @@ const PARITY_SCENARIOS = [
 			"Summarize this conversation in one short sentence.",
 			"Reply with exactly one word: bye"
 		]
+	},
+	{
+		name: "interrupted-text",
+		turns: [{
+			interrupt: "text",
+			prompt: "Write a detailed 1500-word essay on the history of the bicycle. Plain prose only, no tools, no lists, no headings."
+		}, "Reply with exactly one word: continued"]
 	}
 ];
 function resolveGoldensDir() {
@@ -99119,45 +99552,96 @@ function resolveGoldensDir() {
 		dir = parent;
 	}
 }
+const keychainClaudeCredentialsSchema = object$4({ claudeAiOauth: object$4({
+	accessToken: string$5().min(1),
+	expiresAt: number$4()
+}) });
+async function resolveClaudeHostCredential() {
+	const exported = process.env.CLAUDE_CODE_OAUTH_TOKEN;
+	if (exported) return {
+		source: "env",
+		token: exported
+	};
+	const raw = await readClaudeCodeCredentialsFromKeychain({ platform: process.platform });
+	if (raw === null) throw new Error("no Claude credentials for the claude tier: export CLAUDE_CODE_OAUTH_TOKEN, or log in to Claude Code on this Mac (the keychain fallback found nothing).");
+	const creds = keychainClaudeCredentialsSchema.parse(JSON.parse(raw));
+	if (creds.claudeAiOauth.expiresAt <= Date.now()) throw new Error("the keychain's Claude Code token has expired: run any claude command to refresh it, or export CLAUDE_CODE_OAUTH_TOKEN.");
+	return {
+		expiresAt: creds.claudeAiOauth.expiresAt,
+		source: "keychain",
+		token: creds.claudeAiOauth.accessToken
+	};
+}
 
 //#endregion
 //#region ../slate-bridge/dist/index.mjs
+const execFileAsync = promisify(execFile);
 async function writeJsonAtomic(filePath, value) {
 	const tmp = `${filePath}.tmp`;
 	await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`);
 	await rename(tmp, filePath);
 }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-function generatorCtxToken() {
-	throw new Error("parity generator: aud=ctx `?token=` source not implemented — the browser-side token mint is unbuilt");
+async function formatScenarioGoldens(scenarioDir) {
+	await execFileAsync(path.join(REPO_ROOT, "node_modules", ".bin", "biome"), [
+		"check",
+		"--write",
+		scenarioDir
+	], { cwd: REPO_ROOT });
+}
+const FIRST_FRAME_BUDGET_MS = 3e5;
+const TURN_SILENCE_BUDGET_MS = 6e4;
+const KNOWN_SCENARIO_NAMES = new Set(PARITY_SCENARIOS.map((scenario) => scenario.name));
+const generateParityGoldensOptionsSchema = strictObject$1({ only: array$1(string$5().refine((name) => KNOWN_SCENARIO_NAMES.has(name), { error: `unknown parity scenario; expected one of: ${[...KNOWN_SCENARIO_NAMES].join(", ")}` })) });
+async function readFinalizedTranscript(sessionId, claudeHomeDir) {
+	const transcriptPath = await findSessionFile(claudeHomeDir, sessionId);
+	if (transcriptPath === null) throw new Error(`[parity] session ${sessionId}: finalized transcript is missing`);
+	return readFile(transcriptPath, "utf-8");
+}
+async function readFinalizedHistory(sessionId, claudeHomeDir) {
+	return getSessionMessages(sessionId, { sessionStore: singleSessionStore(sessionId, parseSessionStoreJsonl(await readFinalizedTranscript(sessionId, claudeHomeDir), "throw")) });
+}
+function transcriptRowText(row) {
+	const message = row.message;
+	if (typeof message !== "object" || message === null) return "";
+	const content = message.content;
+	if (typeof content === "string") return content;
+	if (!Array.isArray(content)) return "";
+	return content.map((block) => typeof block === "object" && block !== null && "text" in block ? String(block.text ?? "") : "").join("\n");
 }
-async function pollHistoryStable(sessionId, rootDir) {
-	const deadline = Date.now() + 3e4;
-	let prev = -1;
-	let stableReads = 0;
-	let history = [];
-	while (Date.now() < deadline) {
-		history = await getSessionMessages(sessionId, { dir: rootDir });
-		if (history.length > 0 && history.length === prev) {
-			stableReads += 1;
-			if (stableReads >= 2) break;
-		} else stableReads = 0;
-		prev = history.length;
-		await sleep(400);
+const INTERRUPT_MARKER = {
+	text: "[Request interrupted by user]",
+	tool: "[Request interrupted by user for tool use]"
+};
+function assertInterruptPersisted(scenario, history) {
+	const phases = new Set(scenario.turns.map(turnInterruptPhase).filter((phase) => phase !== void 0));
+	for (const phase of phases) {
+		const marker = INTERRUPT_MARKER[phase];
+		if (!history.some((row) => transcriptRowText(row).includes(marker))) throw new Error(`[parity] scenario "${scenario.name}": declared interrupt:"${phase}" but the captured transcript carries no ${marker} row — the stream aborted without the transcript recording it`);
+	}
+}
+function isInterruptTrigger(message, phase) {
+	if (phase === "text") return message.type === "stream_event" && message.event.type === "content_block_delta" && message.event.delta.type === "text_delta";
+	return message.type === "user";
+}
+function assertTurnInterruptionOutcome(scenario, turnNumber, result, expectedInterruptPhase) {
+	const where = `[parity] scenario "${scenario.name}" turn ${turnNumber}/${scenario.turns.length}`;
+	if (expectedInterruptPhase === void 0) {
+		if (result.subtype !== "success") throw new Error(`${where} ended with ${result.subtype}: ${result.errors.join("; ")}`);
+		return;
 	}
-	return history;
+	if (result.subtype === "success") throw new Error(`${where} declared interrupt:"${expectedInterruptPhase}" but ended success — the interrupt did not land`);
+	if (result.terminal_reason !== "aborted_streaming" && result.terminal_reason !== "aborted_tools") throw new Error(`${where} declared interrupt:"${expectedInterruptPhase}" but ended ${result.subtype} with terminal_reason ${String(result.terminal_reason)} — that is a failure, not an interrupt`);
 }
-async function captureScenario(server, scenario, rootDir) {
+async function captureScenarioStream(server, scenario, options) {
 	const ac = new AbortController();
 	let iter;
 	try {
-		const workspaceId = crypto.randomUUID();
 		const sessionId = crypto.randomUUID();
-		const url = `ws://127.0.0.1:${server.port}/bridge/workspaces/${workspaceId}/sessions/${sessionId}/wss?token=${encodeURIComponent(generatorCtxToken())}`;
+		const url = `ws://127.0.0.1:${server.port}/bridge/workspaces/${options.workspaceId}/sessions/${sessionId}/wss?token=${encodeURIComponent(options.ctxToken)}`;
 		const queue = [];
 		let resolveNext = null;
 		const pushTurn = (text) => {
-			const msg = {
+			const message = {
 				message: {
 					content: text,
 					role: "user"
@@ -99168,8 +99652,8 @@ async function captureScenario(server, scenario, rootDir) {
 			if (resolveNext) {
 				const resolve = resolveNext;
 				resolveNext = null;
-				resolve(msg);
-			} else queue.push(msg);
+				resolve(message);
+			} else queue.push(message);
 		};
 		async function* promptGen() {
 			while (true) {
@@ -99180,27 +99664,33 @@ async function captureScenario(server, scenario, rootDir) {
 				});
 			}
 		}
-		iter = query({
+		const claudeQuery = query({
 			abortController: ac,
 			prompt: promptGen(),
 			websocket: { url }
 		});
+		iter = claudeQuery;
 		const stream = [];
-		const STALL_MS = 6e4;
-		let nextTurn = 0;
-		const advance = () => {
-			const turn = scenario.turns[nextTurn];
+		let expectedInterruptPhase;
+		let interruptFired = false;
+		let sentTurnCount = 0;
+		const sendNextTurn = () => {
+			const turn = scenario.turns[sentTurnCount];
 			if (turn === void 0) return false;
-			pushTurn(turn);
-			nextTurn += 1;
+			pushTurn(turnPrompt(turn));
+			expectedInterruptPhase = turnInterruptPhase(turn);
+			interruptFired = false;
+			sentTurnCount += 1;
 			return true;
 		};
-		advance();
+		sendNextTurn();
 		let finished = false;
 		while (!finished) {
+			const awaitingFirstFrame = stream.length === 0;
+			const budgetMs = awaitingFirstFrame ? FIRST_FRAME_BUDGET_MS : TURN_SILENCE_BUDGET_MS;
 			let timer;
 			const stalled = new Promise((_resolve, reject) => {
-				timer = setTimeout(() => reject(/* @__PURE__ */ new Error(`[parity] scenario "${scenario.name}": no SDK message for ${STALL_MS}ms awaiting turn ${nextTurn}/${scenario.turns.length} — turn stalled or emitted no result`)), STALL_MS);
+				timer = setTimeout(() => reject(/* @__PURE__ */ new Error(awaitingFirstFrame ? `[parity] scenario "${scenario.name}": no first SDK frame for ${FIRST_FRAME_BUDGET_MS}ms during guest acquisition and boot for turn ${sentTurnCount}/${scenario.turns.length} — a cold OCI image pull is a likely cause` : `[parity] scenario "${scenario.name}": no SDK frame for ${TURN_SILENCE_BUDGET_MS}ms while streaming turn ${sentTurnCount}/${scenario.turns.length} — running turn stalled or emitted no result`)), budgetMs);
 			});
 			let next;
 			try {
@@ -99208,55 +99698,113 @@ async function captureScenario(server, scenario, rootDir) {
 			} finally {
 				if (timer) clearTimeout(timer);
 			}
-			if (next.done) break;
+			if (next.done) throw new Error(`[parity] scenario "${scenario.name}": SDK stream ended while awaiting turn ${sentTurnCount}/${scenario.turns.length}`);
 			stream.push(next.value);
-			if (next.value.type === "result" && !advance()) finished = true;
+			if (expectedInterruptPhase !== void 0 && !interruptFired && isInterruptTrigger(next.value, expectedInterruptPhase)) {
+				interruptFired = true;
+				claudeQuery.interrupt();
+			}
+			if (next.value.type === "result") {
+				assertTurnInterruptionOutcome(scenario, sentTurnCount, next.value, expectedInterruptPhase);
+				if (!sendNextTurn()) finished = true;
+			}
 		}
 		return {
-			history: await pollHistoryStable(sessionId, rootDir),
+			sessionId,
 			stream
 		};
 	} finally {
-		await iter?.return?.(void 0);
-		ac.abort();
+		try {
+			await iter?.return?.(void 0);
+		} finally {
+			ac.abort();
+		}
 	}
 }
-async function generateParityGoldens(opts) {
-	const filter = opts.only?.filter((n) => n.length > 0) ?? [];
-	if (filter.length > 0) {
-		const known = new Set(PARITY_SCENARIOS.map((s) => s.name));
-		const unknown = filter.filter((n) => !known.has(n));
-		if (unknown.length > 0) throw new Error(`[parity] unknown scenario(s): ${unknown.join(", ")}. Known: ${[...known].join(", ")}`);
-	}
-	const selected = filter.length > 0 ? PARITY_SCENARIOS.filter((s) => filter.includes(s.name)) : PARITY_SCENARIOS;
-	for (const scenario of selected) if (scenario.turns.length === 0 || scenario.turns.some((t) => t.trim() === "")) throw new Error(`[parity] scenario "${scenario.name}" has an empty or missing turn`);
-	const goldensDir = resolveGoldensDir();
-	const scenarioRoots = await Promise.all(selected.map(async (scenario) => ({
-		rootDir: await mkdtemp(path.join(os.tmpdir(), `parity-${scenario.name}-`)),
-		scenario
-	})));
-	const server = await createBridgeServer({
-		gitHostBaseDir: env$1.CTX_GIT_HOST_BASE_DIR,
-		hostClaudeJsonPath: env$1.CTXS_HOST_CLAUDE_JSON_PATH,
-		image: env$1.CTXS_CLAUDE_IMAGE,
-		port: 0
+async function seedChatWorkspace(options) {
+	const workspaceId = await seedWorkspaceViaSdk({
+		claudeToken: options.claudeToken,
+		name: options.name,
+		platformUrl: options.platformUrl,
+		token: options.ctxToken
+	});
+	await pushDocsTree({
+		files: { "README.md": `parity scenario workspace: ${options.name}\n` },
+		platformUrl: options.platformUrl,
+		token: options.ctxToken,
+		workspaceId
 	});
+	await pushClaudeHome({
+		files: { ".gitkeep": "" },
+		platformUrl: options.platformUrl,
+		token: options.ctxToken,
+		userId: DEV_IDENTITY.sub,
+		workspaceId
+	});
+	return workspaceId;
+}
+async function generateParityGoldens(options) {
+	const { only: requestedScenarioNames } = generateParityGoldensOptionsSchema.parse(options);
+	const selectedScenarios = requestedScenarioNames.length > 0 ? PARITY_SCENARIOS.filter((scenario) => requestedScenarioNames.includes(scenario.name)) : PARITY_SCENARIOS;
+	for (const scenario of selectedScenarios) if (scenario.turns.length === 0 || scenario.turns.some((turn) => turnPrompt(turn).trim() === "")) throw new Error(`[parity] scenario "${scenario.name}" has an empty or missing turn`);
+	const goldensDir = resolveGoldensDir();
+	const claudeToken = (await resolveClaudeHostCredential()).token;
+	const ctxToken = mintUnsignedCtxToken(DEV_IDENTITY.sub);
+	const { databaseEnv, dropAll } = await provisionPlatformDatabases();
 	try {
-		for (const { rootDir, scenario } of scenarioRoots) {
-			console.log(`[parity] capturing "${scenario.name}" (${scenario.turns.length} turns)…`);
-			const { stream, history } = await captureScenario(server, scenario, rootDir);
-			const dir = path.join(goldensDir, scenario.name);
-			await mkdir(dir, { recursive: true });
-			await writeJsonAtomic(path.join(dir, "stream.json"), stream);
-			await writeJsonAtomic(path.join(dir, "history.json"), history);
-			console.log(`[parity]   ${scenario.name}: stream=${stream.length} msgs, history=${history.length} rows → ${dir}`);
+		const platform = await bootPlatform(databaseEnv);
+		try {
+			const gitHostBaseDir = await mkdtemp(path.join(os.tmpdir(), "parity-git-host-"));
+			try {
+				for (const scenario of selectedScenarios) {
+					console.log(`[parity] capturing "${scenario.name}" (${scenario.turns.length} turns)…`);
+					const workspaceId = await seedChatWorkspace({
+						claudeToken,
+						ctxToken,
+						name: `parity-${scenario.name}`,
+						platformUrl: platform.platformUrl
+					});
+					const server = await createBridgeServer({
+						gitHostBaseDir,
+						hostClaudeJsonPath: env$1.CTXS_HOST_CLAUDE_JSON_PATH,
+						image: env$1.CTXS_CLAUDE_IMAGE,
+						platformUrl: platform.platformUrl,
+						port: 0,
+						verify: createDevJwtVerifier()
+					});
+					const { sessionId, stream } = await captureScenarioStream(server, scenario, {
+						ctxToken,
+						workspaceId
+					}).finally(() => server.close());
+					const history = await readFinalizedHistory(sessionId, (await resolveRepo({
+						platformUrl: platform.platformUrl,
+						repoId: buildRepoId({
+							kind: "claude",
+							owner: "slate",
+							userId: DEV_IDENTITY.sub,
+							workspaceId
+						}),
+						token: ctxToken
+					}, gitHostBaseDir)).hostDir);
+					assertInterruptPersisted(scenario, history);
+					const scenarioDir = path.join(goldensDir, scenario.name);
+					await mkdir(scenarioDir, { recursive: true });
+					await writeJsonAtomic(path.join(scenarioDir, "stream.json"), stream);
+					await writeJsonAtomic(path.join(scenarioDir, "history.json"), history);
+					await formatScenarioGoldens(scenarioDir);
+					console.log(`[parity]   ${scenario.name}: stream=${stream.length} msgs, history=${history.length} rows → ${scenarioDir}`);
+				}
+			} finally {
+				await rm(gitHostBaseDir, {
+					force: true,
+					recursive: true
+				});
+			}
+		} finally {
+			await platform.close();
 		}
 	} finally {
-		await server.close();
-		await Promise.all(scenarioRoots.map(({ rootDir }) => rm(rootDir, {
-			force: true,
-			recursive: true
-		})));
+		await dropAll();
 	}
 }
 
@@ -103177,7 +103725,7 @@ function createProgram() {
 	program.command("bridge").description("Slate bridge commands").command("start").description("Start the slate bridge server in the foreground, bound to localhost on CTXS_BRIDGE_PORT (default 7777). Authenticates each connection's aud=ctx user token and resolves its workspace + credentials from the platform (CTX_WEB_URL verifies the token, CTX_PLATFORM_URL serves the plan + base DSN); serves the render endpoints + the per-session WebSocket that spawns claude inside a microsandbox sandbox. Blocks until SIGINT/SIGTERM.").action(async () => {
 		await createBridgeServer({});
 	});
-	program.command("parity").description("Translator parity golden tooling (dev/maintainer)").command("generate [scenarios...]").description("Drive scripted multi-turn conversations through the real bridge + microsandbox + claude and (re)write the parity goldens consumed by slate-shared's parity test. Pass scenario names to capture only those (others keep their existing goldens); omit to regenerate all. Dev tool: needs local claude auth and the microsandbox runtime. Run from source ('node --import tsx cli.ts parity generate [names...]').").action(async (scenarios) => {
+	program.command("parity").description("Translator parity golden tooling (dev/maintainer)").command("generate [scenarios...]").description("Drive scripted multi-turn conversations through the real bridge + microsandbox + claude and (re)write the parity goldens consumed by slate-shared's parity test. Pass scenario names to capture only those (others keep their existing goldens); omit to regenerate all. Consumes real Claude usage and requires local Claude auth, the microsandbox runtime, a pullable guest image, the host Claude trust file, and local dev Postgres. Never run from a gate.").action(async (scenarios) => {
 		await generateParityGoldens({ only: scenarios });
 	});
 	program.command("sandbox").allowUnknownOption(true).allowExcessArguments(true).argument("[command...]", "Command + args to run in the guest (default: uname -a)").requiredOption("--image <ref>", "Guest image to boot in the microVM").description("Boot a microsandbox microVM from --image, run a command inside it, print its output, and tear it down. A DB-free check that the host can boot guest microVMs (/dev/kvm in a container; HVF on macOS).").action(async (command, options) => {
@@ -103203,4 +103751,4 @@ runCli().catch((error) => {
 //#endregion
 export { createProgram, runCli };
 //# sourceMappingURL=cli.mjs.map
-//# debugId=5c792d56-554a-5d58-8c1b-518f322339f4
+//# debugId=3205b84e-0fd0-5843-a715-326779c52b1a